@cupel-sh/cli 0.8.1 → 0.9.0

package/bundle/cli.js

@@ -1,55 +1,666 @@
 #!/usr/bin/env node
-import{randomBytes as Yd}from"node:crypto";import{readFileSync as zy,renameSync as Wy,writeFileSync as Jd}from"node:fs";import Vy from"node:path";import{fileURLToPath as qy}from"node:url";var Qd=/^(\d{1,10})\.(\d{1,10})\.(\d{1,10})$/u;function ec(e){let n=Qd.exec(e);return n===null?null:{kind:"npm",release:[Number(n[1]),Number(n[2]),Number(n[3])]}}function nc(e,n){for(let t=0;t<3;t+=1){let o=e.release[t]??0,r=n.release[t]??0;if(o!==r)return o<r?-1:1}return 0}var tc=/^v?(?:(?<epoch>[0-9]+)!)?(?<release>[0-9]+(?:\.[0-9]+)*)(?:[-_.]?(?<preL>a|b|c|rc|alpha|beta|pre|preview)[-_.]?(?<preN>[0-9]+)?)?(?:(?:-(?<postImplicit>[0-9]+))|(?:[-_.]?(?<postL>post|rev|r)[-_.]?(?<postN>[0-9]+)?))?(?:[-_.]?(?<devL>dev)[-_.]?(?<devN>[0-9]+)?)?(?:\+(?<local>[a-z0-9]+(?:[-_.][a-z0-9]+)*))?$/u,oc={a:"a",alpha:"a",b:"b",beta:"b",c:"rc",pre:"rc",preview:"rc",rc:"rc"};function Qn(e){if(e===void 0)return null;let n=Number(e);return Number.isSafeInteger(n)?n:null}function rc(e){let n=tc.exec(e.toLowerCase());if(n===null||n.groups===void 0)return null;let t=n.groups,o=(t.release??"").split(".");if(o.length===0||o.length>32)return null;let r=[];for(let u of o){let p=Qn(u);if(p===null)return null;r.push(p)}let s=0;if(t.epoch!==void 0){let u=Qn(t.epoch);if(u===null)return null;s=u}let a=null;if(t.preL!==void 0){let u=t.preN===void 0?0:Qn(t.preN);if(u===null)return null;a=[oc[t.preL]??t.preL,u]}let l=null;if(t.postImplicit!==void 0){let u=Qn(t.postImplicit);if(u===null)return null;l=u}else if(t.postL!==void 0){let u=t.postN===void 0?0:Qn(t.postN);if(u===null)return null;l=u}let i=null;if(t.devL!==void 0){let u=t.devN===void 0?0:Qn(t.devN);if(u===null)return null;i=u}let d=t.local===void 0?null:t.local.split(/[-_.]/u).map(u=>/^[0-9]+$/u.test(u)?Number(u):u);return{kind:"PyPI",epoch:s,release:r,pre:a,post:l,dev:i,local:d}}function et(e,n){return e===n?0:e<n?-1:1}function Us(e){let n=e.length;for(;n>1&&e[n-1]===0;)n-=1;return e.slice(0,n)}function sc(e,n){let t=Us(e),o=Us(n),r=Math.max(t.length,o.length);for(let s=0;s<r;s+=1){let a=et(t[s]??0,o[s]??0);if(a!==0)return a}return 0}function zs(e){return e.pre!==null?0:e.post===null&&e.dev!==null?-1:1}function ic(e,n){let t=zs(e),o=zs(n);return t!==o?t<o?-1:1:t!==0||e.pre===null||n.pre===null?0:e.pre[0]!==n.pre[0]?e.pre[0]<n.pre[0]?-1:1:et(e.pre[1],n.pre[1])}function ac(e,n){return e===null&&n===null?0:e===null?-1:n===null?1:et(e,n)}function lc(e,n){return e===null&&n===null?0:e===null?1:n===null?-1:et(e,n)}function dc(e,n){let t=typeof e=="number",o=typeof n=="number";return t&&o?et(e,n):!t&&!o?e===n?0:e<n?-1:1:t?1:-1}function cc(e,n){if(e===null&&n===null)return 0;if(e===null)return-1;if(n===null)return 1;let t=Math.max(e.length,n.length);for(let o=0;o<t;o+=1){let r=e[o],s=n[o];if(r===void 0)return-1;if(s===void 0)return 1;let a=dc(r,s);if(a!==0)return a}return 0}function uc(e,n){let t=et(e.epoch,n.epoch);if(t!==0)return t;let o=sc(e.release,n.release);if(o!==0)return o;let r=ic(e,n);if(r!==0)return r;let s=ac(e.post,n.post);if(s!==0)return s;let a=lc(e.dev,n.dev);return a!==0?a:cc(e.local,n.local)}function fc(e,n){if(typeof n!="string"||n.length===0||n.length>256)return null;let t=e==="npm"?ec(n):rc(n);return t===null?null:{ecosystem:e,raw:n,parsed:t}}function gt(e,n){let t=fc(e,n);if(t===null)throw new Error(`not a valid ${e} version: ${JSON.stringify(n)}`);return t}function Qt(e,n){if(e.ecosystem!==n.ecosystem)throw new Error(`cannot compare ${e.ecosystem} with ${n.ecosystem}`);if(e.parsed.kind==="npm"&&n.parsed.kind==="npm")return nc(e.parsed,n.parsed);if(e.parsed.kind==="PyPI"&&n.parsed.kind==="PyPI")return uc(e.parsed,n.parsed);throw new Error("unreachable: ecosystem/parsed mismatch")}function Ws(e,n,t){let o=gt(e,n);return!(t.introduced!=="0"&&Qt(o,gt(e,t.introduced))<0||t.fixed!==void 0&&Qt(o,gt(e,t.fixed))>=0||t.lastAffected!==void 0&&Qt(o,gt(e,t.lastAffected))>0)}var Ho=["no-entrypoint","dynamic-load","resolution-divergence","analysis-cap","dep-opaque"];function Fn(e,n){return Ws(n.ecosystem??"npm",e,n)}function eo(e,n,t){let o=new Map(e.functions.map(l=>[l.id,l])),r=new Map(e.classes.map(l=>[l.id,l.name])),s=new Map(e.callSites.map(l=>[l.id,l])),a=[];for(let l of e.callEdges){if(l.resolution!=="resolved"&&l.resolution!=="field-based")continue;let i=s.get(l.callSiteId);if(i===void 0)continue;let d=o.get(i.enclosingFunctionId);if(d===void 0||!t.has(d.moduleId))continue;let u=n.get(d.moduleId);if(u===void 0)continue;let p=o.get(l.calleeFunctionId);if(p===void 0||p.name===void 0)continue;let f=n.get(p.moduleId);f!==void 0&&f.packageName!==u.packageName&&a.push({packageName:f.packageName,exportName:p.name,container:p.enclosingClassId!==void 0?r.get(p.enclosingClassId)??null:null,resolution:l.resolution})}return a}function pc(e,n){return(e.get(n)??[]).filter(t=>t.status==="summarized").slice().sort((t,o)=>t.analyzedVersion<o.analyzedVersion?1:t.analyzedVersion>o.analyzedVersion?-1:0)}function mc(e,n,t){return e.target.kind!=="symbol"||t!==n.packageName?!1:e.target.exportName===n.exportName&&e.target.container===n.container&&e.target.symbolKind===n.symbolKind}function Vs(e,n,t,o,r,s){if(s<=0)return null;let a=null,l=i=>{(a===null||i.hops<a.hops)&&(a=i)};for(let i of pc(e,n))for(let d of i.edges){if(d.entryExport!==t||d.entryContainer!==o)continue;if(mc(d,r,i.packageName)){l({viaPackages:[],hops:d.hops,provenance:{tool:i.tool,toolVersion:i.toolVersion,analyzedVersion:i.analyzedVersion}});continue}if(d.target.kind!=="dep")continue;let u=Vs(e,d.target.calleePackage,d.target.calleeExport,null,r,s-1);u!==null&&l({viaPackages:[d.target.calleePackage,...u.viaPackages],hops:d.hops+u.hops,provenance:u.provenance})}return a}function Xo(e,n,t,o,r,s){let a=null;for(let l of eo(e,n,t)){let i=Vs(r,l.packageName,l.exportName,l.container,o,s);i!==null&&(a===null||i.hops<a.totalHops)&&(a={tier:"reachable-low",anchorPackage:l.packageName,entryExport:l.exportName,viaPackages:i.viaPackages,totalHops:i.hops,provenance:i.provenance})}return a}function yt(e){switch(e){case"all-resolved":return"reachable-high";case"field-based":return"reachable-medium";case"modeled":return"reachable-low"}}function nt(e){let n=new Map;for(let t of e.modules)n.set(t.id,t);return n}function Yo(e){let n=new Map,t=new Map(e.imports.map(o=>[o.id,o]));for(let o of e.importEdges){let r=t.get(o.importId);if(r===void 0)continue;let s=n.get(r.moduleId)??[];s.push(o.resolvedModuleId),n.set(r.moduleId,s)}return n}function hc(e){let n=new Map,t=new Map(e.imports.map(o=>[o.id,o]));for(let o of e.importEdges){let r=t.get(o.importId);if(r===void 0)continue;let s=n.get(o.resolvedModuleId)??[];s.push(r.moduleId),n.set(o.resolvedModuleId,s)}return n}function dn(e){let n=Yo(e),t=new Set,o=e.modules.filter(r=>r.isEntrypoint).map(r=>r.id);for(;o.length>0;){let r=o.pop();if(!(r===void 0||t.has(r))){t.add(r);for(let s of n.get(r)??[])t.has(s)||o.push(s)}}return t}function gc(e,n){let t=hc(e),o=new Set,r=[n];for(;r.length>0;){let s=r.pop();if(!(s===void 0||o.has(s))){o.add(s);for(let a of t.get(s)??[])o.has(a)||r.push(a)}}return o}function yc(e,n,t){let o=Yo(e),r=nt(e),s=new Set,a=[n];for(;a.length>0;){let l=a.pop();if(l===void 0||s.has(l))continue;s.add(l);let i=r.get(l);if(i===void 0||i.externalSurface===!0||t.has(l))return!0;for(let d of o.get(l)??[])s.has(d)||a.push(d)}return!1}function xt(e,n,t,o=new Set){let r=Yo(e),s=nt(e),a=new Set,l=[],i=[n];for(;i.length>0;){let d=i.pop();if(d===void 0||a.has(d))continue;a.add(d);let u=s.get(d);if(u===void 0){l.push({module:d,kind:"absent"});continue}if(t.has(d)){l.push({module:d,kind:"unbounded"});continue}if(u.externalSurface===!0&&!o.has(d)){l.push({module:d,kind:"surface"});continue}for(let p of r.get(d)??[])a.has(p)||i.push(p)}return l}function xc(e){let n=new Set(e.modules.filter(a=>a.isEntrypoint).map(a=>a.id)),t=new Map(e.functions.map(a=>[a.id,a])),o=nt(e),r=new Map;for(let a of e.functions)n.has(a.moduleId)&&(a.publicSurfaceReachable||a.name==="<toplevel>")&&r.set(a.id,a);let s=new Map(e.exports.map(a=>[a.id,a]));for(let a of e.exportBindings){if(a.target.kind!=="function")continue;let l=s.get(a.exportId);if(l===void 0||!n.has(l.moduleId))continue;let i=t.get(a.target.functionId);i===void 0||o.get(i.moduleId)?.externalSurface===!0||r.set(i.id,i)}return[...r.values()]}function Gs(e){let n="node_modules/",t=e.lastIndexOf(n);if(t===-1)return e;let r=e.slice(t+n.length).split("/"),s=r[0]?.startsWith("@")===!0?2:1;return r.slice(s).join("/")}function Sc(e,n,t){if(t.symbolKind==="accessor"||t.symbolKind==="pattern")return;let o=t.symbolKind==="method"||t.symbolKind==="ctor",r=new Map(e.classes.map(s=>[s.id,s]));return e.functions.find(s=>{if(s.name!==t.exportName)return!1;let a=n.get(s.moduleId);if(a===void 0||a.packageName!==t.packageName)return!1;if(o){if(s.kind!==t.symbolKind||s.enclosingClassId===void 0||r.get(s.enclosingClassId)?.name!==t.container)return!1}else if(s.kind!=="function")return!1;return a.externalSurface===!0?!0:Gs(a.path)===t.sourcePath})}function qs(e,n){return e.modules.find(t=>t.externalSurface!==!0&&t.packageName===n.packageName&&Gs(t.path)===n.sourcePath)}function bc(e,n,t,o){let r=new Map(e.functions.map(s=>[s.id,s]));return e.callSites.some(s=>s.calleeExprShape!=="member"||s.resolution!=="resolved"?!1:s.resolvedTargetIds.some(a=>{let l=r.get(a);if(l?.name!==o.exportName)return!1;let i=n.get(l.moduleId);return i?.externalSurface===!0&&i.packageName===o.packageName&&t.has(l.moduleId)}))}function kc(e,n,t){return t.container===null?!0:e.classes.some(o=>{if(o.name!==t.container)return!1;let r=n.get(o.moduleId);return r!==void 0&&r.packageName===t.packageName&&r.externalSurface!==!0})}function Ec(e,n,t){let o=new Map(e.callSites.map(i=>[i.id,i.enclosingFunctionId])),r=new Map;for(let i of e.callEdges){let d=o.get(i.callSiteId);if(d===void 0)continue;let u=r.get(d)??[];u.push({to:i.calleeFunctionId,res:i.resolution}),r.set(d,u)}let s=i=>{let d=new Set,u=n.map(p=>({id:p.id,prev:null}));for(let p of u)d.add(p.id);for(;u.length>0;){let p=u.shift();if(p===void 0)break;if(p.id===t){let f=[];for(let m=p;m!==null;m=m.prev)f.unshift(m.id);return f}for(let f of r.get(p.id)??[])f.res!=="unresolved"&&(f.res==="field-based"&&!i||d.has(f.to)||(d.add(f.to),u.push({id:f.to,prev:p})))}return null},a=s(!1);if(a!==null)return{path:a,usedFieldBased:!1};let l=s(!0);return l!==null?{path:l,usedFieldBased:!0}:null}function Jo(e){return Hs(e,nt(e),dn(e),Xs(e))}function Hs(e,n,t,o){let r=[],s=[],a=new Map(e.functions.map(i=>[i.id,i.moduleId])),l=i=>i!==void 0&&t.has(i)&&o.has(n.get(i)?.packageName??"");for(let i of e.callSites)i.resolution==="unresolved"&&l(a.get(i.enclosingFunctionId))&&r.push(i.range);for(let i of e.imports)!i.specifierIsLiteral&&t.has(i.moduleId)&&s.push({path:n.get(i.moduleId)?.path??"",start:0,end:0});return{dispatch:r,load:s}}function Xs(e){return new Set(e.modules.filter(n=>n.isEntrypoint).map(n=>n.packageName))}function wc(e,n){let t=new Map(e.functions.map(r=>[r.id,r])),o=nt(e);return n.map(r=>{let s=t.get(r),a=s!==void 0?o.get(s.moduleId):void 0;return{functionId:r,functionName:s?.name,modulePath:a?.path??""}})}function Zo(e){let{graph:n,installed:t,range:o,symbol:r,coverage:s}=e,a=[],l={unresolvedSites:a,unresolvedEvidence:{own:a,sets:[]}},i=U=>({unresolvedSites:U,unresolvedEvidence:{own:U,sets:[]}}),d=Xs(n),u=new Set;for(let U of e.incompleteness)U.reach.kind==="unbounded"&&u.add(U.source);let p=e.incompleteness.some(U=>U.reach.kind==="assumed-bounded")?"loader-assumption":"complete",f=U=>U==="not-reachable"?p:void 0,m=new Map,g=U=>{let X=m.get(U);return X===void 0&&(X=yc(n,U,u),m.set(U,X)),X},y=U=>U.reach.kind==="class-scope"&&r!==null&&r.packageName===U.reach.packageName&&r.container===U.reach.container,b=U=>{if(e.analysisAborted!==null)return{cause:e.analysisAborted,source:null};for(let X of Ho)for(let D of e.incompleteness)if(D.cause===X&&U(D))return{cause:D.cause,source:D.source};return null},x=U=>{let X;return b(D=>D.reach.kind==="unbounded"?!0:D.reach.kind==="class-scope"?y(D):U===void 0||g(D.reach.anchor)?!0:(X??=gc(n,U),X.has(D.reach.anchor)))},I=()=>b(U=>U.reach.kind==="unbounded"?!0:U.reach.kind==="class-scope"?y(U):g(U.reach.anchor));if(t===null)return{tier:"not-affected",decidedAtStage:"presence",reason:`${o.packageName} is not installed`,unknownKind:void 0,attribution:void 0,basis:f("not-affected"),path:void 0,...l};let w;try{if((t.ecosystem??"npm")!==(o.ecosystem??"npm"))throw new Error("ecosystem mismatch");w=Fn(t.version,o)}catch{return{tier:"unknown",decidedAtStage:"version-match",reason:`cannot compare version ${JSON.stringify(t.version)} against the advisory range`,unknownKind:"version-undecidable",attribution:void 0,basis:f("unknown"),path:void 0,...l}}if(!w)return{tier:"not-affected",decidedAtStage:"version-match",reason:`${o.packageName}@${t.version} is outside the affected range`,unknownKind:void 0,attribution:void 0,basis:f("not-affected"),path:void 0,...l};let A=nt(n),k=dn(n),h=U=>{if(U.cause!=="dynamic-load"||U.source===null)return a;let X=A.get(U.source);return X===void 0?a:[{path:X.path,start:0,end:0}]},{dispatch:S,load:_}=Hs(n,A,k,d),P=[...S,..._],v={unresolvedSites:_,unresolvedEvidence:{own:a,sets:["load"]}},T={unresolvedSites:P,unresolvedEvidence:{own:a,sets:["dispatch","load"]}},N=U=>{for(let X of k)if(A.get(X)?.packageName===U)return!0;return!1},j=U=>({tier:"unknown",decidedAtStage:U,reason:`${r?.exportName??"the certified symbols"} not reached from the application's entrypoints, but the advisory's symbol set is known to be incomplete (surface_complete=0) \u2014 a symbol cupel could not name may be reached; cannot confirm it is unreachable`,unknownKind:"incomplete-surface",attribution:void 0,basis:f("unknown"),path:void 0,...l}),O=()=>{if(!N(o.packageName)){if(_.length>0)return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${o.packageName} is not statically loaded, but a dynamic module load (a non-literal require/import) could pull it`,unknownKind:"dynamic-load",attribution:void 0,basis:f("unknown"),path:void 0,...v};let U=I();return U!==null?{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${o.packageName} is not statically loaded, but an incompleteness fact (loader escape / analysis cap / opaque module) could hide a load \u2014 cannot confirm it is unreachable`,unknownKind:U.cause,attribution:void 0,basis:f("unknown"),path:void 0,...i(h(U))}:t!==null&&t.outOfGraphExecution.length>0?{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${o.packageName} is never loaded from the application's entrypoints, but it can still execute outside the module graph (${t.outOfGraphExecution.join(", ")}) \u2014 "not loaded as a module" is not "not executed"`,unknownKind:"analysis-cap",attribution:void 0,basis:f("unknown"),path:void 0,...l}:{tier:"not-reachable",decidedAtStage:"symbol-reachable",reason:t?.devOnly===!0?`${o.packageName} is not reachable at runtime \u2014 installed as a dev-only dependency and never loaded from the application's entrypoints (assumes no dependency loader loads it); still a build-time exposure`:`${o.packageName} is installed but never loaded from the application's entrypoints (no static import, no dynamic load, corridor complete)`,unknownKind:void 0,attribution:void 0,basis:f("not-reachable"),path:void 0,...l}}return null};if(r===null||!r.verified)return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:r===null?"no derived vulnerable symbol for this advisory (package-level only)":"vulnerable symbol is unverified; cannot claim reachability",unknownKind:r===null?"db-gap":"unverified-symbol",attribution:void 0,basis:f("unknown"),path:void 0,...T};if(s!==null&&!s.comparedPaths.has(r.sourcePath))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`derivation did not cover ${r.sourcePath}; symbol reachability undetermined`,unknownKind:"db-gap",attribution:void 0,basis:f("unknown"),path:void 0,...T};if(r.symbolKind==="accessor"||r.symbolKind==="pattern")return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${r.exportName} is a ${r.symbolKind} symbol; call-graph reachability is not evaluated`,unknownKind:"symbol-unsupported",attribution:void 0,basis:f("unknown"),path:void 0,...T};let F=Sc(n,A,r);if(F===void 0||!k.has(F.moduleId)){if(F===void 0&&(r.symbolKind==="method"||r.symbolKind==="ctor")&&bc(n,A,k,r))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${r.exportName} may be a static method reached via an ambiguous package-surface member call`,unknownKind:"dep-opaque",attribution:void 0,basis:f("unknown"),path:void 0,...T};if(F===void 0&&(r.symbolKind==="method"||r.symbolKind==="ctor")&&!kc(n,A,r))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${r.exportName} is a method of the dependency class ${r.container??"?"}, whose body cupel does not analyze \u2014 a sibling method may reach it through an internal edge`,unknownKind:"dep-opaque",attribution:void 0,basis:f("unknown"),path:void 0,...T};let U=O();if(U!==null)return U;if(P.length>0){let C=F!==void 0?A.get(F.moduleId):qs(n,r),H=F===void 0&&C!==void 0&&C.externalSurface!==!0&&k.has(C.id)&&!d.has(C.packageName);return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${r.exportName} not statically reached, but unresolved dynamic access exists`,unknownKind:_.length>0?"dynamic-load":H?"dep-opaque":"dispatch",attribution:void 0,basis:f("unknown"),path:void 0,...T}}let X=F!==void 0?A.get(F.moduleId):qs(n,r);if(F===void 0&&X!==void 0&&X.externalSurface!==!0&&k.has(X.id)&&!d.has(X.packageName))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${r.exportName} is in a loaded dependency module whose bodies are not analyzed (bodyless CJS/member-export surface) \u2014 cannot confirm it is unreachable`,unknownKind:"dep-opaque",attribution:void 0,basis:f("unknown"),path:void 0,...l};let D=X!==void 0?x(X.id):I();return D!==null?{tier:"unknown",decidedAtStage:F===void 0?"symbol-reachable":"module-reachable",reason:`${r.exportName} not statically reached, but an incompleteness fact can hide a path to its corridor \u2014 cannot confirm it is unreachable`,unknownKind:D.cause,attribution:void 0,basis:f("unknown"),path:void 0,...i(h(D))}:o.surfaceComplete?{tier:"not-reachable",decidedAtStage:F===void 0?"symbol-reachable":"module-reachable",reason:`${r.exportName} is never reached from the application's entrypoints`,unknownKind:void 0,attribution:void 0,basis:f("not-reachable"),path:void 0,...l}:j(F===void 0?"symbol-reachable":"module-reachable")}let K=Ec(n,xc(n),F.id);if(K!==null)return{tier:yt(K.usedFieldBased?"field-based":"all-resolved"),decidedAtStage:"call-path-confirmed",reason:`${r.exportName} is called from an application entrypoint`,unknownKind:void 0,attribution:no(r),basis:f("reachable-high"),path:wc(n,K.path),...l};if(P.length>0)return{tier:"unknown",decidedAtStage:"call-path-confirmed",reason:`no resolved call path to ${r.exportName}, but unresolved edges exist`,unknownKind:_.length>0?"dynamic-load":"dispatch",attribution:void 0,basis:f("unknown"),path:void 0,...T};let te=x(F.moduleId);return te!==null?{tier:"unknown",decidedAtStage:"call-path-confirmed",reason:`no resolved call path to ${r.exportName}, but an incompleteness fact can hide a path to its corridor \u2014 cannot confirm it is uncalled`,unknownKind:te.cause,attribution:void 0,basis:f("unknown"),path:void 0,...i(h(te))}:o.surfaceComplete?{tier:"not-reachable",decidedAtStage:"call-path-confirmed",reason:`${r.exportName} is imported but never called from an entrypoint`,unknownKind:void 0,attribution:void 0,basis:f("not-reachable"),path:void 0,...l}:j("call-path-confirmed")}function vc(e,n){return e.packageName===n.packageName&&e.exportName===n.exportName&&e.container===n.container}function Ic(e,n,t){let o=new Map(e.classes.map(r=>[r.id,r.name]));for(let r of e.functions){if(r.name!==t.exportName)continue;let s=n.get(r.moduleId);if(!(s===void 0||s.packageName!==t.packageName||(r.enclosingClassId!==void 0?o.get(r.enclosingClassId)??null:null)!==t.container))return r.id}return null}function Ac(e,n,t){if(n===t)return[];let o=new Map(e.functions.map(i=>[i.id,i])),r=new Map(e.callSites.map(i=>[i.id,i])),s=new Map;for(let i of e.callEdges){if(i.resolution!=="resolved"&&i.resolution!=="field-based")continue;let d=r.get(i.callSiteId);if(d===void 0)continue;let u=d.enclosingFunctionId;if(!o.has(u)||!o.has(i.calleeFunctionId))continue;let p=s.get(u),f={to:i.calleeFunctionId,label:i.resolution};p===void 0?s.set(u,[f]):p.push(f)}let a=new Set([n]),l=[{at:n,labels:[]}];for(let i=0;i<l.length;i++){let d=l[i];for(let u of s.get(d.at)??[]){if(a.has(u.to))continue;let p=[...d.labels,u.label];if(u.to===t)return p;a.add(u.to),l.push({at:u.to,labels:p})}}return null}function St(e,n,t,o,r){if(r.length===0)return null;let s=eo(e,n,t);if(s.length===0)return null;let a=Ic(e,n,o);for(let l of r){let i=s.filter(u=>u.packageName===l.anchor.packageName&&u.exportName===l.anchor.exportName&&u.container===l.anchor.container),d=i.find(u=>u.resolution==="resolved")??i[0];if(d!==void 0){if(vc(l.callee,o))return{tier:yt("modeled"),modelId:l.modelId,anchorPackage:l.anchor.packageName,entryExport:l.anchor.exportName,pathLabels:[d.resolution,"modeled"]};if(l.callee.realFunctionId!==null&&a!==null){let u=Ac(e,l.callee.realFunctionId,a);if(u!==null)return{tier:yt("modeled"),modelId:l.modelId,anchorPackage:l.anchor.packageName,entryExport:l.anchor.exportName,pathLabels:[d.resolution,"modeled",...u]}}}}return null}var Ys=["presence","version-match","module-reachable","symbol-reachable","call-path-confirmed"],Js=["not-affected","not-reachable","reachable-high","reachable-medium","reachable-low","unknown"];function no(e){return e.verified?"gated":"candidate"}var Qo=["no-entrypoint","analyzer-crash","version-undecidable","db-gap","unverified-symbol","symbol-unsupported","dep-opaque","dynamic-load","dispatch","resolution-divergence","analysis-cap","coverage-gap","incomplete-surface"],er=["cupel","project"],qe={"no-entrypoint":"project","dynamic-load":"project",dispatch:"project","analyzer-crash":"cupel","version-undecidable":"cupel","db-gap":"cupel","unverified-symbol":"cupel","symbol-unsupported":"cupel","dep-opaque":"cupel","resolution-divergence":"cupel","analysis-cap":"cupel","coverage-gap":"cupel","incomplete-surface":"cupel"};function Zs(e){return qe[e]}import{randomBytes as Yl}from"node:crypto";import{mkdirSync as Jl,readdirSync as td,readFileSync as Wh,realpathSync as Wt,renameSync as Zl,statSync as ms,writeFileSync as Ql}from"node:fs";import mn from"node:path";import{createRequire as _c}from"node:module";var Nc=_c(import.meta.url);function Rc(){try{return Nc("node:sqlite")}catch{throw new Error("node:sqlite is unavailable on this runtime (needs Node >= 22.13, or 24+). See ADR-013.")}}function Pc(e){return{all:n=>n===void 0?e.all():e.all(n),get:n=>n===void 0?e.get():e.get(n),run:n=>n===void 0?e.run():e.run(n)}}var to={open(e,n){let{DatabaseSync:t}=Rc(),o=n==="readonly"?new t(e,{readOnly:!0}):new t(e);return n==="readonly"?o.exec("PRAGMA query_only = ON;"):o.exec("PRAGMA journal_mode = DELETE;"),{exec:r=>o.exec(r),prepare:r=>Pc(o.prepare(r)),close:()=>o.close()}}};function Ae(e){return typeof e=="string"?e:typeof e=="number"||typeof e=="bigint"?String(e):""}function Ee(e){return typeof e=="string"?e:null}function cn(e){return typeof e=="number"?e:typeof e=="bigint"?Number(e):null}var $c=`
+var G={"extract.py":`None
+
+import ast
+import json
+import sys
+
+MAX_BYTES = 2 * 1024 * 1024
+MAX_NODES = 200_000
+MAX_PER_KIND = 20_000
+MAX_NAME_CHARS = 512
+
+
+def dotted(node):
+    None
+    parts = []
+    while isinstance(node, ast.Attribute):
+        parts.append(node.attr)
+        node = node.value
+    if not isinstance(node, ast.Name):
+        return None
+    parts.append(node.id)
+    name = ".".join(reversed(parts))
+    return name if len(name) <= MAX_NAME_CHARS else None
+
+
+_LINE_STARTS = [0]
+
+
+def set_line_starts(raw):
+    None
+    global _LINE_STARTS
+    starts = [0]
+    for i, b in enumerate(raw):
+        if b == 0x0A:
+            starts.append(i + 1)
+    _LINE_STARTS = starts
+
+
+def _offset(line, col):
+    if line is None or line < 1 or line > len(_LINE_STARTS):
+        return 0
+    return _LINE_STARTS[line - 1] + (col or 0)
+
+
+def rng(node):
+    None
+    line = getattr(node, "lineno", 0)
+    end_line = getattr(node, "end_lineno", None) or line
+    col = getattr(node, "col_offset", 0)
+    return {
+        "line": line,
+        "endLine": end_line,
+        "col": col,
+        "start": _offset(line, col),
+        "end": _offset(end_line, getattr(node, "end_col_offset", 0)),
+    }
+
+
+_SEQ_CALLS = ("frozenset", "set", "tuple", "list")
+
+
+def string_list(node):
+    None
+    if isinstance(node, ast.Call) and not node.keywords and len(node.args) == 1:
+        callee = node.func.id if isinstance(node.func, ast.Name) else None
+        return string_list(node.args[0]) if callee in _SEQ_CALLS else None
+    if not isinstance(node, (ast.List, ast.Tuple, ast.Set)):
+        return None
+    out = []
+    for elt in node.elts:
+        if not (isinstance(elt, ast.Constant) and isinstance(elt.value, str)):
+            return None
+        out.append(elt.value)
+    return sorted(out) if isinstance(node, ast.Set) else out
+
+
+FUNCTION_NODES_X = (ast.FunctionDef, ast.AsyncFunctionDef)
+
+
+def is_sys_modules_read(node):
+    None
+    if not isinstance(node, ast.Subscript):
+        return False
+    base = dotted(node.value)
+    return base is not None and base.endswith("sys.modules")
+
+
+def literal_prefix(node):
+    None
+    if isinstance(node, ast.JoinedStr):
+        first = node.values[0] if node.values else None
+        if isinstance(first, ast.Constant) and isinstance(first.value, str):
+            return first.value
+        return None
+    if isinstance(node, ast.BinOp) and isinstance(node.op, ast.Add):
+        if isinstance(node.left, ast.Constant) and isinstance(node.left.value, str):
+            return node.left.value
+    return None
+
+
+class Extract(ast.NodeVisitor):
+    None
+
+    def __init__(self):
+        self.imports = []
+        self.functions = []
+        self.classes = []
+        self.calls = []
+        self.escapes = []
+        self.all_names = None
+        self.all_computed = False
+        self.truncated = []
+        self._scope = []
+        self._func = []
+        self._class = []
+        self._guard = []
+        self._bound = {}
+        self._handled = set()
+        self._aliases = set()
+        self._module_defs = set()
+
+    def note_module_defs(self, tree):
+        for node in tree.body:
+            if isinstance(node, FUNCTION_NODES_X):
+                self._module_defs.add(node.name)
+
+
+    def _add(self, bucket, row, what):
+        if len(bucket) >= MAX_PER_KIND:
+            if what not in self.truncated:
+                self.truncated.append(what)
+            return
+        bucket.append(row)
+
+    def _qual(self, name):
+        return ".".join([*self._scope, name]) if self._scope else name
+
+    def _enclosing(self):
+        return self._func[-1] if self._func else None
+
+
+    def _import_row(self, node, module, level, names, star, form="from"):
+        return {
+            "form": form,
+            "module": module,
+            "level": level,
+            "names": names,
+            "star": star,
+            "deferred": self._enclosing() is not None,
+            "enclosingFunction": self._enclosing(),
+            "guards": list(self._guard),
+            "range": rng(node),
+        }
+
+    def visit_Import(self, node):
+        for alias in node.names:
+            self._add(
+                self.imports,
+                self._import_row(
+                    node,
+                    alias.name,
+                    0,
+                    [{"name": alias.name, "asname": alias.asname}],
+                    False,
+                    "import",
+                ),
+                "imports",
+            )
+        self.generic_visit(node)
+
+    def visit_ImportFrom(self, node):
+        star = any(a.name == "*" for a in node.names)
+        names = [{"name": a.name, "asname": a.asname} for a in node.names if a.name != "*"]
+        self._add(
+            self.imports,
+            self._import_row(node, node.module, node.level or 0, names, star),
+            "imports",
+        )
+        self.generic_visit(node)
+
+
+    def _visit_function(self, node, kind):
+        qual = self._qual(node.name)
+        self._add(
+            self.functions,
+            {
+                "name": node.name,
+                "qualname": qual,
+                "kind": kind,
+                "enclosingClass": self._class[-1] if self._class else None,
+                "enclosingFunction": self._enclosing(),
+                "decorators": [dotted(d.func) if isinstance(d, ast.Call) else dotted(d) for d in node.decorator_list],
+                "range": rng(node),
+            },
+            "functions",
+        )
+        self._scope.append(node.name)
+        self._func.append(qual)
+        self.generic_visit(node)
+        self._func.pop()
+        self._scope.pop()
+
+    def visit_FunctionDef(self, node):
+        self._visit_function(node, "function")
+
+    def visit_AsyncFunctionDef(self, node):
+        self._visit_function(node, "async-function")
+
+    def visit_ClassDef(self, node):
+        qual = self._qual(node.name)
+        self._add(
+            self.classes,
+            {
+                "name": node.name,
+                "qualname": qual,
+                "bases": [dotted(b) for b in node.bases],
+                "decorators": [dotted(d.func) if isinstance(d, ast.Call) else dotted(d) for d in node.decorator_list],
+                "range": rng(node),
+            },
+            "classes",
+        )
+        self._scope.append(node.name)
+        self._class.append(qual)
+        self.generic_visit(node)
+        self._class.pop()
+        self._scope.pop()
+
+
+    def visit_If(self, node):
+        test = node.test
+        name = dotted(test) or (dotted(test.value) if isinstance(test, ast.Attribute) else None)
+        kind = "type-checking" if (name or "").endswith("TYPE_CHECKING") else "conditional"
+        self._guard.append(kind)
+        for child in node.body:
+            self.visit(child)
+        self._guard.pop()
+        for child in node.orelse:
+            self.visit(child)
+
+    def visit_For(self, node):
+        None
+        values = string_list(node.iter)
+        if values is None and isinstance(node.iter, ast.Name):
+            values = self._bound.get(node.iter.id)
+        name = node.target.id if isinstance(node.target, ast.Name) else None
+        shadowed = name is not None and name in self._bound
+        previous = self._bound.get(name) if shadowed else None
+        if name is not None and values is not None:
+            self._bound[name] = list(values)
+        for child in [*node.body, *node.orelse]:
+            self.visit(child)
+        if name is not None and values is not None:
+            if shadowed:
+                self._bound[name] = previous
+            else:
+                self._bound.pop(name, None)
+        self.visit(node.iter)
+
+    def visit_Try(self, node):
+        handles_import_error = any(
+            (dotted(h.type) or "").endswith("ImportError") or (dotted(h.type) or "").endswith("ModuleNotFoundError")
+            for h in node.handlers
+            if h.type is not None
+        )
+        self._guard.append("optional" if handles_import_error else "conditional")
+        for child in node.body:
+            self.visit(child)
+        self._guard.pop()
+        for child in [*node.handlers, *node.orelse, *node.finalbody]:
+            self.visit(child)
+
+
+    def visit_Assign(self, node):
+        for target in node.targets:
+            if isinstance(target, ast.Name) and target.id == "__all__" and not self._scope:
+                names = string_list(node.value)
+                if names is None:
+                    self.all_computed = True
+                else:
+                    self.all_names = names
+            if isinstance(target, ast.Name) and not self._scope:
+                values = string_list(node.value)
+                if values is not None:
+                    self._bound[target.id] = values
+            if isinstance(target, ast.Name) and is_sys_modules_read(node.value):
+                self._aliases.add(target.id)
+            if (
+                isinstance(target, ast.Attribute)
+                and isinstance(node.value, ast.Name)
+                and node.value.id in self._module_defs
+            ):
+                self._add(
+                    self.escapes,
+                    {
+                        "kind": "attr-rebind",
+                        "callee": dotted(target) or target.attr,
+                        "attr": target.attr,
+                        "target": node.value.id,
+                        "enclosingFunction": self._enclosing(),
+                        "range": rng(node),
+                    },
+                    "escapes",
+                )
+            if isinstance(target, ast.Subscript):
+                base = dotted(target.value)
+                if base is not None and base.endswith("sys.modules"):
+                    self._handled.add(id(target))
+                    aliasing = is_sys_modules_read(node.value) or (
+                        isinstance(node.value, ast.Name) and node.value.id in self._aliases
+                    )
+                    if not aliasing:
+                        self._add(
+                            self.escapes,
+                            {
+                                "kind": "sys-modules",
+                                "callee": base,
+                                "target": None,
+                                "enclosingFunction": self._enclosing(),
+                                "range": rng(node),
+                            },
+                            "escapes",
+                        )
+        self.generic_visit(node)
+
+
+    def visit_Call(self, node):
+        callee = dotted(node.func)
+        receiver = None
+        if isinstance(node.func, ast.Attribute):
+            receiver = dotted(node.func.value)
+        self._add(
+            self.calls,
+            {
+                "callee": callee,
+                "attr": node.func.attr if isinstance(node.func, ast.Attribute) else None,
+                "receiver": receiver,
+                "enclosingFunction": self._enclosing(),
+                "argCount": len(node.args),
+                "range": rng(node),
+            },
+            "calls",
+        )
+        self._escape_for(node, callee)
+        self.generic_visit(node)
+
+    def _import_targets(self, first):
+        None
+        if isinstance(first, ast.Constant) and isinstance(first.value, str):
+            return [first.value]
+        if isinstance(first, ast.Name) and first.id in self._bound:
+            return list(self._bound[first.id])
+        prefix = literal_prefix(first)
+        if prefix is not None and "." in prefix:
+            return [prefix.rsplit(".", 1)[0]]
+        return None
+
+    def _escape_for(self, node, callee):
+        if callee is None:
+            return
+        tail = callee.rsplit(".", 1)[-1]
+        first = node.args[0] if node.args else None
+        literal = isinstance(first, ast.Constant) and isinstance(first.value, str)
+        targets = None
+        kind = None
+        if callee.endswith("import_module") or tail == "__import__":
+            targets = self._import_targets(first)
+            if targets is not None:
+                for target in targets:
+                    self._add(
+                        self.escapes,
+                        {
+                            "kind": "import-module-literal",
+                            "callee": callee,
+                            "target": target,
+                            "enclosingFunction": self._enclosing(),
+                            "range": rng(node),
+                        },
+                        "escapes",
+                    )
+                return
+            kind = "loader-escape"
+        elif tail in ("exec", "eval"):
+            kind = "loader-escape"
+        elif tail in ("iter_modules", "walk_packages"):
+            kind = "pkgutil-scan"
+        elif callee.startswith("runpy.") or tail in ("run_module", "run_path"):
+            kind = "runpy"
+        elif tail == "entry_points":
+            kind = "entry-point-load"
+        elif tail == "getattr" and not literal:
+            kind = "dispatch-escape"
+        if kind is None:
+            return
+        row = {
+            "kind": kind,
+            "callee": callee,
+            "target": first.value if literal and kind == "import-module-literal" else None,
+            "enclosingFunction": self._enclosing(),
+            "range": rng(node),
+        }
+        self._add(self.escapes, row, "escapes")
+
+    def visit_Subscript(self, node):
+        if isinstance(node.ctx, ast.Load) or id(node) in self._handled:
+            self.generic_visit(node)
+            return
+        base = dotted(node.value)
+        if base is not None and base.endswith("sys.modules"):
+            self._add(
+                self.escapes,
+                {"kind": "sys-modules", "callee": base, "target": None, "enclosingFunction": self._enclosing(), "range": rng(node)},
+                "escapes",
+            )
+        self.generic_visit(node)
+
+
+def extract(path, max_bytes, max_nodes):
+    try:
+        with open(path, "rb") as fh:
+            raw = fh.read(max_bytes + 1)
+    except OSError as e:
+        return {"path": path, "refused": "unreadable", "detail": type(e).__name__}
+    if len(raw) > max_bytes:
+        return {"path": path, "refused": "oversize", "detail": f">{max_bytes} bytes"}
+    if b"\\x00" in raw:
+        return {"path": path, "refused": "nul-byte"}
+    set_line_starts(raw)
+    try:
+        src = raw.decode("utf-8")
+    except UnicodeDecodeError:
+        try:
+            src = raw.decode("latin-1")
+        except UnicodeDecodeError:
+            return {"path": path, "refused": "undecodable"}
+    try:
+        tree = ast.parse(src, filename=path)
+    except (SyntaxError, ValueError) as e:
+        return {"path": path, "refused": "parse-error", "detail": type(e).__name__}
+    except RecursionError:
+        return {"path": path, "refused": "recursion"}
+    nodes = sum(1 for _ in ast.walk(tree))
+    if nodes > max_nodes:
+        return {"path": path, "refused": "too-many-nodes", "detail": str(nodes)}
+    ex = Extract()
+    ex.note_module_defs(tree)
+    try:
+        ex.visit(tree)
+    except RecursionError:
+        return {"path": path, "refused": "recursion"}
+    return {
+        "path": path,
+        "refused": None,
+        "imports": ex.imports,
+        "functions": ex.functions,
+        "classes": ex.classes,
+        "calls": ex.calls,
+        "escapes": ex.escapes,
+        "all": ex.all_names,
+        "allComputed": ex.all_computed,
+        "truncated": ex.truncated,
+    }
+
+
+def main(argv):
+    def flag(name, default):
+        return int(argv[argv.index(name) + 1]) if name in argv else default
+
+    max_bytes = flag("--max-bytes", MAX_BYTES)
+    max_nodes = flag("--max-nodes", MAX_NODES)
+    out = sys.stdout
+    out.write(
+        json.dumps(
+            {
+                "kind": "header",
+                "interpreter": sys.version.split()[0],
+                "extract": 1,
+                "stdlib": sorted(getattr(sys, "stdlib_module_names", ())),
+            }
+        )
+        + "\\n"
+    )
+    for line in sys.stdin:
+        path = line.rstrip("\\n")
+        if not path:
+            continue
+        row = extract(path, max_bytes, max_nodes)
+        row["kind"] = "file"
+        out.write(json.dumps(row) + "\\n")
+    out.flush()
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv))
+`,"metadata.py":`None
+
+import configparser
+import json
+import os
+import sys
+
+MAX_BYTES = 4 * 1024 * 1024
+
+
+def read(path, limit=MAX_BYTES):
+    try:
+        with open(path, "rb") as fh:
+            raw = fh.read(limit + 1)
+    except OSError:
+        return None
+    return None if len(raw) > limit else raw
+
+
+def scripts_from_pyproject(root, out):
+    raw = read(os.path.join(root, "pyproject.toml"))
+    if raw is None:
+        return
+    try:
+        import tomllib
+    except ModuleNotFoundError:
+        out["gaps"].append({"file": "pyproject.toml", "why": "no-tomllib"})
+        return
+    try:
+        data = tomllib.loads(raw.decode("utf-8"))
+    except (UnicodeDecodeError, Exception) as e:
+        out["gaps"].append({"file": "pyproject.toml", "why": f"unparsed:{type(e).__name__}"})
+        return
+    project = data.get("project")
+    if not isinstance(project, dict):
+        out["gaps"].append({"file": "pyproject.toml", "why": "no-project-table"})
+        return
+    name = project.get("name")
+    if isinstance(name, str):
+        out["projectName"] = name
+    for table, kind in (("scripts", "console-script"), ("gui-scripts", "gui-script")):
+        entries = project.get(table)
+        if isinstance(entries, dict):
+            for key, target in entries.items():
+                if isinstance(key, str) and isinstance(target, str):
+                    out["entryPoints"].append(
+                        {"name": key, "target": target, "kind": kind, "file": "pyproject.toml"}
+                    )
+    groups = project.get("entry-points")
+    if isinstance(groups, dict):
+        for group, entries in groups.items():
+            if not isinstance(entries, dict):
+                continue
+            for key, target in entries.items():
+                if isinstance(key, str) and isinstance(target, str):
+                    out["entryPoints"].append(
+                        {
+                            "name": f"{group}:{key}" if isinstance(group, str) else key,
+                            "target": target,
+                            "kind": "entry-point-group",
+                            "file": "pyproject.toml",
+                        }
+                    )
+
+
+def scripts_from_setup_cfg(root, out):
+    raw = read(os.path.join(root, "setup.cfg"))
+    if raw is None:
+        return
+    parser = configparser.ConfigParser(strict=False)
+    try:
+        parser.read_string(raw.decode("utf-8", errors="replace"))
+    except configparser.Error as e:
+        out["gaps"].append({"file": "setup.cfg", "why": f"unparsed:{type(e).__name__}"})
+        return
+    if out.get("projectName") is None and parser.has_option("metadata", "name"):
+        out["projectName"] = parser.get("metadata", "name").strip()
+    if not parser.has_section("options.entry_points"):
+        return
+    for group, block in parser.items("options.entry_points"):
+        for line in (block or "").splitlines():
+            line = line.strip()
+            if not line or "=" not in line:
+                continue
+            key, _, target = line.partition("=")
+            out["entryPoints"].append(
+                {
+                    "name": key.strip(),
+                    "target": target.strip(),
+                    "kind": "console-script" if group == "console_scripts" else "entry-point-group",
+                    "file": "setup.cfg",
+                }
+            )
+
+
+def main(argv):
+    if len(argv) < 2:
+        sys.stderr.write("usage: metadata.py <project-root>\\n")
+        return 2
+    root = argv[1]
+    out = {"projectName": None, "entryPoints": [], "gaps": [], "interpreter": sys.version.split()[0]}
+    scripts_from_pyproject(root, out)
+    scripts_from_setup_cfg(root, out)
+    if os.path.isfile(os.path.join(root, "setup.py")) and not out["entryPoints"]:
+        out["gaps"].append({"file": "setup.py", "why": "executable-metadata-not-read"})
+    sys.stdout.write(json.dumps(out) + "\\n")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv))
+`};import{randomBytes as Mu}from"node:crypto";import{readFileSync as ob,renameSync as sb,writeFileSync as Tu}from"node:fs";import ib from"node:path";import{fileURLToPath as ab}from"node:url";var Fu=/^(\d{1,10})\.(\d{1,10})\.(\d{1,10})$/u;function ju(e){let n=Fu.exec(e);return n===null?null:{kind:"npm",release:[Number(n[1]),Number(n[2]),Number(n[3])]}}function Bu(e,n){for(let t=0;t<3;t+=1){let r=e.release[t]??0,o=n.release[t]??0;if(r!==o)return r<o?-1:1}return 0}var Ku=/^v?(?:(?<epoch>[0-9]+)!)?(?<release>[0-9]+(?:\.[0-9]+)*)(?:[-_.]?(?<preL>a|b|c|rc|alpha|beta|pre|preview)[-_.]?(?<preN>[0-9]+)?)?(?:(?:-(?<postImplicit>[0-9]+))|(?:[-_.]?(?<postL>post|rev|r)[-_.]?(?<postN>[0-9]+)?))?(?:[-_.]?(?<devL>dev)[-_.]?(?<devN>[0-9]+)?)?(?:\+(?<local>[a-z0-9]+(?:[-_.][a-z0-9]+)*))?$/u,Uu={a:"a",alpha:"a",b:"b",beta:"b",c:"rc",pre:"rc",preview:"rc",rc:"rc"};function kt(e){if(e===void 0)return null;let n=Number(e);return Number.isSafeInteger(n)?n:null}function zu(e){let n=Ku.exec(e.toLowerCase());if(n===null||n.groups===void 0)return null;let t=n.groups,r=(t.release??"").split(".");if(r.length===0||r.length>32)return null;let o=[];for(let c of r){let p=kt(c);if(p===null)return null;o.push(p)}let s=0;if(t.epoch!==void 0){let c=kt(t.epoch);if(c===null)return null;s=c}let i=null;if(t.preL!==void 0){let c=t.preN===void 0?0:kt(t.preN);if(c===null)return null;i=[Uu[t.preL]??t.preL,c]}let a=null;if(t.postImplicit!==void 0){let c=kt(t.postImplicit);if(c===null)return null;a=c}else if(t.postL!==void 0){let c=t.postN===void 0?0:kt(t.postN);if(c===null)return null;a=c}let d=null;if(t.devL!==void 0){let c=t.devN===void 0?0:kt(t.devN);if(c===null)return null;d=c}let l=t.local===void 0?null:t.local.split(/[-_.]/u).map(c=>/^[0-9]+$/u.test(c)?Number(c):c);return{kind:"PyPI",epoch:s,release:o,pre:i,post:a,dev:d,local:l}}function wt(e,n){return e===n?0:e<n?-1:1}function la(e){let n=e.length;for(;n>1&&e[n-1]===0;)n-=1;return e.slice(0,n)}function Gu(e,n){let t=la(e),r=la(n),o=Math.max(t.length,r.length);for(let s=0;s<o;s+=1){let i=wt(t[s]??0,r[s]??0);if(i!==0)return i}return 0}function da(e){return e.pre!==null?0:e.post===null&&e.dev!==null?-1:1}function Wu(e,n){let t=da(e),r=da(n);return t!==r?t<r?-1:1:t!==0||e.pre===null||n.pre===null?0:e.pre[0]!==n.pre[0]?e.pre[0]<n.pre[0]?-1:1:wt(e.pre[1],n.pre[1])}function qu(e,n){return e===null&&n===null?0:e===null?-1:n===null?1:wt(e,n)}function Vu(e,n){return e===null&&n===null?0:e===null?1:n===null?-1:wt(e,n)}function Hu(e,n){let t=typeof e=="number",r=typeof n=="number";return t&&r?wt(e,n):!t&&!r?e===n?0:e<n?-1:1:t?1:-1}function Xu(e,n){if(e===null&&n===null)return 0;if(e===null)return-1;if(n===null)return 1;let t=Math.max(e.length,n.length);for(let r=0;r<t;r+=1){let o=e[r],s=n[r];if(o===void 0)return-1;if(s===void 0)return 1;let i=Hu(o,s);if(i!==0)return i}return 0}function Yu(e,n){let t=wt(e.epoch,n.epoch);if(t!==0)return t;let r=Gu(e.release,n.release);if(r!==0)return r;let o=Wu(e,n);if(o!==0)return o;let s=qu(e.post,n.post);if(s!==0)return s;let i=Vu(e.dev,n.dev);return i!==0?i:Xu(e.local,n.local)}function Ju(e,n){if(typeof n!="string"||n.length===0||n.length>256)return null;let t=e==="npm"?ju(n):zu(n);return t===null?null:{ecosystem:e,raw:n,parsed:t}}function zt(e,n){let t=Ju(e,n);if(t===null)throw new Error(`not a valid ${e} version: ${JSON.stringify(n)}`);return t}function Or(e,n){if(e.ecosystem!==n.ecosystem)throw new Error(`cannot compare ${e.ecosystem} with ${n.ecosystem}`);if(e.parsed.kind==="npm"&&n.parsed.kind==="npm")return Bu(e.parsed,n.parsed);if(e.parsed.kind==="PyPI"&&n.parsed.kind==="PyPI")return Yu(e.parsed,n.parsed);throw new Error("unreachable: ecosystem/parsed mismatch")}function ca(e,n,t){let r=zt(e,n);return!(t.introduced!=="0"&&Or(r,zt(e,t.introduced))<0||t.fixed!==void 0&&Or(r,zt(e,t.fixed))>=0||t.lastAffected!==void 0&&Or(r,zt(e,t.lastAffected))>0)}var To=["no-entrypoint","dynamic-load","resolution-divergence","analysis-cap","dep-opaque"];function it(e,n){return ca(n.ecosystem??"npm",e,n)}function $r(e,n,t){let r=new Map(e.functions.map(a=>[a.id,a])),o=new Map(e.classes.map(a=>[a.id,a.name])),s=new Map(e.callSites.map(a=>[a.id,a])),i=[];for(let a of e.callEdges){if(a.resolution!=="resolved"&&a.resolution!=="field-based")continue;let d=s.get(a.callSiteId);if(d===void 0)continue;let l=r.get(d.enclosingFunctionId);if(l===void 0||!t.has(l.moduleId))continue;let c=n.get(l.moduleId);if(c===void 0)continue;let p=r.get(a.calleeFunctionId);if(p===void 0||p.name===void 0)continue;let u=n.get(p.moduleId);u!==void 0&&u.packageName!==c.packageName&&i.push({packageName:u.packageName,exportName:p.name,container:p.enclosingClassId!==void 0?o.get(p.enclosingClassId)??null:null,resolution:a.resolution})}return i}function Zu(e,n){return(e.get(n)??[]).filter(t=>t.status==="summarized").slice().sort((t,r)=>t.analyzedVersion<r.analyzedVersion?1:t.analyzedVersion>r.analyzedVersion?-1:0)}function Qu(e,n,t){return e.target.kind!=="symbol"||t!==n.packageName?!1:e.target.exportName===n.exportName&&e.target.container===n.container&&e.target.symbolKind===n.symbolKind}function ua(e,n,t,r,o,s){if(s<=0)return null;let i=null,a=d=>{(i===null||d.hops<i.hops)&&(i=d)};for(let d of Zu(e,n))for(let l of d.edges){if(l.entryExport!==t||l.entryContainer!==r)continue;if(Qu(l,o,d.packageName)){a({viaPackages:[],hops:l.hops,provenance:{tool:d.tool,toolVersion:d.toolVersion,analyzedVersion:d.analyzedVersion}});continue}if(l.target.kind!=="dep")continue;let c=ua(e,l.target.calleePackage,l.target.calleeExport,null,o,s-1);c!==null&&a({viaPackages:[l.target.calleePackage,...c.viaPackages],hops:l.hops+c.hops,provenance:c.provenance})}return i}function Do(e,n,t,r,o,s){let i=null;for(let a of $r(e,n,t)){let d=ua(o,a.packageName,a.exportName,a.container,r,s);d!==null&&(i===null||d.hops<i.totalHops)&&(i={tier:"reachable-low",anchorPackage:a.packageName,entryExport:a.exportName,viaPackages:d.viaPackages,totalHops:d.hops,provenance:d.provenance})}return i}function Cr(e,n){let{args:t,convention:r}=e,o=n.params;if(t===void 0||r===void 0||o===void 0)return{known:!1,reason:"not-emitted"};if(r==="unknown")return{known:!1,reason:"convention"};if(n.reflectiveArguments===!0)return{known:!1,reason:"reflective-arguments"};if(r==="shifted"&&t[0]?.spread!==void 0&&t[0].spread!==!1)return{known:!1,reason:"convention"};let s=r==="shifted"?t.slice(1):t,i=[...o].sort((k,E)=>k.index-E.index),a=i.filter(k=>k.kind==="positional"),d=i.find(k=>k.kind==="rest"),l=i.find(k=>k.kind==="keyword-rest"),c=new Map,p=(k,E)=>{let g=c.get(k);g!=="unknown"&&c.set(k,[...g??[],E])},u=k=>{k!==void 0&&c.set(k,"unknown")},m=[],h=0,x=!1,y=!1;for(let k of s){if(k.spread==="positional"){x=!0;for(let g of a.slice(h))u(g);u(d);continue}if(k.spread==="keyword"){y=!0;for(let g of i)(g.kind==="positional"||g.kind==="keyword-only")&&!c.has(g)&&u(g);u(l);continue}if(k.keyword!==void 0){let g=i.find(b=>b.name===k.keyword&&(b.kind==="positional"||b.kind==="keyword-only"));g!==void 0?c.has(g)?u(g):p(g,k.index):l!==void 0?p(l,k.index):m.push(k.index);continue}if(x){for(let g of a.slice(h))u(g);u(d);continue}let E=a[h];E!==void 0?p(E,k.index):d!==void 0?p(d,k.index):m.push(k.index),h+=1}return{known:!0,params:i.map(k=>{let E=c.get(k);return E==="unknown"?{kind:"unknown"}:E!==void 0?{kind:"args",argIndexes:E}:y&&(k.kind==="positional"||k.kind==="keyword-only")?{kind:"unknown"}:k.kind==="rest"||k.kind==="keyword-rest"?{kind:"args",argIndexes:[]}:{kind:"absent"}}),receiver:ef(e,n),unbound:m}}function ef(e,n){if(n.receiver===void 0)return"unknown";if(n.receiver!=="call")return"none";switch(e.convention){case"construct":return"fresh";case"shifted":return(e.args?.length??0)>0?"first-argument":"none";case"direct":return e.receiverRange!==void 0?"receiver-expression":"none";default:return"unknown"}}var pa=2e4,nf=4,Mr=e=>{switch(e.kind){case"param":return`p${String(e.index)}`;case"local":return`l${e.name}@${String(e.declStart)}`;case"free":return`f${e.name}`;case"call-result":return`c${String(e.at)}`;case"argument":return`a${String(e.at)}:${String(e.index)}`;case"call-receiver":return`r${String(e.at)}`;case"mutated-by-call":return`m${String(e.at)}:${String(e.index)}`;case"opaque":return`o${e.reason}`;default:return e.kind}};function Lo(e){let n=new Map(e.functions.map(d=>[d.id,d])),t=new Map;for(let d of e.functions){if(d.valueFlows===void 0)continue;let l=new Map;for(let c of d.valueFlows){let p=Mr(c.to),u=l.get(p);u===void 0?l.set(p,[c]):u.push(c)}t.set(d.id,l)}let r=new Map,o=new Map;for(let d of e.callSites)r.set(`${d.range.path}\0${String(d.range.start)}`,d),o.set(d.id,d);let s=new Map,i=new Map,a=(d,l,c)=>{let p=d.get(l)??[];p.includes(c)||p.push(c),d.set(l,p)};for(let d of e.callEdges){let l=o.get(d.callSiteId);if(l===void 0)continue;let c=d.invocation==="direct";c&&a(s,l.id,d.calleeFunctionId);let p=i.get(d.calleeFunctionId)??[],u=p.find(m=>m.site===l);u===void 0?p.push({site:l,direct:c}):c&&(u.direct=!0),i.set(d.calleeFunctionId,p)}return{functions:n,into:t,siteAt:r,callees:s,callers:i}}function tf(e,n){let{args:t,convention:r}=e;if(t===void 0||r===void 0||r!=="direct"&&r!=="construct")return"unknown";for(let o=0;o<=n&&o<t.length;o+=1){let s=t[o];if(s===void 0||s.spread!==!1||s.keyword!==void 0)return"unknown"}return n<t.length?n:"absent"}var fa=e=>[...e.params??[]].sort((n,t)=>n.index-t.index);function Fo(e,n){let t=new Map,r=y=>{t.set(`${y.kind}|${y.functionId}|${y.reason??""}|${y.detail??""}`,y)},o=new Set,s=[],i=new Map,a=null,d,l=y=>`${y.fn}\0${Mr(y.ref)}\0${y.stack.map(S=>S.id).join(",")}\0${String(y.tracing??"")}`,c=y=>{if(d!==void 0)return;let S=[{functionId:y.fn,ref:y.ref}];for(let k=a;k!==null;){let E=i.get(k);if(E===void 0)break;S.push({functionId:E.state.fn,ref:E.state.ref}),k=E.key}d=S},p=y=>{let S=l(y);o.has(S)||(o.add(S),i.set(S,{key:a,state:y}),s.push(y))},u=n.site.enclosingFunctionId;if(n.port.kind==="receiver")p({fn:u,ref:{kind:"call-receiver",at:n.site.range.start},stack:[],tracing:n.site.range.start});else{let y=tf(n.site,n.port.index);y==="unknown"?r({kind:"unknown",functionId:u,reason:"binding"}):y==="absent"?r({kind:"constant",functionId:u,detail:"no argument"}):p({fn:u,ref:{kind:"argument",at:n.site.range.start,index:y},stack:[],tracing:n.site.range.start})}let m=0;for(;s.length>0;){if(m+=1,m>pa){r({kind:"unknown",functionId:u,reason:"analysis-cap"});break}let y=s.pop();a=l(y);let S=e.into.get(y.fn),k=e.functions.get(y.fn);if(S===void 0||k===void 0){r({kind:"unknown",functionId:y.fn,reason:"not-emitted"});continue}let E=S.get(Mr(y.ref));if(E!==void 0&&E.length>0){for(let b of E)y.tracing!==void 0&&b.from.kind==="mutated-by-call"&&b.from.at===y.tracing&&e.siteAt.get(`${k.declRange.path}\0${String(y.tracing)}`)?.repeats===!1||p({...y,ref:b.from});if(y.ref.kind!=="param"&&y.ref.kind!=="receiver"&&y.ref.kind!=="call-result"&&y.ref.kind!=="mutated-by-call")continue}let g=y.ref;switch(g.kind){case"constant":r({kind:"constant",functionId:y.fn});break;case"opaque":r({kind:"unknown",functionId:y.fn,reason:"opaque",detail:g.reason});break;case"source":r({kind:"source",functionId:y.fn,sourceClass:g.sourceClass,model:g.model}),c(y);break;case"free":r({kind:"unknown",functionId:y.fn,reason:"free",detail:g.name});break;case"local":case"return":(E===void 0||E.length===0)&&r({kind:"constant",functionId:y.fn,detail:"undefined"});break;case"param":case"receiver":{let b=g.kind==="param"?k.sourceParams?.find(_=>_.index===g.index):void 0;b!==void 0&&(r({kind:"source",functionId:y.fn,sourceClass:b.sourceClass,model:b.model}),c(y));let w=y.stack[y.stack.length-1],I=w!==void 0?[{site:w,direct:!0}]:e.callers.get(y.fn)??[],N=b!==void 0?I.filter(_=>_.site.args!==void 0):I;if(b!==void 0&&N.length===0)break;let v=w!==void 0?y.stack.slice(0,-1):[];if(N.length===0){r({kind:"entry-parameter",functionId:y.fn,detail:g.kind==="param"?`param ${String(g.index)}`:"receiver"});break}for(let{site:_,direct:P}of N){if(!P){r({kind:"unknown",functionId:_.enclosingFunctionId,reason:"binding",detail:"callback"});continue}let R=Cr(_,k);if(!R.known){r({kind:"unknown",functionId:_.enclosingFunctionId,reason:"binding",detail:R.reason});continue}let L=_.range.start,O=_.enclosingFunctionId;if(g.kind==="receiver"){R.receiver==="receiver-expression"?p({fn:O,ref:{kind:"call-receiver",at:L},stack:v,tracing:L}):R.receiver==="first-argument"?p({fn:O,ref:{kind:"argument",at:L,index:0},stack:v,tracing:L}):R.receiver==="none"?r({kind:"constant",functionId:O,detail:"no receiver"}):r({kind:"unknown",functionId:O,reason:"binding",detail:`receiver ${R.receiver}`});continue}let F=fa(k).findIndex(ee=>ee.index===g.index),K=R.params[F];if(K===void 0||K.kind==="unknown")r({kind:"unknown",functionId:O,reason:"binding"});else if(K.kind==="absent")(E===void 0||E.length===0)&&r({kind:"constant",functionId:y.fn,detail:"no argument"});else for(let ee of K.argIndexes)p({fn:O,ref:{kind:"argument",at:L,index:ee},stack:v,tracing:L})}break}case"call-result":case"mutated-by-call":{let b=e.siteAt.get(`${k.declRange.path}\0${String(g.at)}`);if(b===void 0){r({kind:"unknown",functionId:y.fn,reason:"unresolved-call",detail:"no call site at offset"});break}let w=e.callees.get(b.id)??[];if(w.length===0){r({kind:"unknown",functionId:y.fn,reason:"unresolved-call"});break}let I=y.stack.length>=nf?[]:[...y.stack,b];for(let N of w){let v=e.functions.get(N);if(v===void 0||!e.into.has(N)){r({kind:"unknown",functionId:y.fn,reason:"opaque-callee",detail:N});continue}if(g.kind==="call-result"){p({fn:N,ref:{kind:"return"},stack:I});continue}let _=Cr(b,v);if(!_.known){r({kind:"unknown",functionId:y.fn,reason:"binding",detail:_.reason});continue}let P=g.index===-1?_.receiver==="receiver-expression"?{kind:"receiver"}:void 0:(()=>{let L=_.params.findIndex(F=>F.kind==="args"&&F.argIndexes.includes(g.index)),O=fa(v)[L];return O!==void 0?{kind:"param",index:O.index}:void 0})();if(P===void 0)continue;let R=(e.into.get(N)?.get(Mr(P))??[]).filter(L=>L.kind==="field"||L.kind==="mutation");for(let L of R)p({fn:N,ref:L.from,stack:I})}break}case"argument":case"call-receiver":(E===void 0||E.length===0)&&r({kind:"unknown",functionId:y.fn,reason:"not-emitted",detail:"no flow into the argument"});break}}let h=[...t.values()];return{outcome:h.some(y=>y.kind==="source")?"influenced":h.some(y=>y.kind==="unknown")?"unknown":h.some(y=>y.kind==="entry-parameter")?"reaches-entry-parameter":"no-source-reached",leaves:h,visited:o.size,...d!==void 0?{witness:d}:{}}}var Gt={"no-contract":"cupel","no-source-model":"cupel","control-influence-unsupported":"cupel","analysis-cap":"cupel"};function jo(e){if(ma.includes(e))return{value:"unknown",kind:"no-contract"}}function Wt(e){switch(e){case"all-resolved":return"reachable-high";case"field-based":return"reachable-medium";case"modeled":return"reachable-low"}}function Et(e){let n=new Map;for(let t of e.modules)n.set(t.id,t);return n}function Bo(e){let n=new Map,t=new Map(e.imports.map(r=>[r.id,r]));for(let r of e.importEdges){let o=t.get(r.importId);if(o===void 0)continue;let s=n.get(o.moduleId)??[];s.push(r.resolvedModuleId),n.set(o.moduleId,s)}return n}function rf(e){let n=new Map,t=new Map(e.imports.map(r=>[r.id,r]));for(let r of e.importEdges){let o=t.get(r.importId);if(o===void 0)continue;let s=n.get(r.resolvedModuleId)??[];s.push(o.moduleId),n.set(r.resolvedModuleId,s)}return n}function bn(e){let n=Bo(e),t=new Set,r=e.modules.filter(o=>o.isEntrypoint).map(o=>o.id);for(;r.length>0;){let o=r.pop();if(!(o===void 0||t.has(o))){t.add(o);for(let s of n.get(o)??[])t.has(s)||r.push(s)}}return t}function of(e,n){let t=rf(e),r=new Set,o=[n];for(;o.length>0;){let s=o.pop();if(!(s===void 0||r.has(s))){r.add(s);for(let i of t.get(s)??[])r.has(i)||o.push(i)}}return r}function sf(e,n,t){let r=Bo(e),o=Et(e),s=new Set,i=[n];for(;i.length>0;){let a=i.pop();if(a===void 0||s.has(a))continue;s.add(a);let d=o.get(a);if(d===void 0||d.externalSurface===!0||t.has(a))return!0;for(let l of r.get(a)??[])s.has(l)||i.push(l)}return!1}function qt(e,n,t,r=new Set){let o=Bo(e),s=Et(e),i=new Set,a=[],d=[n];for(;d.length>0;){let l=d.pop();if(l===void 0||i.has(l))continue;i.add(l);let c=s.get(l);if(c===void 0){a.push({module:l,kind:"absent"});continue}if(t.has(l)){a.push({module:l,kind:"unbounded"});continue}if(c.externalSurface===!0&&!r.has(l)){a.push({module:l,kind:"surface"});continue}for(let p of o.get(l)??[])i.has(p)||d.push(p)}return a}function ga(e){let n=new Set(e.modules.filter(i=>i.isEntrypoint).map(i=>i.id)),t=new Map(e.functions.map(i=>[i.id,i])),r=Et(e),o=new Map;for(let i of e.functions)n.has(i.moduleId)&&(i.publicSurfaceReachable||i.name==="<toplevel>")&&o.set(i.id,i);let s=new Map(e.exports.map(i=>[i.id,i]));for(let i of e.exportBindings){if(i.target.kind!=="function")continue;let a=s.get(i.exportId);if(a===void 0||!n.has(a.moduleId))continue;let d=t.get(i.target.functionId);d===void 0||r.get(d.moduleId)?.externalSurface===!0||o.set(d.id,d)}return[...o.values()]}function ya(e){let n="node_modules/",t=e.lastIndexOf(n);if(t===-1)return e;let o=e.slice(t+n.length).split("/"),s=o[0]?.startsWith("@")===!0?2:1;return o.slice(s).join("/")}function af(e,n,t){if(t.symbolKind==="accessor"||t.symbolKind==="pattern")return;let r=t.symbolKind==="method"||t.symbolKind==="ctor",o=new Map(e.classes.map(s=>[s.id,s]));return e.functions.find(s=>{if(s.name!==t.exportName)return!1;let i=n.get(s.moduleId);if(i===void 0||i.packageName!==t.packageName)return!1;if(r){if(s.kind!==t.symbolKind||s.enclosingClassId===void 0||o.get(s.enclosingClassId)?.name!==t.container)return!1}else if(s.kind!=="function")return!1;return i.externalSurface===!0?!0:ya(i.path)===t.sourcePath})}function ha(e,n){return e.modules.find(t=>t.externalSurface!==!0&&t.packageName===n.packageName&&ya(t.path)===n.sourcePath)}function lf(e,n,t,r){let o=new Map(e.functions.map(s=>[s.id,s]));return e.callSites.some(s=>s.calleeExprShape!=="member"||s.resolution!=="resolved"?!1:s.resolvedTargetIds.some(i=>{let a=o.get(i);if(a?.name!==r.exportName)return!1;let d=n.get(a.moduleId);return d?.externalSurface===!0&&d.packageName===r.packageName&&t.has(a.moduleId)}))}function df(e,n,t){return t.container===null?!0:e.classes.some(r=>{if(r.name!==t.container)return!1;let o=n.get(r.moduleId);return o!==void 0&&o.packageName===t.packageName&&o.externalSurface!==!0})}function cf(e,n,t){let r=new Map(e.callSites.map(d=>[d.id,d.enclosingFunctionId])),o=new Map;for(let d of e.callEdges){let l=r.get(d.callSiteId);if(l===void 0)continue;let c=o.get(l)??[];c.push({to:d.calleeFunctionId,res:d.resolution,site:d.callSiteId}),o.set(l,c)}let s=d=>{let l=new Set,c=n.map(p=>({id:p.id,prev:null,via:null}));for(let p of c)l.add(p.id);for(;c.length>0;){let p=c.shift();if(p===void 0)break;if(p.id===t){let u=[],m=[];for(let h=p;h!==null;h=h.prev)u.unshift(h.id),m.unshift(h.via);return{path:u,via:m}}for(let u of o.get(p.id)??[])u.res!=="unresolved"&&(u.res==="field-based"&&!d||l.has(u.to)||(l.add(u.to),c.push({id:u.to,prev:p,via:u.site})))}return null},i=s(!1);if(i!==null)return{...i,usedFieldBased:!1};let a=s(!0);return a!==null?{...a,usedFieldBased:!0}:null}function Ko(e,n,t){let r=new Map(e.callSites.map(y=>[y.id,y.enclosingFunctionId])),o=new Map,s=new Map,i=[],a=(y,S,k)=>{let E=y.get(S);E===void 0?y.set(S,[k]):E.push(k)};for(let y of e.callEdges){if(y.resolution==="unresolved"||y.resolution==="field-based"&&!t)continue;let S=r.get(y.callSiteId);if(S===void 0)continue;let k=y.calleeFunctionId;a(o,S,k),a(s,k,S),i.push({from:S,to:k,site:y.callSiteId})}let d=new Set,l=ga(e).map(y=>y.id);for(let y of l)d.add(y);for(let y=0;y<l.length;y+=1)for(let S of o.get(l[y])??[])d.has(S)||(d.add(S),l.push(S));if(!d.has(n))return null;let c=new Map([[n,0]]),p=[n];for(let y=0;y<p.length;y+=1){let S=p[y],k=(c.get(S)??0)+1;for(let E of s.get(S)??[])c.has(E)||!d.has(E)||(c.set(E,k),p.push(E))}let u=(y,S)=>y<S?-1:y>S?1:0,m=[...c].map(([y,S])=>({functionId:y,distance:S})).sort((y,S)=>y.distance-S.distance||u(y.functionId,S.functionId)),h=new Set,x=i.filter(y=>c.has(y.from)&&c.has(y.to)).filter(y=>{let S=JSON.stringify([y.from,y.to,y.site]);return h.has(S)?!1:(h.add(S),!0)}).sort((y,S)=>u(y.from,S.from)||u(y.to,S.to)||u(y.site,S.site));return{functions:m,edges:x}}function Uo(e){return xa(e,Et(e),bn(e),Sa(e))}function xa(e,n,t,r){let o=[],s=[],i=new Map(e.functions.map(d=>[d.id,d.moduleId])),a=d=>d!==void 0&&t.has(d)&&r.has(n.get(d)?.packageName??"");for(let d of e.callSites)d.resolution==="unresolved"&&a(i.get(d.enclosingFunctionId))&&o.push(d.range);for(let d of e.imports)!d.specifierIsLiteral&&t.has(d.moduleId)&&s.push({path:n.get(d.moduleId)?.path??"",start:0,end:0});return{dispatch:o,load:s}}function Sa(e){return new Set(e.modules.filter(n=>n.isEntrypoint).map(n=>n.packageName))}function uf(e,n,t){let r=new Map(e.functions.map(i=>[i.id,i])),o=Et(e),s=new Map(e.callSites.map(i=>[i.id,i]));return n.map((i,a)=>{let d=r.get(i),l=d!==void 0?o.get(d.moduleId):void 0,c=t[a];return{functionId:i,functionName:d?.name,modulePath:l?.path??"",calledAt:c==null?null:s.get(c)?.range??null}})}function zo(e){let{graph:n,installed:t,range:r,symbol:o,coverage:s}=e,i=[],a={unresolvedSites:i,unresolvedEvidence:{own:i,sets:[]}},d=U=>({unresolvedSites:U,unresolvedEvidence:{own:U,sets:[]}}),l=Sa(n),c=new Set;for(let U of e.incompleteness)U.reach.kind==="unbounded"&&c.add(U.source);let p=e.incompleteness.some(U=>U.reach.kind==="assumed-bounded")?"loader-assumption":"complete",u=U=>U==="not-reachable"?p:void 0,m=new Map,h=U=>{let J=m.get(U);return J===void 0&&(J=sf(n,U,c),m.set(U,J)),J},x=U=>U.reach.kind==="class-scope"&&o!==null&&o.packageName===U.reach.packageName&&o.container===U.reach.container,y=U=>{if(e.analysisAborted!==null)return{cause:e.analysisAborted,source:null};for(let J of To)for(let B of e.incompleteness)if(B.cause===J&&U(B))return{cause:B.cause,source:B.source};return null},S=U=>{let J;return y(B=>B.reach.kind==="unbounded"?!0:B.reach.kind==="class-scope"?x(B):U===void 0||h(B.reach.anchor)?!0:(J??=of(n,U),J.has(B.reach.anchor)))},k=()=>y(U=>U.reach.kind==="unbounded"?!0:U.reach.kind==="class-scope"?x(U):h(U.reach.anchor));if(t===null)return{tier:"not-affected",decidedAtStage:"presence",reason:`${r.packageName} is not installed`,unknownKind:void 0,attribution:void 0,basis:u("not-affected"),path:void 0,...a};let E;try{if((t.ecosystem??"npm")!==(r.ecosystem??"npm"))throw new Error("ecosystem mismatch");E=it(t.version,r)}catch{return{tier:"unknown",decidedAtStage:"version-match",reason:`cannot compare version ${JSON.stringify(t.version)} against the advisory range`,unknownKind:"version-undecidable",attribution:void 0,basis:u("unknown"),path:void 0,...a}}if(!E)return{tier:"not-affected",decidedAtStage:"version-match",reason:`${r.packageName}@${t.version} is outside the affected range`,unknownKind:void 0,attribution:void 0,basis:u("not-affected"),path:void 0,...a};let g=Et(n),b=bn(n),w=U=>{if(U.cause!=="dynamic-load"||U.source===null)return i;let J=g.get(U.source);return J===void 0?i:[{path:J.path,start:0,end:0}]},{dispatch:I,load:N}=xa(n,g,b,l),v=[...I,...N],_={unresolvedSites:N,unresolvedEvidence:{own:i,sets:["load"]}},P={unresolvedSites:v,unresolvedEvidence:{own:i,sets:["dispatch","load"]}},R=U=>{for(let J of b)if(g.get(J)?.packageName===U)return!0;return!1},L=U=>({tier:"unknown",decidedAtStage:U,reason:`${o?.exportName??"the certified symbols"} not reached from the application's entrypoints, but the advisory's symbol set is known to be incomplete (surface_complete=0) \u2014 a symbol cupel could not name may be reached; cannot confirm it is unreachable`,unknownKind:"incomplete-surface",attribution:void 0,basis:u("unknown"),path:void 0,...a}),O=()=>{if(!R(r.packageName)){if(N.length>0)return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${r.packageName} is not statically loaded, but a dynamic module load (a non-literal require/import) could pull it`,unknownKind:"dynamic-load",attribution:void 0,basis:u("unknown"),path:void 0,..._};let U=k();return U!==null?{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${r.packageName} is not statically loaded, but an incompleteness fact (loader escape / analysis cap / opaque module) could hide a load \u2014 cannot confirm it is unreachable`,unknownKind:U.cause,attribution:void 0,basis:u("unknown"),path:void 0,...d(w(U))}:t!==null&&t.outOfGraphExecution.length>0?{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${r.packageName} is never loaded from the application's entrypoints, but it can still execute outside the module graph (${t.outOfGraphExecution.join(", ")}) \u2014 "not loaded as a module" is not "not executed"`,unknownKind:"analysis-cap",attribution:void 0,basis:u("unknown"),path:void 0,...a}:{tier:"not-reachable",decidedAtStage:"symbol-reachable",reason:t?.devOnly===!0?`${r.packageName} is not reachable at runtime \u2014 installed as a dev-only dependency and never loaded from the application's entrypoints (assumes no dependency loader loads it); still a build-time exposure`:`${r.packageName} is installed but never loaded from the application's entrypoints (no static import, no dynamic load, corridor complete)`,unknownKind:void 0,attribution:void 0,basis:u("not-reachable"),path:void 0,...a}}return null};if(o===null||!o.verified)return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:o===null?"no derived vulnerable symbol for this advisory (package-level only)":"vulnerable symbol is unverified; cannot claim reachability",unknownKind:o===null?"db-gap":"unverified-symbol",attribution:void 0,basis:u("unknown"),path:void 0,...P};if(s!==null&&!s.comparedPaths.has(o.sourcePath))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`derivation did not cover ${o.sourcePath}; symbol reachability undetermined`,unknownKind:"db-gap",attribution:void 0,basis:u("unknown"),path:void 0,...P};if(o.symbolKind==="accessor"||o.symbolKind==="pattern")return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${o.exportName} is a ${o.symbolKind} symbol; call-graph reachability is not evaluated`,unknownKind:"symbol-unsupported",attribution:void 0,basis:u("unknown"),path:void 0,...P};let F=af(n,g,o);if(F===void 0||!b.has(F.moduleId)){if(F===void 0&&(o.symbolKind==="method"||o.symbolKind==="ctor")&&lf(n,g,b,o))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${o.exportName} may be a static method reached via an ambiguous package-surface member call`,unknownKind:"dep-opaque",attribution:void 0,basis:u("unknown"),path:void 0,...P};if(F===void 0&&(o.symbolKind==="method"||o.symbolKind==="ctor")&&!df(n,g,o))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${o.exportName} is a method of the dependency class ${o.container??"?"}, whose body cupel does not analyze \u2014 a sibling method may reach it through an internal edge`,unknownKind:"dep-opaque",attribution:void 0,basis:u("unknown"),path:void 0,...P};let U=O();if(U!==null)return U;if(v.length>0){let D=F!==void 0?g.get(F.moduleId):ha(n,o),Y=F===void 0&&D!==void 0&&D.externalSurface!==!0&&b.has(D.id)&&!l.has(D.packageName);return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${o.exportName} not statically reached, but unresolved dynamic access exists`,unknownKind:N.length>0?"dynamic-load":Y?"dep-opaque":"dispatch",attribution:void 0,basis:u("unknown"),path:void 0,...P}}let J=F!==void 0?g.get(F.moduleId):ha(n,o);if(F===void 0&&J!==void 0&&J.externalSurface!==!0&&b.has(J.id)&&!l.has(J.packageName))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${o.exportName} is in a loaded dependency module whose bodies are not analyzed (bodyless CJS/member-export surface) \u2014 cannot confirm it is unreachable`,unknownKind:"dep-opaque",attribution:void 0,basis:u("unknown"),path:void 0,...a};let B=J!==void 0?S(J.id):k();return B!==null?{tier:"unknown",decidedAtStage:F===void 0?"symbol-reachable":"module-reachable",reason:`${o.exportName} not statically reached, but an incompleteness fact can hide a path to its corridor \u2014 cannot confirm it is unreachable`,unknownKind:B.cause,attribution:void 0,basis:u("unknown"),path:void 0,...d(w(B))}:r.surfaceComplete?{tier:"not-reachable",decidedAtStage:F===void 0?"symbol-reachable":"module-reachable",reason:`${o.exportName} is never reached from the application's entrypoints`,unknownKind:void 0,attribution:void 0,basis:u("not-reachable"),path:void 0,...a}:L(F===void 0?"symbol-reachable":"module-reachable")}let K=cf(n,ga(n),F.id);if(K!==null)return{tier:Wt(K.usedFieldBased?"field-based":"all-resolved"),decidedAtStage:"call-path-confirmed",reason:`${o.exportName} is called from an application entrypoint`,unknownKind:void 0,attribution:Tr(o),basis:u("reachable-high"),path:uf(n,K.path,K.via),...a};if(v.length>0)return{tier:"unknown",decidedAtStage:"call-path-confirmed",reason:`no resolved call path to ${o.exportName}, but unresolved edges exist`,unknownKind:N.length>0?"dynamic-load":"dispatch",attribution:void 0,basis:u("unknown"),path:void 0,...P};let ee=S(F.moduleId);return ee!==null?{tier:"unknown",decidedAtStage:"call-path-confirmed",reason:`no resolved call path to ${o.exportName}, but an incompleteness fact can hide a path to its corridor \u2014 cannot confirm it is uncalled`,unknownKind:ee.cause,attribution:void 0,basis:u("unknown"),path:void 0,...d(w(ee))}:r.surfaceComplete?{tier:"not-reachable",decidedAtStage:"call-path-confirmed",reason:`${o.exportName} is imported but never called from an entrypoint`,unknownKind:void 0,attribution:void 0,basis:u("not-reachable"),path:void 0,...a}:L("call-path-confirmed")}function ff(e,n){return e.packageName===n.packageName&&e.exportName===n.exportName&&e.container===n.container}function pf(e,n,t){let r=new Map(e.classes.map(o=>[o.id,o.name]));for(let o of e.functions){if(o.name!==t.exportName)continue;let s=n.get(o.moduleId);if(!(s===void 0||s.packageName!==t.packageName||(o.enclosingClassId!==void 0?r.get(o.enclosingClassId)??null:null)!==t.container))return o.id}return null}function mf(e,n,t){if(n===t)return[];let r=new Map(e.functions.map(d=>[d.id,d])),o=new Map(e.callSites.map(d=>[d.id,d])),s=new Map;for(let d of e.callEdges){if(d.resolution!=="resolved"&&d.resolution!=="field-based")continue;let l=o.get(d.callSiteId);if(l===void 0)continue;let c=l.enclosingFunctionId;if(!r.has(c)||!r.has(d.calleeFunctionId))continue;let p=s.get(c),u={to:d.calleeFunctionId,label:d.resolution};p===void 0?s.set(c,[u]):p.push(u)}let i=new Set([n]),a=[{at:n,labels:[]}];for(let d=0;d<a.length;d++){let l=a[d];for(let c of s.get(l.at)??[]){if(i.has(c.to))continue;let p=[...l.labels,c.label];if(c.to===t)return p;i.add(c.to),a.push({at:c.to,labels:p})}}return null}function Vt(e,n,t,r,o){if(o.length===0)return null;let s=$r(e,n,t);if(s.length===0)return null;let i=pf(e,n,r);for(let a of o){let d=s.filter(c=>c.packageName===a.anchor.packageName&&c.exportName===a.anchor.exportName&&c.container===a.anchor.container),l=d.find(c=>c.resolution==="resolved")??d[0];if(l!==void 0){if(ff(a.callee,r))return{tier:Wt("modeled"),modelId:a.modelId,anchorPackage:a.anchor.packageName,entryExport:a.anchor.exportName,pathLabels:[l.resolution,"modeled"]};if(a.callee.realFunctionId!==null&&i!==null){let c=mf(e,a.callee.realFunctionId,i);if(c!==null)return{tier:Wt("modeled"),modelId:a.modelId,anchorPackage:a.anchor.packageName,entryExport:a.anchor.exportName,pathLabels:[l.resolution,"modeled",...c]}}}}return null}var ba=["presence","version-match","module-reachable","symbol-reachable","call-path-confirmed"],ka=["not-affected","not-reachable","reachable-high","reachable-medium","reachable-low","unknown"],ma=["reachable-high","reachable-medium","reachable-low"];function Tr(e){return e.verified?"gated":"candidate"}var Go=["no-entrypoint","analyzer-crash","version-undecidable","db-gap","unverified-symbol","symbol-unsupported","dep-opaque","dynamic-load","dispatch","resolution-divergence","analysis-cap","coverage-gap","incomplete-surface"],Wo=["cupel","project"],Ze={"no-entrypoint":"project","dynamic-load":"project",dispatch:"project","analyzer-crash":"cupel","version-undecidable":"cupel","db-gap":"cupel","unverified-symbol":"cupel","symbol-unsupported":"cupel","dep-opaque":"cupel","resolution-divergence":"cupel","analysis-cap":"cupel","coverage-gap":"cupel","incomplete-surface":"cupel"};function wa(e){return Ze[e]}import{randomBytes as Ri}from"node:crypto";import{performance as Bt}from"node:perf_hooks";var hf="cupel/influence-shadow/1",Ea=64,va=16,gf=e=>e.startsWith("reachable-");function _a(e,n,t){let r=t(),o=Lo(e),s={influenced:0,"no-source-reached":0,"reaches-entry-parameter":0,unknown:0},i={},a=0,d=[];for(let l of n){if(!gf(l.tier))continue;let c={advisoryId:l.advisoryId,packageName:l.packageName,version:l.version,ecosystem:l.ecosystem,symbol:l.symbolName,tier:l.tier};if(l.ecosystem!=="npm"){d.push({...c,skipped:"the Python front-end emits no value layer yet (ADR-112 S6)",sites:[],truncatedSites:!1});continue}let p=l.path?.[l.path.length-1]?.functionId,u=p!==void 0?(o.callers.get(p)??[]).filter(h=>h.direct).map(h=>h.site):[],m=[];for(let h of u.slice(0,Ea)){let x=[],y=h.args?.length??1,S=(k,E)=>{let g=Fo(o,{site:h,port:E});a+=1,s[g.outcome]+=1;for(let b of g.leaves)b.kind==="unknown"&&b.reason!==void 0&&(i[b.reason]=(i[b.reason]??0)+1);x.push({port:k,outcome:g.outcome,leaves:g.leaves,visited:g.visited,...g.witness!==void 0?{witness:g.witness}:{}})};for(let k=0;k<Math.min(y,va);k+=1)S(`arg[${String(k)}]`,{kind:"arg",index:k});h.receiverRange!==void 0&&S("receiver",{kind:"receiver"}),m.push({path:h.range.path,start:h.range.start,enclosing:h.enclosingFunctionId,ports:x,truncatedArgs:y>va})}d.push({...c,sites:m,truncatedSites:u.length>Ea})}return{format:hf,findings:d,totals:{findings:d.length,ports:a,byOutcome:s,unknownReasons:i},wallMs:Math.round((t()-r)*10)/10}}import{mkdirSync as Pi,readdirSync as zc,readFileSync as cx,realpathSync as kr,renameSync as Oi,statSync as Ti,writeFileSync as $i}from"node:fs";import gn from"node:path";import{createRequire as yf}from"node:module";var xf=yf(import.meta.url);function Sf(){try{return xf("node:sqlite")}catch{throw new Error("node:sqlite is unavailable on this runtime (needs Node >= 22.13, or 24+). See ADR-013.")}}function bf(e){return{all:n=>n===void 0?e.all():e.all(n),get:n=>n===void 0?e.get():e.get(n),run:n=>n===void 0?e.run():e.run(n)}}var Dr={open(e,n){let{DatabaseSync:t}=Sf(),r=n==="readonly"?new t(e,{readOnly:!0}):new t(e);return n==="readonly"?r.exec("PRAGMA query_only = ON;"):r.exec("PRAGMA journal_mode = DELETE;"),{exec:o=>r.exec(o),prepare:o=>bf(r.prepare(o)),close:()=>r.close()}}};var Ra=["data","control","state","call-only","config-only"],Pa=["patch-derived","pov-derived","drafted","reviewed"],Oa=["remote-unauthenticated","remote-authenticated","rpc","message","upload","stored","upstream-response","cli","env","file"];var Ia="[A-Za-z_$][A-Za-z0-9_$]{0,127}",kf=new RegExp(`^(?:(?:arg\\[(?:0|[1-9][0-9]{0,2})\\]|receiver)(?:\\.${Ia}){0,${String(4)}}|kwarg\\[${Ia}\\])$`,"u");function $a(e){return kf.test(e)}var qo=(e,n)=>typeof e=="string"&&n.includes(e)?e:null,Aa=e=>{if(e==null)return null;if(typeof e!="string"||e.length>4096)return!1;try{return JSON.parse(e),e}catch{return!1}},Na=e=>e==null?null:typeof e=="string"&&e.length<=4096?e:!1,Lr=e=>typeof e=="number"&&Number.isSafeInteger(e)?e:typeof e=="bigint"?Number(e):null;function Ca(e){let n=Lr(e.id),t=Lr(e.vulnerable_symbol_id),r=qo(e.mode,Ra),o=qo(e.provenance,Pa);if(n===null||t===null||r===null||o===null)return null;let s=r==="call-only"||r==="config-only",i=e.port;if(s?i!==null:typeof i!="string"||!$a(i))return null;let a=e.at_path,d=e.at_start===null?null:Lr(e.at_start),l=e.at_end===null?null:Lr(e.at_end),c=null;if(a!==null||e.at_start!==null||e.at_end!==null){if(typeof a!="string"||a===""||a.length>4096||d===null||l===null||d<0||l<d)return null;c={path:a,start:d,end:l}}let p;try{p=typeof e.accepted_sources=="string"&&e.accepted_sources.length<=4096?JSON.parse(e.accepted_sources):void 0}catch{return null}if(!Array.isArray(p))return null;let u=[];for(let S of p){let k=qo(S,Oa);if(k===null||u.includes(k))return null;u.push(k)}let m=Aa(e.barriers),h=Aa(e.trigger_predicate),x=Na(e.evidence_ref),y=Na(e.reviewer);return m===!1||h===!1||x===!1||y===!1||o==="reviewed"&&y===null?null:{id:n,vulnerableSymbolId:t,mode:r,port:s?null:i,at:c,acceptedSources:u,barriers:m,triggerPredicate:h,provenance:o,evidenceRef:x,reviewer:y}}function Re(e){return typeof e=="string"?e:typeof e=="number"||typeof e=="bigint"?String(e):""}function Ie(e){return typeof e=="string"?e:null}function kn(e){return typeof e=="number"?e:typeof e=="bigint"?Number(e):null}var wf=`
   SELECT a.id AS a_id, a.osv_id, a.cve_id, a.summary, a.severity, a.published, a.source,
          ap.id AS ap_id, ap.advisory_id, ap.ecosystem, ap.package_name,
-         ap.introduced, ap.fixed, ap.last_affected, ap.fix_commit, ap.repo_url`,Oc=`
+         ap.introduced, ap.fixed, ap.last_affected, ap.fix_commit, ap.repo_url`,Ef=`
   FROM affected_package ap
   JOIN advisory a ON a.id = ap.advisory_id
-  WHERE ap.ecosystem = :eco AND ap.package_name = :name`,Cc=`EXISTS (SELECT 1 FROM vulnerable_symbol vs
-                 WHERE vs.affected_package_id = ap.id AND vs.verified = 1) AS surface_complete`,Mc=5,Tc=6;function Dc(e){let n=e>=Tc?"a.details":"NULL AS details",t=e>=Mc?"ap.surface_complete":Cc;return`${$c}, ${n}, ${t}${Oc}`}var Lc="SELECT * FROM vulnerable_symbol WHERE affected_package_id = :id",Fc="SELECT * FROM symbol_alias WHERE vulnerable_symbol_id = :id",jc="SELECT value FROM ingest_meta WHERE key = 'schema_version'",Bc="SELECT DISTINCT ecosystem FROM affected_package ORDER BY ecosystem";function bt(e,n=to){let t=n.open(e,"readonly"),o=t.prepare(jc).get(),r=o!==void 0?Ae(o.value):"",s=/^\d+$/u.test(r)?Number(r):0,a=t.prepare(Dc(s)),l=t.prepare(Lc),i=t.prepare(Fc),d=t.prepare(Bc);return{schemaVersion:r,ecosystems(){return d.all({}).map(u=>Ae(u.ecosystem))},advisoriesForPackage(u,p){return a.all({eco:u,name:p}).map(f=>({affected:{id:cn(f.ap_id)??0,advisoryId:Ae(f.advisory_id),ecosystem:Ae(f.ecosystem),packageName:Ae(f.package_name),introduced:Ee(f.introduced),fixed:Ee(f.fixed),lastAffected:Ee(f.last_affected),fixCommit:Ee(f.fix_commit),repoUrl:Ee(f.repo_url),surfaceComplete:cn(f.surface_complete)===1?1:0},advisory:{id:Ae(f.a_id),osvId:Ee(f.osv_id),cveId:Ee(f.cve_id),summary:Ee(f.summary),details:Ee(f.details),severity:Ee(f.severity),published:Ee(f.published),source:Ae(f.source)==="osv"?"osv":"ghsa"}}))},symbolsForAffected(u){return l.all({id:u}).map(p=>({id:cn(p.id)??0,affectedPackageId:cn(p.affected_package_id)??0,exportName:Ee(p.export_name),symbolKind:Ae(p.symbol_kind),matchPattern:Ee(p.match_pattern),matchGlobs:Ee(p.match_globs),container:Ee(p.container),sourcePath:Ee(p.source_path),declStart:cn(p.decl_start),declEnd:cn(p.decl_end),astHashBefore:Ee(p.ast_hash_before),astHashAfter:Ee(p.ast_hash_after),derivation:Ae(p.derivation),confidence:Ae(p.confidence),verified:cn(p.verified)===1?1:0}))},aliasesForSymbol(u){return i.all({id:u}).map(p=>({id:cn(p.id)??0,vulnerableSymbolId:cn(p.vulnerable_symbol_id)??0,aliasPath:Ae(p.alias_path),aliasName:Ae(p.alias_name)}))},allModels(){let u;try{u=t.prepare(`SELECT id, package_name, introduced, fixed_before, evidence_ref
-               FROM model_package ORDER BY package_name, introduced`).all({})}catch{return[]}let p=t.prepare(`SELECT kind, anchor_export, anchor_container, callee_package, callee_container, callee_export
-           FROM model_edge WHERE model_package_id = :id ORDER BY id`);return u.map(f=>{let m=cn(f.id)??0;return{packageName:Ae(f.package_name),modelId:Ae(f.evidence_ref),introduced:Ae(f.introduced),fixedBefore:Ee(f.fixed_before),evidenceRef:Ae(f.evidence_ref),edges:p.all({id:m}).map(g=>({kind:Ae(g.kind),anchorExport:Ae(g.anchor_export),anchorContainer:Ee(g.anchor_container),calleePackage:Ae(g.callee_package),calleeContainer:Ee(g.callee_container),calleeExport:Ae(g.callee_export)}))}})},close(){t.close()}}}function nr(e){let n=e[0];if(n===void 0)throw new Error("compositeShardReader: at least one shard is required");for(let p of e)if(p.schemaVersion!==n.schemaVersion)throw new Error(`compositeShardReader: shards disagree on schema version (${n.schemaVersion} vs ${p.schemaVersion}); refusing to scan against a mixed schema`);let t=new Map,o=new Map,r=new Map,s=new Map,a=1,l=(p,f,m,g)=>{let y=`${String(m)}:${String(g)}`,b=p.get(y);if(b!==void 0)return b;let x=a;a+=1,p.set(y,x);let I=e[m];if(I===void 0)throw new Error("unreachable: reader index out of range");return f.set(x,{reader:I,id:g}),x},i=e.map(p=>new Set(p.ecosystems?.()??[])),d=p=>{let f=e.map((m,g)=>g).filter(m=>i[m]?.has(p)===!0);return f.length>0?f:e.map((m,g)=>g).filter(m=>e[m]?.ecosystems===void 0)},u=(p,f)=>({...f,id:l(r,s,p,f.id),affectedPackageId:l(t,o,p,f.affectedPackageId)});return{schemaVersion:n.schemaVersion,ecosystems(){let p=new Set;for(let f of i)for(let m of f)p.add(m);return[...p].sort()},advisoriesForPackage(p,f){let m=[];for(let g of d(p)){let y=e[g];if(y!==void 0)for(let b of y.advisoriesForPackage(p,f))m.push({...b,affected:{...b.affected,id:l(t,o,g,b.affected.id)}})}return m},symbolsForAffected(p){let f=o.get(p);if(f===void 0)return[];let m=e.indexOf(f.reader);return f.reader.symbolsForAffected(f.id).map(g=>u(m,g))},aliasesForSymbol(p){let f=s.get(p);if(f===void 0)return[];let m=e.indexOf(f.reader);return f.reader.aliasesForSymbol(f.id).map(g=>({...g,vulnerableSymbolId:l(r,s,m,g.vulnerableSymbolId)}))},allModels(){return e.flatMap(p=>p.allModels?.()??[])},close(){for(let p of e)p.close()}}}var jn="6";import{realpathSync as kn}from"node:fs";import Ye from"node:path";import{realpathSync as Un}from"node:fs";import{isBuiltin as gr}from"node:module";import Me from"node:path";import E from"typescript";function tr(e){let n=e.trim().replace(/\\/gu,"/"),t=n.length;for(;t>0&&n.charCodeAt(t-1)===47;)t-=1;return t===n.length?n:n.slice(0,t)}function we(e){let n=tr(e);if(n===""||n.startsWith(".")||n.startsWith("/"))return"relative";if(n.startsWith("@")){let t=n.indexOf("/");return t===-1||n.indexOf("/",t+1)===-1?"package-root":"package-subpath"}return n.includes("/")?"package-subpath":"package-root"}function Ge(e){let n=tr(e);if(n.startsWith("@")){let o=n.indexOf("/");if(o===-1)return n;let r=n.indexOf("/",o+1);return r===-1?n:n.slice(0,r)}let t=n.indexOf("/");return t===-1?n:n.slice(0,t)}function Qs(e){let n=tr(e),t=Ge(n);return n.length>t.length+1?n.slice(t.length+1):""}import{readFileSync as Vc,statSync as or}from"node:fs";var In=16*1024*1024;function tt(e,n){try{let t=or(e);return t.isFile()?t.size>n?{kind:"too-large",bytes:t.size}:{kind:"ok",text:Vc(e,"utf8")}:{kind:"not-regular"}}catch{return{kind:"not-regular"}}}function Oe(e){let n=tt(e,In);return n.kind==="ok"?n.text:null}function un(e){try{return or(e).isFile()}catch{return!1}}function ei(e){try{let n=or(e);return n.isFile()?"file":n.isDirectory()?"dir":"other"}catch{return"other"}}import{opendirSync as qc,realpathSync as ir}from"node:fs";import ae from"node:path";import oo from"typescript";var ii=[[".d.mts",[".mjs"]],[".d.cts",[".cjs"]],[".d.ts",[".js",".cjs",".mjs",".jsx"]]];function Ke(e){return ii.some(([n])=>e.endsWith(n))}function Gc(e){for(let[n,t]of ii)if(e.endsWith(n)){let o=e.slice(0,-n.length);return t.map(r=>o+r)}return[]}var Hc=[[".tsx",[".js",".jsx",".cjs",".mjs"]],[".cts",[".cjs"]],[".mts",[".mjs"]],[".ts",[".js",".cjs",".mjs",".jsx"]]];function ai(e){if(Ke(e))return e;for(let[n,t]of Hc)if(e.endsWith(n)){let o=e.slice(0,-n.length);for(let r of t){let s=o+r;if(un(s))return s}return e}return e}var ar=[oo.ModuleKind.CommonJS,oo.ModuleKind.ESNext],lr=[[],["node-addons"],["module-sync"],["node-addons","module-sync"]];function kt(e,n,t,o,r,s){let a=oo.resolveModuleName(e,n,t,o,void 0,void 0,r).resolvedModule;if(a===void 0)return null;let l=a.resolvedFileName;if(s){for(let i of Gc(l))if(un(i))return i}return l}var li=[".js",".jsx",".cjs",".mjs",".ts",".tsx",".cts",".mts"],Xc=[".js",".json",".node"],Yc=["index.js","index.json","index.node"];function ro(e){return!Ke(e)&&li.some(n=>e.endsWith(n))}function di(e){if(un(e))return e;for(let n of Xc)if(un(e+n))return e+n;return null}function ni(e){for(let n of Yc){let t=ae.join(e,n);if(un(t))return t}return null}var ci=[".ts",".tsx",".cts",".mts",".jsx"];function Jc(e){for(let n of ci)if(un(e+n))return e+n;return null}function Zc(e){for(let n of ci){let t=ae.join(e,"index"+n);if(un(t))return t}return null}function dr(e){let n=Oe(ae.join(e,"package.json"));if(n!==null)try{let t=JSON.parse(n).main;if(typeof t=="string"&&t.length>0){let o=ae.join(e,t),r=di(o)??ni(o);if(r!==null)return r}}catch{}return ni(e)}function ui(e){return di(e)??dr(e)??Jc(e)??Zc(e)}function fi(e){return ui(e)!==null}function Qc(e,n){let t=e.split(ae.sep),o=n.split("/"),r=null;for(let a=t.length-o.length-1;a>=0;a-=1)if(t[a]==="node_modules"&&o.every((l,i)=>t[a+1+i]===l)){r=t.slice(0,a+1+o.length).join(ae.sep);break}if(r===null||r==="")return null;let s=Oe(ae.join(r,"package.json"));if(s===null)return null;try{let a=JSON.parse(s),l=a.exports,i=typeof l=="string"||Array.isArray(l)||typeof l=="object"&&l!==null;if(a.name!==n||i)return null}catch{return null}try{return ir(r)}catch{return null}}function eu(e,n){let t=ui(ae.join(e,n));if(t===null)return null;let o;try{o=ir(t)}catch{return null}let r=e.endsWith(ae.sep)?e:e+ae.sep;return o!==e&&!o.startsWith(r)||Ke(o)||!li.some(s=>o.endsWith(s))?null:o}function nu(e,n){let t=Qs(e);return t===""||t.includes("\0")||t.split("/").some(o=>o===""||o==="."||o===".."||o==="node_modules")?null:eu(n,t)}var Bn={kind:"nothing-loads"},rr=8192;function sr(e,n){let t=n.get(e);if(t!==void 0)return t;let o,r=null;try{r=qc(e);let s=new Set,a=!1;for(;;){let l=r.readSync();if(l===null)break;if(s.size>=rr){a=!0;break}s.add(l.name)}o={names:s,truncated:a}}catch{o=null}finally{try{r?.closeSync()}catch{}}return n.set(e,o),o}var tu=[".json",".css",".scss",".sass",".less",".styl",".svg",".png",".jpg",".jpeg",".gif",".webp",".avif",".ico",".bmp",".woff",".woff2",".ttf",".otf",".eot",".mp3",".mp4",".webm",".txt"];function pi(e){return tu.some(n=>e.length>n.length&&e.endsWith(n))}function An(e,n){let t=e.endsWith(ae.sep)?e:e+ae.sep;return n===e||n.startsWith(t)}function ti(e,n){let t;try{t=ir(n)}catch{return{kind:"missing"}}return An(e,t)?{kind:"ok",real:t}:{kind:"escaped"}}function oi(e,n){let t=(n+".").toLowerCase(),o=[];for(let r of e){let s=r.toLowerCase();s.length>t.length&&s.startsWith(t)&&o.push(r)}return o}function ou(e,n,t){let o=ae.dirname(n);if(!An(e,o))return null;let r=sr(o,t);if(r===null)return null;let s=ae.basename(n);return r.names.has(s)?s:null}function ri(e,n){let t=e.filter(r=>!pi(r));if(t.length===0)return Bn;let o=[...t].sort()[0]??"";return{kind:"unanalyzable",reason:`${n} ("${o}") the analyzer cannot parse`,why:"sibling-unparsable"}}function mi(e,n,t,o){let r=e,s=r.indexOf("?");s!==-1&&(r=r.slice(0,s));let a=r.indexOf("#");if(a!==-1&&(r=r.slice(0,a)),r===""||r.includes("\0"))return Bn;let l=ae.resolve(ae.dirname(n),r);if(!An(t,l))return{kind:"unanalyzable",reason:"its target is outside the scan root and was not probed",why:"out-of-root"};let i=ti(t,l);if(i.kind==="escaped")return{kind:"unanalyzable",reason:"a symlink carries its target outside the scan root, which was not probed",why:"out-of-root"};if(i.kind==="ok"){let m=ei(i.real);if(m==="file"){let b=ou(t,i.real,o);return b!==null&&pi(b)?Bn:{kind:"unanalyzable",reason:b===null?"a file exists at that path under a name its directory listing did not confirm":`a file exists at that path ("${b}") the analyzer cannot parse`,why:b===null?"probe-refused":"sibling-unparsable"}}if(m!=="dir")return{kind:"unanalyzable",reason:"its target exists but is not a regular file",why:"probe-refused"};let g=sr(i.real,o);if(g===null)return{kind:"unanalyzable",reason:"its target directory could not be listed",why:"probe-refused"};let y=ri(oi(g.names,"index"),"a directory index");return y.kind==="unanalyzable"?y:g.names.has("package.json")?{kind:"unanalyzable",reason:"its target is a directory whose package.json main did not resolve",why:"probe-refused"}:g.truncated?{kind:"unanalyzable",reason:`its target directory exceeds ${String(rr)} entries and was not fully probed`,why:"probe-refused"}:Bn}let d=ae.basename(l);if(d===""||d==="."||d==="..")return Bn;let u=ti(t,ae.dirname(l));if(u.kind==="escaped")return{kind:"unanalyzable",reason:"a symlink carries its target directory outside the scan root, which was not probed",why:"out-of-root"};if(u.kind==="missing")return Bn;let p=sr(u.real,o);if(p===null)return{kind:"unanalyzable",reason:"its target directory could not be listed",why:"probe-refused"};let f=ri(oi(p.names,d),"a sibling file exists");return f.kind==="unanalyzable"?f:p.truncated?{kind:"unanalyzable",reason:`its target directory exceeds ${String(rr)} entries and was not fully probed`,why:"probe-refused"}:Bn}function cr(e,n){let t=Ge(e),o=ae.dirname(n);for(let r=0;r<64;r+=1){let s=ae.join(o,"node_modules",...t.split("/"));if(Oe(ae.join(s,"package.json"))!==null)return s;let a=ae.dirname(o);if(a===o)return null;o=a}return null}function si(e,n,t,o,r){let s;for(let a of ar)for(let l of lr){let i={...t,noDtsResolution:!0,customConditions:[...l]},d=kt(e,n,i,o,a,r);if(s===void 0)s=d;else if(s!==d)return null}return s??null}function He(e,n,t,o){let r=we(e);if(r==="relative")return kt(e,n,t,o,void 0,!0);if(r==="package-root"){let l=si(e,n,t,o,!0);if(l!==null)return l;let i=cr(e,n);if(i===null||Oe(ae.join(i,"package.json"))?.includes('"exports"')===!0)return null;let d=dr(i);return d===null||Ke(d)?null:An(i,d)?d:null}let s=si(e,n,t,o,!1);if(s===null)return null;let a=Qc(s,Ge(e));return a!==null?nu(e,a):Ke(s)?s:ai(s)}function hi(e){let n=e.trim();return n.startsWith("@/")||n==="~"||n.startsWith("~/")||n.startsWith("#")}function Et(e,n,t,o){let r=we(e);if(r==="relative")return"no-candidate";if(hi(e))return"alias-unmapped";let s=new Set;for(let g of ar)for(let y of lr){let b={...t,noDtsResolution:!0,customConditions:[...y]};s.add(kt(e,n,b,o,g,r==="package-root"))}if(s.size>1)return"divergent-exports";let a=cr(e,n);if(a===null)return"not-installed";let l=Oe(ae.join(a,"package.json"));if(l===null)return"unreadable-manifest";let i;try{i=JSON.parse(l)}catch{return"unreadable-manifest"}if(typeof i!="object"||i===null)return"unreadable-manifest";let d=i,u=d.exports!==void 0&&d.exports!==null,p=typeof d.typesVersions=="object"&&d.typesVersions!==null,[f]=s;if(f!=null)return An(a,f)?!u&&p?"types-versions-remap":Ke(f)?"declaration-only":"no-candidate":"out-of-root";let m=kt(e,n,t,o,void 0,!1);if(m!==null&&Ke(m))return!u&&p?"types-versions-remap":"declaration-only";if(r==="package-root"&&!u){let g=dr(a);if(g!==null&&!An(a,g))return"out-of-root"}return"no-candidate"}function ot(e,n,t,o){let r=He(e,n,t,o);if(r!==null)return[r];let s=we(e);if(s==="relative")return[];let a=new Set;for(let d of ar)for(let u of lr){let p={...t,noDtsResolution:!0,customConditions:[...u]};a.add(kt(e,n,p,o,d,s==="package-root"))}if(a.size<2||a.has(null))return[];let l=cr(e,n);if(l===null)return[];let i=[];for(let d of a){if(d===null)return[];let u=ai(d);if(Ke(u)||!An(l,u))return[];i.push(u)}return[...new Set(i)].sort()}function gi(e,n){let t=ae.dirname(e);for(let o=0;o<64;o+=1){let r=Oe(ae.join(t,"package.json"));if(r!==null){try{let a=JSON.parse(r);if(typeof a!="object"||a===null)return!1;let l=a.optionalDependencies;if(typeof l=="object"&&l!==null&&n in l)return!0;let i=a.peerDependenciesMeta;if(typeof i=="object"&&i!==null){let d=i[n];if(typeof d=="object"&&d!==null)return d.optional===!0}}catch{return!1}return!1}let s=ae.dirname(t);if(s===t)return!1;t=s}return!1}function yi(e,n,t){let o=Oe(ae.join(e,"tsconfig.json"));if(o===null)return()=>null;let r=oo.parseConfigFileTextToJson(ae.join(e,"tsconfig.json"),o);if(r.error!==void 0)return()=>null;let s=r.config?.compilerOptions;if(typeof s!="object"||s===null)return()=>null;let a=s.paths;if(typeof a!="object"||a===null)return()=>null;let l=s.baseUrl,i=typeof l=="string"?ae.resolve(e,l):e,d=new Map,u=[];for(let[f,m]of Object.entries(a)){if(!Array.isArray(m))continue;let g=m.filter(b=>typeof b=="string");if(g.length===0)continue;let y=f.indexOf("*");y===-1?d.set(f,g):f.indexOf("*",y+1)===-1&&u.push({prefix:f.slice(0,y),suffix:f.slice(y+1),targets:g})}if(u.sort((f,m)=>m.prefix.length-f.prefix.length),d.size===0&&u.length===0)return()=>null;let p=f=>{let m=d.get(f);if(m!==void 0)return m;for(let g of u){if(f.length<g.prefix.length+g.suffix.length||!f.startsWith(g.prefix)||!f.endsWith(g.suffix))continue;let y=f.slice(g.prefix.length,f.length-g.suffix.length);return g.targets.map(b=>{let x=b.indexOf("*");return x===-1?b:b.slice(0,x)+y+b.slice(x+1)})}return[]};return(f,m)=>{let g=p(f);if(g.length===0||He(f,m,n,t)!==null)return null;for(let y of g){let b=ae.resolve(i,y),x=ae.relative(ae.dirname(m),b).split(ae.sep).join("/");if(x==="")continue;x.startsWith(".")||(x=`./${x}`);let I=He(x,m,n,t);if(I!==null&&An(e,I))return I}return null}}import{readdirSync as ru,realpathSync as su}from"node:fs";import Sn from"node:path";import V from"typescript";function wt(e,n){if(V.isIdentifier(e))n.add(e.text);else for(let t of e.elements)V.isBindingElement(t)&&wt(t.name,n)}function rt(e){let n=new Map,t=new Set,o=i=>{n.set(i,(n.get(i)??0)+1)},r=i=>{let d=Ue(i);if(V.isIdentifier(d))t.add(d.text);else if(V.isArrayLiteralExpression(d))for(let u of d.elements)r(u);else if(V.isObjectLiteralExpression(d))for(let u of d.properties)V.isShorthandPropertyAssignment(u)?t.add(u.name.text):V.isPropertyAssignment(u)?r(u.initializer):V.isSpreadAssignment(u)&&r(u.expression);else V.isSpreadElement(d)?r(d.expression):V.isBinaryExpression(d)&&d.operatorToken.kind===V.SyntaxKind.EqualsToken&&r(d.left)},s=i=>{let d=new Set;wt(i,d);for(let u of d)o(u)},a=i=>{V.isVariableDeclaration(i)?s(i.name):V.isFunctionDeclaration(i)&&i.name!==void 0||V.isClassDeclaration(i)&&i.name!==void 0?o(i.name.text):V.isParameter(i)?s(i.name):((V.isFunctionExpression(i)||V.isClassExpression(i))&&i.name!==void 0&&V.isIdentifier(i.name)&&!(i.parent!==void 0&&V.isVariableDeclaration(i.parent)&&i.parent.initializer===i&&V.isIdentifier(i.parent.name)&&i.parent.name.text===i.name.text)||V.isImportClause(i)&&i.name!==void 0||V.isNamespaceImport(i)||V.isImportSpecifier(i)||V.isImportEqualsDeclaration(i))&&o(i.name.text),V.isBinaryExpression(i)&&i.operatorToken.kind>=V.SyntaxKind.FirstAssignment&&i.operatorToken.kind<=V.SyntaxKind.LastAssignment?r(i.left):(V.isPrefixUnaryExpression(i)||V.isPostfixUnaryExpression(i))&&(i.operator===V.SyntaxKind.PlusPlusToken||i.operator===V.SyntaxKind.MinusMinusToken)?r(i.operand):(V.isForOfStatement(i)||V.isForInStatement(i))&&!V.isVariableDeclarationList(i.initializer)&&r(i.initializer),V.forEachChild(i,a)};a(e);let l=new Set(t);for(let[i,d]of n)d>1&&l.add(i);return l}function Kn(e,n,t){let o=rt(e),r=new Map,s=a=>{V.isVariableDeclaration(a)&&V.isIdentifier(a.name)&&a.initializer!==void 0&&!o.has(a.name.text)&&!r.has(a.name.text)&&r.set(a.name.text,a.initializer),V.forEachChild(a,s)};return s(e),{containingFile:n,taintedNames:o,constBindings:r,resolveParamDirs:t}}var iu=1024,au=32,lu=new Set(["filter","sort","slice","reverse"]),du=new Set(["forEach","map","filter","flatMap","find","some","every"]);function Ue(e){let n=e;for(;V.isParenthesizedExpression(n);)n=n.expression;return n}function xi(e,n){return V.isPropertyAccessExpression(e)&&V.isIdentifier(e.expression)&&e.expression.text==="path"&&e.name.text===n}function _n(e,n,t,o){if(t>au)return null;let r=Ue(e);if(V.isStringLiteralLike(r))return r.text;if(V.isTemplateExpression(r)){let s=r.head.text;for(let a of r.templateSpans){let l=_n(a.expression,n,t+1,o);if(l===null)return null;s+=l+a.literal.text}return s}if(V.isBinaryExpression(r)&&r.operatorToken.kind===V.SyntaxKind.PlusToken){let s=_n(r.left,n,t+1,o);if(s===null)return null;let a=_n(r.right,n,t+1,o);return a===null?null:s+a}if(V.isIdentifier(r)){if(r.text==="__dirname")return Sn.dirname(n.containingFile);if(r.text==="__filename")return n.containingFile;if(n.taintedNames.has(r.text)||o.has(r.text))return null;let s=n.constBindings.get(r.text);if(s===void 0)return null;o.add(r.text);let a=_n(s,n,t+1,o);return o.delete(r.text),a}if(V.isCallExpression(r)){let s=xi(r.expression,"join"),a=xi(r.expression,"resolve");if(!s&&!a)return null;let l=[];for(let d of r.arguments){let u=_n(d,n,t+1,o);if(u===null)return null;l.push(u)}let i=l[0];return i===void 0||a&&!Sn.isAbsolute(i)?null:a?Sn.resolve(...l):Sn.join(...l)}return null}function so(e){let n=Ue(e);if(V.isBinaryExpression(n)&&n.operatorToken.kind===V.SyntaxKind.PlusToken)return[...so(n.left),...so(n.right)];if(V.isTemplateExpression(n)){let t=[];n.head.text.length>0&&t.push({lit:n.head.text});for(let o of n.templateSpans)t.push({expr:o.expression}),o.literal.text.length>0&&t.push({lit:o.literal.text});return t}return V.isStringLiteralLike(n)?[{lit:n.text}]:[{expr:n}]}function ki(e){let n=e,t=0;for(;t++<4096;){let o=n.parent;if(o===void 0)return null;if(V.isForOfStatement(o)&&o.statement===n){let r=o.initializer;if(V.isVariableDeclarationList(r)&&r.declarations.length===1&&r.declarations[0]!==void 0&&V.isIdentifier(r.declarations[0].name)&&r.declarations[0].name.text===e.text){let s=Si(o.expression);if(s!==null)return s}}if((V.isArrowFunction(n)||V.isFunctionExpression(n))&&V.isCallExpression(o)&&o.arguments.length>0&&o.arguments[0]===n&&V.isPropertyAccessExpression(o.expression)&&du.has(o.expression.name.text)){let r=n.parameters[0];if(r!==void 0&&V.isIdentifier(r.name)&&r.name.text===e.text){let s=Si(o.expression.expression);if(s!==null)return s}}n=o}return null}function Si(e){let n=Ue(e),t=0;for(;V.isCallExpression(n)&&t++<16;){let o=n.expression;if(V.isPropertyAccessExpression(o)){let r=o.name.text;if(r==="readdirSync")return n.arguments[0]??null;if(lu.has(r)){n=Ue(o.expression);continue}return null}return V.isIdentifier(o)&&o.text==="readdirSync"?n.arguments[0]??null:null}return null}function cu(e,n){let t=so(e);if(t.length<2)return null;let o=t[t.length-1];if(o===void 0||!("expr"in o)||!V.isIdentifier(o.expr))return null;let r=o.expr;if(n.taintedNames.has(r.text))return null;let s="";for(let d=0;d<t.length-1;d+=1){let u=t[d];if(u===void 0)return null;if("lit"in u)s+=u.lit;else{let p=_n(u.expr,n,0,new Set);if(p===null)return null;s+=p}}let a=ki(r),l=a===null?null:_n(a,n,0,new Set);if(l===null)return null;let i=Sn.resolve(s);return i!==Sn.resolve(l)?null:i}function uu(e){if((V.isFunctionDeclaration(e)||V.isFunctionExpression(e))&&e.name!==void 0&&V.isIdentifier(e.name)||V.isMethodDeclaration(e)&&V.isIdentifier(e.name))return e.name.text;let n=e.parent;return n!==void 0&&V.isVariableDeclaration(n)&&V.isIdentifier(n.name)?n.name.text:null}function fu(e,n){for(let t=e.parent;t!==void 0;t=t.parent){if(!V.isFunctionLike(t))continue;let o=-1;for(let s=0;s<t.parameters.length;s+=1){let a=t.parameters[s];if(a!==void 0&&V.isIdentifier(a.name)&&a.name.text===n){o=s;break}}if(o<0)continue;let r=uu(t);return r===null?null:{fnName:r,paramIndex:o}}return null}function vt(e,n){let t=so(e);if(t.length!==2)return null;let[o,r]=t;if(o===void 0||!("expr"in o)||!V.isIdentifier(o.expr)||r===void 0||!("expr"in r)||!V.isIdentifier(r.expr))return null;let s=o.expr,a=r.expr;if(n.taintedNames.has(s.text)||n.taintedNames.has(a.text))return null;let l=ki(a);return l===null||!V.isIdentifier(l)||l.text!==s.text?null:fu(s,s.text)}function pu(e,n){if(n.resolveParamDirs===void 0)return null;let t=vt(e,n);return t===null?null:n.resolveParamDirs(n.containingFile,t.fnName,t.paramIndex)}function io(e){for(let n=e.parent;n!==void 0;n=n.parent){if(V.isSourceFile(n))return!0;if(!V.isArrowFunction(n)&&V.isFunctionLike(n))return!1}return!0}function ur(e,n){let t=_n(e,n,0,new Set);if(t!==null)return{kind:"const",value:t};let o=cu(e,n);if(o!==null)return{kind:"dir",dir:o};let r=pu(e,n);return r!==null&&r.length>0?{kind:"dirs",dirs:[...r]}:{kind:"opaque"}}function Ei(e,n){let t;try{t=su(e)}catch{return null}let o=n.endsWith(Sn.sep)?n:n+Sn.sep;return t===n||t.startsWith(o)?t:null}function wi(e,n,t,o,r){let s=He(e,n,o,r);return s===null||Ke(s)||!ro(s)?null:Ei(s,t)}function bi(e,n,t,o,r){let s=Ei(e,t);if(s===null)return[];let a;try{a=ru(s)}catch{return[]}if(a.length===0||a.length>iu)return[];a.sort();let l=new Set,i=[];for(let d of a){let u=wi(Sn.join(s,d),n,t,o,r);u!==null&&!l.has(u)&&(l.add(u),i.push(u))}return i}function ao(e,n,t,o,r){let s=ur(e,n);if(s.kind==="const"){if(we(s.value)==="package-root")return[];let a=wi(s.value,n.containingFile,t,o,r);return a===null?[]:[a]}if(s.kind==="dir")return bi(s.dir,n.containingFile,t,o,r);if(s.kind==="dirs"){let a=new Set,l=[];for(let i of s.dirs)for(let d of bi(i,n.containingFile,t,o,r))a.has(d)||(a.add(d),l.push(d));return l}return[]}import mu from"node:path";import me from"typescript";var hu=32,lo="\0",vi=(e,n)=>`${e}${lo}${n}`,Ii=(e,n,t)=>`${e}${lo}${n}${lo}${String(t)}`;function gu(e){let n=new Map,t=new Set,o=(r,s)=>{if(t.has(r)){n.delete(r);return}t.add(r),n.set(r,s)};for(let r of e.statements)if(me.isImportDeclaration(r)&&me.isStringLiteralLike(r.moduleSpecifier)){let s=r.moduleSpecifier.text,a=r.importClause;if(a===void 0)continue;a.name!==void 0&&o(a.name.text,{kind:"module",specifier:s});let l=a.namedBindings;if(l!==void 0&&me.isNamespaceImport(l))o(l.name.text,{kind:"module",specifier:s});else if(l!==void 0&&me.isNamedImports(l))for(let i of l.elements)o(i.name.text,{kind:"named",specifier:s,imported:(i.propertyName??i.name).text})}else if(me.isImportEqualsDeclaration(r)&&me.isExternalModuleReference(r.moduleReference)&&me.isStringLiteralLike(r.moduleReference.expression))o(r.name.text,{kind:"module",specifier:r.moduleReference.expression.text});else if(me.isFunctionDeclaration(r)&&r.name!==void 0)o(r.name.text,{kind:"local"});else if(me.isVariableStatement(r))for(let s of r.declarationList.declarations){if(s.initializer===void 0)continue;let a=s.initializer;if(me.isIdentifier(s.name))me.isArrowFunction(a)||me.isFunctionExpression(a)?o(s.name.text,{kind:"local"}):Ai(a)&&o(s.name.text,{kind:"module",specifier:_i(a)});else if(me.isObjectBindingPattern(s.name)&&Ai(a)){let l=_i(a);for(let i of s.name.elements){if(i.dotDotDotToken!==void 0||!me.isIdentifier(i.name))continue;let d=i.propertyName??i.name;!me.isIdentifier(d)&&!me.isStringLiteralLike(d)||o(i.name.text,{kind:"named",specifier:l,imported:d.text})}}}return n}function Ai(e){return me.isCallExpression(e)&&me.isIdentifier(e.expression)&&e.expression.text==="require"&&e.arguments.length===1&&e.arguments[0]!==void 0&&me.isStringLiteralLike(e.arguments[0])}function _i(e){let n=e.arguments[0];return n!==void 0&&me.isStringLiteralLike(n)?n.text:"\0"}function yu(e){let n=e.expression;if(me.isPropertyAccessExpression(n))return n.name.text;if(me.isIdentifier(n))return n.text}function xu(e,n,t,o,r,s){let a=e.expression,l=i=>{let d=`${i}${lo}${n}`,u=s.get(d);if(u!==void 0||s.has(d))return u??null;let p=He(i,n,o,r),f=p===null?null:mu.resolve(p);return s.set(d,f),f};if(me.isPropertyAccessExpression(a)&&me.isIdentifier(a.expression)){let i=t.get(a.expression.text);if(i?.kind==="module"){let d=l(i.specifier);return d===null?null:{moduleReal:d,fnName:a.name.text}}return null}if(me.isIdentifier(a)){let i=t.get(a.text);if(i?.kind==="named"){let d=l(i.specifier);return d===null?null:{moduleReal:d,fnName:i.imported}}return i?.kind==="local"?{moduleReal:n,fnName:a.text}:null}return null}function Ni(e,n,t,o,r=new Map){if(n.length===0)return()=>null;let s=new Map,a=new Set;for(let i of n){let d=vi(i.definingModuleReal,i.fnName),u=s.get(d);u===void 0&&(u=new Set,s.set(d,u)),u.add(i.paramIndex),a.add(i.fnName)}let l=new Map;for(let i of e){let d=Kn(i.sf,i.real),u=gu(i.sf),p=f=>{if(me.isCallExpression(f)){let m=yu(f);if(m!==void 0&&a.has(m)&&io(f)){let g=xu(f,i.real,u,t,o,r);if(g!==null){let y=s.get(vi(g.moduleReal,g.fnName));if(y!==void 0)for(let b of y){let x=f.arguments[b];if(x===void 0)continue;let I=ur(x,d);if(I.kind==="const"){let w=Ii(g.moduleReal,g.fnName,b),A=l.get(w);A===void 0&&(A=new Set,l.set(w,A)),A.add(I.value)}}}}}me.forEachChild(f,p)};p(i.sf)}return(i,d,u)=>{let p=l.get(Ii(i,d,u));return p===void 0||p.size===0||p.size>hu?null:[...p].sort()}}var Ce={allowJs:!0,checkJs:!1,noEmit:!0,skipLibCheck:!0,target:E.ScriptTarget.ES2020,module:E.ModuleKind.CommonJS,moduleResolution:E.ModuleResolutionKind.Node10,types:[]},co=5e3;function Le(e,n){let t;try{t=Un(n)}catch{t=Me.resolve(n)}let o=e.endsWith(Me.sep)?e:e+Me.sep;return t!==e&&!t.startsWith(o)?null:t===e?"":t.slice(o.length).split(Me.sep).join("/")}function _e(e){let n=e;for(;;)if(E.isParenthesizedExpression(n))n=n.expression;else if(E.isBinaryExpression(n)&&n.operatorToken.kind===E.SyntaxKind.CommaToken)n=n.right;else return n}function bn(e){return E.isPropertyAccessExpression(e)?{receiver:_e(e.expression),name:e.name.text}:E.isElementAccessExpression(e)&&E.isStringLiteralLike(e.argumentExpression)?{receiver:_e(e.expression),name:e.argumentExpression.text}:null}function _t(e){let n=_e(e.expression);if(E.isIdentifier(n)&&n.text==="require")return{specifierArg:e.arguments[0]};if(n.kind===E.SyntaxKind.ImportKeyword)return{specifierArg:e.arguments[0]};let t=bn(n);if(t!==null){if(t.name==="require"&&E.isIdentifier(t.receiver)&&t.receiver.text==="module")return{specifierArg:e.arguments[0]};if(E.isIdentifier(t.receiver)&&t.receiver.text==="require"){if(t.name==="call")return{specifierArg:e.arguments[1]};if(t.name==="apply"){let o=e.arguments[1];return{specifierArg:o!==void 0&&E.isArrayLiteralExpression(o)?o.elements[0]:void 0}}}}return null}function Ri(e){let n=[],t=o=>{if(E.isImportDeclaration(o)&&E.isStringLiteralLike(o.moduleSpecifier))n.push({text:o.moduleSpecifier.text,runtime:o.importClause?.isTypeOnly!==!0});else if(E.isImportEqualsDeclaration(o)&&E.isExternalModuleReference(o.moduleReference)&&E.isStringLiteralLike(o.moduleReference.expression))n.push({text:o.moduleReference.expression.text,runtime:!0});else if(E.isExportDeclaration(o)&&o.moduleSpecifier!==void 0&&E.isStringLiteralLike(o.moduleSpecifier))n.push({text:o.moduleSpecifier.text,runtime:o.isTypeOnly!==!0});else if(E.isCallExpression(o)){let r=_t(o),s=r?.specifierArg;r!==null&&s!==void 0&&E.isStringLiteralLike(s)&&n.push({text:s.text,runtime:!0})}E.forEachChild(o,t)};return t(e),n}function Su(e,n){let t=n===E.ScriptKind.TSX?"__scriptkind_probe.tsx":n===E.ScriptKind.TS?"__scriptkind_probe.ts":"__scriptkind_probe.js",o=E.createSourceFile(t,e,E.ScriptTarget.ES2020,!0,n),r={allowJs:!0,noLib:!0,noResolve:!0,noEmit:!0},s={getSourceFile:a=>a===t?o:void 0,getDefaultLibFileName:()=>"lib.d.ts",writeFile:()=>{},getCurrentDirectory:()=>"",getCanonicalFileName:a=>a,useCaseSensitiveFileNames:()=>!0,getNewLine:()=>`
-`,fileExists:a=>a===t,readFile:a=>a===t?e:void 0};return E.createProgram({rootNames:[t],options:r,host:s}).getSyntacticDiagnostics(o).length}function yr(e){return e.endsWith(".js")||e.endsWith(".jsx")}function Pi(e){let n=0,t=o=>{(E.isCallExpression(o)||E.isNewExpression(o)||E.isTaggedTemplateExpression(o))&&(n+=1),E.forEachChild(o,t)};return t(e),n}function Ci(e,n){let t=Ri(E.createSourceFile(e,n,E.ScriptTarget.ES2020,!0));if(!yr(e)||!n.includes("<")||!n.includes("require"))return t;let o=E.createSourceFile(e,n,E.ScriptTarget.ES2020,!0,E.ScriptKind.TSX),r=new Set(t.map(s=>`${s.runtime?"R":"T"}:${s.text}`));for(let s of Ri(o)){let a=`${s.runtime?"R":"T"}:${s.text}`;r.has(a)||(r.add(a),t.push(s))}return t}function $i(e,n,t,o,r){if(!n.includes("require")&&!n.includes("import("))return[];let s=E.createSourceFile(e,n,E.ScriptTarget.ES2020,!0),a=Kn(s,e,r),l=[],i=new Set;return Mi(s,d=>{for(let u of ao(d,a,t,Ce,o))i.has(u)||(i.add(u),l.push(u))}),l}function Mi(e,n){let t=o=>{if(E.isCallExpression(o)){let r=_t(o),s=r?.specifierArg;r!==null&&s!==void 0&&!E.isStringLiteralLike(s)&&n(s)}E.forEachChild(o,t)};t(e)}function bu(e){let n=[];for(let t of e){let o=Kn(t.sf,t.real);Mi(t.sf,r=>{let s=vt(r,o);s!==null&&n.push({definingModuleReal:t.real,fnName:s.fnName,paramIndex:s.paramIndex})})}return n}var ku=4,fr=co,pr=new Set(["eval","Function","createRequire"]),Eu=new Set(["require","eval","Function","createRequire"]),po=new Set(["module","Module","require","process","global","globalThis"]),mo=new Set(["_load","require","createRequire","eval","getBuiltinModule","dlopen","binding","_linkedBinding","_compile"]);function wu(e){return e===E.SyntaxKind.LessThanToken||e===E.SyntaxKind.GreaterThanToken||e===E.SyntaxKind.LessThanEqualsToken||e===E.SyntaxKind.GreaterThanEqualsToken||e===E.SyntaxKind.EqualsEqualsToken||e===E.SyntaxKind.EqualsEqualsEqualsToken||e===E.SyntaxKind.ExclamationEqualsToken||e===E.SyntaxKind.ExclamationEqualsEqualsToken||e===E.SyntaxKind.InstanceOfKeyword||e===E.SyntaxKind.InKeyword}function vu(e){let n=e.parent;return(E.isParameter(n)||E.isVariableDeclaration(n)||E.isBindingElement(n)||E.isFunctionDeclaration(n)||E.isFunctionExpression(n)||E.isClassDeclaration(n)||E.isClassExpression(n)||E.isPropertyAssignment(n)||E.isPropertyDeclaration(n)||E.isMethodDeclaration(n))&&n.name===e?!0:E.isPropertyAccessExpression(n)&&n.name===e}function Iu(e,n){return E.isCallExpression(n)&&n.expression===e||(E.isPropertyAccessExpression(n)||E.isElementAccessExpression(n))&&n.expression===e||E.isTypeOfExpression(n)||E.isVoidExpression(n)||E.isDeleteExpression(n)||E.isPrefixUnaryExpression(n)||E.isPostfixUnaryExpression(n)?!0:E.isBinaryExpression(n)&&wu(n.operatorToken.kind)}function Ti(e){let n=e,t=e.parent;for(;;)if(E.isParenthesizedExpression(t))n=t,t=t.parent;else if(E.isBinaryExpression(t)&&t.operatorToken.kind===E.SyntaxKind.CommaToken&&t.right===n)n=t,t=t.parent;else break;return!Iu(n,t)}function Au(e){return vu(e)?!1:Ti(e)}function Di(e){let n=bn(e);if(n!==null&&mo.has(n.name))return!0;if(E.isElementAccessExpression(e)&&!E.isStringLiteralLike(e.argumentExpression)){let t=_e(e.expression);if(E.isIdentifier(t)&&po.has(t.text))return!0}return!1}function It(e){let n=bn(e);if(n===null||n.name!=="constructor")return!1;let t=bn(n.receiver);return t!==null&&t.name==="constructor"}function Li(e){if(!E.isCallExpression(e))return!1;let n=_e(e.expression);if(!E.isIdentifier(n)||n.text!=="require")return!1;let t=e.arguments[0];return t!==void 0&&E.isStringLiteralLike(t)&&t.text==="module"}var _u={roots:new Map,nodes:new Set,saturated:!1};function Fi(e){return E.isSourceFile(e)||E.isFunctionDeclaration(e)||E.isFunctionExpression(e)||E.isArrowFunction(e)||E.isMethodDeclaration(e)||E.isConstructorDeclaration(e)||E.isGetAccessorDeclaration(e)||E.isSetAccessorDeclaration(e)||E.isClassStaticBlockDeclaration(e)||E.isModuleDeclaration(e)}function ji(e,n){let t=e.parent;for(;t!==void 0;){if(Fi(t))return t;t=t.parent}return n}function Nu(e){let n=new Set;if(E.isFunctionLike(e))for(let o of e.parameters)for(let r of At(o.name))n.add(r);let t=[e];for(;t.length>0;){let o=t.pop();if(o===void 0)break;if(!(o!==e&&Fi(o))){if(E.isVariableDeclaration(o)&&E.isVariableDeclarationList(o.parent)&&!((o.parent.flags&E.NodeFlags.BlockScoped)!==0))for(let s of At(o.name))n.add(s);E.forEachChild(o,r=>{t.push(r)})}}return n}function Ru(e,n,t){let o=ji(e,n);if(E.isSourceFile(o))return n;let r=t.get(o);return r===void 0&&(r=Nu(o),t.set(o,r)),r.has(e.text)?o:n}function uo(e,n){let t=e.roots.get(n.text);if(t===void 0)return!1;let o=n;for(;;){if(t.has(o))return!0;let r=o.parent;if(r===void 0)return!E.isSourceFile(o);o=r}}var Pu=12,$u=8;function fo(e,n){let t=_e(e);for(;;){if(n.nodes.has(t))return!0;if(E.isIdentifier(t))return po.has(t.text)||uo(n,t);if(E.isCallExpression(t))return Li(t);let o=bn(t);if(o!==null){if(o.name==="constructor")return!0;t=o.receiver;continue}if(E.isElementAccessExpression(t)){t=_e(t.expression);continue}return!1}}function Bi(e){let n=bn(_e(e.expression));if(n===null||n.name!=="get"||!E.isIdentifier(n.receiver)||n.receiver.text!=="Reflect")return null;let t=e.arguments[0];return t===void 0?null:{target:t,key:e.arguments[1]}}function Ou(e,n){let t=Bi(e);if(t===null||!fo(t.target,n))return!1;let o=t.key;return o===void 0||!E.isStringLiteralLike(o)?!0:mo.has(o.text)}function mr(e){if(!E.isFunctionExpression(e)&&!E.isFunctionDeclaration(e))return!1;let n=e.body;if(n===void 0)return!1;let t=!1,o=r=>{if(!(t||E.isFunctionExpression(r)||E.isFunctionDeclaration(r)||E.isClassLike(r))){if(E.isReturnStatement(r)&&r.expression!==void 0&&_e(r.expression).kind===E.SyntaxKind.ThisKeyword){t=!0;return}E.forEachChild(r,o)}};return o(n),t}function At(e){if(E.isIdentifier(e))return[e.text];let n=[];for(let t of e.elements)E.isOmittedExpression(t)||n.push(...At(t.name));return n}function Ki(e){return e.parameters.map(n=>At(n.name))}function Cu(e){let n=new Map,t=new Set,o=(s,a)=>{let l={fn:a,slots:Ki(a)},i=n.get(s);i===void 0?n.set(s,[l]):i.push(l),mr(a)&&t.add(s)},r=s=>{if(E.isFunctionDeclaration(s)&&s.name!==void 0)o(s.name.text,s);else if(E.isVariableDeclaration(s)&&E.isIdentifier(s.name)&&s.initializer!==void 0){let a=_e(s.initializer);(E.isFunctionExpression(a)||E.isArrowFunction(a))&&o(s.name.text,a)}E.forEachChild(s,r)};return r(e),{params:n,thisReturning:t}}function Mu(e){let n=new Map,t=new Set,o={roots:n,nodes:t},r=Cu(e),s=new Map,a=new Set(r.thisReturning),l=!0;for(let i=0;l;i+=1){if(i>=Pu)return{roots:n,nodes:t,saturated:!0};l=!1;let d=(y,b)=>{b!==""&&!y.has(b)&&(y.add(b),l=!0)},u=(y,b)=>{if(y==="")return;let x=n.get(y);x===void 0&&(x=new Set,n.set(y,x)),x.has(b)||(x.add(b),l=!0)},p=y=>{t.has(y)||(t.add(y),l=!0)},f=(y,b)=>{let x=_e(y.expression);if(E.isIdentifier(x)&&pr.has(x.text)||It(x)||E.isCallExpression(y)&&Li(y)||mr(x))return!0;let I=bn(x);if(I!==null&&(I.name==="call"||I.name==="apply"||I.name==="bind")){let w=I.receiver;if(mr(w)||t.has(w)||E.isIdentifier(w)&&(uo(o,w)||a.has(w.text)))return!0}if(t.has(x)||(E.isCallExpression(x)||E.isNewExpression(x))&&f(x,b+1)||E.isIdentifier(x)&&(uo(o,x)||a.has(x.text)))return!0;if(E.isCallExpression(y)){let w=Bi(y);if(w!==null&&fo(w.target,o))return!0}return!1},m=(y,b)=>{if(b>=$u)return!0;let x=_e(y);if(t.has(x))return!0;if(E.isIdentifier(x))return po.has(x.text)||uo(o,x);if(E.isBinaryExpression(x)){let I=x.operatorToken.kind;return I===E.SyntaxKind.BarBarToken||I===E.SyntaxKind.AmpersandAmpersandToken||I===E.SyntaxKind.QuestionQuestionToken?m(x.left,b+1)||m(x.right,b+1):!1}return E.isConditionalExpression(x)?m(x.whenTrue,b+1)||m(x.whenFalse,b+1):E.isPropertyAccessExpression(x)||E.isElementAccessExpression(x)?fo(x,o):E.isCallExpression(x)||E.isNewExpression(x)?f(x,b+1):!1},g=(y,b)=>{if((E.isVariableDeclaration(y)||E.isParameter(y)||E.isBindingElement(y))&&y.initializer!==void 0){if(m(y.initializer,0)){let I=ji(y,e);for(let w of At(y.name))u(w,I)}}else if(E.isBinaryExpression(y)&&y.operatorToken.kind===E.SyntaxKind.EqualsToken&&E.isIdentifier(y.left)&&m(y.right,0))u(y.left.text,Ru(y.left,e,s));else if(E.isReturnStatement(y)&&y.expression!==void 0&&b!==void 0&&m(y.expression,0))d(a,b);else if(E.isCallExpression(y)||E.isNewExpression(y)){f(y,0)&&p(y);let I=_e(y.expression),w=bn(I),A=w!==null&&w.name==="call",k=w!==null&&w.name==="apply",h=A||k?w.receiver:I,S=A?1:0,_=[];E.isFunctionExpression(h)||E.isArrowFunction(h)?_.push({fn:h,slots:Ki(h)}):E.isIdentifier(h)&&_.push(...r.params.get(h.text)??[]);let P=y.arguments??[];if(k){let v=P[1]===void 0?void 0:_e(P[1]);for(let{fn:T,slots:N}of _)if(v!==void 0&&E.isArrayLiteralExpression(v))for(let j=0;j<v.elements.length;j+=1){let O=v.elements[j],F=N[j];if(!(O===void 0||F===void 0)&&m(O,0))for(let K of F)u(K,T)}else if(v!==void 0)for(let j of N)for(let O of j)u(O,T)}else for(let{fn:v,slots:T}of _)for(let N=S;N<P.length;N+=1){let j=P[N],O=T[N-S];if(!(j===void 0||O===void 0)&&m(j,0))for(let F of O)u(F,v)}}let x=b;if(E.isFunctionDeclaration(y))x=y.name?.text;else if(E.isFunctionExpression(y)||E.isArrowFunction(y)){let I=y.parent;x=E.isVariableDeclaration(I)&&E.isIdentifier(I.name)?I.name.text:void 0}E.forEachChild(y,I=>g(I,x))};g(e,void 0)}return{roots:n,nodes:t,saturated:!1}}function Tu(e){if(E.isIdentifier(e)&&pr.has(e.text)||It(e))return!0;let n=bn(e);if(n!==null&&(mo.has(n.name)||(n.name==="call"||n.name==="apply")&&(E.isIdentifier(n.receiver)&&pr.has(n.receiver.text)||It(n.receiver)||(E.isPropertyAccessExpression(n.receiver)||E.isElementAccessExpression(n.receiver))&&Di(n.receiver))))return!0;if(E.isElementAccessExpression(e)&&!E.isStringLiteralLike(e.argumentExpression)){let t=_e(e.expression);if(E.isIdentifier(t)&&po.has(t.text))return!0}return!1}var Du=4;function Oi(e,n){for(let t of e){if(!E.isStringLiteralLike(t)||n>=Du)return!0;let o=E.createSourceFile("<eval>",`async function* __cupel_eval_probe__(){
+  WHERE ap.ecosystem = :eco AND ap.package_name = :name`,vf=`EXISTS (SELECT 1 FROM vulnerable_symbol vs
+                 WHERE vs.affected_package_id = ap.id AND vs.verified = 1) AS surface_complete`,_f=5,If=6;function Af(e){let n=e>=If?"a.details":"NULL AS details",t=e>=_f?"ap.surface_complete":vf;return`${wf}, ${n}, ${t}${Ef}`}var Nf="SELECT * FROM vulnerable_symbol WHERE affected_package_id = :id",Rf="SELECT * FROM symbol_alias WHERE vulnerable_symbol_id = :id",Pf="SELECT value FROM ingest_meta WHERE key = 'schema_version'",Of=7,$f="SELECT * FROM vulnerability_contract WHERE vulnerable_symbol_id = :id ORDER BY id",Cf="SELECT DISTINCT ecosystem FROM affected_package ORDER BY ecosystem";function Ht(e,n=Dr){let t=n.open(e,"readonly"),r=t.prepare(Pf).get(),o=r!==void 0?Re(r.value):"",s=/^\d+$/u.test(o)?Number(o):0,i=t.prepare(Af(s)),a=t.prepare(Nf),d=t.prepare(Rf),l=t.prepare(Cf),c=s>=Of?t.prepare($f):null;return{schemaVersion:o,ecosystems(){return l.all({}).map(p=>Re(p.ecosystem))},advisoriesForPackage(p,u){return i.all({eco:p,name:u}).map(m=>({affected:{id:kn(m.ap_id)??0,advisoryId:Re(m.advisory_id),ecosystem:Re(m.ecosystem),packageName:Re(m.package_name),introduced:Ie(m.introduced),fixed:Ie(m.fixed),lastAffected:Ie(m.last_affected),fixCommit:Ie(m.fix_commit),repoUrl:Ie(m.repo_url),surfaceComplete:kn(m.surface_complete)===1?1:0},advisory:{id:Re(m.a_id),osvId:Ie(m.osv_id),cveId:Ie(m.cve_id),summary:Ie(m.summary),details:Ie(m.details),severity:Ie(m.severity),published:Ie(m.published),source:Re(m.source)==="osv"?"osv":"ghsa"}}))},symbolsForAffected(p){return a.all({id:p}).map(u=>({id:kn(u.id)??0,affectedPackageId:kn(u.affected_package_id)??0,exportName:Ie(u.export_name),symbolKind:Re(u.symbol_kind),matchPattern:Ie(u.match_pattern),matchGlobs:Ie(u.match_globs),container:Ie(u.container),sourcePath:Ie(u.source_path),declStart:kn(u.decl_start),declEnd:kn(u.decl_end),astHashBefore:Ie(u.ast_hash_before),astHashAfter:Ie(u.ast_hash_after),derivation:Re(u.derivation),confidence:Re(u.confidence),verified:kn(u.verified)===1?1:0}))},contractsForSymbol(p){if(c===null)return[];let u=[];for(let m of c.all({id:p})){let h=Ca(m);if(h===null||h.vulnerableSymbolId!==p)return"unreadable";u.push(h)}return u},aliasesForSymbol(p){return d.all({id:p}).map(u=>({id:kn(u.id)??0,vulnerableSymbolId:kn(u.vulnerable_symbol_id)??0,aliasPath:Re(u.alias_path),aliasName:Re(u.alias_name)}))},allModels(){let p;try{p=t.prepare(`SELECT id, package_name, introduced, fixed_before, evidence_ref
+               FROM model_package ORDER BY package_name, introduced`).all({})}catch{return[]}let u=t.prepare(`SELECT kind, anchor_export, anchor_container, callee_package, callee_container, callee_export
+           FROM model_edge WHERE model_package_id = :id ORDER BY id`);return p.map(m=>{let h=kn(m.id)??0;return{packageName:Re(m.package_name),modelId:Re(m.evidence_ref),introduced:Re(m.introduced),fixedBefore:Ie(m.fixed_before),evidenceRef:Re(m.evidence_ref),edges:u.all({id:h}).map(x=>({kind:Re(x.kind),anchorExport:Re(x.anchor_export),anchorContainer:Ie(x.anchor_container),calleePackage:Re(x.callee_package),calleeContainer:Ie(x.callee_container),calleeExport:Re(x.callee_export)}))}})},close(){t.close()}}}function Vo(e){let n=e[0];if(n===void 0)throw new Error("compositeShardReader: at least one shard is required");for(let p of e)if(p.schemaVersion!==n.schemaVersion)throw new Error(`compositeShardReader: shards disagree on schema version (${n.schemaVersion} vs ${p.schemaVersion}); refusing to scan against a mixed schema`);let t=new Map,r=new Map,o=new Map,s=new Map,i=1,a=(p,u,m,h)=>{let x=`${String(m)}:${String(h)}`,y=p.get(x);if(y!==void 0)return y;let S=i;i+=1,p.set(x,S);let k=e[m];if(k===void 0)throw new Error("unreachable: reader index out of range");return u.set(S,{reader:k,id:h}),S},d=e.map(p=>new Set(p.ecosystems?.()??[])),l=p=>{let u=e.map((m,h)=>h).filter(m=>d[m]?.has(p)===!0);return u.length>0?u:e.map((m,h)=>h).filter(m=>e[m]?.ecosystems===void 0)},c=(p,u)=>({...u,id:a(o,s,p,u.id),affectedPackageId:a(t,r,p,u.affectedPackageId)});return{schemaVersion:n.schemaVersion,ecosystems(){let p=new Set;for(let u of d)for(let m of u)p.add(m);return[...p].sort()},advisoriesForPackage(p,u){let m=[];for(let h of l(p)){let x=e[h];if(x!==void 0)for(let y of x.advisoriesForPackage(p,u))m.push({...y,affected:{...y.affected,id:a(t,r,h,y.affected.id)}})}return m},symbolsForAffected(p){let u=r.get(p);if(u===void 0)return[];let m=e.indexOf(u.reader);return u.reader.symbolsForAffected(u.id).map(h=>c(m,h))},aliasesForSymbol(p){let u=s.get(p);if(u===void 0)return[];let m=e.indexOf(u.reader);return u.reader.aliasesForSymbol(u.id).map(h=>({...h,vulnerableSymbolId:a(o,s,m,h.vulnerableSymbolId)}))},contractsForSymbol(p){let u=s.get(p);if(u===void 0)return[];let m=u.reader.contractsForSymbol?.(u.id)??[];return m==="unreadable"?m:m.map(h=>({...h,vulnerableSymbolId:p}))},allModels(){return e.flatMap(p=>p.allModels?.()??[])},close(){for(let p of e)p.close()}}}var vt="7";import{realpathSync as Tn}from"node:fs";import tn from"node:path";import{realpathSync as dt}from"node:fs";import{isBuiltin as ls}from"node:module";import Be from"node:path";import A from"typescript";function Ho(e){let n=e.trim().replace(/\\/gu,"/"),t=n.length;for(;t>0&&n.charCodeAt(t-1)===47;)t-=1;return t===n.length?n:n.slice(0,t)}function Ae(e){let n=Ho(e);if(n===""||n.startsWith(".")||n.startsWith("/"))return"relative";if(n.startsWith("@")){let t=n.indexOf("/");return t===-1||n.indexOf("/",t+1)===-1?"package-root":"package-subpath"}return n.includes("/")?"package-subpath":"package-root"}function Qe(e){let n=Ho(e);if(n.startsWith("@")){let r=n.indexOf("/");if(r===-1)return n;let o=n.indexOf("/",r+1);return o===-1?n:n.slice(0,o)}let t=n.indexOf("/");return t===-1?n:n.slice(0,t)}function Ma(e){let n=Ho(e),t=Qe(n);return n.length>t.length+1?n.slice(t.length+1):""}import{readFileSync as jf,statSync as Xo}from"node:fs";var Bn=16*1024*1024;function _t(e,n){try{let t=Xo(e);return t.isFile()?t.size>n?{kind:"too-large",bytes:t.size}:{kind:"ok",text:jf(e,"utf8")}:{kind:"not-regular"}}catch{return{kind:"not-regular"}}}function Fe(e){let n=_t(e,Bn);return n.kind==="ok"?n.text:null}function wn(e){try{return Xo(e).isFile()}catch{return!1}}function Ta(e){try{let n=Xo(e);return n.isFile()?"file":n.isDirectory()?"dir":"other"}catch{return"other"}}import{opendirSync as Bf,realpathSync as Zo}from"node:fs";import le from"node:path";import Fr from"typescript";var Ka=[[".d.mts",[".mjs"]],[".d.cts",[".cjs"]],[".d.ts",[".js",".cjs",".mjs",".jsx"]]];function Ve(e){return Ka.some(([n])=>e.endsWith(n))}function Kf(e){for(let[n,t]of Ka)if(e.endsWith(n)){let r=e.slice(0,-n.length);return t.map(o=>r+o)}return[]}var Uf=[[".tsx",[".js",".jsx",".cjs",".mjs"]],[".cts",[".cjs"]],[".mts",[".mjs"]],[".ts",[".js",".cjs",".mjs",".jsx"]]];function Ua(e){if(Ve(e))return e;for(let[n,t]of Uf)if(e.endsWith(n)){let r=e.slice(0,-n.length);for(let o of t){let s=r+o;if(wn(s))return s}return e}return e}var Qo=[Fr.ModuleKind.CommonJS,Fr.ModuleKind.ESNext],es=[[],["node-addons"],["module-sync"],["node-addons","module-sync"]];function Xt(e,n,t,r,o,s){let i=Fr.resolveModuleName(e,n,t,r,void 0,void 0,o).resolvedModule;if(i===void 0)return null;let a=i.resolvedFileName;if(s){for(let d of Kf(a))if(wn(d))return d}return a}var za=[".js",".jsx",".cjs",".mjs",".ts",".tsx",".cts",".mts"],zf=[".js",".json",".node"],Gf=["index.js","index.json","index.node"];function jr(e){return!Ve(e)&&za.some(n=>e.endsWith(n))}function Ga(e){if(wn(e))return e;for(let n of zf)if(wn(e+n))return e+n;return null}function Da(e){for(let n of Gf){let t=le.join(e,n);if(wn(t))return t}return null}var Wa=[".ts",".tsx",".cts",".mts",".jsx"];function Wf(e){for(let n of Wa)if(wn(e+n))return e+n;return null}function qf(e){for(let n of Wa){let t=le.join(e,"index"+n);if(wn(t))return t}return null}function ns(e){let n=Fe(le.join(e,"package.json"));if(n!==null)try{let t=JSON.parse(n).main;if(typeof t=="string"&&t.length>0){let r=le.join(e,t),o=Ga(r)??Da(r);if(o!==null)return o}}catch{}return Da(e)}function qa(e){return Ga(e)??ns(e)??Wf(e)??qf(e)}function Va(e){return qa(e)!==null}function Vf(e,n){let t=e.split(le.sep),r=n.split("/"),o=null;for(let i=t.length-r.length-1;i>=0;i-=1)if(t[i]==="node_modules"&&r.every((a,d)=>t[i+1+d]===a)){o=t.slice(0,i+1+r.length).join(le.sep);break}if(o===null||o==="")return null;let s=Fe(le.join(o,"package.json"));if(s===null)return null;try{let i=JSON.parse(s),a=i.exports,d=typeof a=="string"||Array.isArray(a)||typeof a=="object"&&a!==null;if(i.name!==n||d)return null}catch{return null}try{return Zo(o)}catch{return null}}function Hf(e,n){let t=qa(le.join(e,n));if(t===null)return null;let r;try{r=Zo(t)}catch{return null}let o=e.endsWith(le.sep)?e:e+le.sep;return r!==e&&!r.startsWith(o)||Ve(r)||!za.some(s=>r.endsWith(s))?null:r}function Xf(e,n){let t=Ma(e);return t===""||t.includes("\0")||t.split("/").some(r=>r===""||r==="."||r===".."||r==="node_modules")?null:Hf(n,t)}var at={kind:"nothing-loads"},Yo=8192;function Jo(e,n){let t=n.get(e);if(t!==void 0)return t;let r,o=null;try{o=Bf(e);let s=new Set,i=!1;for(;;){let a=o.readSync();if(a===null)break;if(s.size>=Yo){i=!0;break}s.add(a.name)}r={names:s,truncated:i}}catch{r=null}finally{try{o?.closeSync()}catch{}}return n.set(e,r),r}var Yf=[".json",".css",".scss",".sass",".less",".styl",".svg",".png",".jpg",".jpeg",".gif",".webp",".avif",".ico",".bmp",".woff",".woff2",".ttf",".otf",".eot",".mp3",".mp4",".webm",".txt"];function Ha(e){return Yf.some(n=>e.length>n.length&&e.endsWith(n))}function Kn(e,n){let t=e.endsWith(le.sep)?e:e+le.sep;return n===e||n.startsWith(t)}function La(e,n){let t;try{t=Zo(n)}catch{return{kind:"missing"}}return Kn(e,t)?{kind:"ok",real:t}:{kind:"escaped"}}function Fa(e,n){let t=(n+".").toLowerCase(),r=[];for(let o of e){let s=o.toLowerCase();s.length>t.length&&s.startsWith(t)&&r.push(o)}return r}function Jf(e,n,t){let r=le.dirname(n);if(!Kn(e,r))return null;let o=Jo(r,t);if(o===null)return null;let s=le.basename(n);return o.names.has(s)?s:null}function ja(e,n){let t=e.filter(o=>!Ha(o));if(t.length===0)return at;let r=[...t].sort()[0]??"";return{kind:"unanalyzable",reason:`${n} ("${r}") the analyzer cannot parse`,why:"sibling-unparsable"}}function Xa(e,n,t,r){let o=e,s=o.indexOf("?");s!==-1&&(o=o.slice(0,s));let i=o.indexOf("#");if(i!==-1&&(o=o.slice(0,i)),o===""||o.includes("\0"))return at;let a=le.resolve(le.dirname(n),o);if(!Kn(t,a))return{kind:"unanalyzable",reason:"its target is outside the scan root and was not probed",why:"out-of-root"};let d=La(t,a);if(d.kind==="escaped")return{kind:"unanalyzable",reason:"a symlink carries its target outside the scan root, which was not probed",why:"out-of-root"};if(d.kind==="ok"){let m=Ta(d.real);if(m==="file"){let y=Jf(t,d.real,r);return y!==null&&Ha(y)?at:{kind:"unanalyzable",reason:y===null?"a file exists at that path under a name its directory listing did not confirm":`a file exists at that path ("${y}") the analyzer cannot parse`,why:y===null?"probe-refused":"sibling-unparsable"}}if(m!=="dir")return{kind:"unanalyzable",reason:"its target exists but is not a regular file",why:"probe-refused"};let h=Jo(d.real,r);if(h===null)return{kind:"unanalyzable",reason:"its target directory could not be listed",why:"probe-refused"};let x=ja(Fa(h.names,"index"),"a directory index");return x.kind==="unanalyzable"?x:h.names.has("package.json")?{kind:"unanalyzable",reason:"its target is a directory whose package.json main did not resolve",why:"probe-refused"}:h.truncated?{kind:"unanalyzable",reason:`its target directory exceeds ${String(Yo)} entries and was not fully probed`,why:"probe-refused"}:at}let l=le.basename(a);if(l===""||l==="."||l==="..")return at;let c=La(t,le.dirname(a));if(c.kind==="escaped")return{kind:"unanalyzable",reason:"a symlink carries its target directory outside the scan root, which was not probed",why:"out-of-root"};if(c.kind==="missing")return at;let p=Jo(c.real,r);if(p===null)return{kind:"unanalyzable",reason:"its target directory could not be listed",why:"probe-refused"};let u=ja(Fa(p.names,l),"a sibling file exists");return u.kind==="unanalyzable"?u:p.truncated?{kind:"unanalyzable",reason:`its target directory exceeds ${String(Yo)} entries and was not fully probed`,why:"probe-refused"}:at}function ts(e,n){let t=Qe(e),r=le.dirname(n);for(let o=0;o<64;o+=1){let s=le.join(r,"node_modules",...t.split("/"));if(Fe(le.join(s,"package.json"))!==null)return s;let i=le.dirname(r);if(i===r)return null;r=i}return null}function Ba(e,n,t,r,o){let s;for(let i of Qo)for(let a of es){let d={...t,noDtsResolution:!0,customConditions:[...a]},l=Xt(e,n,d,r,i,o);if(s===void 0)s=l;else if(s!==l)return null}return s??null}function en(e,n,t,r){let o=Ae(e);if(o==="relative")return Xt(e,n,t,r,void 0,!0);if(o==="package-root"){let a=Ba(e,n,t,r,!0);if(a!==null)return a;let d=ts(e,n);if(d===null||Fe(le.join(d,"package.json"))?.includes('"exports"')===!0)return null;let l=ns(d);return l===null||Ve(l)?null:Kn(d,l)?l:null}let s=Ba(e,n,t,r,!1);if(s===null)return null;let i=Vf(s,Qe(e));return i!==null?Xf(e,i):Ve(s)?s:Ua(s)}function Ya(e){let n=e.trim();return n.startsWith("@/")||n==="~"||n.startsWith("~/")||n.startsWith("#")}function Yt(e,n,t,r){let o=Ae(e);if(o==="relative")return"no-candidate";if(Ya(e))return"alias-unmapped";let s=new Set;for(let h of Qo)for(let x of es){let y={...t,noDtsResolution:!0,customConditions:[...x]};s.add(Xt(e,n,y,r,h,o==="package-root"))}if(s.size>1)return"divergent-exports";let i=ts(e,n);if(i===null)return"not-installed";let a=Fe(le.join(i,"package.json"));if(a===null)return"unreadable-manifest";let d;try{d=JSON.parse(a)}catch{return"unreadable-manifest"}if(typeof d!="object"||d===null)return"unreadable-manifest";let l=d,c=l.exports!==void 0&&l.exports!==null,p=typeof l.typesVersions=="object"&&l.typesVersions!==null,[u]=s;if(u!=null)return Kn(i,u)?!c&&p?"types-versions-remap":Ve(u)?"declaration-only":"no-candidate":"out-of-root";let m=Xt(e,n,t,r,void 0,!1);if(m!==null&&Ve(m))return!c&&p?"types-versions-remap":"declaration-only";if(o==="package-root"&&!c){let h=ns(i);if(h!==null&&!Kn(i,h))return"out-of-root"}return"no-candidate"}function It(e,n,t,r){let o=en(e,n,t,r);if(o!==null)return[o];let s=Ae(e);if(s==="relative")return[];let i=new Set;for(let l of Qo)for(let c of es){let p={...t,noDtsResolution:!0,customConditions:[...c]};i.add(Xt(e,n,p,r,l,s==="package-root"))}if(i.size<2||i.has(null))return[];let a=ts(e,n);if(a===null)return[];let d=[];for(let l of i){if(l===null)return[];let c=Ua(l);if(Ve(c)||!Kn(a,c))return[];d.push(c)}return[...new Set(d)].sort()}function Ja(e,n){let t=le.dirname(e);for(let r=0;r<64;r+=1){let o=Fe(le.join(t,"package.json"));if(o!==null){try{let i=JSON.parse(o);if(typeof i!="object"||i===null)return!1;let a=i.optionalDependencies;if(typeof a=="object"&&a!==null&&n in a)return!0;let d=i.peerDependenciesMeta;if(typeof d=="object"&&d!==null){let l=d[n];if(typeof l=="object"&&l!==null)return l.optional===!0}}catch{return!1}return!1}let s=le.dirname(t);if(s===t)return!1;t=s}return!1}function Za(e,n,t){let r=Fe(le.join(e,"tsconfig.json"));if(r===null)return()=>null;let o=Fr.parseConfigFileTextToJson(le.join(e,"tsconfig.json"),r);if(o.error!==void 0)return()=>null;let s=o.config?.compilerOptions;if(typeof s!="object"||s===null)return()=>null;let i=s.paths;if(typeof i!="object"||i===null)return()=>null;let a=s.baseUrl,d=typeof a=="string"?le.resolve(e,a):e,l=new Map,c=[];for(let[u,m]of Object.entries(i)){if(!Array.isArray(m))continue;let h=m.filter(y=>typeof y=="string");if(h.length===0)continue;let x=u.indexOf("*");x===-1?l.set(u,h):u.indexOf("*",x+1)===-1&&c.push({prefix:u.slice(0,x),suffix:u.slice(x+1),targets:h})}if(c.sort((u,m)=>m.prefix.length-u.prefix.length),l.size===0&&c.length===0)return()=>null;let p=u=>{let m=l.get(u);if(m!==void 0)return m;for(let h of c){if(u.length<h.prefix.length+h.suffix.length||!u.startsWith(h.prefix)||!u.endsWith(h.suffix))continue;let x=u.slice(h.prefix.length,u.length-h.suffix.length);return h.targets.map(y=>{let S=y.indexOf("*");return S===-1?y:y.slice(0,S)+x+y.slice(S+1)})}return[]};return(u,m)=>{let h=p(u);if(h.length===0||en(u,m,n,t)!==null)return null;for(let x of h){let y=le.resolve(d,x),S=le.relative(le.dirname(m),y).split(le.sep).join("/");if(S==="")continue;S.startsWith(".")||(S=`./${S}`);let k=en(S,m,n,t);if(k!==null&&Kn(e,k))return k}return null}}import{readdirSync as Zf,realpathSync as Qf}from"node:fs";import Cn from"node:path";import V from"typescript";function Jt(e,n){if(V.isIdentifier(e))n.add(e.text);else for(let t of e.elements)V.isBindingElement(t)&&Jt(t.name,n)}function At(e){let n=new Map,t=new Set,r=d=>{n.set(d,(n.get(d)??0)+1)},o=d=>{let l=He(d);if(V.isIdentifier(l))t.add(l.text);else if(V.isArrayLiteralExpression(l))for(let c of l.elements)o(c);else if(V.isObjectLiteralExpression(l))for(let c of l.properties)V.isShorthandPropertyAssignment(c)?t.add(c.name.text):V.isPropertyAssignment(c)?o(c.initializer):V.isSpreadAssignment(c)&&o(c.expression);else V.isSpreadElement(l)?o(l.expression):V.isBinaryExpression(l)&&l.operatorToken.kind===V.SyntaxKind.EqualsToken&&o(l.left)},s=d=>{let l=new Set;Jt(d,l);for(let c of l)r(c)},i=d=>{V.isVariableDeclaration(d)?s(d.name):V.isFunctionDeclaration(d)&&d.name!==void 0||V.isClassDeclaration(d)&&d.name!==void 0?r(d.name.text):V.isParameter(d)?s(d.name):((V.isFunctionExpression(d)||V.isClassExpression(d))&&d.name!==void 0&&V.isIdentifier(d.name)&&!(d.parent!==void 0&&V.isVariableDeclaration(d.parent)&&d.parent.initializer===d&&V.isIdentifier(d.parent.name)&&d.parent.name.text===d.name.text)||V.isImportClause(d)&&d.name!==void 0||V.isNamespaceImport(d)||V.isImportSpecifier(d)||V.isImportEqualsDeclaration(d))&&r(d.name.text),V.isBinaryExpression(d)&&d.operatorToken.kind>=V.SyntaxKind.FirstAssignment&&d.operatorToken.kind<=V.SyntaxKind.LastAssignment?o(d.left):(V.isPrefixUnaryExpression(d)||V.isPostfixUnaryExpression(d))&&(d.operator===V.SyntaxKind.PlusPlusToken||d.operator===V.SyntaxKind.MinusMinusToken)?o(d.operand):(V.isForOfStatement(d)||V.isForInStatement(d))&&!V.isVariableDeclarationList(d.initializer)&&o(d.initializer),V.forEachChild(d,i)};i(e);let a=new Set(t);for(let[d,l]of n)l>1&&a.add(d);return a}function lt(e,n,t){let r=At(e),o=new Map,s=i=>{V.isVariableDeclaration(i)&&V.isIdentifier(i.name)&&i.initializer!==void 0&&!r.has(i.name.text)&&!o.has(i.name.text)&&o.set(i.name.text,i.initializer),V.forEachChild(i,s)};return s(e),{containingFile:n,taintedNames:r,constBindings:o,resolveParamDirs:t}}var ep=1024,np=32,tp=new Set(["filter","sort","slice","reverse"]),rp=new Set(["forEach","map","filter","flatMap","find","some","every"]);function He(e){let n=e;for(;V.isParenthesizedExpression(n);)n=n.expression;return n}function Qa(e,n){return V.isPropertyAccessExpression(e)&&V.isIdentifier(e.expression)&&e.expression.text==="path"&&e.name.text===n}function Un(e,n,t,r){if(t>np)return null;let o=He(e);if(V.isStringLiteralLike(o))return o.text;if(V.isTemplateExpression(o)){let s=o.head.text;for(let i of o.templateSpans){let a=Un(i.expression,n,t+1,r);if(a===null)return null;s+=a+i.literal.text}return s}if(V.isBinaryExpression(o)&&o.operatorToken.kind===V.SyntaxKind.PlusToken){let s=Un(o.left,n,t+1,r);if(s===null)return null;let i=Un(o.right,n,t+1,r);return i===null?null:s+i}if(V.isIdentifier(o)){if(o.text==="__dirname")return Cn.dirname(n.containingFile);if(o.text==="__filename")return n.containingFile;if(n.taintedNames.has(o.text)||r.has(o.text))return null;let s=n.constBindings.get(o.text);if(s===void 0)return null;r.add(o.text);let i=Un(s,n,t+1,r);return r.delete(o.text),i}if(V.isCallExpression(o)){let s=Qa(o.expression,"join"),i=Qa(o.expression,"resolve");if(!s&&!i)return null;let a=[];for(let l of o.arguments){let c=Un(l,n,t+1,r);if(c===null)return null;a.push(c)}let d=a[0];return d===void 0||i&&!Cn.isAbsolute(d)?null:i?Cn.resolve(...a):Cn.join(...a)}return null}function Br(e){let n=He(e);if(V.isBinaryExpression(n)&&n.operatorToken.kind===V.SyntaxKind.PlusToken)return[...Br(n.left),...Br(n.right)];if(V.isTemplateExpression(n)){let t=[];n.head.text.length>0&&t.push({lit:n.head.text});for(let r of n.templateSpans)t.push({expr:r.expression}),r.literal.text.length>0&&t.push({lit:r.literal.text});return t}return V.isStringLiteralLike(n)?[{lit:n.text}]:[{expr:n}]}function tl(e){let n=e,t=0;for(;t++<4096;){let r=n.parent;if(r===void 0)return null;if(V.isForOfStatement(r)&&r.statement===n){let o=r.initializer;if(V.isVariableDeclarationList(o)&&o.declarations.length===1&&o.declarations[0]!==void 0&&V.isIdentifier(o.declarations[0].name)&&o.declarations[0].name.text===e.text){let s=el(r.expression);if(s!==null)return s}}if((V.isArrowFunction(n)||V.isFunctionExpression(n))&&V.isCallExpression(r)&&r.arguments.length>0&&r.arguments[0]===n&&V.isPropertyAccessExpression(r.expression)&&rp.has(r.expression.name.text)){let o=n.parameters[0];if(o!==void 0&&V.isIdentifier(o.name)&&o.name.text===e.text){let s=el(r.expression.expression);if(s!==null)return s}}n=r}return null}function el(e){let n=He(e),t=0;for(;V.isCallExpression(n)&&t++<16;){let r=n.expression;if(V.isPropertyAccessExpression(r)){let o=r.name.text;if(o==="readdirSync")return n.arguments[0]??null;if(tp.has(o)){n=He(r.expression);continue}return null}return V.isIdentifier(r)&&r.text==="readdirSync"?n.arguments[0]??null:null}return null}function op(e,n){let t=Br(e);if(t.length<2)return null;let r=t[t.length-1];if(r===void 0||!("expr"in r)||!V.isIdentifier(r.expr))return null;let o=r.expr;if(n.taintedNames.has(o.text))return null;let s="";for(let l=0;l<t.length-1;l+=1){let c=t[l];if(c===void 0)return null;if("lit"in c)s+=c.lit;else{let p=Un(c.expr,n,0,new Set);if(p===null)return null;s+=p}}let i=tl(o),a=i===null?null:Un(i,n,0,new Set);if(a===null)return null;let d=Cn.resolve(s);return d!==Cn.resolve(a)?null:d}function sp(e){if((V.isFunctionDeclaration(e)||V.isFunctionExpression(e))&&e.name!==void 0&&V.isIdentifier(e.name)||V.isMethodDeclaration(e)&&V.isIdentifier(e.name))return e.name.text;let n=e.parent;return n!==void 0&&V.isVariableDeclaration(n)&&V.isIdentifier(n.name)?n.name.text:null}function ip(e,n){for(let t=e.parent;t!==void 0;t=t.parent){if(!V.isFunctionLike(t))continue;let r=-1;for(let s=0;s<t.parameters.length;s+=1){let i=t.parameters[s];if(i!==void 0&&V.isIdentifier(i.name)&&i.name.text===n){r=s;break}}if(r<0)continue;let o=sp(t);return o===null?null:{fnName:o,paramIndex:r}}return null}function Zt(e,n){let t=Br(e);if(t.length!==2)return null;let[r,o]=t;if(r===void 0||!("expr"in r)||!V.isIdentifier(r.expr)||o===void 0||!("expr"in o)||!V.isIdentifier(o.expr))return null;let s=r.expr,i=o.expr;if(n.taintedNames.has(s.text)||n.taintedNames.has(i.text))return null;let a=tl(i);return a===null||!V.isIdentifier(a)||a.text!==s.text?null:ip(s,s.text)}function ap(e,n){if(n.resolveParamDirs===void 0)return null;let t=Zt(e,n);return t===null?null:n.resolveParamDirs(n.containingFile,t.fnName,t.paramIndex)}function Kr(e){for(let n=e.parent;n!==void 0;n=n.parent){if(V.isSourceFile(n))return!0;if(!V.isArrowFunction(n)&&V.isFunctionLike(n))return!1}return!0}function rs(e,n){let t=Un(e,n,0,new Set);if(t!==null)return{kind:"const",value:t};let r=op(e,n);if(r!==null)return{kind:"dir",dir:r};let o=ap(e,n);return o!==null&&o.length>0?{kind:"dirs",dirs:[...o]}:{kind:"opaque"}}function rl(e,n){let t;try{t=Qf(e)}catch{return null}let r=n.endsWith(Cn.sep)?n:n+Cn.sep;return t===n||t.startsWith(r)?t:null}function ol(e,n,t,r,o){let s=en(e,n,r,o);return s===null||Ve(s)||!jr(s)?null:rl(s,t)}function nl(e,n,t,r,o){let s=rl(e,t);if(s===null)return[];let i;try{i=Zf(s)}catch{return[]}if(i.length===0||i.length>ep)return[];i.sort();let a=new Set,d=[];for(let l of i){let c=ol(Cn.join(s,l),n,t,r,o);c!==null&&!a.has(c)&&(a.add(c),d.push(c))}return d}function Ur(e,n,t,r,o){let s=rs(e,n);if(s.kind==="const"){if(Ae(s.value)==="package-root")return[];let i=ol(s.value,n.containingFile,t,r,o);return i===null?[]:[i]}if(s.kind==="dir")return nl(s.dir,n.containingFile,t,r,o);if(s.kind==="dirs"){let i=new Set,a=[];for(let d of s.dirs)for(let l of nl(d,n.containingFile,t,r,o))i.has(l)||(i.add(l),a.push(l));return a}return[]}import lp from"node:path";import he from"typescript";var dp=32,zr="\0",sl=(e,n)=>`${e}${zr}${n}`,il=(e,n,t)=>`${e}${zr}${n}${zr}${String(t)}`;function cp(e){let n=new Map,t=new Set,r=(o,s)=>{if(t.has(o)){n.delete(o);return}t.add(o),n.set(o,s)};for(let o of e.statements)if(he.isImportDeclaration(o)&&he.isStringLiteralLike(o.moduleSpecifier)){let s=o.moduleSpecifier.text,i=o.importClause;if(i===void 0)continue;i.name!==void 0&&r(i.name.text,{kind:"module",specifier:s});let a=i.namedBindings;if(a!==void 0&&he.isNamespaceImport(a))r(a.name.text,{kind:"module",specifier:s});else if(a!==void 0&&he.isNamedImports(a))for(let d of a.elements)r(d.name.text,{kind:"named",specifier:s,imported:(d.propertyName??d.name).text})}else if(he.isImportEqualsDeclaration(o)&&he.isExternalModuleReference(o.moduleReference)&&he.isStringLiteralLike(o.moduleReference.expression))r(o.name.text,{kind:"module",specifier:o.moduleReference.expression.text});else if(he.isFunctionDeclaration(o)&&o.name!==void 0)r(o.name.text,{kind:"local"});else if(he.isVariableStatement(o))for(let s of o.declarationList.declarations){if(s.initializer===void 0)continue;let i=s.initializer;if(he.isIdentifier(s.name))he.isArrowFunction(i)||he.isFunctionExpression(i)?r(s.name.text,{kind:"local"}):al(i)&&r(s.name.text,{kind:"module",specifier:ll(i)});else if(he.isObjectBindingPattern(s.name)&&al(i)){let a=ll(i);for(let d of s.name.elements){if(d.dotDotDotToken!==void 0||!he.isIdentifier(d.name))continue;let l=d.propertyName??d.name;!he.isIdentifier(l)&&!he.isStringLiteralLike(l)||r(d.name.text,{kind:"named",specifier:a,imported:l.text})}}}return n}function al(e){return he.isCallExpression(e)&&he.isIdentifier(e.expression)&&e.expression.text==="require"&&e.arguments.length===1&&e.arguments[0]!==void 0&&he.isStringLiteralLike(e.arguments[0])}function ll(e){let n=e.arguments[0];return n!==void 0&&he.isStringLiteralLike(n)?n.text:"\0"}function up(e){let n=e.expression;if(he.isPropertyAccessExpression(n))return n.name.text;if(he.isIdentifier(n))return n.text}function fp(e,n,t,r,o,s){let i=e.expression,a=d=>{let l=`${d}${zr}${n}`,c=s.get(l);if(c!==void 0||s.has(l))return c??null;let p=en(d,n,r,o),u=p===null?null:lp.resolve(p);return s.set(l,u),u};if(he.isPropertyAccessExpression(i)&&he.isIdentifier(i.expression)){let d=t.get(i.expression.text);if(d?.kind==="module"){let l=a(d.specifier);return l===null?null:{moduleReal:l,fnName:i.name.text}}return null}if(he.isIdentifier(i)){let d=t.get(i.text);if(d?.kind==="named"){let l=a(d.specifier);return l===null?null:{moduleReal:l,fnName:d.imported}}return d?.kind==="local"?{moduleReal:n,fnName:i.text}:null}return null}function dl(e,n,t,r,o=new Map){if(n.length===0)return()=>null;let s=new Map,i=new Set;for(let d of n){let l=sl(d.definingModuleReal,d.fnName),c=s.get(l);c===void 0&&(c=new Set,s.set(l,c)),c.add(d.paramIndex),i.add(d.fnName)}let a=new Map;for(let d of e){let l=lt(d.sf,d.real),c=cp(d.sf),p=u=>{if(he.isCallExpression(u)){let m=up(u);if(m!==void 0&&i.has(m)&&Kr(u)){let h=fp(u,d.real,c,t,r,o);if(h!==null){let x=s.get(sl(h.moduleReal,h.fnName));if(x!==void 0)for(let y of x){let S=u.arguments[y];if(S===void 0)continue;let k=rs(S,l);if(k.kind==="const"){let E=il(h.moduleReal,h.fnName,y),g=a.get(E);g===void 0&&(g=new Set,a.set(E,g)),g.add(k.value)}}}}}he.forEachChild(u,p)};p(d.sf)}return(d,l,c)=>{let p=a.get(il(d,l,c));return p===void 0||p.size===0||p.size>dp?null:[...p].sort()}}var je={allowJs:!0,checkJs:!1,noEmit:!0,skipLibCheck:!0,target:A.ScriptTarget.ES2020,module:A.ModuleKind.CommonJS,moduleResolution:A.ModuleResolutionKind.Node10,types:[]},Gr=5e3;function ze(e,n){let t;try{t=dt(n)}catch{t=Be.resolve(n)}let r=e.endsWith(Be.sep)?e:e+Be.sep;return t!==e&&!t.startsWith(r)?null:t===e?"":t.slice(r.length).split(Be.sep).join("/")}function Pe(e){let n=e;for(;;)if(A.isParenthesizedExpression(n))n=n.expression;else if(A.isBinaryExpression(n)&&n.operatorToken.kind===A.SyntaxKind.CommaToken)n=n.right;else return n}function Mn(e){return A.isPropertyAccessExpression(e)?{receiver:Pe(e.expression),name:e.name.text}:A.isElementAccessExpression(e)&&A.isStringLiteralLike(e.argumentExpression)?{receiver:Pe(e.expression),name:e.argumentExpression.text}:null}function nr(e){let n=Pe(e.expression);if(A.isIdentifier(n)&&n.text==="require")return{specifierArg:e.arguments[0]};if(n.kind===A.SyntaxKind.ImportKeyword)return{specifierArg:e.arguments[0]};let t=Mn(n);if(t!==null){if(t.name==="require"&&A.isIdentifier(t.receiver)&&t.receiver.text==="module")return{specifierArg:e.arguments[0]};if(A.isIdentifier(t.receiver)&&t.receiver.text==="require"){if(t.name==="call")return{specifierArg:e.arguments[1]};if(t.name==="apply"){let r=e.arguments[1];return{specifierArg:r!==void 0&&A.isArrayLiteralExpression(r)?r.elements[0]:void 0}}}}return null}function cl(e){let n=[],t=r=>{if(A.isImportDeclaration(r)&&A.isStringLiteralLike(r.moduleSpecifier))n.push({text:r.moduleSpecifier.text,runtime:r.importClause?.isTypeOnly!==!0});else if(A.isImportEqualsDeclaration(r)&&A.isExternalModuleReference(r.moduleReference)&&A.isStringLiteralLike(r.moduleReference.expression))n.push({text:r.moduleReference.expression.text,runtime:!0});else if(A.isExportDeclaration(r)&&r.moduleSpecifier!==void 0&&A.isStringLiteralLike(r.moduleSpecifier))n.push({text:r.moduleSpecifier.text,runtime:r.isTypeOnly!==!0});else if(A.isCallExpression(r)){let o=nr(r),s=o?.specifierArg;o!==null&&s!==void 0&&A.isStringLiteralLike(s)&&n.push({text:s.text,runtime:!0})}A.forEachChild(r,t)};return t(e),n}function pp(e,n){let t=n===A.ScriptKind.TSX?"__scriptkind_probe.tsx":n===A.ScriptKind.TS?"__scriptkind_probe.ts":"__scriptkind_probe.js",r=A.createSourceFile(t,e,A.ScriptTarget.ES2020,!0,n),o={allowJs:!0,noLib:!0,noResolve:!0,noEmit:!0},s={getSourceFile:i=>i===t?r:void 0,getDefaultLibFileName:()=>"lib.d.ts",writeFile:()=>{},getCurrentDirectory:()=>"",getCanonicalFileName:i=>i,useCaseSensitiveFileNames:()=>!0,getNewLine:()=>`
+`,fileExists:i=>i===t,readFile:i=>i===t?e:void 0};return A.createProgram({rootNames:[t],options:o,host:s}).getSyntacticDiagnostics(r).length}function ds(e){return e.endsWith(".js")||e.endsWith(".jsx")}function ul(e){let n=0,t=r=>{(A.isCallExpression(r)||A.isNewExpression(r)||A.isTaggedTemplateExpression(r))&&(n+=1),A.forEachChild(r,t)};return t(e),n}function ml(e,n){let t=cl(A.createSourceFile(e,n,A.ScriptTarget.ES2020,!0));if(!ds(e)||!n.includes("<")||!n.includes("require"))return t;let r=A.createSourceFile(e,n,A.ScriptTarget.ES2020,!0,A.ScriptKind.TSX),o=new Set(t.map(s=>`${s.runtime?"R":"T"}:${s.text}`));for(let s of cl(r)){let i=`${s.runtime?"R":"T"}:${s.text}`;o.has(i)||(o.add(i),t.push(s))}return t}function fl(e,n,t,r,o){if(!n.includes("require")&&!n.includes("import("))return[];let s=A.createSourceFile(e,n,A.ScriptTarget.ES2020,!0),i=lt(s,e,o),a=[],d=new Set;return hl(s,l=>{for(let c of Ur(l,i,t,je,r))d.has(c)||(d.add(c),a.push(c))}),a}function hl(e,n){let t=r=>{if(A.isCallExpression(r)){let o=nr(r),s=o?.specifierArg;o!==null&&s!==void 0&&!A.isStringLiteralLike(s)&&n(s)}A.forEachChild(r,t)};t(e)}function mp(e){let n=[];for(let t of e){let r=lt(t.sf,t.real);hl(t.sf,o=>{let s=Zt(o,r);s!==null&&n.push({definingModuleReal:t.real,fnName:s.fnName,paramIndex:s.paramIndex})})}return n}var hp=4,os=Gr,ss=new Set(["eval","Function","createRequire"]),gp=new Set(["require","eval","Function","createRequire"]),Vr=new Set(["module","Module","require","process","global","globalThis"]),Hr=new Set(["_load","require","createRequire","eval","getBuiltinModule","dlopen","binding","_linkedBinding","_compile"]);function yp(e){return e===A.SyntaxKind.LessThanToken||e===A.SyntaxKind.GreaterThanToken||e===A.SyntaxKind.LessThanEqualsToken||e===A.SyntaxKind.GreaterThanEqualsToken||e===A.SyntaxKind.EqualsEqualsToken||e===A.SyntaxKind.EqualsEqualsEqualsToken||e===A.SyntaxKind.ExclamationEqualsToken||e===A.SyntaxKind.ExclamationEqualsEqualsToken||e===A.SyntaxKind.InstanceOfKeyword||e===A.SyntaxKind.InKeyword}function xp(e){let n=e.parent;return(A.isParameter(n)||A.isVariableDeclaration(n)||A.isBindingElement(n)||A.isFunctionDeclaration(n)||A.isFunctionExpression(n)||A.isClassDeclaration(n)||A.isClassExpression(n)||A.isPropertyAssignment(n)||A.isPropertyDeclaration(n)||A.isMethodDeclaration(n))&&n.name===e?!0:A.isPropertyAccessExpression(n)&&n.name===e}function Sp(e,n){return A.isCallExpression(n)&&n.expression===e||(A.isPropertyAccessExpression(n)||A.isElementAccessExpression(n))&&n.expression===e||A.isTypeOfExpression(n)||A.isVoidExpression(n)||A.isDeleteExpression(n)||A.isPrefixUnaryExpression(n)||A.isPostfixUnaryExpression(n)?!0:A.isBinaryExpression(n)&&yp(n.operatorToken.kind)}function gl(e){let n=e,t=e.parent;for(;;)if(A.isParenthesizedExpression(t))n=t,t=t.parent;else if(A.isBinaryExpression(t)&&t.operatorToken.kind===A.SyntaxKind.CommaToken&&t.right===n)n=t,t=t.parent;else break;return!Sp(n,t)}function bp(e){return xp(e)?!1:gl(e)}function yl(e){let n=Mn(e);if(n!==null&&Hr.has(n.name))return!0;if(A.isElementAccessExpression(e)&&!A.isStringLiteralLike(e.argumentExpression)){let t=Pe(e.expression);if(A.isIdentifier(t)&&Vr.has(t.text))return!0}return!1}function Qt(e){let n=Mn(e);if(n===null||n.name!=="constructor")return!1;let t=Mn(n.receiver);return t!==null&&t.name==="constructor"}function xl(e){if(!A.isCallExpression(e))return!1;let n=Pe(e.expression);if(!A.isIdentifier(n)||n.text!=="require")return!1;let t=e.arguments[0];return t!==void 0&&A.isStringLiteralLike(t)&&t.text==="module"}var kp={roots:new Map,nodes:new Set,saturated:!1};function Sl(e){return A.isSourceFile(e)||A.isFunctionDeclaration(e)||A.isFunctionExpression(e)||A.isArrowFunction(e)||A.isMethodDeclaration(e)||A.isConstructorDeclaration(e)||A.isGetAccessorDeclaration(e)||A.isSetAccessorDeclaration(e)||A.isClassStaticBlockDeclaration(e)||A.isModuleDeclaration(e)}function bl(e,n){let t=e.parent;for(;t!==void 0;){if(Sl(t))return t;t=t.parent}return n}function wp(e){let n=new Set;if(A.isFunctionLike(e))for(let r of e.parameters)for(let o of er(r.name))n.add(o);let t=[e];for(;t.length>0;){let r=t.pop();if(r===void 0)break;if(!(r!==e&&Sl(r))){if(A.isVariableDeclaration(r)&&A.isVariableDeclarationList(r.parent)&&!((r.parent.flags&A.NodeFlags.BlockScoped)!==0))for(let s of er(r.name))n.add(s);A.forEachChild(r,o=>{t.push(o)})}}return n}function Ep(e,n,t){let r=bl(e,n);if(A.isSourceFile(r))return n;let o=t.get(r);return o===void 0&&(o=wp(r),t.set(r,o)),o.has(e.text)?r:n}function Wr(e,n){let t=e.roots.get(n.text);if(t===void 0)return!1;let r=n;for(;;){if(t.has(r))return!0;let o=r.parent;if(o===void 0)return!A.isSourceFile(r);r=o}}var vp=12,_p=8;function qr(e,n){let t=Pe(e);for(;;){if(n.nodes.has(t))return!0;if(A.isIdentifier(t))return Vr.has(t.text)||Wr(n,t);if(A.isCallExpression(t))return xl(t);let r=Mn(t);if(r!==null){if(r.name==="constructor")return!0;t=r.receiver;continue}if(A.isElementAccessExpression(t)){t=Pe(t.expression);continue}return!1}}function kl(e){let n=Mn(Pe(e.expression));if(n===null||n.name!=="get"||!A.isIdentifier(n.receiver)||n.receiver.text!=="Reflect")return null;let t=e.arguments[0];return t===void 0?null:{target:t,key:e.arguments[1]}}function Ip(e,n){let t=kl(e);if(t===null||!qr(t.target,n))return!1;let r=t.key;return r===void 0||!A.isStringLiteralLike(r)?!0:Hr.has(r.text)}function is(e){if(!A.isFunctionExpression(e)&&!A.isFunctionDeclaration(e))return!1;let n=e.body;if(n===void 0)return!1;let t=!1,r=o=>{if(!(t||A.isFunctionExpression(o)||A.isFunctionDeclaration(o)||A.isClassLike(o))){if(A.isReturnStatement(o)&&o.expression!==void 0&&Pe(o.expression).kind===A.SyntaxKind.ThisKeyword){t=!0;return}A.forEachChild(o,r)}};return r(n),t}function er(e){if(A.isIdentifier(e))return[e.text];let n=[];for(let t of e.elements)A.isOmittedExpression(t)||n.push(...er(t.name));return n}function wl(e){return e.parameters.map(n=>er(n.name))}function Ap(e){let n=new Map,t=new Set,r=(s,i)=>{let a={fn:i,slots:wl(i)},d=n.get(s);d===void 0?n.set(s,[a]):d.push(a),is(i)&&t.add(s)},o=s=>{if(A.isFunctionDeclaration(s)&&s.name!==void 0)r(s.name.text,s);else if(A.isVariableDeclaration(s)&&A.isIdentifier(s.name)&&s.initializer!==void 0){let i=Pe(s.initializer);(A.isFunctionExpression(i)||A.isArrowFunction(i))&&r(s.name.text,i)}A.forEachChild(s,o)};return o(e),{params:n,thisReturning:t}}function Np(e){let n=new Map,t=new Set,r={roots:n,nodes:t},o=Ap(e),s=new Map,i=new Set(o.thisReturning),a=!0;for(let d=0;a;d+=1){if(d>=vp)return{roots:n,nodes:t,saturated:!0};a=!1;let l=(x,y)=>{y!==""&&!x.has(y)&&(x.add(y),a=!0)},c=(x,y)=>{if(x==="")return;let S=n.get(x);S===void 0&&(S=new Set,n.set(x,S)),S.has(y)||(S.add(y),a=!0)},p=x=>{t.has(x)||(t.add(x),a=!0)},u=(x,y)=>{let S=Pe(x.expression);if(A.isIdentifier(S)&&ss.has(S.text)||Qt(S)||A.isCallExpression(x)&&xl(x)||is(S))return!0;let k=Mn(S);if(k!==null&&(k.name==="call"||k.name==="apply"||k.name==="bind")){let E=k.receiver;if(is(E)||t.has(E)||A.isIdentifier(E)&&(Wr(r,E)||i.has(E.text)))return!0}if(t.has(S)||(A.isCallExpression(S)||A.isNewExpression(S))&&u(S,y+1)||A.isIdentifier(S)&&(Wr(r,S)||i.has(S.text)))return!0;if(A.isCallExpression(x)){let E=kl(x);if(E!==null&&qr(E.target,r))return!0}return!1},m=(x,y)=>{if(y>=_p)return!0;let S=Pe(x);if(t.has(S))return!0;if(A.isIdentifier(S))return Vr.has(S.text)||Wr(r,S);if(A.isBinaryExpression(S)){let k=S.operatorToken.kind;return k===A.SyntaxKind.BarBarToken||k===A.SyntaxKind.AmpersandAmpersandToken||k===A.SyntaxKind.QuestionQuestionToken?m(S.left,y+1)||m(S.right,y+1):!1}return A.isConditionalExpression(S)?m(S.whenTrue,y+1)||m(S.whenFalse,y+1):A.isPropertyAccessExpression(S)||A.isElementAccessExpression(S)?qr(S,r):A.isCallExpression(S)||A.isNewExpression(S)?u(S,y+1):!1},h=(x,y)=>{if((A.isVariableDeclaration(x)||A.isParameter(x)||A.isBindingElement(x))&&x.initializer!==void 0){if(m(x.initializer,0)){let k=bl(x,e);for(let E of er(x.name))c(E,k)}}else if(A.isBinaryExpression(x)&&x.operatorToken.kind===A.SyntaxKind.EqualsToken&&A.isIdentifier(x.left)&&m(x.right,0))c(x.left.text,Ep(x.left,e,s));else if(A.isReturnStatement(x)&&x.expression!==void 0&&y!==void 0&&m(x.expression,0))l(i,y);else if(A.isCallExpression(x)||A.isNewExpression(x)){u(x,0)&&p(x);let k=Pe(x.expression),E=Mn(k),g=E!==null&&E.name==="call",b=E!==null&&E.name==="apply",w=g||b?E.receiver:k,I=g?1:0,N=[];A.isFunctionExpression(w)||A.isArrowFunction(w)?N.push({fn:w,slots:wl(w)}):A.isIdentifier(w)&&N.push(...o.params.get(w.text)??[]);let v=x.arguments??[];if(b){let _=v[1]===void 0?void 0:Pe(v[1]);for(let{fn:P,slots:R}of N)if(_!==void 0&&A.isArrayLiteralExpression(_))for(let L=0;L<_.elements.length;L+=1){let O=_.elements[L],F=R[L];if(!(O===void 0||F===void 0)&&m(O,0))for(let K of F)c(K,P)}else if(_!==void 0)for(let L of R)for(let O of L)c(O,P)}else for(let{fn:_,slots:P}of N)for(let R=I;R<v.length;R+=1){let L=v[R],O=P[R-I];if(!(L===void 0||O===void 0)&&m(L,0))for(let F of O)c(F,_)}}let S=y;if(A.isFunctionDeclaration(x))S=x.name?.text;else if(A.isFunctionExpression(x)||A.isArrowFunction(x)){let k=x.parent;S=A.isVariableDeclaration(k)&&A.isIdentifier(k.name)?k.name.text:void 0}A.forEachChild(x,k=>h(k,S))};h(e,void 0)}return{roots:n,nodes:t,saturated:!1}}function Rp(e){if(A.isIdentifier(e)&&ss.has(e.text)||Qt(e))return!0;let n=Mn(e);if(n!==null&&(Hr.has(n.name)||(n.name==="call"||n.name==="apply")&&(A.isIdentifier(n.receiver)&&ss.has(n.receiver.text)||Qt(n.receiver)||(A.isPropertyAccessExpression(n.receiver)||A.isElementAccessExpression(n.receiver))&&yl(n.receiver))))return!0;if(A.isElementAccessExpression(e)&&!A.isStringLiteralLike(e.argumentExpression)){let t=Pe(e.expression);if(A.isIdentifier(t)&&Vr.has(t.text))return!0}return!1}var Pp=4;function pl(e,n){for(let t of e){if(!A.isStringLiteralLike(t)||n>=Pp)return!0;let r=A.createSourceFile("<eval>",`async function* __cupel_eval_probe__(){
 ${t.text}
-}`,E.ScriptTarget.Latest,!0),r=o.parseDiagnostics;if(r!==void 0&&r.length>0||Lu(o,n+1,!0))return!0}return!1}function Lu(e,n=0,t=!1){return hr(e,n,t).size>0}function hr(e,n=0,t=!1){let o=new Set,r=t?_u:Mu(e);if(r.saturated)return o.add("saturated"),o;let s=l=>E.isElementAccessExpression(l)&&!E.isStringLiteralLike(l.argumentExpression)&&fo(_e(l.expression),r),a=l=>{if(t&&(E.isCallExpression(l)||E.isNewExpression(l)||E.isTaggedTemplateExpression(l))){o.add("eval-invocation");return}if(E.isCallExpression(l)){let i=_t(l);if(i!==null){let d=i.specifierArg;if(d===void 0||!E.isStringLiteralLike(d)||t){o.add("non-literal-load");return}}else{let d=_e(l.expression);if(E.isIdentifier(d)&&(d.text==="eval"||d.text==="Function")){if(Oi(l.arguments,n)){o.add("eval-code");return}}else if(Tu(d)){o.add("loader-callee");return}else if(s(d)){o.add("computed-loader");return}else if(Ou(l,r)){o.add("reflect-get");return}}}else if(E.isNewExpression(l)){let i=_e(l.expression);if(E.isIdentifier(i)&&i.text==="Function"){if(Oi(l.arguments??[],n)){o.add("function-ctor");return}}else if(It(i)){o.add("ctor-chain");return}}else if(E.isIdentifier(l)&&Eu.has(l.text)&&Au(l)){o.add("captured-loader");return}else if((E.isPropertyAccessExpression(l)||E.isElementAccessExpression(l))&&(Di(l)||It(l)||s(l))&&Ti(l)){o.add("captured-member");return}else if(E.isBindingElement(l)){let i=l.propertyName??l.name,d=E.isIdentifier(i)||E.isStringLiteralLike(i)?i.text:E.isComputedPropertyName(i)&&E.isStringLiteralLike(i.expression)?i.expression.text:void 0;if(d!==void 0&&mo.has(d)){o.add("destructured-member");return}}E.forEachChild(l,a)};return a(e),o}function Ui(e,n,t){let o=new Set(hr(t));if(yr(e)&&n.includes("<")&&n.includes("require")){let r=E.createSourceFile(e,n,E.ScriptTarget.ES2020,!0,E.ScriptKind.TSX);for(let s of hr(r))o.add(s)}return o}function Fu(e,n,t){if(gr(e))return!0;let o=t.endsWith(Me.sep)?t:t+Me.sep,r=e.split("/"),s=n;for(;;){let a=Me.join(s,"node_modules",...r),l;try{l=Un(Me.join(a,"package.json"))}catch{l=null}if(l!==null){if(!l.startsWith(o))return!1;let d=Oe(l);if(d===null)return!1;let u;try{u=JSON.parse(d).exports}catch{return!1}if(typeof u=="string"||Array.isArray(u)||typeof u=="object"&&u!==null)return!1}if(fi(a))return!1;if(s===t)break;let i=Me.dirname(s);if(i===s||i!==t&&!i.startsWith(o))break;s=i}return!0}function ju(e,n){let t=n.endsWith(Me.sep)?n:n+Me.sep,o=Me.dirname(e);for(;;){let r=Me.join(o,"package.json"),s;try{s=Un(r)}catch{s=null}if(s!==null&&(s===n||s.startsWith(t))){let l=Oe(s);if(l!==null)try{let i=JSON.parse(l).name;if(typeof i=="string"&&i.length>0)return i}catch{return null}}if(o===n)break;let a=Me.dirname(o);if(a===o||a!==n&&!a.startsWith(t))break;o=a}return null}function Bu(e,n,t,o,r){let s=[],a=[],l=new Set,i={},d=[],u=[],p=new Set,f=new Set,m=[],g=!1,y=(x,I)=>{let w;try{w=Un(I)}catch{return!1}let A=Le(e,w);if(A===null)return r.push({code:"out-of-root",path:w,detail:"dependency module resolved outside the app root; not followed"}),!1;let k=!t.has(w)&&!f.has(w);return k&&f.size>=fr?(g=!0,!1):(a.push({from:x,to:{module:A}}),k?(f.add(w),s.push(A),!0):!1)},b=(x,I)=>{if(l.add(I),p.has(I))return;p.add(I);let w=He(I,x,Ce,n),A=w!==null?[w]:ot(I,x,Ce,n);A.length>=2&&d.push({path:Le(e,x)??x,specifier:I,candidates:A.map(h=>Le(e,h)??h)});let k=!1;for(let h of A)if(!Ke(h)&&(k=!0,y({surface:I},h))){m.push(h);try{let S=Le(e,Un(h)),_=ju(h,e);S!==null&&_!==null&&(i[S]=_)}catch{}}k||Fu(I,Me.dirname(x),e)||r.push({code:"unresolved-specifier",path:I,reason:Et(I,x,Ce,n),detail:`dependency "${I}" is installed and Node loads an entry for it, but its runtime entry did not resolve here (divergent conditional exports / a typesVersions remap / a declaration-only surface / an unreadable manifest / an out-of-root install); its module was not analyzed (degraded to unbounded)`})};for(let x of o)b(x.containingFile,x.packageName);for(;m.length>0&&f.size<fr;){let x=m.pop();if(x===void 0)break;let I=Le(e,x);if(I===null)continue;let w=tt(x,In);if(w.kind==="too-large"){r.push({code:"limit-exceeded",path:I,detail:`dependency module over the ${String(In/1048576)}MiB cap; its imports were not followed (degraded to unbounded)`});continue}if(w.kind==="not-regular"){r.push({code:"parse-error",path:I,detail:"dependency module unreadable or not a regular file; its imports were not followed (degraded to unbounded)"});continue}let A=E.createSourceFile(x,w.text,E.ScriptTarget.ES2020,!0),k=A.parseDiagnostics;if(k!==void 0&&k.length>0){r.push({code:"dependency-body",path:I,detail:"dependency module has syntax errors; its tolerant parse may have dropped import/loader nodes \u2014 module reach unbounded (ADR-050 2A parse-cap)"});continue}let h=Ui(x,w.text,A);if(h.size>0){r.push({code:"dependency-body",path:I,detail:"dependency module contains a loader escape (eval / Function / reflective or non-literal loader / captured loader value); its module reach is unbounded (ADR-045 Attack #1 dep-side mirror)",escapes:[...h].sort()});continue}r.push({code:"dependency-body",path:I,detail:"dependency module followed at module-import granularity only; its function bodies are not analyzed (ADR-050 2A, bodyless)",anchor:I});for(let S of Ci(x,w.text))if(S.runtime)if(we(S.text)==="package-root"){let _=Ge(S.text);a.push({from:{module:I},to:{surface:_}}),b(x,_)}else{if(gr(Ge(S.text)))continue;let _=He(S.text,x,Ce,n),P=_!==null?[_]:ot(S.text,x,Ce,n);if(P.length===0){if(we(S.text)==="package-subpath"){let v=Et(S.text,x,Ce,n);if(v==="no-candidate"||v==="not-installed"&&gi(x,Ge(S.text))){u.push({path:I,specifier:S.text,why:v});continue}r.push({code:"unresolved-specifier",path:I,reason:v,detail:`runtime package-subpath import "${S.text}" did not resolve under Node10 (an exports-map/typesVersions subpath Node may load); its module was not analyzed`})}continue}P.length>=2&&d.push({path:I,specifier:S.text,candidates:P.map(v=>Le(e,v)??v)});for(let v of P){if(Ke(v)){let T=Le(e,v);r.push({code:T===null?"out-of-root":"declaration-shadow",path:I,detail:T===null?`runtime import "${S.text}" resolved outside the app root; its module was not analyzed`:`runtime import "${S.text}" resolved to the declaration file "${T}" with no co-located runtime module; its code was not analyzed`});continue}y({module:I},v)&&m.push(v)}}}return(g||m.length>0)&&r.push({code:"limit-exceeded",path:e,detail:`dependency module closure hit the ${String(fr)} cap; module-reachability truncated (degraded to unbounded)`}),{modules:s,edges:a,surfacePackages:[...l],entryRealNames:i,conditionUnions:d,provenAbsent:u}}function zi(e,n,t=!1){let o=Un(e),r=[],s=[],a=E.createCompilerHost(Ce,!0),l=t?yi(o,Ce,a):()=>null,i=new Set,d=new Set,u=n.map(N=>Me.join(o,N)),p=[],f=new Map,m=new Map,g=new Map,y=new Map,b=new Set,x=(N,j,O)=>{let F=`${String(N.length)}:${N}${j}`;b.has(F)||(b.add(F),r.push({code:"unresolved-specifier",path:N,detail:j,reason:O}))},I=()=>null,w=0,A=(N,j)=>{let O=m.get(N);return O===void 0&&(O=E.createSourceFile(N,j,E.ScriptTarget.ES2020,!0),m.set(N,O)),{real:N,sf:O}};for(;d.size<co;){let N=u.pop();if(N===void 0){if(w>=ku)break;w+=1;let K=[];for(let[D,C]of f)C.includes("readdir")&&(C.includes("require")||C.includes("import("))&&K.push(A(D,C));let te=bu(K);if(te.length===0)break;let U=[];for(let[D,C]of f)U.push(A(D,C));I=Ni(U,te,Ce,a,g);let X=!1;for(let D of K){let C=f.get(D.real);if(C!==void 0)for(let H of $i(D.real,C,o,a,I))d.has(H)||(u.push(H),X=!0)}if(!X)break;continue}let j;try{j=Un(N)}catch{continue}if(d.has(j))continue;if(d.add(j),Le(o,j)===null){r.push({code:"out-of-root",path:N,detail:"resolved outside app root"});continue}let O=tt(j,In);if(O.kind==="too-large"){r.push({code:"limit-exceeded",path:j,detail:`file is ${String(Math.round(O.bytes/1048576))}MiB, over the ${String(In/1048576)}MiB per-file cap; skipped (degraded to unknown)`});continue}if(O.kind==="not-regular"){r.push({code:"parse-error",path:j,detail:"unreadable or not a regular file"});continue}let F=O.text;i.add(j),f.set(j,F);for(let K of Ci(j,F)){let te=K.runtime?l(K.text,j):null;if(te===null&&we(K.text)==="package-root"){K.runtime&&p.push({containingFile:j,packageName:Ge(K.text)});continue}let U=te??He(K.text,j,Ce,a),X=U!==null?[U]:K.runtime&&te===null?ot(K.text,j,Ce,a):[];if(X.length===0){if(K.runtime){let D=we(K.text);if(!(D==="package-subpath"&&gr(Ge(K.text)))){if(D==="package-subpath")x(j,`runtime package-subpath import "${K.text}" did not resolve under Node10 (an exports-map/typesVersions subpath Node may load); its module was not analyzed`,Et(K.text,j,Ce,a));else if(D==="relative"){let C=mi(K.text,j,o,y);C.kind==="unanalyzable"&&x(j,`runtime relative import "${K.text}" did not resolve and its absence could not be proven \u2014 ${C.reason}; a bundler/loader may load a module the analyzer never saw`,C.why)}}}continue}X.length>=2&&s.push({path:Le(o,j)??j,specifier:K.text,candidates:X.map(D=>Le(o,D)??D)});for(let D of X){if(Le(o,D)===null){r.push({code:"out-of-root",path:D,detail:`specifier "${K.text}" resolved outside app root`});continue}if(K.runtime&&Ke(D)){r.push({code:"declaration-shadow",path:D,detail:`runtime import "${K.text}" resolved to a declaration file with no co-located runtime module; its code was not analyzed`});continue}if(K.runtime&&!ro(D)){r.push({code:"unanalyzable-module",path:D,detail:`runtime import "${K.text}" resolved to a file the analyzer cannot parse (extensionless/.json/.node); its module was not analyzed`});continue}u.push(D)}}for(let K of $i(j,F,o,a,I))d.has(K)||u.push(K)}d.size>=co&&u.length>0&&r.push({code:"limit-exceeded",path:o,detail:`reachable file set exceeds ${String(co)}; analysis truncated (${String(u.length)}+ files not analyzed)`});let k=Bu(o,a,i,p,r),h=E.createProgram({rootNames:[...i],options:Ce,host:a}),S=new Set,_=new Map;for(let N of h.getSourceFiles()){if(N.isDeclarationFile||h.isSourceFileDefaultLibrary(N)||Le(o,N.fileName)===null||!yr(N.fileName))continue;let j=h.getSyntacticDiagnostics(N).length>0;if(!j&&!N.text.includes("<")||Su(N.text,E.ScriptKind.TSX)!==0)continue;let O=E.createSourceFile(N.fileName,N.text,E.ScriptTarget.ES2020,!0,E.ScriptKind.TSX);(j||Pi(O)>Pi(N))&&(S.add(N.fileName),_.set(N.fileName,N.text))}let P=h;if(S.size>0){let N=a.getSourceFile.bind(a);a.getSourceFile=(j,O,F,K)=>{let te=_.get(j);return te!==void 0?E.createSourceFile(j,te,E.ScriptTarget.ES2020,!0,E.ScriptKind.TSX):N(j,O,F,K)},P=E.createProgram({rootNames:[...i],options:Ce,host:a,oldProgram:h})}let v=P.getTypeChecker(),T=[];for(let N of P.getSourceFiles()){if(N.isDeclarationFile||P.isSourceFileDefaultLibrary(N)||Le(o,N.fileName)===null)continue;T.push(N);let j=P.getSyntacticDiagnostics(N);if(j.length>0){let K=j[0],te=K!==void 0?E.flattenDiagnosticMessageText(K.messageText," "):"syntax error";r.push({code:"parse-error",path:N.fileName,detail:`${String(j.length)} syntax error(s): ${te}`})}let O=Le(o,N.fileName),F=O===null?null:Ui(N.fileName,N.text,N);O!==null&&F!==null&&F.size>0&&r.push({code:"loader-escape",path:O,detail:"module contains a loader escape (eval / Function / reflective or non-literal loader / captured or destructured loader); its module reach is unbounded (ADR-050 2B)",escapes:[...F].sort()})}return{program:P,checker:v,host:a,options:Ce,appRoot:o,sourceFiles:T,diagnostics:r,depReach:k,conditionUnions:[...s,...k.conditionUnions],provenAbsent:k.provenAbsent,resolveParamDirs:I,toRel:N=>Le(o,N)}}import{opendirSync as Ku,statSync as Uu}from"node:fs";import xr from"node:path";var zu=8192,Wu=2e4,Vu=new Set(["node_modules"]),Wi=new Set(["test","tests","__tests__","__mocks__","fixtures","e2e","dist","build","out","coverage","vendor"]),qu=16;function ho(e,n,t,o,r={}){let s=r.maxEntries??Wu,a=r.prune,l=[],i=!1,d=0,u=[{dir:xr.join(e,n),rel:n,depth:0}];for(;u.length>0;){let p=u.pop();if(p===void 0)break;if(p.depth>qu){i=!0;continue}let f;try{f=Ku(p.dir)}catch{i=!0;continue}try{let m=0;for(;;){let g=f.readSync();if(g===null)break;if(m+=1,d+=1,m>zu||d>s){i=!0;break}let y=p.rel+g.name;if(g.isSymbolicLink()){let b;try{b=Uu(xr.join(p.dir,g.name)).isDirectory()}catch{i=!0;continue}if(b){i=!0;continue}}else if(g.isDirectory()){if(Vu.has(g.name)||g.name.startsWith(".")||a?.has(g.name)===!0){i=!0;continue}u.push({dir:xr.join(p.dir,g.name),rel:`${y}/`,depth:p.depth+1});continue}else if(!g.isFile())continue;if(t(y)){if(l.length>=o){i=!0;break}l.push(y)}}}finally{try{f.closeSync()}catch{}}}return{matches:l,truncated:i}}var Gu=64;function Vi(e,n){let t=n.indexOf("*");if(t===-1||n.indexOf("*",t+1)!==-1)return null;let o=n.slice(0,t),r=n.slice(t+1);if(o.startsWith("./")&&(o=o.slice(2)),o.startsWith("/")||r.includes("/")||o.split("/").includes("..")||o.includes("\\")||n.includes("\0"))return null;let s=o.slice(0,o.lastIndexOf("/")+1);return ho(e,s,a=>a.length>=o.length+r.length&&a.startsWith(o)&&a.endsWith(r),Gu)}import{existsSync as Hu}from"node:fs";import Xu from"node:path";var Yu=[{name:"Astro",dependency:"astro",configFiles:["astro.config.mjs","astro.config.js","astro.config.ts","astro.config.mts"],entryHint:"your route files under src/pages/",rootDirs:["pages","actions"]},{name:"Next.js",dependency:"next",configFiles:["next.config.js","next.config.mjs","next.config.ts","next.config.cjs"],entryHint:"your route files under app/ or pages/",rootDirs:["app","pages"]},{name:"SvelteKit",dependency:"@sveltejs/kit",configFiles:["svelte.config.js","svelte.config.mjs","svelte.config.ts"],entryHint:"your route files under src/routes/",rootDirs:["routes"]},{name:"Nuxt",dependency:"nuxt",configFiles:["nuxt.config.js","nuxt.config.mjs","nuxt.config.ts"],entryHint:"app.vue, or your route files under pages/",rootDirs:["server","pages","middleware","plugins"]},{name:"Remix",dependency:"@remix-run/dev",configFiles:["remix.config.js","remix.config.mjs","vite.config.js","vite.config.ts"],entryHint:"app/root.tsx, or your route files under app/routes/",rootDirs:["app","routes"]},{name:"Vite",dependency:"vite",configFiles:["vite.config.js","vite.config.ts","vite.config.mjs","vite.config.mts"],entryHint:"the module script your index.html loads",rootDirs:[]}],Ju=["dependencies","devDependencies"];function Zu(e,n){for(let t of Ju){let o=e[t];if(!(typeof o!="object"||o===null||Array.isArray(o))&&Object.hasOwn(o,n))return!0}return!1}function Sr(e,n){if(n===null)return null;for(let t of Yu)if(Zu(n,t.dependency)){for(let o of t.configFiles)if(Hu(Xu.join(e,o)))return{name:t.name,configFile:o,entryHint:t.entryHint,rootDirs:t.rootDirs}}return null}function br(e){return`This looks like ${e.name} (${e.configFile} plus the dependency), and ${e.name} resolves its entry at build time \u2014 there is nothing in package.json for cupel to start from. Pass --entry ${e.entryHint}.`}var Qu=[".ts",".tsx",".mts",".cts",".js",".jsx",".mjs",".cjs"],ef=256,nf=12e4;function kr(e,n){let t=new Set(n.rootDirs);if(t.size===0)return{roots:[],truncated:!1};let o=ho(e,"",r=>{let s=r.split("/");for(let a=0;a<s.length-1;a+=1){let l=s[a];if(l!==void 0&&t.has(l))return Qu.some(i=>r.endsWith(i))}return!1},ef,{maxEntries:nf,prune:Wi});return{roots:o.matches,truncated:o.truncated}}function Xe(e){let n=e.length<=120?e:`${e.slice(0,120)}\u2026`,t="";for(let o of n){let r=o.codePointAt(0)??0;t+=r<32||r>=127&&r<=159?`\\x${r.toString(16).padStart(2,"0")}`:o}return t}function tf(e){for(let n of e){let t=n.codePointAt(0)??0;if(t<32||t===127||t>=128&&t<=159||"&|;<>$`(){}[]*?~#!\\\"'".includes(n))return!0}return!1}function of(e){let n=!1;for(let t=0;t<e.length;t+=1){let o=e.charAt(t),r=o.codePointAt(0)??0;if(r<32||r===127||r>=128&&r<=159)return null;if(o==="\\"){n=!0;let s=e.charAt(t+1);if(!(s>="a"&&s<="z"||s>="A"&&s<="Z"||s>="0"&&s<="9"||s==="."||s==="_"||s==="-"))return null;continue}if("&|;<>$`(){}[]*?~#!\"'".includes(o))return null}return n?{windows:e.split("\\").join("/"),posixShell:e.split("\\").join("")}:null}function rf(e){let n=[],t="";for(let o of e){if(o===" "||o==="	"){if(t.length>0){if(n.length>=64)return null;n.push(t),t=""}continue}t+=o}if(t.length>0){if(n.length>=64)return null;n.push(t)}return n}var sf=/^[A-Za-z_][A-Za-z0-9_]*=/u;function af(e){let n=e.slice(e.lastIndexOf("/")+1);return n==="node"||n==="nodejs"}var lf=new Set(["--abort-on-uncaught-exception","--disallow-code-generation-from-strings","--enable-source-maps","--experimental-json-modules","--experimental-modules","--experimental-vm-modules","--frozen-intrinsics","--harmony","--inspect","--inspect-brk","--no-warnings","--preserve-symlinks","--preserve-symlinks-main","--trace-uncaught","--trace-warnings","--use-strict","--zero-fill-buffers"]),df=new Set(["--dns-result-order","--heapsnapshot-signal","--inspect-port","--max-http-header-size","--max-old-space-size","--max-semi-space-size","--stack-size","--title","--tls-cipher-list","--trace-event-categories","--unhandled-rejections","--v8-pool-size"]),cf=new Set(["-e","--eval","-p","--print","--run","--env-file","--env-file-if-exists"]);function Gi(e){return e.includes("require")||e.includes("import")||e.includes("loader")}function qi(e){if(Gi(e))return{token:e,why:"preloads another module; the launch surface is more than one file"};let n=e.indexOf("="),t=n===-1?e:e.slice(0,n);return cf.has(t)?{token:t,why:"runs code that is not the script token (or can inject a preload); the entry file cannot be identified"}:lf.has(t)||n!==-1&&df.has(t)?null:{token:t,why:"is not on cupel's allowlist of flags that provably do not change which file node runs \u2014 the entry file cannot be identified with certainty"}}var uf=[".js",".cjs",".mjs",".ts",".mts",".cts"];function ff(e){return uf.some(n=>e.endsWith(n))}var pf=new Set(["npm","yarn","pnpm"]);function mf(e){let n=e[0];return n===void 0||!pf.has(n)?!1:e.length===2?e[1]==="start":e.length===3&&e[1]==="run"&&e[2]==="start"}function wr(e){let n=e.trim();if(n.length===0)return{kind:"unparsed",reason:"empty command"};if(n.length>4096)return{kind:"unparsed",reason:`command exceeds the ${String(4096)}-byte cap; not parsed`};if(!tf(n))return Er(n);let t=of(n);if(t===null)return{kind:"unparsed",reason:"contains shell metacharacters (chaining/expansion/quoting) \u2014 not a plain `node <file>` invocation"};let o=Er(t.windows),r=Er(t.posixShell);if(o.kind==="file"){let s=r.kind==="file"?r.specifier:void 0;return s===void 0||s===o.specifier?{kind:"file",specifier:o.specifier}:{kind:"file",specifier:o.specifier,alt:s}}return r.kind==="file"?{kind:"file",specifier:r.specifier}:o}function Er(e){let n=rf(e);if(n===null)return{kind:"unparsed",reason:"command has more tokens than cupel will consider"};let t=0;for(n[t]==="env"&&(t+=1);t<n.length;t+=1){let s=n[t];if(s===void 0||!sf.test(s))break;if(Gi(s))return{kind:"unparsed",reason:`environment \`${Xe(s)}\` preloads another module; the launch surface is more than one file`};let a=s.indexOf("=");if(s.slice(0,a)==="NODE_OPTIONS")for(let l of s.slice(a+1).split(/\s+/u)){if(l===""||!l.startsWith("-"))continue;let i=qi(l);if(i!==null)return{kind:"unparsed",reason:`NODE_OPTIONS flag \`${Xe(i.token)}\` ${i.why}`}}}let o=n[t];if(o===void 0)return{kind:"unparsed",reason:"no program in the command"};if(mf(n.slice(t)))return{kind:"delegates",target:"scripts.start"};if(!af(o))return{kind:"unparsed",reason:`runs \`${Xe(o)}\`, not node directly \u2014 the entry file cannot be identified`};for(t+=1;t<n.length;t+=1){let s=n[t];if(s===void 0||!s.startsWith("-"))break;let a=qi(s);if(a!==null)return{kind:"unparsed",reason:`node flag \`${Xe(a.token)}\` ${a.why}`}}let r=n[t];return r===void 0?{kind:"unparsed",reason:"node is invoked with no script file"}:ff(r)?{kind:"file",specifier:r}:{kind:"unparsed",reason:`\`${Xe(r)}\` has no .js/.cjs/.mjs/.ts extension \u2014 not confidently a JS entry file`}}function hf(e){for(let n of e)if(!(n>="a"&&n<="z"||n>="A"&&n<="Z"||n>="0"&&n<="9"||n==="_"||n==="-"))return!1;return e.length>0}var gf=64;function vr(e){let n=e.split(`
-`),t=n.length>64,o=[],r=0;for(let s of n.slice(0,64)){let a=s.trim();if(a.length===0||a.startsWith("#"))continue;let l=a.indexOf(":");if(l<=0)continue;let i=a.slice(l+1).trim();if(i.length===0)continue;let d=a.slice(0,l);if(d.length>gf||!hf(d)){r+=1;continue}o.push({name:d,command:i})}return o.sort((s,a)=>s.name===a.name?0:s.name==="web"?-1:a.name==="web"?1:0),{entries:o,truncated:t,unnamedLines:r}}import{realpathSync as Hi}from"node:fs";import ze from"node:path";import c from"typescript";var Xi=3;function he(e,n,t){if(e===void 0)return;let o=e[n]??={fired:0,refused:{}};t===null?o.fired+=1:o.refused[t]=(o.refused[t]??0)+1}function Nn(e,n,t){return{path:e,start:n.getStart(t,!1),end:n.getEnd()}}var yo=16,Nr=256,Ir=class{mods=new Map;fns=new Map;classNodes=new Map;classMembers=new Map;moduleFor(n){let t=`pkg:${n}`;return this.mods.has(n)||this.mods.set(n,{id:t,packageName:n,versionRange:"",path:n,moduleSystem:"dual",isEntrypoint:!1,externalSurface:!0}),t}exportFor(n,t){let o=`${n}#${t}`,r=`pkg:${n}#${t}`;return this.fns.has(o)||(this.moduleFor(n),this.fns.set(o,{id:r,moduleId:`pkg:${n}`,name:t,kind:"function",declRange:{path:n,start:0,end:0},isExported:!0,publicSurfaceReachable:!0})),r}classFor(n,t){let o=`${n}#${t}`,r=`pkg:${n}#${t}`;return this.classNodes.has(o)||(this.moduleFor(n),this.classNodes.set(o,{id:r,moduleId:`pkg:${n}`,name:t,implementsRefs:[],members:[]}),this.classMembers.set(o,[])),r}methodFor(n,t,o,r){let s=`${n}#${t}.${o}`,a=`pkg:${n}#${t}.${o}`;if(!this.fns.has(s)){let l=this.classFor(n,t);this.fns.set(s,{id:a,moduleId:`pkg:${n}`,name:o,kind:r,enclosingClassId:l,declRange:{path:n,start:0,end:0},isExported:!0,publicSurfaceReachable:!0}),this.classMembers.get(`${n}#${t}`)?.push(a)}return a}modules(){return[...this.mods.values()]}functions(){return[...this.fns.values()]}classes(){return[...this.classNodes.entries()].map(([n,t])=>({...t,members:this.classMembers.get(n)??[]}))}};function ra(e,n){let t="node_modules/",o=e.lastIndexOf(t);if(o===-1)return n;let s=e.slice(o+t.length).split("/");return s[0]?.startsWith("@")&&s.length>=2?`${s[0]}/${s[1]}`:s[0]??n}function Yi(e,n,t){let o=ze.dirname(e),r=ze.dirname(n),s=[];for(;;){let l=t.get(o);if(l!==void 0){for(let d of s)t.set(d,l);return l}s.push(o);let i=Oe(ze.join(o,"package.json"));if(i!==null)try{let d=JSON.parse(i),u={name:d.name??"app",version:d.version??"0.0.0",dir:o};for(let p of s)t.set(p,u);return u}catch{}if(o===r||o===ze.dirname(o))break;o=ze.dirname(o)}let a={name:"app",version:"0.0.0",dir:null};for(let l of s)t.set(l,a);return a}function Ar(e){return c.isParenthesizedExpression(e)?Ar(e.expression):c.isStringLiteralLike(e)?e.text:c.isTemplateExpression(e)?e.head.text:c.isBinaryExpression(e)&&e.operatorToken.kind===c.SyntaxKind.PlusToken?Ar(e.left):null}function yf(e){if(!c.isCallExpression(e))return!1;let n=e.expression,t=c.isPropertyAccessExpression(n)?n.name.text:c.isIdentifier(n)?n.text:null;if(t!=="join"&&t!=="resolve")return!1;let o=e.arguments[0];return o!==void 0&&c.isIdentifier(o)&&(o.text==="__dirname"||o.text==="__filename")}function sa(e){let n=Ar(e);return n!==null?n.startsWith("./")||n.startsWith("../")?"relative-bounded":n.length>0&&!n.startsWith(".")&&!n.startsWith("/")?"bare":"unknown":yf(e)?"relative-bounded":"unknown"}function xf(e){let n=[],t=o=>{if(c.isImportDeclaration(o)&&c.isStringLiteralLike(o.moduleSpecifier))n.push({specifier:o.moduleSpecifier.text,specifierIsLiteral:!0,dynamic:!1});else if(c.isImportEqualsDeclaration(o)&&c.isExternalModuleReference(o.moduleReference)&&c.isStringLiteralLike(o.moduleReference.expression))n.push({specifier:o.moduleReference.expression.text,specifierIsLiteral:!0,dynamic:!1});else if(c.isExportDeclaration(o)&&o.moduleSpecifier!==void 0&&c.isStringLiteralLike(o.moduleSpecifier))n.push({specifier:o.moduleSpecifier.text,specifierIsLiteral:!0,dynamic:!1});else if(c.isCallExpression(o)){let r=_t(o);if(r!==null){let s=r.specifierArg,a=s!==void 0&&c.isStringLiteralLike(s);n.push({specifier:a?s.text:void 0,specifierIsLiteral:a,dynamic:!0,...s!==void 0&&!a?{computedArg:s,loadPos:o.getStart(e)}:{}})}}c.forEachChild(o,t)};return t(e),n}function Sf(e,n,t){let o=new Map,r=Yi(ze.join(e.appRoot,"package.json"),e.appRoot,o),s=[],a=[],l=[],i=new Map,d=new Set,u=[],p=new Set;for(let f of e.sourceFiles){let m=e.toRel(f.fileName);m!==null&&p.add(m)}for(let f of e.sourceFiles){let m=e.toRel(f.fileName);if(m===null)continue;let g=Yi(f.fileName,e.appRoot,o),y=ra(m,r.name),b=m.includes("node_modules/");s.push({id:m,packageName:b&&g.name!==r.name?g.name:y,versionRange:g.version,path:m,moduleSystem:"cjs",isEntrypoint:n.has(m)}),g.dir===r.dir&&d.add(m);let x=0,I=null;for(let w of xf(f)){let A=`${m}#import${String(x)}`;x+=1;let k=null,h=[];if(w.specifier!==void 0)if(we(w.specifier)==="package-root")k=t.moduleFor(Ge(w.specifier));else{let S=He(w.specifier,f.fileName,e.options,e.host),_=S!==null?e.toRel(S):null;if(_!==null)k=_;else if(w.specifier!==void 0){let[P,...v]=ot(w.specifier,f.fileName,e.options,e.host).map(T=>e.toRel(T)).filter(T=>T!==null&&p.has(T));P!==void 0&&v.length>=1&&(k=P,h=v.map(T=>T))}}a.push({id:A,moduleId:m,specifier:w.specifier??"<computed>",isNamespace:!1,isDefault:!1,dynamic:w.dynamic,specifierIsLiteral:w.specifierIsLiteral,...k!==null?{resolvedModuleId:k}:{}}),k!==null&&l.push({importId:A,resolvedModuleId:k});for(let S of h)l.push({importId:A,resolvedModuleId:S});if(w.computedArg!==void 0&&w.loadPos!==void 0&&u.push({importId:String(A),path:m,pos:w.loadPos,shape:sa(w.computedArg),text:w.computedArg.getText(f).slice(0,160)}),w.computedArg!==void 0&&w.loadPos!==void 0){I??=Kn(f,f.fileName,e.resolveParamDirs);let S=[];for(let _ of ao(w.computedArg,I,e.appRoot,e.options,e.host)){let P=e.toRel(_);if(P===null||!p.has(P))continue;let v=P,T=`${m}#import${String(x)}`;x+=1,a.push({id:T,moduleId:m,specifier:P,isNamespace:!1,isDefault:!1,dynamic:!0,specifierIsLiteral:!0,resolvedModuleId:v}),l.push({importId:T,resolvedModuleId:v}),S.push(P)}if(S.length>0){let _=vt(w.computedArg,I)!==null||io(w.computedArg),P=i.get(m)??[];P.push({pos:w.loadPos,candidateRels:S,seedable:_}),i.set(m,P)}}}}return{modules:s,imports:a,importEdges:l,computedLoads:i,appOwnedPaths:d,loadSites:u}}function bf(e){let n=Oe(e);if(n===null)return null;let t=c.createSourceFile(e,n,c.ScriptTarget.Latest,!0),o=r=>t.statements.some(s=>c.isFunctionDeclaration(s)?s.name?.text===r:c.isVariableStatement(s)?s.declarationList.declarations.some(a=>c.isIdentifier(a.name)&&a.name.text===r&&a.initializer!==void 0&&(c.isFunctionExpression(a.initializer)||c.isArrowFunction(a.initializer))):!1);for(let r of t.statements){if(c.isFunctionDeclaration(r)&&r.name!==void 0&&r.modifiers?.some(a=>a.kind===c.SyntaxKind.DefaultKeyword)===!0)return r.name.text;if(!c.isExpressionStatement(r)||!c.isBinaryExpression(r.expression))continue;let s=r.expression;if(s.operatorToken.kind===c.SyntaxKind.EqualsToken&&kf(s.left)){if(c.isFunctionExpression(s.right)&&s.right.name!==void 0)return s.right.name.text;if(c.isIdentifier(s.right)&&o(s.right.text))return s.right.text}}return null}function kf(e){return c.isPropertyAccessExpression(e)&&c.isIdentifier(e.expression)&&e.expression.text==="module"&&e.name.text==="exports"?!0:c.isElementAccessExpression(e)&&c.isIdentifier(e.expression)&&e.expression.text==="module"&&c.isStringLiteralLike(e.argumentExpression)&&e.argumentExpression.text==="exports"}function Ef(e,n,t){for(let d of e.surfacePackages)n.moduleFor(d);let o=d=>"surface"in d?n.moduleFor(d.surface):d.module,r=[],s=new Set;for(let d of e.modules)t.has(d)||s.has(d)||(s.add(d),r.push({id:d,packageName:e.entryRealNames[d]??ra(d,"app"),versionRange:"",path:d,moduleSystem:"cjs",isEntrypoint:!1}));let a=[],l=[],i=0;for(let d of e.edges){let u=o(d.from),p=o(d.to),f=`${String(u)}#depreach${String(i)}`;i+=1,a.push({id:f,moduleId:u,specifier:"<dep-module-reach>",isNamespace:!1,isDefault:!1,dynamic:!1,specifierIsLiteral:!0,resolvedModuleId:p}),l.push({importId:f,resolvedModuleId:p})}return{modules:r,imports:a,importEdges:l}}function Ji(e,n,t){let o=e.expression;if(c.isIdentifier(o)&&!t.has(o.text)){let r=n.get(o.text);if(r?.kind==="package-export")return{kind:"package-instance",packageName:r.packageName,className:r.exportName};if(r?.kind==="app-class")return{kind:"app-instance",cls:r.cls}}else if(c.isPropertyAccessExpression(o)&&c.isIdentifier(o.expression)&&!t.has(o.expression.text)){let r=n.get(o.expression.text);if(r?.kind==="package-surface")return{kind:"package-instance",packageName:r.packageName,className:o.name.text}}return null}function zn(e){return c.canHaveModifiers(e)&&(c.getModifiers(e)?.some(n=>n.kind===c.SyntaxKind.ExportKeyword)??!1)}function wf(e){let n=new Set,t;for(let o of e.statements){if(c.isExpressionStatement(o)&&c.isBinaryExpression(o.expression)){let r=o.expression;if(r.operatorToken.kind===c.SyntaxKind.EqualsToken&&c.isPropertyAccessExpression(r.left)&&c.isIdentifier(r.left.expression)&&r.left.expression.text==="module"&&r.left.name.text==="exports"){if(c.isIdentifier(r.right))n.add(r.right.text),t=r.right.text;else if(c.isObjectLiteralExpression(r.right))for(let s of r.right.properties)c.isShorthandPropertyAssignment(s)?n.add(s.name.text):c.isPropertyAssignment(s)&&c.isIdentifier(s.initializer)&&n.add(s.initializer.text)}continue}if(c.isFunctionDeclaration(o)&&o.name!==void 0&&zn(o))n.add(o.name.text);else if(c.isVariableStatement(o)&&zn(o))for(let r of o.declarationList.declarations)c.isIdentifier(r.name)&&n.add(r.name.text);else if(c.isExportDeclaration(o)&&o.exportClause&&c.isNamedExports(o.exportClause))for(let r of o.exportClause.elements)n.add((r.propertyName??r.name).text);else c.isExportAssignment(o)&&c.isIdentifier(o.expression)&&(n.add(o.expression.text),t=o.expression.text)}return{reachableLocals:n,defaultTarget:t}}function vf(e){for(let n of e.statements){if(c.isFunctionDeclaration(n)&&n.name!==void 0&&zn(n)&&c.getModifiers(n)?.some(t=>t.kind===c.SyntaxKind.DefaultKeyword)===!0)return{name:n.name.text,esm:!0};if(c.isExportAssignment(n)&&!n.isExportEquals&&c.isIdentifier(n.expression))return{name:n.expression.text,esm:!0};if(c.isExpressionStatement(n)&&c.isBinaryExpression(n.expression)){let t=n.expression;if(t.operatorToken.kind===c.SyntaxKind.EqualsToken&&je(t.left)&&c.isIdentifier(t.right))return{name:t.right.text,esm:!1}}}}function fn(e){if(c.isCallExpression(e)&&c.isIdentifier(e.expression)&&e.expression.text==="require"&&e.arguments.length===1&&e.arguments[0]!==void 0&&c.isStringLiteralLike(e.arguments[0]))return e.arguments[0].text}function je(e){return c.isPropertyAccessExpression(e)&&c.isIdentifier(e.expression)&&e.expression.text==="module"&&e.name.text==="exports"?!0:c.isElementAccessExpression(e)&&c.isIdentifier(e.expression)&&e.expression.text==="module"&&c.isStringLiteralLike(e.argumentExpression)&&e.argumentExpression.text==="exports"}function on(e){if(je(e))return!0;if(!c.isPropertyAccessExpression(e)&&!c.isElementAccessExpression(e))return!1;let n=e.expression;return c.isIdentifier(n)&&n.text==="exports"?!0:je(n)}function it(e){return c.isPropertyAccessExpression(e.expression)&&c.isIdentifier(e.expression.expression)&&e.expression.expression.text==="Object"&&e.expression.name.text==="assign"}function ia(e){let n=!1,t=o=>{if(!n){if(c.isCallExpression(o)){let r=fn(o);if(r!==void 0&&we(r)!=="package-root"){n=!0;return}}c.forEachChild(o,t)}};return t(e),n}function aa(e){let n=new Set,t=r=>r!==void 0&&ia(r),o=r=>{c.isVariableDeclaration(r)&&t(r.initializer)&&wt(r.name,n),c.isBinaryExpression(r)&&r.operatorToken.kind===c.SyntaxKind.EqualsToken&&c.isIdentifier(r.left)&&t(r.right)&&n.add(r.left.text),c.forEachChild(r,o)};return o(e),n}function la(e,n){for(let t of e.properties)c.isShorthandPropertyAssignment(t)?n.add(t.name.text):c.isPropertyAssignment(t)&&c.isIdentifier(t.initializer)&&n.add(t.initializer.text)}function If(e){let n=new Set;for(let l of e.statements)if(c.isFunctionDeclaration(l)&&l.name!==void 0)n.add(l.name.text);else if(c.isClassDeclaration(l)&&l.name!==void 0)n.add(l.name.text);else if(c.isVariableStatement(l))for(let i of l.declarationList.declarations)c.isIdentifier(i.name)&&i.initializer!==void 0&&(c.isFunctionExpression(i.initializer)||c.isArrowFunction(i.initializer)||c.isObjectLiteralExpression(i.initializer))&&n.add(i.name.text);let t=l=>c.isFunctionExpression(l)||c.isArrowFunction(l)||c.isObjectLiteralExpression(l)||c.isIdentifier(l)&&n.has(l.text),o=new Set,r=l=>{c.isIdentifier(l)?o.add(l.text):c.isObjectLiteralExpression(l)&&la(l,o)},s=!1,a=l=>{if(!s){if(c.isBinaryExpression(l)&&l.operatorToken.kind===c.SyntaxKind.EqualsToken)if(je(l.left)){r(l.right);let i=l.right;(c.isObjectLiteralExpression(i)?i.properties.every(u=>c.isShorthandPropertyAssignment(u)&&n.has(u.name.text)||c.isPropertyAssignment(u)&&t(u.initializer)):t(i))||(s=!0)}else on(l.left)&&(t(l.right)||(s=!0));else(c.isCallExpression(l)&&it(l)&&l.arguments[0]!==void 0&&Wn(l.arguments[0])||c.isExportDeclaration(l)&&l.moduleSpecifier!==void 0)&&(s=!0);s||c.forEachChild(l,a)}};if(a(e),!s&&o.size>0){for(let l of fa(e))if(o.has(l)){s=!0;break}}return s}function Wn(e){return on(e)||c.isIdentifier(e)&&e.text==="exports"}function da(e){if(!c.isPropertyAccessExpression(e.expression)||!c.isIdentifier(e.expression.expression))return!1;let n=e.expression.expression.text,t=e.expression.name.text;return n==="Object"&&(t==="defineProperty"||t==="defineProperties")||n==="Reflect"&&(t==="defineProperty"||t==="set")}function Rr(e){return da(e)&&e.arguments[0]!==void 0&&Wn(e.arguments[0])}function Af(e){return da(e)&&e.arguments[0]!==void 0&&c.isIdentifier(e.arguments[0])&&e.arguments[0].text==="module"}function _f(e){for(let n of e.declarations??[])if(c.isExportSpecifier(n)){if(n.isTypeOnly)return!0;let t=n.parent.parent;if(c.isExportDeclaration(t)&&t.isTypeOnly)return!0}else if(c.isImportSpecifier(n)){if(n.isTypeOnly)return!0;let t=n.parent.parent;if(c.isImportClause(t)&&t.isTypeOnly)return!0}return!1}function Nf(e,n,t,o,r){let s=(e.declarations??[]).filter(l=>!c.isSourceFile(l)&&!c.isModuleDeclaration(l));for(let l of s){let i=l.getSourceFile(),d=n.toRel(i.fileName);if(d===null||r.has(d))continue;let u=t.get(`${d}::${String(l.getStart(i,!1))}`);if(u!==void 0)return u}let a=e.getName();for(let l of s){let i=n.toRel(l.getSourceFile().fileName);if(i===null||r.has(i))continue;let d=o.get(`${i}::${a}`);if(d!==void 0)return d}}function xo(e){return c.isPropertyAccessExpression(e)?e.name.text:c.isStringLiteralLike(e.argumentExpression)?e.argumentExpression.text:void 0}var Pr=/^[A-Za-z_$][A-Za-z0-9_$]*$/u;function $r(e){let n=c.isPropertyAccessExpression(e)||c.isElementAccessExpression(e)?xo(e):void 0;return n!==void 0&&n!=="__proto__"&&Pr.test(n)?n:void 0}function Rf(e){return e!=="__proto__"&&Pr.test(e)}function Zi(e){let n=_e(e);return c.isIdentifier(n)&&(n.text==="exports"||n.text==="module")||je(n)}function Pf(e){if(!c.isArrayLiteralExpression(e)&&!c.isObjectLiteralExpression(e))return!1;let n=!1,t=o=>{n||(on(o)?n=!0:c.forEachChild(o,t))};return t(e),n}function Or(e){let n=!1,t=new Map,o=r=>{if(!n){if(c.isBinaryExpression(r)&&r.operatorToken.kind>=c.SyntaxKind.FirstAssignment&&r.operatorToken.kind<=c.SyntaxKind.LastAssignment){if(je(r.left)||c.isIdentifier(r.left)&&r.left.text==="exports")n=!0;else if(r.operatorToken.kind===c.SyntaxKind.EqualsToken&&Zi(r.right))n=!0;else if(Pf(r.left))n=!0;else if(on(r.left)){let s=$r(r.left);s===void 0?n=!0:t.set(s,(t.get(s)??0)+1)}}else(c.isCallExpression(r)&&it(r)&&r.arguments[0]!==void 0&&Wn(r.arguments[0])||c.isCallExpression(r)&&Rr(r)||c.isCallExpression(r)&&Af(r)||c.isVariableDeclaration(r)&&r.initializer!==void 0&&Zi(r.initializer))&&(n=!0);n||c.forEachChild(r,o)}};return o(e),{surfaceEscapes:n,assignCount:t}}function Cr(e){let n=[];for(let t of e.statements){if(!c.isExpressionStatement(t)||!c.isBinaryExpression(t.expression))continue;let o=t.expression;o.operatorToken.kind===c.SyntaxKind.EqualsToken&&(!on(o.left)||je(o.left)||n.push({bin:o,name:$r(o.left)}))}return n}function $f(e){let{surfaceEscapes:n,assignCount:t}=Or(e);if(n)return[];let o=[];for(let{bin:r,name:s}of Cr(e))s===void 0||(t.get(s)??0)!==1||(c.isFunctionExpression(r.right)||c.isArrowFunction(r.right))&&o.push({name:s,value:r.right});return o}function Of(e,n){let{surfaceEscapes:t,assignCount:o}=Or(e);if(t)return[];let r=[];for(let{bin:s,name:a}of Cr(e))a===void 0||(o.get(a)??0)!==1||c.isIdentifier(s.right)&&!n.has(s.right.text)&&r.push(s.right.text);return r}function Cf(e,n){let{surfaceEscapes:t,assignCount:o}=Or(e);for(let{bin:r,name:s}of Cr(e)){let a=r.right;if(!(c.isFunctionExpression(a)||c.isArrowFunction(a)||c.isIdentifier(a)))continue;let i=c.isFunctionExpression(a)||c.isArrowFunction(a)||c.isIdentifier(a)&&!n.has(a.text);if(!(!t&&s!==void 0&&(o.get(s)??0)===1&&i))return!0}return!1}function Mf(e){let n=c.isPropertyAccessExpression(e)||c.isElementAccessExpression(e)?e.expression:void 0;return n!==void 0&&c.isIdentifier(n)&&n.text==="exports"?"exports":"module.exports"}function Qi(e){let n=e.parent;return n===void 0?!1:c.isPropertyAccessExpression(n)?n.name===e:c.isQualifiedName(n)?n.right===e:c.isBindingElement(n)||c.isImportSpecifier(n)?n.propertyName===e:c.isExportSpecifier(n)?!0:c.isPropertyAssignment(n)||c.isPropertyDeclaration(n)||c.isPropertySignature(n)||c.isMethodDeclaration(n)||c.isMethodSignature(n)||c.isGetAccessorDeclaration(n)||c.isSetAccessorDeclaration(n)||c.isEnumMember(n)?n.name===e:!1}function ea(e){for(let n=e.parent;n!==void 0;n=n.parent){if(c.isSourceFile(n))return!0;if(!c.isArrowFunction(n)&&(c.isFunctionLike(n)||c.isClassLike(n)))return!1}return!0}function Tf(e,n){let t=o=>{c.isIdentifier(o)&&(o.text==="exports"||o.text==="module")&&n.add(o),c.forEachChild(o,t)};t(e)}function Df(e){let n=[],t=new Set;for(let s of e.statements){if(c.isExportDeclaration(s)||c.isExportAssignment(s)||c.isImportDeclaration(s)||c.isImportEqualsDeclaration(s)||zn(s))return null;if(!c.isExpressionStatement(s)||!c.isBinaryExpression(s.expression))continue;let a=s.expression;if(a.operatorToken.kind===c.SyntaxKind.EqualsToken){if(je(a.left))n.push({kind:"whole",value:a.right});else if(on(a.left)){let l=$r(a.left);if(l===void 0)return null;n.push({kind:"member",name:l,value:a.right,root:Mf(a.left)})}else continue;Tf(a.left,t)}}let o=!1,r=s=>{if(!o){if(c.isIdentifier(s)&&(s.text==="exports"||s.text==="module")&&!t.has(s)&&!Qi(s)){o=!0;return}if(s.kind===c.SyntaxKind.ThisKeyword&&ea(s)){o=!0;return}if(c.isIdentifier(s)&&s.text==="arguments"&&!Qi(s)&&ea(s)){o=!0;return}c.forEachChild(s,r)}};return r(e),o?null:n}function _r(e){return c.isIdentifier(e)||c.isStringLiteralLike(e)?e.text:void 0}function na(e,n,t){return c.isIdentifier(e)?n(e.text):t?.(e)}function Lf(e,n,t,o){let r=new Map,s=Df(e);if(s===null||s.filter(m=>m.kind==="whole").length>1)return r;let a=s.findIndex(m=>m.kind==="whole"),l=(m,g)=>a>=0&&g>a&&m.kind==="member"&&m.root==="exports",i=s.some(l);if(i){let m=s[a];if(m===void 0||m.kind!=="whole"||!c.isObjectLiteralExpression(m.value))return r}let d=i?s.filter((m,g)=>!l(m,g)):s,u=new Map;for(let m of d)m.kind==="member"&&u.set(m.name,(u.get(m.name)??0)+1);let p=m=>n.has(m)?void 0:t(m),f=(m,g)=>{g===void 0?r.delete(m):r.set(m,g)};for(let m of d){if(m.kind==="member"){f(m.name,(u.get(m.name)??0)>1?void 0:na(m.value,p,o));continue}r.clear();let g=m.value;if(c.isObjectLiteralExpression(g))for(let y of g.properties){if(c.isSpreadAssignment(y))return new Map;if(c.isShorthandPropertyAssignment(y)){f(y.name.text,p(y.name.text));continue}let b=_r(y.name);if(b===void 0)return new Map;f(b,c.isPropertyAssignment(y)?na(y.initializer,p,o):void 0)}}return r}function ca(e,n,t,o){let r=new Map,s=l=>l!==void 0&&we(l)==="relative"?t.get(`${n}::${l}`):void 0,a=l=>{if(c.isVariableDeclaration(l)&&l.initializer!==void 0){let i=l.initializer;if(c.isIdentifier(l.name)&&!o.has(l.name.text)){let d=s(fn(i));if(d!==void 0)r.set(l.name.text,{kind:"whole",target:d});else if((c.isPropertyAccessExpression(i)||c.isElementAccessExpression(i))&&c.isCallExpression(i.expression)){let u=s(fn(i.expression)),p=xo(i);u!==void 0&&p!==void 0&&r.set(l.name.text,{kind:"member",target:u,member:p})}}else if(c.isObjectBindingPattern(l.name)){let d=s(fn(i));if(d!==void 0){for(let u of l.name.elements)if(c.isIdentifier(u.name)&&!o.has(u.name.text)){let p=u.propertyName!==void 0&&c.isIdentifier(u.propertyName)?u.propertyName.text:u.name.text;r.set(u.name.text,{kind:"member",target:d,member:p})}}}}c.forEachChild(l,a)};return a(e),r}function Ff(e,n,t,o){let r=a=>a!==void 0&&we(a)==="relative"?t.get(`${n}::${a}`):void 0,s=r(fn(e));if(s!==void 0)return{kind:"whole",target:s};if(c.isPropertyAccessExpression(e)||c.isElementAccessExpression(e)){let a=xo(e);if(a===void 0)return;let l=r(fn(e.expression));if(l!==void 0)return{kind:"member",target:l,member:a};if(c.isIdentifier(e.expression)){let i=o.get(e.expression.text);if(i?.kind==="whole")return{kind:"member",target:i.target,member:a}}return}if(c.isIdentifier(e))return o.get(e.text)}function ua(e,n,t,o,r){let s=[],a=!1,l=p=>{if(ia(p))return!0;let f=!1,m=g=>{f||(c.isIdentifier(g)&&r.has(g.text)?f=!0:c.forEachChild(g,m))};return m(p),f},i=(p,f)=>{let m=Ff(p,n,t,o);m!==void 0?s.push({source:m,exportedName:f}):l(p)&&(a=!0)},d=p=>{if(c.isObjectLiteralExpression(p)){for(let f of p.properties)if(c.isSpreadAssignment(f))i(f.expression,"default");else if(c.isPropertyAssignment(f)){let m=c.isIdentifier(f.name)||c.isStringLiteralLike(f.name)?f.name.text:"default";i(f.initializer,m)}else if(c.isShorthandPropertyAssignment(f)){let m=o.get(f.name.text);m!==void 0&&s.push({source:m,exportedName:f.name.text})}return}i(p,"default")},u=p=>{if(c.isBinaryExpression(p)&&p.operatorToken.kind>=c.SyntaxKind.FirstAssignment&&p.operatorToken.kind<=c.SyntaxKind.LastAssignment){if(je(p.left)){d(p.right);return}if(on(p.left)){let f=c.isPropertyAccessExpression(p.left)?p.left.name.text:c.isElementAccessExpression(p.left)&&c.isStringLiteralLike(p.left.argumentExpression)?p.left.argumentExpression.text:"default";i(p.right,f);return}}else if(c.isExportAssignment(p)&&p.isExportEquals){i(p.expression,"default");return}else if(c.isCallExpression(p)&&it(p)&&p.arguments[0]!==void 0&&Wn(p.arguments[0])){for(let f of p.arguments.slice(1))d(f);return}c.forEachChild(p,u)};return u(e),{sources:s,residual:a}}function fa(e){let n=new Set,t=r=>{let s=r;for(;c.isPropertyAccessExpression(s)||c.isElementAccessExpression(s);)s=s.expression;return c.isIdentifier(s)?s.text:void 0},o=r=>{let s=pa(r);if(s!==void 0){let a=t(s);a!==void 0&&n.add(a)}c.forEachChild(r,o)};return o(e),n}function pa(e){return c.isBinaryExpression(e)&&e.operatorToken.kind>=c.SyntaxKind.FirstAssignment&&e.operatorToken.kind<=c.SyntaxKind.LastAssignment&&(c.isPropertyAccessExpression(e.left)||c.isElementAccessExpression(e.left))?e.left:void 0}function go(e){if(c.isIdentifier(e))return[e.text];let n=[];for(let t of e.elements)c.isBindingElement(t)&&n.push(...go(t.name));return n}function Fe(e){if(c.isIdentifier(e))return[e.text];if(c.isParenthesizedExpression(e)||c.isAsExpression(e)||c.isNonNullExpression(e)||c.isSatisfiesExpression(e)||c.isTypeAssertionExpression(e)||c.isAwaitExpression(e))return Fe(e.expression);if(c.isYieldExpression(e))return e.expression!==void 0?Fe(e.expression):[];if(c.isBinaryExpression(e)){let n=e.operatorToken.kind;return n===c.SyntaxKind.BarBarToken||n===c.SyntaxKind.AmpersandAmpersandToken||n===c.SyntaxKind.QuestionQuestionToken?[...Fe(e.left),...Fe(e.right)]:n===c.SyntaxKind.CommaToken?Fe(e.right):[]}return c.isConditionalExpression(e)?[...Fe(e.whenTrue),...Fe(e.whenFalse)]:c.isArrayLiteralExpression(e)?e.elements.flatMap(n=>c.isSpreadElement(n)?Fe(n.expression):c.isOmittedExpression(n)?[]:Fe(n)):c.isObjectLiteralExpression(e)?e.properties.flatMap(n=>c.isShorthandPropertyAssignment(n)?[n.name.text]:c.isPropertyAssignment(n)?Fe(n.initializer):c.isSpreadAssignment(n)?Fe(n.expression):[]):[]}function ma(e,n){let t=[],o=(l,i)=>{for(let d of l)for(let u of i)d!==u&&t.push({a:d,b:u})},r=l=>c.isIdentifier(l)?[l.text]:c.isArrayLiteralExpression(l)?l.elements.flatMap(r):c.isObjectLiteralExpression(l)?l.properties.flatMap(i=>c.isShorthandPropertyAssignment(i)?[i.name.text]:c.isPropertyAssignment(i)?r(i.initializer):[]):[],s=l=>{c.isBinaryExpression(l)&&l.operatorToken.kind===c.SyntaxKind.EqualsToken?o(r(l.left),Fe(l.right)):c.isVariableDeclaration(l)&&l.initializer!==void 0?o(go(l.name),Fe(l.initializer)):(c.isForOfStatement(l)||c.isForInStatement(l))&&c.isVariableDeclarationList(l.initializer)&&l.initializer.declarations[0]!==void 0&&o(go(l.initializer.declarations[0].name),Fe(l.expression)),c.forEachChild(l,s)};s(e);let a=new Set(n);for(let l=!0;l;){l=!1;for(let{a:i,b:d}of t)a.has(i)&&!a.has(d)&&(a.add(d),l=!0),a.has(d)&&!a.has(i)&&(a.add(i),l=!0)}return a}function ha(e,n){let t=l=>{if(!c.isPropertyAccessExpression(l)&&!c.isElementAccessExpression(l))return;let i=l;for(;c.isPropertyAccessExpression(i)||c.isElementAccessExpression(i);)i=i.expression;return c.isIdentifier(i)?i.text:void 0},o=[],r=(l,i)=>{for(let u of Fe(i))o.push({name:l,root:u});let d=t(i);d!==void 0&&o.push({name:l,root:d})},s=l=>{c.isVariableDeclaration(l)&&c.isIdentifier(l.name)&&l.initializer!==void 0?r(l.name.text,l.initializer):c.isBinaryExpression(l)&&l.operatorToken.kind===c.SyntaxKind.EqualsToken&&c.isIdentifier(l.left)&&r(l.left.text,l.right),c.forEachChild(l,s)};s(e);let a=new Map(n);for(let l=!0;l;){l=!1;for(let{name:i,root:d}of o){let u=a.get(d);u!==void 0&&!a.has(i)&&(a.set(i,u),l=!0)}}return a}function ga(e){return ma(e,fa(e))}function jf(e,n){let t=i=>i>=c.SyntaxKind.FirstAssignment&&i<=c.SyntaxKind.LastAssignment,o=i=>{let d=i.parent;if(d===void 0||!c.isObjectLiteralExpression(d))return!1;let u=d.parent;return u!==void 0&&c.isBinaryExpression(u)&&u.operatorToken.kind===c.SyntaxKind.EqualsToken&&u.right===d&&on(u.left)?!0:u!==void 0&&c.isCallExpression(u)&&it(u)&&u.arguments[0]!==void 0&&Wn(u.arguments[0])&&u.arguments.indexOf(d)>0},r=(i,d)=>{if((c.isFunctionDeclaration(d)||c.isFunctionExpression(d))&&d.name===i||c.isVariableDeclaration(d)&&d.name===i||c.isParameter(d)&&d.name===i||c.isBindingElement(d)&&d.name===i||(c.isCallExpression(d)||c.isNewExpression(d))&&d.expression===i)return!0;if((c.isPropertyAccessExpression(d)||c.isElementAccessExpression(d))&&d.expression===i){let u=d;for(;u.parent!==void 0&&(c.isPropertyAccessExpression(u.parent)||c.isElementAccessExpression(u.parent))&&u.parent.expression===u;)u=u.parent;let p=u.parent;return!(p!==void 0&&c.isBinaryExpression(p)&&t(p.operatorToken.kind)&&p.left===u)}return c.isBinaryExpression(d)&&d.operatorToken.kind===c.SyntaxKind.EqualsToken&&d.right===i&&on(d.left)?!0:c.isShorthandPropertyAssignment(d)&&d.name===i||c.isPropertyAssignment(d)&&d.initializer===i?o(d):!!(c.isExportAssignment(d)&&d.expression===i||c.isExportSpecifier(d))},s=(i,d)=>c.isPropertyAccessExpression(d)&&d.name===i||c.isPropertyAssignment(d)&&d.name===i||(c.isMethodDeclaration(d)||c.isGetAccessorDeclaration(d)||c.isSetAccessorDeclaration(d))&&d.name===i,a=!1,l=(i,d)=>{if(!a){if(c.isIdentifier(i)&&d!==void 0&&n.has(i.text)&&!s(i,d)&&!r(i,d)){a=!0;return}c.forEachChild(i,u=>l(u,i))}};return l(e,void 0),a}function Bf(e){let n=new Set;for(let i of e.statements)if(c.isFunctionDeclaration(i)&&i.name!==void 0)n.add(i.name.text);else if(c.isVariableStatement(i))for(let d of i.declarationList.declarations)c.isIdentifier(d.name)&&d.initializer!==void 0&&(c.isFunctionExpression(d.initializer)||c.isArrowFunction(d.initializer))&&n.add(d.name.text);let t=new Set,o=i=>{c.isBinaryExpression(i)&&i.operatorToken.kind===c.SyntaxKind.EqualsToken?(je(i.left)&&(c.isIdentifier(i.right)?t.add(i.right.text):c.isObjectLiteralExpression(i.right)&&la(i.right,t)),je(i.right)&&c.isIdentifier(i.left)&&t.add(i.left.text)):c.isVariableDeclaration(i)&&c.isIdentifier(i.name)&&i.initializer!==void 0&&je(i.initializer)&&t.add(i.name.text),c.forEachChild(i,o)};if(o(e),t.size>0){if(jf(e,t))return!0;let i=ha(e,new Map([...t].map(u=>[u,u]))),d=ga(e);for(let u of i.keys())if(d.has(u))return!0}let r=i=>c.isIdentifier(i)&&n.has(i.text),s=i=>i.properties.every(d=>c.isShorthandPropertyAssignment(d)&&n.has(d.name.text)||c.isPropertyAssignment(d)&&r(d.initializer)),a=!1,l=i=>{if(!a){if(c.isBinaryExpression(i)){let d=i.operatorToken.kind>=c.SyntaxKind.FirstAssignment&&i.operatorToken.kind<=c.SyntaxKind.LastAssignment;d&&je(i.left)?i.operatorToken.kind===c.SyntaxKind.EqualsToken&&(r(i.right)||c.isObjectLiteralExpression(i.right)&&s(i.right))||(a=!0):d&&on(i.left)&&(a=!0)}else c.isCallExpression(i)?(it(i)&&i.arguments[0]!==void 0&&Wn(i.arguments[0])||Rr(i))&&(a=!0):(c.isExportAssignment(i)&&i.isExportEquals&&!c.isIdentifier(i.expression)||c.isExportDeclaration(i)&&i.moduleSpecifier!==void 0)&&(a=!0);a||c.forEachChild(i,l)}};return l(e),a}var Kf=8;function ta(e,n,t){let o=new Set,r=ca(e,n,t,rt(e)),s=ua(e,n,t,r,aa(e));for(let{source:a}of s.sources)o.add(a.target);for(let a of e.statements)if(c.isExportDeclaration(a)&&a.moduleSpecifier!==void 0&&c.isStringLiteralLike(a.moduleSpecifier)&&we(a.moduleSpecifier.text)==="relative"){let l=t.get(`${n}::${a.moduleSpecifier.text}`);l!==void 0&&o.add(l)}return o}function Uf(e,n,t,o=new Map){let r=new Set(n.modules.filter(k=>k.isEntrypoint).map(k=>String(k.id)));if(r.size===0)return{exports:[],exportBindings:[],diagnostics:[]};let s=new Set(n.modules.filter(k=>k.externalSurface===!0).map(k=>String(k.id))),a=new Map,l=new Map,i=new Map,d=new Map;for(let k of t){if(k.name==="<toplevel>"){d.set(String(k.moduleId),k);continue}if(a.set(`${String(k.moduleId)}::${String(k.declRange.start)}`,k),k.name!==void 0&&l.set(`${String(k.moduleId)}::${k.name}`,k),k.isExported&&k.name!==void 0){let h=i.get(String(k.moduleId))??[];h.push(k),i.set(String(k.moduleId),h)}}if(o.size>0){let k=new Map(t.map(h=>[String(h.id),h]));for(let[h,S]of o){let _=k.get(String(S));_!==void 0&&!a.has(h)&&a.set(h,_)}}let u=new Map;for(let k of n.imports)k.resolvedModuleId!==void 0&&u.set(`${k.moduleId}::${k.specifier}`,String(k.resolvedModuleId));let p=new Map;for(let k of e.sourceFiles){let h=e.toRel(k.fileName);h!==null&&p.set(h,k)}let f=new Map,m=k=>{let h=f.get(k);if(h!==void 0)return h;let S=p.get(k),_=S===void 0?!0:Bf(S);return f.set(k,_),_},g=new Set,y=(k,h)=>h!==void 0&&we(h)==="relative"?u.get(`${k}::${h}`):void 0,b=k=>{if(c.isIdentifier(k))return k.text;if(c.isPropertyAccessExpression(k)){let h=b(k.expression);return h===void 0?void 0:`${h}.${k.name.text}`}if(c.isElementAccessExpression(k)&&c.isStringLiteralLike(k.argumentExpression)){let h=b(k.expression);return h===void 0?void 0:`${h}.${k.argumentExpression.text}`}},x=k=>{let h=k;for(;c.isPropertyAccessExpression(h)||c.isElementAccessExpression(h);)h=h.expression;return fn(h)};for(let k of e.sourceFiles){let h=e.toRel(k.fileName);if(h===null)continue;let S=new Map,_=new Map,P=(N,j)=>{let O=y(h,fn(j));if(O!==void 0){if(c.isIdentifier(N))_.set(N.text,O),S.set(N.text,O);else if(c.isObjectBindingPattern(N)||c.isArrayBindingPattern(N))for(let F of go(N))_.set(F,O);else if(c.isPropertyAccessExpression(N)||c.isElementAccessExpression(N)){let F=b(N);F!==void 0&&S.set(F,O)}}},v=N=>{c.isVariableDeclaration(N)&&N.initializer!==void 0?P(N.name,N.initializer):c.isBinaryExpression(N)&&N.operatorToken.kind===c.SyntaxKind.EqualsToken&&P(N.left,N.right),c.forEachChild(N,v)};v(k);let T=N=>{let j=pa(N);if(j!==void 0){let O=j.expression,F=y(h,x(O));F!==void 0&&g.add(F);let K=b(O),te=K!==void 0?S.get(K):void 0;te!==void 0&&g.add(te)}c.forEachChild(N,T)};if(T(k),_.size>0){let N=ha(k,_),j=ga(k);for(let[O,F]of N)j.has(O)&&g.add(F)}}let I=[],w=[],A=[];for(let k of e.sourceFiles){let h=e.toRel(k.fileName);if(h===null||!r.has(h))continue;let S=e.checker.getSymbolAtLocation(k),_=new Set,P=new Set,v=0,T=(D,C)=>{if(s.has(String(D.moduleId))||_.has(String(D.id)))return;_.add(String(D.id));let H=`${h}#reexport:${String(v)}:${C}`;v+=1,I.push({id:H,moduleId:h,exportedName:C,kind:"value",reexportOf:{moduleId:String(D.moduleId),name:D.name??C}}),w.push({exportId:H,target:{kind:"function",functionId:D.id}})},N=D=>{if(_f(D))return;let C=D;if((D.flags&c.SymbolFlags.Alias)!==0)try{C=e.checker.getAliasedSymbol(D)}catch{return}let H=Nf(C,e,a,l,s);if(H!==void 0){T(H,D.getName());return}if((C.flags&c.SymbolFlags.Module)!==0&&!P.has(C)){P.add(C);try{for(let J of e.checker.getExportsOfModule(C))N(J)}catch{}}};if(S!==void 0)for(let D of e.checker.getExportsOfModule(S))N(D);let j=ca(k,h,u,rt(k)),O=ua(k,h,u,j,aa(k)),F=new Set,K=O.residual,te=D=>{let C=p.get(D);D.includes("node_modules/")||C===void 0||If(C)?K=!0:F.add(D)};for(let{source:D,exportedName:C}of O.sources){let H=i.get(D.target)??[],J=g.has(D.target);if(D.kind==="whole"){for(let G of H)T(G,G.name??C);J?K=!0:(H.length===0||m(D.target))&&te(D.target)}else{let G=H.filter(Y=>Y.name===D.member);for(let Y of G)T(Y,C);J?K=!0:(G.length===0||m(D.target))&&te(D.target)}}let U=new Set,X=[];for(let D of ta(k,h,u))X.push({target:D,depth:1});for(;X.length>0;){let D=X.shift();if(D===void 0)break;let{target:C,depth:H}=D;if(U.has(C)||H>Kf||(U.add(C),C.split("/").includes("node_modules")))continue;let J=p.get(C);if(J===void 0)continue;let G=d.get(C);G!==void 0&&!m(C)&&T(G,"<load>");for(let Y of ta(J,C,u))U.has(Y)||X.push({target:Y,depth:H+1})}Cf(k,rt(k))&&(K=!0);for(let D of F)A.push({code:"unresolved-reexport",path:h,detail:`entrypoint whole/member re-exports app-owned relative module ${D} whose exact entry surface could not be lifted; capping at unknown, corridor-scoped to that module (ADR-024, ROADMAP R3.3)`,anchor:D});K&&A.push({code:"unresolved-reexport",path:h,detail:"entrypoint has a CJS re-export the analyzer cannot pin to concrete relative functions (computed/dynamic/package-subpath/tainted, or an externally-mutated barrel); capping at unknown, globally (ADR-024, ROADMAP CJS.5)"})}return{exports:I,exportBindings:w,diagnostics:A}}var st=new Set(["valueOf","toString","toJSON","then","catch","finally","next","return","throw"]),zf=new Set(["defineProperty","defineProperties","create"]);function Wf(e){let n=!0,t=r=>c.isIdentifier(r)||c.isStringLiteral(r)||c.isNumericLiteral(r)?st.has(r.text):c.isComputedPropertyName(r)&&c.isStringLiteralLike(r.expression)?st.has(r.expression.text):!1,o=r=>{if(n){if(c.isNewExpression(r)||c.isForOfStatement(r)||c.isSpreadElement(r)||c.isSpreadAssignment(r)||c.isArrayBindingPattern(r)||c.isGetAccessorDeclaration(r)||c.isSetAccessorDeclaration(r)||c.isYieldExpression(r)&&r.asteriskToken!==void 0||c.canHaveDecorators(r)&&(c.getDecorators(r)?.length??0)>0){n=!1;return}if((c.isPropertyAccessExpression(r)||c.isMethodDeclaration(r)||c.isPropertyAssignment(r))&&t(r.name)||c.isPropertyDeclaration(r)&&t(r.name)||c.isShorthandPropertyAssignment(r)&&t(r.name)||c.isBindingElement(r)&&t(r.propertyName??r.name)||c.isElementAccessExpression(r)&&c.isStringLiteralLike(r.argumentExpression)&&st.has(r.argumentExpression.text)){n=!1;return}if(c.isCallExpression(r)&&c.isPropertyAccessExpression(r.expression)&&c.isIdentifier(r.expression.expression)&&r.expression.expression.text==="Object"&&zf.has(r.expression.name.text)){n=!1;return}c.forEachChild(r,o)}};return o(e),n}function So(e){if(c.isIdentifier(e)||c.isStringLiteral(e)||c.isNumericLiteral(e))return e.text}function ya(e){let n=t=>c.canHaveDecorators(t)&&(c.getDecorators(t)?.length??0)>0;return n(e)||e.members.some(n)}function Vf(e){let n=!1,t=new Set,o=[],r=new Map,s=(f,m)=>{let g=r.get(f);g===void 0?r.set(f,[m]):g.push(m)},a=f=>{c.isIdentifier(f)?t.add(f.text):o.push(f)},l=f=>{for(let m of f.properties)c.isShorthandPropertyAssignment(m)?t.add(m.name.text):c.isPropertyAssignment(m)?o.push(m.initializer):n=!0},i=f=>{if(c.isBinaryExpression(f)&&f.operatorToken.kind===c.SyntaxKind.EqualsToken){let m=f.left,g=f.right;je(m)?c.isObjectLiteralExpression(g)?l(g):c.isIdentifier(g)||c.isFunctionExpression(g)||c.isArrowFunction(g)||c.isClassExpression(g)?a(g):n=!0:on(m)?(c.isElementAccessExpression(m)&&!c.isStringLiteralLike(m.argumentExpression)&&(n=!0),a(g)):c.isIdentifier(m)?s(m.text,g):(c.isPropertyAccessExpression(m)||c.isElementAccessExpression(m))&&c.isIdentifier(m.expression)&&s(m.expression.text,g)}else if(c.isCallExpression(f))(it(f)&&f.arguments[0]!==void 0&&Wn(f.arguments[0])||Rr(f))&&(n=!0);else if(c.isVariableDeclaration(f)&&c.isIdentifier(f.name)&&f.initializer!==void 0)s(f.name.text,f.initializer);else if((c.isFunctionDeclaration(f)||c.isClassDeclaration(f))&&f.name!==void 0)s(f.name.text,f),zn(f)&&t.add(f.name.text);else if(c.isExportDeclaration(f)){if(f.exportClause===void 0)n=!0;else if(f.moduleSpecifier===void 0&&c.isNamedExports(f.exportClause))for(let m of f.exportClause.elements)t.add((m.propertyName??m.name).text)}else if(c.isExportAssignment(f))f.isExportEquals&&!c.isIdentifier(f.expression)?n=!0:a(f.expression);else if(c.isVariableStatement(f)&&zn(f))for(let m of f.declarationList.declarations)c.isIdentifier(m.name)&&t.add(m.name.text);c.forEachChild(f,i)};i(e);let d=new Set,u=[...t],p=f=>{let m=g=>{c.isIdentifier(g)&&u.push(g.text),c.forEachChild(g,m)};m(f)};for(let f of o)p(f);for(;u.length>0;){let f=u.pop();if(!(f===void 0||d.has(f))){d.add(f);for(let m of r.get(f)??[])p(m)}}return{names:d,opaque:n}}var qf=512,Gf=new Set(["get","post","put","patch","delete","options","head"]);function Hf(e){for(let n of e.statements){if(c.isExportAssignment(n)&&n.isExportEquals!==!0)return n.expression;if(c.isExpressionStatement(n)&&c.isBinaryExpression(n.expression)&&n.expression.operatorToken.kind===c.SyntaxKind.EqualsToken&&c.isPropertyAccessExpression(n.expression.left)&&c.isIdentifier(n.expression.left.expression)){let t=n.expression.left.expression.text,o=n.expression.left.name.text;if(t==="module"&&o==="exports"||t==="exports"&&o==="default")return n.expression.right}}return null}function Xf(e){let n=new Map,t=Hf(e);if(t===null)return n;let o=s=>{for(let a of s.properties)if(c.isPropertyAssignment(a)&&c.isObjectLiteralExpression(a.initializer)){let l=So(a.name);l!==void 0&&n.set(l,a.initializer)}};if(c.isObjectLiteralExpression(t))return o(t),n;if(!c.isIdentifier(t))return n;let r=t.text;for(let s of e.statements)if(c.isVariableStatement(s))for(let a of s.declarationList.declarations)c.isIdentifier(a.name)&&a.name.text===r&&a.initializer!==void 0&&c.isObjectLiteralExpression(a.initializer)&&o(a.initializer);else if(c.isExpressionStatement(s)&&c.isBinaryExpression(s.expression)&&s.expression.operatorToken.kind===c.SyntaxKind.EqualsToken&&c.isPropertyAccessExpression(s.expression.left)&&c.isIdentifier(s.expression.left.expression)&&s.expression.left.expression.text===r&&c.isObjectLiteralExpression(s.expression.right)){let a=s.expression.left.name.text;n.set(a,s.expression.right)}return n}function Yf(e){for(let n of e.properties){if(c.isMethodDeclaration(n)&&c.isIdentifier(n.name)&&n.name.text==="handler")return n;if(c.isPropertyAssignment(n)&&c.isIdentifier(n.name)&&n.name.text==="handler"&&(c.isArrowFunction(n.initializer)||c.isFunctionExpression(n.initializer)))return n.initializer}return null}function Jf(e,n){for(let o of e.properties){let r;if(c.isPropertyAssignment(o)||c.isMethodDeclaration(o)?r=So(o.name):c.isShorthandPropertyAssignment(o)&&(r=o.name.text),r==="method"||r==="url"||r==="middlewares")return!0}let t=n.parameters.length;return t>=2&&t<=3}function Zf(e,n){let t=[],o=new Set,r=(l,i,d)=>{if(t.length>=qf||l==="__proto__"||!Pr.test(l))return;let u=`${e}#handler:${l}`;o.has(u)||(o.add(u),t.push({id:u,node:i,memberPath:l,idiom:d}))};for(let[l,i]of Xf(n)){let d=Yf(i);d!==null&&Jf(i,d)&&r(l,d,"descriptor-object")}let s=0,a=l=>{if(c.isCallExpression(l)&&c.isPropertyAccessExpression(l.expression)&&c.isIdentifier(l.expression.expression)&&Gf.has(l.expression.name.text)&&l.arguments.length>=2&&l.arguments[0]!==void 0&&c.isStringLiteralLike(l.arguments[0])){let i=l.expression.name.text;for(let d=1;d<l.arguments.length;d+=1){let u=l.arguments[d];u!==void 0&&(c.isArrowFunction(u)||c.isFunctionExpression(u))&&r(`${i}_${String(s)}_${String(d)}`,u,"router-verb")}s+=1}c.forEachChild(l,a)};return a(n),t}function Qf(e,n,t,o,r,s){let a=`${e}#class:${t}`,l=[],i=new Set;for(let d of o.members){let u,p,f;if(c.isConstructorDeclaration(d))u="constructor",p="ctor",f=!1;else if(c.isMethodDeclaration(d))u=So(d.name),p="method",f=u!==void 0&&!st.has(u);else continue;if(u===void 0||i.has(u))continue;i.add(u);let m=`${e}#${t}.${u}`;r.push({id:m,moduleId:e,name:u,kind:p,enclosingClassId:a,declRange:Nn(e,d,n),isExported:!1,publicSurfaceReachable:!1}),l.push(m),f&&s.push({start:d.getStart(n,!1),end:d.getEnd(),id:m})}return{id:a,moduleId:e,name:t,implementsRefs:[],members:l}}function ep(e,n,t=[],o=!1,r){let s=[],a=new Map,l=[],{reachableLocals:i,defaultTarget:d}=wf(n),u=rt(n),p=`${e}#<toplevel>`;s.push({id:p,moduleId:e,name:"<toplevel>",kind:"function",declRange:{path:e,start:0,end:n.getEnd()},isExported:!1,publicSurfaceReachable:!1});let f=(h,S)=>{let _=`${e}#${h}`;return s.push({id:_,moduleId:e,name:h,kind:"function",declRange:Nn(e,S,n),isExported:i.has(h),publicSurfaceReachable:i.has(h)}),a.set(h,{kind:"function",functionId:_}),l.push({start:S.getStart(n,!1),end:S.getEnd(),id:_}),_},m=[],g=!e.split("/").includes("node_modules");if(g)for(let h of Of(n,u))i.add(h);let y=g?Vf(n):void 0,b=(h,S,_)=>{y===void 0||y.opaque||y.names.has(h)||zn(_)||ya(S)||m.push(Qf(e,n,h,S,s,l))};for(let h of n.statements)if(c.isFunctionDeclaration(h)&&h.name!==void 0)f(h.name.text,h);else if(c.isClassDeclaration(h)&&h.name!==void 0)b(h.name.text,h,h);else if(c.isVariableStatement(h))for(let S of h.declarationList.declarations){if(c.isObjectBindingPattern(S.name)&&S.initializer!==void 0&&c.isCallExpression(S.initializer)&&c.isIdentifier(S.initializer.expression)&&S.initializer.expression.text==="require"&&S.initializer.arguments.length===1&&S.initializer.arguments[0]!==void 0&&c.isStringLiteralLike(S.initializer.arguments[0])){let P=S.initializer.arguments[0].text;for(let v of S.name.elements){if(v.dotDotDotToken!==void 0||v.initializer!==void 0||!c.isIdentifier(v.name))continue;let T=v.propertyName??v.name;!c.isIdentifier(T)&&!c.isStringLiteralLike(T)||a.set(v.name.text,{kind:"import",specifier:P,form:{named:T.text}})}continue}if(!c.isIdentifier(S.name)||S.initializer===void 0)continue;let _=S.initializer;if(c.isFunctionExpression(_)||c.isArrowFunction(_))f(S.name.text,S);else if(c.isClassExpression(_))b(S.name.text,_,h);else if(c.isCallExpression(_)&&c.isIdentifier(_.expression)&&_.expression.text==="require"&&_.arguments.length===1&&_.arguments[0]!==void 0&&c.isStringLiteralLike(_.arguments[0]))a.set(S.name.text,{kind:"import",specifier:_.arguments[0].text,form:"whole"});else if((c.isPropertyAccessExpression(_)||c.isElementAccessExpression(_))&&xo(_)==="default"&&c.isCallExpression(_.expression)){let P=fn(_.expression);P!==void 0&&a.set(S.name.text,{kind:"import",specifier:P,form:"require-default"})}}else if(c.isImportDeclaration(h)&&c.isStringLiteralLike(h.moduleSpecifier)){let S=h.moduleSpecifier.text,_=h.importClause;if(_!==void 0){_.name!==void 0&&a.set(_.name.text,{kind:"import",specifier:S,form:"default"});let P=_.namedBindings;if(P!==void 0&&c.isNamespaceImport(P))a.set(P.name.text,{kind:"import",specifier:S,form:"namespace"});else if(P!==void 0&&c.isNamedImports(P))for(let v of P.elements){let T=(v.propertyName??v.name).text;a.set(v.name.text,{kind:"import",specifier:S,form:{named:T}})}}}else c.isImportEqualsDeclaration(h)&&c.isExternalModuleReference(h.moduleReference)&&c.isStringLiteralLike(h.moduleReference.expression)&&a.set(h.name.text,{kind:"import",specifier:h.moduleReference.expression.text,form:"whole"});let x=new Map,I,w=new Map,A=new Map;if(g)for(let{name:h,value:S}of $f(n)){let _=`${e}#member-export:${h}`;s.push({id:_,moduleId:e,name:h,kind:c.isArrowFunction(S)?"arrow":"function",declRange:Nn(e,S,n),isExported:!0,publicSurfaceReachable:!0}),l.push({start:S.getStart(n,!1),end:S.getEnd(),id:_}),x.set(S.getStart(n,!1),_)}if(o&&g){let h=T=>{let N=Ue(T);return c.isFunctionExpression(N)||c.isArrowFunction(N)?N:void 0},S=(T,N)=>{let j=T;return s.push({id:j,moduleId:e,kind:c.isArrowFunction(N)?"arrow":"function",declRange:Nn(e,N,n),isExported:!0,publicSurfaceReachable:!0}),l.push({start:N.getStart(n,!1),end:N.getEnd(),id:j}),x.set(N.getStart(n,!1),j),j},_=[],P=[],v=[];for(let T of n.statements)c.isExportAssignment(T)&&!T.isExportEquals?_.push(T):c.isFunctionDeclaration(T)&&c.getModifiers(T)?.some(N=>N.kind===c.SyntaxKind.DefaultKeyword)===!0?P.push(T):c.isExpressionStatement(T)&&c.isBinaryExpression(T.expression)&&T.expression.operatorToken.kind===c.SyntaxKind.EqualsToken&&je(T.expression.left)&&v.push(T.expression);if(_.length+P.length+v.length===1){let T=_[0],N=P[0],j=v[0];if(T!==void 0){let O=h(T.expression);if(O!==void 0){let F=S(`${e}#<default>`,O);I={id:F,esm:!0},A.set(T.getStart(n,!1),F),he(r,"2a-default",null)}}else if(N!==void 0&&N.name===void 0&&N.body!==void 0){let O=S(`${e}#<default>`,N);I={id:O,esm:!0},A.set(N.getStart(n,!1),O),he(r,"2a-default",null)}else if(j!==void 0){let O=h(j.right);if(O!==void 0){let F=S(`${e}#<default>`,O);I={id:F,esm:!1},A.set(j.getStart(n,!1),F),he(r,"2a-default",null)}else if(c.isObjectLiteralExpression(j.right)){let F=j.right,K=[],te=!0;for(let U of F.properties){if(c.isSpreadAssignment(U)){te=!1;break}let X=U.name,D=X===void 0?void 0:_r(X);if(D===void 0){te=!1;break}K.push(D)}if(te){let U=new Map;for(let X of K)U.set(X,(U.get(X)??0)+1);for(let X of F.properties){if(!c.isPropertyAssignment(X))continue;let D=_r(X.name),C=h(X.initializer);if(D!==void 0){if(!Rf(D)){C!==void 0&&he(r,"2a-member","charset-refused");continue}if((U.get(D)??0)!==1){C!==void 0&&he(r,"2a-member","duplicate-key");continue}if(C!==void 0){let H=S(`${e}#<cjs>.${D}`,C);w.set(D,H),A.set(X.getStart(n,!1),H),he(r,"2a-member",null)}}}}else for(let U of F.properties)c.isPropertyAssignment(U)&&h(U.initializer)!==void 0&&he(r,"2a-member","spread-or-computed-literal")}}}else{for(let T of _)h(T.expression)!==void 0&&he(r,"2a-default","duplicate-default-sources");for(let T of P)T.name===void 0&&he(r,"2a-default","duplicate-default-sources");for(let T of v)if(h(T.right)!==void 0)he(r,"2a-default","duplicate-default-sources");else if(c.isObjectLiteralExpression(T.right))for(let N of T.right.properties)c.isPropertyAssignment(N)&&h(N.initializer)!==void 0&&he(r,"2a-member","duplicate-default-sources")}}for(let h of t)s.push({id:h.id,moduleId:e,name:`handler:${h.memberPath}`,kind:c.isArrowFunction(h.node)?"arrow":"function",declRange:Nn(e,h.node,n),isExported:!1,publicSurfaceReachable:!1}),l.push({start:h.node.getStart(n,!1),end:h.node.getEnd(),id:h.id});l.sort((h,S)=>h.end-h.start-(S.end-S.start));let k=d!==void 0?`${e}#${d}`:void 0;return{rel:e,sf:n,functions:s,bindings:a,exportedFunctionId:k,exportedNames:i,tainted:u,fnRanges:l,toplevelId:p,classes:m,mintedByPos:x,mintedDefault:I,mintedMembers:w,mintSeedAliases:A}}function np(e){return c.isIdentifier(e)?"identifier":c.isPropertyAccessExpression(e)?"member":c.isElementAccessExpression(e)?"computed-member":e.kind===c.SyntaxKind.ImportKeyword?"dynamic-import":"unknown"}function oa(e,n){let t=o=>{if(c.isBinaryExpression(o)&&o.operatorToken.kind>=c.SyntaxKind.FirstAssignment&&o.operatorToken.kind<=c.SyntaxKind.LastAssignment){let r=o.left;c.isPropertyAccessExpression(r)&&c.isIdentifier(r.expression)?n(r.expression.text,r.name.text):c.isElementAccessExpression(r)&&c.isIdentifier(r.expression)&&n(r.expression.text,c.isStringLiteralLike(r.argumentExpression)?r.argumentExpression.text:null)}else if(c.isCallExpression(o)&&c.isPropertyAccessExpression(o.expression)){let r=o.expression,s=o.arguments[0];c.isIdentifier(r.expression)&&s!==void 0&&c.isIdentifier(s)&&(r.expression.text==="Object"&&(r.name.text==="assign"||r.name.text==="defineProperty"||r.name.text==="defineProperties")||r.expression.text==="Reflect"&&r.name.text==="defineProperty")&&n(s.text,null)}c.forEachChild(o,t)};t(e)}function tp(e){let n=!1,t=o=>{if(!n){if(c.isVariableDeclaration(o)||c.isParameter(o)){let r=new Set;if(wt(o.name,r),r.has("require")){n=!0;return}}else if((c.isFunctionDeclaration(o)||c.isClassDeclaration(o))&&o.name!==void 0&&o.name.text==="require"){n=!0;return}c.forEachChild(o,t)}};return t(e),n}function op(e,n,t,o=new Map,r={}){let s=r.additiveForms===!0,a=r.namelessExports===!0,l=s||a?{}:void 0,i=new Map,d=new Map;for(let h of n.imports)h.resolvedModuleId!==void 0&&d.set(`${h.moduleId}::${h.specifier}`,h.resolvedModuleId);for(let h of e.sourceFiles){let S=e.toRel(h.fileName);S!==null&&i.set(S,ep(S,h,o.get(S)??[],a,l))}let u=new Map;if(s)for(let h of i.values()){let S=new Map;for(let[_,P]of h.bindings)if(P.kind==="import"&&P.form==="whole"&&we(P.specifier)!=="package-root"){let v=d.get(`${h.rel}::${P.specifier}`);v!==void 0&&S.set(_,String(v))}S.size!==0&&oa(h.sf,(_,P)=>{let v=S.get(_);if(v===void 0)return;let T=u.get(v);if(T!=="*"){if(P===null){u.set(v,"*");return}T===void 0?u.set(v,new Set([P])):T.add(P)}})}let p=new Map;for(let h of i.values())h.exportedFunctionId!==void 0&&p.set(h.rel,h.exportedFunctionId);let f=new Map;for(let h of i.values()){if(h.rel.split("/").includes("node_modules"))continue;let S=vf(h.sf);if(S===void 0){a&&h.mintedDefault!==void 0&&f.set(h.rel,h.mintedDefault);continue}let _=h.bindings.get(S.name);_?.kind==="function"&&f.set(h.rel,{id:_.functionId,esm:S.esm})}let m=new Map;for(let h of i.values()){let S;for(let _ of h.exportedNames){let P=h.bindings.get(_);P?.kind==="function"&&(S??=new Map,S.set(_,P.functionId))}S!==void 0&&m.set(h.rel,S)}let g=new Map;for(let h of i.values()){if(h.rel.split("/").includes("node_modules"))continue;let S=Lf(h.sf,h.tainted,_=>{let P=h.bindings.get(_);return P?.kind==="function"?P.functionId:void 0},a?_=>{let P=Ue(_);return c.isFunctionExpression(P)||c.isArrowFunction(P)?h.mintedByPos.get(P.getStart(h.sf,!1)):void 0}:void 0);S.size>0&&g.set(h.rel,S)}let y=[],b=[],x=[],I=[],w=[],A=[];for(let h of i.values()){y.push(...h.functions),A.push(...h.classes);for(let R of h.exportedNames){let M=h.bindings.get(R);if(M?.kind==="function"){let B=`${h.rel}#export:${R}`;I.push({id:B,moduleId:h.rel,exportedName:R,kind:"value"}),w.push({exportId:B,target:{kind:"function",functionId:M.functionId}})}}if(a){if(h.mintedDefault!==void 0){let R=`${h.rel}#export:<default>`;I.push({id:R,moduleId:h.rel,exportedName:"default",kind:"value"}),w.push({exportId:R,target:{kind:"function",functionId:h.mintedDefault.id}})}for(let[R,M]of h.mintedMembers){let B=`${h.rel}#export:<cjs>.${R}`;I.push({id:B,moduleId:h.rel,exportedName:R,kind:"value"}),w.push({exportId:B,target:{kind:"function",functionId:M}})}}let S=new Map;for(let[R,M]of h.bindings){if(M.kind==="function"){S.set(R,M);continue}if(we(M.specifier)==="package-root"){let q=Ge(M.specifier);typeof M.form=="object"?S.set(R,{kind:"package-export",packageName:q,exportName:M.form.named}):M.form==="require-default"?S.set(R,{kind:"package-default",packageName:q}):S.set(R,{kind:"package-surface",packageName:q})}else{let q=d.get(`${h.rel}::${M.specifier}`);if(q!==void 0&&typeof M.form=="object"){let le=m.get(String(q))?.get(M.form.named);le!==void 0&&S.set(R,{kind:"app-named-fn",functionId:le})}else if(q!==void 0&&M.form==="require-default"){let le=f.get(String(q));le!==void 0&&le.esm&&S.set(R,{kind:"app-default-fn",functionId:le.id})}else q!==void 0&&typeof M.form!="object"&&M.form!=="require-default"&&S.set(R,{kind:"module",resolvedModuleId:q})}}let _=new Map;for(let R of h.functions){if(R.enclosingClassId===void 0||R.name===void 0)continue;let M=_.get(R.enclosingClassId);M===void 0&&(M=new Map,_.set(R.enclosingClassId,M)),M.set(R.name,R.id)}for(let R of h.classes)R.name===void 0||h.tainted.has(R.name)||S.has(R.name)||S.set(R.name,{kind:"app-class",cls:{classId:R.id,className:R.name,memberIds:_.get(R.id)??new Map}});let P=R=>{if(c.isVariableDeclaration(R)&&c.isIdentifier(R.name)&&R.initializer!==void 0&&c.isNewExpression(R.initializer)&&!h.tainted.has(R.name.text)&&!S.has(R.name.text)){let M=Ji(R.initializer,S,h.tainted);M!==null&&S.set(R.name.text,M)}c.forEachChild(R,P)};P(h.sf);let v=R=>{for(let M of h.fnRanges)if(R>=M.start&&R<M.end)return M.id;return h.toplevelId},T=new Map,N=new Map,j=new Map,O=(R,M,B)=>{if(B===null){R.set(M,"*");return}let q=R.get(M);q!=="*"&&(q===void 0?R.set(M,new Set([B])):q.add(B))},F=(R,M)=>{O(T,R,M);let B=S.get(R);B?.kind==="package-surface"?O(N,B.packageName,M):B?.kind==="module"&&O(j,String(B.resolvedModuleId),M)};oa(h.sf,F);let K=new Map,te=256,U=R=>{let M=K.get(R);return M===void 0&&(M=K.size>=te?new Set([R]):ma(h.sf,new Set([R])),K.set(R,M)),M},X=(R,M)=>R==="*"||R!==void 0&&R.has(M),D=(R,M)=>{let B=S.get(R);if(B?.kind==="package-surface"&&X(N.get(B.packageName),M)||B?.kind==="module"&&X(j.get(String(B.resolvedModuleId)),M))return!0;for(let q of U(R))if(X(T.get(q),M))return!0;return!1},C=R=>{if(c.isIdentifier(R)){let M=h.tainted.has(R.text)?void 0:S.get(R.text);return M?.kind==="function"?M.functionId:M?.kind==="module"?p.get(String(M.resolvedModuleId))??null:M?.kind==="package-export"?t.exportFor(M.packageName,M.exportName):null}if(c.isPropertyAccessExpression(R)&&c.isIdentifier(R.expression)){let M=R.expression.text;if(D(M,R.name.text))return null;let B=h.tainted.has(M)?void 0:S.get(M);return B?.kind==="package-surface"?t.exportFor(B.packageName,R.name.text):B?.kind==="package-export"?t.methodFor(B.packageName,B.exportName,R.name.text,"method"):B?.kind==="package-instance"?t.methodFor(B.packageName,B.className,R.name.text,"method"):null}return null},H=R=>{for(let M=R.parent;M!==void 0;M=M.parent)if(!c.isArrowFunction(M)){if(c.isFunctionExpression(M)||c.isFunctionDeclaration(M))return null;if(c.isMethodDeclaration(M)||c.isConstructorDeclaration(M)||c.isGetAccessorDeclaration(M)||c.isSetAccessorDeclaration(M)){let B=M.parent;if(!c.isClassLike(B)||B.name===void 0)return null;let q=h.tainted.has(B.name.text)?void 0:S.get(B.name.text);return q?.kind==="app-class"?q.cls:null}}return null},J=s&&!h.tainted.has("require")&&!tp(h.sf),G=R=>{if(c.isIdentifier(R)){let q=h.tainted.has(R.text)?void 0:S.get(R.text);return q?.kind==="package-surface"||q?.kind==="package-default"?t.exportFor(q.packageName,"default"):q?.kind==="app-named-fn"||q?.kind==="app-default-fn"?q.functionId:q?.kind==="module"?f.get(String(q.resolvedModuleId))?.id??null:q?.kind==="member-value"?q.functionId:null}if(!c.isPropertyAccessExpression(R))return null;let M=R.expression;if(s&&c.isCallExpression(Ue(M))){let q=fn(Ue(M));if(q!==void 0)if(!J)he(l,"2b","require-shadow");else if(we(q)==="package-root")he(l,"2b","package-root");else{let le=d.get(`${h.rel}::${q}`);if(le===void 0)he(l,"2b","unresolved-module");else{let ge=R.name.text,Te=u.get(String(le));if(Te==="*"||Te!==void 0&&Te.has(ge))he(l,"2b","module-mutation-gate");else{let Qe=g.get(String(le))?.get(ge);if(Qe!==void 0)return he(l,"2b",null),Qe;if(ge==="default"){let L=f.get(String(le));if(L!==void 0&&L.esm)return he(l,"2b",null),L.id;he(l,"2b","non-esm-default")}else he(l,"2b","unknown-member")}}}return null}let B;if(c.isIdentifier(M)){let q=h.tainted.has(M.text)?void 0:S.get(M.text);if(q?.kind==="app-class"||q?.kind==="app-instance")B=q.cls.memberIds;else if(q?.kind==="object-literal")B=q.obj.members;else if(q?.kind==="module"){let le=g.get(String(q.resolvedModuleId));le?.has(R.name.text)===!0&&!D(M.text,R.name.text)&&(B=le)}}else if(c.isNewExpression(M)){let q=Ji(M,S,h.tainted);q?.kind==="app-instance"&&(B=q.cls.memberIds)}else M.kind===c.SyntaxKind.ThisKeyword&&(B=H(R)?.memberIds);return B?.get(R.name.text)??null},Y=new Map,re=R=>{if(c.isVariableDeclaration(R)&&c.isIdentifier(R.name)&&R.initializer!==void 0&&c.isObjectLiteralExpression(R.initializer)&&!h.tainted.has(R.name.text)&&!S.has(R.name.text)&&!Y.has(R.name.text)){let M=new Map;for(let B of R.initializer.properties)if(c.isPropertyAssignment(B)&&c.isIdentifier(B.name)){let q=C(B.initializer);q!==null&&M.set(B.name.text,q)}Y.set(R.name.text,M)}c.forEachChild(R,re)};re(h.sf);let ne=R=>{if(c.isBinaryExpression(R)&&R.operatorToken.kind===c.SyntaxKind.EqualsToken&&c.isPropertyAccessExpression(R.left)&&c.isIdentifier(R.left.expression)&&!h.tainted.has(R.left.expression.text)){let M=Y.get(R.left.expression.text);if(M!==void 0){let B=C(R.right);B!==null&&M.set(R.left.name.text,B)}}c.forEachChild(R,ne)};ne(h.sf);for(let[R,M]of Y)S.set(R,{kind:"object-literal",obj:{members:M}});let $=(R,M=0)=>{if(M>Xi)return null;let B=Ue(R);if(c.isCallExpression(B)&&c.isPropertyAccessExpression(B.expression)&&B.expression.name.text==="bind")return $(B.expression.expression,M+1);if(c.isIdentifier(B)){let q=C(B);if(q!==null)return q;let le=h.tainted.has(B.text)?void 0:S.get(B.text);return le?.kind==="member-value"?le.functionId:null}return c.isPropertyAccessExpression(B)?C(B)??G(B):null},Z=(R,M=0)=>{if(M>Xi)return"depth-cap";let B=Ue(R);if(c.isCallExpression(B)&&c.isPropertyAccessExpression(B.expression)&&B.expression.name.text==="bind")return Z(B.expression.expression,M+1);if(c.isIdentifier(B))return h.tainted.has(B.text)?"tainted-receiver":"unresolved-receiver";if(c.isPropertyAccessExpression(B)&&c.isIdentifier(B.expression)){if(h.tainted.has(B.expression.text))return"tainted-receiver";if(D(B.expression.text,B.name.text))return"mutated-member"}return"unresolved-receiver"},Q=R=>{if(c.isVariableDeclaration(R)&&c.isIdentifier(R.name)&&R.initializer!==void 0){let M=Ue(R.initializer),B=c.isPropertyAccessExpression(M),q=c.isCallExpression(M)&&c.isPropertyAccessExpression(M.expression)&&M.expression.name.text==="bind";if(B||q){let le=B?"D1":"A2";if(h.tainted.has(R.name.text))he(l,le,"tainted-alias");else if(S.has(R.name.text))he(l,le,"already-bound");else{let ge=$(M);ge!==null?(S.set(R.name.text,{kind:"member-value",functionId:ge}),he(l,le,null)):he(l,le,Z(M))}}}c.forEachChild(R,Q)};s&&Q(h.sf);let ce=0,Tn=R=>{let M,B;if(c.isCallExpression(R)){let q=R.expression,le=c.isIdentifier(q)&&q.text==="require",ge=q.kind===c.SyntaxKind.ImportKeyword;!le&&!ge&&(M=q,B=R.arguments)}else c.isTaggedTemplateExpression(R)&&(M=R.tag);if(M!==void 0){let q=np(M),le=R.getStart(h.sf,!1),ge=`${h.rel}#call${String(ce)}`;ce+=1;let Te="unresolved",Qe=[],L=C(M);L!==null&&(Te="resolved",Qe.push(L)),b.push({id:ge,enclosingFunctionId:v(le),calleeExprShape:q,resolvedTargetIds:Qe,resolution:Te,range:Nn(h.rel,R,h.sf)});for(let oe of Qe)x.push({callSiteId:ge,calleeFunctionId:oe,resolution:Te});if(L===null){let oe=G(M);if(oe!==null)x.push({callSiteId:ge,calleeFunctionId:oe,resolution:"field-based"});else if(s&&c.isPropertyAccessExpression(M)&&(M.name.text==="call"||M.name.text==="apply")){let se=$(M.expression);se!==null?(x.push({callSiteId:ge,calleeFunctionId:se,resolution:"field-based"}),he(l,"A3",null)):he(l,"A3",Z(M.expression))}}for(let oe of B??[]){let se=C(oe);if(se!==null)x.push({callSiteId:ge,calleeFunctionId:se,resolution:"field-based"});else{let Ie=G(oe);if(Ie!==null)x.push({callSiteId:ge,calleeFunctionId:Ie,resolution:"field-based"});else if(s){let Ne=$(oe),pe=Ue(oe),en=pe!==oe||c.isCallExpression(pe)&&c.isPropertyAccessExpression(pe.expression)&&pe.expression.name.text==="bind";Ne!==null?(x.push({callSiteId:ge,calleeFunctionId:Ne,resolution:"field-based"}),en&&he(l,"A2p",null)):en&&he(l,"A2p",Z(oe))}}}}c.forEachChild(R,Tn)};Tn(h.sf);for(let R of n.computedLoads.get(h.rel)??[]){let M=R.candidateRels.filter(q=>i.has(q)).map(q=>`${q}#<toplevel>`);if(M.length===0)continue;let B=`${h.rel}#dirload${String(ce)}`;ce+=1,b.push({id:B,enclosingFunctionId:v(R.pos),calleeExprShape:"require",resolvedTargetIds:M,resolution:"field-based",range:{path:h.rel,start:R.pos,end:R.pos}});for(let q of M)x.push({callSiteId:B,calleeFunctionId:q,resolution:"field-based"})}let Jn=0;for(let R of o.get(h.rel)??[]){let M=`${h.rel}#handlerseed${String(Jn)}`;Jn+=1;let B=R.node.getStart(h.sf,!1);b.push({id:M,enclosingFunctionId:h.toplevelId,calleeExprShape:"member",resolvedTargetIds:[R.id],resolution:"field-based",range:{path:h.rel,start:B,end:B}}),x.push({callSiteId:M,calleeFunctionId:R.id,resolution:"field-based"})}}let k=new Map;if(a)for(let h of i.values())for(let[S,_]of h.mintSeedAliases)k.set(`${h.rel}::${String(S)}`,_);return{functions:y,callSites:b,callEdges:x,exports:I,exportBindings:w,classes:A,mintSeedAliases:k,bindingApplicability:l}}function rp(e,n,t){let o=i=>i.length===0||ze.isAbsolute(i)||i.includes("\\")||/^[a-zA-Z]:/u.test(i)||i.split("/").some(d=>d===".."||d==="");if(o(n)||o(t))return null;let r=e.endsWith(ze.sep)?e:e+ze.sep,s;try{s=Hi(ze.resolve(e,n))}catch{return null}if(!s.startsWith(r))return null;let a=s.endsWith(ze.sep)?s:s+ze.sep,l;try{l=Hi(ze.resolve(s,t))}catch{return null}return l.startsWith(a)?l:null}function xa(e,n,t){let o=`${e}#class:${t}`,r=[],s=[],a=[],l=new Set;return{pushMember(i,d,u,p){if(i==="__proto__"||l.has(i))return;l.add(i);let f=`${e}#${t}.${i}`;r.push({id:f,moduleId:e,name:i,kind:u,enclosingClassId:o,declRange:Nn(e,d,n),isExported:!1,publicSurfaceReachable:!1}),a.push(f),s.push({name:i,id:f,kind:u,body:p})},finish(){return s.length===0?null:{functions:r,classNode:{id:o,moduleId:e,name:t,implementsRefs:[],members:a},members:s}}}}function sp(e,n,t,o){if(ya(o)||o.members.length>Nr)return null;let r=xa(e,n,t);for(let s of o.members){let a,l,i;if(c.isConstructorDeclaration(s))a="constructor",l="ctor",i=void 0;else if(c.isMethodDeclaration(s))a=So(s.name),l="method",i=a!==void 0&&!st.has(a)?s.body??void 0:void 0;else continue;a!==void 0&&r.pushMember(a,s,l,i)}return r.finish()}function ip(e,n,t){let o;for(let a of n.statements)if(c.isFunctionDeclaration(a)&&a.name?.text===t){o=a;break}if(o===void 0)return null;let r=[];for(let a of n.statements){if(!c.isExpressionStatement(a))continue;let l=a.expression;if(!c.isBinaryExpression(l)||l.operatorToken.kind!==c.SyntaxKind.EqualsToken)continue;let i=l.left;if(c.isPropertyAccessExpression(i)&&c.isPropertyAccessExpression(i.expression)&&c.isIdentifier(i.expression.expression)&&i.expression.expression.text===t&&i.expression.name.text==="prototype"){let d=i.name.text;c.isFunctionExpression(l.right)?r.push({name:d,fn:l.right,walk:!0}):c.isArrowFunction(l.right)&&r.push({name:d,fn:l.right,walk:!1})}}if(r.length===0||r.length+1>Nr)return null;let s=xa(e,n,t);s.pushMember("constructor",o,"ctor",void 0);for(let a of r){let l=a.walk&&!st.has(a.name)&&c.isFunctionExpression(a.fn)?a.fn.body:void 0;s.pushMember(a.name,a.fn,"method",l)}return s.finish()}function ap(e,n,t){for(let o of n.statements)if(c.isClassDeclaration(o)&&o.name?.text===t)return sp(e,n,t,o);return ip(e,n,t)}function lp(e,n,t,o,r){let s={modules:[],functions:[],classes:[],callSites:[],callEdges:[],imports:[],importEdges:[],diagnostics:[]};if(n.length===0)return s;let a=new Set(t.map(p=>p.packageName)),l=new Set(t.map(p=>p.path)),i=new Set,d=new Set,u=0;for(let p of n){if(!a.has(p.packageName))continue;let f=rp(e.appRoot,p.packageRootRel,p.sourcePath);if(f===null)continue;let m=e.toRel(f);if(m===null)continue;let g=`${m}#${p.container}`;if(d.has(g)||!i.has(m)&&i.size>=yo)continue;let y=Oe(f);if(y===null)continue;let b;try{b=c.createSourceFile(m,y,c.ScriptTarget.Latest,!0,c.ScriptKind.JS)}catch{continue}let x=ap(m,b,p.container);if(x===null)continue;i.add(m),d.add(g);let I=new Map,w=new Map;for(let k of x.members){let h=r.methodFor(p.packageName,p.container,k.name,k.kind);I.set(k.name,h),w.set(h,k.id)}let A=0;for(let k of x.members){if(k.body===void 0)continue;let h=(S,_)=>{if(_&&c.isCallExpression(S)&&c.isPropertyAccessExpression(S.expression)&&S.expression.expression.kind===c.SyntaxKind.ThisKeyword){let T=I.get(S.expression.name.text);if(T!==void 0){let N=`${m}#depclass:${p.container}.${k.name}#c${String(A)}`;A+=1,s.callSites.push({id:N,enclosingFunctionId:k.id,calleeExprShape:"member",resolvedTargetIds:[],resolution:"unresolved",range:Nn(m,S,b)}),s.callEdges.push({callSiteId:N,calleeFunctionId:T,resolution:"field-based"})}}let P=c.isFunctionExpression(S)||c.isFunctionDeclaration(S)||c.isMethodDeclaration(S)||c.isConstructorDeclaration(S)||c.isGetAccessorDeclaration(S)||c.isSetAccessorDeclaration(S)||c.isClassLike(S),v=c.isArrowFunction(S)?_:P?!1:_;c.forEachChild(S,T=>{h(T,v)})};h(k.body,!0)}for(let k of o){let h=w.get(k.calleeFunctionId);h!==void 0&&s.callEdges.push({callSiteId:k.callSiteId,calleeFunctionId:h,resolution:"field-based"})}if(s.functions.push(...x.functions),s.classes.push(x.classNode),!l.has(m)){l.add(m),s.modules.push({id:m,packageName:p.packageName,versionRange:"",path:m,moduleSystem:"cjs",isEntrypoint:!1});let k=r.moduleFor(p.packageName),h=`${String(k)}#depclass${String(u)}`;u+=1,s.imports.push({id:h,moduleId:k,specifier:"<dep-class-corridor>",isNamespace:!1,isDefault:!1,dynamic:!1,specifierIsLiteral:!0,resolvedModuleId:m}),s.importEdges.push({importId:h,resolvedModuleId:m})}s.diagnostics.push({code:"dep-class-corridor",path:m,detail:`lowered dependency class ${p.container} (${p.packageName}) \u2014 ${String(x.members.length)} members; the un-analyzed remainder caps this class's method sinks at unknown`,classScope:{packageName:p.packageName,container:p.container}})}return s}function dp(e,n,t,o){let r=new Set(e.modules.filter(i=>i.isEntrypoint).map(i=>i.packageName)),s=new Map(e.functions.map(i=>[i.id,i.moduleId])),a=new Map;for(let i of e.callSites){if(i.resolution!=="unresolved")continue;let d=s.get(i.enclosingFunctionId);d!==void 0&&a.set(d,(a.get(d)??0)+1)}let l=[];for(let i of e.modules){if(i.externalSurface===!0)continue;let d=n.get(i.path);if(d===void 0||t.has(i.path)||r.has(i.packageName)&&o.has(i.path)&&!i.path.split("/").includes("node_modules"))continue;let u=a.get(i.id)??0;if(u===0&&Wf(d))continue;let p=u>0?`${String(u)} of its call sites are unresolved`:"it invokes (or exposes) a function body through a form that emits no call site \u2014 `new`, an accessor, the iterator protocol, spread, or a coercion member";l.push({code:"dependency-body",path:i.path,detail:`dependency module analyzed with full bodies (package-subpath/relative/computed entry) but ${p}; its hidden call edges are bounded by its own forward module reach (ADR-069 Finding A)`,anchor:i.id})}return l}function Sa(e,n,t=[],o={},r=!1){let s=new Ir,a=Sf(e,n,s),l=new Set;for(let A of a.computedLoads.values())for(let k of A)if(k.seedable)for(let h of k.candidateRels)l.add(h);let i=new Map;for(let A of e.sourceFiles){let k=e.toRel(A.fileName);if(k===null||!l.has(k)||k.split("/").includes("node_modules"))continue;let h=Zf(k,A);h.length>0&&i.set(k,h)}let d=i.size===0?a.modules:a.modules.map(A=>i.has(A.path)&&!A.isEntrypoint?{...A,isEntrypoint:!0}:A),u={...a,modules:d},p=op(e,u,s,i,o),f=Uf(e,a,p.functions,p.mintSeedAliases),m=new Set(a.modules.map(A=>A.path)),g=Ef(e.depReach,s,m),y=[...u.modules,...g.modules,...s.modules()],b=lp(e,t,y,p.callEdges,s),x=[];if(r){let A="#default",k=new Set;for(let S of p.callEdges){let _=String(S.calleeFunctionId);!_.startsWith("pkg:")||!_.endsWith(A)||k.add(_.slice(4,_.length-A.length))}let h=new Map;for(let S of e.depReach.edges){if(!("surface"in S.from)||"surface"in S.to)continue;let _=S.from.surface;h.set(_,h.has(_)?null:S.to.module)}for(let S of k){let _=h.get(S);if(_==null)continue;let P=bf(ze.join(e.appRoot,_));if(P===null||P==="default")continue;let v=s.exportFor(S,P),T=`pkg:${S}${A}`;for(let N of p.callEdges)String(N.calleeFunctionId)===T&&x.push({callSiteId:N.callSiteId,calleeFunctionId:v,resolution:"field-based"})}}let I={modules:[...u.modules,...g.modules,...b.modules,...s.modules()],exports:[...p.exports,...f.exports],imports:[...a.imports,...g.imports,...b.imports],functions:[...p.functions,...s.functions(),...b.functions],callSites:[...p.callSites,...b.callSites],classes:[...p.classes,...s.classes(),...b.classes],callEdges:[...p.callEdges,...b.callEdges,...x],importEdges:[...a.importEdges,...g.importEdges,...b.importEdges],exportBindings:[...p.exportBindings,...f.exportBindings],inheritEdges:[]},w=new Map;for(let A of e.sourceFiles){let k=e.toRel(A.fileName);k!==null&&w.set(k,A)}return{graph:I,diagnostics:[...f.diagnostics,...b.diagnostics,...dp(I,w,new Set(e.diagnostics.filter(A=>A.code==="dependency-body").map(A=>A.path)),a.appOwnedPaths)],loadSites:a.loadSites,...p.bindingApplicability!==void 0?{bindingApplicability:p.bindingApplicability}:{}}}var cp=/^(@[A-Za-z0-9_.-]{1,100}\/)?[A-Za-z0-9_.-]{1,100}$/u,bo=/^[A-Za-z0-9_$.-]{1,128}$/u;function up(e){return cp.test(e.calleePackage)?bo.test(e.anchorExport)?bo.test(e.calleeExport)?e.anchorContainer!==null&&!bo.test(e.anchorContainer)?`anchorContainer ${JSON.stringify(e.anchorContainer)}`:e.calleeContainer!==null&&!bo.test(e.calleeContainer)?`calleeContainer ${JSON.stringify(e.calleeContainer)}`:null:`calleeExport ${JSON.stringify(e.calleeExport)}`:`anchorExport ${JSON.stringify(e.anchorExport)}`:`calleePackage ${JSON.stringify(e.calleePackage)}`}function Nt(e,n){let t=[],o=[],r=new Map(e.modules.map(d=>[d.id,d])),s=new Map(e.classes.map(d=>[d.id,d.name])),a=(d,u,p)=>e.functions.some(f=>{if(f.name!==u)return!1;let m=r.get(f.moduleId);return m===void 0||m.packageName!==d?!1:(f.enclosingClassId!==void 0?s.get(f.enclosingClassId)??null:null)===p}),l=(d,u,p)=>{for(let f of e.functions){if(f.name!==u)continue;let m=r.get(f.moduleId);if(!(m===void 0||m.packageName!==d||(f.enclosingClassId!==void 0?s.get(f.enclosingClassId)??null:null)!==p))return f.id}return null},i=[...n].sort((d,u)=>d.modelId<u.modelId?-1:d.modelId>u.modelId?1:0);for(let d of i){if(d.edges.length>64){t.push(`model ${d.modelId}: ${String(d.edges.length)} edges over cap ${String(64)} \u2014 dropped WHOLE (all-or-nothing)`);continue}let u=d.edges.map(up).find(m=>m!==null);if(u!==void 0){t.push(`model ${d.modelId}: hostile/invalid edge field ${u} \u2014 model refused WHOLE`);continue}let p=0,f=0;for(let m of d.edges){if(!a(d.packageName,m.anchorExport,m.anchorContainer)){f+=1;continue}o.push({modelId:d.modelId,kind:m.kind,anchor:{packageName:d.packageName,exportName:m.anchorExport,container:m.anchorContainer},callee:{packageName:m.calleePackage,exportName:m.calleeExport,container:m.calleeContainer,realFunctionId:l(m.calleePackage,m.calleeExport,m.calleeContainer)},resolution:"modeled"}),p+=1}p>0?t.push(`model-edge ${d.modelId}: ${String(p)} edge(s) lowered, ${String(f)} reference-gated`):t.push(`model ${d.modelId}: refused \u2014 no anchor surface in the graph (${String(f)} edge(s) reference-gated); models never mint loadedness`)}return{delta:{records:o,notes:t}}}var fp={modules:[],exports:[],imports:[],functions:[],callSites:[],classes:[],callEdges:[],importEdges:[],exportBindings:[],inheritEdges:[]};function Dr(e){try{let n=zi(e.appRoot,e.entrypoints,e.tsconfigPaths===!0),t=new Set(e.entrypoints.map(l=>l.split(Ye.sep).join("/"))),{graph:o,diagnostics:r,loadSites:s,bindingApplicability:a}=Sa(n,t,e.depClassAnchors??[],e.bindingForms??{},e.callablePackageResolver===!0);return{graph:o,diagnostics:[...n.diagnostics,...r],loadSites:s,conditionUnions:n.conditionUnions,provenAbsent:n.provenAbsent,...a!==void 0?{bindingApplicability:a}:{}}}catch(n){return{graph:fp,loadSites:[],conditionUnions:[],provenAbsent:[],diagnostics:[{code:"unsupported-syntax",path:e.appRoot,detail:`analysis aborted: ${n instanceof Error?n.message:String(n)}`}]}}}function ba(e,n){let t=512,o=(r,s,a)=>{if(!(t<=0||s>12)){if(t-=1,typeof r=="string"){n(r,a);return}if(Array.isArray(r)){for(let l of r)o(l,s+1,a);return}if(r!==null&&typeof r=="object")for(let[l,i]of Object.entries(r))l==="types"||l==="typings"||o(i,s+1,a||l.includes("*"))}};o(e,0,!1)}function va(e,n,t,o=!1){if(typeof t!="string"||t.length===0||t.endsWith(".d.ts")||t.endsWith(".d.mts")||t.endsWith(".d.cts"))return null;let r;try{r=kn(Ye.resolve(e,t))}catch{return null}return r!==e&&!r.startsWith(n)||o&&!un(r)?null:r===e?"":r.slice(n.length).split(Ye.sep).join("/")}var pp=1024*1024,mp=4096;function ka(e,n){let t=e.toLowerCase(),o=0;for(;;){let r=t.indexOf(n,o);if(r===-1)return null;let s=r===0?" ":t[r-1],a=r+n.length;for(;a<e.length&&(e[a]===" "||e[a]==="	"||e[a]===`
-`||e[a]==="\r");)a+=1;if(/[a-z0-9_:-]/i.test(s??" ")||e[a]!=="="){o=r+n.length;continue}for(a+=1;a<e.length&&(e[a]===" "||e[a]==="	"||e[a]===`
-`||e[a]==="\r");)a+=1;let l=e[a];if(l==='"'||l==="'"){let d=e.indexOf(l,a+1);return d===-1?null:e.slice(a+1,d)}let i=a;for(;i<e.length&&!/[\s>]/.test(e[i]??"");)i+=1;return e.slice(a,i)}}function hp(e){let n=[],t=e.toLowerCase(),o=0;for(;;){let r=t.indexOf("<script",o);if(r===-1)break;let s=t[r+7];if(s!==void 0&&/[a-z0-9-]/.test(s)){o=r+7;continue}let a=e.indexOf(">",r);if(a===-1)break;o=a+1;let l=e.slice(r+7,a);if(l.length>mp)continue;let i=ka(l,"type");n.push({module:(i??"").trim().toLowerCase()==="module",src:ka(l,"src")})}return n}function gp(e){return/^[a-z][a-z0-9+.-]*:/i.test(e)||e.startsWith("//")}function yp(e){let n=e.search(/[?#]/);return(n===-1?e:e.slice(0,n)).replace(/^\/+/,"")}function xp(e){let n=kn(e),t=n.endsWith(Ye.sep)?n:n+Ye.sep,o=new Set,r=[],s=[],a=[],l=[],i=[],d=!1,u=(O,F,K=!1,te)=>{let U=va(n,t,O);return U===null||U.length===0?"unresolved":o.has(U)?"duplicate":(o.add(U),r.push(U),s.push({source:F,specifier:Xe(te??(typeof O=="string"?O:"")),entrypoint:U,launch:K}),"added")},p=new Set,f=(O,F,K=!1)=>{let te=u(O,F),U=typeof O=="string"&&O.includes("\\")?u(O.split("\\").join("/"),F,!1,O):"unresolved";if(te!=="unresolved"||U!=="unresolved"||typeof O!="string"||O.trim().length===0||O.endsWith(".d.ts")||O.endsWith(".d.mts")||O.endsWith(".d.cts"))return;if(K&&O.includes("*")){let D=Vi(n,O),C=!1;if(D!==null){for(let H of D.matches)u(H,F,!1,O)!=="unresolved"&&(C=!0);if(!D.truncated&&C)return}l.push({source:F,file:"package.json",detail:`\`${Xe(O)}\` is a subpath pattern cupel could not expand completely; the files it names beyond those seeded were NOT analyzed`});return}let X=`${F}\0${O}`;p.has(X)||(p.add(X),l.push({source:F,file:"package.json",detail:`\`${Xe(O)}\` did not resolve to a file inside the scan root; the code it names was NOT analyzed`}))},m=[],g=(O,F)=>{a.push({source:O,file:O,detail:F.detail}),m.push({code:F.code,path:O,detail:`${O} ${F.detail}`})},y,b,x,I=null,w=Mr(n,t,"package.json",In);w.kind==="refused"&&g("package.json",w);try{let O=w.kind==="ok"?JSON.parse(w.text):{};if(I=w.kind==="ok"?O:null,f(O.main,"main"),typeof O.bin=="string")f(O.bin,"bin");else if(O.bin!==null&&typeof O.bin=="object")for(let K of Object.values(O.bin))f(K,"bin");ba(O.exports,(K,te)=>{f(K,"exports",te)}),typeof O.browser=="string"?f(O.browser,"browser"):ba(O.browser,K=>{u(K,"browser")});let F=O.scripts;if(F!==null&&typeof F=="object"){let K=F;y=K.start,b=K.prestart,x=K.poststart}}catch{}if(r.length===0)try{kn(Ye.join(n,"index.js")),u("index.js","index.js fallback")}catch{}let A=(O,F)=>{if(typeof O=="string"&&O.trim().length>0){let K=Ea(O,F,"package.json",u,a,!1)==="used";return K&&(d=!0),K?"resolved":"gapped"}return O===void 0||typeof O=="string"?"absent":(a.push({source:F,file:"package.json",detail:`${F} is not a string; no entry file could be read from it`}),"gapped")},k=A(y,"scripts.start"),h=A(b,"scripts.prestart"),S=A(x,"scripts.poststart"),_=k==="resolved"&&h!=="gapped"&&S!=="gapped",P=Mr(n,t,"Procfile",65536);if(P.kind==="refused")g("Procfile",P);else if(P.kind==="ok"){let{entries:O,truncated:F,unnamedLines:K}=vr(P.text);F&&a.push({source:"Procfile",file:"Procfile",detail:"Procfile has more process types than cupel parses; the remainder was not read"}),K>0&&a.push({source:"Procfile",file:"Procfile",detail:`${String(K)} Procfile line(s) declare a process whose name cupel does not accept; their commands were NOT read`});for(let te of O)Ea(te.command,`Procfile:${te.name}`,"Procfile",u,a,_)==="used"&&(d=!0)}let v=r.length===0,T=Mr(n,t,"index.html",pp);if(T.kind==="ok")for(let O of hp(T.text)){if(O.src===null)continue;let F=Xe(O.src);if(!O.module){i.push({kind:"classic-script",file:"index.html",detail:`index.html loads "${F}" as a classic (non-module) script; not seeded (ADR-071 Step 5, decision 2)`,root:""});continue}if(gp(O.src)){i.push({kind:"external-script",file:"index.html",detail:`index.html loads the module script "${F}" from another origin \u2014 not this repository's code; not seeded`,root:""});continue}u(yp(O.src),"index.html",!1,O.src)==="unresolved"&&a.push({source:"index.html",file:"index.html",detail:`index.html names the module script "${F}", which did not resolve to a file inside the root; the browser would load it and cupel did not analyze it`})}else T.kind==="refused"&&i.push({kind:T.code==="limit-exceeded"?"index-html-oversize":"index-html-refused",file:"index.html",detail:`index.html ${T.detail}`,root:""});let N=v?Sr(n,I):null;if(N!==null){let O=0;for(let F of kr(n,N).roots)u(F,`framework:${N.name}`)==="added"&&(O+=1);O>0&&m.push({code:"framework-derived-entry",path:"package.json",detail:`entrypoints were derived from ${N.name}'s directory conventions (recognised via ${N.configFile}), not declared by this project. That set cannot be proven complete, so findings that would read \`not-reachable\` are capped at \`unknown\`; pass \`--entry\` for the files your build actually starts to lift it`})}let j=O=>O.map(F=>({...F,root:""}));return{entrypoints:r,sources:j(s),gaps:j(a),surfaceGaps:j(l),launchResolved:d,diagnostics:m,framework:N,observations:i}}function Mr(e,n,t,o){let r;try{r=kn(Ye.join(e,t))}catch{return{kind:"absent"}}if(!r.startsWith(n))return{kind:"refused",code:"out-of-root",detail:"exists but resolves OUTSIDE the scan root (symlink); it was NOT read, so the declarations it carries were not analyzed"};let s=tt(r,o);return s.kind==="ok"?s:s.kind==="too-large"?{kind:"refused",code:"limit-exceeded",detail:`is ${String(s.bytes)} bytes, over the ${String(o)}-byte cap; it was NOT read`}:{kind:"refused",code:"parse-error",detail:"exists but is not a readable regular file (FIFO/device/directory); it was NOT read"}}function Ea(e,n,t,o,r,s){let a=wr(e);if(a.kind==="delegates")return s?"used":(r.push({source:n,file:t,detail:`\`${Xe(e)}\`: runs the package \`start\` lifecycle (prestart/start/poststart), which is absent or not fully readable`}),"gapped");if(a.kind==="unparsed")return r.push({source:n,file:t,detail:`\`${Xe(e)}\`: ${a.reason}`}),"gapped";let l=o(a.specifier,n,!0),i=a.alt===void 0?"unresolved":o(a.alt,n,!0);return l==="unresolved"&&i==="unresolved"?(r.push({source:n,file:t,detail:`\`${Xe(a.specifier)}\` did not resolve to a file inside the app root`}),"gapped"):"used"}function at(e,n){return e===""?n:`${e}/${n}`}function Ia(e,n){let t=kn(e),o=t.endsWith(Ye.sep)?t:t+Ye.sep,r=new Set,s=[],a=[],l=[],i=[],d=[],u=[],p=!1,f=null,m=[...n].sort((g,y)=>g.rel===""?-1:y.rel===""?1:g.rel<y.rel?-1:g.rel>y.rel?1:0);for(let g of m){let y=at(g.rel,"package.json"),b=g.rel===""?".":g.rel,x;try{x=kn(g.abs)}catch{l.push({source:"root",file:y,detail:`root \`${b}\` could not be resolved; not seeded`,root:g.rel});continue}if(x!==t&&!x.startsWith(o)){l.push({source:"root",file:y,detail:`root \`${b}\` resolves outside the scan root; refused, not seeded`,root:g.rel});continue}let I;try{I=xp(x)}catch{l.push({source:"root",file:y,detail:`root \`${b}\` could not be read; not seeded`,root:g.rel});continue}for(let w of I.sources){let A=at(g.rel,w.entrypoint),k,h;try{k=kn(Ye.resolve(t,A)),h=kn(Ye.resolve(x,w.entrypoint))}catch{l.push({source:w.source,file:y,detail:`\`${w.specifier}\` re-based to \`${A}\` did not resolve; not seeded`,root:g.rel});continue}if(!k.startsWith(o)||k!==h){l.push({source:w.source,file:y,detail:`\`${w.specifier}\` re-based to \`${A}\` escapes the scan root or names another file; refused, not seeded`,root:g.rel});continue}r.has(A)||(r.add(A),s.push(A),a.push({...w,entrypoint:A,root:g.rel}))}I.launchResolved&&(p=!0);for(let w of I.gaps)l.push({...w,file:at(g.rel,w.file),root:g.rel});for(let w of I.surfaceGaps)i.push({...w,file:at(g.rel,w.file),root:g.rel});for(let w of I.diagnostics)d.push({...w,path:at(g.rel,w.path)});for(let w of I.observations)u.push({...w,file:at(g.rel,w.file),root:g.rel});g.rel===""&&(f=I.framework)}return{entrypoints:s,sources:a,gaps:l,surfaceGaps:i,launchResolved:p,diagnostics:d,framework:f,observations:u}}function Lr(e){let{gaps:n,launchResolved:t}=e;if(n.length===0||!t)return[];let o=n.slice(0,3).map(r=>r.source).join(", ");return[{code:"unresolved-launch-entry",path:n[0]?.file??"package.json",detail:`${String(n.length)} launch declaration(s) (${o}) name code this project starts but cupel could not resolve to an entry file, while other launch declarations DID seed the analysis; verdicts that would be \`not-reachable\` are capped at \`unknown\`. To clear it, make those commands a direct \`node <file.js>\` invocation cupel can read. \`--entry <file>\` analyzes that code too (so a sink there is still reported), but the cap remains while the command itself is unreadable`}]}function Fr(e,n){let{surfaceGaps:t}=e;if(t.length===0||n===0)return[];let o=[...new Set(t.slice(0,3).map(r=>r.source))].join(", ");return[{code:"unresolved-entry-declaration",path:t[0]?.file??"package.json",detail:`${String(t.length)} package.json entry declaration(s) (${o}) name a file this package owns that cupel could not resolve inside the scan root, while the analysis was seeded from elsewhere; the code they name was NOT analyzed, so verdicts that would be \`not-reachable\` are capped at \`unknown\`. To clear it, point those fields at a file that exists (a Windows-style \`lib\\index.js\` does not resolve on a posix host). \`--entry <file>\` analyzes that code too, but the cap remains while the declaration is unresolvable`}]}function Aa(e,n){let t=kn(e),o=t.endsWith(Ye.sep)?t:t+Ye.sep,r=new Set,s=[],a=[];for(let l of n){let i=va(t,o,l,!0);if(i===null||i.length===0){a.push(l);continue}r.has(i)||(r.add(i),s.push(i))}return{entrypoints:s,rejected:a}}import{readdirSync as al,readFileSync as Gr,realpathSync as Hr,statSync as Lt}from"node:fs";import an from"node:path";function Sp(e){if(e.startsWith("<<:")||e.startsWith("- &")||e.startsWith("- *"))return!0;let n=e.charCodeAt(0);if(n===38||n===42)return!0;let t=e.indexOf(": ");if(t===-1)return!1;let o=t+2;for(;o<e.length&&e.charCodeAt(o)===32;)o+=1;let r=e.charCodeAt(o);return r===38||r===42}function Rt(e,n,t){let o=n.maxLines??2e6,r=n.maxLineBytes??16384,s=!1,a=!1,l=0,i=0,d=e.charCodeAt(0)===65279?1:0;for(;d<=e.length;){let u=e.indexOf(`
-`,d),p=u===-1;p&&(u=e.length);let f=u>d&&e.charCodeAt(u-1)===13?u-1:u;if(i+=1,i>o){s=!0;break}if(f-d>r)l+=1;else{let m=d;for(;m<f&&e.charCodeAt(m)===32;)m+=1;let g=m-d,y=f;for(;y>m&&(e.charCodeAt(y-1)===32||e.charCodeAt(y-1)===9);)y-=1;if(m<y&&e.charCodeAt(m)!==35){let b=e.slice(m,y);if(Sp(b)){a=!0;break}t(g,b)}}if(p)break;d=u+1}return{truncated:s||l>0,refusedAnchors:a,oversizeLines:l}}function ko(e){let n=e.charCodeAt(0);if(n===34||n===39){let o=e.indexOf(String.fromCharCode(n),1);if(o===-1)return null;let r=o+1;for(;r<e.length&&e.charCodeAt(r)===32;)r+=1;return e.charCodeAt(r)===58?e.slice(0,o+1):null}let t=e.indexOf(":");return t>0?e.slice(0,t):null}function lt(e){return e.endsWith(":")}function rn(e){if(e.length>=2){let n=e.charCodeAt(0);if((n===34||n===39)&&e.charCodeAt(e.length-1)===n)return e.slice(1,-1)}return e}function Eo(e){if(e.length===0||e.length>214)return!1;let n=e.charCodeAt(0)===64,t=n?e.slice(1):e,o=t.indexOf("/");if(n){if(o<=0||t.indexOf("/",o+1)!==-1)return!1}else if(o!==-1)return!1;let r=n?[t.slice(0,o),t.slice(o+1)]:[t];for(let s of r){if(s.length===0||s.charCodeAt(0)===46||s.charCodeAt(0)===95)return!1;for(let a=0;a<s.length;a+=1){let l=s.charCodeAt(a);if(!(l>=97&&l<=122||l>=65&&l<=90||l>=48&&l<=57||l===45||l===46||l===95||l===126))return!1}}return!0}function Pt(e){return Eo(e)?`node_modules/${e}`:""}function $t(e,n){let t=`${e}@${n}`;return t.length<=96?t:`${t.slice(0,96)}\u2026`}var wo=2e5,_a=64,vo=1024,bp=5,kp=[1,2,3];function Ep(e){let n="node_modules/",t=e.lastIndexOf(n);if(t===-1)return null;let o=e.slice(t+n.length);if(o==="")return null;let r=o.split("/");return r[0]?.startsWith("@")?r.length>=2?`${r[0]}/${r[1]}`:null:r[0]??null}function Na(e,n){if(!n.startsWith("npm:"))return[{name:e,version:n}];let t=n.slice(4);if(t.length===0)return[{name:e,version:n}];let o=t.indexOf("@",1);if(o>0){let r=t.slice(0,o),s=t.slice(o+1);if(r.length>0&&s.length>0)return[{name:r,version:s}]}return t===e?[{name:e,version:n}]:[{name:e,version:n},{name:t,version:n}]}function dt(e){return typeof e!="object"||e===null||Array.isArray(e)?null:e}function Ra(e){return{deps:[],seen:new Set,maxEntries:e,unread:0,visited:0,capped:!1}}function Pa(e){return e.capped?!1:(e.visited+=1,e.visited>e.maxEntries?(e.capped=!0,!1):!0)}function $a(e,n,t,o,r=!1){let s=JSON.stringify([n,t,o]);if(!e.seen.has(s)){if(e.deps.length>=e.maxEntries){e.capped=!0;return}e.seen.add(s),e.deps.push({name:n,version:t,lockKey:o,dev:r})}}function wp(e,n){for(let[t,o]of Object.entries(e)){if(t==="")continue;if(!Pa(n))return;let r=t.startsWith("node_modules/")||t.includes("/node_modules/"),s=dt(o);if(s===null){n.unread+=1;continue}if(s.link===!0)continue;let a=s.name,l=typeof a=="string"&&a!==""?a:Ep(t),i=s.version;if(l===null||typeof i!="string"){r&&(n.unread+=1);continue}let d=s.dev===!0||s.devOptional===!0;for(let u of Na(l,i))$a(n,u.name,u.version,t,d)}}function Oa(e,n,t){let o=[{deps:e,prefix:"",depth:0,pathSafe:!0,dev:!1}],r=!1;for(let s=0;s<o.length;s+=1){let a=o[s];if(a===void 0)break;for(let[l,i]of Object.entries(a.deps)){if(!Pa(n))return{depthCapped:r};if(l===""){n.unread+=1;continue}let d=dt(i);if(d===null){n.unread+=1;continue}let u=a.pathSafe&&Eo(l),p=u?`${a.prefix}node_modules/${l}`:"",f=u&&p.length<=vo,m=f?p:"",g=d.version,y=d.dev===!0||a.dev;if(d.link!==!0&&typeof g=="string"&&g!=="")for(let x of Na(l,g))$a(n,x.name,x.version,m,y);else n.unread+=1;let b=dt(d.dependencies);if(b!==null){if(a.depth+1>t){r=!0;continue}o.push({deps:b,prefix:f?`${m}/`:a.prefix,depth:a.depth+1,pathSafe:f,dev:y})}}}return{depthCapped:r}}function vp(e,n,t){let o=Ra(n.maxEntries),{depthCapped:r}=Oa(e,o,t),s=[],a=new Set(n.deps.map(d=>JSON.stringify([d.name,d.version]))),l=new Set,i=[];for(let d of o.deps){if(d.version.includes(":"))continue;let u=JSON.stringify([d.name,d.version]);a.has(u)||l.has(u)||(l.add(u),i.length<bp&&i.push($t(d.name,d.version)))}if(l.size>0){let d=l.size-i.length;s.push(`package-lock.json carries BOTH a v2/v3 \`packages\` map and a legacy v1 \`dependencies\` tree, and they DISAGREE: ${String(l.size)} install(s) the tree describes are absent from the map (${i.join(", ")}${d>0?`, and ${String(d)} more`:""}). npm 6 installs from the tree and npm 7+ from the map, so what is on disk depends on which npm ran; cupel enumerated the map`)}return(o.capped||r)&&s.push("package-lock.json's legacy `dependencies` tree hit a cap before it could be cross-checked against the `packages` map; a disagreement between the two would not have been seen"),s}function Io(e,n={}){let t=[],o;try{o=JSON.parse(e)}catch{return{deps:[],diagnostics:["package-lock.json is not valid JSON"],truncated:!1}}let r=dt(o);if(r===null)return{deps:[],diagnostics:["package-lock.json is not an object"],truncated:!1};let s=r.lockfileVersion,a=typeof s=="number"&&Number.isInteger(s)?s:null,l=typeof s=="number"?String(s):"?",i=dt(r.packages),d=dt(r.dependencies);if(i===null&&d===null)return{deps:[],diagnostics:[`package-lock.json (lockfileVersion ${l}) has neither a v2/v3 \`packages\` map nor a v1 \`dependencies\` tree; NO dependency was enumerated`],truncated:!1};(a===null||!kp.includes(a))&&t.push(`package-lock.json declares unsupported lockfileVersion ${l} (cupel knows v1, v2 and v3); its shape may differ, so what was read may be incomplete`);let u=n.maxDepth??_a,p=Ra(n.maxEntries??wo),f=!1;return i!==null?(wp(i,p),d!==null&&t.push(...vp(d,p,u))):d!==null&&(f=Oa(d,p,u).depthCapped),p.capped&&t.push(`lockfile exceeds ${String(p.maxEntries)} entries; truncated`),f&&t.push(`package-lock.json nests \`dependencies\` deeper than ${String(u)} levels; the deeper subtree(s) were NOT enumerated`),p.unread>0&&t.push(`package-lock.json has ${String(p.unread)} entr(ies) with no version cupel could read (an odd shape or a missing \`version\`); they were not enumerated`),{deps:p.deps,diagnostics:t,truncated:p.capped||f}}var Ip=["workspace:","link:","portal:","file:","exec:"];function Ap(e){let n=e.charCodeAt(0);if(n>=48&&n<=57||n===94||n===126||n===62||n===60||n===61||n===42||n===124)return!0;if(n===118||n===86){let t=e.charCodeAt(1);return t>=48&&t<=57}return!1}function _p(e){let n=e.trim();if(n.length===0)return[];let t=n.indexOf("@",1);if(t<=0)return[];let o=n.slice(0,t),r=n.slice(t+1);if(o.length===0)return[];for(let l of Ip)if(r.startsWith(l))return[];if(!r.startsWith("npm:"))return[o];let s=r.slice(4),a=s.indexOf("@",1);if(a>0){let l=s.slice(0,a);return l.length>0?[l]:[o]}return s.length===0||Ap(s)?[o]:[o,s]}function Np(e){if(lt(e))return e.slice(0,-1);let n=0;for(let t=0;t<e.length-1;t+=1){let o=e.charCodeAt(t);if(o===34||o===39){n===0?n=o:n===o&&(n=0);continue}if(n===0&&o===58&&e.charCodeAt(t+1)===32)return e.slice(0,t)}return null}function Rp(e){let n=e.replaceAll('"',"").replaceAll("'",""),t=[];for(let o of n.split(",")){let r=o.trim();r.length>0&&t.push(r)}return t}function Pp(e){let n=e.charCodeAt(0)===65279?e.slice(1,64):e.slice(0,64),t="# yarn lockfile v";if(!n.startsWith(t))return null;let o=t.length;for(;o<n.length&&o<t.length+3;){let s=n.charCodeAt(o);if(s<48||s>57)break;o+=1}let r=n.slice(t.length,o);return r.length>0?r:null}function Ca(e){if(!e.startsWith("version"))return null;let n=e.charCodeAt(7);if(n!==58&&n!==32)return null;let t=rn(e.slice(8).trim());return t.length>0?t:null}function jr(e,n={}){let t=[],o=[],r=new Set,s=n.maxEntries??2e5,a=!1,l=null,i=!1,d=[],u=!1,p=-1,f=!1,m=0,g=()=>{d.length>0&&!u&&(m+=1)},y=Rt(e,n,(w,A)=>{if(w===0){g(),d=[],u=!1,p=-1,i=!1;let h=Np(A);if(h===null)return;let S=rn(h.trim());if(S==="__metadata"){a=!0,i=lt(A);return}for(let _ of Rp(S))d.push(..._p(_));return}if(i){if(w===2&&l===null){let h=Ca(A);h!==null&&(l=h)}return}if(d.length===0||(p===-1&&(p=w),w!==p||u))return;let k=Ca(A);if(k!==null){u=!0;for(let h of d){let S=JSON.stringify([h,k]);if(!r.has(S)){if(o.length>=s){f=!0;return}r.add(S),o.push({name:h,version:k,lockKey:Pt(h),dev:!1})}}}});g();let b=a?"yarn.lock (Berry)":"yarn.lock (v1)";if(y.refusedAnchors)return{deps:[],diagnostics:[`${b} uses YAML anchors/aliases (& / * / <<:); cupel refuses to expand them (expansion-bomb shape) and did NOT read the dependency set`],truncated:!1};y.oversizeLines>0&&t.push(`${b} has ${String(y.oversizeLines)} over-long line(s) that were not parsed; the dependency set is incomplete`),f&&t.push(`${b} exceeds ${String(s)} entries; truncated`);let x=l??Pp(e),I=x===null?null:Number(x.split(".")[0]);return x!==null&&(I===null||!Number.isInteger(I)||I<1||I>8)&&t.push(`${b} declares unsupported lockfileVersion ${x} (cupel knows v1 and Berry 4-8); its shape may differ, so what was read may be incomplete`),m>0&&t.push(`${b} has ${String(m)} entr(ies) with no version cupel could read (an unusual body shape or a missing \`version\`); they were not enumerated`),{deps:o,diagnostics:t,truncated:y.truncated||f}}function Br(e){let n=e.trim(),t=n.indexOf("(");t!==-1&&(n=n.slice(0,t));let o=n.indexOf("_");return o!==-1&&(n=n.slice(0,o)),n.trim()}function Kr(e){let n=e.charCodeAt(0);return e.length>0&&n>=48&&n<=57}function Ma(e){let n=rn(e.trim());if(n.length===0)return null;let t=n.indexOf("(");t!==-1&&(n=n.slice(0,t));let o=n.charCodeAt(0)===47;if(o&&(n=n.slice(1)),n.length===0)return null;if(!o&&n.charCodeAt(0)!==64){let u=n.indexOf("/"),p=n.indexOf("@",1);u>0&&(p===-1||u<p)&&n.slice(0,u).includes(".")&&n.indexOf("/",u+1)!==-1&&(n=n.slice(u+1))}let r=n.charCodeAt(0)===64,s=r?n.indexOf("/"):-1;if(r&&s<=0)return null;let a=r?s+1:0,l=-1;for(let u=a;u<n.length;u+=1){let p=n.charCodeAt(u);if(p===47||p===64){l=u;break}}if(l<=a)return null;let i=n.slice(0,l),d=Br(n.slice(l+1));return Kr(d)?{name:i,version:d}:null}var $p=new Set(["packages","snapshots","importers"]),Op=new Set([5,6,7,8,9]);function Cp(e){let n=rn(e.trim()),t=0;for(;t<n.length&&n.charCodeAt(t)>=48&&n.charCodeAt(t)<=57;)t+=1;return t===0||t>6?null:Number(n.slice(0,t))}function _o(e){let n=e.indexOf(":");if(n<=0)return null;let t=e.slice(n+1).trim();return t.length===0?null:{key:rn(e.slice(0,n).trim()),value:rn(t)}}function Ur(e,n={}){let t=[],o=[],r=new Set,s=n.maxEntries??2e5,a="",l=null,i=!1,d=0,u=[],p=(m,g)=>{let y=JSON.stringify([m,g]);if(!r.has(y)){if(o.length>=s){i=!0;return}r.add(y),o.push({name:m,version:g,lockKey:Pt(m),dev:!1})}},f=Rt(e,n,(m,g)=>{if(m===0){let y=ko(g);if(a=y===null?"":rn(y.trim()),l=null,a==="lockfileVersion"){let b=_o(g),x=b===null?null:Cp(b.value);b!==null&&(x===null||!Op.has(x))&&u.push(`pnpm-lock.yaml declares unsupported lockfileVersion ${b.value} (cupel knows 5.x-9.x); its shape may differ, so what was read may be incomplete`),a="";return}if($p.has(a)&&!lt(g)){let b=_o(g)?.value.trim()??"";b!=="{}"&&b!=="[]"&&(d+=1),a=""}return}if(a==="packages"||a==="snapshots"){if(m!==2)return;let y=ko(g),b=y===null?null:Ma(y);if(b===null){d+=1;return}p(b.name,b.version);return}if(a==="importers"){if(m===6){let y=_o(g);if(y===null){l=g.endsWith(":")?rn(g.slice(0,-1).trim()):null;return}l=null;let b=Br(y.value);Kr(b)&&p(y.key,b);return}if(m===8&&l!==null){let y=_o(g);if(y===null||y.key!=="version")return;let b=Br(y.value);Kr(b)&&p(l,b)}}});return f.refusedAnchors?{deps:[],diagnostics:["pnpm-lock.yaml uses YAML anchors/aliases (& / * / <<:); cupel refuses to expand them (expansion-bomb shape) and did NOT read the dependency set"],truncated:!1}:(t.push(...u),f.oversizeLines>0&&t.push(`pnpm-lock.yaml has ${String(f.oversizeLines)} over-long line(s) that were not parsed; the dependency set is incomplete`),i&&t.push(`pnpm-lock.yaml exceeds ${String(s)} entries; truncated`),d>0&&t.push(`pnpm-lock.yaml has ${String(d)} entr(ies) with no registry name@version key (git/tarball/link); they were not enumerated`),{deps:o,diagnostics:t,truncated:f.truncated||i})}function La(e){return e.toLowerCase().replace(/[-_.]+/gu,"-")}var Mp=1e6,Ta=2e5,Tp=4096,Dp=65536,Lp=262144,Ot=/^[A-Za-z_][A-Za-z0-9_]*$/u;function Fa(e){if(e.length>Mp)return null;let n,t;for(let o of e.split(/\r?\n/u)){if(o==="")break;let r=/^([A-Za-z][A-Za-z0-9-]*):[ \t]*(.*)$/u.exec(o);if(r===null)continue;let s=r[1]?.toLowerCase();s==="name"&&n===void 0?n=r[2]?.trim():s==="version"&&t===void 0&&(t=r[2]?.trim())}return n===void 0||t===void 0||n===""||t===""?null:{name:n,version:t}}function ja(e){return e.split(/\r?\n/u).map(n=>n.trim()).filter(n=>n.length>0&&Ot.test(n))}function Ba(e){if(!e.startsWith('"'))return e.split(",")[0]??"";let n="";for(let t=1;t<e.length;t+=1){let o=e[t];if(o==='"'){if(e[t+1]==='"'){n+='"',t+=1;continue}return n}n+=o}return n}function Ka(e){return e===""||e==="."||e===".."||e==="__pycache__"||e.startsWith("__editable__")||e.endsWith(".dist-info")||e.endsWith(".egg-info")||e.endsWith(".data")}function Ua(e){return e.endsWith(".py")?e.slice(0,-3):e.endsWith(".so")||e.endsWith(".pyd")?e.split(".")[0]??null:null}function za(e){let n=e.split(/\r?\n/u);return n.length>Ta?n.slice(0,Ta):n}function Wa(e){let n=new Set;for(let t of za(e)){if(t==="")continue;let o=Ba(t).split("/"),r=o[0]??"";if(Ka(r))continue;if(o.length>1){Ot.test(r)&&n.add(r);continue}let s=Ua(r);s!==null&&Ot.test(s)&&n.add(s)}return[...n].sort((t,o)=>t<o?-1:t>o?1:0)}function Fp(e){let n=e.split("/"),t=n[0]??"";if(Ka(t))return null;let o=n[n.length-1]??"",r=Ua(o);if(r===null)return null;let s=n.slice(0,-1);if(s.some(l=>!Ot.test(l)||l==="__pycache__"))return null;let a=r==="__init__"?s:[...s,r];return a.length===0||!Ot.test(r==="__init__"?s[s.length-1]??"":r)?null:a}function Va(e,n=Tp){let t=new Set,o=0,r=0,s=!1;for(let a of za(e)){if(a==="")continue;let l=Ba(a),i=Fp(l);if(i!==null){o+=1,(l.endsWith(".so")||l.endsWith(".pyd"))&&(r+=1);for(let d=1;d<=Math.min(2,i.length);d+=1){let u=i.slice(0,d).join(".");if(!t.has(u)){if(t.size>=n){s=!0;break}t.add(u)}}}}return{prefixes:[...t].sort((a,l)=>a<l?-1:a>l?1:0),moduleFiles:o,extensionModules:r,capped:s}}function jp(e){if(e.length>Lp)return!0;let n=!1;for(let t of e.split(/\r?\n/u)){let o=t.trim();if(!(o===""||o.startsWith("#")||o.startsWith(";"))){if(o.startsWith("[")){let r=o.slice(1,o.endsWith("]")?-1:void 0).trim();n=r==="console_scripts"||r==="gui_scripts";continue}if(n&&o.includes("="))return!0}}return!1}function qa(e){if(e.length>Dp)return null;let n;try{n=JSON.parse(e)}catch{return null}if(typeof n!="object"||n===null||Array.isArray(n))return null;let t=n,o=typeof t.dir_info=="object"&&t.dir_info!==null&&!Array.isArray(t.dir_info)?t.dir_info:null;return{url:typeof t.url=="string"?t.url:null,editable:o?.editable===!0}}function Ct(e,n){let t=Fa(e);if(t===null)return null;let o=n.topLevelText!==void 0?ja(n.topLevelText):[],r=o.length>0?o:n.recordText!==void 0?Wa(n.recordText):[],s=n.recordText!==void 0?Va(n.recordText):{prefixes:[],moduleFiles:0,extensionModules:0,capped:!1},a=n.entryPointsText!==void 0?jp(n.entryPointsText)?"declared":"none":n.entryPointsUnknown===!0?"unknown":"none",l=n.directUrlText!==void 0?qa(n.directUrlText)?.editable??!1:!1;return{name:La(t.name),version:t.version,importNames:r,modulePrefixes:s.prefixes,moduleFiles:s.moduleFiles,editable:l,consoleScripts:a,extensionModules:s.extensionModules,recordKnown:n.recordText!==void 0}}function Da(e,n,t){let o=e.get(n);o===void 0?e.set(n,[t]):o.includes(t)||o.push(t)}function zr(e){let n=new Map,t=new Map,o=[];for(let r of e){if(r.importNames.length===0){o.push(r);continue}for(let s of r.importNames)Da(n,s,r);for(let s of r.modulePrefixes)Da(t,s,r)}return{byImportName:n,byModulePrefix:t,unmapped:o}}function No(e,n){let t=n.split(".").filter(r=>r.length>0),o=t[0];if(o===void 0)return[];for(let r=Math.min(2,t.length);r>=1;r-=1){let s=e.byModulePrefix.get(t.slice(0,r).join("."));if(s!==void 0&&s.length>0)return s}return e.byImportName.get(o)??[]}import{statSync as im}from"node:fs";import am from"node:path";import{lstatSync as Bp,readFileSync as Kp,readdirSync as Up,realpathSync as Wr,statSync as Mt}from"node:fs";import Se from"node:path";function Tt(e){return e.ecosystem==="PyPI"||e.alsoPython===!0}var Ya=2e4,Ja=32,Za=256,zp=2*1024*1024,Wp=256*1024,Qa=256,Vp=16,qp=["package-lock.json","npm-shrinkwrap.json","yarn.lock","pnpm-lock.yaml"],Gp=["pyproject.toml","setup.py","setup.cfg"],Hp=["requirements.txt","Pipfile"],Xp=["uv.lock","poetry.lock","Pipfile.lock","pdm.lock"],el={roots:[],observations:[],budget:"not-attempted",counts:{dirsWalked:0,manifestsSeen:0,rootsAdmitted:0,dotDirectoriesSkipped:0}};function Ga(e,n){try{let t=Mt(e);return!t.isFile()||t.size>n?null:Kp(e,"utf8")}catch{return null}}function Rn(e){let n;try{n=Mt(e)}catch(t){return t?.code==="ENOENT"?"absent":"refused"}return n.isFile()?"regular":"refused"}function Yp(e){try{return Mt(e).isDirectory()}catch{return!1}}function Jp(e,n){let t=0,o=0,r=-1,s=0;for(;o<n.length;)if(t<e.length&&(e.charAt(t)==="?"||e.charAt(t)===n.charAt(o)))t+=1,o+=1;else if(t<e.length&&e.charAt(t)==="*")r=t,s=o,t+=1;else if(r>=0)t=r+1,s+=1,o=s;else return!1;for(;t<e.length&&e.charAt(t)==="*";)t+=1;return t===e.length}function Zp(e,n){let t=(o,r)=>{if(o===e.length)return r===n.length;let s=e[o]??"";if(s==="**"){for(let l=r;l<=n.length;l+=1)if(t(o+1,l))return!0;return!1}if(r>=n.length)return!1;let a=n[r]??"";return(s.includes("*")||s.includes("?")?Jp(s,a):s===a)?t(o+1,r+1):!1};return t(0,0)}function Qp(e){let n=[],t=Ga(Se.join(e,"package.json"),zp);if(t!==null)try{let a=JSON.parse(t)?.workspaces;if(Array.isArray(a))for(let l of a)typeof l=="string"&&n.push(l);else if(typeof a=="object"&&a!==null){let l=a.packages;if(Array.isArray(l))for(let i of l)typeof i=="string"&&n.push(i)}}catch{}let o=Ga(Se.join(e,"pnpm-workspace.yaml"),Wp);o!==null&&n.push(...em(o));let r=[];for(let s of n){if(r.length>=Qa)break;let a=s.trim();if(a.length===0)continue;for(;a.startsWith("./");)a=a.slice(2);if(a.startsWith("/")||Se.isAbsolute(a))continue;let l=a.split("/").filter(i=>i.length>0);l.length===0||l.length>Vp||l.includes("..")||r.push(l.join("/"))}return r}function em(e){let n=[],t=!1;for(let o of e.split(`
-`)){if(n.length>=Qa)break;if(/^packages:\s*(#.*)?$/.test(o)){t=!0;continue}if(!t)continue;let r=/^\s+-\s*(.*?)\s*$/.exec(o);if(r===null){o.trim().length>0&&(t=!1);continue}let s=(r[1]??"").trim(),a=s.indexOf(" #");a>=0&&(s=s.slice(0,a).trim()),(s.startsWith('"')&&s.endsWith('"')&&s.length>=2||s.startsWith("'")&&s.endsWith("'")&&s.length>=2)&&(s=s.slice(1,-1)),s.length>0&&n.push(s)}return n}function Ha(e,n){let t=Se.relative(n,e);return t.length===0?!1:t.split(Se.sep).includes("node_modules")}function Xa(e,n){return Se.relative(e,n).split(Se.sep).join("/")}function Vr(e,n){let t=n?.maxDirs??Ya,o=n?.maxDepth??Ja,r=n?.maxRoots??Za,s=n?.discoverPythonRoots??!0,a;try{a=Wr(e)}catch{return{...el,observations:[{kind:"refused-unreadable",rel:""}]}}let l=[],i=[],d=new Set([a]),u=0,p=0,f=0,m="complete",g=Qp(a).map(w=>w.split("/")),y=w=>{let A="absent";for(let h of Gp){let S=Rn(Se.join(w,h));if(S==="regular"){A="declared";break}S==="refused"&&(A="refused")}if(A==="absent"&&Hp.some(h=>Rn(Se.join(w,h))==="regular")&&(A="listed"),A==="absent")return{candidate:A,witnesses:[]};let k=[];return Xp.some(h=>Rn(Se.join(w,h))==="regular")&&k.push("own-lockfile"),Yp(Se.join(w,".venv"))&&k.push("installed-env"),{candidate:A,witnesses:k}},b=(w,A)=>{let k=y(w);return k.candidate==="absent"?"not-root":(k.candidate!=="listed"&&(p+=1),k.witnesses.length===0&&k.candidate!=="refused"?(k.candidate==="declared"&&i.push({kind:"undeclared-manifest",rel:A}),"not-root"):l.length>=r?"exhausted":(l.push({rel:A,abs:w,witnesses:k.witnesses,manifestRefused:k.candidate==="refused",ecosystem:"PyPI"}),"root"))},x=(w,A)=>{if(A.length===0){let P=Rn(Se.join(w,"package.json"))!=="absent",v=s?y(w):{candidate:"absent",witnesses:[]};return!P&&v.candidate!=="absent"?(l.push({rel:"",abs:w,witnesses:["scan-root",...v.witnesses],manifestRefused:!1,ecosystem:"PyPI"}),"root"):(l.push({rel:"",abs:w,witnesses:["scan-root",...v.witnesses],manifestRefused:!1,...v.witnesses.length>0?{alsoPython:!0}:{}}),"root")}let k=Rn(Se.join(w,"package.json"));if(k==="absent")return s?b(w,A):"not-root";p+=1;let h=[],S=A.split("/");g.some(P=>Zp(P,S))&&h.push("workspace-declared"),qp.some(P=>Rn(Se.join(w,P))==="regular")&&h.push("own-lockfile");let _=s?y(w):{candidate:"absent",witnesses:[]};for(let P of _.witnesses)h.includes(P)||h.push(P);return h.length===0&&k!=="refused"?(i.push({kind:"undeclared-manifest",rel:A}),"not-root"):l.length>=r?"exhausted":(l.push({rel:A,abs:w,witnesses:h,manifestRefused:k==="refused",..._.witnesses.length>0?{alsoPython:!0}:{}}),"root")},I=[{abs:a,rel:"",depth:0}];for(;I.length>0;){let w=I.pop();if(w===void 0)break;if(u>=t){m="dirs-exhausted";break}u+=1;let A=x(w.abs,w.rel);if(A==="exhausted"){m="roots-exhausted";break}let k=A==="root";if(w.depth>=o){m=m==="complete"?"depth-clamped":m;continue}let h;try{h=Up(w.abs)}catch{i.push({kind:"refused-unreadable",rel:w.rel});continue}h.sort().reverse();for(let S of h){let _=Se.join(w.abs,S),P=w.rel.length===0?S:`${w.rel}/${S}`,v;try{let j=Bp(_);v=j.isDirectory()||j.isSymbolicLink()&&Mt(_).isDirectory()}catch{continue}if(!v)continue;if(S==="node_modules"){k||i.push({kind:"unenumerated-install",rel:P});continue}if(S.startsWith(".")){f+=1,i.push({kind:"skipped-dot-directory",rel:P}),Rn(Se.join(_,"package.json"))!=="absent"&&i.push({kind:"undeclared-manifest",rel:P});continue}let T;try{T=Wr(_)}catch{i.push({kind:"refused-unreadable",rel:P});continue}let N=a.endsWith(Se.sep)?a:a+Se.sep;if(T!==a&&!T.startsWith(N)){i.push({kind:"refused-out-of-root",rel:P});continue}Ha(T,a)||d.has(T)||(d.add(T),I.push({abs:T,rel:Xa(a,T),depth:w.depth+1}))}}for(let w of n?.operatorRoots??[]){let A=typeof w=="string"?w.slice(0,512):"",k=()=>{i.push({kind:"refused-operator-root",rel:A})};if(A.length===0||A.includes("\0")){k();continue}let h;try{h=Wr(Se.resolve(a,A))}catch{k();continue}let S=a.endsWith(Se.sep)?a:a+Se.sep;if(h!==a&&(!h.startsWith(S)||Ha(h,a))){k();continue}let _;try{_=Mt(h).isDirectory()}catch{_=!1}if(!_||Rn(Se.join(h,"package.json"))!=="regular"){k();continue}let P=l.findIndex(N=>N.abs===h);if(P>=0){let N=l[P];N!==void 0&&!N.witnesses.includes("operator")&&(l[P]={...N,witnesses:[...N.witnesses,"operator"]});continue}let v=Xa(a,h);l.push({rel:v,abs:h,witnesses:["operator"],manifestRefused:!1});let T=i.findIndex(N=>N.kind==="undeclared-manifest"&&N.rel===v);T>=0&&i.splice(T,1)}return l.sort((w,A)=>w.rel<A.rel?-1:w.rel>A.rel?1:0),i.sort((w,A)=>w.kind!==A.kind?w.kind<A.kind?-1:1:w.rel<A.rel?-1:w.rel>A.rel?1:0),{roots:l,observations:i,budget:m,counts:{dirsWalked:u,manifestsSeen:p,rootsAdmitted:l.length,dotDirectoriesSkipped:f}}}import{lstatSync as nl,readdirSync as nm,readFileSync as tm,realpathSync as rl,statSync as sl}from"node:fs";import We from"node:path";var sn={envDir:".venv",maxDistributions:2e4,maxMetadataBytes:1e6,maxRecordBytes:32*1024*1024,maxTopLevelBytes:256*1024,maxDirectUrlBytes:64*1024,maxPyvenvCfgBytes:64*1024,maxEntryPointsBytes:256*1024,maxPthBytes:256*1024,maxPthPaths:1024},om=/^python\d+\.\d+$/u;function Pn(e,n){let t;try{t=sl(e)}catch(o){return{why:o?.code==="ENOENT"?"absent":"unreadable"}}if(!t.isFile())return{why:"not-regular"};if(t.size>n)return{why:"oversize"};try{return{text:tm(e,"utf8")}}catch{return{why:"unreadable"}}}function qr(e,n){let t;try{if(t=rl(n),!sl(t).isDirectory())return null}catch{return null}return t===e||t.startsWith(e+We.sep)?t:null}function tl(e,n){return We.relative(e,n).split(We.sep).join("/")}function ol(e){try{return nm(e).sort()}catch{return null}}function rm(e){let n=[],t=[],o=0;for(let r of e.split(/\r?\n/u)){let s=r.trim();if(!(s===""||s.startsWith("#"))){if(/^import[ \t]/u.test(s)){o+=1;let a=/^import[ \t]+([A-Za-z_][A-Za-z0-9_.]*)/u.exec(s);a?.[1]!==void 0&&t.length<sn.maxPthPaths&&t.push(a[1]);continue}n.length<sn.maxPthPaths&&n.push(s)}}return{paths:n,importLines:o,importModules:t}}function sm(e){let n=null;for(let t of e.split(/\r?\n/u)){let o=/^\s*(version_info|version)\s*=\s*(\S+)\s*$/u.exec(t);if(o!==null){if(o[1]==="version_info")return o[2]??null;n??=o[2]??null}}return n}function Dt(e,n){let t=n?.envDir??sn.envDir,o=n?.maxDistributions??sn.maxDistributions,r=n?.maxMetadataBytes??sn.maxMetadataBytes,s=n?.maxRecordBytes??sn.maxRecordBytes,a=n?.maxTopLevelBytes??sn.maxTopLevelBytes,l=n?.maxDirectUrlBytes??sn.maxDirectUrlBytes,i=sn.maxEntryPointsBytes,d=t,u=[],p=(P,v,T=null)=>({envRel:d,refused:P,sitePackages:[],interpreter:T,distInfos:[],pthFiles:[],unreadable:0,diagnostics:[...u,v],truncated:!1}),f;try{f=rl(e)}catch{return p("absent","the root itself could not be resolved")}let m=We.join(f,t),g;try{g=nl(m)}catch(P){return P?.code==="ENOENT"?p("absent",`${d}: absent`):p("not-a-directory",`${d}: could not be inspected`)}if(!g.isDirectory()&&!g.isSymbolicLink())return p("not-a-directory",`${d}: not a directory`);let y=qr(f,m);if(y===null)return p("escapes-root",`${d}: resolves outside the project root (a symlinked environment is not the project's); refused, never followed`);let b=Pn(We.join(y,"pyvenv.cfg"),sn.maxPyvenvCfgBytes),x="text"in b?sm(b.text):null;"text"in b||u.push(`${d}/pyvenv.cfg: ${b.why} \u2014 interpreter version unknown`);let I=[];for(let P of["lib","lib64"]){let v=ol(We.join(y,P));if(v!==null)for(let T of v)om.test(T)&&I.push(We.join(y,P,T,"site-packages"))}I.push(We.join(y,"Lib","site-packages"));let w=[],A=new Set;for(let P of I){let v=qr(y,P);v===null||A.has(v)||(A.add(v),w.push(v))}if(w.length===0)return p("no-site-packages",`${d}: no site-packages directory (lib/pythonX.Y/site-packages or Lib/site-packages)`,x);w.length>1&&u.push(`${d}: ${String(w.length)} site-packages directories; all enumerated`);let k=[],h=[],S=0,_=!1;e:for(let P of w){let v=tl(f,P),T=ol(P);if(T===null){u.push(`${v}: unreadable; nothing enumerated there`);continue}for(let N of T){let j=We.join(P,N),O=N.endsWith(".dist-info"),F=N.endsWith(".egg-info");if(N.endsWith(".pth")){let G=Pn(j,sn.maxPthBytes);if(!("text"in G)){u.push(`${v}/${N}: ${G.why}; the paths it adds were NOT enumerated`);continue}h.push({name:N,sitePackages:v,...rm(G.text)});continue}if(!O&&!F)continue;if(k.length>=o){_=!0,u.push(`${v}: the distribution cap (${String(o)}) was hit at ${N}; the enumeration is INCOMPLETE`);break e}let K;try{K=nl(j)}catch{S+=1,u.push(`${v}/${N}: could not be inspected; not enumerated`);continue}let te=O?"dist-info":"egg-info";if(K.isFile()&&F){let G=Pn(j,r);"text"in G?k.push({dir:N,kind:te,metadata:G.text,entryPointsUnknown:!0}):(S+=1,u.push(`${v}/${N}: ${G.why}; not enumerated`));continue}let U=qr(y,j);if(U===null){S+=1,u.push(`${v}/${N}: not a directory inside the environment; not enumerated`);continue}let X=O?"METADATA":"PKG-INFO",D=Pn(We.join(U,X),r);if(!("text"in D)){S+=1,u.push(`${v}/${N}: ${X} ${D.why}; not enumerated`);continue}let C={dir:N,kind:te,metadata:D.text},H=Pn(We.join(U,"entry_points.txt"),i);"text"in H?C.entryPoints=H.text:H.why!=="absent"&&(C.entryPointsUnknown=!0,u.push(`${v}/${N}/entry_points.txt: ${H.why}; the commands it declares are UNKNOWN`));let J=Pn(We.join(U,"top_level.txt"),a);if("text"in J?C.topLevel=J.text:J.why!=="absent"&&u.push(`${v}/${N}/top_level.txt: ${J.why}; ignored`),O){let G=Pn(We.join(U,"RECORD"),s);"text"in G?C.record=G.text:u.push(`${v}/${N}/RECORD: ${G.why}; import names from top_level.txt only`);let Y=Pn(We.join(U,"direct_url.json"),l);"text"in Y&&(C.directUrl=Y.text)}k.push(C)}}return{envRel:d,refused:null,sitePackages:w.map(P=>tl(f,P)),interpreter:x,distInfos:k,pthFiles:h,unreadable:S,diagnostics:u,truncated:_}}var lm=["uv.lock","poetry.lock","Pipfile.lock","pdm.lock"];function dm(e,n){for(let t of n)try{if(im(am.join(e,t)).isFile())return t}catch{}return null}function il(e){let n=[],t=[],o=(p,f)=>{t.push({kind:p,detail:f,blindsAnalysis:!1,rootRel:""}),n.push(f)},r=dm(e,lm),s=Dt(e);if(s.refused!==null){let p=s.refused==="absent"?`no \`${s.envRel}\` is installed`:`\`${s.envRel}\` could not be read (${s.refused})`;return o("no-installed-env",`${r??"the Python manifest"} declares a dependency set but ${p}: ZERO distributions were enumerated, so this scan reports nothing about Python dependencies \u2014 it is not a clean bill of health. Install the environment (\`uv sync\`) and re-scan.`),{packages:[],source:"none",lockfilePath:r,diagnostics:[...n,...s.diagnostics],truncated:!1,gaps:t}}let a=[],l=new Set,i=[],d=0;for(let p of s.distInfos){let f=Ct(p.metadata,{...p.topLevel!==void 0?{topLevelText:p.topLevel}:{},...p.record!==void 0?{recordText:p.record}:{},...p.directUrl!==void 0?{directUrlText:p.directUrl}:{}});if(f===null){d+=1,n.push(`${p.dir}: METADATA carries no Name/Version; not enumerated`);continue}let m=JSON.stringify([f.name,f.version]);l.has(m)||(l.add(m),f.importNames.length===0&&i.push(f.name),a.push({name:f.name,version:f.version,lockKey:"",dev:!1,declaredIn:"",ecosystem:"PyPI"}))}n.push(...s.diagnostics);let u=s.unreadable+d;return u>0&&o("installed-env-partial",`${String(u)} entr${u===1?"y":"ies"} under ${s.sitePackages.join(", ")} could not be read as a distribution (see the diagnostics): those distributions are MISSING from this scan; the ${String(a.length)} enumerated were assessed normally.`),s.truncated&&o("installed-env-partial",`the environment walk under ${s.sitePackages.join(", ")} hit its distribution cap: the enumeration is INCOMPLETE, and a partial (possibly false-clean) set is never reported.`),i.length>0&&n.push(`${String(i.length)} distribution(s) carry no import name (distribution-unmapped, Tier-B): ${i.slice(0,5).join(", ")}${i.length>5?", \u2026":""} \u2014 advisories on them are enumerated; their modules cannot be resolved (ADR-109 D5)`),{packages:a,source:a.length>0?"installed-env":"none",lockfilePath:r,diagnostics:n,truncated:s.truncated,gaps:t}}var cm=128*1024*1024,um=[{file:"package-lock.json",source:"npm-lockfile",parse:(e,n)=>Io(e,n===void 0?{}:{maxEntries:n})},{file:"npm-shrinkwrap.json",source:"npm-lockfile",parse:(e,n)=>Io(e,n===void 0?{}:{maxEntries:n})},{file:"yarn.lock",source:"yarn-lockfile",parse:(e,n)=>jr(e,n===void 0?{}:{maxEntries:n})},{file:"pnpm-lock.yaml",source:"pnpm-lockfile",parse:(e,n)=>Ur(e,n===void 0?{}:{maxEntries:n})}],fm=[".pnp.cjs",".pnp.data.json",".pnp.js"];function Xr(e,n){let t;try{t=Hr(an.join(e,n))}catch{return null}let o=e.endsWith(an.sep)?e:e+an.sep;return t.startsWith(o)?t:null}function ll(e,n){let t=an.join(e,"package.json"),o;try{o=Hr(t)}catch{return null}if(!o.startsWith(n+an.sep))return null;try{if(!Lt(o).isFile())return null;let r=JSON.parse(Gr(o,"utf8"));return typeof r.name!="string"||typeof r.version!="string"?null:{name:r.name,version:r.version}}catch{return null}}function dl(e,n){try{return Lt(an.join(e,n)),!0}catch{return!1}}function pm(e,n){if(dl(e,"pnpm-workspace.yaml"))return!0;let t=Xr(e,"package.json");if(t===null)return dl(e,"package.json");let o;try{let a=Lt(t);if(!a.isFile()||a.size>n)return!0;o=Gr(t,"utf8")}catch{return!0}let r;try{r=JSON.parse(o)}catch{return!0}for(let a of["dependencies","devDependencies","optionalDependencies","peerDependencies"]){let l=r[a];if(typeof l=="object"&&l!==null&&Object.keys(l).length>0)return!0}let s=r.workspaces;return Array.isArray(s)?s.length>0:typeof s=="object"&&s!==null}function cl(e,n){let t=an.join(e,"node_modules"),o=[],r;try{r=al(t,{withFileTypes:!0})}catch{return o}for(let s of r){let a=s.name;if(a.startsWith("."))continue;if(a.startsWith("@")){let i;try{i=al(an.join(t,a),{withFileTypes:!0})}catch{continue}for(let d of i){let u=ll(an.join(t,a,d.name),n);u!==null&&o.push({dev:!1,name:u.name,version:u.version,lockKey:`node_modules/${a}/${d.name}`,linked:d.isSymbolicLink()||s.isSymbolicLink()})}continue}let l=ll(an.join(t,a),n);l!==null&&o.push({dev:!1,name:l.name,version:l.version,lockKey:`node_modules/${a}`,linked:s.isSymbolicLink()})}return o}var mm=5;function hm(e,n,t){let o=Xr(e,n);if(o===null){try{Lt(an.join(e,n))}catch{return null}return{gap:`${n} resolves outside the scan root (symlink); refused, not read`}}let r;try{r=Lt(o)}catch{return null}if(!r.isFile())return{gap:`${n} is not a regular file; refused, not read`};if(r.size>t)return{gap:`${n} is ${String(r.size)} bytes (> ${String(t)}); skipped before reading to avoid a memory DoS`};try{return{text:Gr(o,"utf8")}}catch{return{gap:`${n} could not be read`}}}function gm(e,n){let t=Hr(e),o=[],r=[],s=n?.maxLockfileBytes??cm,a=[],l=new Set,i=[],d=pm(t,s),u=null,p=!1,f=(g,y,b)=>{r.push({kind:g,detail:y,blindsAnalysis:b,rootRel:""}),o.push(y)};for(let g of um){let y=hm(t,g.file,s);if(y===null)continue;if("gap"in y){f("lockfile-unreadable",y.gap,!1);continue}let b=g.parse(y.text,n?.maxLockfileEntries);if(b.truncated&&(p=!0),b.deps.length===0){if(b.diagnostics.length>0||d){let x=b.diagnostics.length>0?b.diagnostics.join("; "):"no entries found";f("lockfile-unparsed",`${g.file} yielded NO dependencies (${x}); its transitive dependency set was not enumerated`,!1)}continue}b.diagnostics.length>0&&f("lockfile-partial",`${g.file} was only partly enumerated (${b.diagnostics.join("; ")})`,!1),u===null&&(u=g.file),i.includes(g.source)||i.push(g.source);for(let x of b.deps){let I=JSON.stringify([x.name,x.version,x.lockKey]);l.has(I)||(l.add(I),a.push({...x,declaredIn:g.file}))}}for(let g of fm)if(Xr(t,g)!==null){f("yarn-pnp",`${g} present: this project uses Yarn Plug'n'Play, whose dependency code lives in zips cupel does not resolve or read \u2014 NO dependency code was analyzed, so no finding here can be read as not-reachable. Set \`nodeLinker: node-modules\` for a full scan.`,!0);break}if(a.length>0){let g=i.length===1?i[0]??"none":"multi-lockfile";i.length>1&&o.push(`multiple lockfiles present (${i.join(", ")}); enumerated the UNION of all of them`);let y=new Set(a.map(I=>JSON.stringify([I.name,I.version]))),b=new Set,x=[];for(let I of cl(t,t)){let w=JSON.stringify([I.name,I.version,I.lockKey]);l.has(w)||(l.add(w),a.push({name:I.name,version:I.version,lockKey:I.lockKey,dev:I.dev,declaredIn:""}));let A=JSON.stringify([I.name,I.version]);I.linked||y.has(A)||b.has(A)||(b.add(A),x.length<mm&&x.push($t(I.name,I.version)))}if(b.size>0){let I=b.size-x.length;f("lockfile-skew",`node_modules holds ${String(b.size)} package(s) at a (name, version) no lockfile lists (${x.join(", ")}${I>0?`, and ${String(I)} more`:""}): ${u??"the lockfile"} and the installed tree DISAGREE, so cupel enumerated BOTH. A stale lockfile or an \`npm i --no-save\` is the usual cause \u2014 re-install and commit the lockfile so the reviewed set is the installed set.`,!1)}return{packages:a,source:g,lockfilePath:u,diagnostics:o,truncated:p,gaps:r}}let m=cl(t,t);return m.length>0?(f("shallow-node-modules",`no usable lockfile (package-lock.json / npm-shrinkwrap.json / yarn.lock / pnpm-lock.yaml), so the installed set came from a SHALLOW node_modules scan: ${String(m.length)} top-level package(s), with every transitive dependency missing. Commit a lockfile for a complete scan.`,!1),{packages:m.map(g=>({name:g.name,version:g.version,lockKey:g.lockKey,dev:!1,declaredIn:""})),source:"node-modules",lockfilePath:null,diagnostics:o,truncated:p,gaps:r}):(d&&f("no-enumeration","package.json declares dependencies but there is no lockfile and no readable node_modules: ZERO packages were enumerated, so this scan reports nothing about dependencies \u2014 it is not a clean bill of health. Install the project (or commit a lockfile) and re-scan.",!1),{packages:[],source:"none",lockfilePath:null,diagnostics:o,truncated:p,gaps:r})}function ym(e){return e.rel===""||e.witnesses.includes("own-lockfile")||e.witnesses.includes("operator")||e.witnesses.includes("installed-env")||e.manifestRefused}function xm(e){if(e.length===0||e==="."||e==="..")return!1;for(let n=0;n<e.length;n+=1){let t=e.charCodeAt(n);if(t<32||t===127||t>=128&&t<=159||t===92)return!1}return!0}function fl(e){return e===""||e.split("/").every(xm)}function Sm(e,n){if(e===""||n==="")return n;if(!fl(e))return"";let t=`${e}/${n}`;return t.length<=vo?t:""}function ul(e,n){return e===""?n:`${e}: ${n}`}function bm(e){return{rel:"",abs:e,witnesses:["scan-root"],manifestRefused:!1}}function pl(e,n,t){let o=t?.maxUnionEntries??wo,r=n.roots.filter(ym),s=r.some(g=>g.rel==="")?r:[bm(e),...r],a=[],l=[],i=new Set,d=[],u=[],p=!1,f=!1;for(let g of s){let y=g.rel===""?e:g.abs,b=gm(y,t),x=Tt(g)?il(y):null,I=x===null?b:wm(b,x),w=I.diagnostics.map(k=>ul(g.rel,k));!fl(g.rel)&&I.packages.length>0&&w.push(`${g.rel}: its path holds a segment no install key may be built from, so the install location of its ${String(I.packages.length)} row(s) is refused \u2014 dependency-class evidence and execution context for them read fail-closed (ADR-071)`);let A={...I,rootRel:g.rel,...g.ecosystem!==void 0?{ecosystem:g.ecosystem}:{},...x!==null?{pythonLockfilePath:x.lockfilePath===null||g.rel===""?x.lockfilePath:`${g.rel}/${x.lockfilePath}`}:{},packages:I.packages.map(k=>({...k,lockKey:Sm(g.rel,k.lockKey),declaredIn:k.declaredIn===""||g.rel===""?k.declaredIn:`${g.rel}/${k.declaredIn}`})),lockfilePath:I.lockfilePath===null||g.rel===""?I.lockfilePath:`${g.rel}/${I.lockfilePath}`,gaps:I.gaps.map(k=>({...k,rootRel:g.rel,detail:ul(g.rel,k.detail)})),diagnostics:w};a.push(A),I.truncated&&(p=!0);for(let k of A.packages){let h=JSON.stringify([k.name,k.version,k.lockKey]);if(!i.has(h)){if(l.length>=o){f=!0;break}i.add(h),l.push(k)}}d.push(...A.gaps),u.push(...A.diagnostics)}f&&(p=!0,u.push(`the union of installed sets across ${String(s.length)} roots exceeds its ceiling of ${String(o)} distinct rows; truncated \u2014 a partial enumeration is never reported (ADR-071)`));let m=a[0];if(m===void 0)throw new Error("unreachable: the scan root is always enumerated");return{packages:l,source:m.source,lockfilePath:m.lockfilePath,diagnostics:u,truncated:p,gaps:d,perRoot:a}}function km(e,n){let t;for(let o of e.perRoot){if(o.rootRel===""){t??=o;continue}n.startsWith(`${o.rootRel}/`)&&(t===void 0||o.rootRel.length>t.rootRel.length)&&(t=o)}return t}function Ro(e,n){return n.declaredIn!==""?n.declaredIn:km(e,n.lockKey)?.lockfilePath??null}function ml(e,n){let t=e.perRoot.find(o=>o.rootRel===n.rootRel);return Em.has(n.kind)?t?.pythonLockfilePath!==void 0&&t.pythonLockfilePath!==null?t.pythonLockfilePath:n.rootRel===""?null:`${n.rootRel}/pyproject.toml`:t?.lockfilePath!==void 0&&t.lockfilePath!==null?t.lockfilePath:n.rootRel===""?null:`${n.rootRel}/${t?.ecosystem==="PyPI"?"pyproject.toml":"package.json"}`}var Em=new Set(["no-installed-env","installed-env-partial"]);function wm(e,n){return{packages:[...e.packages,...n.packages],source:e.packages.length===0&&n.packages.length>0?n.source:e.source,lockfilePath:e.lockfilePath??n.lockfilePath,diagnostics:[...e.diagnostics,...n.diagnostics],truncated:e.truncated||n.truncated,gaps:[...e.gaps,...n.gaps]}}function hl(e){let n=new Map;for(let t of e){let o=n.get(t.name)??new Set;o.add(t.version),n.set(t.name,o)}return t=>{let o=n.get(t);if(o===void 0)return;let r=[...o].sort();return r.length===1?r[0]:r}}function Ft(e){return new Set(e.map(n=>n.root))}function ct(e,n){let t=Ft(n);return e.roots.filter(o=>!t.has(o.rel)&&(o.rel===""||o.ecosystem!=="PyPI"))}function Yr(e){let n=e.slice(0,8),t=e.length-n.length;return n.join(", ")+(t>0?`, \u2026 and ${String(t)} more`:"")}function Jr(e,n){return ct(e,n).map(t=>({code:"unanalyzed-project-root",path:t.rel===""?".":t.rel,detail:t.rel===""?`the scan root declares no JavaScript entrypoint of its own (${t.witnesses.join(" + ")}) \u2014 its JavaScript, if any, was not analyzed while a nested root's was; pass \`--entry <file>\` or declare \`main\`, else every npm \`not-reachable\` is capped at \`unknown\` (ADR-071)`:`\`${t.rel}\` is a project root (${t.witnesses.join(" + ")}${t.manifestRefused?", manifest refused":""}) whose JavaScript this scan did not analyze; code there can load any installed npm package, so every npm \`not-reachable\` is capped at \`unknown\` until it is analyzed (ADR-071)`}))}function gl(e){let n=[],t=e.observations.filter(o=>o.kind==="unenumerated-install").map(o=>o.rel);if(t.length>0&&n.push({kind:"unenumerated-install",detail:`${String(t.length)} node_modules director${t.length===1?"y":"ies"} under no admitted project root (${Yr(t)}) were not enumerated: packages installed there are MISSING from this scan. The enumerated ones were analyzed normally (ADR-071)`,blindsAnalysis:!1,rootRel:""}),e.budget!=="complete"){let o=e.counts;n.push({kind:"root-discovery-truncated",detail:`root discovery did not finish (${e.budget}: ${String(o.dirsWalked)} dirs walked, ${String(o.rootsAdmitted)} roots admitted) \u2014 a project root with its own install location may have been missed, so every \`not-reachable\` is capped at \`unknown\` (ADR-071 Invariant C)`,blindsAnalysis:!0,rootRel:""})}return n}function yl(e){let n=new Set;for(let t of e)t.blindsAnalysis&&n.add(t.kind==="root-discovery-truncated"?"analysis-cap":"resolution-divergence");return[...n]}import{statSync as mh}from"node:fs";import Gn from"node:path";import{spawnSync as oh}from"node:child_process";import{fileURLToPath as rh}from"node:url";import{readdirSync as vm,realpathSync as xl,statSync as Sl}from"node:fs";import En from"node:path";var bl=32,Im=512,Am=/^[A-Za-z_][A-Za-z0-9_]*$/u,_m=[".so",".pyd",".dylib"],Po=e=>({resolved:e,failure:null}),ut=e=>({resolved:null,failure:e});function Nm(e){if(e.length===0||e.length>Im)return null;let n=e.split(".");return n.length>bl?null:n.every(t=>Am.test(t))?n:null}function Zr(e){try{return Sl(e).isDirectory()}catch{return!1}}function ft(e){try{return Sl(e).isFile()}catch{return!1}}function jt(e,n){let t,o;try{t=xl(n),o=xl(e)}catch{return null}return t===o||t.startsWith(o+En.sep)?t:null}function Rm(e,n){let t;try{t=vm(e)}catch{return null}for(let o of t)if(o.startsWith(`${n}.`)&&_m.some(r=>o.endsWith(r))&&ft(En.join(e,o)))return En.join(e,o);return null}function $n(e,n){let t=Nm(n);if(t===null)return ut("refused");let o=null,r=!1;for(let[s,a]of e.roots.entries()){let l=a,i=!1;for(let y of t.slice(0,-1)){let b=En.join(l,y);if(ft(En.join(b,"__init__.py"))||Zr(b)){if(!Zr(b)){i=!0;break}l=b;continue}i=!0,ft(`${b}.py`)&&(r=!0);break}if(i)continue;let d=t[t.length-1];if(d===void 0)return ut("refused");let u=En.join(l,d,"__init__.py");if(ft(u)){let y=jt(a,u);return y===null?ut("escapes-root"):Po({module:n,kind:"package",path:y,rootIndex:s})}let p=En.join(l,`${d}.py`);if(ft(p)){let y=jt(a,p);return y===null?ut("escapes-root"):Po({module:n,kind:"module",path:y,rootIndex:s})}let f=Rm(l,d);if(f!==null){let y=jt(a,f);return y===null?ut("escapes-root"):Po({module:n,kind:"extension",path:y,rootIndex:s})}let m=En.join(l,d);if(o===null&&Zr(m)){let y=jt(a,m);y!==null&&(o={module:n,kind:"namespace",path:y,rootIndex:s});continue}let g=En.join(l,`${d}.pyi`);if(o===null&&ft(g)){let y=jt(a,g);y!==null&&(o={module:n,kind:"stub-only",path:y,rootIndex:s})}}return o!==null?Po(o):ut(r?"not-a-package":"not-found")}function kl(e,n){if(n)return e;let t=e.lastIndexOf(".");return t===-1?"":e.slice(0,t)}function $o(e,n,t,o){if(t<1||t>bl)return{failure:"refused"};let r=kl(e,n),s=r===""?[]:r.split("."),a=t-1;if(a>s.length)return{failure:"beyond-top-level"};let l=s.slice(0,s.length-a),i=o===null||o===""?[]:o.split("."),d=[...l,...i].join(".");return d===""?{failure:"beyond-top-level"}:{dotted:d}}var Qr="<toplevel>";var Pm=new Set(["self","cls"]),$m=8;function wl(e,n){return{path:e,start:n.start,end:n.end}}function El(e,n){return n!==null?n.includes(e):!e.startsWith("_")}function ns(e,n,t,o){let r=[],s=[],a=[],l=[],i=new Map,d=new Map,u=new Map,p=new Map,f=new Map,m=`${n}#${Qr}`;r.push({id:m,moduleId:n,name:Qr,kind:"function",declRange:{path:t,start:0,end:0},isExported:!1,publicSurfaceReachable:!1});for(let y of e.classes){let b=`${n}#class:${y.qualname}`;u.set(y.qualname,b),f.set(y.qualname,y.bases.filter(x=>x!==null)),s.push({id:b,moduleId:n,name:y.name,implementsRefs:[],members:[]})}for(let y of e.functions){let b=`${n}#${y.qualname}`;i.set(y.qualname,b);let x=y.enclosingClass,I=x===null?void 0:u.get(x),w=x===null&&y.enclosingFunction===null,A=w?El(y.name,e.all):x!==null&&!x.includes(".")?El(x,e.all):!1;if(r.push({id:b,moduleId:n,name:y.name,kind:I!==void 0?y.name==="__init__"?"ctor":"method":"function",...I!==void 0?{enclosingClassId:I}:{},declRange:wl(t,y.range),isExported:A,publicSurfaceReachable:A}),w&&(d.set(y.name,b),A)){let k=o();a.push({id:k,moduleId:n,exportedName:y.name,kind:"value"}),l.push({exportId:k,target:{kind:"function",functionId:b}})}if(x!==null){let k=p.get(x)??new Map;k.set(y.name,b),p.set(x,k)}}let g=s.map(y=>{let b=[...u.entries()].find(([,I])=>I===y.id)?.[0],x=b===void 0?void 0:p.get(b);return x===void 0?y:{...y,members:[...x.values()]}});return{moduleId:n,functions:r,classes:g,exports:a,exportBindings:l,byQualname:i,topLevel:d,classByName:u,methods:p,baseNames:f,toplevelId:m}}function ts(e){let{decls:n,envs:t}=e,o=[],r=new Map;for(let[f,m]of n){let g=t.get(f);for(let[y,b]of m.baseNames){let x=m.classByName.get(y);if(x!==void 0)for(let I of b){let w=Om(I,m,g,n);if(w===void 0)continue;o.push({subclassId:x,superclassId:w,relation:"extends"});let A=r.get(w)??[];A.push(x),r.set(w,A)}}}let s=new Map,a=(f,m)=>{let g=s.get(f)??[];g.includes(m)||g.push(m),s.set(f,g)};for(let f of n.values())for(let m of f.methods.values())for(let[g,y]of m)a(g,y);for(let f of e.rebinds??[]){let m=n.get(f.moduleId)?.topLevel.get(f.target);m!==void 0&&a(f.attr,m)}let l=new Map;for(let f of n.values())for(let m of f.classByName.values())l.set(m,f);let i=[],d=[],u=0,p=0;for(let{moduleId:f,path:m,call:g}of e.pending){let y=n.get(f);if(y===void 0)continue;let b=g.enclosingFunction===null?y.toplevelId:y.byQualname.get(g.enclosingFunction)??y.toplevelId,x=Cm(g,f,y,t.get(f),n,t,{byMethodName:s,subclassesOf:r,classOwner:l}),I=`py-call:${f}:${String(u)}`;u+=1,x.resolution==="unresolved"&&(p+=1),i.push({id:I,enclosingFunctionId:b,calleeExprShape:g.receiver===null?"identifier":"member",resolvedTargetIds:x.ids,resolution:x.resolution,range:wl(m,g.range)});for(let w of x.ids)d.push({callSiteId:I,calleeFunctionId:w,resolution:x.resolution})}return{callSites:i,callEdges:d,inheritEdges:o,unresolved:p}}function es(e,n,t,o,r=new Set,s=0){if(s>$m)return;let a=`${e}${n}`;if(r.has(a))return;r.add(a);let l=t.get(e)?.topLevel.get(n);if(l!==void 0)return l;let i=o.get(e)?.names.get(n);if(i!==void 0)return es(i.moduleId,i.name,t,o,r,s+1)}function Om(e,n,t,o){let r=n.classByName.get(e);if(r!==void 0)return r;let s=t?.names.get(e);if(s!==void 0)return o.get(s.moduleId)?.classByName.get(s.name)}var pt={ids:[],resolution:"unresolved"};function Cm(e,n,t,o,r,s,a){if(e.callee===null)return pt;if(e.receiver===null){let u=t.topLevel.get(e.callee);if(u!==void 0)return{ids:[u],resolution:"resolved"};let p=o?.names.get(e.callee);if(p!==void 0){let f=es(p.moduleId,p.name,r,s);if(f!==void 0)return{ids:[f],resolution:"resolved"}}return pt}let l=e.attr;if(l===null)return pt;if(Pm.has(e.receiver)&&e.enclosingFunction!==null){let u=e.enclosingFunction.split(".").slice(0,-1).join("."),p=t.classByName.get(u);if(p!==void 0){let f=Mm(p,l,a);return f.length===1?{ids:f,resolution:"resolved"}:f.length>1?{ids:f,resolution:"field-based"}:pt}}let i=o?.modules.get(e.receiver);if(i!==void 0){let u=es(i,l,r,s);return u!==void 0?{ids:[u],resolution:"resolved"}:pt}let d=a.byMethodName.get(l)??[];return d.length===0||d.length>64?pt:{ids:d,resolution:"field-based"}}function Mm(e,n,t){let o=[],r=new Set,s=[e];for(;s.length>0;){let a=s.shift();if(a===void 0||r.has(a))continue;r.add(a);let l=t.classOwner.get(a);if(l!==void 0){let i=[...l.classByName.entries()].find(([,u])=>u===a)?.[0],d=i===void 0?void 0:l.methods.get(i)?.get(n);d!==void 0&&!o.includes(d)&&o.push(d)}for(let i of t.subclassesOf.get(a)??[])s.push(i)}return o}var Tm=5e3,vl=200,Il=100,Al={modules:[],exports:[],imports:[],functions:[],callSites:[],classes:[],callEdges:[],importEdges:[],exportBindings:[],inheritEdges:[]};function Nl(e){return`pkg:${e}`}function pn(e){return e.split(/[\\/]+/u).join("/")}function _l(e,n){let t=e.endsWith("/")?e:`${e}/`,o=pn(n),r=pn(t);return o.startsWith(r)?o.slice(r.length):null}function Rl(e){let n=pn(e).split("/"),t=n[n.length-1]??"";if(t==="__init__.py")return{dotted:n.slice(0,-1).join("."),isPackage:!0};let o=t.endsWith(".py")?t.slice(0,-3):t;return{dotted:[...n.slice(0,-1),o].filter(r=>r!=="").join("."),isPackage:!1}}function os(e){return e.split(".")[0]??e}var Dm="site-packages:";function rs(e){let n=e.extract??Oo,t=e.maxModules??Tm,o=(e.externalRoots??[]).map(C=>pn(C).endsWith("/")?pn(C):`${pn(C)}/`),r=C=>{let H=pn(C);return o.find(J=>H.startsWith(J))??null},s=C=>r(C)!==null,a=[],l=new Map,i=[],d=[],u=new Set,p=new Set,f=new Map,m=new Map,g=[],y=new Map,b=[],x=0,I=()=>{let C=`py-export:${String(x)}`;return x+=1,C},w=null,A=!1,k=new Set,h=[];for(let C of e.entryFiles){let H=_l(e.projectRoot,C);if(H===null){a.push({code:"unresolved-import",where:pn(C),detail:"entrypoint lies outside the project root; not analyzed"});continue}u.has(C)||(u.add(C),h.push({file:C,rel:H,isEntry:!0,packageName:"",modulePath:H}))}let S=C=>{let H=Nl(C);return l.has(H)||(p.add(C),l.set(H,{id:H,packageName:C,versionRange:"",path:C,moduleSystem:"dual",isEntrypoint:!1,externalSurface:!0})),H},_=0,P=(C,H,J,G)=>{let Y=`py-import:${String(_)}`;_+=1,i.push({id:Y,moduleId:C,specifier:H,...J!==null?{resolvedModuleId:J}:{},isNamespace:!1,isDefault:!1,dynamic:G,specifierIsLiteral:!0}),J!==null&&d.push({importId:Y,resolvedModuleId:J})};for(let C=0;C<Il&&h.length>0;C+=1){let H=h.slice(0,vl);h=h.slice(vl);let J=n(H.map(Y=>Y.file),e.python!==void 0?{python:e.python}:{});if(w??=J.interpreter,k.size===0&&J.stdlib.length>0&&(k=new Set(J.stdlib)),J.refused!==null)return a.push({code:"extract-refused",where:"",detail:`${J.refused}: ${J.diagnostics.join("; ")}`}),{graph:Al,diagnostics:a,interpreter:J.interpreter,counts:{modules:0,surfaces:0}};let G=new Map(J.files.map(Y=>[Y.path,Y]));for(let Y of H){let re=G.get(Y.file),ne=Y.rel,$=Rl(Y.modulePath);if(l.set(ne,{id:ne,packageName:Y.packageName,versionRange:"",path:Y.modulePath,moduleSystem:"dual",isEntrypoint:Y.isEntry}),re===void 0||re.refused!==null){a.push({code:"file-refused",where:Y.rel,detail:re?.refused??"no row was returned for this file"});continue}v(re,ne,$),F(re,Y.rel),f.set(ne,ns(re,ne,Y.rel,I)),m.set(ne,O(re,ne,$));for(let Z of re.calls)g.push({moduleId:ne,path:Y.rel,call:Z});for(let Z of re.escapes){if(Z.kind!=="attr-rebind")continue;let Q=Z.attr??null;Q===null||Z.target===null||b.push({moduleId:ne,attr:Q,target:Z.target})}}}function v(C,H,J){for(let G of C.imports){if(G.guards.includes("type-checking"))continue;let Y=[];if(G.level>0){let ne=$o(J.dotted,J.isPackage,G.level,G.module);if("failure"in ne){a.push({code:"unresolved-import",where:C.path,detail:`relative import (level ${String(G.level)}) ${ne.failure}`});continue}Y.push(ne.dotted);for(let $ of G.names)Y.push(`${ne.dotted}.${$.name}`)}else if(G.module!==null){Y.push(G.module);for(let ne of G.names)Y.push(`${G.module}.${ne.name}`)}else continue;let re=!1;for(let ne of Y)T(ne,H,G.deferred)&&(re=!0);if(!re){let ne=Y[0]??"";P(H,ne,null,G.deferred);let $=os(ne);if(k.has($)||G.guards.includes("optional")||(e.environmentComplete??!1)&&e.distributionOf($)===null)continue;a.push({code:"unresolved-import",where:C.path,detail:`\`${ne}\` did not resolve on the search path`})}}}function T(C,H,J){let G=C.split("."),Y=!1;for(let re=1;re<=G.length;re+=1){let ne=G.slice(0,re).join("."),$=$n(e.paths,ne);$.resolved!==null&&(j($.resolved,H,ne,J),re===G.length&&(Y=!0))}return Y}function N(C){return u.has(C.file)||l.has(C.rel)?!0:u.size>=t?(A||(A=!0,a.push({code:"module-cap",where:C.rel,detail:`the analyzed-module ceiling (${String(t)}) was hit; the graph is INCOMPLETE`})),!1):(u.add(C.file),h.push(C),!0)}function j(C,H,J,G){if(C.kind==="stub-only")return;let Y=C.kind==="module"||C.kind==="package",re=_l(e.projectRoot,C.path);if(re!==null&&!s(C.path)&&Y){let Q=re;P(H,J,Q,G),y.set(J,Q),N({file:C.path,rel:re,isEntry:!1,packageName:"",modulePath:re});return}let ne=e.distributionOf(os(J));if(ne===null){P(H,J,null,G),a.push({code:"unresolved-import",where:J,detail:`resolved to ${C.kind} outside the project, but no installed distribution provides \`${os(J)}\``});return}let $=r(C.path);if(!Y||$===null){P(H,J,S(ne),G);return}let Z=`${Dm}${pn(C.path).slice($.length)}`;P(H,J,Z,G),y.set(J,Z),N({file:C.path,rel:Z,isEntry:!1,packageName:ne,modulePath:pn(C.path).slice($.length)})}function O(C,H,J){let G=new Map,Y=new Map;for(let re of C.imports){if(re.guards.includes("type-checking"))continue;let ne=re.module;if(re.level>0){let $=$o(J.dotted,J.isPackage,re.level,re.module);if("failure"in $)continue;ne=$.dotted}if(ne!==null){if(re.form==="import"){let $=re.names[0]?.asname??null;if($!==null){let ce=y.get(ne);ce!==void 0&&G.set($,ce);continue}let Z=ne.split(".")[0]??ne,Q=y.get(Z)??y.get(ne);Q!==void 0&&G.set(Z,Q);continue}for(let $ of re.names){let Z=$.asname??$.name,Q=y.get(`${ne}.${$.name}`);if(Q!==void 0){G.set(Z,Q);continue}let ce=y.get(ne);ce!==void 0&&Y.set(Z,{moduleId:ce,name:$.name})}}}return G.set("",H),{modules:G,names:Y}}function F(C,H){for(let J of C.escapes)switch(J.kind){case"loader-escape":a.push({code:"loader-escape",where:H,detail:`${J.callee} loads a module this analysis cannot name`});break;case"pkgutil-scan":case"runpy":case"entry-point-load":a.push({code:"dynamic-load-set",where:H,detail:`${J.callee} loads a set of modules the syntax does not name`});break;case"sys-modules":a.push({code:"module-registry-write",where:H,detail:`${J.callee} rewrites the module registry at run time`});break;case"import-module-literal":{let G=J.target;if(G===null)break;T(G,H,!0);break}case"dispatch-escape":break}}h.length>0&&a.push({code:"module-cap",where:"",detail:`the walk did not finish within ${String(Il)} waves; the graph is INCOMPLETE`});let K=ts({decls:f,envs:m,pending:g,rebinds:b}),te=[...f.values()].flatMap(C=>C.functions),U=[...f.values()].flatMap(C=>C.classes),X=[...f.values()].flatMap(C=>C.exports),D=[...f.values()].flatMap(C=>C.exportBindings);return{graph:{...Al,modules:[...l.values()],imports:i,importEdges:d,functions:te,classes:U,exports:X,exportBindings:D,callSites:K.callSites,callEdges:K.callEdges,inheritEdges:K.inheritEdges},diagnostics:a,interpreter:w,counts:{modules:l.size-p.size,surfaces:p.size}}}import{readdirSync as Lm,readFileSync as $l,statSync as Co}from"node:fs";import Be from"node:path";import{spawnSync as Fm}from"node:child_process";import{fileURLToPath as jm}from"node:url";var Bm="python3",Km=256*1024,Um=8*1024*1024,Ol=/^([A-Za-z_][A-Za-z0-9_.]*)(?::([A-Za-z_][A-Za-z0-9_.]*))?$/u,zm=/(?:^|\s)([A-Za-z_][A-Za-z0-9_.]*:[A-Za-z_][A-Za-z0-9_.]*)(?:\s|$)/u;function Cl(){return jm(new URL("../py/metadata.py",import.meta.url))}function On(e){try{return Co(e).isFile()}catch{return!1}}function Pl(e){try{return Co(e).isDirectory()}catch{return!1}}function Wm(e,n){return Be.relative(e,n).split(Be.sep).join("/")}function Vm(e){let n=e.python??process.env.CUPEL_PYTHON??Bm,t=Fm(n,["-I","-S",Cl(),e.projectRoot],{encoding:"utf8",maxBuffer:Um,timeout:6e4}),o=i=>({entries:[],projectName:null,gaps:[{source:"metadata",declaration:"pyproject.toml / setup.cfg",detail:i}]});if(t.error!==void 0||t.status!==0)return o("the declared entry surface could not be read; it is unknown, not empty");let r;try{r=JSON.parse(t.stdout)}catch{return o("the declared entry surface came back unreadable; it is unknown, not empty")}if(typeof r!="object"||r===null)return{entries:[],projectName:null,gaps:[]};let s=r,a=(Array.isArray(s.entryPoints)?s.entryPoints:[]).filter(i=>typeof i=="object"&&i!==null&&typeof i.name=="string"&&typeof i.target=="string"&&typeof i.kind=="string"),l=(Array.isArray(s.gaps)?s.gaps:[]).flatMap(i=>{if(typeof i!="object"||i===null)return[];let d=i,u=typeof d.file=="string"?d.file:"",p=typeof d.why=="string"?d.why:"";return[{source:"metadata",declaration:u,detail:p==="executable-metadata-not-read"?"setup.py declares this project's entry points and is a PROGRAM: cupel never runs it, so the declared surface is INCOMPLETE":p}]});return{entries:a,gaps:l,projectName:typeof s.projectName=="string"?s.projectName:null}}function ss(e,n){let t=Ol.exec(n.trim());if(t===null)return{detail:`\`${n}\` is not a module:attr target`};let o=t[1]??"",r=$n(e.paths,o);if(r.resolved===null)return{detail:`\`${o}\` ${r.failure??"did not resolve"}`};if(r.resolved.kind==="namespace"||r.resolved.kind==="stub-only")return{detail:`\`${o}\` resolved to a ${r.resolved.kind}, which runs no code`};let s=Wm(e.projectRoot,r.resolved.path);return s.startsWith("..")?{detail:`\`${o}\` resolves outside the project root; not seeded`}:{file:s}}function qm(e){let n=[];On(Be.join(e,"__main__.py"))&&n.push("__main__.py");let t=(o,r)=>{let s;try{s=Lm(o).sort()}catch{return}for(let a of s){if(a.startsWith("."))continue;let l=Be.join(o,a);Pl(l)&&On(Be.join(l,"__init__.py"))&&On(Be.join(l,"__main__.py"))&&n.push(`${r}${a}/__main__.py`)}};return t(e,""),Pl(Be.join(e,"src"))&&t(Be.join(e,"src"),"src/"),n}function Gm(e,n){let t=Be.join(e,"Procfile");if(!On(t))return[];let o;try{if(Co(t).size>n)return[];o=$l(t,"utf8")}catch{return[]}let r=[];for(let s of o.split(/\r?\n/u)){let a=zm.exec(s);a?.[1]!==void 0&&r.push(a[1])}return r}var Hm=256*1024,Xm=/^\s*(?:CMD|ENTRYPOINT)\s+(.*)$/imu,Ym=/^\s*WORKDIR\s+(\S+)\s*$/imu,Jm=/^\s*COPY\s+(?:--\S+\s+)*(\S+)\s+(\S+)\s*$/imu,Zm=/(?:^|[\s"',[])([A-Za-z_][A-Za-z0-9_.]*:[A-Za-z_][A-Za-z0-9_.]*)(?:[\s"',\]]|$)/u,Qm=/(?:^|[\s"',[])((?:[A-Za-z0-9_.-]+\/)*[A-Za-z0-9_-]+\.py)(?:[\s"',\]]|$)/u;function eh(e){let n=Ym.exec(e)?.[1]?.replace(/\/+$/u,"")??null;if(n===null)return null;for(let t of e.split(/\r?\n/u)){let o=Jm.exec(t),r=o?.[1],s=o?.[2]?.replace(/\/+$/u,"");if(r===void 0||s===void 0||s!==n)continue;let a=r.replace(/\/+$/u,"");return a==="."?null:a}return null}function nh(e,n){let t=[],o=s=>{let a=Be.join(e,s);if(!On(a))return null;try{return Co(a).size>n?null:$l(a,"utf8")}catch{return null}},r=o("Dockerfile");if(r!==null){let s=eh(r);for(let a of r.split(/\r?\n/u)){let l=Xm.exec(a);l?.[1]!==void 0&&t.push({command:l[1],from:"Dockerfile",srcRoot:s})}}for(let s of["docker-compose.yml","docker-compose.yaml","compose.yml","compose.yaml"]){let a=o(s);if(a!==null)for(let l of a.split(/\r?\n/u)){let i=/^\s*(?:command|entrypoint):\s*(.+)$/u.exec(l);i?.[1]!==void 0&&t.push({command:i[1],from:s,srcRoot:null})}}return t}function th(e,n,t){let o=e.projectRoot,r=Qm.exec(n)?.[1];if(r!==void 0){for(let l of t===null?[r]:[Be.join(t,r),r])if(On(Be.join(o,l)))return{file:l}}let s=Zm.exec(n)?.[1];if(s===void 0)return r===void 0?{detail:`no module:attr target or .py path in \`${n.trim()}\``}:{detail:`\`${r}\` is not a file in this repository`};let a=Ol.exec(s)?.[1]??"";for(let l of t===null?[""]:[t,""])for(let i of[`${a.replace(/\./gu,"/")}.py`,`${a.replace(/\./gu,"/")}/__init__.py`]){let d=l===""?i:Be.join(l,i);if(On(Be.join(o,d)))return{file:d}}return ss(e,s)}function is(e){let n=[],t=[],o=new Set,r=(l,i,d)=>{let u=`${l} ${i}`;o.has(u)||(o.add(u),n.push({file:l,source:i,declaration:d}))},s=Vm(e);t.push(...s.gaps);for(let l of s.entries){let i=l.kind==="entry-point-group"?"entry-point-group":"console-script",d=ss(e,l.target);"file"in d?r(d.file,i,`${l.name} = ${l.target}`):t.push({source:i,declaration:`${l.name} = ${l.target}`,detail:d.detail})}for(let l of qm(e.projectRoot))r(l,"dunder-main",l);On(Be.join(e.projectRoot,"manage.py"))&&r("manage.py","manage-py","manage.py");let a=e.maxProcfileBytes??Km;for(let l of Gm(e.projectRoot,a)){let i=ss(e,l);"file"in i?r(i.file,"launch-declaration",l):t.push({source:"launch-declaration",declaration:l,detail:i.detail})}for(let l of nh(e.projectRoot,Hm)){let i=th(e,l.command,l.srcRoot),d=`${l.from}: ${l.command.trim()}`;"file"in i?r(i.file,"launch-declaration",d):t.push({source:"launch-declaration",declaration:d,detail:i.detail})}return{entrypoints:n,gaps:t,projectName:s.projectName}}var hk=256*1024*1024;var Ml="CUPEL_PYTHON",sh=["-I","-S"],ih="python3",ah=256*1024*1024,lh=12e4,dh=512;function ch(){return rh(new URL("../py/extract.py",import.meta.url))}function be(e,n=dh){return typeof e=="string"&&e.length<=n?e:null}function qn(e){return typeof e=="number"&&Number.isFinite(e)?e:0}function Bt(e){let n=Cn(e)?e:{};return{line:qn(n.line),endLine:qn(n.endLine),col:qn(n.col),start:qn(n.start),end:qn(n.end)}}function Cn(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function Vn(e){return Array.isArray(e)?e:[]}function mt(e){return Vn(e).map(n=>be(n))}var uh=new Set(["import-module-literal","loader-escape","pkgutil-scan","runpy","entry-point-load","dispatch-escape","attr-rebind","sys-modules"]),fh=new Set(["unreadable","oversize","nul-byte","undecodable","parse-error","recursion","too-many-nodes"]);function ph(e){let n=be(e.path,4096);if(n===null)return null;let t=e.refused,o=typeof t=="string"&&fh.has(t)?t:null,r=be(e.detail,200),s=Vn(e.imports).filter(Cn).map(f=>({form:f.form==="import"?"import":"from",module:be(f.module),level:qn(f.level),names:Vn(f.names).filter(Cn).map(m=>({name:be(m.name)??"",asname:be(m.asname)})).filter(m=>m.name!==""),star:f.star===!0,deferred:f.deferred===!0,enclosingFunction:be(f.enclosingFunction),guards:mt(f.guards).filter(m=>m!==null),range:Bt(f.range)})),a=Vn(e.functions).filter(Cn).flatMap(f=>{let m=be(f.name),g=be(f.qualname);return m===null||g===null?[]:[{name:m,qualname:g,kind:f.kind==="async-function"?"async-function":"function",enclosingClass:be(f.enclosingClass),enclosingFunction:be(f.enclosingFunction),decorators:mt(f.decorators),range:Bt(f.range)}]}),l=Vn(e.classes).filter(Cn).flatMap(f=>{let m=be(f.name),g=be(f.qualname);return m===null||g===null?[]:[{name:m,qualname:g,bases:mt(f.bases),decorators:mt(f.decorators),range:Bt(f.range)}]}),i=Vn(e.calls).filter(Cn).map(f=>({callee:be(f.callee),attr:be(f.attr),receiver:be(f.receiver),enclosingFunction:be(f.enclosingFunction),argCount:qn(f.argCount),range:Bt(f.range)})),d=Vn(e.escapes).filter(Cn).flatMap(f=>{let m=f.kind,g=be(f.callee);return typeof m!="string"||!uh.has(m)||g===null?[]:[{kind:m,callee:g,target:be(f.target),attr:be(f.attr),enclosingFunction:be(f.enclosingFunction),range:Bt(f.range)}]}),u=e.all,p=Array.isArray(u)?mt(u).filter(f=>f!==null):null;return{path:n,refused:o,...r!==null?{detail:r}:{},imports:s,functions:a,classes:l,calls:i,escapes:d,all:p,allComputed:e.allComputed===!0,truncated:mt(e.truncated).filter(f=>f!==null)}}function Oo(e,n={}){let t=n.env??process.env,o=n.python??t[Ml]??ih,r=[],s=e.filter(m=>!m.includes(`
-`));s.length!==e.length&&r.push(`${String(e.length-s.length)} path(s) carried a newline and were not extracted`);let a=[...sh,ch()];n.maxBytesPerFile!==void 0&&a.push("--max-bytes",String(n.maxBytesPerFile));let l=oh(o,a,{input:s.length>0?`${s.join(`
+}`,A.ScriptTarget.Latest,!0),o=r.parseDiagnostics;if(o!==void 0&&o.length>0||Op(r,n+1,!0))return!0}return!1}function Op(e,n=0,t=!1){return as(e,n,t).size>0}function as(e,n=0,t=!1){let r=new Set,o=t?kp:Np(e);if(o.saturated)return r.add("saturated"),r;let s=a=>A.isElementAccessExpression(a)&&!A.isStringLiteralLike(a.argumentExpression)&&qr(Pe(a.expression),o),i=a=>{if(t&&(A.isCallExpression(a)||A.isNewExpression(a)||A.isTaggedTemplateExpression(a))){r.add("eval-invocation");return}if(A.isCallExpression(a)){let d=nr(a);if(d!==null){let l=d.specifierArg;if(l===void 0||!A.isStringLiteralLike(l)||t){r.add("non-literal-load");return}}else{let l=Pe(a.expression);if(A.isIdentifier(l)&&(l.text==="eval"||l.text==="Function")){if(pl(a.arguments,n)){r.add("eval-code");return}}else if(Rp(l)){r.add("loader-callee");return}else if(s(l)){r.add("computed-loader");return}else if(Ip(a,o)){r.add("reflect-get");return}}}else if(A.isNewExpression(a)){let d=Pe(a.expression);if(A.isIdentifier(d)&&d.text==="Function"){if(pl(a.arguments??[],n)){r.add("function-ctor");return}}else if(Qt(d)){r.add("ctor-chain");return}}else if(A.isIdentifier(a)&&gp.has(a.text)&&bp(a)){r.add("captured-loader");return}else if((A.isPropertyAccessExpression(a)||A.isElementAccessExpression(a))&&(yl(a)||Qt(a)||s(a))&&gl(a)){r.add("captured-member");return}else if(A.isBindingElement(a)){let d=a.propertyName??a.name,l=A.isIdentifier(d)||A.isStringLiteralLike(d)?d.text:A.isComputedPropertyName(d)&&A.isStringLiteralLike(d.expression)?d.expression.text:void 0;if(l!==void 0&&Hr.has(l)){r.add("destructured-member");return}}A.forEachChild(a,i)};return i(e),r}function El(e,n,t){let r=new Set(as(t));if(ds(e)&&n.includes("<")&&n.includes("require")){let o=A.createSourceFile(e,n,A.ScriptTarget.ES2020,!0,A.ScriptKind.TSX);for(let s of as(o))r.add(s)}return r}function $p(e,n,t){if(ls(e))return!0;let r=t.endsWith(Be.sep)?t:t+Be.sep,o=e.split("/"),s=n;for(;;){let i=Be.join(s,"node_modules",...o),a;try{a=dt(Be.join(i,"package.json"))}catch{a=null}if(a!==null){if(!a.startsWith(r))return!1;let l=Fe(a);if(l===null)return!1;let c;try{c=JSON.parse(l).exports}catch{return!1}if(typeof c=="string"||Array.isArray(c)||typeof c=="object"&&c!==null)return!1}if(Va(i))return!1;if(s===t)break;let d=Be.dirname(s);if(d===s||d!==t&&!d.startsWith(r))break;s=d}return!0}function Cp(e,n){let t=n.endsWith(Be.sep)?n:n+Be.sep,r=Be.dirname(e);for(;;){let o=Be.join(r,"package.json"),s;try{s=dt(o)}catch{s=null}if(s!==null&&(s===n||s.startsWith(t))){let a=Fe(s);if(a!==null)try{let d=JSON.parse(a).name;if(typeof d=="string"&&d.length>0)return d}catch{return null}}if(r===n)break;let i=Be.dirname(r);if(i===r||i!==n&&!i.startsWith(t))break;r=i}return null}function Mp(e,n,t,r,o){let s=[],i=[],a=new Set,d={},l=[],c=[],p=new Set,u=new Set,m=[],h=!1,x=(S,k)=>{let E;try{E=dt(k)}catch{return!1}let g=ze(e,E);if(g===null)return o.push({code:"out-of-root",path:E,detail:"dependency module resolved outside the app root; not followed"}),!1;let b=!t.has(E)&&!u.has(E);return b&&u.size>=os?(h=!0,!1):(i.push({from:S,to:{module:g}}),b?(u.add(E),s.push(g),!0):!1)},y=(S,k)=>{if(a.add(k),p.has(k))return;p.add(k);let E=en(k,S,je,n),g=E!==null?[E]:It(k,S,je,n);g.length>=2&&l.push({path:ze(e,S)??S,specifier:k,candidates:g.map(w=>ze(e,w)??w)});let b=!1;for(let w of g)if(!Ve(w)&&(b=!0,x({surface:k},w))){m.push(w);try{let I=ze(e,dt(w)),N=Cp(w,e);I!==null&&N!==null&&(d[I]=N)}catch{}}b||$p(k,Be.dirname(S),e)||o.push({code:"unresolved-specifier",path:k,reason:Yt(k,S,je,n),detail:`dependency "${k}" is installed and Node loads an entry for it, but its runtime entry did not resolve here (divergent conditional exports / a typesVersions remap / a declaration-only surface / an unreadable manifest / an out-of-root install); its module was not analyzed (degraded to unbounded)`})};for(let S of r)y(S.containingFile,S.packageName);for(;m.length>0&&u.size<os;){let S=m.pop();if(S===void 0)break;let k=ze(e,S);if(k===null)continue;let E=_t(S,Bn);if(E.kind==="too-large"){o.push({code:"limit-exceeded",path:k,detail:`dependency module over the ${String(Bn/1048576)}MiB cap; its imports were not followed (degraded to unbounded)`});continue}if(E.kind==="not-regular"){o.push({code:"parse-error",path:k,detail:"dependency module unreadable or not a regular file; its imports were not followed (degraded to unbounded)"});continue}let g=A.createSourceFile(S,E.text,A.ScriptTarget.ES2020,!0),b=g.parseDiagnostics;if(b!==void 0&&b.length>0){o.push({code:"dependency-body",path:k,detail:"dependency module has syntax errors; its tolerant parse may have dropped import/loader nodes \u2014 module reach unbounded (ADR-050 2A parse-cap)"});continue}let w=El(S,E.text,g);if(w.size>0){o.push({code:"dependency-body",path:k,detail:"dependency module contains a loader escape (eval / Function / reflective or non-literal loader / captured loader value); its module reach is unbounded (ADR-045 Attack #1 dep-side mirror)",escapes:[...w].sort()});continue}o.push({code:"dependency-body",path:k,detail:"dependency module followed at module-import granularity only; its function bodies are not analyzed (ADR-050 2A, bodyless)",anchor:k});for(let I of ml(S,E.text))if(I.runtime)if(Ae(I.text)==="package-root"){let N=Qe(I.text);i.push({from:{module:k},to:{surface:N}}),y(S,N)}else{if(ls(Qe(I.text)))continue;let N=en(I.text,S,je,n),v=N!==null?[N]:It(I.text,S,je,n);if(v.length===0){if(Ae(I.text)==="package-subpath"){let _=Yt(I.text,S,je,n);if(_==="no-candidate"||_==="not-installed"&&Ja(S,Qe(I.text))){c.push({path:k,specifier:I.text,why:_});continue}o.push({code:"unresolved-specifier",path:k,reason:_,detail:`runtime package-subpath import "${I.text}" did not resolve under Node10 (an exports-map/typesVersions subpath Node may load); its module was not analyzed`})}continue}v.length>=2&&l.push({path:k,specifier:I.text,candidates:v.map(_=>ze(e,_)??_)});for(let _ of v){if(Ve(_)){let P=ze(e,_);o.push({code:P===null?"out-of-root":"declaration-shadow",path:k,detail:P===null?`runtime import "${I.text}" resolved outside the app root; its module was not analyzed`:`runtime import "${I.text}" resolved to the declaration file "${P}" with no co-located runtime module; its code was not analyzed`});continue}x({module:k},_)&&m.push(_)}}}return(h||m.length>0)&&o.push({code:"limit-exceeded",path:e,detail:`dependency module closure hit the ${String(os)} cap; module-reachability truncated (degraded to unbounded)`}),{modules:s,edges:i,surfacePackages:[...a],entryRealNames:d,conditionUnions:l,provenAbsent:c}}function vl(e,n,t=!1){let r=dt(e),o=[],s=[],i=A.createCompilerHost(je,!0),a=t?Za(r,je,i):()=>null,d=new Set,l=new Set,c=n.map(R=>Be.join(r,R)),p=[],u=new Map,m=new Map,h=new Map,x=new Map,y=new Set,S=(R,L,O)=>{let F=`${String(R.length)}:${R}${L}`;y.has(F)||(y.add(F),o.push({code:"unresolved-specifier",path:R,detail:L,reason:O}))},k=()=>null,E=0,g=(R,L)=>{let O=m.get(R);return O===void 0&&(O=A.createSourceFile(R,L,A.ScriptTarget.ES2020,!0),m.set(R,O)),{real:R,sf:O}};for(;l.size<Gr;){let R=c.pop();if(R===void 0){if(E>=hp)break;E+=1;let K=[];for(let[B,D]of u)D.includes("readdir")&&(D.includes("require")||D.includes("import("))&&K.push(g(B,D));let ee=mp(K);if(ee.length===0)break;let U=[];for(let[B,D]of u)U.push(g(B,D));k=dl(U,ee,je,i,h);let J=!1;for(let B of K){let D=u.get(B.real);if(D!==void 0)for(let Y of fl(B.real,D,r,i,k))l.has(Y)||(c.push(Y),J=!0)}if(!J)break;continue}let L;try{L=dt(R)}catch{continue}if(l.has(L))continue;if(l.add(L),ze(r,L)===null){o.push({code:"out-of-root",path:R,detail:"resolved outside app root"});continue}let O=_t(L,Bn);if(O.kind==="too-large"){o.push({code:"limit-exceeded",path:L,detail:`file is ${String(Math.round(O.bytes/1048576))}MiB, over the ${String(Bn/1048576)}MiB per-file cap; skipped (degraded to unknown)`});continue}if(O.kind==="not-regular"){o.push({code:"parse-error",path:L,detail:"unreadable or not a regular file"});continue}let F=O.text;d.add(L),u.set(L,F);for(let K of ml(L,F)){let ee=K.runtime?a(K.text,L):null;if(ee===null&&Ae(K.text)==="package-root"){K.runtime&&p.push({containingFile:L,packageName:Qe(K.text)});continue}let U=ee??en(K.text,L,je,i),J=U!==null?[U]:K.runtime&&ee===null?It(K.text,L,je,i):[];if(J.length===0){if(K.runtime){let B=Ae(K.text);if(!(B==="package-subpath"&&ls(Qe(K.text)))){if(B==="package-subpath")S(L,`runtime package-subpath import "${K.text}" did not resolve under Node10 (an exports-map/typesVersions subpath Node may load); its module was not analyzed`,Yt(K.text,L,je,i));else if(B==="relative"){let D=Xa(K.text,L,r,x);D.kind==="unanalyzable"&&S(L,`runtime relative import "${K.text}" did not resolve and its absence could not be proven \u2014 ${D.reason}; a bundler/loader may load a module the analyzer never saw`,D.why)}}}continue}J.length>=2&&s.push({path:ze(r,L)??L,specifier:K.text,candidates:J.map(B=>ze(r,B)??B)});for(let B of J){if(ze(r,B)===null){o.push({code:"out-of-root",path:B,detail:`specifier "${K.text}" resolved outside app root`});continue}if(K.runtime&&Ve(B)){o.push({code:"declaration-shadow",path:B,detail:`runtime import "${K.text}" resolved to a declaration file with no co-located runtime module; its code was not analyzed`});continue}if(K.runtime&&!jr(B)){o.push({code:"unanalyzable-module",path:B,detail:`runtime import "${K.text}" resolved to a file the analyzer cannot parse (extensionless/.json/.node); its module was not analyzed`});continue}c.push(B)}}for(let K of fl(L,F,r,i,k))l.has(K)||c.push(K)}l.size>=Gr&&c.length>0&&o.push({code:"limit-exceeded",path:r,detail:`reachable file set exceeds ${String(Gr)}; analysis truncated (${String(c.length)}+ files not analyzed)`});let b=Mp(r,i,d,p,o),w=A.createProgram({rootNames:[...d],options:je,host:i}),I=new Set,N=new Map;for(let R of w.getSourceFiles()){if(R.isDeclarationFile||w.isSourceFileDefaultLibrary(R)||ze(r,R.fileName)===null||!ds(R.fileName))continue;let L=w.getSyntacticDiagnostics(R).length>0;if(!L&&!R.text.includes("<")||pp(R.text,A.ScriptKind.TSX)!==0)continue;let O=A.createSourceFile(R.fileName,R.text,A.ScriptTarget.ES2020,!0,A.ScriptKind.TSX);(L||ul(O)>ul(R))&&(I.add(R.fileName),N.set(R.fileName,R.text))}let v=w;if(I.size>0){let R=i.getSourceFile.bind(i);i.getSourceFile=(L,O,F,K)=>{let ee=N.get(L);return ee!==void 0?A.createSourceFile(L,ee,A.ScriptTarget.ES2020,!0,A.ScriptKind.TSX):R(L,O,F,K)},v=A.createProgram({rootNames:[...d],options:je,host:i,oldProgram:w})}let _=v.getTypeChecker(),P=[];for(let R of v.getSourceFiles()){if(R.isDeclarationFile||v.isSourceFileDefaultLibrary(R)||ze(r,R.fileName)===null)continue;P.push(R);let L=v.getSyntacticDiagnostics(R);if(L.length>0){let K=L[0],ee=K!==void 0?A.flattenDiagnosticMessageText(K.messageText," "):"syntax error";o.push({code:"parse-error",path:R.fileName,detail:`${String(L.length)} syntax error(s): ${ee}`})}let O=ze(r,R.fileName),F=O===null?null:El(R.fileName,R.text,R);O!==null&&F!==null&&F.size>0&&o.push({code:"loader-escape",path:O,detail:"module contains a loader escape (eval / Function / reflective or non-literal loader / captured or destructured loader); its module reach is unbounded (ADR-050 2B)",escapes:[...F].sort()})}return{program:v,checker:_,host:i,options:je,appRoot:r,sourceFiles:P,diagnostics:o,depReach:b,conditionUnions:[...s,...b.conditionUnions],provenAbsent:b.provenAbsent,resolveParamDirs:k,toRel:R=>ze(r,R)}}import{opendirSync as Tp,statSync as Dp}from"node:fs";import cs from"node:path";var Lp=8192,Fp=2e4,jp=new Set(["node_modules"]),_l=new Set(["test","tests","__tests__","__mocks__","fixtures","e2e","dist","build","out","coverage","vendor"]),Bp=16;function Xr(e,n,t,r,o={}){let s=o.maxEntries??Fp,i=o.prune,a=[],d=!1,l=0,c=[{dir:cs.join(e,n),rel:n,depth:0}];for(;c.length>0;){let p=c.pop();if(p===void 0)break;if(p.depth>Bp){d=!0;continue}let u;try{u=Tp(p.dir)}catch{d=!0;continue}try{let m=0;for(;;){let h=u.readSync();if(h===null)break;if(m+=1,l+=1,m>Lp||l>s){d=!0;break}let x=p.rel+h.name;if(h.isSymbolicLink()){let y;try{y=Dp(cs.join(p.dir,h.name)).isDirectory()}catch{d=!0;continue}if(y){d=!0;continue}}else if(h.isDirectory()){if(jp.has(h.name)||h.name.startsWith(".")||i?.has(h.name)===!0){d=!0;continue}c.push({dir:cs.join(p.dir,h.name),rel:`${x}/`,depth:p.depth+1});continue}else if(!h.isFile())continue;if(t(x)){if(a.length>=r){d=!0;break}a.push(x)}}}finally{try{u.closeSync()}catch{}}}return{matches:a,truncated:d}}var Kp=64;function Il(e,n){let t=n.indexOf("*");if(t===-1||n.indexOf("*",t+1)!==-1)return null;let r=n.slice(0,t),o=n.slice(t+1);if(r.startsWith("./")&&(r=r.slice(2)),r.startsWith("/")||o.includes("/")||r.split("/").includes("..")||r.includes("\\")||n.includes("\0"))return null;let s=r.slice(0,r.lastIndexOf("/")+1);return Xr(e,s,i=>i.length>=r.length+o.length&&i.startsWith(r)&&i.endsWith(o),Kp)}import{existsSync as Up}from"node:fs";import zp from"node:path";var Gp=[{name:"Astro",dependency:"astro",configFiles:["astro.config.mjs","astro.config.js","astro.config.ts","astro.config.mts"],entryHint:"your route files under src/pages/",rootDirs:["pages","actions"]},{name:"Next.js",dependency:"next",configFiles:["next.config.js","next.config.mjs","next.config.ts","next.config.cjs"],entryHint:"your route files under app/ or pages/",rootDirs:["app","pages"]},{name:"SvelteKit",dependency:"@sveltejs/kit",configFiles:["svelte.config.js","svelte.config.mjs","svelte.config.ts"],entryHint:"your route files under src/routes/",rootDirs:["routes"]},{name:"Nuxt",dependency:"nuxt",configFiles:["nuxt.config.js","nuxt.config.mjs","nuxt.config.ts"],entryHint:"app.vue, or your route files under pages/",rootDirs:["server","pages","middleware","plugins"]},{name:"Remix",dependency:"@remix-run/dev",configFiles:["remix.config.js","remix.config.mjs","vite.config.js","vite.config.ts"],entryHint:"app/root.tsx, or your route files under app/routes/",rootDirs:["app","routes"]},{name:"Vite",dependency:"vite",configFiles:["vite.config.js","vite.config.ts","vite.config.mjs","vite.config.mts"],entryHint:"the module script your index.html loads",rootDirs:[]}],Wp=["dependencies","devDependencies"];function qp(e,n){for(let t of Wp){let r=e[t];if(!(typeof r!="object"||r===null||Array.isArray(r))&&Object.hasOwn(r,n))return!0}return!1}function us(e,n){if(n===null)return null;for(let t of Gp)if(qp(n,t.dependency)){for(let r of t.configFiles)if(Up(zp.join(e,r)))return{name:t.name,configFile:r,entryHint:t.entryHint,rootDirs:t.rootDirs}}return null}function fs(e){return`This looks like ${e.name} (${e.configFile} plus the dependency), and ${e.name} resolves its entry at build time \u2014 there is nothing in package.json for cupel to start from. Pass --entry ${e.entryHint}.`}var Vp=[".ts",".tsx",".mts",".cts",".js",".jsx",".mjs",".cjs"],Hp=256,Xp=12e4;function ps(e,n){let t=new Set(n.rootDirs);if(t.size===0)return{roots:[],truncated:!1};let r=Xr(e,"",o=>{let s=o.split("/");for(let i=0;i<s.length-1;i+=1){let a=s[i];if(a!==void 0&&t.has(a))return Vp.some(d=>o.endsWith(d))}return!1},Hp,{maxEntries:Xp,prune:_l});return{roots:r.matches,truncated:r.truncated}}function nn(e){let n=e.length<=120?e:`${e.slice(0,120)}\u2026`,t="";for(let r of n){let o=r.codePointAt(0)??0;t+=o<32||o>=127&&o<=159?`\\x${o.toString(16).padStart(2,"0")}`:r}return t}function Yp(e){for(let n of e){let t=n.codePointAt(0)??0;if(t<32||t===127||t>=128&&t<=159||"&|;<>$`(){}[]*?~#!\\\"'".includes(n))return!0}return!1}function Jp(e){let n=!1;for(let t=0;t<e.length;t+=1){let r=e.charAt(t),o=r.codePointAt(0)??0;if(o<32||o===127||o>=128&&o<=159)return null;if(r==="\\"){n=!0;let s=e.charAt(t+1);if(!(s>="a"&&s<="z"||s>="A"&&s<="Z"||s>="0"&&s<="9"||s==="."||s==="_"||s==="-"))return null;continue}if("&|;<>$`(){}[]*?~#!\"'".includes(r))return null}return n?{windows:e.split("\\").join("/"),posixShell:e.split("\\").join("")}:null}function Zp(e){let n=[],t="";for(let r of e){if(r===" "||r==="	"){if(t.length>0){if(n.length>=64)return null;n.push(t),t=""}continue}t+=r}if(t.length>0){if(n.length>=64)return null;n.push(t)}return n}var Qp=/^[A-Za-z_][A-Za-z0-9_]*=/u;function em(e){let n=e.slice(e.lastIndexOf("/")+1);return n==="node"||n==="nodejs"}var Al=new Set(["flask","granian","gunicorn","hypercorn","php","php-fpm","puma","python","python2","python3","rails","ruby","streamlit","unicorn","uvicorn","uwsgi","waitress-serve"]);function nm(e){let n=e.slice(e.lastIndexOf("/")+1);return Al.has(n)||Al.has(n.replace(/[0-9.]+$/u,""))}var tm=new Set(["--abort-on-uncaught-exception","--disallow-code-generation-from-strings","--enable-source-maps","--experimental-json-modules","--experimental-modules","--experimental-vm-modules","--frozen-intrinsics","--harmony","--inspect","--inspect-brk","--no-warnings","--preserve-symlinks","--preserve-symlinks-main","--trace-uncaught","--trace-warnings","--use-strict","--zero-fill-buffers"]),rm=new Set(["--dns-result-order","--heapsnapshot-signal","--inspect-port","--max-http-header-size","--max-old-space-size","--max-semi-space-size","--stack-size","--title","--tls-cipher-list","--trace-event-categories","--unhandled-rejections","--v8-pool-size"]),om=new Set(["-e","--eval","-p","--print","--run","--env-file","--env-file-if-exists"]);function Rl(e){return e.includes("require")||e.includes("import")||e.includes("loader")}function Nl(e){if(Rl(e))return{token:e,why:"preloads another module; the launch surface is more than one file"};let n=e.indexOf("="),t=n===-1?e:e.slice(0,n);return om.has(t)?{token:t,why:"runs code that is not the script token (or can inject a preload); the entry file cannot be identified"}:tm.has(t)||n!==-1&&rm.has(t)?null:{token:t,why:"is not on cupel's allowlist of flags that provably do not change which file node runs \u2014 the entry file cannot be identified with certainty"}}var sm=[".js",".cjs",".mjs",".ts",".mts",".cts"];function im(e){return sm.some(n=>e.endsWith(n))}var am=new Set(["npm","yarn","pnpm"]);function lm(e){let n=e[0];return n===void 0||!am.has(n)?!1:e.length===2?e[1]==="start":e.length===3&&e[1]==="run"&&e[2]==="start"}function hs(e){let n=e.trim();if(n.length===0)return{kind:"unparsed",reason:"empty command"};if(n.length>4096)return{kind:"unparsed",reason:`command exceeds the ${String(4096)}-byte cap; not parsed`};if(!Yp(n))return ms(n);let t=Jp(n);if(t===null)return{kind:"unparsed",reason:"contains shell metacharacters (chaining/expansion/quoting) \u2014 not a plain `node <file>` invocation"};let r=ms(t.windows),o=ms(t.posixShell);if(r.kind==="file"){let s=o.kind==="file"?o.specifier:void 0;return s===void 0||s===r.specifier?{kind:"file",specifier:r.specifier}:{kind:"file",specifier:r.specifier,alt:s}}return o.kind==="file"?{kind:"file",specifier:o.specifier}:r}function ms(e){let n=Zp(e);if(n===null)return{kind:"unparsed",reason:"command has more tokens than cupel will consider"};let t=0;for(n[t]==="env"&&(t+=1);t<n.length;t+=1){let s=n[t];if(s===void 0||!Qp.test(s))break;if(Rl(s))return{kind:"unparsed",reason:`environment \`${nn(s)}\` preloads another module; the launch surface is more than one file`};let i=s.indexOf("=");if(s.slice(0,i)==="NODE_OPTIONS")for(let a of s.slice(i+1).split(/\s+/u)){if(a===""||!a.startsWith("-"))continue;let d=Nl(a);if(d!==null)return{kind:"unparsed",reason:`NODE_OPTIONS flag \`${nn(d.token)}\` ${d.why}`}}}let r=n[t];if(r===void 0)return{kind:"unparsed",reason:"no program in the command"};if(lm(n.slice(t)))return{kind:"delegates",target:"scripts.start"};if(!em(r))return nm(r)?{kind:"foreign",binary:r}:{kind:"unparsed",reason:`runs \`${nn(r)}\`, not node directly \u2014 the entry file cannot be identified`};for(t+=1;t<n.length;t+=1){let s=n[t];if(s===void 0||!s.startsWith("-"))break;let i=Nl(s);if(i!==null)return{kind:"unparsed",reason:`node flag \`${nn(i.token)}\` ${i.why}`}}let o=n[t];return o===void 0?{kind:"unparsed",reason:"node is invoked with no script file"}:im(o)?{kind:"file",specifier:o}:{kind:"unparsed",reason:`\`${nn(o)}\` has no .js/.cjs/.mjs/.ts extension \u2014 not confidently a JS entry file`}}function dm(e){for(let n of e)if(!(n>="a"&&n<="z"||n>="A"&&n<="Z"||n>="0"&&n<="9"||n==="_"||n==="-"))return!1;return e.length>0}var cm=64,gs=64*1024,um=64;function ys(e){let n=[],t=!1;for(let r of e.split(/\r?\n/u)){if(n.length>=um){t=!0;break}let o=/^\s*(CMD|ENTRYPOINT)\s+(.*\S)\s*$/iu.exec(r),s=/^\s*(command|entrypoint):\s*(.*\S)\s*$/u.exec(r),i=o??s;if(i?.[1]===void 0||i[2]===void 0)continue;let a=fm(i[2]);a!==null&&n.push({label:i[1].toUpperCase(),command:a})}return{commands:n,truncated:t}}function fm(e){let n=e.trim();if(!n.startsWith("["))return n===""?null:n;let t;try{t=JSON.parse(n)}catch{return null}if(!Array.isArray(t))return null;let r=t.filter(o=>typeof o=="string");return r.length===0||r.length!==t.length?null:r.join(" ")}function xs(e){let n=e.split(`
+`),t=n.length>64,r=[],o=0;for(let s of n.slice(0,64)){let i=s.trim();if(i.length===0||i.startsWith("#"))continue;let a=i.indexOf(":");if(a<=0)continue;let d=i.slice(a+1).trim();if(d.length===0)continue;let l=i.slice(0,a);if(l.length>cm||!dm(l)){o+=1;continue}r.push({name:l,command:d})}return r.sort((s,i)=>s.name===i.name?0:s.name==="web"?-1:i.name==="web"?1:0),{entries:r,truncated:t,unnamedLines:o}}import{realpathSync as Cl}from"node:fs";import Xe from"node:path";import f from"typescript";import C from"typescript";import Nt from"typescript";var Ss=["get","post","put","patch","delete","options","head","all"],pm=[{id:"express@4-source-v1",packages:["express"],members:new Set([...Ss,"use"]),sourceClass:"remote-unauthenticated",evidence:"https://expressjs.com/en/4x/api.html#app.METHOD \u2014 callbacks receive (req, res, next); error-handling middleware receives (err, req, res, next)"},{id:"koa@2-source-v1",packages:["koa","@koa/router","koa-router"],members:new Set([...Ss,"use"]),sourceClass:"remote-unauthenticated",evidence:"https://koajs.com/#context \u2014 middleware receives (ctx, next); ctx.request carries the request"},{id:"fastify@4-source-v1",packages:["fastify"],members:new Set(Ss),sourceClass:"remote-unauthenticated",evidence:"https://fastify.dev/docs/latest/Reference/Routes/ \u2014 handler receives (request, reply)"}];function Pl(e){let n=new Set(e.map(t=>t.startsWith("@")?t.split("/").slice(0,2).join("/"):t.split("/")[0]));return pm.filter(t=>t.packages.some(r=>n.has(r)))}function Yr(e,n){if(n.length===0)return null;let t=e.expression;for(;Nt.isParenthesizedExpression(t);)t=t.expression;if(!Nt.isPropertyAccessExpression(t))return null;let r=t.name.text,o=n.find(i=>i.members.has(r));if(o===void 0)return null;let s=e.arguments.filter(i=>Nt.isArrowFunction(i)||Nt.isFunctionExpression(i)||Nt.isIdentifier(i)||Nt.isPropertyAccessExpression(i));return s.length>0?{model:o,handlers:s}:null}function tr(e,n){return e.id.startsWith("express@")&&n===4?1:0}function Pt(e){return C.isFunctionDeclaration(e)||C.isFunctionExpression(e)||C.isArrowFunction(e)||C.isMethodDeclaration(e)||C.isConstructorDeclaration(e)||C.isGetAccessorDeclaration(e)||C.isSetAccessorDeclaration(e)}var bs=(e,n,t)=>({path:e,start:n.getStart(t,!1),end:n.getEnd()});function mm(e,n,t){let r=[];for(let o of e.parameters){if(C.isIdentifier(o.name)&&o.name.text==="this")continue;let s=C.isIdentifier(o.name)?o.name.text:void 0;r.push({index:r.length,kind:o.dotDotDotToken!==void 0?"rest":"positional",...s!==void 0?{name:s}:{},destructured:s===void 0,hasDefault:o.initializer!==void 0,range:bs(n,o,t)})}return r}function hm(e){return C.isArrowFunction(e)?"lexical":"call"}function gm(e){let n=!1,t=r=>{if(!n&&!(r!==e&&Pt(r)&&!C.isArrowFunction(r))){if(C.isIdentifier(r)&&r.text==="arguments"){let o=r.parent;C.isPropertyAccessExpression(o)&&o.name===r||C.isPropertyAssignment(o)&&o.name===r||(n=!0)}C.isCallExpression(r)&&C.isIdentifier(r.expression)&&r.expression.text==="eval"&&(n=!0),C.forEachChild(r,t)}};e.body!==void 0&&C.forEachChild(e.body,t);for(let r of e.parameters)r.initializer!==void 0&&t(r.initializer);return n}function ks(e,n,t,r=[]){let o=new Map;if(r.length>0){let c=p=>{if(C.isCallExpression(p)){let u=Yr(p,r);for(let m of u?.handlers??[])u!==null&&(C.isArrowFunction(m)||C.isFunctionExpression(m))&&o.set(m,u.model)}C.forEachChild(p,c)};c(n)}let s=[],i=c=>{Pt(c)&&s.push({start:c.getStart(n,!1),end:c.getEnd(),node:c}),C.forEachChild(c,i)};i(n),s.sort((c,p)=>c.start-p.start||p.end-c.end);let a=c=>{let p=0,u=s.length;for(;p<u;){let m=p+u>>>1;(s[m]?.start??1/0)<c?p=m+1:u=m}return p},d=e.map(c=>{if(c.declRange.path!==t||c.name==="<toplevel>")return;let{start:p,end:u}=c.declRange,m=a(p);for(;m<s.length&&(s[m]?.start??1/0)<u&&(s[m]?.end??0)>u;)m+=1;let h=s[m];if(h===void 0||h.start>=u||h.end>u)return;let x=s[a(h.end)];if(!(x!==void 0&&x.start<u&&x.end<=u))return h.node}),l=new Set(d.filter(c=>c!==void 0));return e.map((c,p)=>{if(c.name==="<toplevel>"&&c.declRange.path===t){let x=Ol(n,l,n,o);return x!==void 0?{...c,valueFlows:x}:c}let u=d[p];if(u===void 0)return c;let m=Ol(u,l,n,o),h=o.get(u);return{...c,...h!==void 0?{sourceParams:[{index:tr(h,u.parameters.length),sourceClass:h.sourceClass,model:h.id}]}:{},params:mm(u,t,n),receiver:hm(u),reflectiveArguments:gm(u),...m!==void 0?{valueFlows:m}:{}}})}var ym=new Set(["call","apply","bind"]);function ws(e,n,t,r){let o=n;for(;C.isParenthesizedExpression(o);)o=o.expression;let s=C.isPropertyAccessExpression(o)||C.isElementAccessExpression(o)?o.expression:void 0,i=s!==void 0?{receiverRange:bs(t,s,r)}:{},a={repeats:xm(e)};if(C.isTaggedTemplateExpression(e))return{convention:"unknown",...i,...a};let d=C.isPropertyAccessExpression(o)&&ym.has(o.name.text);return{args:e.arguments.map((c,p)=>({index:p,spread:C.isSpreadElement(c)?"positional":!1,range:bs(t,c,r)})),convention:d?"unknown":"direct",...i,...a}}function xm(e){for(let n=e.parent;n!==void 0;n=n.parent){if(C.isForStatement(n)||C.isForInStatement(n)||C.isForOfStatement(n)||C.isWhileStatement(n)||C.isDoStatement(n))return!0;if(C.isFunctionDeclaration(n)||C.isMethodDeclaration(n)||C.isConstructorDeclaration(n)||C.isGetAccessorDeclaration(n)||C.isSetAccessorDeclaration(n))return!1;if(C.isFunctionExpression(n)||C.isArrowFunction(n))return!(C.isVariableDeclaration(n.parent)&&n.parent.initializer===n)}return!0}var $l=2e4,Rt={kind:"constant"},zn=e=>({kind:"opaque",reason:e}),Jr=class extends Error{};function Ol(e,n,t,r){let o=[],s=(g,b,w)=>{for(let I of g)for(let N of b)if(o.push({from:I,to:N,kind:w}),o.length>$l)throw new Jr},i=g=>g.getStart(t,!1),a=new Map,d=(g,b)=>{let w=a.get(g);w===void 0?a.set(g,[b]):w.push(b)},l=g=>{if(C.isIdentifier(g))return[g];let b=[];for(let w of g.elements)C.isOmittedExpression(w)||b.push(...l(w.name));return b},c=g=>({kind:"local",name:g.text,declStart:i(g)}),p=C.isSourceFile(e)?[]:e.parameters.filter(g=>!(C.isIdentifier(g.name)&&g.name.text==="this"));p.forEach((g,b)=>{if(C.isIdentifier(g.name))d(g.name.text,{kind:"param",index:b});else for(let w of l(g.name))d(w.text,c(w))});let u=g=>{for(let b=g.parent;b!==void 0&&b!==e;b=b.parent)if(Pt(b)&&!C.isArrowFunction(b))return!0;return!1},m=g=>{if(g!==e&&Pt(g)){if(n.has(g))return;for(let b of g.parameters)for(let w of l(b.name))d(w.text,c(w))}else if(C.isVariableDeclaration(g))for(let b of l(g.name))d(b.text,c(b));else if((C.isFunctionDeclaration(g)||C.isClassDeclaration(g))&&g.name!==void 0&&g!==e)d(g.name.text,c(g.name));else if(C.isCatchClause(g)&&g.variableDeclaration!==void 0)for(let b of l(g.variableDeclaration.name))d(b.text,c(b));C.forEachChild(g,m)},h=[];C.isSourceFile(e)?h.push(e):e.body!==void 0&&h.push(e.body);for(let g of p)g.initializer!==void 0&&h.push(g.initializer);for(let g of h)m(g);let x=g=>g.text==="undefined"?[Rt]:g.text==="arguments"?[zn("reflective")]:a.get(g.text)??[{kind:"free",name:g.text}],y=g=>{if(C.isStringLiteral(g)||C.isNumericLiteral(g)||C.isBigIntLiteral(g)||C.isNoSubstitutionTemplateLiteral(g)||C.isRegularExpressionLiteral(g)||g.kind===C.SyntaxKind.TrueKeyword||g.kind===C.SyntaxKind.FalseKeyword||g.kind===C.SyntaxKind.NullKeyword||C.isFunctionExpression(g)||C.isArrowFunction(g)||C.isClassExpression(g)||C.isVoidExpression(g)||C.isDeleteExpression(g))return[Rt];if(C.isIdentifier(g))return x(g);if(g.kind===C.SyntaxKind.ThisKeyword)return u(g)||C.isSourceFile(e)?[zn("unmodeled")]:[{kind:"receiver"}];if(C.isParenthesizedExpression(g)||C.isAsExpression(g)||C.isNonNullExpression(g)||C.isTypeAssertionExpression(g)||C.isSatisfiesExpression(g)||C.isSpreadElement(g)||C.isTypeOfExpression(g)||C.isAwaitExpression(g))return y(g.expression);if(C.isYieldExpression(g))return g.expression!==void 0?y(g.expression):[Rt];if(C.isPropertyAccessExpression(g)||C.isElementAccessExpression(g))return y(g.expression);if(C.isCallExpression(g)){if(C.isIdentifier(g.expression)&&g.expression.text==="require"){let b=g.arguments[0];return b!==void 0&&C.isStringLiteralLike(b)?[Rt]:[zn("unmodeled")]}return g.expression.kind===C.SyntaxKind.ImportKeyword?[zn("unmodeled")]:[{kind:"call-result",at:i(g)}]}if(C.isTaggedTemplateExpression(g))return[{kind:"call-result",at:i(g)}];if(C.isNewExpression(g))return[zn("construct")];if(C.isConditionalExpression(g))return[...y(g.whenTrue),...y(g.whenFalse)];if(C.isBinaryExpression(g)){let b=g.operatorToken.kind;return b===C.SyntaxKind.CommaToken||b===C.SyntaxKind.EqualsToken?y(g.right):[...y(g.left),...y(g.right)]}return C.isPrefixUnaryExpression(g)||C.isPostfixUnaryExpression(g)?y(g.operand):C.isTemplateExpression(g)?g.templateSpans.flatMap(b=>y(b.expression)):C.isArrayLiteralExpression(g)?g.elements.flatMap(b=>y(b)):C.isObjectLiteralExpression(g)?g.properties.flatMap(b=>C.isPropertyAssignment(b)?y(b.initializer):C.isShorthandPropertyAssignment(b)?x(b.name):C.isSpreadAssignment(b)?y(b.expression):[Rt]):[zn("unmodeled")]},S=g=>C.isIdentifier(g)?x(g):C.isParenthesizedExpression(g)||C.isNonNullExpression(g)||C.isAsExpression(g)||C.isPropertyAccessExpression(g)||C.isElementAccessExpression(g)?S(g.expression):g.kind===C.SyntaxKind.ThisKeyword?u(g)||C.isSourceFile(e)?[]:[{kind:"receiver"}]:C.isArrayLiteralExpression(g)?g.elements.flatMap(b=>S(b)):C.isObjectLiteralExpression(g)?g.properties.flatMap(b=>C.isShorthandPropertyAssignment(b)?x(b.name):C.isPropertyAssignment(b)?S(b.initializer):C.isSpreadAssignment(b)?S(b.expression):[]):C.isSpreadElement(g)?S(g.expression):[],k=g=>S(g).filter(b=>b.kind==="local"||b.kind==="param"||b.kind==="receiver");p.forEach((g,b)=>{let w={kind:"param",index:b};g.initializer!==void 0&&s(y(g.initializer),[w],"copy"),C.isIdentifier(g.name)||s([w],l(g.name).map(c),"field")});let E=g=>{if(g!==e&&Pt(g)){if(n.has(g))return;let b=r.get(g),w=b!==void 0?tr(b,g.parameters.length):-1;g.parameters.forEach((I,N)=>{let v=b!==void 0&&N===w?{kind:"source",sourceClass:b.sourceClass,model:b.id}:zn("inner-function-param");s([v],l(I.name).map(c),"copy")})}else if(C.isVariableDeclaration(g)&&g.initializer!==void 0)s(y(g.initializer),l(g.name).map(c),C.isIdentifier(g.name)?"copy":"field");else if(C.isCatchClause(g)&&g.variableDeclaration!==void 0)s([zn("caught")],l(g.variableDeclaration.name).map(c),"copy");else if((C.isFunctionDeclaration(g)||C.isClassDeclaration(g))&&g.name!==void 0&&g!==e)s([Rt],[c(g.name)],"copy");else if(C.isForOfStatement(g)||C.isForInStatement(g)){let b=g.initializer,w=C.isVariableDeclarationList(b)?b.declarations.flatMap(I=>l(I.name).map(c)):S(b);s(y(g.expression),w,"derive")}else if(C.isBinaryExpression(g)&&Sm(g.operatorToken.kind)){let b=g.operatorToken.kind===C.SyntaxKind.EqualsToken?y(g.right):[...y(g.left),...y(g.right)],w=S(g.left);s(b,w,C.isIdentifier(g.left)?"copy":"field")}else if(C.isReturnStatement(g)&&g.expression!==void 0&&km(g)===e)s(y(g.expression),[{kind:"return"}],"return");else if(C.isCallExpression(g)&&!bm(g)){let b=i(g);g.arguments.forEach((I,N)=>{s(y(I),[{kind:"argument",at:b,index:N}],"argument"),s([{kind:"mutated-by-call",at:b,index:N}],k(I),"mutation")});let w=g.expression;for(;C.isParenthesizedExpression(w);)w=w.expression;(C.isPropertyAccessExpression(w)||C.isElementAccessExpression(w))&&(s(y(w.expression),[{kind:"call-receiver",at:b}],"argument"),s([{kind:"mutated-by-call",at:b,index:-1}],k(w.expression),"mutation"))}C.forEachChild(g,E)};try{for(let g of h)E(g);!C.isSourceFile(e)&&C.isArrowFunction(e)&&!C.isBlock(e.body)&&s(y(e.body),[{kind:"return"}],"return")}catch(g){if(g instanceof Jr)return;throw g}return o}function Sm(e){return e>=C.SyntaxKind.FirstAssignment&&e<=C.SyntaxKind.LastAssignment}function bm(e){return C.isIdentifier(e.expression)&&e.expression.text==="require"||e.expression.kind===C.SyntaxKind.ImportKeyword}function km(e){for(let n=e.parent;n!==void 0;n=n.parent)if(Pt(n))return n}var Ml=3;function ge(e,n,t){if(e===void 0)return;let r=e[n]??={fired:0,refused:{}};t===null?r.fired+=1:r.refused[t]=(r.refused[t]??0)+1}function Gn(e,n,t){return{path:e,start:n.getStart(t,!1),end:n.getEnd()}}var Qr=16,Is=256,Es=class{mods=new Map;fns=new Map;classNodes=new Map;classMembers=new Map;moduleFor(n){let t=`pkg:${n}`;return this.mods.has(n)||this.mods.set(n,{id:t,packageName:n,versionRange:"",path:n,moduleSystem:"dual",isEntrypoint:!1,externalSurface:!0}),t}exportFor(n,t){let r=`${n}#${t}`,o=`pkg:${n}#${t}`;return this.fns.has(r)||(this.moduleFor(n),this.fns.set(r,{id:o,moduleId:`pkg:${n}`,name:t,kind:"function",declRange:{path:n,start:0,end:0},isExported:!0,publicSurfaceReachable:!0})),o}classFor(n,t){let r=`${n}#${t}`,o=`pkg:${n}#${t}`;return this.classNodes.has(r)||(this.moduleFor(n),this.classNodes.set(r,{id:o,moduleId:`pkg:${n}`,name:t,implementsRefs:[],members:[]}),this.classMembers.set(r,[])),o}methodFor(n,t,r,o){let s=`${n}#${t}.${r}`,i=`pkg:${n}#${t}.${r}`;if(!this.fns.has(s)){let a=this.classFor(n,t);this.fns.set(s,{id:i,moduleId:`pkg:${n}`,name:r,kind:o,enclosingClassId:a,declRange:{path:n,start:0,end:0},isExported:!0,publicSurfaceReachable:!0}),this.classMembers.get(`${n}#${t}`)?.push(i)}return i}modules(){return[...this.mods.values()]}functions(){return[...this.fns.values()]}classes(){return[...this.classNodes.entries()].map(([n,t])=>({...t,members:this.classMembers.get(n)??[]}))}};function zl(e,n){let t="node_modules/",r=e.lastIndexOf(t);if(r===-1)return n;let s=e.slice(r+t.length).split("/");return s[0]?.startsWith("@")&&s.length>=2?`${s[0]}/${s[1]}`:s[0]??n}function Tl(e,n,t){let r=Xe.dirname(e),o=Xe.dirname(n),s=[];for(;;){let a=t.get(r);if(a!==void 0){for(let l of s)t.set(l,a);return a}s.push(r);let d=Fe(Xe.join(r,"package.json"));if(d!==null)try{let l=JSON.parse(d),c={name:l.name??"app",version:l.version??"0.0.0",dir:r};for(let p of s)t.set(p,c);return c}catch{}if(r===o||r===Xe.dirname(r))break;r=Xe.dirname(r)}let i={name:"app",version:"0.0.0",dir:null};for(let a of s)t.set(a,i);return i}function vs(e){return f.isParenthesizedExpression(e)?vs(e.expression):f.isStringLiteralLike(e)?e.text:f.isTemplateExpression(e)?e.head.text:f.isBinaryExpression(e)&&e.operatorToken.kind===f.SyntaxKind.PlusToken?vs(e.left):null}function wm(e){if(!f.isCallExpression(e))return!1;let n=e.expression,t=f.isPropertyAccessExpression(n)?n.name.text:f.isIdentifier(n)?n.text:null;if(t!=="join"&&t!=="resolve")return!1;let r=e.arguments[0];return r!==void 0&&f.isIdentifier(r)&&(r.text==="__dirname"||r.text==="__filename")}function Gl(e){let n=vs(e);return n!==null?n.startsWith("./")||n.startsWith("../")?"relative-bounded":n.length>0&&!n.startsWith(".")&&!n.startsWith("/")?"bare":"unknown":wm(e)?"relative-bounded":"unknown"}function Em(e){let n=[],t=r=>{if(f.isImportDeclaration(r)&&f.isStringLiteralLike(r.moduleSpecifier))n.push({specifier:r.moduleSpecifier.text,specifierIsLiteral:!0,dynamic:!1});else if(f.isImportEqualsDeclaration(r)&&f.isExternalModuleReference(r.moduleReference)&&f.isStringLiteralLike(r.moduleReference.expression))n.push({specifier:r.moduleReference.expression.text,specifierIsLiteral:!0,dynamic:!1});else if(f.isExportDeclaration(r)&&r.moduleSpecifier!==void 0&&f.isStringLiteralLike(r.moduleSpecifier))n.push({specifier:r.moduleSpecifier.text,specifierIsLiteral:!0,dynamic:!1});else if(f.isCallExpression(r)){let o=nr(r);if(o!==null){let s=o.specifierArg,i=s!==void 0&&f.isStringLiteralLike(s);n.push({specifier:i?s.text:void 0,specifierIsLiteral:i,dynamic:!0,...s!==void 0&&!i?{computedArg:s,loadPos:r.getStart(e)}:{}})}}f.forEachChild(r,t)};return t(e),n}function vm(e,n,t){let r=new Map,o=Tl(Xe.join(e.appRoot,"package.json"),e.appRoot,r),s=[],i=[],a=[],d=new Map,l=new Set,c=[],p=new Set;for(let u of e.sourceFiles){let m=e.toRel(u.fileName);m!==null&&p.add(m)}for(let u of e.sourceFiles){let m=e.toRel(u.fileName);if(m===null)continue;let h=Tl(u.fileName,e.appRoot,r),x=zl(m,o.name),y=m.includes("node_modules/");s.push({id:m,packageName:y&&h.name!==o.name?h.name:x,versionRange:h.version,path:m,moduleSystem:"cjs",isEntrypoint:n.has(m)}),h.dir===o.dir&&l.add(m);let S=0,k=null;for(let E of Em(u)){let g=`${m}#import${String(S)}`;S+=1;let b=null,w=[];if(E.specifier!==void 0)if(Ae(E.specifier)==="package-root")b=t.moduleFor(Qe(E.specifier));else{let I=en(E.specifier,u.fileName,e.options,e.host),N=I!==null?e.toRel(I):null;if(N!==null)b=N;else if(E.specifier!==void 0){let[v,..._]=It(E.specifier,u.fileName,e.options,e.host).map(P=>e.toRel(P)).filter(P=>P!==null&&p.has(P));v!==void 0&&_.length>=1&&(b=v,w=_.map(P=>P))}}i.push({id:g,moduleId:m,specifier:E.specifier??"<computed>",isNamespace:!1,isDefault:!1,dynamic:E.dynamic,specifierIsLiteral:E.specifierIsLiteral,...b!==null?{resolvedModuleId:b}:{}}),b!==null&&a.push({importId:g,resolvedModuleId:b});for(let I of w)a.push({importId:g,resolvedModuleId:I});if(E.computedArg!==void 0&&E.loadPos!==void 0&&c.push({importId:String(g),path:m,pos:E.loadPos,shape:Gl(E.computedArg),text:E.computedArg.getText(u).slice(0,160)}),E.computedArg!==void 0&&E.loadPos!==void 0){k??=lt(u,u.fileName,e.resolveParamDirs);let I=[];for(let N of Ur(E.computedArg,k,e.appRoot,e.options,e.host)){let v=e.toRel(N);if(v===null||!p.has(v))continue;let _=v,P=`${m}#import${String(S)}`;S+=1,i.push({id:P,moduleId:m,specifier:v,isNamespace:!1,isDefault:!1,dynamic:!0,specifierIsLiteral:!0,resolvedModuleId:_}),a.push({importId:P,resolvedModuleId:_}),I.push(v)}if(I.length>0){let N=Zt(E.computedArg,k)!==null||Kr(E.computedArg),v=d.get(m)??[];v.push({pos:E.loadPos,candidateRels:I,seedable:N}),d.set(m,v)}}}}return{modules:s,imports:i,importEdges:a,computedLoads:d,appOwnedPaths:l,loadSites:c}}function _m(e){let n=Fe(e);if(n===null)return null;let t=f.createSourceFile(e,n,f.ScriptTarget.Latest,!0),r=o=>t.statements.some(s=>f.isFunctionDeclaration(s)?s.name?.text===o:f.isVariableStatement(s)?s.declarationList.declarations.some(i=>f.isIdentifier(i.name)&&i.name.text===o&&i.initializer!==void 0&&(f.isFunctionExpression(i.initializer)||f.isArrowFunction(i.initializer))):!1);for(let o of t.statements){if(f.isFunctionDeclaration(o)&&o.name!==void 0&&o.modifiers?.some(i=>i.kind===f.SyntaxKind.DefaultKeyword)===!0)return o.name.text;if(!f.isExpressionStatement(o)||!f.isBinaryExpression(o.expression))continue;let s=o.expression;if(s.operatorToken.kind===f.SyntaxKind.EqualsToken&&Im(s.left)){if(f.isFunctionExpression(s.right)&&s.right.name!==void 0)return s.right.name.text;if(f.isIdentifier(s.right)&&r(s.right.text))return s.right.text}}return null}function Im(e){return f.isPropertyAccessExpression(e)&&f.isIdentifier(e.expression)&&e.expression.text==="module"&&e.name.text==="exports"?!0:f.isElementAccessExpression(e)&&f.isIdentifier(e.expression)&&e.expression.text==="module"&&f.isStringLiteralLike(e.argumentExpression)&&e.argumentExpression.text==="exports"}function Am(e,n,t){for(let l of e.surfacePackages)n.moduleFor(l);let r=l=>"surface"in l?n.moduleFor(l.surface):l.module,o=[],s=new Set;for(let l of e.modules)t.has(l)||s.has(l)||(s.add(l),o.push({id:l,packageName:e.entryRealNames[l]??zl(l,"app"),versionRange:"",path:l,moduleSystem:"cjs",isEntrypoint:!1}));let i=[],a=[],d=0;for(let l of e.edges){let c=r(l.from),p=r(l.to),u=`${String(c)}#depreach${String(d)}`;d+=1,i.push({id:u,moduleId:c,specifier:"<dep-module-reach>",isNamespace:!1,isDefault:!1,dynamic:!1,specifierIsLiteral:!0,resolvedModuleId:p}),a.push({importId:u,resolvedModuleId:p})}return{modules:o,imports:i,importEdges:a}}function Dl(e,n,t){let r=e.expression;if(f.isIdentifier(r)&&!t.has(r.text)){let o=n.get(r.text);if(o?.kind==="package-export")return{kind:"package-instance",packageName:o.packageName,className:o.exportName};if(o?.kind==="app-class")return{kind:"app-instance",cls:o.cls}}else if(f.isPropertyAccessExpression(r)&&f.isIdentifier(r.expression)&&!t.has(r.expression.text)){let o=n.get(r.expression.text);if(o?.kind==="package-surface")return{kind:"package-instance",packageName:o.packageName,className:r.name.text}}return null}function ct(e){return f.canHaveModifiers(e)&&(f.getModifiers(e)?.some(n=>n.kind===f.SyntaxKind.ExportKeyword)??!1)}function Nm(e){let n=new Set,t;for(let r of e.statements){if(f.isExpressionStatement(r)&&f.isBinaryExpression(r.expression)){let o=r.expression;if(o.operatorToken.kind===f.SyntaxKind.EqualsToken&&f.isPropertyAccessExpression(o.left)&&f.isIdentifier(o.left.expression)&&o.left.expression.text==="module"&&o.left.name.text==="exports"){if(f.isIdentifier(o.right))n.add(o.right.text),t=o.right.text;else if(f.isObjectLiteralExpression(o.right))for(let s of o.right.properties)f.isShorthandPropertyAssignment(s)?n.add(s.name.text):f.isPropertyAssignment(s)&&f.isIdentifier(s.initializer)&&n.add(s.initializer.text)}continue}if(f.isFunctionDeclaration(r)&&r.name!==void 0&&ct(r))n.add(r.name.text);else if(f.isVariableStatement(r)&&ct(r))for(let o of r.declarationList.declarations)f.isIdentifier(o.name)&&n.add(o.name.text);else if(f.isExportDeclaration(r)&&r.exportClause&&f.isNamedExports(r.exportClause))for(let o of r.exportClause.elements)n.add((o.propertyName??o.name).text);else f.isExportAssignment(r)&&f.isIdentifier(r.expression)&&(n.add(r.expression.text),t=r.expression.text)}return{reachableLocals:n,defaultTarget:t}}function Rm(e){for(let n of e.statements){if(f.isFunctionDeclaration(n)&&n.name!==void 0&&ct(n)&&f.getModifiers(n)?.some(t=>t.kind===f.SyntaxKind.DefaultKeyword)===!0)return{name:n.name.text,esm:!0};if(f.isExportAssignment(n)&&!n.isExportEquals&&f.isIdentifier(n.expression))return{name:n.expression.text,esm:!0};if(f.isExpressionStatement(n)&&f.isBinaryExpression(n.expression)){let t=n.expression;if(t.operatorToken.kind===f.SyntaxKind.EqualsToken&&We(t.left)&&f.isIdentifier(t.right))return{name:t.right.text,esm:!1}}}}function En(e){if(f.isCallExpression(e)&&f.isIdentifier(e.expression)&&e.expression.text==="require"&&e.arguments.length===1&&e.arguments[0]!==void 0&&f.isStringLiteralLike(e.arguments[0]))return e.arguments[0].text}function We(e){return f.isPropertyAccessExpression(e)&&f.isIdentifier(e.expression)&&e.expression.text==="module"&&e.name.text==="exports"?!0:f.isElementAccessExpression(e)&&f.isIdentifier(e.expression)&&e.expression.text==="module"&&f.isStringLiteralLike(e.argumentExpression)&&e.argumentExpression.text==="exports"}function cn(e){if(We(e))return!0;if(!f.isPropertyAccessExpression(e)&&!f.isElementAccessExpression(e))return!1;let n=e.expression;return f.isIdentifier(n)&&n.text==="exports"?!0:We(n)}function $t(e){return f.isPropertyAccessExpression(e.expression)&&f.isIdentifier(e.expression.expression)&&e.expression.expression.text==="Object"&&e.expression.name.text==="assign"}function Wl(e){let n=!1,t=r=>{if(!n){if(f.isCallExpression(r)){let o=En(r);if(o!==void 0&&Ae(o)!=="package-root"){n=!0;return}}f.forEachChild(r,t)}};return t(e),n}function ql(e){let n=new Set,t=o=>o!==void 0&&Wl(o),r=o=>{f.isVariableDeclaration(o)&&t(o.initializer)&&Jt(o.name,n),f.isBinaryExpression(o)&&o.operatorToken.kind===f.SyntaxKind.EqualsToken&&f.isIdentifier(o.left)&&t(o.right)&&n.add(o.left.text),f.forEachChild(o,r)};return r(e),n}function Vl(e,n){for(let t of e.properties)f.isShorthandPropertyAssignment(t)?n.add(t.name.text):f.isPropertyAssignment(t)&&f.isIdentifier(t.initializer)&&n.add(t.initializer.text)}function Pm(e){let n=new Set;for(let a of e.statements)if(f.isFunctionDeclaration(a)&&a.name!==void 0)n.add(a.name.text);else if(f.isClassDeclaration(a)&&a.name!==void 0)n.add(a.name.text);else if(f.isVariableStatement(a))for(let d of a.declarationList.declarations)f.isIdentifier(d.name)&&d.initializer!==void 0&&(f.isFunctionExpression(d.initializer)||f.isArrowFunction(d.initializer)||f.isObjectLiteralExpression(d.initializer))&&n.add(d.name.text);let t=a=>f.isFunctionExpression(a)||f.isArrowFunction(a)||f.isObjectLiteralExpression(a)||f.isIdentifier(a)&&n.has(a.text),r=new Set,o=a=>{f.isIdentifier(a)?r.add(a.text):f.isObjectLiteralExpression(a)&&Vl(a,r)},s=!1,i=a=>{if(!s){if(f.isBinaryExpression(a)&&a.operatorToken.kind===f.SyntaxKind.EqualsToken)if(We(a.left)){o(a.right);let d=a.right;(f.isObjectLiteralExpression(d)?d.properties.every(c=>f.isShorthandPropertyAssignment(c)&&n.has(c.name.text)||f.isPropertyAssignment(c)&&t(c.initializer)):t(d))||(s=!0)}else cn(a.left)&&(t(a.right)||(s=!0));else(f.isCallExpression(a)&&$t(a)&&a.arguments[0]!==void 0&&ut(a.arguments[0])||f.isExportDeclaration(a)&&a.moduleSpecifier!==void 0)&&(s=!0);s||f.forEachChild(a,i)}};if(i(e),!s&&r.size>0){for(let a of Jl(e))if(r.has(a)){s=!0;break}}return s}function ut(e){return cn(e)||f.isIdentifier(e)&&e.text==="exports"}function Hl(e){if(!f.isPropertyAccessExpression(e.expression)||!f.isIdentifier(e.expression.expression))return!1;let n=e.expression.expression.text,t=e.expression.name.text;return n==="Object"&&(t==="defineProperty"||t==="defineProperties")||n==="Reflect"&&(t==="defineProperty"||t==="set")}function As(e){return Hl(e)&&e.arguments[0]!==void 0&&ut(e.arguments[0])}function Om(e){return Hl(e)&&e.arguments[0]!==void 0&&f.isIdentifier(e.arguments[0])&&e.arguments[0].text==="module"}function $m(e){for(let n of e.declarations??[])if(f.isExportSpecifier(n)){if(n.isTypeOnly)return!0;let t=n.parent.parent;if(f.isExportDeclaration(t)&&t.isTypeOnly)return!0}else if(f.isImportSpecifier(n)){if(n.isTypeOnly)return!0;let t=n.parent.parent;if(f.isImportClause(t)&&t.isTypeOnly)return!0}return!1}function Cm(e,n,t,r,o){let s=(e.declarations??[]).filter(a=>!f.isSourceFile(a)&&!f.isModuleDeclaration(a));for(let a of s){let d=a.getSourceFile(),l=n.toRel(d.fileName);if(l===null||o.has(l))continue;let c=t.get(`${l}::${String(a.getStart(d,!1))}`);if(c!==void 0)return c}let i=e.getName();for(let a of s){let d=n.toRel(a.getSourceFile().fileName);if(d===null||o.has(d))continue;let l=r.get(`${d}::${i}`);if(l!==void 0)return l}}function eo(e){return f.isPropertyAccessExpression(e)?e.name.text:f.isStringLiteralLike(e.argumentExpression)?e.argumentExpression.text:void 0}var Ns=/^[A-Za-z_$][A-Za-z0-9_$]*$/u;function Rs(e){let n=f.isPropertyAccessExpression(e)||f.isElementAccessExpression(e)?eo(e):void 0;return n!==void 0&&n!=="__proto__"&&Ns.test(n)?n:void 0}function Mm(e){return e!=="__proto__"&&Ns.test(e)}function Ll(e){let n=Pe(e);return f.isIdentifier(n)&&(n.text==="exports"||n.text==="module")||We(n)}function Tm(e){if(!f.isArrayLiteralExpression(e)&&!f.isObjectLiteralExpression(e))return!1;let n=!1,t=r=>{n||(cn(r)?n=!0:f.forEachChild(r,t))};return t(e),n}function Ps(e){let n=!1,t=new Map,r=o=>{if(!n){if(f.isBinaryExpression(o)&&o.operatorToken.kind>=f.SyntaxKind.FirstAssignment&&o.operatorToken.kind<=f.SyntaxKind.LastAssignment){if(We(o.left)||f.isIdentifier(o.left)&&o.left.text==="exports")n=!0;else if(o.operatorToken.kind===f.SyntaxKind.EqualsToken&&Ll(o.right))n=!0;else if(Tm(o.left))n=!0;else if(cn(o.left)){let s=Rs(o.left);s===void 0?n=!0:t.set(s,(t.get(s)??0)+1)}}else(f.isCallExpression(o)&&$t(o)&&o.arguments[0]!==void 0&&ut(o.arguments[0])||f.isCallExpression(o)&&As(o)||f.isCallExpression(o)&&Om(o)||f.isVariableDeclaration(o)&&o.initializer!==void 0&&Ll(o.initializer))&&(n=!0);n||f.forEachChild(o,r)}};return r(e),{surfaceEscapes:n,assignCount:t}}function Os(e){let n=[];for(let t of e.statements){if(!f.isExpressionStatement(t)||!f.isBinaryExpression(t.expression))continue;let r=t.expression;r.operatorToken.kind===f.SyntaxKind.EqualsToken&&(!cn(r.left)||We(r.left)||n.push({bin:r,name:Rs(r.left)}))}return n}function Dm(e){let{surfaceEscapes:n,assignCount:t}=Ps(e);if(n)return[];let r=[];for(let{bin:o,name:s}of Os(e))s===void 0||(t.get(s)??0)!==1||(f.isFunctionExpression(o.right)||f.isArrowFunction(o.right))&&r.push({name:s,value:o.right});return r}function Lm(e,n){let{surfaceEscapes:t,assignCount:r}=Ps(e);if(t)return[];let o=[];for(let{bin:s,name:i}of Os(e))i===void 0||(r.get(i)??0)!==1||f.isIdentifier(s.right)&&!n.has(s.right.text)&&o.push(s.right.text);return o}function Fm(e,n){let{surfaceEscapes:t,assignCount:r}=Ps(e);for(let{bin:o,name:s}of Os(e)){let i=o.right;if(!(f.isFunctionExpression(i)||f.isArrowFunction(i)||f.isIdentifier(i)))continue;let d=f.isFunctionExpression(i)||f.isArrowFunction(i)||f.isIdentifier(i)&&!n.has(i.text);if(!(!t&&s!==void 0&&(r.get(s)??0)===1&&d))return!0}return!1}function jm(e){let n=f.isPropertyAccessExpression(e)||f.isElementAccessExpression(e)?e.expression:void 0;return n!==void 0&&f.isIdentifier(n)&&n.text==="exports"?"exports":"module.exports"}function Fl(e){let n=e.parent;return n===void 0?!1:f.isPropertyAccessExpression(n)?n.name===e:f.isQualifiedName(n)?n.right===e:f.isBindingElement(n)||f.isImportSpecifier(n)?n.propertyName===e:f.isExportSpecifier(n)?!0:f.isPropertyAssignment(n)||f.isPropertyDeclaration(n)||f.isPropertySignature(n)||f.isMethodDeclaration(n)||f.isMethodSignature(n)||f.isGetAccessorDeclaration(n)||f.isSetAccessorDeclaration(n)||f.isEnumMember(n)?n.name===e:!1}function jl(e){for(let n=e.parent;n!==void 0;n=n.parent){if(f.isSourceFile(n))return!0;if(!f.isArrowFunction(n)&&(f.isFunctionLike(n)||f.isClassLike(n)))return!1}return!0}function Bm(e,n){let t=r=>{f.isIdentifier(r)&&(r.text==="exports"||r.text==="module")&&n.add(r),f.forEachChild(r,t)};t(e)}function Km(e){let n=[],t=new Set;for(let s of e.statements){if(f.isExportDeclaration(s)||f.isExportAssignment(s)||f.isImportDeclaration(s)||f.isImportEqualsDeclaration(s)||ct(s))return null;if(!f.isExpressionStatement(s)||!f.isBinaryExpression(s.expression))continue;let i=s.expression;if(i.operatorToken.kind===f.SyntaxKind.EqualsToken){if(We(i.left))n.push({kind:"whole",value:i.right});else if(cn(i.left)){let a=Rs(i.left);if(a===void 0)return null;n.push({kind:"member",name:a,value:i.right,root:jm(i.left)})}else continue;Bm(i.left,t)}}let r=!1,o=s=>{if(!r){if(f.isIdentifier(s)&&(s.text==="exports"||s.text==="module")&&!t.has(s)&&!Fl(s)){r=!0;return}if(s.kind===f.SyntaxKind.ThisKeyword&&jl(s)){r=!0;return}if(f.isIdentifier(s)&&s.text==="arguments"&&!Fl(s)&&jl(s)){r=!0;return}f.forEachChild(s,o)}};return o(e),r?null:n}function _s(e){return f.isIdentifier(e)||f.isStringLiteralLike(e)?e.text:void 0}function Bl(e,n,t){return f.isIdentifier(e)?n(e.text):t?.(e)}function Um(e,n,t,r){let o=new Map,s=Km(e);if(s===null||s.filter(m=>m.kind==="whole").length>1)return o;let i=s.findIndex(m=>m.kind==="whole"),a=(m,h)=>i>=0&&h>i&&m.kind==="member"&&m.root==="exports",d=s.some(a);if(d){let m=s[i];if(m===void 0||m.kind!=="whole"||!f.isObjectLiteralExpression(m.value))return o}let l=d?s.filter((m,h)=>!a(m,h)):s,c=new Map;for(let m of l)m.kind==="member"&&c.set(m.name,(c.get(m.name)??0)+1);let p=m=>n.has(m)?void 0:t(m),u=(m,h)=>{h===void 0?o.delete(m):o.set(m,h)};for(let m of l){if(m.kind==="member"){u(m.name,(c.get(m.name)??0)>1?void 0:Bl(m.value,p,r));continue}o.clear();let h=m.value;if(f.isObjectLiteralExpression(h))for(let x of h.properties){if(f.isSpreadAssignment(x))return new Map;if(f.isShorthandPropertyAssignment(x)){u(x.name.text,p(x.name.text));continue}let y=_s(x.name);if(y===void 0)return new Map;u(y,f.isPropertyAssignment(x)?Bl(x.initializer,p,r):void 0)}}return o}function Xl(e,n,t,r){let o=new Map,s=a=>a!==void 0&&Ae(a)==="relative"?t.get(`${n}::${a}`):void 0,i=a=>{if(f.isVariableDeclaration(a)&&a.initializer!==void 0){let d=a.initializer;if(f.isIdentifier(a.name)&&!r.has(a.name.text)){let l=s(En(d));if(l!==void 0)o.set(a.name.text,{kind:"whole",target:l});else if((f.isPropertyAccessExpression(d)||f.isElementAccessExpression(d))&&f.isCallExpression(d.expression)){let c=s(En(d.expression)),p=eo(d);c!==void 0&&p!==void 0&&o.set(a.name.text,{kind:"member",target:c,member:p})}}else if(f.isObjectBindingPattern(a.name)){let l=s(En(d));if(l!==void 0){for(let c of a.name.elements)if(f.isIdentifier(c.name)&&!r.has(c.name.text)){let p=c.propertyName!==void 0&&f.isIdentifier(c.propertyName)?c.propertyName.text:c.name.text;o.set(c.name.text,{kind:"member",target:l,member:p})}}}}f.forEachChild(a,i)};return i(e),o}function zm(e,n,t,r){let o=i=>i!==void 0&&Ae(i)==="relative"?t.get(`${n}::${i}`):void 0,s=o(En(e));if(s!==void 0)return{kind:"whole",target:s};if(f.isPropertyAccessExpression(e)||f.isElementAccessExpression(e)){let i=eo(e);if(i===void 0)return;let a=o(En(e.expression));if(a!==void 0)return{kind:"member",target:a,member:i};if(f.isIdentifier(e.expression)){let d=r.get(e.expression.text);if(d?.kind==="whole")return{kind:"member",target:d.target,member:i}}return}if(f.isIdentifier(e))return r.get(e.text)}function Yl(e,n,t,r,o){let s=[],i=!1,a=p=>{if(Wl(p))return!0;let u=!1,m=h=>{u||(f.isIdentifier(h)&&o.has(h.text)?u=!0:f.forEachChild(h,m))};return m(p),u},d=(p,u)=>{let m=zm(p,n,t,r);m!==void 0?s.push({source:m,exportedName:u}):a(p)&&(i=!0)},l=p=>{if(f.isObjectLiteralExpression(p)){for(let u of p.properties)if(f.isSpreadAssignment(u))d(u.expression,"default");else if(f.isPropertyAssignment(u)){let m=f.isIdentifier(u.name)||f.isStringLiteralLike(u.name)?u.name.text:"default";d(u.initializer,m)}else if(f.isShorthandPropertyAssignment(u)){let m=r.get(u.name.text);m!==void 0&&s.push({source:m,exportedName:u.name.text})}return}d(p,"default")},c=p=>{if(f.isBinaryExpression(p)&&p.operatorToken.kind>=f.SyntaxKind.FirstAssignment&&p.operatorToken.kind<=f.SyntaxKind.LastAssignment){if(We(p.left)){l(p.right);return}if(cn(p.left)){let u=f.isPropertyAccessExpression(p.left)?p.left.name.text:f.isElementAccessExpression(p.left)&&f.isStringLiteralLike(p.left.argumentExpression)?p.left.argumentExpression.text:"default";d(p.right,u);return}}else if(f.isExportAssignment(p)&&p.isExportEquals){d(p.expression,"default");return}else if(f.isCallExpression(p)&&$t(p)&&p.arguments[0]!==void 0&&ut(p.arguments[0])){for(let u of p.arguments.slice(1))l(u);return}f.forEachChild(p,c)};return c(e),{sources:s,residual:i}}function Jl(e){let n=new Set,t=o=>{let s=o;for(;f.isPropertyAccessExpression(s)||f.isElementAccessExpression(s);)s=s.expression;return f.isIdentifier(s)?s.text:void 0},r=o=>{let s=Zl(o);if(s!==void 0){let i=t(s);i!==void 0&&n.add(i)}f.forEachChild(o,r)};return r(e),n}function Zl(e){return f.isBinaryExpression(e)&&e.operatorToken.kind>=f.SyntaxKind.FirstAssignment&&e.operatorToken.kind<=f.SyntaxKind.LastAssignment&&(f.isPropertyAccessExpression(e.left)||f.isElementAccessExpression(e.left))?e.left:void 0}function Zr(e){if(f.isIdentifier(e))return[e.text];let n=[];for(let t of e.elements)f.isBindingElement(t)&&n.push(...Zr(t.name));return n}function Ge(e){if(f.isIdentifier(e))return[e.text];if(f.isParenthesizedExpression(e)||f.isAsExpression(e)||f.isNonNullExpression(e)||f.isSatisfiesExpression(e)||f.isTypeAssertionExpression(e)||f.isAwaitExpression(e))return Ge(e.expression);if(f.isYieldExpression(e))return e.expression!==void 0?Ge(e.expression):[];if(f.isBinaryExpression(e)){let n=e.operatorToken.kind;return n===f.SyntaxKind.BarBarToken||n===f.SyntaxKind.AmpersandAmpersandToken||n===f.SyntaxKind.QuestionQuestionToken?[...Ge(e.left),...Ge(e.right)]:n===f.SyntaxKind.CommaToken?Ge(e.right):[]}return f.isConditionalExpression(e)?[...Ge(e.whenTrue),...Ge(e.whenFalse)]:f.isArrayLiteralExpression(e)?e.elements.flatMap(n=>f.isSpreadElement(n)?Ge(n.expression):f.isOmittedExpression(n)?[]:Ge(n)):f.isObjectLiteralExpression(e)?e.properties.flatMap(n=>f.isShorthandPropertyAssignment(n)?[n.name.text]:f.isPropertyAssignment(n)?Ge(n.initializer):f.isSpreadAssignment(n)?Ge(n.expression):[]):[]}function Ql(e,n){let t=[],r=(a,d)=>{for(let l of a)for(let c of d)l!==c&&t.push({a:l,b:c})},o=a=>f.isIdentifier(a)?[a.text]:f.isArrayLiteralExpression(a)?a.elements.flatMap(o):f.isObjectLiteralExpression(a)?a.properties.flatMap(d=>f.isShorthandPropertyAssignment(d)?[d.name.text]:f.isPropertyAssignment(d)?o(d.initializer):[]):[],s=a=>{f.isBinaryExpression(a)&&a.operatorToken.kind===f.SyntaxKind.EqualsToken?r(o(a.left),Ge(a.right)):f.isVariableDeclaration(a)&&a.initializer!==void 0?r(Zr(a.name),Ge(a.initializer)):(f.isForOfStatement(a)||f.isForInStatement(a))&&f.isVariableDeclarationList(a.initializer)&&a.initializer.declarations[0]!==void 0&&r(Zr(a.initializer.declarations[0].name),Ge(a.expression)),f.forEachChild(a,s)};s(e);let i=new Set(n);for(let a=!0;a;){a=!1;for(let{a:d,b:l}of t)i.has(d)&&!i.has(l)&&(i.add(l),a=!0),i.has(l)&&!i.has(d)&&(i.add(d),a=!0)}return i}function ed(e,n){let t=a=>{if(!f.isPropertyAccessExpression(a)&&!f.isElementAccessExpression(a))return;let d=a;for(;f.isPropertyAccessExpression(d)||f.isElementAccessExpression(d);)d=d.expression;return f.isIdentifier(d)?d.text:void 0},r=[],o=(a,d)=>{for(let c of Ge(d))r.push({name:a,root:c});let l=t(d);l!==void 0&&r.push({name:a,root:l})},s=a=>{f.isVariableDeclaration(a)&&f.isIdentifier(a.name)&&a.initializer!==void 0?o(a.name.text,a.initializer):f.isBinaryExpression(a)&&a.operatorToken.kind===f.SyntaxKind.EqualsToken&&f.isIdentifier(a.left)&&o(a.left.text,a.right),f.forEachChild(a,s)};s(e);let i=new Map(n);for(let a=!0;a;){a=!1;for(let{name:d,root:l}of r){let c=i.get(l);c!==void 0&&!i.has(d)&&(i.set(d,c),a=!0)}}return i}function nd(e){return Ql(e,Jl(e))}function Gm(e,n){let t=d=>d>=f.SyntaxKind.FirstAssignment&&d<=f.SyntaxKind.LastAssignment,r=d=>{let l=d.parent;if(l===void 0||!f.isObjectLiteralExpression(l))return!1;let c=l.parent;return c!==void 0&&f.isBinaryExpression(c)&&c.operatorToken.kind===f.SyntaxKind.EqualsToken&&c.right===l&&cn(c.left)?!0:c!==void 0&&f.isCallExpression(c)&&$t(c)&&c.arguments[0]!==void 0&&ut(c.arguments[0])&&c.arguments.indexOf(l)>0},o=(d,l)=>{if((f.isFunctionDeclaration(l)||f.isFunctionExpression(l))&&l.name===d||f.isVariableDeclaration(l)&&l.name===d||f.isParameter(l)&&l.name===d||f.isBindingElement(l)&&l.name===d||(f.isCallExpression(l)||f.isNewExpression(l))&&l.expression===d)return!0;if((f.isPropertyAccessExpression(l)||f.isElementAccessExpression(l))&&l.expression===d){let c=l;for(;c.parent!==void 0&&(f.isPropertyAccessExpression(c.parent)||f.isElementAccessExpression(c.parent))&&c.parent.expression===c;)c=c.parent;let p=c.parent;return!(p!==void 0&&f.isBinaryExpression(p)&&t(p.operatorToken.kind)&&p.left===c)}return f.isBinaryExpression(l)&&l.operatorToken.kind===f.SyntaxKind.EqualsToken&&l.right===d&&cn(l.left)?!0:f.isShorthandPropertyAssignment(l)&&l.name===d||f.isPropertyAssignment(l)&&l.initializer===d?r(l):!!(f.isExportAssignment(l)&&l.expression===d||f.isExportSpecifier(l))},s=(d,l)=>f.isPropertyAccessExpression(l)&&l.name===d||f.isPropertyAssignment(l)&&l.name===d||(f.isMethodDeclaration(l)||f.isGetAccessorDeclaration(l)||f.isSetAccessorDeclaration(l))&&l.name===d,i=!1,a=(d,l)=>{if(!i){if(f.isIdentifier(d)&&l!==void 0&&n.has(d.text)&&!s(d,l)&&!o(d,l)){i=!0;return}f.forEachChild(d,c=>a(c,d))}};return a(e,void 0),i}function Wm(e){let n=new Set;for(let d of e.statements)if(f.isFunctionDeclaration(d)&&d.name!==void 0)n.add(d.name.text);else if(f.isVariableStatement(d))for(let l of d.declarationList.declarations)f.isIdentifier(l.name)&&l.initializer!==void 0&&(f.isFunctionExpression(l.initializer)||f.isArrowFunction(l.initializer))&&n.add(l.name.text);let t=new Set,r=d=>{f.isBinaryExpression(d)&&d.operatorToken.kind===f.SyntaxKind.EqualsToken?(We(d.left)&&(f.isIdentifier(d.right)?t.add(d.right.text):f.isObjectLiteralExpression(d.right)&&Vl(d.right,t)),We(d.right)&&f.isIdentifier(d.left)&&t.add(d.left.text)):f.isVariableDeclaration(d)&&f.isIdentifier(d.name)&&d.initializer!==void 0&&We(d.initializer)&&t.add(d.name.text),f.forEachChild(d,r)};if(r(e),t.size>0){if(Gm(e,t))return!0;let d=ed(e,new Map([...t].map(c=>[c,c]))),l=nd(e);for(let c of d.keys())if(l.has(c))return!0}let o=d=>f.isIdentifier(d)&&n.has(d.text),s=d=>d.properties.every(l=>f.isShorthandPropertyAssignment(l)&&n.has(l.name.text)||f.isPropertyAssignment(l)&&o(l.initializer)),i=!1,a=d=>{if(!i){if(f.isBinaryExpression(d)){let l=d.operatorToken.kind>=f.SyntaxKind.FirstAssignment&&d.operatorToken.kind<=f.SyntaxKind.LastAssignment;l&&We(d.left)?d.operatorToken.kind===f.SyntaxKind.EqualsToken&&(o(d.right)||f.isObjectLiteralExpression(d.right)&&s(d.right))||(i=!0):l&&cn(d.left)&&(i=!0)}else f.isCallExpression(d)?($t(d)&&d.arguments[0]!==void 0&&ut(d.arguments[0])||As(d))&&(i=!0):(f.isExportAssignment(d)&&d.isExportEquals&&!f.isIdentifier(d.expression)||f.isExportDeclaration(d)&&d.moduleSpecifier!==void 0)&&(i=!0);i||f.forEachChild(d,a)}};return a(e),i}var qm=8;function Kl(e,n,t){let r=new Set,o=Xl(e,n,t,At(e)),s=Yl(e,n,t,o,ql(e));for(let{source:i}of s.sources)r.add(i.target);for(let i of e.statements)if(f.isExportDeclaration(i)&&i.moduleSpecifier!==void 0&&f.isStringLiteralLike(i.moduleSpecifier)&&Ae(i.moduleSpecifier.text)==="relative"){let a=t.get(`${n}::${i.moduleSpecifier.text}`);a!==void 0&&r.add(a)}return r}function Vm(e,n,t,r=new Map){let o=new Set(n.modules.filter(b=>b.isEntrypoint).map(b=>String(b.id)));if(o.size===0)return{exports:[],exportBindings:[],diagnostics:[]};let s=new Set(n.modules.filter(b=>b.externalSurface===!0).map(b=>String(b.id))),i=new Map,a=new Map,d=new Map,l=new Map;for(let b of t){if(b.name==="<toplevel>"){l.set(String(b.moduleId),b);continue}if(i.set(`${String(b.moduleId)}::${String(b.declRange.start)}`,b),b.name!==void 0&&a.set(`${String(b.moduleId)}::${b.name}`,b),b.isExported&&b.name!==void 0){let w=d.get(String(b.moduleId))??[];w.push(b),d.set(String(b.moduleId),w)}}if(r.size>0){let b=new Map(t.map(w=>[String(w.id),w]));for(let[w,I]of r){let N=b.get(String(I));N!==void 0&&!i.has(w)&&i.set(w,N)}}let c=new Map;for(let b of n.imports)b.resolvedModuleId!==void 0&&c.set(`${b.moduleId}::${b.specifier}`,String(b.resolvedModuleId));let p=new Map;for(let b of e.sourceFiles){let w=e.toRel(b.fileName);w!==null&&p.set(w,b)}let u=new Map,m=b=>{let w=u.get(b);if(w!==void 0)return w;let I=p.get(b),N=I===void 0?!0:Wm(I);return u.set(b,N),N},h=new Set,x=(b,w)=>w!==void 0&&Ae(w)==="relative"?c.get(`${b}::${w}`):void 0,y=b=>{if(f.isIdentifier(b))return b.text;if(f.isPropertyAccessExpression(b)){let w=y(b.expression);return w===void 0?void 0:`${w}.${b.name.text}`}if(f.isElementAccessExpression(b)&&f.isStringLiteralLike(b.argumentExpression)){let w=y(b.expression);return w===void 0?void 0:`${w}.${b.argumentExpression.text}`}},S=b=>{let w=b;for(;f.isPropertyAccessExpression(w)||f.isElementAccessExpression(w);)w=w.expression;return En(w)};for(let b of e.sourceFiles){let w=e.toRel(b.fileName);if(w===null)continue;let I=new Map,N=new Map,v=(R,L)=>{let O=x(w,En(L));if(O!==void 0){if(f.isIdentifier(R))N.set(R.text,O),I.set(R.text,O);else if(f.isObjectBindingPattern(R)||f.isArrayBindingPattern(R))for(let F of Zr(R))N.set(F,O);else if(f.isPropertyAccessExpression(R)||f.isElementAccessExpression(R)){let F=y(R);F!==void 0&&I.set(F,O)}}},_=R=>{f.isVariableDeclaration(R)&&R.initializer!==void 0?v(R.name,R.initializer):f.isBinaryExpression(R)&&R.operatorToken.kind===f.SyntaxKind.EqualsToken&&v(R.left,R.right),f.forEachChild(R,_)};_(b);let P=R=>{let L=Zl(R);if(L!==void 0){let O=L.expression,F=x(w,S(O));F!==void 0&&h.add(F);let K=y(O),ee=K!==void 0?I.get(K):void 0;ee!==void 0&&h.add(ee)}f.forEachChild(R,P)};if(P(b),N.size>0){let R=ed(b,N),L=nd(b);for(let[O,F]of R)L.has(O)&&h.add(F)}}let k=[],E=[],g=[];for(let b of e.sourceFiles){let w=e.toRel(b.fileName);if(w===null||!o.has(w))continue;let I=e.checker.getSymbolAtLocation(b),N=new Set,v=new Set,_=0,P=(B,D)=>{if(s.has(String(B.moduleId))||N.has(String(B.id)))return;N.add(String(B.id));let Y=`${w}#reexport:${String(_)}:${D}`;_+=1,k.push({id:Y,moduleId:w,exportedName:D,kind:"value",reexportOf:{moduleId:String(B.moduleId),name:B.name??D}}),E.push({exportId:Y,target:{kind:"function",functionId:B.id}})},R=B=>{if($m(B))return;let D=B;if((B.flags&f.SymbolFlags.Alias)!==0)try{D=e.checker.getAliasedSymbol(B)}catch{return}let Y=Cm(D,e,i,a,s);if(Y!==void 0){P(Y,B.getName());return}if((D.flags&f.SymbolFlags.Module)!==0&&!v.has(D)){v.add(D);try{for(let Z of e.checker.getExportsOfModule(D))R(Z)}catch{}}};if(I!==void 0)for(let B of e.checker.getExportsOfModule(I))R(B);let L=Xl(b,w,c,At(b)),O=Yl(b,w,c,L,ql(b)),F=new Set,K=O.residual,ee=B=>{let D=p.get(B);B.includes("node_modules/")||D===void 0||Pm(D)?K=!0:F.add(B)};for(let{source:B,exportedName:D}of O.sources){let Y=d.get(B.target)??[],Z=h.has(B.target);if(B.kind==="whole"){for(let H of Y)P(H,H.name??D);Z?K=!0:(Y.length===0||m(B.target))&&ee(B.target)}else{let H=Y.filter(ne=>ne.name===B.member);for(let ne of H)P(ne,D);Z?K=!0:(H.length===0||m(B.target))&&ee(B.target)}}let U=new Set,J=[];for(let B of Kl(b,w,c))J.push({target:B,depth:1});for(;J.length>0;){let B=J.shift();if(B===void 0)break;let{target:D,depth:Y}=B;if(U.has(D)||Y>qm||(U.add(D),D.split("/").includes("node_modules")))continue;let Z=p.get(D);if(Z===void 0)continue;let H=l.get(D);H!==void 0&&!m(D)&&P(H,"<load>");for(let ne of Kl(Z,D,c))U.has(ne)||J.push({target:ne,depth:Y+1})}Fm(b,At(b))&&(K=!0);for(let B of F)g.push({code:"unresolved-reexport",path:w,detail:`entrypoint whole/member re-exports app-owned relative module ${B} whose exact entry surface could not be lifted; capping at unknown, corridor-scoped to that module (ADR-024, ROADMAP R3.3)`,anchor:B});K&&g.push({code:"unresolved-reexport",path:w,detail:"entrypoint has a CJS re-export the analyzer cannot pin to concrete relative functions (computed/dynamic/package-subpath/tainted, or an externally-mutated barrel); capping at unknown, globally (ADR-024, ROADMAP CJS.5)"})}return{exports:k,exportBindings:E,diagnostics:g}}var Ot=new Set(["valueOf","toString","toJSON","then","catch","finally","next","return","throw"]),Hm=new Set(["defineProperty","defineProperties","create"]);function Xm(e){let n=!0,t=o=>f.isIdentifier(o)||f.isStringLiteral(o)||f.isNumericLiteral(o)?Ot.has(o.text):f.isComputedPropertyName(o)&&f.isStringLiteralLike(o.expression)?Ot.has(o.expression.text):!1,r=o=>{if(n){if(f.isNewExpression(o)||f.isForOfStatement(o)||f.isSpreadElement(o)||f.isSpreadAssignment(o)||f.isArrayBindingPattern(o)||f.isGetAccessorDeclaration(o)||f.isSetAccessorDeclaration(o)||f.isYieldExpression(o)&&o.asteriskToken!==void 0||f.canHaveDecorators(o)&&(f.getDecorators(o)?.length??0)>0){n=!1;return}if((f.isPropertyAccessExpression(o)||f.isMethodDeclaration(o)||f.isPropertyAssignment(o))&&t(o.name)||f.isPropertyDeclaration(o)&&t(o.name)||f.isShorthandPropertyAssignment(o)&&t(o.name)||f.isBindingElement(o)&&t(o.propertyName??o.name)||f.isElementAccessExpression(o)&&f.isStringLiteralLike(o.argumentExpression)&&Ot.has(o.argumentExpression.text)){n=!1;return}if(f.isCallExpression(o)&&f.isPropertyAccessExpression(o.expression)&&f.isIdentifier(o.expression.expression)&&o.expression.expression.text==="Object"&&Hm.has(o.expression.name.text)){n=!1;return}f.forEachChild(o,r)}};return r(e),n}function no(e){if(f.isIdentifier(e)||f.isStringLiteral(e)||f.isNumericLiteral(e))return e.text}function td(e){let n=t=>f.canHaveDecorators(t)&&(f.getDecorators(t)?.length??0)>0;return n(e)||e.members.some(n)}function Ym(e){let n=!1,t=new Set,r=[],o=new Map,s=(u,m)=>{let h=o.get(u);h===void 0?o.set(u,[m]):h.push(m)},i=u=>{f.isIdentifier(u)?t.add(u.text):r.push(u)},a=u=>{for(let m of u.properties)f.isShorthandPropertyAssignment(m)?t.add(m.name.text):f.isPropertyAssignment(m)?r.push(m.initializer):n=!0},d=u=>{if(f.isBinaryExpression(u)&&u.operatorToken.kind===f.SyntaxKind.EqualsToken){let m=u.left,h=u.right;We(m)?f.isObjectLiteralExpression(h)?a(h):f.isIdentifier(h)||f.isFunctionExpression(h)||f.isArrowFunction(h)||f.isClassExpression(h)?i(h):n=!0:cn(m)?(f.isElementAccessExpression(m)&&!f.isStringLiteralLike(m.argumentExpression)&&(n=!0),i(h)):f.isIdentifier(m)?s(m.text,h):(f.isPropertyAccessExpression(m)||f.isElementAccessExpression(m))&&f.isIdentifier(m.expression)&&s(m.expression.text,h)}else if(f.isCallExpression(u))($t(u)&&u.arguments[0]!==void 0&&ut(u.arguments[0])||As(u))&&(n=!0);else if(f.isVariableDeclaration(u)&&f.isIdentifier(u.name)&&u.initializer!==void 0)s(u.name.text,u.initializer);else if((f.isFunctionDeclaration(u)||f.isClassDeclaration(u))&&u.name!==void 0)s(u.name.text,u),ct(u)&&t.add(u.name.text);else if(f.isExportDeclaration(u)){if(u.exportClause===void 0)n=!0;else if(u.moduleSpecifier===void 0&&f.isNamedExports(u.exportClause))for(let m of u.exportClause.elements)t.add((m.propertyName??m.name).text)}else if(f.isExportAssignment(u))u.isExportEquals&&!f.isIdentifier(u.expression)?n=!0:i(u.expression);else if(f.isVariableStatement(u)&&ct(u))for(let m of u.declarationList.declarations)f.isIdentifier(m.name)&&t.add(m.name.text);f.forEachChild(u,d)};d(e);let l=new Set,c=[...t],p=u=>{let m=h=>{f.isIdentifier(h)&&c.push(h.text),f.forEachChild(h,m)};m(u)};for(let u of r)p(u);for(;c.length>0;){let u=c.pop();if(!(u===void 0||l.has(u))){l.add(u);for(let m of o.get(u)??[])p(m)}}return{names:l,opaque:n}}var Jm=512,Zm=new Set(["get","post","put","patch","delete","options","head"]);function Qm(e){for(let n of e.statements){if(f.isExportAssignment(n)&&n.isExportEquals!==!0)return n.expression;if(f.isExpressionStatement(n)&&f.isBinaryExpression(n.expression)&&n.expression.operatorToken.kind===f.SyntaxKind.EqualsToken&&f.isPropertyAccessExpression(n.expression.left)&&f.isIdentifier(n.expression.left.expression)){let t=n.expression.left.expression.text,r=n.expression.left.name.text;if(t==="module"&&r==="exports"||t==="exports"&&r==="default")return n.expression.right}}return null}function eh(e){let n=new Map,t=Qm(e);if(t===null)return n;let r=s=>{for(let i of s.properties)if(f.isPropertyAssignment(i)&&f.isObjectLiteralExpression(i.initializer)){let a=no(i.name);a!==void 0&&n.set(a,i.initializer)}};if(f.isObjectLiteralExpression(t))return r(t),n;if(!f.isIdentifier(t))return n;let o=t.text;for(let s of e.statements)if(f.isVariableStatement(s))for(let i of s.declarationList.declarations)f.isIdentifier(i.name)&&i.name.text===o&&i.initializer!==void 0&&f.isObjectLiteralExpression(i.initializer)&&r(i.initializer);else if(f.isExpressionStatement(s)&&f.isBinaryExpression(s.expression)&&s.expression.operatorToken.kind===f.SyntaxKind.EqualsToken&&f.isPropertyAccessExpression(s.expression.left)&&f.isIdentifier(s.expression.left.expression)&&s.expression.left.expression.text===o&&f.isObjectLiteralExpression(s.expression.right)){let i=s.expression.left.name.text;n.set(i,s.expression.right)}return n}function nh(e){for(let n of e.properties){if(f.isMethodDeclaration(n)&&f.isIdentifier(n.name)&&n.name.text==="handler")return n;if(f.isPropertyAssignment(n)&&f.isIdentifier(n.name)&&n.name.text==="handler"&&(f.isArrowFunction(n.initializer)||f.isFunctionExpression(n.initializer)))return n.initializer}return null}function th(e,n){for(let r of e.properties){let o;if(f.isPropertyAssignment(r)||f.isMethodDeclaration(r)?o=no(r.name):f.isShorthandPropertyAssignment(r)&&(o=r.name.text),o==="method"||o==="url"||o==="middlewares")return!0}let t=n.parameters.length;return t>=2&&t<=3}function rh(e,n){let t=[],r=new Set,o=(a,d,l)=>{if(t.length>=Jm||a==="__proto__"||!Ns.test(a))return;let c=`${e}#handler:${a}`;r.has(c)||(r.add(c),t.push({id:c,node:d,memberPath:a,idiom:l}))};for(let[a,d]of eh(n)){let l=nh(d);l!==null&&th(d,l)&&o(a,l,"descriptor-object")}let s=0,i=a=>{if(f.isCallExpression(a)&&f.isPropertyAccessExpression(a.expression)&&f.isIdentifier(a.expression.expression)&&Zm.has(a.expression.name.text)&&a.arguments.length>=2&&a.arguments[0]!==void 0&&f.isStringLiteralLike(a.arguments[0])){let d=a.expression.name.text;for(let l=1;l<a.arguments.length;l+=1){let c=a.arguments[l];c!==void 0&&(f.isArrowFunction(c)||f.isFunctionExpression(c))&&o(`${d}_${String(s)}_${String(l)}`,c,"router-verb")}s+=1}f.forEachChild(a,i)};return i(n),t}function oh(e,n,t,r,o,s){let i=`${e}#class:${t}`,a=[],d=new Set;for(let l of r.members){let c,p,u;if(f.isConstructorDeclaration(l))c="constructor",p="ctor",u=!1;else if(f.isMethodDeclaration(l))c=no(l.name),p="method",u=c!==void 0&&!Ot.has(c);else continue;if(c===void 0||d.has(c))continue;d.add(c);let m=`${e}#${t}.${c}`;o.push({id:m,moduleId:e,name:c,kind:p,enclosingClassId:i,declRange:Gn(e,l,n),isExported:!1,publicSurfaceReachable:!1}),a.push(m),u&&s.push({start:l.getStart(n,!1),end:l.getEnd(),id:m})}return{id:i,moduleId:e,name:t,implementsRefs:[],members:a}}function sh(e,n,t=[],r=!1,o){let s=[],i=new Map,a=[],{reachableLocals:d,defaultTarget:l}=Nm(n),c=At(n),p=`${e}#<toplevel>`;s.push({id:p,moduleId:e,name:"<toplevel>",kind:"function",declRange:{path:e,start:0,end:n.getEnd()},isExported:!1,publicSurfaceReachable:!1});let u=(w,I)=>{let N=`${e}#${w}`;return s.push({id:N,moduleId:e,name:w,kind:"function",declRange:Gn(e,I,n),isExported:d.has(w),publicSurfaceReachable:d.has(w)}),i.set(w,{kind:"function",functionId:N}),a.push({start:I.getStart(n,!1),end:I.getEnd(),id:N}),N},m=[],h=!e.split("/").includes("node_modules");if(h)for(let w of Lm(n,c))d.add(w);let x=h?Ym(n):void 0,y=(w,I,N)=>{x===void 0||x.opaque||x.names.has(w)||ct(N)||td(I)||m.push(oh(e,n,w,I,s,a))};for(let w of n.statements)if(f.isFunctionDeclaration(w)&&w.name!==void 0)u(w.name.text,w);else if(f.isClassDeclaration(w)&&w.name!==void 0)y(w.name.text,w,w);else if(f.isVariableStatement(w))for(let I of w.declarationList.declarations){if(f.isObjectBindingPattern(I.name)&&I.initializer!==void 0&&f.isCallExpression(I.initializer)&&f.isIdentifier(I.initializer.expression)&&I.initializer.expression.text==="require"&&I.initializer.arguments.length===1&&I.initializer.arguments[0]!==void 0&&f.isStringLiteralLike(I.initializer.arguments[0])){let v=I.initializer.arguments[0].text;for(let _ of I.name.elements){if(_.dotDotDotToken!==void 0||_.initializer!==void 0||!f.isIdentifier(_.name))continue;let P=_.propertyName??_.name;!f.isIdentifier(P)&&!f.isStringLiteralLike(P)||i.set(_.name.text,{kind:"import",specifier:v,form:{named:P.text}})}continue}if(!f.isIdentifier(I.name)||I.initializer===void 0)continue;let N=I.initializer;if(f.isFunctionExpression(N)||f.isArrowFunction(N))u(I.name.text,I);else if(f.isClassExpression(N))y(I.name.text,N,w);else if(f.isCallExpression(N)&&f.isIdentifier(N.expression)&&N.expression.text==="require"&&N.arguments.length===1&&N.arguments[0]!==void 0&&f.isStringLiteralLike(N.arguments[0]))i.set(I.name.text,{kind:"import",specifier:N.arguments[0].text,form:"whole"});else if((f.isPropertyAccessExpression(N)||f.isElementAccessExpression(N))&&eo(N)==="default"&&f.isCallExpression(N.expression)){let v=En(N.expression);v!==void 0&&i.set(I.name.text,{kind:"import",specifier:v,form:"require-default"})}}else if(f.isImportDeclaration(w)&&f.isStringLiteralLike(w.moduleSpecifier)){let I=w.moduleSpecifier.text,N=w.importClause;if(N!==void 0){N.name!==void 0&&i.set(N.name.text,{kind:"import",specifier:I,form:"default"});let v=N.namedBindings;if(v!==void 0&&f.isNamespaceImport(v))i.set(v.name.text,{kind:"import",specifier:I,form:"namespace"});else if(v!==void 0&&f.isNamedImports(v))for(let _ of v.elements){let P=(_.propertyName??_.name).text;i.set(_.name.text,{kind:"import",specifier:I,form:{named:P}})}}}else f.isImportEqualsDeclaration(w)&&f.isExternalModuleReference(w.moduleReference)&&f.isStringLiteralLike(w.moduleReference.expression)&&i.set(w.name.text,{kind:"import",specifier:w.moduleReference.expression.text,form:"whole"});let S=new Map,k,E=new Map,g=new Map;if(h)for(let{name:w,value:I}of Dm(n)){let N=`${e}#member-export:${w}`;s.push({id:N,moduleId:e,name:w,kind:f.isArrowFunction(I)?"arrow":"function",declRange:Gn(e,I,n),isExported:!0,publicSurfaceReachable:!0}),a.push({start:I.getStart(n,!1),end:I.getEnd(),id:N}),S.set(I.getStart(n,!1),N)}if(r&&h){let w=P=>{let R=He(P);return f.isFunctionExpression(R)||f.isArrowFunction(R)?R:void 0},I=(P,R)=>{let L=P;return s.push({id:L,moduleId:e,kind:f.isArrowFunction(R)?"arrow":"function",declRange:Gn(e,R,n),isExported:!0,publicSurfaceReachable:!0}),a.push({start:R.getStart(n,!1),end:R.getEnd(),id:L}),S.set(R.getStart(n,!1),L),L},N=[],v=[],_=[];for(let P of n.statements)f.isExportAssignment(P)&&!P.isExportEquals?N.push(P):f.isFunctionDeclaration(P)&&f.getModifiers(P)?.some(R=>R.kind===f.SyntaxKind.DefaultKeyword)===!0?v.push(P):f.isExpressionStatement(P)&&f.isBinaryExpression(P.expression)&&P.expression.operatorToken.kind===f.SyntaxKind.EqualsToken&&We(P.expression.left)&&_.push(P.expression);if(N.length+v.length+_.length===1){let P=N[0],R=v[0],L=_[0];if(P!==void 0){let O=w(P.expression);if(O!==void 0){let F=I(`${e}#<default>`,O);k={id:F,esm:!0},g.set(P.getStart(n,!1),F),ge(o,"2a-default",null)}}else if(R!==void 0&&R.name===void 0&&R.body!==void 0){let O=I(`${e}#<default>`,R);k={id:O,esm:!0},g.set(R.getStart(n,!1),O),ge(o,"2a-default",null)}else if(L!==void 0){let O=w(L.right);if(O!==void 0){let F=I(`${e}#<default>`,O);k={id:F,esm:!1},g.set(L.getStart(n,!1),F),ge(o,"2a-default",null)}else if(f.isObjectLiteralExpression(L.right)){let F=L.right,K=[],ee=!0;for(let U of F.properties){if(f.isSpreadAssignment(U)){ee=!1;break}let J=U.name,B=J===void 0?void 0:_s(J);if(B===void 0){ee=!1;break}K.push(B)}if(ee){let U=new Map;for(let J of K)U.set(J,(U.get(J)??0)+1);for(let J of F.properties){if(!f.isPropertyAssignment(J))continue;let B=_s(J.name),D=w(J.initializer);if(B!==void 0){if(!Mm(B)){D!==void 0&&ge(o,"2a-member","charset-refused");continue}if((U.get(B)??0)!==1){D!==void 0&&ge(o,"2a-member","duplicate-key");continue}if(D!==void 0){let Y=I(`${e}#<cjs>.${B}`,D);E.set(B,Y),g.set(J.getStart(n,!1),Y),ge(o,"2a-member",null)}}}}else for(let U of F.properties)f.isPropertyAssignment(U)&&w(U.initializer)!==void 0&&ge(o,"2a-member","spread-or-computed-literal")}}}else{for(let P of N)w(P.expression)!==void 0&&ge(o,"2a-default","duplicate-default-sources");for(let P of v)P.name===void 0&&ge(o,"2a-default","duplicate-default-sources");for(let P of _)if(w(P.right)!==void 0)ge(o,"2a-default","duplicate-default-sources");else if(f.isObjectLiteralExpression(P.right))for(let R of P.right.properties)f.isPropertyAssignment(R)&&w(R.initializer)!==void 0&&ge(o,"2a-member","duplicate-default-sources")}}for(let w of t)s.push({id:w.id,moduleId:e,name:`handler:${w.memberPath}`,kind:f.isArrowFunction(w.node)?"arrow":"function",declRange:Gn(e,w.node,n),isExported:!1,publicSurfaceReachable:!1}),a.push({start:w.node.getStart(n,!1),end:w.node.getEnd(),id:w.id});a.sort((w,I)=>w.end-w.start-(I.end-I.start));let b=l!==void 0?`${e}#${l}`:void 0;return{rel:e,sf:n,functions:s,bindings:i,exportedFunctionId:b,exportedNames:d,tainted:c,fnRanges:a,toplevelId:p,classes:m,mintedByPos:S,mintedDefault:k,mintedMembers:E,mintSeedAliases:g}}function ih(e){return f.isIdentifier(e)?"identifier":f.isPropertyAccessExpression(e)?"member":f.isElementAccessExpression(e)?"computed-member":e.kind===f.SyntaxKind.ImportKeyword?"dynamic-import":"unknown"}function Ul(e,n){let t=r=>{if(f.isBinaryExpression(r)&&r.operatorToken.kind>=f.SyntaxKind.FirstAssignment&&r.operatorToken.kind<=f.SyntaxKind.LastAssignment){let o=r.left;f.isPropertyAccessExpression(o)&&f.isIdentifier(o.expression)?n(o.expression.text,o.name.text):f.isElementAccessExpression(o)&&f.isIdentifier(o.expression)&&n(o.expression.text,f.isStringLiteralLike(o.argumentExpression)?o.argumentExpression.text:null)}else if(f.isCallExpression(r)&&f.isPropertyAccessExpression(r.expression)){let o=r.expression,s=r.arguments[0];f.isIdentifier(o.expression)&&s!==void 0&&f.isIdentifier(s)&&(o.expression.text==="Object"&&(o.name.text==="assign"||o.name.text==="defineProperty"||o.name.text==="defineProperties")||o.expression.text==="Reflect"&&o.name.text==="defineProperty")&&n(s.text,null)}f.forEachChild(r,t)};t(e)}function ah(e){let n=!1,t=r=>{if(!n){if(f.isVariableDeclaration(r)||f.isParameter(r)){let o=new Set;if(Jt(r.name,o),o.has("require")){n=!0;return}}else if((f.isFunctionDeclaration(r)||f.isClassDeclaration(r))&&r.name!==void 0&&r.name.text==="require"){n=!0;return}f.forEachChild(r,t)}};return t(e),n}function lh(e,n,t,r=new Map,o={}){let s=o.additiveForms===!0,i=o.namelessExports===!0,a=s||i?{}:void 0,d=new Map,l=new Map;for(let v of n.imports)v.resolvedModuleId!==void 0&&l.set(`${v.moduleId}::${v.specifier}`,v.resolvedModuleId);for(let v of e.sourceFiles){let _=e.toRel(v.fileName);_!==null&&d.set(_,sh(_,v,r.get(_)??[],i,a))}let c=new Map;if(s)for(let v of d.values()){let _=new Map;for(let[P,R]of v.bindings)if(R.kind==="import"&&R.form==="whole"&&Ae(R.specifier)!=="package-root"){let L=l.get(`${v.rel}::${R.specifier}`);L!==void 0&&_.set(P,String(L))}_.size!==0&&Ul(v.sf,(P,R)=>{let L=_.get(P);if(L===void 0)return;let O=c.get(L);if(O!=="*"){if(R===null){c.set(L,"*");return}O===void 0?c.set(L,new Set([R])):O.add(R)}})}let p=new Map;for(let v of d.values())v.exportedFunctionId!==void 0&&p.set(v.rel,v.exportedFunctionId);let u=new Map;for(let v of d.values()){if(v.rel.split("/").includes("node_modules"))continue;let _=Rm(v.sf);if(_===void 0){i&&v.mintedDefault!==void 0&&u.set(v.rel,v.mintedDefault);continue}let P=v.bindings.get(_.name);P?.kind==="function"&&u.set(v.rel,{id:P.functionId,esm:_.esm})}let m=new Map;for(let v of d.values()){let _;for(let P of v.exportedNames){let R=v.bindings.get(P);R?.kind==="function"&&(_??=new Map,_.set(P,R.functionId))}_!==void 0&&m.set(v.rel,_)}let h=new Map;for(let v of d.values()){if(v.rel.split("/").includes("node_modules"))continue;let _=Um(v.sf,v.tainted,P=>{let R=v.bindings.get(P);return R?.kind==="function"?R.functionId:void 0},i?P=>{let R=He(P);return f.isFunctionExpression(R)||f.isArrowFunction(R)?v.mintedByPos.get(R.getStart(v.sf,!1)):void 0}:void 0);_.size>0&&h.set(v.rel,_)}let x=[],y=[],S=[],k=[],E=[],g=[],b=new Map;for(let v of n.imports){let _=b.get(v.moduleId)??[];_.push(v.specifier),b.set(v.moduleId,_)}let w=v=>Pl(b.get(v)??[]),I=new Map;for(let v of d.values()){x.push(...ks(v.functions,v.sf,v.rel,w(v.rel))),g.push(...v.classes);for(let $ of v.exportedNames){let T=v.bindings.get($);if(T?.kind==="function"){let z=`${v.rel}#export:${$}`;k.push({id:z,moduleId:v.rel,exportedName:$,kind:"value"}),E.push({exportId:z,target:{kind:"function",functionId:T.functionId}})}}if(i){if(v.mintedDefault!==void 0){let $=`${v.rel}#export:<default>`;k.push({id:$,moduleId:v.rel,exportedName:"default",kind:"value"}),E.push({exportId:$,target:{kind:"function",functionId:v.mintedDefault.id}})}for(let[$,T]of v.mintedMembers){let z=`${v.rel}#export:<cjs>.${$}`;k.push({id:z,moduleId:v.rel,exportedName:$,kind:"value"}),E.push({exportId:z,target:{kind:"function",functionId:T}})}}let _=new Map;for(let[$,T]of v.bindings){if(T.kind==="function"){_.set($,T);continue}if(Ae(T.specifier)==="package-root"){let X=Qe(T.specifier);typeof T.form=="object"?_.set($,{kind:"package-export",packageName:X,exportName:T.form.named}):T.form==="require-default"?_.set($,{kind:"package-default",packageName:X}):_.set($,{kind:"package-surface",packageName:X})}else{let X=l.get(`${v.rel}::${T.specifier}`);if(X!==void 0&&typeof T.form=="object"){let ce=m.get(String(X))?.get(T.form.named);ce!==void 0&&_.set($,{kind:"app-named-fn",functionId:ce})}else if(X!==void 0&&T.form==="require-default"){let ce=u.get(String(X));ce!==void 0&&ce.esm&&_.set($,{kind:"app-default-fn",functionId:ce.id})}else X!==void 0&&typeof T.form!="object"&&T.form!=="require-default"&&_.set($,{kind:"module",resolvedModuleId:X})}}let P=new Map;for(let $ of v.functions){if($.enclosingClassId===void 0||$.name===void 0)continue;let T=P.get($.enclosingClassId);T===void 0&&(T=new Map,P.set($.enclosingClassId,T)),T.set($.name,$.id)}for(let $ of v.classes)$.name===void 0||v.tainted.has($.name)||_.has($.name)||_.set($.name,{kind:"app-class",cls:{classId:$.id,className:$.name,memberIds:P.get($.id)??new Map}});let R=$=>{if(f.isVariableDeclaration($)&&f.isIdentifier($.name)&&$.initializer!==void 0&&f.isNewExpression($.initializer)&&!v.tainted.has($.name.text)&&!_.has($.name.text)){let T=Dl($.initializer,_,v.tainted);T!==null&&_.set($.name.text,T)}f.forEachChild($,R)};R(v.sf);let L=$=>{for(let T of v.fnRanges)if($>=T.start&&$<T.end)return T.id;return v.toplevelId},O=new Map,F=new Map,K=new Map,ee=($,T,z)=>{if(z===null){$.set(T,"*");return}let X=$.get(T);X!=="*"&&(X===void 0?$.set(T,new Set([z])):X.add(z))},U=($,T)=>{ee(O,$,T);let z=_.get($);z?.kind==="package-surface"?ee(F,z.packageName,T):z?.kind==="module"&&ee(K,String(z.resolvedModuleId),T)};Ul(v.sf,U);let J=new Map,B=256,D=$=>{let T=J.get($);return T===void 0&&(T=J.size>=B?new Set([$]):Ql(v.sf,new Set([$])),J.set($,T)),T},Y=($,T)=>$==="*"||$!==void 0&&$.has(T),Z=($,T)=>{let z=_.get($);if(z?.kind==="package-surface"&&Y(F.get(z.packageName),T)||z?.kind==="module"&&Y(K.get(String(z.resolvedModuleId)),T))return!0;for(let X of D($))if(Y(O.get(X),T))return!0;return!1},H=$=>{if(f.isIdentifier($)){let T=v.tainted.has($.text)?void 0:_.get($.text);return T?.kind==="function"?T.functionId:T?.kind==="module"?p.get(String(T.resolvedModuleId))??null:T?.kind==="package-export"?t.exportFor(T.packageName,T.exportName):null}if(f.isPropertyAccessExpression($)&&f.isIdentifier($.expression)){let T=$.expression.text;if(Z(T,$.name.text))return null;let z=v.tainted.has(T)?void 0:_.get(T);return z?.kind==="package-surface"?t.exportFor(z.packageName,$.name.text):z?.kind==="package-export"?t.methodFor(z.packageName,z.exportName,$.name.text,"method"):z?.kind==="package-instance"?t.methodFor(z.packageName,z.className,$.name.text,"method"):null}return null},ne=$=>{for(let T=$.parent;T!==void 0;T=T.parent)if(!f.isArrowFunction(T)){if(f.isFunctionExpression(T)||f.isFunctionDeclaration(T))return null;if(f.isMethodDeclaration(T)||f.isConstructorDeclaration(T)||f.isGetAccessorDeclaration(T)||f.isSetAccessorDeclaration(T)){let z=T.parent;if(!f.isClassLike(z)||z.name===void 0)return null;let X=v.tainted.has(z.name.text)?void 0:_.get(z.name.text);return X?.kind==="app-class"?X.cls:null}}return null},se=s&&!v.tainted.has("require")&&!ah(v.sf),oe=$=>{if(f.isIdentifier($)){let X=v.tainted.has($.text)?void 0:_.get($.text);return X?.kind==="package-surface"||X?.kind==="package-default"?t.exportFor(X.packageName,"default"):X?.kind==="app-named-fn"||X?.kind==="app-default-fn"?X.functionId:X?.kind==="module"?u.get(String(X.resolvedModuleId))?.id??null:X?.kind==="member-value"?X.functionId:null}if(!f.isPropertyAccessExpression($))return null;let T=$.expression;if(s&&f.isCallExpression(He(T))){let X=En(He(T));if(X!==void 0)if(!se)ge(a,"2b","require-shadow");else if(Ae(X)==="package-root")ge(a,"2b","package-root");else{let ce=l.get(`${v.rel}::${X}`);if(ce===void 0)ge(a,"2b","unresolved-module");else{let xe=$.name.text,Ke=c.get(String(ce));if(Ke==="*"||Ke!==void 0&&Ke.has(xe))ge(a,"2b","module-mutation-gate");else{let pe=h.get(String(ce))?.get(xe);if(pe!==void 0)return ge(a,"2b",null),pe;if(xe==="default"){let xn=u.get(String(ce));if(xn!==void 0&&xn.esm)return ge(a,"2b",null),xn.id;ge(a,"2b","non-esm-default")}else ge(a,"2b","unknown-member")}}}return null}let z;if(f.isIdentifier(T)){let X=v.tainted.has(T.text)?void 0:_.get(T.text);if(X?.kind==="app-class"||X?.kind==="app-instance")z=X.cls.memberIds;else if(X?.kind==="object-literal")z=X.obj.members;else if(X?.kind==="module"){let ce=h.get(String(X.resolvedModuleId));ce?.has($.name.text)===!0&&!Z(T.text,$.name.text)&&(z=ce)}}else if(f.isNewExpression(T)){let X=Dl(T,_,v.tainted);X?.kind==="app-instance"&&(z=X.cls.memberIds)}else T.kind===f.SyntaxKind.ThisKeyword&&(z=ne($)?.memberIds);return z?.get($.name.text)??null},M=new Map,Q=$=>{if(f.isVariableDeclaration($)&&f.isIdentifier($.name)&&$.initializer!==void 0&&f.isObjectLiteralExpression($.initializer)&&!v.tainted.has($.name.text)&&!_.has($.name.text)&&!M.has($.name.text)){let T=new Map;for(let z of $.initializer.properties)if(f.isPropertyAssignment(z)&&f.isIdentifier(z.name)){let X=H(z.initializer);X!==null&&T.set(z.name.text,X)}M.set($.name.text,T)}f.forEachChild($,Q)};Q(v.sf);let re=$=>{if(f.isBinaryExpression($)&&$.operatorToken.kind===f.SyntaxKind.EqualsToken&&f.isPropertyAccessExpression($.left)&&f.isIdentifier($.left.expression)&&!v.tainted.has($.left.expression.text)){let T=M.get($.left.expression.text);if(T!==void 0){let z=H($.right);z!==null&&T.set($.left.name.text,z)}}f.forEachChild($,re)};re(v.sf);for(let[$,T]of M)_.set($,{kind:"object-literal",obj:{members:T}});let de=($,T=0)=>{if(T>Ml)return null;let z=He($);if(f.isCallExpression(z)&&f.isPropertyAccessExpression(z.expression)&&z.expression.name.text==="bind")return de(z.expression.expression,T+1);if(f.isIdentifier(z)){let X=H(z);if(X!==null)return X;let ce=v.tainted.has(z.text)?void 0:_.get(z.text);return ce?.kind==="member-value"?ce.functionId:null}return f.isPropertyAccessExpression(z)?H(z)??oe(z):null},be=($,T=0)=>{if(T>Ml)return"depth-cap";let z=He($);if(f.isCallExpression(z)&&f.isPropertyAccessExpression(z.expression)&&z.expression.name.text==="bind")return be(z.expression.expression,T+1);if(f.isIdentifier(z))return v.tainted.has(z.text)?"tainted-receiver":"unresolved-receiver";if(f.isPropertyAccessExpression(z)&&f.isIdentifier(z.expression)){if(v.tainted.has(z.expression.text))return"tainted-receiver";if(Z(z.expression.text,z.name.text))return"mutated-member"}return"unresolved-receiver"},et=$=>{if(f.isVariableDeclaration($)&&f.isIdentifier($.name)&&$.initializer!==void 0){let T=He($.initializer),z=f.isPropertyAccessExpression(T),X=f.isCallExpression(T)&&f.isPropertyAccessExpression(T.expression)&&T.expression.name.text==="bind";if(z||X){let ce=z?"D1":"A2";if(v.tainted.has($.name.text))ge(a,ce,"tainted-alias");else if(_.has($.name.text))ge(a,ce,"already-bound");else{let xe=de(T);xe!==null?(_.set($.name.text,{kind:"member-value",functionId:xe}),ge(a,ce,null)):ge(a,ce,be(T))}}}f.forEachChild($,et)};s&&et(v.sf);let yn=0,nt=$=>{let T,z;if(f.isCallExpression($)){let X=$.expression,ce=f.isIdentifier(X)&&X.text==="require",xe=X.kind===f.SyntaxKind.ImportKeyword;!ce&&!xe&&(T=X,z=$.arguments)}else f.isTaggedTemplateExpression($)&&(T=$.tag);if(T!==void 0){let X=ih(T),ce=$.getStart(v.sf,!1),xe=`${v.rel}#call${String(yn)}`;yn+=1;let Ke="unresolved",pe=[],xn=H(T);if(xn!==null&&(Ke="resolved",pe.push(xn)),y.push({id:xe,enclosingFunctionId:L(ce),calleeExprShape:X,resolvedTargetIds:pe,resolution:Ke,range:Gn(v.rel,$,v.sf),...ws($,T,v.rel,v.sf)}),f.isCallExpression($)){let Te=Yr($,w(v.rel));for(let sn of Te?.handlers??[]){if(Te===null||!(f.isIdentifier(sn)||f.isPropertyAccessExpression(sn)))continue;let Sn=H(sn);Sn!==null&&!I.has(Sn)&&I.set(Sn,Te.model)}}for(let Te of pe)S.push({callSiteId:xe,calleeFunctionId:Te,resolution:Ke,invocation:"direct"});if(xn===null){let Te=oe(T);if(Te!==null)S.push({callSiteId:xe,calleeFunctionId:Te,resolution:"field-based",invocation:"direct"});else if(s&&f.isPropertyAccessExpression(T)&&(T.name.text==="call"||T.name.text==="apply")){let sn=de(T.expression);sn!==null?(S.push({callSiteId:xe,calleeFunctionId:sn,resolution:"field-based"}),ge(a,"A3",null)):ge(a,"A3",be(T.expression))}}for(let Te of z??[]){let sn=H(Te);if(sn!==null)S.push({callSiteId:xe,calleeFunctionId:sn,resolution:"field-based",invocation:"callback"});else{let Sn=oe(Te);if(Sn!==null)S.push({callSiteId:xe,calleeFunctionId:Sn,resolution:"field-based",invocation:"callback"});else if(s){let Kt=de(Te),rt=He(Te),St=rt!==Te||f.isCallExpression(rt)&&f.isPropertyAccessExpression(rt.expression)&&rt.expression.name.text==="bind";Kt!==null?(S.push({callSiteId:xe,calleeFunctionId:Kt,resolution:"field-based"}),St&&ge(a,"A2p",null)):St&&ge(a,"A2p",be(Te))}}}}f.forEachChild($,nt)};nt(v.sf);for(let $ of n.computedLoads.get(v.rel)??[]){let T=$.candidateRels.filter(X=>d.has(X)).map(X=>`${X}#<toplevel>`);if(T.length===0)continue;let z=`${v.rel}#dirload${String(yn)}`;yn+=1,y.push({id:z,enclosingFunctionId:L($.pos),calleeExprShape:"require",resolvedTargetIds:T,resolution:"field-based",range:{path:v.rel,start:$.pos,end:$.pos}});for(let X of T)S.push({callSiteId:z,calleeFunctionId:X,resolution:"field-based"})}let tt=0;for(let $ of r.get(v.rel)??[]){let T=`${v.rel}#handlerseed${String(tt)}`;tt+=1;let z=$.node.getStart(v.sf,!1);y.push({id:T,enclosingFunctionId:v.toplevelId,calleeExprShape:"member",resolvedTargetIds:[$.id],resolution:"field-based",range:{path:v.rel,start:z,end:z}}),S.push({callSiteId:T,calleeFunctionId:$.id,resolution:"field-based"})}}let N=new Map;if(i)for(let v of d.values())for(let[_,P]of v.mintSeedAliases)N.set(`${v.rel}::${String(_)}`,P);return{functions:x.map(v=>{let _=I.get(v.id);return _===void 0||v.sourceParams!==void 0?v:{...v,sourceParams:[{index:tr(_,v.params?.length??0),sourceClass:_.sourceClass,model:_.id}]}}),callSites:y,callEdges:S,exports:k,exportBindings:E,classes:g,mintSeedAliases:N,bindingApplicability:a}}function dh(e,n,t){let r=d=>d.length===0||Xe.isAbsolute(d)||d.includes("\\")||/^[a-zA-Z]:/u.test(d)||d.split("/").some(l=>l===".."||l==="");if(r(n)||r(t))return null;let o=e.endsWith(Xe.sep)?e:e+Xe.sep,s;try{s=Cl(Xe.resolve(e,n))}catch{return null}if(!s.startsWith(o))return null;let i=s.endsWith(Xe.sep)?s:s+Xe.sep,a;try{a=Cl(Xe.resolve(s,t))}catch{return null}return a.startsWith(i)?a:null}function rd(e,n,t){let r=`${e}#class:${t}`,o=[],s=[],i=[],a=new Set;return{pushMember(d,l,c,p){if(d==="__proto__"||a.has(d))return;a.add(d);let u=`${e}#${t}.${d}`;o.push({id:u,moduleId:e,name:d,kind:c,enclosingClassId:r,declRange:Gn(e,l,n),isExported:!1,publicSurfaceReachable:!1}),i.push(u),s.push({name:d,id:u,kind:c,body:p})},finish(){return s.length===0?null:{functions:o,classNode:{id:r,moduleId:e,name:t,implementsRefs:[],members:i},members:s}}}}function ch(e,n,t,r){if(td(r)||r.members.length>Is)return null;let o=rd(e,n,t);for(let s of r.members){let i,a,d;if(f.isConstructorDeclaration(s))i="constructor",a="ctor",d=void 0;else if(f.isMethodDeclaration(s))i=no(s.name),a="method",d=i!==void 0&&!Ot.has(i)?s.body??void 0:void 0;else continue;i!==void 0&&o.pushMember(i,s,a,d)}return o.finish()}function uh(e,n,t){let r;for(let i of n.statements)if(f.isFunctionDeclaration(i)&&i.name?.text===t){r=i;break}if(r===void 0)return null;let o=[];for(let i of n.statements){if(!f.isExpressionStatement(i))continue;let a=i.expression;if(!f.isBinaryExpression(a)||a.operatorToken.kind!==f.SyntaxKind.EqualsToken)continue;let d=a.left;if(f.isPropertyAccessExpression(d)&&f.isPropertyAccessExpression(d.expression)&&f.isIdentifier(d.expression.expression)&&d.expression.expression.text===t&&d.expression.name.text==="prototype"){let l=d.name.text;f.isFunctionExpression(a.right)?o.push({name:l,fn:a.right,walk:!0}):f.isArrowFunction(a.right)&&o.push({name:l,fn:a.right,walk:!1})}}if(o.length===0||o.length+1>Is)return null;let s=rd(e,n,t);s.pushMember("constructor",r,"ctor",void 0);for(let i of o){let a=i.walk&&!Ot.has(i.name)&&f.isFunctionExpression(i.fn)?i.fn.body:void 0;s.pushMember(i.name,i.fn,"method",a)}return s.finish()}function fh(e,n,t){for(let r of n.statements)if(f.isClassDeclaration(r)&&r.name?.text===t)return ch(e,n,t,r);return uh(e,n,t)}function ph(e,n,t,r,o){let s={modules:[],functions:[],classes:[],callSites:[],callEdges:[],imports:[],importEdges:[],diagnostics:[]};if(n.length===0)return s;let i=new Set(t.map(p=>p.packageName)),a=new Set(t.map(p=>p.path)),d=new Set,l=new Set,c=0;for(let p of n){if(!i.has(p.packageName))continue;let u=dh(e.appRoot,p.packageRootRel,p.sourcePath);if(u===null)continue;let m=e.toRel(u);if(m===null)continue;let h=`${m}#${p.container}`;if(l.has(h)||!d.has(m)&&d.size>=Qr)continue;let x=Fe(u);if(x===null)continue;let y;try{y=f.createSourceFile(m,x,f.ScriptTarget.Latest,!0,f.ScriptKind.JS)}catch{continue}let S=fh(m,y,p.container);if(S===null)continue;d.add(m),l.add(h);let k=new Map,E=new Map;for(let b of S.members){let w=o.methodFor(p.packageName,p.container,b.name,b.kind);k.set(b.name,w),E.set(w,b.id)}let g=0;for(let b of S.members){if(b.body===void 0)continue;let w=(I,N)=>{if(N&&f.isCallExpression(I)&&f.isPropertyAccessExpression(I.expression)&&I.expression.expression.kind===f.SyntaxKind.ThisKeyword){let P=k.get(I.expression.name.text);if(P!==void 0){let R=`${m}#depclass:${p.container}.${b.name}#c${String(g)}`;g+=1,s.callSites.push({id:R,enclosingFunctionId:b.id,calleeExprShape:"member",resolvedTargetIds:[],resolution:"unresolved",range:Gn(m,I,y)}),s.callEdges.push({callSiteId:R,calleeFunctionId:P,resolution:"field-based"})}}let v=f.isFunctionExpression(I)||f.isFunctionDeclaration(I)||f.isMethodDeclaration(I)||f.isConstructorDeclaration(I)||f.isGetAccessorDeclaration(I)||f.isSetAccessorDeclaration(I)||f.isClassLike(I),_=f.isArrowFunction(I)?N:v?!1:N;f.forEachChild(I,P=>{w(P,_)})};w(b.body,!0)}for(let b of r){let w=E.get(b.calleeFunctionId);w!==void 0&&s.callEdges.push({callSiteId:b.callSiteId,calleeFunctionId:w,resolution:"field-based"})}if(s.functions.push(...S.functions),s.classes.push(S.classNode),!a.has(m)){a.add(m),s.modules.push({id:m,packageName:p.packageName,versionRange:"",path:m,moduleSystem:"cjs",isEntrypoint:!1});let b=o.moduleFor(p.packageName),w=`${String(b)}#depclass${String(c)}`;c+=1,s.imports.push({id:w,moduleId:b,specifier:"<dep-class-corridor>",isNamespace:!1,isDefault:!1,dynamic:!1,specifierIsLiteral:!0,resolvedModuleId:m}),s.importEdges.push({importId:w,resolvedModuleId:m})}s.diagnostics.push({code:"dep-class-corridor",path:m,detail:`lowered dependency class ${p.container} (${p.packageName}) \u2014 ${String(S.members.length)} members; the un-analyzed remainder caps this class's method sinks at unknown`,classScope:{packageName:p.packageName,container:p.container}})}return s}function mh(e,n,t,r){let o=new Set(e.modules.filter(d=>d.isEntrypoint).map(d=>d.packageName)),s=new Map(e.functions.map(d=>[d.id,d.moduleId])),i=new Map;for(let d of e.callSites){if(d.resolution!=="unresolved")continue;let l=s.get(d.enclosingFunctionId);l!==void 0&&i.set(l,(i.get(l)??0)+1)}let a=[];for(let d of e.modules){if(d.externalSurface===!0)continue;let l=n.get(d.path);if(l===void 0||t.has(d.path)||o.has(d.packageName)&&r.has(d.path)&&!d.path.split("/").includes("node_modules"))continue;let c=i.get(d.id)??0;if(c===0&&Xm(l))continue;let p=c>0?`${String(c)} of its call sites are unresolved`:"it invokes (or exposes) a function body through a form that emits no call site \u2014 `new`, an accessor, the iterator protocol, spread, or a coercion member";a.push({code:"dependency-body",path:d.path,detail:`dependency module analyzed with full bodies (package-subpath/relative/computed entry) but ${p}; its hidden call edges are bounded by its own forward module reach (ADR-069 Finding A)`,anchor:d.id})}return a}function od(e,n,t=[],r={},o=!1){let s=new Es,i=vm(e,n,s),a=new Set;for(let g of i.computedLoads.values())for(let b of g)if(b.seedable)for(let w of b.candidateRels)a.add(w);let d=new Map;for(let g of e.sourceFiles){let b=e.toRel(g.fileName);if(b===null||!a.has(b)||b.split("/").includes("node_modules"))continue;let w=rh(b,g);w.length>0&&d.set(b,w)}let l=d.size===0?i.modules:i.modules.map(g=>d.has(g.path)&&!g.isEntrypoint?{...g,isEntrypoint:!0}:g),c={...i,modules:l},p=lh(e,c,s,d,r),u=Vm(e,i,p.functions,p.mintSeedAliases),m=new Set(i.modules.map(g=>g.path)),h=Am(e.depReach,s,m),x=[...c.modules,...h.modules,...s.modules()],y=ph(e,t,x,p.callEdges,s),S=[];if(o){let g="#default",b=new Set;for(let I of p.callEdges){let N=String(I.calleeFunctionId);!N.startsWith("pkg:")||!N.endsWith(g)||b.add(N.slice(4,N.length-g.length))}let w=new Map;for(let I of e.depReach.edges){if(!("surface"in I.from)||"surface"in I.to)continue;let N=I.from.surface;w.set(N,w.has(N)?null:I.to.module)}for(let I of b){let N=w.get(I);if(N==null)continue;let v=_m(Xe.join(e.appRoot,N));if(v===null||v==="default")continue;let _=s.exportFor(I,v),P=`pkg:${I}${g}`;for(let R of p.callEdges)String(R.calleeFunctionId)===P&&S.push({callSiteId:R.callSiteId,calleeFunctionId:_,resolution:"field-based"})}}let k={modules:[...c.modules,...h.modules,...y.modules,...s.modules()],exports:[...p.exports,...u.exports],imports:[...i.imports,...h.imports,...y.imports],functions:[...p.functions,...s.functions(),...y.functions],callSites:[...p.callSites,...y.callSites],classes:[...p.classes,...s.classes(),...y.classes],callEdges:[...p.callEdges,...y.callEdges,...S],importEdges:[...i.importEdges,...h.importEdges,...y.importEdges],exportBindings:[...p.exportBindings,...u.exportBindings],inheritEdges:[]},E=new Map;for(let g of e.sourceFiles){let b=e.toRel(g.fileName);b!==null&&E.set(b,g)}return{graph:k,diagnostics:[...u.diagnostics,...y.diagnostics,...mh(k,E,new Set(e.diagnostics.filter(g=>g.code==="dependency-body").map(g=>g.path)),i.appOwnedPaths)],loadSites:i.loadSites,...p.bindingApplicability!==void 0?{bindingApplicability:p.bindingApplicability}:{}}}var hh=/^(@[A-Za-z0-9_.-]{1,100}\/)?[A-Za-z0-9_.-]{1,100}$/u,to=/^[A-Za-z0-9_$.-]{1,128}$/u;function gh(e){return hh.test(e.calleePackage)?to.test(e.anchorExport)?to.test(e.calleeExport)?e.anchorContainer!==null&&!to.test(e.anchorContainer)?`anchorContainer ${JSON.stringify(e.anchorContainer)}`:e.calleeContainer!==null&&!to.test(e.calleeContainer)?`calleeContainer ${JSON.stringify(e.calleeContainer)}`:null:`calleeExport ${JSON.stringify(e.calleeExport)}`:`anchorExport ${JSON.stringify(e.anchorExport)}`:`calleePackage ${JSON.stringify(e.calleePackage)}`}function rr(e,n){let t=[],r=[],o=new Map(e.modules.map(l=>[l.id,l])),s=new Map(e.classes.map(l=>[l.id,l.name])),i=(l,c,p)=>e.functions.some(u=>{if(u.name!==c)return!1;let m=o.get(u.moduleId);return m===void 0||m.packageName!==l?!1:(u.enclosingClassId!==void 0?s.get(u.enclosingClassId)??null:null)===p}),a=(l,c,p)=>{for(let u of e.functions){if(u.name!==c)continue;let m=o.get(u.moduleId);if(!(m===void 0||m.packageName!==l||(u.enclosingClassId!==void 0?s.get(u.enclosingClassId)??null:null)!==p))return u.id}return null},d=[...n].sort((l,c)=>l.modelId<c.modelId?-1:l.modelId>c.modelId?1:0);for(let l of d){if(l.edges.length>64){t.push(`model ${l.modelId}: ${String(l.edges.length)} edges over cap ${String(64)} \u2014 dropped WHOLE (all-or-nothing)`);continue}let c=l.edges.map(gh).find(m=>m!==null);if(c!==void 0){t.push(`model ${l.modelId}: hostile/invalid edge field ${c} \u2014 model refused WHOLE`);continue}let p=0,u=0;for(let m of l.edges){if(!i(l.packageName,m.anchorExport,m.anchorContainer)){u+=1;continue}r.push({modelId:l.modelId,kind:m.kind,anchor:{packageName:l.packageName,exportName:m.anchorExport,container:m.anchorContainer},callee:{packageName:m.calleePackage,exportName:m.calleeExport,container:m.calleeContainer,realFunctionId:a(m.calleePackage,m.calleeExport,m.calleeContainer)},resolution:"modeled"}),p+=1}p>0?t.push(`model-edge ${l.modelId}: ${String(p)} edge(s) lowered, ${String(u)} reference-gated`):t.push(`model ${l.modelId}: refused \u2014 no anchor surface in the graph (${String(u)} edge(s) reference-gated); models never mint loadedness`)}return{delta:{records:r,notes:t}}}var yh={modules:[],exports:[],imports:[],functions:[],callSites:[],classes:[],callEdges:[],importEdges:[],exportBindings:[],inheritEdges:[]};function Ms(e){try{let n=vl(e.appRoot,e.entrypoints,e.tsconfigPaths===!0),t=new Set(e.entrypoints.map(a=>a.split(tn.sep).join("/"))),{graph:r,diagnostics:o,loadSites:s,bindingApplicability:i}=od(n,t,e.depClassAnchors??[],e.bindingForms??{},e.callablePackageResolver===!0);return{graph:r,diagnostics:[...n.diagnostics,...o],loadSites:s,conditionUnions:n.conditionUnions,provenAbsent:n.provenAbsent,...i!==void 0?{bindingApplicability:i}:{}}}catch(n){return{graph:yh,loadSites:[],conditionUnions:[],provenAbsent:[],diagnostics:[{code:"unsupported-syntax",path:e.appRoot,detail:`analysis aborted: ${n instanceof Error?n.message:String(n)}`}]}}}function sd(e,n){let t=512,r=(o,s,i)=>{if(!(t<=0||s>12)){if(t-=1,typeof o=="string"){n(o,i);return}if(Array.isArray(o)){for(let a of o)r(a,s+1,i);return}if(o!==null&&typeof o=="object")for(let[a,d]of Object.entries(o))a==="types"||a==="typings"||r(d,s+1,i||a.includes("*"))}};r(e,0,!1)}function ld(e,n,t,r=!1){if(typeof t!="string"||t.length===0||t.endsWith(".d.ts")||t.endsWith(".d.mts")||t.endsWith(".d.cts"))return null;let o;try{o=Tn(tn.resolve(e,t))}catch{return null}return o!==e&&!o.startsWith(n)||r&&!wn(o)?null:o===e?"":o.slice(n.length).split(tn.sep).join("/")}var xh=1024*1024,Sh=4096;function id(e,n){let t=e.toLowerCase(),r=0;for(;;){let o=t.indexOf(n,r);if(o===-1)return null;let s=o===0?" ":t[o-1],i=o+n.length;for(;i<e.length&&(e[i]===" "||e[i]==="	"||e[i]===`
+`||e[i]==="\r");)i+=1;if(/[a-z0-9_:-]/i.test(s??" ")||e[i]!=="="){r=o+n.length;continue}for(i+=1;i<e.length&&(e[i]===" "||e[i]==="	"||e[i]===`
+`||e[i]==="\r");)i+=1;let a=e[i];if(a==='"'||a==="'"){let l=e.indexOf(a,i+1);return l===-1?null:e.slice(i+1,l)}let d=i;for(;d<e.length&&!/[\s>]/.test(e[d]??"");)d+=1;return e.slice(i,d)}}function bh(e){let n=[],t=e.toLowerCase(),r=0;for(;;){let o=t.indexOf("<script",r);if(o===-1)break;let s=t[o+7];if(s!==void 0&&/[a-z0-9-]/.test(s)){r=o+7;continue}let i=e.indexOf(">",o);if(i===-1)break;r=i+1;let a=e.slice(o+7,i);if(a.length>Sh)continue;let d=id(a,"type");n.push({module:(d??"").trim().toLowerCase()==="module",src:id(a,"src")})}return n}function kh(e){return/^[a-z][a-z0-9+.-]*:/i.test(e)||e.startsWith("//")}function wh(e){let n=e.search(/[?#]/);return(n===-1?e:e.slice(0,n)).replace(/^\/+/,"")}function Eh(e){let n=Tn(e),t=n.endsWith(tn.sep)?n:n+tn.sep,r=new Set,o=[],s=[],i=[],a=[],d=[],l=!1,c=(O,F,K=!1,ee)=>{let U=ld(n,t,O);return U===null||U.length===0?"unresolved":r.has(U)?"duplicate":(r.add(U),o.push(U),s.push({source:F,specifier:nn(ee??(typeof O=="string"?O:"")),entrypoint:U,launch:K}),"added")},p=new Set,u=(O,F,K=!1)=>{let ee=c(O,F),U=typeof O=="string"&&O.includes("\\")?c(O.split("\\").join("/"),F,!1,O):"unresolved";if(ee!=="unresolved"||U!=="unresolved"||typeof O!="string"||O.trim().length===0||O.endsWith(".d.ts")||O.endsWith(".d.mts")||O.endsWith(".d.cts"))return;if(K&&O.includes("*")){let B=Il(n,O),D=!1;if(B!==null){for(let Y of B.matches)c(Y,F,!1,O)!=="unresolved"&&(D=!0);if(!B.truncated&&D)return}a.push({source:F,file:"package.json",detail:`\`${nn(O)}\` is a subpath pattern cupel could not expand completely; the files it names beyond those seeded were NOT analyzed`});return}let J=`${F}\0${O}`;p.has(J)||(p.add(J),a.push({source:F,file:"package.json",detail:`\`${nn(O)}\` did not resolve to a file inside the scan root; the code it names was NOT analyzed`}))},m=[],h=(O,F)=>{i.push({source:O,file:O,detail:F.detail}),m.push({code:F.code,path:O,detail:`${O} ${F.detail}`})},x,y,S,k=null,E=ro(n,t,"package.json",Bn);E.kind==="refused"&&h("package.json",E);try{let O=E.kind==="ok"?JSON.parse(E.text):{};if(k=E.kind==="ok"?O:null,u(O.main,"main"),typeof O.bin=="string")u(O.bin,"bin");else if(O.bin!==null&&typeof O.bin=="object")for(let K of Object.values(O.bin))u(K,"bin");sd(O.exports,(K,ee)=>{u(K,"exports",ee)}),typeof O.browser=="string"?u(O.browser,"browser"):sd(O.browser,K=>{c(K,"browser")});let F=O.scripts;if(F!==null&&typeof F=="object"){let K=F;x=K.start,y=K.prestart,S=K.poststart}}catch{}if(o.length===0)try{Tn(tn.join(n,"index.js")),c("index.js","index.js fallback")}catch{}let g=(O,F)=>{if(typeof O=="string"&&O.trim().length>0){let K=$s(O,F,"package.json",c,i,!1)==="used";return K&&(l=!0),K?"resolved":"gapped"}return O===void 0||typeof O=="string"?"absent":(i.push({source:F,file:"package.json",detail:`${F} is not a string; no entry file could be read from it`}),"gapped")},b=g(x,"scripts.start"),w=g(y,"scripts.prestart"),I=g(S,"scripts.poststart"),N=b==="resolved"&&w!=="gapped"&&I!=="gapped",v=ro(n,t,"Procfile",65536);if(v.kind==="refused")h("Procfile",v);else if(v.kind==="ok"){let{entries:O,truncated:F,unnamedLines:K}=xs(v.text);F&&i.push({source:"Procfile",file:"Procfile",detail:"Procfile has more process types than cupel parses; the remainder was not read"}),K>0&&i.push({source:"Procfile",file:"Procfile",detail:`${String(K)} Procfile line(s) declare a process whose name cupel does not accept; their commands were NOT read`});for(let ee of O)$s(ee.command,`Procfile:${ee.name}`,"Procfile",c,i,N)==="used"&&(l=!0)}for(let O of["Dockerfile","docker-compose.yml","docker-compose.yaml","compose.yml"]){let F=ro(n,t,O,gs);if(F.kind==="refused"){h(O,F);continue}if(F.kind!=="ok")continue;let{commands:K,truncated:ee}=ys(F.text);ee&&i.push({source:O,file:O,detail:`${O} declares more launch commands than cupel parses; the remainder was not read`});for(let U of K)$s(U.command,`${O}:${U.label}`,O,c,i,N)==="used"&&(l=!0)}let _=o.length===0,P=ro(n,t,"index.html",xh);if(P.kind==="ok")for(let O of bh(P.text)){if(O.src===null)continue;let F=nn(O.src);if(!O.module){d.push({kind:"classic-script",file:"index.html",detail:`index.html loads "${F}" as a classic (non-module) script; not seeded (ADR-071 Step 5, decision 2)`,root:""});continue}if(kh(O.src)){d.push({kind:"external-script",file:"index.html",detail:`index.html loads the module script "${F}" from another origin \u2014 not this repository's code; not seeded`,root:""});continue}c(wh(O.src),"index.html",!1,O.src)==="unresolved"&&i.push({source:"index.html",file:"index.html",detail:`index.html names the module script "${F}", which did not resolve to a file inside the root; the browser would load it and cupel did not analyze it`})}else P.kind==="refused"&&d.push({kind:P.code==="limit-exceeded"?"index-html-oversize":"index-html-refused",file:"index.html",detail:`index.html ${P.detail}`,root:""});let R=_?us(n,k):null;if(R!==null){let O=0;for(let F of ps(n,R).roots)c(F,`framework:${R.name}`)==="added"&&(O+=1);O>0&&m.push({code:"framework-derived-entry",path:"package.json",detail:`entrypoints were derived from ${R.name}'s directory conventions (recognised via ${R.configFile}), not declared by this project. That set cannot be proven complete, so findings that would read \`not-reachable\` are capped at \`unknown\`; pass \`--entry\` for the files your build actually starts to lift it`})}let L=O=>O.map(F=>({...F,root:""}));return{entrypoints:o,sources:L(s),gaps:L(i),surfaceGaps:L(a),launchResolved:l,diagnostics:m,framework:R,observations:d}}function ro(e,n,t,r){let o;try{o=Tn(tn.join(e,t))}catch{return{kind:"absent"}}if(!o.startsWith(n))return{kind:"refused",code:"out-of-root",detail:"exists but resolves OUTSIDE the scan root (symlink); it was NOT read, so the declarations it carries were not analyzed"};let s=_t(o,r);return s.kind==="ok"?s:s.kind==="too-large"?{kind:"refused",code:"limit-exceeded",detail:`is ${String(s.bytes)} bytes, over the ${String(r)}-byte cap; it was NOT read`}:{kind:"refused",code:"parse-error",detail:"exists but is not a readable regular file (FIFO/device/directory); it was NOT read"}}function $s(e,n,t,r,o,s){let i=hs(e);if(i.kind==="delegates")return s?"used":(o.push({source:n,file:t,detail:`\`${nn(e)}\`: runs the package \`start\` lifecycle (prestart/start/poststart), which is absent or not fully readable`}),"gapped");if(i.kind==="foreign")return"foreign";if(i.kind==="unparsed")return o.push({source:n,file:t,detail:`\`${nn(e)}\`: ${i.reason}`}),"gapped";let a=r(i.specifier,n,!0),d=i.alt===void 0?"unresolved":r(i.alt,n,!0);return a==="unresolved"&&d==="unresolved"?(o.push({source:n,file:t,detail:`\`${nn(i.specifier)}\` did not resolve to a file inside the app root`}),"gapped"):"used"}function Ct(e,n){return e===""?n:`${e}/${n}`}function dd(e,n){let t=Tn(e),r=t.endsWith(tn.sep)?t:t+tn.sep,o=new Set,s=[],i=[],a=[],d=[],l=[],c=[],p=!1,u=null,m=[...n].sort((h,x)=>h.rel===""?-1:x.rel===""?1:h.rel<x.rel?-1:h.rel>x.rel?1:0);for(let h of m){let x=Ct(h.rel,"package.json"),y=h.rel===""?".":h.rel,S;try{S=Tn(h.abs)}catch{a.push({source:"root",file:x,detail:`root \`${y}\` could not be resolved; not seeded`,root:h.rel});continue}if(S!==t&&!S.startsWith(r)){a.push({source:"root",file:x,detail:`root \`${y}\` resolves outside the scan root; refused, not seeded`,root:h.rel});continue}let k;try{k=Eh(S)}catch{a.push({source:"root",file:x,detail:`root \`${y}\` could not be read; not seeded`,root:h.rel});continue}for(let E of k.sources){let g=Ct(h.rel,E.entrypoint),b,w;try{b=Tn(tn.resolve(t,g)),w=Tn(tn.resolve(S,E.entrypoint))}catch{a.push({source:E.source,file:x,detail:`\`${E.specifier}\` re-based to \`${g}\` did not resolve; not seeded`,root:h.rel});continue}if(!b.startsWith(r)||b!==w){a.push({source:E.source,file:x,detail:`\`${E.specifier}\` re-based to \`${g}\` escapes the scan root or names another file; refused, not seeded`,root:h.rel});continue}o.has(g)||(o.add(g),s.push(g),i.push({...E,entrypoint:g,root:h.rel}))}k.launchResolved&&(p=!0);for(let E of k.gaps)a.push({...E,file:Ct(h.rel,E.file),root:h.rel});for(let E of k.surfaceGaps)d.push({...E,file:Ct(h.rel,E.file),root:h.rel});for(let E of k.diagnostics)l.push({...E,path:Ct(h.rel,E.path)});for(let E of k.observations)c.push({...E,file:Ct(h.rel,E.file),root:h.rel});h.rel===""&&(u=k.framework)}return{entrypoints:s,sources:i,gaps:a,surfaceGaps:d,launchResolved:p,diagnostics:l,framework:u,observations:c}}function Ts(e){let{gaps:n,launchResolved:t}=e;if(n.length===0||!t)return[];let r=n.slice(0,3).map(o=>o.source).join(", ");return[{code:"unresolved-launch-entry",path:n[0]?.file??"package.json",detail:`${String(n.length)} launch declaration(s) (${r}) name code this project starts but cupel could not resolve to an entry file, while other launch declarations DID seed the analysis; verdicts that would be \`not-reachable\` are capped at \`unknown\`. To clear it, make those commands a direct \`node <file.js>\` invocation cupel can read. \`--entry <file>\` analyzes that code too (so a sink there is still reported), but the cap remains while the command itself is unreadable`}]}function Ds(e,n){let{surfaceGaps:t}=e;if(t.length===0||n===0)return[];let r=[...new Set(t.slice(0,3).map(o=>o.source))].join(", ");return[{code:"unresolved-entry-declaration",path:t[0]?.file??"package.json",detail:`${String(t.length)} package.json entry declaration(s) (${r}) name a file this package owns that cupel could not resolve inside the scan root, while the analysis was seeded from elsewhere; the code they name was NOT analyzed, so verdicts that would be \`not-reachable\` are capped at \`unknown\`. To clear it, point those fields at a file that exists (a Windows-style \`lib\\index.js\` does not resolve on a posix host). \`--entry <file>\` analyzes that code too, but the cap remains while the declaration is unresolvable`}]}function cd(e,n){let t=Tn(e),r=t.endsWith(tn.sep)?t:t+tn.sep,o=new Set,s=[],i=[];for(let a of n){let d=ld(t,r,a,!0);if(d===null||d.length===0){i.push(a);continue}o.has(d)||(o.add(d),s.push(d))}return{entrypoints:s,rejected:i}}import{readdirSync as Gd,readFileSync as ri,realpathSync as oi,statSync as fr}from"node:fs";import mn from"node:path";function vh(e){if(e.startsWith("<<:")||e.startsWith("- &")||e.startsWith("- *"))return!0;let n=e.charCodeAt(0);if(n===38||n===42)return!0;let t=e.indexOf(": ");if(t===-1)return!1;let r=t+2;for(;r<e.length&&e.charCodeAt(r)===32;)r+=1;let o=e.charCodeAt(r);return o===38||o===42}function un(e,n,t){let r=n.maxLines??2e6,o=n.maxLineBytes??16384,s=!1,i=!1,a=0,d=0,l=e.charCodeAt(0)===65279?1:0;for(;l<=e.length;){let c=e.indexOf(`
+`,l),p=c===-1;p&&(c=e.length);let u=c>l&&e.charCodeAt(c-1)===13?c-1:c;if(d+=1,d>r){s=!0;break}if(u-l>o)a+=1;else{let m=l;for(;m<u&&e.charCodeAt(m)===32;)m+=1;let h=m-l,x=u;for(;x>m&&(e.charCodeAt(x-1)===32||e.charCodeAt(x-1)===9);)x-=1;if(m<x&&e.charCodeAt(m)!==35){let y=e.slice(m,x);if(vh(y)){i=!0;break}t(h,y)}}if(p)break;l=c+1}return{truncated:s||a>0,refusedAnchors:i,oversizeLines:a}}function vn(e){let n=e.charCodeAt(0);if(n===34||n===39){let r=e.indexOf(String.fromCharCode(n),1);if(r===-1)return null;let o=r+1;for(;o<e.length&&e.charCodeAt(o)===32;)o+=1;return e.charCodeAt(o)===58?e.slice(0,r+1):null}let t=e.indexOf(":");return t>0?e.slice(0,t):null}function an(e){return e.endsWith(":")}function ye(e){if(e.length>=2){let n=e.charCodeAt(0);if((n===34||n===39)&&e.charCodeAt(e.length-1)===n)return e.slice(1,-1)}return e}function oo(e){if(e.length===0||e.length>214)return!1;let n=e.charCodeAt(0)===64,t=n?e.slice(1):e,r=t.indexOf("/");if(n){if(r<=0||t.indexOf("/",r+1)!==-1)return!1}else if(r!==-1)return!1;let o=n?[t.slice(0,r),t.slice(r+1)]:[t];for(let s of o){if(s.length===0||s.charCodeAt(0)===46||s.charCodeAt(0)===95)return!1;for(let i=0;i<s.length;i+=1){let a=s.charCodeAt(i);if(!(a>=97&&a<=122||a>=65&&a<=90||a>=48&&a<=57||a===45||a===46||a===95||a===126))return!1}}return!0}function or(e){return oo(e)?`node_modules/${e}`:""}function sr(e,n){let t=`${e}@${n}`;return t.length<=96?t:`${t.slice(0,96)}\u2026`}var so=2e5,ud=64,io=1024,_h=5,Ih=[1,2,3];function Ah(e){let n="node_modules/",t=e.lastIndexOf(n);if(t===-1)return null;let r=e.slice(t+n.length);if(r==="")return null;let o=r.split("/");return o[0]?.startsWith("@")?o.length>=2?`${o[0]}/${o[1]}`:null:o[0]??null}function fd(e,n){if(!n.startsWith("npm:"))return[{name:e,version:n}];let t=n.slice(4);if(t.length===0)return[{name:e,version:n}];let r=t.indexOf("@",1);if(r>0){let o=t.slice(0,r),s=t.slice(r+1);if(o.length>0&&s.length>0)return[{name:o,version:s}]}return t===e?[{name:e,version:n}]:[{name:e,version:n},{name:t,version:n}]}function fn(e){return typeof e!="object"||e===null||Array.isArray(e)?null:e}function pd(e){return{deps:[],seen:new Set,maxEntries:e,unread:0,visited:0,capped:!1}}function md(e){return e.capped?!1:(e.visited+=1,e.visited>e.maxEntries?(e.capped=!0,!1):!0)}function hd(e,n,t,r,o=!1){let s=JSON.stringify([n,t,r]);if(!e.seen.has(s)){if(e.deps.length>=e.maxEntries){e.capped=!0;return}e.seen.add(s),e.deps.push({name:n,version:t,lockKey:r,dev:o})}}function Nh(e,n){for(let[t,r]of Object.entries(e)){if(t==="")continue;if(!md(n))return;let o=t.startsWith("node_modules/")||t.includes("/node_modules/"),s=fn(r);if(s===null){n.unread+=1;continue}if(s.link===!0)continue;let i=s.name,a=typeof i=="string"&&i!==""?i:Ah(t),d=s.version;if(a===null||typeof d!="string"){o&&(n.unread+=1);continue}let l=s.dev===!0||s.devOptional===!0;for(let c of fd(a,d))hd(n,c.name,c.version,t,l)}}function gd(e,n,t){let r=[{deps:e,prefix:"",depth:0,pathSafe:!0,dev:!1}],o=!1;for(let s=0;s<r.length;s+=1){let i=r[s];if(i===void 0)break;for(let[a,d]of Object.entries(i.deps)){if(!md(n))return{depthCapped:o};if(a===""){n.unread+=1;continue}let l=fn(d);if(l===null){n.unread+=1;continue}let c=i.pathSafe&&oo(a),p=c?`${i.prefix}node_modules/${a}`:"",u=c&&p.length<=io,m=u?p:"",h=l.version,x=l.dev===!0||i.dev;if(l.link!==!0&&typeof h=="string"&&h!=="")for(let S of fd(a,h))hd(n,S.name,S.version,m,x);else n.unread+=1;let y=fn(l.dependencies);if(y!==null){if(i.depth+1>t){o=!0;continue}r.push({deps:y,prefix:u?`${m}/`:i.prefix,depth:i.depth+1,pathSafe:u,dev:x})}}}return{depthCapped:o}}function Rh(e,n,t){let r=pd(n.maxEntries),{depthCapped:o}=gd(e,r,t),s=[],i=new Set(n.deps.map(l=>JSON.stringify([l.name,l.version]))),a=new Set,d=[];for(let l of r.deps){if(l.version.includes(":"))continue;let c=JSON.stringify([l.name,l.version]);i.has(c)||a.has(c)||(a.add(c),d.length<_h&&d.push(sr(l.name,l.version)))}if(a.size>0){let l=a.size-d.length;s.push(`package-lock.json carries BOTH a v2/v3 \`packages\` map and a legacy v1 \`dependencies\` tree, and they DISAGREE: ${String(a.size)} install(s) the tree describes are absent from the map (${d.join(", ")}${l>0?`, and ${String(l)} more`:""}). npm 6 installs from the tree and npm 7+ from the map, so what is on disk depends on which npm ran; cupel enumerated the map`)}return(r.capped||o)&&s.push("package-lock.json's legacy `dependencies` tree hit a cap before it could be cross-checked against the `packages` map; a disagreement between the two would not have been seen"),s}function ao(e,n={}){let t=[],r;try{r=JSON.parse(e)}catch{return{deps:[],diagnostics:["package-lock.json is not valid JSON"],truncated:!1}}let o=fn(r);if(o===null)return{deps:[],diagnostics:["package-lock.json is not an object"],truncated:!1};let s=o.lockfileVersion,i=typeof s=="number"&&Number.isInteger(s)?s:null,a=typeof s=="number"?String(s):"?",d=fn(o.packages),l=fn(o.dependencies);if(d===null&&l===null)return{deps:[],diagnostics:[`package-lock.json (lockfileVersion ${a}) has neither a v2/v3 \`packages\` map nor a v1 \`dependencies\` tree; NO dependency was enumerated`],truncated:!1};(i===null||!Ih.includes(i))&&t.push(`package-lock.json declares unsupported lockfileVersion ${a} (cupel knows v1, v2 and v3); its shape may differ, so what was read may be incomplete`);let c=n.maxDepth??ud,p=pd(n.maxEntries??so),u=!1;return d!==null?(Nh(d,p),l!==null&&t.push(...Rh(l,p,c))):l!==null&&(u=gd(l,p,c).depthCapped),p.capped&&t.push(`lockfile exceeds ${String(p.maxEntries)} entries; truncated`),u&&t.push(`package-lock.json nests \`dependencies\` deeper than ${String(c)} levels; the deeper subtree(s) were NOT enumerated`),p.unread>0&&t.push(`package-lock.json has ${String(p.unread)} entr(ies) with no version cupel could read (an odd shape or a missing \`version\`); they were not enumerated`),{deps:p.deps,diagnostics:t,truncated:p.capped||u}}var Ph=["workspace:","link:","portal:","file:","exec:"];function Oh(e){let n=e.charCodeAt(0);if(n>=48&&n<=57||n===94||n===126||n===62||n===60||n===61||n===42||n===124)return!0;if(n===118||n===86){let t=e.charCodeAt(1);return t>=48&&t<=57}return!1}function Ls(e){let n=e.trim();if(n.length===0)return[];let t=n.indexOf("@",1);if(t<=0)return[];let r=n.slice(0,t),o=n.slice(t+1);if(r.length===0)return[];for(let a of Ph)if(o.startsWith(a))return[];if(!o.startsWith("npm:"))return[r];let s=o.slice(4),i=s.indexOf("@",1);if(i>0){let a=s.slice(0,i);return a.length>0?[a]:[r]}return s.length===0||Oh(s)?[r]:[r,s]}function $h(e){if(an(e))return e.slice(0,-1);let n=0;for(let t=0;t<e.length-1;t+=1){let r=e.charCodeAt(t);if(r===34||r===39){n===0?n=r:n===r&&(n=0);continue}if(n===0&&r===58&&e.charCodeAt(t+1)===32)return e.slice(0,t)}return null}function Ch(e){let n=e.replaceAll('"',"").replaceAll("'",""),t=[];for(let r of n.split(",")){let o=r.trim();o.length>0&&t.push(o)}return t}function Mh(e){let n=e.charCodeAt(0)===65279?e.slice(1,64):e.slice(0,64),t="# yarn lockfile v";if(!n.startsWith(t))return null;let r=t.length;for(;r<n.length&&r<t.length+3;){let s=n.charCodeAt(r);if(s<48||s>57)break;r+=1}let o=n.slice(t.length,r);return o.length>0?o:null}function yd(e){if(!e.startsWith("version"))return null;let n=e.charCodeAt(7);if(n!==58&&n!==32)return null;let t=ye(e.slice(8).trim());return t.length>0?t:null}function Fs(e,n={}){let t=[],r=[],o=new Set,s=n.maxEntries??2e5,i=!1,a=null,d=!1,l=[],c=!1,p=-1,u=!1,m=0,h=()=>{l.length>0&&!c&&(m+=1)},x=un(e,n,(E,g)=>{if(E===0){h(),l=[],c=!1,p=-1,d=!1;let w=$h(g);if(w===null)return;let I=ye(w.trim());if(I==="__metadata"){i=!0,d=an(g);return}for(let N of Ch(I))l.push(...Ls(N));return}if(d){if(E===2&&a===null){let w=yd(g);w!==null&&(a=w)}return}if(l.length===0||(p===-1&&(p=E),E!==p||c))return;let b=yd(g);if(b!==null){c=!0;for(let w of l){let I=JSON.stringify([w,b]);if(!o.has(I)){if(r.length>=s){u=!0;return}o.add(I),r.push({name:w,version:b,lockKey:or(w),dev:!1})}}}});h();let y=i?"yarn.lock (Berry)":"yarn.lock (v1)";if(x.refusedAnchors)return{deps:[],diagnostics:[`${y} uses YAML anchors/aliases (& / * / <<:); cupel refuses to expand them (expansion-bomb shape) and did NOT read the dependency set`],truncated:!1};x.oversizeLines>0&&t.push(`${y} has ${String(x.oversizeLines)} over-long line(s) that were not parsed; the dependency set is incomplete`),u&&t.push(`${y} exceeds ${String(s)} entries; truncated`);let S=a??Mh(e),k=S===null?null:Number(S.split(".")[0]);return S!==null&&(k===null||!Number.isInteger(k)||k<1||k>8)&&t.push(`${y} declares unsupported lockfileVersion ${S} (cupel knows v1 and Berry 4-8); its shape may differ, so what was read may be incomplete`),m>0&&t.push(`${y} has ${String(m)} entr(ies) with no version cupel could read (an unusual body shape or a missing \`version\`); they were not enumerated`),{deps:r,diagnostics:t,truncated:x.truncated||u}}function js(e){let n=e.trim(),t=n.indexOf("(");t!==-1&&(n=n.slice(0,t));let r=n.indexOf("_");return r!==-1&&(n=n.slice(0,r)),n.trim()}function Bs(e){let n=e.charCodeAt(0);return e.length>0&&n>=48&&n<=57}function co(e){let n=ye(e.trim());if(n.length===0)return null;let t=n.indexOf("(");t!==-1&&(n=n.slice(0,t));let r=n.charCodeAt(0)===47;if(r&&(n=n.slice(1)),n.length===0)return null;if(!r&&n.charCodeAt(0)!==64){let c=n.indexOf("/"),p=n.indexOf("@",1);c>0&&(p===-1||c<p)&&n.slice(0,c).includes(".")&&n.indexOf("/",c+1)!==-1&&(n=n.slice(c+1))}let o=n.charCodeAt(0)===64,s=o?n.indexOf("/"):-1;if(o&&s<=0)return null;let i=o?s+1:0,a=-1;for(let c=i;c<n.length;c+=1){let p=n.charCodeAt(c);if(p===47||p===64){a=c;break}}if(a<=i)return null;let d=n.slice(0,a),l=js(n.slice(a+1));return Bs(l)?{name:d,version:l}:null}var Th=new Set(["packages","snapshots","importers"]),Dh=new Set([5,6,7,8,9]);function Lh(e){let n=ye(e.trim()),t=0;for(;t<n.length&&n.charCodeAt(t)>=48&&n.charCodeAt(t)<=57;)t+=1;return t===0||t>6?null:Number(n.slice(0,t))}function lo(e){let n=e.indexOf(":");if(n<=0)return null;let t=e.slice(n+1).trim();return t.length===0?null:{key:ye(e.slice(0,n).trim()),value:ye(t)}}function Ks(e,n={}){let t=[],r=[],o=new Set,s=n.maxEntries??2e5,i="",a=null,d=!1,l=0,c=[],p=(m,h)=>{let x=JSON.stringify([m,h]);if(!o.has(x)){if(r.length>=s){d=!0;return}o.add(x),r.push({name:m,version:h,lockKey:or(m),dev:!1})}},u=un(e,n,(m,h)=>{if(m===0){let x=vn(h);if(i=x===null?"":ye(x.trim()),a=null,i==="lockfileVersion"){let y=lo(h),S=y===null?null:Lh(y.value);y!==null&&(S===null||!Dh.has(S))&&c.push(`pnpm-lock.yaml declares unsupported lockfileVersion ${y.value} (cupel knows 5.x-9.x); its shape may differ, so what was read may be incomplete`),i="";return}if(Th.has(i)&&!an(h)){let y=lo(h)?.value.trim()??"";y!=="{}"&&y!=="[]"&&(l+=1),i=""}return}if(i==="packages"||i==="snapshots"){if(m!==2)return;let x=vn(h),y=x===null?null:co(x);if(y===null){l+=1;return}p(y.name,y.version);return}if(i==="importers"){if(m===6){let x=lo(h);if(x===null){a=h.endsWith(":")?ye(h.slice(0,-1).trim()):null;return}a=null;let y=js(x.value);Bs(y)&&p(x.key,y);return}if(m===8&&a!==null){let x=lo(h);if(x===null||x.key!=="version")return;let y=js(x.value);Bs(y)&&p(a,y)}}});return u.refusedAnchors?{deps:[],diagnostics:["pnpm-lock.yaml uses YAML anchors/aliases (& / * / <<:); cupel refuses to expand them (expansion-bomb shape) and did NOT read the dependency set"],truncated:!1}:(t.push(...c),u.oversizeLines>0&&t.push(`pnpm-lock.yaml has ${String(u.oversizeLines)} over-long line(s) that were not parsed; the dependency set is incomplete`),d&&t.push(`pnpm-lock.yaml exceeds ${String(s)} entries; truncated`),l>0&&t.push(`pnpm-lock.yaml has ${String(l)} entr(ies) with no registry name@version key (git/tarball/link); they were not enumerated`),{deps:r,diagnostics:t,truncated:u.truncated||d})}function Ln(e){return e.toLowerCase().replace(/[-_.]+/gu,"-")}var Fh=1e6,xd=2e5,jh=4096,Bh=65536,Kh=262144,ir=/^[A-Za-z_][A-Za-z0-9_]*$/u;function bd(e){if(e.length>Fh)return null;let n,t;for(let r of e.split(/\r?\n/u)){if(r==="")break;let o=/^([A-Za-z][A-Za-z0-9-]*):[ \t]*(.*)$/u.exec(r);if(o===null)continue;let s=o[1]?.toLowerCase();s==="name"&&n===void 0?n=o[2]?.trim():s==="version"&&t===void 0&&(t=o[2]?.trim())}return n===void 0||t===void 0||n===""||t===""?null:{name:n,version:t}}function kd(e){return e.split(/\r?\n/u).map(n=>n.trim()).filter(n=>n.length>0&&ir.test(n))}function wd(e){if(!e.startsWith('"'))return e.split(",")[0]??"";let n="";for(let t=1;t<e.length;t+=1){let r=e[t];if(r==='"'){if(e[t+1]==='"'){n+='"',t+=1;continue}return n}n+=r}return n}function Ed(e){return e===""||e==="."||e===".."||e==="__pycache__"||e.startsWith("__editable__")||e.endsWith(".dist-info")||e.endsWith(".egg-info")||e.endsWith(".data")}function vd(e){return e.endsWith(".py")?e.slice(0,-3):e.endsWith(".so")||e.endsWith(".pyd")?e.split(".")[0]??null:null}function _d(e){let n=e.split(/\r?\n/u);return n.length>xd?n.slice(0,xd):n}function Id(e){let n=new Set;for(let t of _d(e)){if(t==="")continue;let r=wd(t).split("/"),o=r[0]??"";if(Ed(o))continue;if(r.length>1){ir.test(o)&&n.add(o);continue}let s=vd(o);s!==null&&ir.test(s)&&n.add(s)}return[...n].sort((t,r)=>t<r?-1:t>r?1:0)}function Uh(e){let n=e.split("/"),t=n[0]??"";if(Ed(t))return null;let r=n[n.length-1]??"",o=vd(r);if(o===null)return null;let s=n.slice(0,-1);if(s.some(a=>!ir.test(a)||a==="__pycache__"))return null;let i=o==="__init__"?s:[...s,o];return i.length===0||!ir.test(o==="__init__"?s[s.length-1]??"":o)?null:i}function Ad(e,n=jh){let t=new Set,r=0,o=0,s=!1;for(let i of _d(e)){if(i==="")continue;let a=wd(i),d=Uh(a);if(d!==null){r+=1,(a.endsWith(".so")||a.endsWith(".pyd"))&&(o+=1);for(let l=1;l<=Math.min(2,d.length);l+=1){let c=d.slice(0,l).join(".");if(!t.has(c)){if(t.size>=n){s=!0;break}t.add(c)}}}}return{prefixes:[...t].sort((i,a)=>i<a?-1:i>a?1:0),moduleFiles:r,extensionModules:o,capped:s}}function zh(e){if(e.length>Kh)return!0;let n=!1;for(let t of e.split(/\r?\n/u)){let r=t.trim();if(!(r===""||r.startsWith("#")||r.startsWith(";"))){if(r.startsWith("[")){let o=r.slice(1,r.endsWith("]")?-1:void 0).trim();n=o==="console_scripts"||o==="gui_scripts";continue}if(n&&r.includes("="))return!0}}return!1}function Nd(e){if(e.length>Bh)return null;let n;try{n=JSON.parse(e)}catch{return null}if(typeof n!="object"||n===null||Array.isArray(n))return null;let t=n,r=typeof t.dir_info=="object"&&t.dir_info!==null&&!Array.isArray(t.dir_info)?t.dir_info:null;return{url:typeof t.url=="string"?t.url:null,editable:r?.editable===!0}}function ar(e,n){let t=bd(e);if(t===null)return null;let r=n.topLevelText!==void 0?kd(n.topLevelText):[],o=r.length>0?r:n.recordText!==void 0?Id(n.recordText):[],s=n.recordText!==void 0?Ad(n.recordText):{prefixes:[],moduleFiles:0,extensionModules:0,capped:!1},i=n.entryPointsText!==void 0?zh(n.entryPointsText)?"declared":"none":n.entryPointsUnknown===!0?"unknown":"none",a=n.directUrlText!==void 0?Nd(n.directUrlText)?.editable??!1:!1;return{name:Ln(t.name),version:t.version,importNames:o,modulePrefixes:s.prefixes,moduleFiles:s.moduleFiles,editable:a,consoleScripts:i,extensionModules:s.extensionModules,recordKnown:n.recordText!==void 0}}function Sd(e,n,t){let r=e.get(n);r===void 0?e.set(n,[t]):r.includes(t)||r.push(t)}function Us(e){let n=new Map,t=new Map,r=[];for(let o of e){if(o.importNames.length===0){r.push(o);continue}for(let s of o.importNames)Sd(n,s,o);for(let s of o.modulePrefixes)Sd(t,s,o)}return{byImportName:n,byModulePrefix:t,unmapped:r}}function uo(e,n){let t=n.split(".").filter(o=>o.length>0),r=t[0];if(r===void 0)return[];for(let o=Math.min(2,t.length);o>=1;o-=1){let s=e.byModulePrefix.get(t.slice(0,o).join("."));if(s!==void 0&&s.length>0)return s}return e.byImportName.get(r)??[]}var lr=class{nodes=new Map;children=new Map;importers=new Map;over=!1;node(n,t,r){if(!this.nodes.has(n)){if(this.nodes.size>=2e5){this.over=!0;return}this.nodes.set(n,{name:t,version:r})}}edge(n,t){let r=this.children.get(n);r===void 0?this.children.set(n,[t]):r.includes(t)||r.push(t)}done(){return this.over||this.importers.size===0?null:{nodes:this.nodes,children:this.children,importers:this.importers}}},Wn="importer:",ft="node_modules/";function Gs(e){let n;try{n=JSON.parse(e)}catch{return null}let t=fn(fn(n)?.packages);if(t===null)return null;let r=new lr,o=new Map;for(let[l,c]of Object.entries(t)){let p=fn(c);p!==null&&o.set(l,p)}let s=l=>l.startsWith(ft)||l.includes(`/${ft}`),i=l=>{let c=l;for(let p=0;p<8;p+=1){let u=o.get(c);if(u===void 0)return null;if(u.link!==!0)return c;let m=u.resolved;if(typeof m!="string")return null;c=m}return null},a=l=>s(l)?l:`${Wn}${l}`,d=(l,c)=>{let p=l;for(;;){let u=p===""?`${ft}${c}`:`${p}/${ft}${c}`;if(o.has(u))return i(u);if(p==="")return null;let m=p.lastIndexOf(`/${ft}`);p=m===-1?"":p.slice(0,m)}};for(let[l,c]of o){if(c.link===!0)continue;let p=s(l);if(p){let m=typeof c.name=="string"&&c.name!==""?c.name:l.slice(l.lastIndexOf(ft)+ft.length),h=c.version;if(typeof h!="string")continue;r.node(l,m,h)}else r.importers.set(`${Wn}${l}`,l===""?"package.json":`${l}/package.json`);let u=p?["dependencies","optionalDependencies","peerDependencies"]:["dependencies","devDependencies","optionalDependencies","peerDependencies"];for(let m of u){let h=fn(c[m]);if(h!==null)for(let x of Object.keys(h)){let y=d(l,x);y!==null&&y!==l&&r.edge(a(l),a(y))}}}return r.done()}function fo(e){let n=vn(e);if(n===null)return null;let t=e.slice(n.length+1).trim();return t.length===0?null:{key:ye(n.trim()),value:ye(t)}}var zs=new Set(["dependencies","optionalDependencies","devDependencies"]);function Ws(e,n={}){let t=new lr,r=[],o="",s=!1,i=null,a="",d=null,l=u=>u==="."||u===""?"package.json":`${u}/package.json`,c=(u,m,h,x)=>{if(h===m){let y=fo(x);d=y===null&&an(x)?ye(x.slice(0,-1).trim()):null,y!==null&&r.push({from:u,name:y.key,token:y.value});return}if(h===m+2&&d!==null){let y=fo(x);y?.key==="version"&&r.push({from:u,name:d,token:y.value})}},p=un(e,n,(u,m)=>{if(u===0){let h=vn(m);o=h===null?"":ye(h.trim()),o==="lockfileVersion"&&(s=(fo(m)?.value??"").startsWith("5")),i=null,zs.has(o)&&an(m)&&(i=`${Wn}.`,t.importers.set(i,"package.json"),a=o,d=null);return}if(zs.has(o)){i!==null&&c(i,2,u,m);return}if(o==="importers"){if(u===2){let h=vn(m),x=h===null?".":ye(h.trim());i=`${Wn}${x}`,t.importers.set(i,l(x)),a="";return}if(i===null)return;if(u===4){a=an(m)?ye(m.slice(0,-1).trim()):"",d=null;return}zs.has(a)&&c(i,6,u,m);return}if(!(o!=="packages"&&o!=="snapshots")){if(u===2){let h=vn(m);if(h===null){i=null;return}let x=ye(h.trim()),y=x.startsWith("/")?x.slice(1):x,S=co(x);i=S===null?null:y,S!==null&&t.node(y,S.name,S.version),a="";return}if(i!==null){if(u===4){a=an(m)?ye(m.slice(0,-1).trim()):"";return}if(u===6&&(a==="dependencies"||a==="optionalDependencies")){let h=fo(m);h!==null&&r.push({from:i,name:h.key,token:h.value})}}}});if(p.refusedAnchors||p.truncated)return null;for(let u of r){if(u.token.startsWith("link:"))continue;let h=(u.token.startsWith("/")?u.token.slice(1):null)??(s?`${u.name}/${u.token}`:`${u.name}@${u.token}`);t.nodes.has(h)&&t.edge(u.from,h)}return t.done()}function qs(e,n,t={}){let r=new lr,o=new Map,s=[],i=null,a=-1,d=!1,l=-1,c=[],p=0,u=un(e,t,(m,h)=>{if(m===0){d=!1,a=-1;let k=an(h)?h.slice(0,-1):null;if(i=null,c=[],k===null)return;let E=ye(k.trim());if(E==="__metadata"||(c=E.split(",").map(b=>ye(b.trim())).filter(b=>b.length>0),c.length===0))return;p+=1,i=`y${String(p)}`;for(let b of c)o.set(b,i);let g=c.find(b=>b.includes("@workspace:"));if(g!==void 0){let b=g.slice(g.indexOf("@workspace:")+11),w=`${Wn}${b}`;r.importers.set(w,b==="."||b===""?"package.json":`${b}/package.json`),i=w;for(let I of c)o.set(I,w)}return}if(i===null)return;if(a===-1&&(a=m),m===a){if(d=!1,h==="dependencies:"||h==="optionalDependencies:"){d=!0,l=-1;return}let k=h.startsWith("version ")||h.startsWith("version:")?ye(h.slice(8).trim()):null,E=c[0];if(k!==null&&E!==void 0&&!i.startsWith(Wn)){let g=Ls(E);g.length===1&&g[0]!==void 0&&r.node(i,g[0],k)}return}if(!d||m<=a||(l===-1&&(l=m),m!==l))return;let x=vn(h),y,S;if(x!==null&&h.charCodeAt(x.length)===58)y=ye(x.trim()),S=ye(h.slice(x.length+1).trim());else{let k=h.indexOf(" ");if(k<=0)return;y=ye(h.slice(0,k)),S=ye(h.slice(k+1).trim())}y.length>0&&S.length>0&&s.push({from:i,descriptor:`${y}@${S}`})});if(u.refusedAnchors||u.truncated)return null;if(r.importers.size===0){r.importers.set(`${Wn}.`,"package.json");for(let[m,h]of n)s.push({from:`${Wn}.`,descriptor:`${m}@${h}`})}for(let m of s){let h=m.descriptor.indexOf("@",1),x=m.descriptor.slice(h+1),y=x.includes(":")?m.descriptor:`${m.descriptor.slice(0,h)}@npm:${x}`,S=o.get(m.descriptor)??o.get(y);S!==void 0&&S!==m.from&&r.edge(m.from,S)}return r.done()}function Vs(e,n,t,r){let o=new Map;for(let[k,E]of e.children)for(let g of E){let b=o.get(g);b===void 0?o.set(g,[k]):b.push(k)}let s=new Set,i=[...e.importers.keys()];for(let k=0;k<i.length;k+=1)for(let E of e.children.get(i[k])??[])s.has(E)||e.importers.has(E)||(s.add(E),i.push(E));let a=[...e.nodes].filter(([k,E])=>E.name===n&&E.version===t&&s.has(k)).map(([k])=>k).sort();if(a.length===0)return null;let d=new Map(a.map(k=>[k,0])),l=[...a];for(let k=0;k<l.length;k+=1){let E=l[k];for(let g of o.get(E)??[])d.has(g)||!s.has(g)||(d.set(g,(d.get(E)??0)+1),l.push(g))}let c=[...d.keys()].sort((k,E)=>(d.get(k)??0)-(d.get(E)??0)||(k<E?-1:k>E?1:0)),p=new Map(c.map((k,E)=>[k,E])),u=[];for(let k of c)for(let E of e.children.get(k)??[])p.has(E)&&u.push([k,E]);let m=new Array(c.length).fill(0);for(let[k,E]of u){let g=Math.max(p.get(k)??0,p.get(E)??0);m[g]=(m[g]??0)+1}let h=0,x=0;for(;h<c.length&&h<r.maxNodes;){let k=m[h]??0;if(x+k>r.maxEdges)break;x+=k,h+=1}let y=new Map(c.slice(0,h).map((k,E)=>[k,`p${String(E)}`])),S=k=>{let g=(o.get(k)??[]).filter(b=>e.importers.has(b)).sort()[0];return g===void 0?null:e.importers.get(g)??null};return{nodes:c.slice(0,h).map(k=>{let E=e.nodes.get(k);return{id:y.get(k),name:E.name,version:E.version,directFrom:S(k)}}),edges:u.flatMap(([k,E])=>{let g=y.get(k),b=y.get(E);return g===void 0||b===void 0?[]:[{from:g,to:b}]}),truncated:c.length-h}}function Hs(e){let n=new Map,t=new Set(["dependencies","devDependencies","optionalDependencies","peerDependencies"]),r=[],o=1,s=!1,i=e.charCodeAt(0)===65279?1:0;for(;i<e.length;){let a=e.charCodeAt(i);if(a===10)o+=1;else if(a===123||a===91){if(r.length>=64)return null;r.push({kind:a===123?"{":"[",key:null}),s=a===123}else if(a===125||a===93)r.pop(),s=!1;else if(a===44)s=r.at(-1)?.kind==="{";else if(a===58)s=!1;else if(a===34){let d=o,l=i+1;for(;l<e.length&&e.charCodeAt(l)!==34;){if(e.charCodeAt(l)===92)l+=1;else if(e.charCodeAt(l)===10)return null;l+=1}if(l>=e.length)return null;let c=r.at(-1);if(s&&c?.kind==="{"){let p;try{p=JSON.parse(e.slice(i,l+1))}catch{return null}c.key=p;let u=r.length===2?r[0]?.key:null;u!=null&&t.has(u)&&!n.has(p)&&n.set(p,d)}s=!1,i=l}i+=1}return r.length===0?n:null}var Xs="importer:";function po(e){let n=e.indexOf(" = ");if(n<=0)return null;let t=e.slice(n+3).trim();if(t.length<2||!t.startsWith('"')||!t.endsWith('"'))return null;let r=t.slice(1,-1);return r.includes('"')?null:{key:e.slice(0,n).trim(),value:r}}function Gh(e){let n=[],t=0;for(;;){let r=e.indexOf('"',t);if(r===-1)return n;let o=e.indexOf('"',r+1);if(o===-1)return n;n.push(e.slice(r+1,o)),t=o+1}}function Wh(e){let n=[],t=0;for(;;){let r=e.indexOf("{",t);if(r===-1)return n;let o=e.indexOf("}",r);if(o===-1)return n;let s=e.slice(r+1,o),i=[],a=s.indexOf("extra = [");if(a!==-1){let c=s.indexOf("]",a);c!==-1&&(i=Gh(s.slice(a,c)),s=s.slice(0,a)+s.slice(c+1))}let d=null,l=null;for(let c of s.split(",")){let p=po(c.trim());p?.key==="name"?d=p.value:p?.key==="version"&&(l=p.value)}d!==null&&n.push({name:d,version:l,extras:i}),t=o+1}}function Rd(e,n,t,r,o=new Map){if(r||n.size===0)return null;let s=new Map;for(let[l,c]of e){let p=s.get(c.name);p===void 0?s.set(c.name,[l]):p.push(l)}let i=new Map,a=[...t],d=new Set;for(let l=0;l<a.length;l+=1){let c=a[l],p=Ln(c.name),u=s.get(p)??[],m=c.version!==null?`${p}@${c.version}`:u.length===1?u[0]??null:null;if(m===null||!e.has(m)||m===c.from)continue;let h=i.get(c.from);h===void 0?i.set(c.from,[m]):h.includes(m)||h.push(m);for(let x of c.extras){let y=JSON.stringify([m,x]);if(!d.has(y)){d.add(y);for(let S of o.get(m)?.get(x)??[])a.push({from:m,...S})}}}return{nodes:e,children:i,importers:n}}function Js(e,n={}){let t=new Map,r=new Map,o=[],s=!1,i=null,a=null,d=null,l=[],c=new Map,p=new Map,u="",m=!1,h="",x=null,y=E=>{let g=Wh(E);x===null?l.push(...g):c.set(x,[...c.get(x)??[],...g])},S=()=>{if(i===null)return;let E=Ln(i),g=null;if(d!==null?(g=`${Xs}${d}`,r.set(g,d==="."?"pyproject.toml":`${d}/pyproject.toml`)):a!==null&&(g=`${E}@${a}`,t.size>=2e5?s=!0:t.set(g,{name:E,version:a})),g!==null){for(let b of l)o.push({from:g,...b});c.size>0&&p.set(g,c)}i=null,a=null,d=null,l=[],c=new Map},k=un(e,n,(E,g)=>{if(m){h+=g,g.startsWith("]")&&(y(h),m=!1);return}if(g==="[[package]]"){S(),u="package";return}if(g.startsWith("[")){u=g==="[package.dev-dependencies]"?"dev":g==="[package.optional-dependencies]"?"optional":"other";return}if(u==="other")return;let b=g.indexOf(" = ");if(b<=0)return;let w=g.slice(0,b).trim(),I=g.slice(b+3).trim();if((u==="optional"||(u==="dev"?d!==null:w==="dependencies"))&&I.startsWith("[")){x=u==="optional"?w.replaceAll('"',""):null,I.endsWith("]")?y(I):(m=!0,h=I);return}if(u!=="package")return;if(w==="source"){let _=I.startsWith("{")&&I.endsWith("}")?I.slice(1,-1):"";for(let P of _.split(",")){let R=po(P.trim());(R?.key==="editable"||R?.key==="virtual")&&(d=R.value)}return}let v=po(g);v?.key==="name"?i=v.value:v?.key==="version"&&(a=v.value)});return S(),k.refusedAnchors||k.truncated?null:Rd(t,r,o,s,p)}function Zs(e,n,t={}){let r=new Map,o=new Map([[`${Xs}.`,"pyproject.toml"]]),s=n.map(m=>({from:`${Xs}.`,name:m,version:null,extras:[]})),i=!1,a=null,d=null,l=[],c="",p=()=>{if(a!==null&&d!==null){let m=Ln(a),h=`${m}@${d}`;r.size>=2e5?i=!0:r.set(h,{name:m,version:d});for(let x of l)s.push({from:h,name:x,version:null,extras:[]})}a=null,d=null,l=[]},u=un(e,t,(m,h)=>{if(h==="[[package]]"){p(),c="package";return}if(h.startsWith("[")){c=h==="[package.dependencies]"?"deps":"other";return}if(c==="package"){let S=po(h);S?.key==="name"?a=S.value:S?.key==="version"&&(d=S.value);return}if(c!=="deps")return;let x=h.indexOf(" = ");x<=0||h.slice(x+3).includes("optional = true")||l.push(h.slice(0,x).trim().replaceAll('"',""))});return p(),u.refusedAnchors||u.truncated?null:Rd(r,o,s,i)}function Ys(e){let n=0;for(;n<e.length;){let t=e.charCodeAt(n);if(!(t>=97&&t<=122||t>=65&&t<=90||t>=48&&t<=57||t===45||t===46||t===95))break;n+=1}return n===0?null:Ln(e.slice(0,n))}function qh(e){return e==="tool.poetry.dependencies"||e==="tool.poetry.dev-dependencies"||e.startsWith("tool.poetry.group.")&&e.endsWith(".dependencies")}function mo(e){let n=new Map,t="",r=!1,o=0,s=l=>{l!==null&&l!=="python"&&!n.has(l)&&n.set(l,o)},i=l=>{let c=0;for(;;){let p=l.indexOf('"',c);if(p===-1)return;let u=l.indexOf('"',p+1);if(u===-1)return;s(Ys(l.slice(p+1,u))),c=u+1}},a=(l,c)=>l==="project"&&c==="dependencies"||l==="project.optional-dependencies"||l==="dependency-groups"||l==="tool.uv"&&c==="dev-dependencies",d=e.charCodeAt(0)===65279?1:0;for(;d<=e.length&&o<2e5;){let l=e.indexOf(`
+`,d);l===-1&&(l=e.length),o+=1;let c=e.slice(d,l);d=l+1;let p=c.indexOf("#"),u=(p===-1?c:c.slice(0,p)).trim();if(u.length>4096)continue;if(r){i(u),u.includes("]")&&(r=!1);continue}if(u.startsWith("[")&&!u.startsWith("[[")){t=u.slice(1,u.indexOf("]")===-1?u.length:u.indexOf("]")).trim();continue}let m=u.indexOf("=");if(m<=0)continue;let h=u.slice(0,m).trim().replaceAll('"',""),x=u.slice(m+1).trim();if(qh(t)){s(Ys(h));continue}if(a(t,h)&&x.startsWith("[")&&(i(x),r=!x.includes("]")),l===e.length)break}return n}function Qs(e){let n=new Map,t=0,r=0;for(;r<=e.length&&t<2e5;){let o=e.indexOf(`
+`,r);o===-1&&(o=e.length),t+=1;let s=e.slice(r,o);r=o+1;let i=s.trim();if(i.length>0&&i.length<=4096&&!i.startsWith("#")&&!i.startsWith("-")){let a=Ys(i);a!==null&&!n.has(a)&&n.set(a,t)}if(o===e.length)break}return n}import{statSync as pg}from"node:fs";import mg from"node:path";import{lstatSync as Vh,readFileSync as Hh,readdirSync as Xh,realpathSync as ei,statSync as dr}from"node:fs";import Ee from"node:path";function cr(e){return e.ecosystem==="PyPI"||e.alsoPython===!0}var Cd=2e4,Md=32,Td=256,Yh=2*1024*1024,Jh=256*1024,Dd=256,Zh=16,Qh=["package-lock.json","npm-shrinkwrap.json","yarn.lock","pnpm-lock.yaml"],eg=["pyproject.toml","setup.py","setup.cfg"],ng=["requirements.txt","Pipfile"],tg=["uv.lock","poetry.lock","Pipfile.lock","pdm.lock"],Ld={roots:[],observations:[],budget:"not-attempted",counts:{dirsWalked:0,manifestsSeen:0,rootsAdmitted:0,dotDirectoriesSkipped:0}};function Pd(e,n){try{let t=dr(e);return!t.isFile()||t.size>n?null:Hh(e,"utf8")}catch{return null}}function qn(e){let n;try{n=dr(e)}catch(t){return t?.code==="ENOENT"?"absent":"refused"}return n.isFile()?"regular":"refused"}function rg(e){try{return dr(e).isDirectory()}catch{return!1}}function og(e,n){let t=0,r=0,o=-1,s=0;for(;r<n.length;)if(t<e.length&&(e.charAt(t)==="?"||e.charAt(t)===n.charAt(r)))t+=1,r+=1;else if(t<e.length&&e.charAt(t)==="*")o=t,s=r,t+=1;else if(o>=0)t=o+1,s+=1,r=s;else return!1;for(;t<e.length&&e.charAt(t)==="*";)t+=1;return t===e.length}function sg(e,n){let t=(r,o)=>{if(r===e.length)return o===n.length;let s=e[r]??"";if(s==="**"){for(let a=o;a<=n.length;a+=1)if(t(r+1,a))return!0;return!1}if(o>=n.length)return!1;let i=n[o]??"";return(s.includes("*")||s.includes("?")?og(s,i):s===i)?t(r+1,o+1):!1};return t(0,0)}function ig(e){let n=[],t=Pd(Ee.join(e,"package.json"),Yh);if(t!==null)try{let i=JSON.parse(t)?.workspaces;if(Array.isArray(i))for(let a of i)typeof a=="string"&&n.push(a);else if(typeof i=="object"&&i!==null){let a=i.packages;if(Array.isArray(a))for(let d of a)typeof d=="string"&&n.push(d)}}catch{}let r=Pd(Ee.join(e,"pnpm-workspace.yaml"),Jh);r!==null&&n.push(...ag(r));let o=[];for(let s of n){if(o.length>=Dd)break;let i=s.trim();if(i.length===0)continue;for(;i.startsWith("./");)i=i.slice(2);if(i.startsWith("/")||Ee.isAbsolute(i))continue;let a=i.split("/").filter(d=>d.length>0);a.length===0||a.length>Zh||a.includes("..")||o.push(a.join("/"))}return o}function ag(e){let n=[],t=!1;for(let r of e.split(`
+`)){if(n.length>=Dd)break;if(/^packages:\s*(#.*)?$/.test(r)){t=!0;continue}if(!t)continue;let o=/^\s+-\s*(.*?)\s*$/.exec(r);if(o===null){r.trim().length>0&&(t=!1);continue}let s=(o[1]??"").trim(),i=s.indexOf(" #");i>=0&&(s=s.slice(0,i).trim()),(s.startsWith('"')&&s.endsWith('"')&&s.length>=2||s.startsWith("'")&&s.endsWith("'")&&s.length>=2)&&(s=s.slice(1,-1)),s.length>0&&n.push(s)}return n}function Od(e,n){let t=Ee.relative(n,e);return t.length===0?!1:t.split(Ee.sep).includes("node_modules")}function $d(e,n){return Ee.relative(e,n).split(Ee.sep).join("/")}function ni(e,n){let t=n?.maxDirs??Cd,r=n?.maxDepth??Md,o=n?.maxRoots??Td,s=n?.discoverPythonRoots??!0,i;try{i=ei(e)}catch{return{...Ld,observations:[{kind:"refused-unreadable",rel:""}]}}let a=[],d=[],l=new Set([i]),c=0,p=0,u=0,m="complete",h=ig(i).map(E=>E.split("/")),x=E=>{let g="absent";for(let w of eg){let I=qn(Ee.join(E,w));if(I==="regular"){g="declared";break}I==="refused"&&(g="refused")}if(g==="absent"&&ng.some(w=>qn(Ee.join(E,w))==="regular")&&(g="listed"),g==="absent")return{candidate:g,witnesses:[]};let b=[];return tg.some(w=>qn(Ee.join(E,w))==="regular")&&b.push("own-lockfile"),rg(Ee.join(E,".venv"))&&b.push("installed-env"),{candidate:g,witnesses:b}},y=(E,g)=>{let b=x(E);return b.candidate==="absent"?"not-root":(b.candidate!=="listed"&&(p+=1),b.witnesses.length===0&&b.candidate!=="refused"?(b.candidate==="declared"&&d.push({kind:"undeclared-manifest",rel:g}),"not-root"):a.length>=o?"exhausted":(a.push({rel:g,abs:E,witnesses:b.witnesses,manifestRefused:b.candidate==="refused",ecosystem:"PyPI"}),"root"))},S=(E,g)=>{if(g.length===0){let v=qn(Ee.join(E,"package.json"))!=="absent",_=s?x(E):{candidate:"absent",witnesses:[]};return!v&&_.candidate!=="absent"?(a.push({rel:"",abs:E,witnesses:["scan-root",..._.witnesses],manifestRefused:!1,ecosystem:"PyPI"}),"root"):(a.push({rel:"",abs:E,witnesses:["scan-root",..._.witnesses],manifestRefused:!1,..._.witnesses.length>0?{alsoPython:!0}:{}}),"root")}let b=qn(Ee.join(E,"package.json"));if(b==="absent")return s?y(E,g):"not-root";p+=1;let w=[],I=g.split("/");h.some(v=>sg(v,I))&&w.push("workspace-declared"),Qh.some(v=>qn(Ee.join(E,v))==="regular")&&w.push("own-lockfile");let N=s?x(E):{candidate:"absent",witnesses:[]};for(let v of N.witnesses)w.includes(v)||w.push(v);return w.length===0&&b!=="refused"?(d.push({kind:"undeclared-manifest",rel:g}),"not-root"):a.length>=o?"exhausted":(a.push({rel:g,abs:E,witnesses:w,manifestRefused:b==="refused",...N.witnesses.length>0?{alsoPython:!0}:{}}),"root")},k=[{abs:i,rel:"",depth:0}];for(;k.length>0;){let E=k.pop();if(E===void 0)break;if(c>=t){m="dirs-exhausted";break}c+=1;let g=S(E.abs,E.rel);if(g==="exhausted"){m="roots-exhausted";break}let b=g==="root";if(E.depth>=r){m=m==="complete"?"depth-clamped":m;continue}let w;try{w=Xh(E.abs)}catch{d.push({kind:"refused-unreadable",rel:E.rel});continue}w.sort().reverse();for(let I of w){let N=Ee.join(E.abs,I),v=E.rel.length===0?I:`${E.rel}/${I}`,_;try{let L=Vh(N);_=L.isDirectory()||L.isSymbolicLink()&&dr(N).isDirectory()}catch{continue}if(!_)continue;if(I==="node_modules"){b||d.push({kind:"unenumerated-install",rel:v});continue}if(I.startsWith(".")){u+=1,d.push({kind:"skipped-dot-directory",rel:v}),qn(Ee.join(N,"package.json"))!=="absent"&&d.push({kind:"undeclared-manifest",rel:v});continue}let P;try{P=ei(N)}catch{d.push({kind:"refused-unreadable",rel:v});continue}let R=i.endsWith(Ee.sep)?i:i+Ee.sep;if(P!==i&&!P.startsWith(R)){d.push({kind:"refused-out-of-root",rel:v});continue}Od(P,i)||l.has(P)||(l.add(P),k.push({abs:P,rel:$d(i,P),depth:E.depth+1}))}}for(let E of n?.operatorRoots??[]){let g=typeof E=="string"?E.slice(0,512):"",b=()=>{d.push({kind:"refused-operator-root",rel:g})};if(g.length===0||g.includes("\0")){b();continue}let w;try{w=ei(Ee.resolve(i,g))}catch{b();continue}let I=i.endsWith(Ee.sep)?i:i+Ee.sep;if(w!==i&&(!w.startsWith(I)||Od(w,i))){b();continue}let N;try{N=dr(w).isDirectory()}catch{N=!1}if(!N||qn(Ee.join(w,"package.json"))!=="regular"){b();continue}let v=a.findIndex(R=>R.abs===w);if(v>=0){let R=a[v];R!==void 0&&!R.witnesses.includes("operator")&&(a[v]={...R,witnesses:[...R.witnesses,"operator"]});continue}let _=$d(i,w);a.push({rel:_,abs:w,witnesses:["operator"],manifestRefused:!1});let P=d.findIndex(R=>R.kind==="undeclared-manifest"&&R.rel===_);P>=0&&d.splice(P,1)}return a.sort((E,g)=>E.rel<g.rel?-1:E.rel>g.rel?1:0),d.sort((E,g)=>E.kind!==g.kind?E.kind<g.kind?-1:1:E.rel<g.rel?-1:E.rel>g.rel?1:0),{roots:a,observations:d,budget:m,counts:{dirsWalked:c,manifestsSeen:p,rootsAdmitted:a.length,dotDirectoriesSkipped:u}}}import{lstatSync as Fd,readdirSync as lg,readFileSync as dg,realpathSync as Kd,statSync as Ud}from"node:fs";import Ye from"node:path";var pn={envDir:".venv",maxDistributions:2e4,maxMetadataBytes:1e6,maxRecordBytes:32*1024*1024,maxTopLevelBytes:256*1024,maxDirectUrlBytes:64*1024,maxPyvenvCfgBytes:64*1024,maxEntryPointsBytes:256*1024,maxPthBytes:256*1024,maxPthPaths:1024},cg=/^python\d+\.\d+$/u;function Vn(e,n){let t;try{t=Ud(e)}catch(r){return{why:r?.code==="ENOENT"?"absent":"unreadable"}}if(!t.isFile())return{why:"not-regular"};if(t.size>n)return{why:"oversize"};try{return{text:dg(e,"utf8")}}catch{return{why:"unreadable"}}}function ti(e,n){let t;try{if(t=Kd(n),!Ud(t).isDirectory())return null}catch{return null}return t===e||t.startsWith(e+Ye.sep)?t:null}function jd(e,n){return Ye.relative(e,n).split(Ye.sep).join("/")}function Bd(e){try{return lg(e).sort()}catch{return null}}function ug(e){let n=[],t=[],r=0;for(let o of e.split(/\r?\n/u)){let s=o.trim();if(!(s===""||s.startsWith("#"))){if(/^import[ \t]/u.test(s)){r+=1;let i=/^import[ \t]+([A-Za-z_][A-Za-z0-9_.]*)/u.exec(s);i?.[1]!==void 0&&t.length<pn.maxPthPaths&&t.push(i[1]);continue}n.length<pn.maxPthPaths&&n.push(s)}}return{paths:n,importLines:r,importModules:t}}function fg(e){let n=null;for(let t of e.split(/\r?\n/u)){let r=/^\s*(version_info|version)\s*=\s*(\S+)\s*$/u.exec(t);if(r!==null){if(r[1]==="version_info")return r[2]??null;n??=r[2]??null}}return n}function ur(e,n){let t=n?.envDir??pn.envDir,r=n?.maxDistributions??pn.maxDistributions,o=n?.maxMetadataBytes??pn.maxMetadataBytes,s=n?.maxRecordBytes??pn.maxRecordBytes,i=n?.maxTopLevelBytes??pn.maxTopLevelBytes,a=n?.maxDirectUrlBytes??pn.maxDirectUrlBytes,d=pn.maxEntryPointsBytes,l=t,c=[],p=(v,_,P=null)=>({envRel:l,refused:v,sitePackages:[],interpreter:P,distInfos:[],pthFiles:[],unreadable:0,diagnostics:[...c,_],truncated:!1}),u;try{u=Kd(e)}catch{return p("absent","the root itself could not be resolved")}let m=Ye.join(u,t),h;try{h=Fd(m)}catch(v){return v?.code==="ENOENT"?p("absent",`${l}: absent`):p("not-a-directory",`${l}: could not be inspected`)}if(!h.isDirectory()&&!h.isSymbolicLink())return p("not-a-directory",`${l}: not a directory`);let x=ti(u,m);if(x===null)return p("escapes-root",`${l}: resolves outside the project root (a symlinked environment is not the project's); refused, never followed`);let y=Vn(Ye.join(x,"pyvenv.cfg"),pn.maxPyvenvCfgBytes),S="text"in y?fg(y.text):null;"text"in y||c.push(`${l}/pyvenv.cfg: ${y.why} \u2014 interpreter version unknown`);let k=[];for(let v of["lib","lib64"]){let _=Bd(Ye.join(x,v));if(_!==null)for(let P of _)cg.test(P)&&k.push(Ye.join(x,v,P,"site-packages"))}k.push(Ye.join(x,"Lib","site-packages"));let E=[],g=new Set;for(let v of k){let _=ti(x,v);_===null||g.has(_)||(g.add(_),E.push(_))}if(E.length===0)return p("no-site-packages",`${l}: no site-packages directory (lib/pythonX.Y/site-packages or Lib/site-packages)`,S);E.length>1&&c.push(`${l}: ${String(E.length)} site-packages directories; all enumerated`);let b=[],w=[],I=0,N=!1;e:for(let v of E){let _=jd(u,v),P=Bd(v);if(P===null){c.push(`${_}: unreadable; nothing enumerated there`);continue}for(let R of P){let L=Ye.join(v,R),O=R.endsWith(".dist-info"),F=R.endsWith(".egg-info");if(R.endsWith(".pth")){let H=Vn(L,pn.maxPthBytes);if(!("text"in H)){c.push(`${_}/${R}: ${H.why}; the paths it adds were NOT enumerated`);continue}w.push({name:R,sitePackages:_,...ug(H.text)});continue}if(!O&&!F)continue;if(b.length>=r){N=!0,c.push(`${_}: the distribution cap (${String(r)}) was hit at ${R}; the enumeration is INCOMPLETE`);break e}let K;try{K=Fd(L)}catch{I+=1,c.push(`${_}/${R}: could not be inspected; not enumerated`);continue}let ee=O?"dist-info":"egg-info";if(K.isFile()&&F){let H=Vn(L,o);"text"in H?b.push({dir:R,kind:ee,metadata:H.text,entryPointsUnknown:!0}):(I+=1,c.push(`${_}/${R}: ${H.why}; not enumerated`));continue}let U=ti(x,L);if(U===null){I+=1,c.push(`${_}/${R}: not a directory inside the environment; not enumerated`);continue}let J=O?"METADATA":"PKG-INFO",B=Vn(Ye.join(U,J),o);if(!("text"in B)){I+=1,c.push(`${_}/${R}: ${J} ${B.why}; not enumerated`);continue}let D={dir:R,kind:ee,metadata:B.text},Y=Vn(Ye.join(U,"entry_points.txt"),d);"text"in Y?D.entryPoints=Y.text:Y.why!=="absent"&&(D.entryPointsUnknown=!0,c.push(`${_}/${R}/entry_points.txt: ${Y.why}; the commands it declares are UNKNOWN`));let Z=Vn(Ye.join(U,"top_level.txt"),i);if("text"in Z?D.topLevel=Z.text:Z.why!=="absent"&&c.push(`${_}/${R}/top_level.txt: ${Z.why}; ignored`),O){let H=Vn(Ye.join(U,"RECORD"),s);"text"in H?D.record=H.text:c.push(`${_}/${R}/RECORD: ${H.why}; import names from top_level.txt only`);let ne=Vn(Ye.join(U,"direct_url.json"),a);"text"in ne&&(D.directUrl=ne.text)}b.push(D)}}return{envRel:l,refused:null,sitePackages:E.map(v=>jd(u,v)),interpreter:S,distInfos:b,pthFiles:w,unreadable:I,diagnostics:c,truncated:N}}var hg=["uv.lock","poetry.lock","Pipfile.lock","pdm.lock"];function gg(e,n){for(let t of n)try{if(pg(mg.join(e,t)).isFile())return t}catch{}return null}function zd(e){let n=[],t=[],r=(p,u)=>{t.push({kind:p,detail:u,blindsAnalysis:!1,rootRel:""}),n.push(u)},o=gg(e,hg),s=ur(e);if(s.refused!==null){let p=s.refused==="absent"?`no \`${s.envRel}\` is installed`:`\`${s.envRel}\` could not be read (${s.refused})`;return r("no-installed-env",`${o??"the Python manifest"} declares a dependency set but ${p}: ZERO distributions were enumerated, so this scan reports nothing about Python dependencies \u2014 it is not a clean bill of health. Install the environment (\`uv sync\`) and re-scan.`),{packages:[],source:"none",lockfilePath:o,diagnostics:[...n,...s.diagnostics],truncated:!1,gaps:t}}let i=[],a=new Set,d=[],l=0;for(let p of s.distInfos){let u=ar(p.metadata,{...p.topLevel!==void 0?{topLevelText:p.topLevel}:{},...p.record!==void 0?{recordText:p.record}:{},...p.directUrl!==void 0?{directUrlText:p.directUrl}:{}});if(u===null){l+=1,n.push(`${p.dir}: METADATA carries no Name/Version; not enumerated`);continue}let m=JSON.stringify([u.name,u.version]);a.has(m)||(a.add(m),u.importNames.length===0&&d.push(u.name),i.push({name:u.name,version:u.version,lockKey:"",dev:!1,declaredIn:"",ecosystem:"PyPI"}))}n.push(...s.diagnostics);let c=s.unreadable+l;return c>0&&r("installed-env-partial",`${String(c)} entr${c===1?"y":"ies"} under ${s.sitePackages.join(", ")} could not be read as a distribution (see the diagnostics): those distributions are MISSING from this scan; the ${String(i.length)} enumerated were assessed normally.`),s.truncated&&r("installed-env-partial",`the environment walk under ${s.sitePackages.join(", ")} hit its distribution cap: the enumeration is INCOMPLETE, and a partial (possibly false-clean) set is never reported.`),d.length>0&&n.push(`${String(d.length)} distribution(s) carry no import name (distribution-unmapped, Tier-B): ${d.slice(0,5).join(", ")}${d.length>5?", \u2026":""} \u2014 advisories on them are enumerated; their modules cannot be resolved (ADR-109 D5)`),{packages:i,source:i.length>0?"installed-env":"none",lockfilePath:o,diagnostics:n,truncated:s.truncated,gaps:t}}var si=128*1024*1024,yg=[{file:"package-lock.json",source:"npm-lockfile",parse:(e,n)=>ao(e,n===void 0?{}:{maxEntries:n})},{file:"npm-shrinkwrap.json",source:"npm-lockfile",parse:(e,n)=>ao(e,n===void 0?{}:{maxEntries:n})},{file:"yarn.lock",source:"yarn-lockfile",parse:(e,n)=>Fs(e,n===void 0?{}:{maxEntries:n})},{file:"pnpm-lock.yaml",source:"pnpm-lockfile",parse:(e,n)=>Ks(e,n===void 0?{}:{maxEntries:n})}],xg=[".pnp.cjs",".pnp.data.json",".pnp.js"];function ii(e,n){let t;try{t=oi(mn.join(e,n))}catch{return null}let r=e.endsWith(mn.sep)?e:e+mn.sep;return t.startsWith(r)?t:null}function Wd(e,n){let t=mn.join(e,"package.json"),r;try{r=oi(t)}catch{return null}if(!r.startsWith(n+mn.sep))return null;try{if(!fr(r).isFile())return null;let o=JSON.parse(ri(r,"utf8"));return typeof o.name!="string"||typeof o.version!="string"?null:{name:o.name,version:o.version}}catch{return null}}function qd(e,n){try{return fr(mn.join(e,n)),!0}catch{return!1}}function Sg(e,n){if(qd(e,"pnpm-workspace.yaml"))return!0;let t=ii(e,"package.json");if(t===null)return qd(e,"package.json");let r;try{let i=fr(t);if(!i.isFile()||i.size>n)return!0;r=ri(t,"utf8")}catch{return!0}let o;try{o=JSON.parse(r)}catch{return!0}for(let i of["dependencies","devDependencies","optionalDependencies","peerDependencies"]){let a=o[i];if(typeof a=="object"&&a!==null&&Object.keys(a).length>0)return!0}let s=o.workspaces;return Array.isArray(s)?s.length>0:typeof s=="object"&&s!==null}function Vd(e,n){let t=mn.join(e,"node_modules"),r=[],o;try{o=Gd(t,{withFileTypes:!0})}catch{return r}for(let s of o){let i=s.name;if(i.startsWith("."))continue;if(i.startsWith("@")){let d;try{d=Gd(mn.join(t,i),{withFileTypes:!0})}catch{continue}for(let l of d){let c=Wd(mn.join(t,i,l.name),n);c!==null&&r.push({dev:!1,name:c.name,version:c.version,lockKey:`node_modules/${i}/${l.name}`,linked:l.isSymbolicLink()||s.isSymbolicLink()})}continue}let a=Wd(mn.join(t,i),n);a!==null&&r.push({dev:!1,name:a.name,version:a.version,lockKey:`node_modules/${i}`,linked:s.isSymbolicLink()})}return r}var bg=5;function kg(e,n,t){let r=ii(e,n);if(r===null){try{fr(mn.join(e,n))}catch{return null}return{gap:`${n} resolves outside the scan root (symlink); refused, not read`}}let o;try{o=fr(r)}catch{return null}if(!o.isFile())return{gap:`${n} is not a regular file; refused, not read`};if(o.size>t)return{gap:`${n} is ${String(o.size)} bytes (> ${String(t)}); skipped before reading to avoid a memory DoS`};try{return{text:ri(r,"utf8")}}catch{return{gap:`${n} could not be read`}}}function wg(e,n){let t=oi(e),r=[],o=[],s=n?.maxLockfileBytes??si,i=[],a=new Set,d=[],l=Sg(t,s),c=null,p=!1,u=(h,x,y)=>{o.push({kind:h,detail:x,blindsAnalysis:y,rootRel:""}),r.push(x)};for(let h of yg){let x=kg(t,h.file,s);if(x===null)continue;if("gap"in x){u("lockfile-unreadable",x.gap,!1);continue}let y=h.parse(x.text,n?.maxLockfileEntries);if(y.truncated&&(p=!0),y.deps.length===0){if(y.diagnostics.length>0||l){let S=y.diagnostics.length>0?y.diagnostics.join("; "):"no entries found";u("lockfile-unparsed",`${h.file} yielded NO dependencies (${S}); its transitive dependency set was not enumerated`,!1)}continue}y.diagnostics.length>0&&u("lockfile-partial",`${h.file} was only partly enumerated (${y.diagnostics.join("; ")})`,!1),c===null&&(c=h.file),d.includes(h.source)||d.push(h.source);for(let S of y.deps){let k=JSON.stringify([S.name,S.version,S.lockKey]);a.has(k)||(a.add(k),i.push({...S,declaredIn:h.file}))}}for(let h of xg)if(ii(t,h)!==null){u("yarn-pnp",`${h} present: this project uses Yarn Plug'n'Play, whose dependency code lives in zips cupel does not resolve or read \u2014 NO dependency code was analyzed, so no finding here can be read as not-reachable. Set \`nodeLinker: node-modules\` for a full scan.`,!0);break}if(i.length>0){let h=d.length===1?d[0]??"none":"multi-lockfile";d.length>1&&r.push(`multiple lockfiles present (${d.join(", ")}); enumerated the UNION of all of them`);let x=new Set(i.map(k=>JSON.stringify([k.name,k.version]))),y=new Set,S=[];for(let k of Vd(t,t)){let E=JSON.stringify([k.name,k.version,k.lockKey]);a.has(E)||(a.add(E),i.push({name:k.name,version:k.version,lockKey:k.lockKey,dev:k.dev,declaredIn:""}));let g=JSON.stringify([k.name,k.version]);k.linked||x.has(g)||y.has(g)||(y.add(g),S.length<bg&&S.push(sr(k.name,k.version)))}if(y.size>0){let k=y.size-S.length;u("lockfile-skew",`node_modules holds ${String(y.size)} package(s) at a (name, version) no lockfile lists (${S.join(", ")}${k>0?`, and ${String(k)} more`:""}): ${c??"the lockfile"} and the installed tree DISAGREE, so cupel enumerated BOTH. A stale lockfile or an \`npm i --no-save\` is the usual cause \u2014 re-install and commit the lockfile so the reviewed set is the installed set.`,!1)}return{packages:i,source:h,lockfilePath:c,diagnostics:r,truncated:p,gaps:o}}let m=Vd(t,t);return m.length>0?(u("shallow-node-modules",`no usable lockfile (package-lock.json / npm-shrinkwrap.json / yarn.lock / pnpm-lock.yaml), so the installed set came from a SHALLOW node_modules scan: ${String(m.length)} top-level package(s), with every transitive dependency missing. Commit a lockfile for a complete scan.`,!1),{packages:m.map(h=>({name:h.name,version:h.version,lockKey:h.lockKey,dev:!1,declaredIn:""})),source:"node-modules",lockfilePath:null,diagnostics:r,truncated:p,gaps:o}):(l&&u("no-enumeration","package.json declares dependencies but there is no lockfile and no readable node_modules: ZERO packages were enumerated, so this scan reports nothing about dependencies \u2014 it is not a clean bill of health. Install the project (or commit a lockfile) and re-scan.",!1),{packages:[],source:"none",lockfilePath:null,diagnostics:r,truncated:p,gaps:o})}function Eg(e){return e.rel===""||e.witnesses.includes("own-lockfile")||e.witnesses.includes("operator")||e.witnesses.includes("installed-env")||e.manifestRefused}function vg(e){if(e.length===0||e==="."||e==="..")return!1;for(let n=0;n<e.length;n+=1){let t=e.charCodeAt(n);if(t<32||t===127||t>=128&&t<=159||t===92)return!1}return!0}function Xd(e){return e===""||e.split("/").every(vg)}function _g(e,n){if(e===""||n==="")return n;if(!Xd(e))return"";let t=`${e}/${n}`;return t.length<=io?t:""}function Hd(e,n){return e===""?n:`${e}: ${n}`}function Ig(e){return{rel:"",abs:e,witnesses:["scan-root"],manifestRefused:!1}}function Yd(e,n,t){let r=t?.maxUnionEntries??so,o=n.roots.filter(Eg),s=o.some(h=>h.rel==="")?o:[Ig(e),...o],i=[],a=[],d=new Set,l=[],c=[],p=!1,u=!1;for(let h of s){let x=h.rel===""?e:h.abs,y=wg(x,t),S=cr(h)?zd(x):null,k=S===null?y:Rg(y,S),E=k.diagnostics.map(b=>Hd(h.rel,b));!Xd(h.rel)&&k.packages.length>0&&E.push(`${h.rel}: its path holds a segment no install key may be built from, so the install location of its ${String(k.packages.length)} row(s) is refused \u2014 dependency-class evidence and execution context for them read fail-closed (ADR-071)`);let g={...k,rootRel:h.rel,...h.ecosystem!==void 0?{ecosystem:h.ecosystem}:{},...S!==null?{pythonLockfilePath:S.lockfilePath===null||h.rel===""?S.lockfilePath:`${h.rel}/${S.lockfilePath}`}:{},packages:k.packages.map(b=>({...b,lockKey:_g(h.rel,b.lockKey),declaredIn:b.declaredIn===""||h.rel===""?b.declaredIn:`${h.rel}/${b.declaredIn}`})),lockfilePath:k.lockfilePath===null||h.rel===""?k.lockfilePath:`${h.rel}/${k.lockfilePath}`,gaps:k.gaps.map(b=>({...b,rootRel:h.rel,detail:Hd(h.rel,b.detail)})),diagnostics:E};i.push(g),k.truncated&&(p=!0);for(let b of g.packages){let w=JSON.stringify([b.name,b.version,b.lockKey]);if(!d.has(w)){if(a.length>=r){u=!0;break}d.add(w),a.push(b)}}l.push(...g.gaps),c.push(...g.diagnostics)}u&&(p=!0,c.push(`the union of installed sets across ${String(s.length)} roots exceeds its ceiling of ${String(r)} distinct rows; truncated \u2014 a partial enumeration is never reported (ADR-071)`));let m=i[0];if(m===void 0)throw new Error("unreachable: the scan root is always enumerated");return{packages:a,source:m.source,lockfilePath:m.lockfilePath,diagnostics:c,truncated:p,gaps:l,perRoot:i}}function Ag(e,n){let t;for(let r of e.perRoot){if(r.rootRel===""){t??=r;continue}n.startsWith(`${r.rootRel}/`)&&(t===void 0||r.rootRel.length>t.rootRel.length)&&(t=r)}return t}function ho(e,n){return n.declaredIn!==""?n.declaredIn:Ag(e,n.lockKey)?.lockfilePath??null}function Jd(e,n){let t=e.perRoot.find(r=>r.rootRel===n.rootRel);return Ng.has(n.kind)?t?.pythonLockfilePath!==void 0&&t.pythonLockfilePath!==null?t.pythonLockfilePath:n.rootRel===""?null:`${n.rootRel}/pyproject.toml`:t?.lockfilePath!==void 0&&t.lockfilePath!==null?t.lockfilePath:n.rootRel===""?null:`${n.rootRel}/${t?.ecosystem==="PyPI"?"pyproject.toml":"package.json"}`}var Ng=new Set(["no-installed-env","installed-env-partial"]);function Rg(e,n){return{packages:[...e.packages,...n.packages],source:e.packages.length===0&&n.packages.length>0?n.source:e.source,lockfilePath:e.lockfilePath??n.lockfilePath,diagnostics:[...e.diagnostics,...n.diagnostics],truncated:e.truncated||n.truncated,gaps:[...e.gaps,...n.gaps]}}function Zd(e){let n=new Map;for(let t of e){let r=n.get(t.name)??new Set;r.add(t.version),n.set(t.name,r)}return t=>{let r=n.get(t);if(r===void 0)return;let o=[...r].sort();return o.length===1?o[0]:o}}function pr(e){return new Set(e.map(n=>n.root))}function Mt(e,n){let t=pr(n);return e.roots.filter(r=>!t.has(r.rel)&&(r.rel===""||r.ecosystem!=="PyPI"))}function ai(e){let n=e.slice(0,8),t=e.length-n.length;return n.join(", ")+(t>0?`, \u2026 and ${String(t)} more`:"")}function li(e,n){return Mt(e,n).map(t=>({code:"unanalyzed-project-root",path:t.rel===""?".":t.rel,detail:t.rel===""?`the scan root declares no JavaScript entrypoint of its own (${t.witnesses.join(" + ")}) \u2014 its JavaScript, if any, was not analyzed while a nested root's was; pass \`--entry <file>\` or declare \`main\`, else every npm \`not-reachable\` is capped at \`unknown\` (ADR-071)`:`\`${t.rel}\` is a project root (${t.witnesses.join(" + ")}${t.manifestRefused?", manifest refused":""}) whose JavaScript this scan did not analyze; code there can load any installed npm package, so every npm \`not-reachable\` is capped at \`unknown\` until it is analyzed (ADR-071)`}))}function Qd(e){let n=[],t=e.observations.filter(r=>r.kind==="unenumerated-install").map(r=>r.rel);if(t.length>0&&n.push({kind:"unenumerated-install",detail:`${String(t.length)} node_modules director${t.length===1?"y":"ies"} under no admitted project root (${ai(t)}) were not enumerated: packages installed there are MISSING from this scan. The enumerated ones were analyzed normally (ADR-071)`,blindsAnalysis:!1,rootRel:""}),e.budget!=="complete"){let r=e.counts;n.push({kind:"root-discovery-truncated",detail:`root discovery did not finish (${e.budget}: ${String(r.dirsWalked)} dirs walked, ${String(r.rootsAdmitted)} roots admitted) \u2014 a project root with its own install location may have been missed, so every \`not-reachable\` is capped at \`unknown\` (ADR-071 Invariant C)`,blindsAnalysis:!0,rootRel:""})}return n}function ec(e){let n=new Set;for(let t of e)t.blindsAnalysis&&n.add(t.kind==="root-discovery-truncated"?"analysis-cap":"resolution-divergence");return[...n]}import{statSync as yy}from"node:fs";import ht from"node:path";import{spawnSync as ly}from"node:child_process";function mr(e){{let n=G[e];if(n===void 0)throw new Error(`the bundle does not embed ${e}; this is a cupel build defect`);return["-c",n]}}import{readdirSync as Pg,realpathSync as nc,statSync as tc}from"node:fs";import Fn from"node:path";var rc=32,Og=512,$g=/^[A-Za-z_][A-Za-z0-9_]*$/u,Cg=[".so",".pyd",".dylib"],go=e=>({resolved:e,failure:null}),Tt=e=>({resolved:null,failure:e});function Mg(e){if(e.length===0||e.length>Og)return null;let n=e.split(".");return n.length>rc?null:n.every(t=>$g.test(t))?n:null}function di(e){try{return tc(e).isDirectory()}catch{return!1}}function Dt(e){try{return tc(e).isFile()}catch{return!1}}function hr(e,n){let t,r;try{t=nc(n),r=nc(e)}catch{return null}return t===r||t.startsWith(r+Fn.sep)?t:null}function Tg(e,n){let t;try{t=Pg(e)}catch{return null}for(let r of t)if(r.startsWith(`${n}.`)&&Cg.some(o=>r.endsWith(o))&&Dt(Fn.join(e,r)))return Fn.join(e,r);return null}function Hn(e,n){let t=Mg(n);if(t===null)return Tt("refused");let r=null,o=!1;for(let[s,i]of e.roots.entries()){let a=i,d=!1;for(let x of t.slice(0,-1)){let y=Fn.join(a,x);if(Dt(Fn.join(y,"__init__.py"))||di(y)){if(!di(y)){d=!0;break}a=y;continue}d=!0,Dt(`${y}.py`)&&(o=!0);break}if(d)continue;let l=t[t.length-1];if(l===void 0)return Tt("refused");let c=Fn.join(a,l,"__init__.py");if(Dt(c)){let x=hr(i,c);return x===null?Tt("escapes-root"):go({module:n,kind:"package",path:x,rootIndex:s})}let p=Fn.join(a,`${l}.py`);if(Dt(p)){let x=hr(i,p);return x===null?Tt("escapes-root"):go({module:n,kind:"module",path:x,rootIndex:s})}let u=Tg(a,l);if(u!==null){let x=hr(i,u);return x===null?Tt("escapes-root"):go({module:n,kind:"extension",path:x,rootIndex:s})}let m=Fn.join(a,l);if(r===null&&di(m)){let x=hr(i,m);x!==null&&(r={module:n,kind:"namespace",path:x,rootIndex:s});continue}let h=Fn.join(a,`${l}.pyi`);if(r===null&&Dt(h)){let x=hr(i,h);x!==null&&(r={module:n,kind:"stub-only",path:x,rootIndex:s})}}return r!==null?go(r):Tt(o?"not-a-package":"not-found")}function oc(e,n){if(n)return e;let t=e.lastIndexOf(".");return t===-1?"":e.slice(0,t)}function yo(e,n,t,r){if(t<1||t>rc)return{failure:"refused"};let o=oc(e,n),s=o===""?[]:o.split("."),i=t-1;if(i>s.length)return{failure:"beyond-top-level"};let a=s.slice(0,s.length-i),d=r===null||r===""?[]:r.split("."),l=[...a,...d].join(".");return l===""?{failure:"beyond-top-level"}:{dotted:l}}var ci="<toplevel>";var Dg=new Set(["self","cls"]),Lg=8;function ic(e,n){return{path:e,start:n.start,end:n.end}}function sc(e,n){return n!==null?n.includes(e):!e.startsWith("_")}function fi(e,n,t,r){let o=[],s=[],i=[],a=[],d=new Map,l=new Map,c=new Map,p=new Map,u=new Map,m=`${n}#${ci}`;o.push({id:m,moduleId:n,name:ci,kind:"function",declRange:{path:t,start:0,end:0},isExported:!1,publicSurfaceReachable:!1});for(let x of e.classes){let y=`${n}#class:${x.qualname}`;c.set(x.qualname,y),u.set(x.qualname,x.bases.filter(S=>S!==null)),s.push({id:y,moduleId:n,name:x.name,implementsRefs:[],members:[]})}for(let x of e.functions){let y=`${n}#${x.qualname}`;d.set(x.qualname,y);let S=x.enclosingClass,k=S===null?void 0:c.get(S),E=S===null&&x.enclosingFunction===null,g=E?sc(x.name,e.all):S!==null&&!S.includes(".")?sc(S,e.all):!1;if(o.push({id:y,moduleId:n,name:x.name,kind:k!==void 0?x.name==="__init__"?"ctor":"method":"function",...k!==void 0?{enclosingClassId:k}:{},declRange:ic(t,x.range),isExported:g,publicSurfaceReachable:g}),E&&(l.set(x.name,y),g)){let b=r();i.push({id:b,moduleId:n,exportedName:x.name,kind:"value"}),a.push({exportId:b,target:{kind:"function",functionId:y}})}if(S!==null){let b=p.get(S)??new Map;b.set(x.name,y),p.set(S,b)}}let h=s.map(x=>{let y=[...c.entries()].find(([,k])=>k===x.id)?.[0],S=y===void 0?void 0:p.get(y);return S===void 0?x:{...x,members:[...S.values()]}});return{moduleId:n,functions:o,classes:h,exports:i,exportBindings:a,byQualname:d,topLevel:l,classByName:c,methods:p,baseNames:u,toplevelId:m}}function pi(e){let{decls:n,envs:t}=e,r=[],o=new Map;for(let[u,m]of n){let h=t.get(u);for(let[x,y]of m.baseNames){let S=m.classByName.get(x);if(S!==void 0)for(let k of y){let E=Fg(k,m,h,n);if(E===void 0)continue;r.push({subclassId:S,superclassId:E,relation:"extends"});let g=o.get(E)??[];g.push(S),o.set(E,g)}}}let s=new Map,i=(u,m)=>{let h=s.get(u)??[];h.includes(m)||h.push(m),s.set(u,h)};for(let u of n.values())for(let m of u.methods.values())for(let[h,x]of m)i(h,x);for(let u of e.rebinds??[]){let m=n.get(u.moduleId)?.topLevel.get(u.target);m!==void 0&&i(u.attr,m)}let a=new Map;for(let u of n.values())for(let m of u.classByName.values())a.set(m,u);let d=[],l=[],c=0,p=0;for(let{moduleId:u,path:m,call:h}of e.pending){let x=n.get(u);if(x===void 0)continue;let y=h.enclosingFunction===null?x.toplevelId:x.byQualname.get(h.enclosingFunction)??x.toplevelId,S=jg(h,u,x,t.get(u),n,t,{byMethodName:s,subclassesOf:o,classOwner:a}),k=`py-call:${u}:${String(c)}`;c+=1,S.resolution==="unresolved"&&(p+=1),d.push({id:k,enclosingFunctionId:y,calleeExprShape:h.receiver===null?"identifier":"member",resolvedTargetIds:S.ids,resolution:S.resolution,range:ic(m,h.range)});for(let E of S.ids)l.push({callSiteId:k,calleeFunctionId:E,resolution:S.resolution})}return{callSites:d,callEdges:l,inheritEdges:r,unresolved:p}}function ui(e,n,t,r,o=new Set,s=0){if(s>Lg)return;let i=`${e}${n}`;if(o.has(i))return;o.add(i);let a=t.get(e)?.topLevel.get(n);if(a!==void 0)return a;let d=r.get(e)?.names.get(n);if(d!==void 0)return ui(d.moduleId,d.name,t,r,o,s+1)}function Fg(e,n,t,r){let o=n.classByName.get(e);if(o!==void 0)return o;let s=t?.names.get(e);if(s!==void 0)return r.get(s.moduleId)?.classByName.get(s.name)}var Lt={ids:[],resolution:"unresolved"};function jg(e,n,t,r,o,s,i){if(e.callee===null)return Lt;if(e.receiver===null){let c=t.topLevel.get(e.callee);if(c!==void 0)return{ids:[c],resolution:"resolved"};let p=r?.names.get(e.callee);if(p!==void 0){let u=ui(p.moduleId,p.name,o,s);if(u!==void 0)return{ids:[u],resolution:"resolved"}}return Lt}let a=e.attr;if(a===null)return Lt;if(Dg.has(e.receiver)&&e.enclosingFunction!==null){let c=e.enclosingFunction.split(".").slice(0,-1).join("."),p=t.classByName.get(c);if(p!==void 0){let u=Bg(p,a,i);return u.length===1?{ids:u,resolution:"resolved"}:u.length>1?{ids:u,resolution:"field-based"}:Lt}}let d=r?.modules.get(e.receiver);if(d!==void 0){let c=ui(d,a,o,s);return c!==void 0?{ids:[c],resolution:"resolved"}:Lt}let l=i.byMethodName.get(a)??[];return l.length===0||l.length>64?Lt:{ids:l,resolution:"field-based"}}function Bg(e,n,t){let r=[],o=new Set,s=[e];for(;s.length>0;){let i=s.shift();if(i===void 0||o.has(i))continue;o.add(i);let a=t.classOwner.get(i);if(a!==void 0){let d=[...a.classByName.entries()].find(([,c])=>c===i)?.[0],l=d===void 0?void 0:a.methods.get(d)?.get(n);l!==void 0&&!r.includes(l)&&r.push(l)}for(let d of t.subclassesOf.get(i)??[])s.push(d)}return r}var Kg=5e3,ac=200,lc=100,dc={modules:[],exports:[],imports:[],functions:[],callSites:[],classes:[],callEdges:[],importEdges:[],exportBindings:[],inheritEdges:[]};function uc(e){return`pkg:${e}`}function _n(e){return e.split(/[\\/]+/u).join("/")}function cc(e,n){let t=e.endsWith("/")?e:`${e}/`,r=_n(n),o=_n(t);return r.startsWith(o)?r.slice(o.length):null}function fc(e){let n=_n(e).split("/"),t=n[n.length-1]??"";if(t==="__init__.py")return{dotted:n.slice(0,-1).join("."),isPackage:!0};let r=t.endsWith(".py")?t.slice(0,-3):t;return{dotted:[...n.slice(0,-1),r].filter(o=>o!=="").join("."),isPackage:!1}}function mi(e){return e.split(".")[0]??e}var Ug="site-packages:";function hi(e){let n=e.extract??xo,t=e.maxModules??Kg,r=(e.externalRoots??[]).map(D=>_n(D).endsWith("/")?_n(D):`${_n(D)}/`),o=D=>{let Y=_n(D);return r.find(Z=>Y.startsWith(Z))??null},s=D=>o(D)!==null,i=[],a=new Map,d=[],l=[],c=new Set,p=new Set,u=new Map,m=new Map,h=[],x=new Map,y=[],S=0,k=()=>{let D=`py-export:${String(S)}`;return S+=1,D},E=null,g=!1,b=new Set,w=[];for(let D of e.entryFiles){let Y=cc(e.projectRoot,D);if(Y===null){i.push({code:"unresolved-import",where:_n(D),detail:"entrypoint lies outside the project root; not analyzed"});continue}c.has(D)||(c.add(D),w.push({file:D,rel:Y,isEntry:!0,packageName:"",modulePath:Y}))}let I=D=>{let Y=uc(D);return a.has(Y)||(p.add(D),a.set(Y,{id:Y,packageName:D,versionRange:"",path:D,moduleSystem:"dual",isEntrypoint:!1,externalSurface:!0})),Y},N=0,v=(D,Y,Z,H)=>{let ne=`py-import:${String(N)}`;N+=1,d.push({id:ne,moduleId:D,specifier:Y,...Z!==null?{resolvedModuleId:Z}:{},isNamespace:!1,isDefault:!1,dynamic:H,specifierIsLiteral:!0}),Z!==null&&l.push({importId:ne,resolvedModuleId:Z})};for(let D=0;D<lc&&w.length>0;D+=1){let Y=w.slice(0,ac);w=w.slice(ac);let Z=n(Y.map(ne=>ne.file),e.python!==void 0?{python:e.python}:{});if(E??=Z.interpreter,b.size===0&&Z.stdlib.length>0&&(b=new Set(Z.stdlib)),Z.refused!==null)return i.push({code:"extract-refused",where:"",detail:`${Z.refused}: ${Z.diagnostics.join("; ")}`}),{graph:dc,diagnostics:i,interpreter:Z.interpreter,counts:{modules:0,surfaces:0}};let H=new Map(Z.files.map(ne=>[ne.path,ne]));for(let ne of Y){let se=H.get(ne.file),oe=ne.rel,M=fc(ne.modulePath);if(a.set(oe,{id:oe,packageName:ne.packageName,versionRange:"",path:ne.modulePath,moduleSystem:"dual",isEntrypoint:ne.isEntry}),se===void 0||se.refused!==null){i.push({code:"file-refused",where:ne.rel,detail:se?.refused??"no row was returned for this file"});continue}_(se,oe,M),F(se,ne.rel),u.set(oe,fi(se,oe,ne.rel,k)),m.set(oe,O(se,oe,M));for(let Q of se.calls)h.push({moduleId:oe,path:ne.rel,call:Q});for(let Q of se.escapes){if(Q.kind!=="attr-rebind")continue;let re=Q.attr??null;re===null||Q.target===null||y.push({moduleId:oe,attr:re,target:Q.target})}}}function _(D,Y,Z){for(let H of D.imports){if(H.guards.includes("type-checking"))continue;let ne=[];if(H.level>0){let oe=yo(Z.dotted,Z.isPackage,H.level,H.module);if("failure"in oe){i.push({code:"unresolved-import",where:D.path,detail:`relative import (level ${String(H.level)}) ${oe.failure}`});continue}ne.push(oe.dotted);for(let M of H.names)ne.push(`${oe.dotted}.${M.name}`)}else if(H.module!==null){ne.push(H.module);for(let oe of H.names)ne.push(`${H.module}.${oe.name}`)}else continue;let se=!1;for(let oe of ne)P(oe,Y,H.deferred)&&(se=!0);if(!se){let oe=ne[0]??"";v(Y,oe,null,H.deferred);let M=mi(oe);if(b.has(M)||H.guards.includes("optional")||(e.environmentComplete??!1)&&e.distributionOf(M)===null)continue;i.push({code:"unresolved-import",where:D.path,detail:`\`${oe}\` did not resolve on the search path`})}}}function P(D,Y,Z){let H=D.split("."),ne=!1;for(let se=1;se<=H.length;se+=1){let oe=H.slice(0,se).join("."),M=Hn(e.paths,oe);M.resolved!==null&&(L(M.resolved,Y,oe,Z),se===H.length&&(ne=!0))}return ne}function R(D){return c.has(D.file)||a.has(D.rel)?!0:c.size>=t?(g||(g=!0,i.push({code:"module-cap",where:D.rel,detail:`the analyzed-module ceiling (${String(t)}) was hit; the graph is INCOMPLETE`})),!1):(c.add(D.file),w.push(D),!0)}function L(D,Y,Z,H){if(D.kind==="stub-only")return;let ne=D.kind==="module"||D.kind==="package",se=cc(e.projectRoot,D.path);if(se!==null&&!s(D.path)&&ne){let re=se;v(Y,Z,re,H),x.set(Z,re),R({file:D.path,rel:se,isEntry:!1,packageName:"",modulePath:se});return}let oe=e.distributionOf(mi(Z));if(oe===null){v(Y,Z,null,H),i.push({code:"unresolved-import",where:Z,detail:`resolved to ${D.kind} outside the project, but no installed distribution provides \`${mi(Z)}\``});return}let M=o(D.path);if(!ne||M===null){v(Y,Z,I(oe),H);return}let Q=`${Ug}${_n(D.path).slice(M.length)}`;v(Y,Z,Q,H),x.set(Z,Q),R({file:D.path,rel:Q,isEntry:!1,packageName:oe,modulePath:_n(D.path).slice(M.length)})}function O(D,Y,Z){let H=new Map,ne=new Map;for(let se of D.imports){if(se.guards.includes("type-checking"))continue;let oe=se.module;if(se.level>0){let M=yo(Z.dotted,Z.isPackage,se.level,se.module);if("failure"in M)continue;oe=M.dotted}if(oe!==null){if(se.form==="import"){let M=se.names[0]?.asname??null;if(M!==null){let de=x.get(oe);de!==void 0&&H.set(M,de);continue}let Q=oe.split(".")[0]??oe,re=x.get(Q)??x.get(oe);re!==void 0&&H.set(Q,re);continue}for(let M of se.names){let Q=M.asname??M.name,re=x.get(`${oe}.${M.name}`);if(re!==void 0){H.set(Q,re);continue}let de=x.get(oe);de!==void 0&&ne.set(Q,{moduleId:de,name:M.name})}}}return H.set("",Y),{modules:H,names:ne}}function F(D,Y){for(let Z of D.escapes)switch(Z.kind){case"loader-escape":i.push({code:"loader-escape",where:Y,detail:`${Z.callee} loads a module this analysis cannot name`});break;case"pkgutil-scan":case"runpy":case"entry-point-load":i.push({code:"dynamic-load-set",where:Y,detail:`${Z.callee} loads a set of modules the syntax does not name`});break;case"sys-modules":i.push({code:"module-registry-write",where:Y,detail:`${Z.callee} rewrites the module registry at run time`});break;case"import-module-literal":{let H=Z.target;if(H===null)break;P(H,Y,!0);break}case"dispatch-escape":break}}w.length>0&&i.push({code:"module-cap",where:"",detail:`the walk did not finish within ${String(lc)} waves; the graph is INCOMPLETE`});let K=pi({decls:u,envs:m,pending:h,rebinds:y}),ee=[...u.values()].flatMap(D=>D.functions),U=[...u.values()].flatMap(D=>D.classes),J=[...u.values()].flatMap(D=>D.exports),B=[...u.values()].flatMap(D=>D.exportBindings);return{graph:{...dc,modules:[...a.values()],imports:d,importEdges:l,functions:ee,classes:U,exports:J,exportBindings:B,callSites:K.callSites,callEdges:K.callEdges,inheritEdges:K.inheritEdges},diagnostics:i,interpreter:E,counts:{modules:a.size-p.size,surfaces:p.size}}}import{readdirSync as zg,readFileSync as mc,statSync as So}from"node:fs";import qe from"node:path";import{spawnSync as Gg}from"node:child_process";var Wg="python3",qg=256*1024,Vg=8*1024*1024,hc=/^([A-Za-z_][A-Za-z0-9_.]*)(?::([A-Za-z_][A-Za-z0-9_.]*))?$/u,Hg=/(?:^|\s)([A-Za-z_][A-Za-z0-9_.]*:[A-Za-z_][A-Za-z0-9_.]*)(?:\s|$)/u;function Xn(e){try{return So(e).isFile()}catch{return!1}}function pc(e){try{return So(e).isDirectory()}catch{return!1}}function Xg(e,n){return qe.relative(e,n).split(qe.sep).join("/")}function Yg(e){let n=e.python??process.env.CUPEL_PYTHON??Wg,t=Gg(n,["-I","-S",...mr("metadata.py"),e.projectRoot],{encoding:"utf8",maxBuffer:Vg,timeout:6e4}),r=d=>({entries:[],projectName:null,gaps:[{source:"metadata",declaration:"pyproject.toml / setup.cfg",detail:d}]});if(t.error!==void 0||t.status!==0)return r("the declared entry surface could not be read; it is unknown, not empty");let o;try{o=JSON.parse(t.stdout)}catch{return r("the declared entry surface came back unreadable; it is unknown, not empty")}if(typeof o!="object"||o===null)return{entries:[],projectName:null,gaps:[]};let s=o,i=(Array.isArray(s.entryPoints)?s.entryPoints:[]).filter(d=>typeof d=="object"&&d!==null&&typeof d.name=="string"&&typeof d.target=="string"&&typeof d.kind=="string"),a=(Array.isArray(s.gaps)?s.gaps:[]).flatMap(d=>{if(typeof d!="object"||d===null)return[];let l=d,c=typeof l.file=="string"?l.file:"",p=typeof l.why=="string"?l.why:"";return[{source:"metadata",declaration:c,detail:p==="executable-metadata-not-read"?"setup.py declares this project's entry points and is a PROGRAM: cupel never runs it, so the declared surface is INCOMPLETE":p}]});return{entries:i,gaps:a,projectName:typeof s.projectName=="string"?s.projectName:null}}function gi(e,n){let t=hc.exec(n.trim());if(t===null)return{detail:`\`${n}\` is not a module:attr target`};let r=t[1]??"",o=Hn(e.paths,r);if(o.resolved===null)return{detail:`\`${r}\` ${o.failure??"did not resolve"}`};if(o.resolved.kind==="namespace"||o.resolved.kind==="stub-only")return{detail:`\`${r}\` resolved to a ${o.resolved.kind}, which runs no code`};let s=Xg(e.projectRoot,o.resolved.path);return s.startsWith("..")?{detail:`\`${r}\` resolves outside the project root; not seeded`}:{file:s}}function Jg(e){let n=[];Xn(qe.join(e,"__main__.py"))&&n.push("__main__.py");let t=(r,o)=>{let s;try{s=zg(r).sort()}catch{return}for(let i of s){if(i.startsWith("."))continue;let a=qe.join(r,i);pc(a)&&Xn(qe.join(a,"__init__.py"))&&Xn(qe.join(a,"__main__.py"))&&n.push(`${o}${i}/__main__.py`)}};return t(e,""),pc(qe.join(e,"src"))&&t(qe.join(e,"src"),"src/"),n}function Zg(e,n){let t=qe.join(e,"Procfile");if(!Xn(t))return[];let r;try{if(So(t).size>n)return[];r=mc(t,"utf8")}catch{return[]}let o=[];for(let s of r.split(/\r?\n/u)){let i=Hg.exec(s);i?.[1]!==void 0&&o.push(i[1])}return o}var Qg=256*1024,ey=/^\s*(?:CMD|ENTRYPOINT)\s+(.*)$/imu,ny=/^\s*WORKDIR\s+(\S+)\s*$/imu,ty=/^\s*COPY\s+(?:--\S+\s+)*(\S+)\s+(\S+)\s*$/imu,ry=/(?:^|[\s"',[])([A-Za-z_][A-Za-z0-9_.]*:[A-Za-z_][A-Za-z0-9_.]*)(?:[\s"',\]]|$)/u,oy=/(?:^|[\s"',[])((?:[A-Za-z0-9_.-]+\/)*[A-Za-z0-9_-]+\.py)(?:[\s"',\]]|$)/u;function sy(e){let n=ny.exec(e)?.[1]?.replace(/\/+$/u,"")??null;if(n===null)return null;for(let t of e.split(/\r?\n/u)){let r=ty.exec(t),o=r?.[1],s=r?.[2]?.replace(/\/+$/u,"");if(o===void 0||s===void 0||s!==n)continue;let i=o.replace(/\/+$/u,"");return i==="."?null:i}return null}function iy(e,n){let t=[],r=s=>{let i=qe.join(e,s);if(!Xn(i))return null;try{return So(i).size>n?null:mc(i,"utf8")}catch{return null}},o=r("Dockerfile");if(o!==null){let s=sy(o);for(let i of o.split(/\r?\n/u)){let a=ey.exec(i);a?.[1]!==void 0&&t.push({command:a[1],from:"Dockerfile",srcRoot:s})}}for(let s of["docker-compose.yml","docker-compose.yaml","compose.yml","compose.yaml"]){let i=r(s);if(i!==null)for(let a of i.split(/\r?\n/u)){let d=/^\s*(?:command|entrypoint):\s*(.+)$/u.exec(a);d?.[1]!==void 0&&t.push({command:d[1],from:s,srcRoot:null})}}return t}function ay(e,n,t){let r=e.projectRoot,o=oy.exec(n)?.[1];if(o!==void 0){for(let a of t===null?[o]:[qe.join(t,o),o])if(Xn(qe.join(r,a)))return{file:a}}let s=ry.exec(n)?.[1];if(s===void 0)return o===void 0?{detail:`no module:attr target or .py path in \`${n.trim()}\``}:{detail:`\`${o}\` is not a file in this repository`};let i=hc.exec(s)?.[1]??"";for(let a of t===null?[""]:[t,""])for(let d of[`${i.replace(/\./gu,"/")}.py`,`${i.replace(/\./gu,"/")}/__init__.py`]){let l=a===""?d:qe.join(a,d);if(Xn(qe.join(r,l)))return{file:l}}return gi(e,s)}function yi(e){let n=[],t=[],r=new Set,o=(a,d,l)=>{let c=`${a} ${d}`;r.has(c)||(r.add(c),n.push({file:a,source:d,declaration:l}))},s=Yg(e);t.push(...s.gaps);for(let a of s.entries){let d=a.kind==="entry-point-group"?"entry-point-group":"console-script",l=gi(e,a.target);"file"in l?o(l.file,d,`${a.name} = ${a.target}`):t.push({source:d,declaration:`${a.name} = ${a.target}`,detail:l.detail})}for(let a of Jg(e.projectRoot))o(a,"dunder-main",a);Xn(qe.join(e.projectRoot,"manage.py"))&&o("manage.py","manage-py","manage.py");let i=e.maxProcfileBytes??qg;for(let a of Zg(e.projectRoot,i)){let d=gi(e,a);"file"in d?o(d.file,"launch-declaration",a):t.push({source:"launch-declaration",declaration:a,detail:d.detail})}for(let a of iy(e.projectRoot,Qg)){let d=ay(e,a.command,a.srcRoot),l=`${a.from}: ${a.command.trim()}`;"file"in d?o(d.file,"launch-declaration",l):t.push({source:"launch-declaration",declaration:l,detail:d.detail})}return{entrypoints:n,gaps:t,projectName:s.projectName}}var f_=256*1024*1024;var gc="CUPEL_PYTHON",dy=["-I","-S"],cy="python3",uy=256*1024*1024,fy=12e4,py=512;function ve(e,n=py){return typeof e=="string"&&e.length<=n?e:null}function mt(e){return typeof e=="number"&&Number.isFinite(e)?e:0}function gr(e){let n=Yn(e)?e:{};return{line:mt(n.line),endLine:mt(n.endLine),col:mt(n.col),start:mt(n.start),end:mt(n.end)}}function Yn(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function pt(e){return Array.isArray(e)?e:[]}function Ft(e){return pt(e).map(n=>ve(n))}var my=new Set(["import-module-literal","loader-escape","pkgutil-scan","runpy","entry-point-load","dispatch-escape","attr-rebind","sys-modules"]),hy=new Set(["unreadable","oversize","nul-byte","undecodable","parse-error","recursion","too-many-nodes"]);function gy(e){let n=ve(e.path,4096);if(n===null)return null;let t=e.refused,r=typeof t=="string"&&hy.has(t)?t:null,o=ve(e.detail,200),s=pt(e.imports).filter(Yn).map(u=>({form:u.form==="import"?"import":"from",module:ve(u.module),level:mt(u.level),names:pt(u.names).filter(Yn).map(m=>({name:ve(m.name)??"",asname:ve(m.asname)})).filter(m=>m.name!==""),star:u.star===!0,deferred:u.deferred===!0,enclosingFunction:ve(u.enclosingFunction),guards:Ft(u.guards).filter(m=>m!==null),range:gr(u.range)})),i=pt(e.functions).filter(Yn).flatMap(u=>{let m=ve(u.name),h=ve(u.qualname);return m===null||h===null?[]:[{name:m,qualname:h,kind:u.kind==="async-function"?"async-function":"function",enclosingClass:ve(u.enclosingClass),enclosingFunction:ve(u.enclosingFunction),decorators:Ft(u.decorators),range:gr(u.range)}]}),a=pt(e.classes).filter(Yn).flatMap(u=>{let m=ve(u.name),h=ve(u.qualname);return m===null||h===null?[]:[{name:m,qualname:h,bases:Ft(u.bases),decorators:Ft(u.decorators),range:gr(u.range)}]}),d=pt(e.calls).filter(Yn).map(u=>({callee:ve(u.callee),attr:ve(u.attr),receiver:ve(u.receiver),enclosingFunction:ve(u.enclosingFunction),argCount:mt(u.argCount),range:gr(u.range)})),l=pt(e.escapes).filter(Yn).flatMap(u=>{let m=u.kind,h=ve(u.callee);return typeof m!="string"||!my.has(m)||h===null?[]:[{kind:m,callee:h,target:ve(u.target),attr:ve(u.attr),enclosingFunction:ve(u.enclosingFunction),range:gr(u.range)}]}),c=e.all,p=Array.isArray(c)?Ft(c).filter(u=>u!==null):null;return{path:n,refused:r,...o!==null?{detail:o}:{},imports:s,functions:i,classes:a,calls:d,escapes:l,all:p,allComputed:e.allComputed===!0,truncated:Ft(e.truncated).filter(u=>u!==null)}}function xo(e,n={}){let t=n.env??process.env,r=n.python??t[gc]??cy,o=[],s=e.filter(m=>!m.includes(`
+`));s.length!==e.length&&o.push(`${String(e.length-s.length)} path(s) carried a newline and were not extracted`);let i=[...dy,...mr("extract.py")];n.maxBytesPerFile!==void 0&&i.push("--max-bytes",String(n.maxBytesPerFile));let a=ly(r,i,{input:s.length>0?`${s.join(`
 `)}
-`:"",encoding:"utf8",maxBuffer:ah,timeout:n.timeoutMs??lh,env:t});if(l.error!==void 0){let m=l.error.code,g=m==="ENOENT";return{refused:g?"no-interpreter":"script-failed",interpreter:null,files:[],stdlib:[],diagnostics:[...r,g?`no Python interpreter: \`${o}\` is not on PATH (set ${Ml} to the interpreter this project runs under)`:`the Python extract could not run (${m??l.error.message})`]}}if(l.status!==0){let m=(l.stderr??"").slice(-400).trim();return{refused:"script-failed",interpreter:null,files:[],stdlib:[],diagnostics:[...r,`the Python extract exited ${String(l.status??"on a signal")}${m!==""?`: ${m}`:""}`]}}let i=(l.stdout??"").split(`
-`).filter(m=>m.trim()!==""),d=null,u=[],p=[];for(let m of i){let g;try{g=JSON.parse(m)}catch{r.push("the Python extract emitted a line that is not JSON; it was skipped");continue}if(!Cn(g))continue;if(g.kind==="header"){d=be(g.interpreter,64);let b=g.stdlib;Array.isArray(b)&&(u=b.filter(x=>typeof x=="string"&&x.length<=128));continue}let y=ph(g);if(y===null){r.push("the Python extract emitted a file row without a path; it was skipped");continue}p.push(y)}if(d===null)return{refused:"unreadable-output",interpreter:null,files:[],stdlib:[],diagnostics:[...r,"the Python extract did not report an interpreter version"]};let f=s.length-p.length;return f>0&&r.push(`${String(f)} file(s) asked for produced no row \u2014 treat the extract as incomplete`),{refused:null,interpreter:d,files:p,stdlib:u,diagnostics:r}}var hh="python3",gh={"loader-escape":"dynamic-load","dynamic-load-set":"dynamic-load","module-registry-write":"dynamic-load","unresolved-import":"resolution-divergence","file-refused":"analysis-cap","module-cap":"analysis-cap","extract-refused":"analysis-cap"};function yh(e,n,t=o=>Oo([],{python:o}).refused===null){let o=Gn.resolve(e,n.envRel);for(let r of["bin/python3","bin/python","Scripts/python.exe"]){let s=Gn.join(o,r);try{if(!mh(s).isFile())continue}catch{continue}if(t(s))return s}return hh}function xh(e,n){let t=[e];for(let o of n.sitePackages)t.push(Gn.resolve(e,o));for(let o of n.pthFiles)for(let r of o.paths)t.push(Gn.isAbsolute(r)?r:Gn.resolve(e,o.sitePackages,r));return{roots:[...new Set(t)]}}function Sh(e){let n=[];for(let t of e.distInfos){let o=Ct(t.metadata,{...t.topLevel!==void 0?{topLevelText:t.topLevel}:{},...t.record!==void 0?{recordText:t.record}:{},...t.directUrl!==void 0?{directUrlText:t.directUrl}:{},...t.entryPoints!==void 0?{entryPointsText:t.entryPoints}:{},...t.entryPointsUnknown===!0?{entryPointsUnknown:!0}:{}});o!==null&&n.push(o)}return n}function bh(e){return n=>{let t=e.byImportName.get(n);return t===void 0||t.length===0?null:t.length===1?t[0]?.name??null:null}}function kh(e,n,t={}){let r=(t.readEnvironment??Dt)(n),s=Sh(r),a=zr(s),l=r.diagnostics.map(x=>x),i=t.python??yh(n,r),d=xh(n,r),u=Ih(r,a,d),p=new Map;for(let x of s)p.set(x.name,wh(x,u.distributions));for(let x of u.seen)l.push(`startup hook: ${x}`);for(let x of u.unattributed)l.push(`startup escape: ${x} \u2014 a module runs at interpreter start that no installed distribution claims`);let f=is({projectRoot:n,paths:d,python:i});for(let x of f.gaps)l.push(`entrypoint \`${x.declaration}\` (${x.source}): ${x.detail}`);if(f.entrypoints.length===0)return l.push("no Python entrypoint was found (no console script, `__main__.py`, `manage.py` or launch declaration resolved), so no Python dependency can be reported unreachable"),{rootRel:e,graph:Kt,incompleteness:[],analysisAborted:"no-entrypoint",entrypoints:[],entrypointGaps:f.gaps,interpreter:null,diagnostics:l,execution:p};let m=rs({projectRoot:n,paths:d,entryFiles:f.entrypoints.map(x=>Gn.join(n,x.file)),environmentComplete:!r.truncated&&r.refused===null,externalRoots:r.sitePackages.map(x=>Gn.resolve(n,x)),distributionOf:bh(a),python:i,...t.maxModules!==void 0?{maxModules:t.maxModules}:{}});for(let x of m.diagnostics)l.push(`${x.code} at ${x.where}: ${x.detail}`);if(m.graph.modules.length===0)return{rootRel:e,graph:Kt,incompleteness:[],analysisAborted:"analyzer-crash",entrypoints:f.entrypoints,entrypointGaps:f.gaps,interpreter:m.interpreter,diagnostics:l,execution:p};let g=new Map;for(let x of m.graph.modules)g.set(x.id,x.id),g.set(x.path,x.id);let y=m.graph.modules[0]?.id,b=m.diagnostics.map(x=>({source:g.get(x.where)??y,cause:gh[x.code],reach:{kind:"unbounded"}}));return u.unattributed.length>0&&b.push({source:y,cause:"dynamic-load",reach:{kind:"unbounded"}}),{rootRel:e,graph:m.graph,incompleteness:b,analysisAborted:null,entrypoints:f.entrypoints,entrypointGaps:f.gaps,interpreter:m.interpreter,diagnostics:l,execution:p}}var Kt={modules:[],exports:[],imports:[],functions:[],callSites:[],classes:[],callEdges:[],importEdges:[],exportBindings:[],inheritEdges:[]};function Eh(e){if(e.length===0)return null;let n=[],t=new Map;for(let x of e){let I=x.rootRel===""?".":x.rootRel;for(let w of x.diagnostics)n.push(`${I}: ${w}`);for(let[w,A]of x.execution){let k=t.get(w);t.set(w,k===void 0?A:[...new Set([...k,...A])])}}let o=e.filter(x=>x.analysisAborted===null);if(o.length===0)return{graph:Kt,incompleteness:[],analysisAborted:e[0]?.analysisAborted??"no-entrypoint",roots:e,diagnostics:n,execution:t};let r=[],s=[],a=[],l=[],i=[],d=[],u=[],p=[],f=[],m=[],g=[],y=new Set;for(let x of o){let I=x.rootRel===""?"":`${x.rootRel}::`,w=new Set(x.graph.modules.filter(v=>v.externalSurface===!0).map(v=>v.id)),A=v=>w.has(v)?v:`${I}${v}`,k=v=>`${I}${v}`,h=v=>`${I}${v}`,S=v=>`${I}${v}`,_=v=>`${I}${v}`,P=v=>`${I}${v}`;for(let v of x.graph.modules){if(v.externalSurface===!0){if(y.has(v.id))continue;y.add(v.id),r.push(v);continue}r.push({...v,id:A(v.id)})}for(let v of x.graph.imports)s.push({...v,id:k(v.id),moduleId:A(v.moduleId),...v.resolvedModuleId!==void 0?{resolvedModuleId:A(v.resolvedModuleId)}:{}});for(let v of x.graph.importEdges)a.push({importId:k(v.importId),resolvedModuleId:A(v.resolvedModuleId)});for(let v of x.incompleteness)g.push({...v,source:A(v.source)});for(let v of x.graph.functions)l.push({...v,id:h(v.id),moduleId:A(v.moduleId),...v.enclosingClassId!==void 0?{enclosingClassId:S(v.enclosingClassId)}:{}});for(let v of x.graph.classes)i.push({...v,id:S(v.id),moduleId:A(v.moduleId),members:v.members.map(h)});for(let v of x.graph.exports)d.push({...v,id:P(v.id),moduleId:A(v.moduleId)});for(let v of x.graph.exportBindings)u.push({exportId:P(v.exportId),target:v.target.kind==="function"?{kind:"function",functionId:h(v.target.functionId)}:{kind:"module",moduleId:A(v.target.moduleId)}});for(let v of x.graph.callSites)p.push({...v,id:_(v.id),enclosingFunctionId:h(v.enclosingFunctionId),resolvedTargetIds:v.resolvedTargetIds.map(h)});for(let v of x.graph.callEdges)f.push({...v,callSiteId:_(v.callSiteId),calleeFunctionId:h(v.calleeFunctionId)});for(let v of x.graph.inheritEdges)m.push({...v,subclassId:S(v.subclassId),superclassId:S(v.superclassId)})}let b=r[0]?.id;for(let x of e)x.analysisAborted===null||b===void 0||g.push({source:b,cause:x.analysisAborted==="no-entrypoint"?"no-entrypoint":"analysis-cap",reach:{kind:"unbounded"}});return{graph:{modules:r,imports:s,importEdges:a,functions:l,classes:i,exports:d,exportBindings:u,callSites:p,callEdges:f,inheritEdges:m},incompleteness:g,analysisAborted:null,roots:e,diagnostics:n,execution:t}}function Tl(e,n={}){let t=e.filter(o=>Tt(o));return t.length===0?null:Eh(t.map(o=>kh(o.rel,o.abs,n)))}function wh(e,n){let t=[];return e.consoleScripts==="declared"&&t.push("bin"),e.extensionModules>0&&t.push("native-artifact"),n.has(e.name)&&t.push("install-script"),(e.consoleScripts==="unknown"||!e.recordKnown)&&t.push("manifest-unreadable"),t}var vh=["sitecustomize","usercustomize"];function Ih(e,n,t){let o=new Set,r=[],s=[];for(let a of e.pthFiles){for(let i of a.importModules){let d=No(n,i);for(let p of d)o.add(p.name);let u=$n(t,i);if(u.resolved!==null){s.push(`${a.sitePackages}/${a.name}: \`import ${i}\` runs ${u.resolved.path}`);continue}d.length===0&&r.push(`${a.sitePackages}/${a.name}: \`import ${i}\``)}let l=a.importModules.length;a.importLines>l&&r.push(`${a.sitePackages}/${a.name}: ${String(a.importLines-l)} import line(s) whose module could not be read`)}for(let a of vh){let l=$n(t,a);if(l.resolved===null)continue;let i=No(n,a);for(let d of i)o.add(d.name);i.length===0?r.push(`${l.resolved.path}: \`import ${a}\` runs at every interpreter start`):s.push(`${a}: \`import ${a}\` runs ${l.resolved.path}`)}return{distributions:o,unattributed:r,seen:s}}import{readdirSync as Ah,readFileSync as _h}from"node:fs";import Nh from"node:path";var Rh=new Set(["summarized","crashed","over-cap"]),Ph=new Set(["function","method","ctor"]);function ke(e,n){throw new Error(`summary facts file ${e}: ${n}`)}function as(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function $h(e,n){as(e)||ke(n,"edge is not an object");let{entryPath:t,entryExport:o,entryContainer:r,hops:s}=e;(typeof t!="string"||typeof o!="string")&&ke(n,"edge entry fields must be strings"),r!==null&&typeof r!="string"&&ke(n,"entryContainer must be string or null"),(typeof s!="number"||!Number.isInteger(s)||s<0)&&ke(n,"hops must be a non-negative integer");let a=e.target;if(as(a)||ke(n,"edge target missing"),a.kind==="symbol"){let{exportName:l,container:i,symbolKind:d}=a;return typeof l!="string"&&ke(n,"symbol target exportName"),i!==null&&typeof i!="string"&&ke(n,"symbol target container"),(typeof d!="string"||!Ph.has(d))&&ke(n,`symbol target kind ${JSON.stringify(d)}`),{entryPath:t,entryExport:o,entryContainer:r,target:{kind:"symbol",exportName:l,container:i,symbolKind:d},hops:s}}if(a.kind==="dep"){let{calleePackage:l,calleeSubpath:i,calleeExport:d}=a;return(typeof l!="string"||l.length===0)&&ke(n,"dep target calleePackage"),i!==null&&typeof i!="string"&&ke(n,"dep target calleeSubpath"),(typeof d!="string"||d.length===0)&&ke(n,"dep target calleeExport"),{entryPath:t,entryExport:o,entryContainer:r,target:{kind:"dep",calleePackage:l,calleeSubpath:i,calleeExport:d},hops:s}}ke(n,`unknown target kind ${JSON.stringify(a.kind)}`)}function Oh(e,n){as(e)||ke(n,"root is not an object");let{packageName:t,analyzedVersion:o,tool:r,toolVersion:s,maxIndirections:a,status:l}=e;(typeof t!="string"||t.length===0)&&ke(n,"packageName"),typeof o!="string"&&ke(n,"analyzedVersion"),r!=="jelly"&&ke(n,`tool ${JSON.stringify(r)} (only 'jelly' exists)`),typeof s!="string"&&ke(n,"toolVersion"),typeof a!="number"&&ke(n,"maxIndirections"),(typeof l!="string"||!Rh.has(l))&&ke(n,`status ${JSON.stringify(l)} not in the enum`);let i=e.edges;return Array.isArray(i)||ke(n,"edges is not an array"),l!=="summarized"&&i.length>0&&ke(n,`status='${l}' with edges (CS-W6: edge rows only under summarized)`),{packageName:t,analyzedVersion:o,tool:r,toolVersion:s,maxIndirections:a,status:l,edges:i.map(d=>$h(d,n))}}function Dl(e){let n=new Map,t=Ah(e).filter(o=>o.endsWith(".summary.json"));for(let o of t){let r=Nh.join(e,o),s;try{s=JSON.parse(_h(r,"utf8"))}catch(i){ke(o,`unparseable JSON: ${i instanceof Error?i.message:String(i)}`)}let a=Oh(s,o),l=n.get(a.packageName);l===void 0?n.set(a.packageName,[a]):l.push(a)}return n}import{isBuiltin as Ll}from"node:module";function W(e){let n="";for(let t of e){let o=t.charCodeAt(0),r=o<32||o>=127&&o<=159;n+=r?"\\x"+o.toString(16).padStart(2,"0"):t}return n}var Fl=1024,jl=4096,Mo=8,Bl=512,Kl=512,ls=8,Ch=160,Mh=new Set(["unresolved-specifier","declaration-shadow","unresolved-reexport","unanalyzable-module"]),ds=new Set(["limit-exceeded","parse-error","unsupported-syntax"]),Th=/^(@[^/@\s]+\/)?[^/@\s.][^/\s]*$/u,Dh=/\.[cm]?[jt]sx?$/u;function Ul(e,n){let t=n.get(e);if(t!==void 0)return t.packageName;let o=e.lastIndexOf("node_modules/");if(o!==-1){let r=e.slice(o+13).split("/"),s=r[0]??"";return s.startsWith("@")?r[1]===void 0?null:`${s}/${r[1]}`:s===""?null:s}return Th.test(e)&&!Dh.test(e)?e:null}function Lh(e){return W(`${e.code} ${e.path}: ${e.detail}`.slice(0,Ch))}function zl(e){let{graph:n,facts:t,diagnostics:o}=e,r=new Map(n.modules.map($=>[$.id,$])),s=new Map(n.modules.map($=>[$.path,$])),a=dn(n),l=new Set;for(let $ of a){let Z=r.get($);Z!==void 0&&l.add(Z.packageName)}let i=new Map,d=0,u=!1,p=!1,f=$=>$.startsWith(`${e.appRootReal}/`)?$.slice(e.appRootReal.length+1):$;for(let $ of o){if($.code==="limit-exceeded"&&$.path===e.appRootReal){u=!0;continue}let Z=Ul(f($.path),s);if(Z===null){$.code==="out-of-root"&&d++,ds.has($.code)&&(p=!0);continue}let Q=s.get(f($.path));Q!==void 0&&ds.has($.code)&&!Q.path.includes("node_modules/")&&(p=!0);let ce=i.get(Z);ce===void 0?i.set(Z,[$]):ce.push($)}let m=new Map(n.imports.map($=>[$.id,$])),g=new Set;for(let $ of n.importEdges){let Z=m.get($.importId);Z!==void 0&&r.get(Z.moduleId)?.externalSurface===!0&&g.add(Z.moduleId)}let y=[],b=new Set,x=n.modules.filter($=>$.externalSurface===!0);for(let $ of x){let Z=i.get($.packageName)??[],Q=g.has($.id),ce=[],Tn=se=>se.code==="dependency-body"&&se.anchor===void 0&&/syntax/u.test(se.detail),Jn=se=>se.code==="loader-escape"||se.code==="dependency-body"&&se.anchor===void 0&&!/syntax/u.test(se.detail),R=Z.filter(se=>Mh.has(se.code)),M=Z.filter(Jn),B=Z.filter(se=>ds.has(se.code)||Tn(se)),q=Z.filter(se=>se.code==="out-of-root"),le=Q&&R.length===0,ge=M.length===0,Te=!u&&B.length===0,Qe=d===0&&q.length===0;Q||ce.push("(a) the package's entry was never followed to a module");for(let se of[...R,...M,...B,...q]){if(ce.length>=ls)break;ce.push(Lh(se))}u&&ce.length<ls&&ce.push("(c) the dependency module closure hit its cap \u2014 every follow is truncated"),d>0&&ce.length<ls&&ce.push(`(d) ${String(d)} out-of-root diagnostic(s) no package can be read from`);let L=["a","b","c","d"].filter(se=>!{a:le,b:ge,c:Te,d:Qe}[se]),oe=L.length===0;oe&&b.add($.id),y.push({packageName:W($.packageName),module:W(String($.id)),inReach:a.has($.id),builtin:Ll($.packageName),followed:Q,d1:{a:le,b:ge,c:Te,d:Qe},failing:L,transparent:oe,evidence:ce})}let I=new Set;for(let $ of t)$.reach.kind==="unbounded"&&I.add($.source);let w=$=>({module:W(String($.module)),kind:$.kind,packageName:r.get($.module)?.packageName??null}),A=new Set(x.filter($=>Ll($.packageName)).map($=>$.id)),k=new Set([...b,...A]),h=[],S=new Map,_=0,P=0,v=0,T=0,N=[],j=new Set;for(let $ of t)$.reach.kind==="unbounded"&&j.add($.cause);for(let $ of t){if($.reach.kind==="class-scope"){N.push({packageName:$.reach.packageName,container:$.reach.container});continue}if($.reach.kind==="unbounded")continue;T++;let Z=$.reach.anchor,Q=S.get(String(Z));Q===void 0&&(Q={today:xt(n,Z,I),d1:xt(n,Z,I,b),d1Builtins:xt(n,Z,I,k)},S.set(String(Z),Q)),Q.d1Builtins.length>0&&v++,Q.today.length>0&&(_++,j.add($.cause)),Q.d1.length>0&&P++,h.length<jl&&h.push({anchor:W(String(Z)),packageName:W(r.get(Z)?.packageName??""),cause:$.cause,reachKind:$.reach.kind,blockersToday:Q.today.slice(0,Mo).map(w),blockersUnderD1:Q.d1.slice(0,Mo).map(w),blockedUnderD1Builtins:Q.d1Builtins.length>0,moreToday:Math.max(0,Q.today.length-Mo),moreUnderD1:Math.max(0,Q.d1.length-Mo)})}let O=o.filter($=>$.anchor===void 0&&$.classScope===void 0),F=new Map(e.loadSites.map($=>[$.importId,$])),K=new Map;for(let $ of e.loadSites){let Z=K.get($.path);Z===void 0?K.set($.path,[$.shape]):Z.push($.shape)}let te=$=>{if($.code!=="loader-escape")return!1;let Z=$.escapes??[];if(Z.length===0||Z.some(ce=>ce!=="non-literal-load"))return!1;let Q=K.get($.path)??[];return Q.length>0&&Q.every(ce=>ce==="relative-bounded")},U=O.slice(0,Kl).map($=>({cause:e.causeOf($.code),code:$.code,path:W(f($.path)),attributedPackage:Ul(f($.path),s),...$.escapes!==void 0?{escapes:[...$.escapes]}:{},...$.reason!==void 0?{reason:$.reason}:{},d2Dischargeable:te($)})),X={};for(let $ of O){if($.code!=="unresolved-specifier")continue;let Z=$.reason??"(none)";X[Z]=(X[Z]??0)+1}let D=I.size===0?0:t.filter($=>$.reach.kind==="unbounded").length,C=Math.max(0,D-O.length),H=D-O.filter(te).length,J=[],G=0,Y=0,re=0;for(let $ of n.imports){if($.specifierIsLiteral)continue;re++;let Z=a.has($.moduleId),Q=F.get(String($.id)),ce=Q?.shape??"unrecorded";Z&&(G++,ce==="relative-bounded"&&Y++),J.length<Bl&&J.push({importId:W(String($.id)),path:W(r.get($.moduleId)?.path??""),shape:ce,text:W(Q?.text??""),inReach:Z})}return{report:{adr:"ADR-105",aborted:e.analysisAborted,rootBudget:e.rootBudget,closureCapHit:u,appCapHit:p,unattributedOutOfRoot:d,blindUnbounded:C,unbounded:U,anchors:h,surfaces:y.slice(0,Fl),loads:J,counts:{modules:n.modules.length,reachMods:a.size,surfaces:x.length,surfacesInReach:y.filter($=>$.inReach).length,transparentSurfaces:b.size,builtinSurfaces:A.size,anchors:T,anchorsBlockedToday:_,anchorsBlockedUnderD1:P,anchorsBlockedUnderD1Builtins:v,unbounded:D,loadsInReach:G,loadsRelativeBounded:Y,unresolvedByReason:X,conditionUnions:e.conditionUnions.length,provenAbsent:e.provenAbsent.length},truncated:{surfaces:Math.max(0,y.length-Fl),anchors:Math.max(0,T-jl),loads:Math.max(0,re-Bl),unbounded:Math.max(0,O.length-Kl)}},reachedPackages:l,aborted:e.analysisAborted,unboundedFacts:D,unboundedHard:H,anchorsBlockedToday:_,anchorsBlockedUnderD1:P,anchorsBlockedUnderD1Builtins:v,loadsInReach:G,loadsAllBounded:G>0&&Y===G,d2Eligible:e.rootBudget==="complete"&&!p&&!u,classScope:N,taintCausesToday:j}}var Fh=new Set(["unverified-symbol","db-gap","symbol-unsupported","incomplete-surface"]),jh=["no-entrypoint","dynamic-load","resolution-divergence","analysis-cap","dep-opaque"];function Wl(e,n,t,o,r){if(t===null||e.reachedPackages.has(t.packageName))return;let s=e.classScope.some(_=>_.packageName===t.packageName&&_.container===t.container),a=e.aborted!==null||e.unboundedFacts>0||e.anchorsBlockedToday>0||s,l=t.symbolKind==="method"||t.symbolKind==="ctor",d=!t.verified||t.symbolKind==="accessor"||t.symbolKind==="pattern"||l||n.unknownKind!==void 0&&Fh.has(n.unknownKind)?"pre-2b":n.tier==="not-reachable"?"denial":e.loadsInReach>0?"load":a?"taint":o>0?"oog":"unexpected",u=new Set(e.taintCausesToday);s&&u.add("dep-opaque");let p=e.aborted!==null?e.aborted:jh.find(_=>u.has(_)),f=d==="pre-2b"?n.tier==="unknown"&&(l?n.unknownKind==="dep-opaque":!0):d==="denial"?n.tier==="not-reachable":d==="load"?n.tier==="unknown"&&n.unknownKind==="dynamic-load":d==="taint"?n.tier==="unknown"&&n.unknownKind===p:d==="oog"?n.tier==="unknown"&&n.unknownKind==="analysis-cap":!1,m=t.verified&&r===!0,g=e.aborted===null&&e.unboundedFacts===0&&!s&&o===0,y=e.loadsInReach===0||e.d2Eligible&&e.loadsAllBounded,b=m&&d==="taint"&&g&&e.loadsInReach===0&&e.anchorsBlockedUnderD1===0,x=m&&d==="load"&&g&&e.d2Eligible&&e.loadsAllBounded&&e.anchorsBlockedToday===0,I=m&&(d==="load"||d==="taint")&&g&&y&&e.anchorsBlockedUnderD1===0,w=e.aborted===null&&e.unboundedHard===0&&!s&&o===0,A=m&&d==="load"&&w&&e.d2Eligible&&e.loadsAllBounded&&e.anchorsBlockedToday===0,k=m&&(d==="load"||d==="taint")&&w&&y&&e.anchorsBlockedUnderD1===0,h=m&&d==="taint"&&g&&e.loadsInReach===0&&e.anchorsBlockedUnderD1Builtins===0,S=m&&(d==="load"||d==="taint")&&w&&y&&e.anchorsBlockedUnderD1Builtins===0;return{unloaded:!0,exit:d,agrees:f,verified:t.verified,surfaceComplete:r,oog:o,classScoped:s,predicted:{d1:b,d2:x,d1d2:I,d2Amended:A,d1d2Amended:k,d1Builtins:h,d1d2AmendedBuiltins:S}}}import{readFileSync as Bh,statSync as Kh}from"node:fs";var us=/^(@[A-Za-z0-9_.-]{1,100}\/)?[A-Za-z0-9_.-]{1,100}$/u,To=/^[A-Za-z0-9_$.-]{1,128}$/u,Vl=64,ql=1024*1024,Gl=/^(0|\d{1,10}\.\d{1,10}\.\d{1,10})$/u,Hl=/^[A-Za-z0-9@_.-]{1,128}$/u;function ve(e){throw new Error(`model claims rejected: ${e}`)}function cs(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function Uh(e,n){cs(e)||ve(`${n}: edge is not an object`);let{kind:t,anchorExport:o,anchorContainer:r,calleePackage:s,calleeContainer:a,calleeExport:l}=e;return t!=="alias"&&t!=="dispatch"&&ve(`${n}: edge kind`),(typeof o!="string"||!To.test(o))&&ve(`${n}: anchorExport ${JSON.stringify(o)}`),r!==null&&(typeof r!="string"||!To.test(r))&&ve(`${n}: anchorContainer`),(typeof s!="string"||!us.test(s))&&ve(`${n}: calleePackage ${JSON.stringify(s)}`),a!==null&&(typeof a!="string"||!To.test(a))&&ve(`${n}: calleeContainer`),(typeof l!="string"||!To.test(l))&&ve(`${n}: calleeExport ${JSON.stringify(l)}`),{kind:t,anchorExport:o,anchorContainer:r,calleePackage:s,calleeContainer:a,calleeExport:l}}function Xl(e){let n=Kh(e).size;n>ql&&ve(`file is ${String(n)} bytes, over the ${String(ql)} cap`);let t;try{t=JSON.parse(Bh(e,"utf8"))}catch(r){ve(`unparseable JSON: ${r instanceof Error?r.message:String(r)}`)}Array.isArray(t)||ve("root is not an array"),t.length>Vl&&ve(`${String(t.length)} claims over cap ${String(Vl)}`);let o=[];for(let r of t){cs(r)||ve("claim is not an object");let{packageName:s,modelId:a,range:l,edges:i}=r;(typeof s!="string"||!us.test(s))&&ve("packageName"),(typeof a!="string"||!Hl.test(a))&&ve("modelId (identifier charset, 1-128 chars)"),o.some(u=>u.model.modelId===a)&&ve(`duplicate modelId ${a} \u2014 the V5 promote\u2192claim join must be unambiguous`),(!cs(l)||typeof l.introduced!="string")&&ve(`${a}: range`),Gl.test(l.introduced)||ve(`${a}: range.introduced ${JSON.stringify(l.introduced)} is not '0' or an exact x.y.z triple`);let d=l.fixedBefore;d!==null&&typeof d!="string"&&ve(`${a}: fixedBefore`),typeof d=="string"&&!Gl.test(d)&&ve(`${a}: range.fixedBefore ${JSON.stringify(d)} is not an exact x.y.z triple`),Array.isArray(i)||ve(`${a}: edges`),i.length>64&&ve(`${a}: ${String(i.length)} edges over cap ${String(64)}`),o.push({model:{packageName:s,modelId:a,edges:i.map(u=>Uh(u,a))},introduced:l.introduced,fixedBefore:d})}return o}var zh=["in-app-purchase@1-v1"];function fs(e,n,t){let o=[],r=[],s=[],a=(l,i,d,u)=>{r.push(d),s.push({modelId:u??l.model.modelId,status:i,reason:d,edgeCount:l.model.edges.length})};for(let l of e){if(!us.test(l.model.packageName)||!Hl.test(l.model.modelId)){a(l,"refused","model (unprintable id): hostile-shaped packageName/modelId \u2014 refused WHOLE","(unprintable id)");continue}if(t?.shadowConsultDenylisted!==!0&&zh.includes(l.model.modelId)){a(l,"denylisted",`model ${l.model.modelId}: DENYLISTED (ADR-081 F-081-A a-prime) \u2014 dropped, never consulted`);continue}if(l.model.edges.some(u=>u.kind!=="alias"&&u.kind!=="dispatch")){a(l,"refused",`model ${l.model.modelId}: unknown edge kind \u2014 refused WHOLE`);continue}let i=n(l.model.packageName);if(typeof i!="string"&&i!==void 0){a(l,"inert",`model ${l.model.modelId}: anchor ${l.model.packageName} installed at more than one version (${i.join(", ")}) \u2014 inert, never guessed (ADR-071)`);continue}if(i===void 0){a(l,"inert",`model ${l.model.modelId}: anchor ${l.model.packageName} not installed \u2014 inert`);continue}let d;try{d=Fn(i,{advisoryId:l.model.modelId,packageName:l.model.packageName,introduced:l.introduced,...l.fixedBefore!==null?{fixed:l.fixedBefore}:{},surfaceComplete:!1})}catch{a(l,"inert",`model ${l.model.modelId}: installed ${l.model.packageName}@${i} not an exact triple \u2014 inert (never guessed)`);continue}if(!d){a(l,"inert",`model ${l.model.modelId}: installed ${l.model.packageName}@${i} outside [${l.introduced}, ${l.fixedBefore??"\u221E"}) \u2014 inert`);continue}o.push(l.model),s.push({modelId:l.model.modelId,status:"active",reason:null,edgeCount:l.model.edges.length})}return{models:o,notes:r,dispositions:s}}var Vh=4,qh={additiveForms:!0,namelessExports:!0},Gh=new Set(["dep-opaque","dynamic-load","dispatch"]),Hh={base:new Set(["symbol-reachable"]),widened:new Set(["symbol-reachable","call-path-confirmed"])};function hs(e,n,t){return e.tier==="unknown"&&Hh[t].has(e.decidedAtStage)&&e.unknownKind!==void 0&&Gh.has(e.unknownKind)&&n!==null&&n.verified}var Xh=()=>({"not-affected":0,"not-reachable":0,"reachable-high":0,"reachable-medium":0,"reachable-low":0,unknown:0}),ln=class extends Error{},gs="cupel/coverage-gap",od={"loader-escape":"dynamic-load","out-of-root":"resolution-divergence","unresolved-specifier":"resolution-divergence","declaration-shadow":"resolution-divergence","unanalyzable-module":"resolution-divergence","unresolved-reexport":"resolution-divergence","limit-exceeded":"analysis-cap","parse-error":"analysis-cap","unsupported-syntax":"analysis-cap","unresolved-launch-entry":"analysis-cap","unresolved-entry-declaration":"analysis-cap","framework-derived-entry":"analysis-cap","unanalyzed-project-root":"no-entrypoint","dependency-body":"dep-opaque","dep-class-corridor":"dep-opaque"};function zt(e,n,t){return{advisoryId:e,packageName:n,...t.ecosystem==="PyPI"?{ecosystem:"PyPI"}:{},introduced:t.introduced??"0",...t.fixed!==null?{fixed:t.fixed}:{},...t.lastAffected!==null?{lastAffected:t.lastAffected}:{},surfaceComplete:t.surfaceComplete===1}}function ed(e,n){return e===0?"no-entrypoint":n.modules.length===0?"analyzer-crash":null}function nd(e,n,t){let o=new Map(e.modules.map(a=>[a.path,a.id])),r=e.modules[0]?.id;if(r===void 0)return[];let s=n.map(a=>({source:o.get(a.path)??r,cause:od[a.code],reach:a.classScope!==void 0?{kind:"class-scope",packageName:a.classScope.packageName,container:a.classScope.container}:a.anchor!==void 0?{kind:"via-module",anchor:a.anchor}:{kind:"unbounded"}}));for(let a of t)s.push({source:r,reach:{kind:"unbounded"},cause:a});return s}function ps(e,n,t,o,r){let s=t.filter(a=>a.exportName!==null&&(o===1||r||a.verified!==1));return s.length>0?s.map(a=>({advisoryId:e,packageName:n,exportName:a.exportName??"",container:a.container,symbolKind:a.symbolKind,sourcePath:a.sourcePath??"",derivation:a.derivation,confidence:a.confidence,verified:a.verified===1})):t.length===0||t.every(a=>a.exportName!==null&&a.verified===1)?[null]:[]}function Yh(e,n){let t;try{t=Wt(e)}catch{return!0}let o=3,r=(s,a)=>{if(a>o)return!1;let l;try{l=td(s)}catch{return!1}for(let i of l){if(i==="node_modules"||i.startsWith("."))continue;let d=mn.join(s,i),u;try{u=ms(d)}catch{continue}if(!u.isDirectory())continue;let p=mn.relative(t,d).split(mn.sep).join("/");try{if(ms(mn.join(d,"package.json")).isFile()&&!n.has(p))return!0}catch{}if(r(d,a+1))return!0}return!1};return r(t,1)}function Jh(e,n){let t="";for(let o of e)o.rel!==""&&n.startsWith(`${o.rel}/`)&&o.rel.length>t.length&&(t=o.rel);return t}function Zh(e,n,t){let o=[];if(t&&o.push("nested-app-root"),n==="")return[...o,"manifest-unreadable"];let r;try{if(r=Wt(mn.resolve(e,n)),!r.startsWith(Wt(e)+mn.sep))return[...o,"manifest-unreadable"]}catch{return[...o,"manifest-unreadable"]}let s;try{let u=mn.join(r,"package.json");if(!ms(u).isFile())return[...o,"manifest-unreadable"];s=Wh(u,"utf8")}catch{return[...o,"manifest-unreadable"]}let a;try{a=JSON.parse(s)}catch{return[...o,"manifest-unreadable"]}if(typeof a!="object"||a===null)return[...o,"manifest-unreadable"];let l=a;(typeof l.bin=="string"||typeof l.bin=="object"&&l.bin!==null)&&o.push("bin");let i=["preinstall","install","postinstall","prepare","prepublish"],d=l.scripts;if(typeof d=="object"&&d!==null){let u=d;i.some(p=>typeof u[p]=="string")&&o.push("install-script")}return(l.gypfile===!0||Qh(r))&&o.push("native-artifact"),o}function Qh(e){for(let n of["","build/Release","build/Debug","prebuilds","lib/binding"]){let t=mn.join(e,n),o;try{o=td(t)}catch{continue}if(o.some(r=>r.endsWith(".node")))return!0}return!1}function eg(e,n){let t=new Set(["npm",...n.ecosystems?.()??[]]),o=[];for(let r of e.perRoot){let s=new Map;for(let a of r.packages){let l=a.ecosystem??"npm";t.has(l)||s.set(l,(s.get(l)??0)+1)}for(let[a,l]of[...s.entries()].sort())o.push({kind:"ecosystem-uncovered",detail:`${r.rootRel===""?"":`${r.rootRel}: `}${String(l)} ${a} distribution(s) were enumerated but the loaded shard carries no ${a} advisories: they were NOT assessed, so this is not a clean bill of health for them. Scan with a ${a} shard to assess them (ADR-109 D5).`,blindsAnalysis:!1,rootRel:r.rootRel})}return o}function rd(e){return JSON.stringify([e.ecosystem??"npm",e.name,e.version,e.lockKey])}function ng(e,n,t){return new Map(n.map(o=>[rd(o),Zh(e,o.lockKey,t)]))}function tg(e){let n=new Map;for(let t of e){let o=n.get(t.advisory.id);o===void 0?n.set(t.advisory.id,[t]):o.push(t)}return n}function og(e,n,t){return n.symbolsDecidable||e.tier!=="not-reachable"||!n.graph.modules.some(r=>r.packageName===t.name)?e:{...e,tier:"unknown",reason:`${t.name} is loaded, and cupel does not yet follow calls in this ecosystem's code \u2014 "no call path found" here is a property of the analysis, not of the application`,unknownKind:"symbol-unsupported",basis:void 0,path:void 0}}function rg(e,n,t,o,r,s,a){let{finding:l}=Ut(e,n,{name:t.name,version:t.version,...t.ecosystem!==void 0?{ecosystem:t.ecosystem}:{},devOnly:t.dev,outOfGraphExecution:a(t)},zt(o.advisory.id,t.name,o.affected),null,r,s);return l.decidedAtStage!=="presence"&&l.decidedAtStage!=="version-match"}function Ut(e,n,t,o,r,s,a){let l=Zo({graph:e,installed:t,range:o,symbol:r,coverage:null,incompleteness:s,analysisAborted:a});if(n!==null&&r!==null&&hs(l,r,"base")){let i=St(e,n.modulesById,n.reachMods,r,n.records);if(i!==null)return{finding:l,hit:i}}return{finding:l,hit:null}}function sg(e,n){let t=new Set,o=[];for(let r of e.packages)if((r.ecosystem??"npm")==="npm")for(let{advisory:s,affected:a}of n.advisoriesForPackage(r.ecosystem??"npm",r.name)){let l=zt(s.id,r.name,a),i;try{i=Fn(r.version,l)}catch{continue}if(i)for(let d of n.symbolsForAffected(a.id)){if(d.verified!==1||d.symbolKind!=="method"&&d.symbolKind!=="ctor"||d.container===null||d.sourcePath===null)continue;let u=`${r.lockKey}\0${d.container}\0${d.sourcePath}`;t.has(u)||(t.add(u),o.push({packageName:r.name,packageRootRel:r.lockKey,container:d.container,sourcePath:d.sourcePath}))}}return o.sort((r,s)=>`${r.packageRootRel}\0${r.container}\0${r.sourcePath}`.localeCompare(`${s.packageRootRel}\0${s.container}\0${s.sourcePath}`)),o.slice(0,yo)}function ig(e,n,t){let o=new Map(e.functions.map(l=>[l.id,l])),r=new Map(e.classes.map(l=>[l.id,l.name])),s=new Map(e.callSites.map(l=>[l.id,l])),a=[];for(let l of e.callEdges){if(l.resolution!=="resolved"&&l.resolution!=="field-based")continue;let i=s.get(l.callSiteId);if(i===void 0)continue;let d=o.get(i.enclosingFunctionId);if(d===void 0||!t.has(d.moduleId))continue;let u=n.get(d.moduleId);if(u===void 0)continue;let p=o.get(l.calleeFunctionId);if(p===void 0||p.name===void 0)continue;let f=n.get(p.moduleId);f!==void 0&&f.packageName!==u.packageName&&a.push({packageName:f.packageName,exportName:p.name,container:p.enclosingClassId!==void 0?r.get(p.enclosingClassId)??null:null,resolution:l.resolution,callerFunctionId:d.id})}return a}function ag(e){let n=new Set(e.modules.filter(u=>u.isEntrypoint).map(u=>u.id)),t=new Map(e.modules.map(u=>[u.id,u])),o=new Map(e.functions.map(u=>[u.id,u])),r=new Set;for(let u of e.functions)n.has(u.moduleId)&&(u.publicSurfaceReachable||u.name==="<toplevel>")&&r.add(u.id);let s=new Map(e.exports.map(u=>[u.id,u]));for(let u of e.exportBindings){if(u.target.kind!=="function")continue;let p=s.get(u.exportId);if(p===void 0||!n.has(p.moduleId))continue;let f=o.get(u.target.functionId);f===void 0||t.get(f.moduleId)?.externalSurface===!0||r.add(f.id)}let a=new Map(e.callSites.map(u=>[u.id,u.enclosingFunctionId])),l=new Map;for(let u of e.callEdges){if(u.resolution!=="resolved"&&u.resolution!=="field-based")continue;let p=a.get(u.callSiteId);if(p===void 0)continue;let f=l.get(p);f===void 0?l.set(p,[u.calleeFunctionId]):f.push(u.calleeFunctionId)}let i=new Set(r),d=[...r];for(;d.length>0;){let u=d.pop();if(u!==void 0)for(let p of l.get(u)??[])i.has(p)||(i.add(p),d.push(p))}return i}function lg(e,n,t,o){for(let r of n){if(r.modelId!==e.modelId||r.anchor.packageName!==e.anchorPackage||r.anchor.exportName!==e.entryExport)continue;let s=t.filter(l=>l.packageName===r.anchor.packageName&&l.exportName===r.anchor.exportName&&l.container===r.anchor.container),a=s.find(l=>l.resolution==="resolved")??s[0];if(a!==void 0)return o.has(a.callerFunctionId)}return null}function dg(e,n,t){if(t===void 0||t===!1)return!1;if(t===!0||t==="all")return n>0||e.some(s=>s.modelId!==void 0);let o=new Set(t),r=s=>o.has(s)||o.has(qe[s]??"");return e.some(s=>s.tier==="unknown"&&s.unknownKind!==void 0&&r(s.unknownKind)||s.modelPromotedFromKind!==void 0&&r(s.modelPromotedFromKind))}function ys(e){let n=Wt(e.dir),t=e.reader??(e.shardPathPypi!==void 0?nr([bt(e.shardPath),bt(e.shardPathPypi)]):bt(e.shardPath)),o=e.partialRows===!0;try{if(!/^\d+$/u.test(t.schemaVersion)||Number(t.schemaVersion)>Number(jn))throw new ln(`shard schema ${JSON.stringify(t.schemaVersion)} is unreadable or newer than this cupel understands (v${jn})`);let r=null;if(e.summaryShadow!==void 0)try{r=Dl(e.summaryShadow)}catch(L){throw new ln(`--summary-shadow facts dir rejected: ${L instanceof Error?L.message:String(L)}`)}let s=null;if(e.modelShadow!==void 0)try{s=Xl(e.modelShadow.claimsPath)}catch(L){throw new ln(`--model-shadow claims rejected: ${L instanceof Error?L.message:String(L)}`)}let a=Vr(n,{...e.rootDiscovery,...e.root!==void 0?{operatorRoots:e.root}:{}}),l=pl(n,a,e.installedSet);if(l.truncated){let L=l.perRoot.filter(oe=>oe.truncated).map(oe=>oe.rootRel===""?"the scan root":`\`${oe.rootRel}\``);throw new ln(`the dependency enumeration hit a hard cap and is incomplete at ${L.length>0?L.join(", "):"the union across roots"} (${l.diagnostics.join("; ")}) \u2014 refusing to report a partial (possibly false-clean) scan`)}let i=Tl(a.roots),d=i?.execution??null,u=hl(l.packages.filter(L=>(L.ecosystem??"npm")==="npm")),p=e.entry??[],f=p.length>0?Aa(n,p):{entrypoints:[],rejected:[]},m=f.rejected,g=Ia(n,a.roots),y=[...new Set([...g.entrypoints,...f.entrypoints])],b=[...g.sources];for(let L of f.entrypoints)g.entrypoints.includes(L)||b.push({source:"--entry",specifier:L,entrypoint:L,launch:!1,root:Jh(a.roots,L)});let x=[...b];for(let L of i?.roots??[])for(let oe of L.entrypoints)b.push({source:`python:${oe.source}`,specifier:oe.declaration,entrypoint:L.rootRel===""?oe.file:`${L.rootRel}/${oe.file}`,launch:oe.source==="console-script"||oe.source==="launch-declaration",root:L.rootRel});let I=sg(l,t),w=e.bindingForms??qh,A=e.callablePackageResolver===!0,k=e.tsconfigPaths!==!1,h=Yh(n,Ft(b)),S=ng(n,l.packages,h),_=L=>(L.ecosystem??"npm")!=="npm"?d?.get(L.name)??["manifest-unreadable"]:S.get(rd(L))??["manifest-unreadable"],P=Dr({appRoot:n,entrypoints:y,depClassAnchors:I,bindingForms:w,callablePackageResolver:A,tsconfigPaths:k}),v=P.graph,T=Jo(v),N=[...g.diagnostics,...Lr(g),...Fr(g,y.length),...Jr(a,x),...P.diagnostics],j=ed(y.length,v),O=L=>l.packages.some(oe=>(oe.ecosystem??"npm")===L),F=i===null?"no-entrypoint":i.analysisAborted,K=(O("npm")?j:null)??(O("PyPI")?F:null)??(O("npm")||O("PyPI")?null:j),te=[...l.gaps,...gl(a),...eg(l,t)],U=yl(te),X=nd(v,N,U),D={graph:Kt,incompleteness:[],analysisAborted:"no-entrypoint",symbolsDecidable:!1},C=L=>(L.ecosystem??"npm")==="npm"?{graph:v,incompleteness:X,analysisAborted:j,symbolsDecidable:!0}:i===null?D:{...i,symbolsDecidable:!0},H=n;try{H=Wt(n)}catch{}let J=zl({graph:v,facts:X,diagnostics:N,analysisAborted:j,loadSites:P.loadSites,conditionUnions:P.conditionUnions,provenAbsent:P.provenAbsent,appRootReal:H,rootBudget:a.budget,causeOf:L=>od[L]}),G=t.allModels?.()??[],Y=fs(G.map(L=>({model:{packageName:L.packageName,modelId:L.modelId,edges:L.edges},introduced:L.introduced,fixedBefore:L.fixedBefore})),u),re=Y.models.length>0?Nt(v,Y.models).delta:null,ne=re!==null?{records:re.records,reachMods:dn(v),modulesById:new Map(v.modules.map(L=>[L.id,L]))}:null,$=[],Z=new Map,Q=Xh(),ce=[],Tn=[];for(let L of l.packages){let oe=C(L),se=(L.ecosystem??"npm")==="npm"?ne:null;for(let[,Ie]of tg(t.advisoriesForPackage(L.ecosystem??"npm",L.name))){let Ne=Ie[0];if(Ne!==void 0){let xe=Z.get(Ne.advisory.id),nn=Ie.map(De=>De.affected);xe===void 0?Z.set(Ne.advisory.id,{advisory:Ne.advisory,ranges:nn}):xe.ranges.push(...nn)}let pe=Ie.filter(xe=>rg(oe.graph,se,L,xe,oe.incompleteness,oe.analysisAborted,_)),en=pe.length>0?pe:Ie.slice(0,1),hn=pe.length===0;for(let{advisory:xe,affected:nn}of en){let De=zt(xe.id,L.name,nn),gn=xe.cveId??xe.id,Dn=hn?[]:t.symbolsForAffected(nn.id),ht=Dn.filter(ye=>ye.exportName===null),yn=ps(xe.id,L.name,Dn,nn.surfaceComplete,o),xn=Ut(oe.graph,se,{name:L.name,version:L.version,...L.ecosystem!==void 0?{ecosystem:L.ecosystem}:{},devOnly:L.dev,outOfGraphExecution:_(L)},De,null,oe.incompleteness,oe.analysisAborted).finding;if(xn.decidedAtStage==="presence"||xn.decidedAtStage==="version-match"){Q[xn.tier]+=1,$.push({...xn,modelId:void 0,modelPromotedFromKind:void 0,surfaceComplete:De.surfaceComplete,advisoryId:xe.id,displayId:gn,packageName:L.name,version:L.version,ecosystem:L.ecosystem??"npm",symbolName:null,symbolPath:null,severity:xe.severity,packageLocation:Ro(l,L)});continue}for(let ye of yn){let{finding:tn,hit:Ve}=Ut(oe.graph,se,{name:L.name,version:L.version,...L.ecosystem!==void 0?{ecosystem:L.ecosystem}:{},devOnly:L.dev,outOfGraphExecution:_(L)},De,ye,oe.incompleteness,oe.analysisAborted),z=og(tn,oe,L),ee,de;Ve!==null&&ye!==null&&(ee=Ve.modelId,de=tn.unknownKind,z={basis:void 0,tier:Ve.tier,decidedAtStage:tn.decidedAtStage,reason:`boundary model ${Ve.modelId}: ${Ve.anchorPackage}.${Ve.entryExport} reaches ${ye.exportName} [${Ve.pathLabels.join(" \u2192 ")}]`,unknownKind:void 0,attribution:no(ye),path:void 0,unresolvedSites:tn.unresolvedSites,unresolvedEvidence:tn.unresolvedEvidence}),Q[z.tier]+=1;let Re=Wl(J,z,ye,_(L).length,De.surfaceComplete),fe={...z,...Re!==void 0?{adr105:Re}:{},modelId:ee,modelPromotedFromKind:de,surfaceComplete:De.surfaceComplete,advisoryId:xe.id,displayId:gn,packageName:L.name,version:L.version,ecosystem:L.ecosystem??"npm",symbolName:ye?.exportName??null,symbolPath:ye?.sourcePath||null,severity:xe.severity,packageLocation:Ro(l,L)};$.push(fe);let ue=new Set(["dep-opaque","dynamic-load","dispatch"]);r!==null&&fe.tier==="unknown"&&fe.decidedAtStage==="symbol-reachable"&&fe.unknownKind!==void 0&&ue.has(fe.unknownKind)&&ye!==null&&ce.push({finding:fe,symbol:ye}),s!==null&&fe.tier==="unknown"&&ye!==null&&Tn.push({finding:fe,symbol:ye})}for(let ye of ht)Q.unknown+=1,$.push({modelId:void 0,modelPromotedFromKind:void 0,surfaceComplete:De.surfaceComplete,tier:"unknown",decidedAtStage:"symbol-reachable",reason:`advisory ${gn} carries a ${ye.symbolKind} pattern symbol; pattern matching is not evaluated yet`,unknownKind:"symbol-unsupported",attribution:void 0,basis:void 0,path:void 0,unresolvedSites:[],unresolvedEvidence:{own:[],sets:[]},advisoryId:xe.id,displayId:gn,packageName:L.name,version:L.version,ecosystem:L.ecosystem??"npm",symbolName:null,symbolPath:null,severity:xe.severity,packageLocation:Ro(l,L)})}}}for(let L of te)Q.unknown+=1,$.push({modelId:void 0,modelPromotedFromKind:void 0,surfaceComplete:void 0,tier:"unknown",decidedAtStage:"presence",reason:L.detail,attribution:void 0,basis:void 0,path:void 0,unresolvedSites:[],unresolvedEvidence:{own:[],sets:[]},advisoryId:gs,displayId:gs,packageName:L.kind,version:"",ecosystem:"npm",symbolName:null,symbolPath:null,severity:null,unknownKind:"coverage-gap",packageLocation:ml(l,L)});let Jn=Q["reachable-high"]+Q["reachable-medium"],R=e.failOnReachable===!0&&Jn>0,M=dg($,Q.unknown,e.failOnUnknown),B=e.requireCompleteDenial===!0&&$.some(L=>L.tier==="not-reachable"&&L.basis==="loader-assumption"),q=R||M||B?2:0,le;if(r!==null){let L=dn(v),oe=new Map(v.modules.map(Ie=>[Ie.id,Ie])),se=[];for(let{finding:Ie,symbol:Ne}of ce){let pe=Xo(v,oe,L,Ne,r,Vh);se.push({advisoryId:Ie.advisoryId,packageName:Ie.packageName,symbolName:Ie.symbolName,unknownKind:Ie.unknownKind??null,wouldPromote:pe!==null,...pe!==null?{anchorPackage:pe.anchorPackage,entryExport:pe.entryExport,viaPackages:pe.viaPackages,totalHops:pe.totalHops}:{}})}le={records:se}}let ge;if(s!==null&&e.modelShadow!==void 0){let L=e.modelShadow.widened===!0?"widened":"base",{models:oe,notes:se,dispositions:Ie}=fs(s,u,{shadowConsultDenylisted:!0}),{delta:Ne}=Nt(v,oe),pe=dn(v),en=new Map(v.modules.map(z=>[z.id,z])),hn=ig(v,en,pe),xe=ag(v),nn=Ne.records.some(z=>hn.some(ee=>ee.packageName===z.anchor.packageName&&ee.exportName===z.anchor.exportName&&ee.container===z.anchor.container)),De=[],gn=Date.now();for(let{finding:z,symbol:ee}of Tn){let de=Ne.records,Re=hs(z,ee,L),fe=Re?St(v,en,pe,ee,de):null,ue=Ne.records.filter($e=>$e.callee.packageName===ee.packageName&&$e.callee.exportName===ee.exportName&&$e.callee.container===ee.container||$e.callee.packageName===ee.packageName&&$e.callee.realFunctionId!==null);De.push({advisoryId:z.advisoryId,packageName:z.packageName,symbolName:z.symbolName,unknownKind:z.unknownKind??null,decidedAtStage:z.decidedAtStage,consultSurface:L,noHitReason:fe!==null?null:Re?nn?"no-key-match-no-continuation":"no-matching-anchor":"not-eligible-base",anchorFunctionEntryReachable:fe!==null?lg(fe,de,hn,xe):null,verdictBefore:z.tier,verdictAfter:fe!==null?"reachable-low":z.tier,wouldPromote:fe!==null,...fe!==null?{modelId:fe.modelId,anchorPackage:fe.anchorPackage,entryExport:fe.entryExport,pathLabels:fe.pathLabels,calleeBinding:ue.find($e=>$e.callee.realFunctionId!==null)?.callee.realFunctionId??"key:any-installed-in-range-copy"}:Re?ue.length>0?{reason:"model-covers-symbol-but-no-baseline-anchor",nearestBlockedHop:`anchor:${ue[0]?.anchor.packageName??"?"}#${ue[0]?.anchor.exportName??"?"} (no resolved|field-based baseline edge from a reachable module)`}:{reason:"no-model-coverage"}:{}})}let Dn=Date.now()-gn,ht=Ie.map(z=>{if(z.status!=="active")return{modelId:z.modelId,state:z.status,reason:z.reason,edgesLowered:0,edgesReferenceGated:0};let ee=Ne.records.filter(Re=>Re.modelId===z.modelId).length;if(ee>0)return{modelId:z.modelId,state:"lowered",reason:null,edgesLowered:ee,edgesReferenceGated:z.edgeCount-ee};let de=Ne.notes.find(Re=>Re.startsWith(`model ${z.modelId}:`)||Re.startsWith(`model-edge ${z.modelId}:`));return{modelId:z.modelId,state:"refused",reason:de??"refused \u2014 no anchor surface in the graph (all edges reference-gated)",edgesLowered:0,edgesReferenceGated:z.edgeCount}}),yn=De.filter(z=>z.wouldPromote).length,xn=Q.unknown-yn,ye=Q["reachable-high"]+Q["reachable-medium"],tn=z=>({none:0,"fail-on-reachable":ye>0?2:0,"fail-on-unknown":z>0?2:0,both:ye>0||z>0?2:0});ge={records:De,notes:[...se,...Ne.notes],laneStates:ht,exitCodes:{baseline:tn(Q.unknown),withModels:tn(xn)},overlayWallMs:Dn},Jl(mn.dirname(e.modelShadow.outPath),{recursive:!0});let Ve=`${e.modelShadow.outPath}.tmp-${Yl(8).toString("hex")}`;Ql(Ve,`${JSON.stringify(ge,null,2)}
-`,{encoding:"utf8",flag:"wx"}),Zl(Ve,e.modelShadow.outPath)}let Te;if(e.bindingShadow!==void 0){let L=Date.now(),oe=z=>Y.models.length>0?{records:Nt(z,Y.models).delta.records,reachMods:dn(z),modulesById:new Map(z.modules.map(ee=>[ee.id,ee]))}:null,se=(z,ee,de,Re)=>{let fe=[];for(let ue of l.packages)for(let{advisory:$e,affected:Ln}of t.advisoriesForPackage(ue.ecosystem??"npm",ue.name)){let Zn=zt($e.id,ue.name,Ln),Zd=ps($e.id,ue.name,t.symbolsForAffected(Ln.id),Ln.surfaceComplete,o);for(let Bs of Zd){let{finding:Ks,hit:Go}=Ut(z,Re,{name:ue.name,version:ue.version,...ue.ecosystem!==void 0?{ecosystem:ue.ecosystem}:{},devOnly:ue.dev,outOfGraphExecution:_(ue)},Zn,Bs,ee,de);fe.push({advisoryId:$e.id,packageName:ue.name,symbolName:Bs?.exportName??null,tier:Go!==null?Go.tier:Ks.tier,unknownKind:Go!==null?null:Ks.unknownKind??null})}}return fe},Ie=z=>{let ee=Dr({appRoot:n,entrypoints:y,depClassAnchors:I,bindingForms:z,callablePackageResolver:A,tsconfigPaths:k}),de=[...g.diagnostics,...Lr(g),...Fr(g,y.length),...Jr(a,x),...ee.diagnostics];return{graph:ee.graph,inc:nd(ee.graph,de,U),aborted:ed(y.length,ee.graph),live:oe(ee.graph),applicability:ee.bindingApplicability}},Ne=z=>{let ee=Ie(z);return se(ee.graph,ee.inc,ee.aborted,ee.live)},pe=Ie({}),en=se(pe.graph,pe.inc,pe.aborted,pe.live),hn=se(v,X,j,ne);if(hn.length!==en.length)throw new ln("--binding-shadow dual-run row counts diverged; refusing to write a misaligned diff");let xe=(z,ee)=>ee.tier!==z.tier||ee.unknownKind!==z.unknownKind,nn=en.some((z,ee)=>{let de=hn[ee];return de!==void 0&&xe(z,de)}),De=nn?Ne({additiveForms:!0}):null,gn=nn?Ne({namelessExports:!0}):null,Dn=0,ht=en.map((z,ee)=>{let de=hn[ee];if(de===void 0||de.advisoryId!==z.advisoryId||de.packageName!==z.packageName||de.symbolName!==z.symbolName)throw new ln("--binding-shadow dual-run row identities diverged; refusing to write a misaligned diff");let Re={advisoryId:z.advisoryId,packageName:z.packageName,symbolName:z.symbolName,unknownKind:z.unknownKind,verdictBefore:z.tier,verdictAfter:de.tier,wouldPromote:de.tier!==z.tier&&(de.tier==="reachable-high"||de.tier==="reachable-medium"||de.tier==="reachable-low")};if(!xe(z,de)||De===null||gn===null)return Re;Dn+=1;let fe=De[ee],ue=gn[ee],$e=fe!==void 0&&xe(z,fe),Ln=ue!==void 0&&xe(z,ue);return{...Re,attributedArm:$e&&!Ln?"additiveForms":Ln&&!$e?"namelessExports":"both",...fe!==void 0?{verdictArmA:fe.tier}:{},...ue!==void 0?{verdictArmB:ue.tier}:{}}}),yn={...Q};en.forEach((z,ee)=>{let de=hn[ee];de!==void 0&&de.tier!==z.tier&&(yn[de.tier]-=1,yn[z.tier]+=1)});let xn=(z,ee)=>({none:0,"fail-on-reachable":z>0?2:0,"fail-on-unknown":ee>0?2:0,both:z>0||ee>0?2:0}),ye;if(Y.models.length>0&&ne!==null){ye=[];for(let z of l.packages)for(let{advisory:ee,affected:de}of t.advisoriesForPackage(z.ecosystem??"npm",z.name)){let Re=zt(ee.id,z.name,de),fe=ps(ee.id,z.name,t.symbolsForAffected(de.id),de.surfaceComplete,o);for(let ue of fe){if(ue===null||!ue.verified)continue;let $e=Ut(pe.graph,pe.live,{name:z.name,version:z.version,...z.ecosystem!==void 0?{ecosystem:z.ecosystem}:{},devOnly:z.dev,outOfGraphExecution:_(z)},Re,ue,pe.inc,pe.aborted);if(!($e.hit===null&&hs($e.finding,ue,"base")))continue;let Zn=St(v,ne.modulesById,ne.reachMods,ue,ne.records);ye.push({advisoryId:ee.id,packageName:z.name,symbolName:ue.exportName,modelWouldPromote:Zn!==null,...Zn!==null?{modelId:Zn.modelId}:{},anchorCleared:Zn!==null})}}}let tn=$.some(z=>z.modelId!==void 0);Te={records:ht,deltas:Dn,exitCodes:{baseline:xn(yn["reachable-high"]+yn["reachable-medium"],yn.unknown+(tn?1:0)),withBindingForms:xn(Q["reachable-high"]+Q["reachable-medium"],Q.unknown+(tn?1:0))},dualRunWallMs:Date.now()-L,...P.bindingApplicability!==void 0?{applicability:P.bindingApplicability}:{},...ye!==void 0?{modelProbe:ye}:{}},Jl(mn.dirname(e.bindingShadow.outPath),{recursive:!0});let Ve=`${e.bindingShadow.outPath}.tmp-${Yl(8).toString("hex")}`;Ql(Ve,`${JSON.stringify(Te,null,2)}
-`,{encoding:"utf8",flag:"wx"}),Zl(Ve,e.bindingShadow.outPath)}let Qe=G.length>0||Y.notes.length>0?{active:Y.models.length,stored:G.length,promoted:$.filter(L=>L.modelId!==void 0).length,notes:[...Y.notes,...re!==null?re.notes:[]]}:void 0;return{...le!==void 0?{summaryShadow:le}:{},...ge!==void 0?{modelShadow:ge}:{},...Te!==void 0?{bindingShadow:Te}:{},...Qe!==void 0?{modelLane:Qe}:{},dir:n,shardSchemaVersion:t.schemaVersion,installed:l,findings:$,counts:Q,analyzerDiagnostics:N,pythonDiagnostics:i?.diagnostics??[],analysisAborted:K,rejectedEntries:m,entrypointSources:b,entrypointGaps:[...g.gaps,...g.surfaceGaps],entrypointObservations:g.observations,framework:g.framework,unresolved:T,advisories:[...Z.values()],rootSet:a,exitCode:q,adr105:J.report}}finally{e.reader===void 0&&t.close()}}var cg="cupel",ug="reachability-first SCA \u2014 verdict + call path + confidence";function xs(e){return[`${cg} v${e} \u2014 ${ug}`,`cascade: ${Ys.join(" \u2192 ")}`,`verdicts: ${Js.join(", ")}`,"","usage: cupel scan <dir> [--shard <npm.sqlite>] [--sarif <file>] [--fail-on-reachable] [--fail-on-unknown]","  --shard               path to the npm symbol shard (or set CUPEL_SHARD_NPM)","  --shard-pypi          path to the PyPI shard (or set CUPEL_SHARD_PYPI); Python distributions","                        found in a .venv are assessed against it, else reported as not assessed","  --sarif               also write a SARIF 2.1.0 report","  --fail-on-reachable   exit 2 when any reachable finding is present (for CI)","  --fail-on-unknown     exit 2 when any unknown verdict is present (strict CI)","","       cupel login     store a delivery token for this machine (read from stdin)","       cupel logout    forget it","  On GitHub Actions neither is needed: the workflow authenticates with a token GitHub","  signs per run. Elsewhere a scan fetches the advisory database with the stored token,","  or CUPEL_DELIVERY_TOKEN, or works offline from a shard you already have (--shard)."].join(`
-`)}var fg=new Set([...Qo,...er]);function wn(e,n,t){let o=e[n+1];if(o===void 0||o.startsWith("--"))throw new Error(`${t} requires a value`);return o}function pg(e){let n=e.split(",").map(r=>r.trim()),t=[...Qo,...er].join(", ");if(n.length===0||n.some(r=>r===""))throw new Error(`--fail-on-unknown= requires a non-empty comma-separated list of: ${t} (or pass the bare --fail-on-unknown to fail on every kind)`);let o=[];for(let r of n){if(!fg.has(r))throw new Error(`unknown --fail-on-unknown selector ${JSON.stringify(r)}; valid: ${t}`);o.push(r)}return o}function sd(e){let n=".",t,o,r,s=!1,a=!1,l=!1,i=!1,d=!1,u,p,f,m=!1,g=!1,y,b=!1,x=!0,I=!1,w,A=[],k=[];for(let h=0;h<e.length;h+=1){let S=e[h];if(S==="--require-complete-denial"){a=!0;continue}if(S==="--fail-on-reachable")s=!0;else if(S==="--fail-on-unknown")l="all";else if(S!==void 0&&S.startsWith("--fail-on-unknown="))l=pg(S.slice(18));else if(S==="--offline")i=!0;else if(S==="--sarif")t=wn(e,h,"--sarif"),h+=1;else if(S==="--shard")o=wn(e,h,"--shard"),h+=1;else if(S==="--shard-pypi")r=wn(e,h,"--shard-pypi"),h+=1;else if(S==="--entry")A.push(wn(e,h,"--entry")),h+=1;else if(S==="--root")k.push(wn(e,h,"--root")),h+=1;else if(S==="--summary-shadow")u=wn(e,h,"--summary-shadow"),h+=1;else if(S==="--model-shadow")p=wn(e,h,"--model-shadow"),h+=1;else if(S==="--model-shadow-out")f=wn(e,h,"--model-shadow-out"),h+=1;else if(S==="--model-shadow-widened")m=!0;else if(S==="--binding-shadow")g=!0;else if(S==="--binding-shadow-out")y=wn(e,h,"--binding-shadow-out"),h+=1;else if(S==="--x-partial-rows")b=!0;else if(S==="--no-tsconfig-paths")x=!1;else if(S==="--x-tsconfig-paths")x=!0;else if(S==="--push")I=!0;else if(S!==void 0&&S.startsWith("--auth=")){let _=S.slice(7);if(_!=="oidc"&&_!=="token")throw new Error(`--auth must be oidc or token, got ${JSON.stringify(_)}`);w=_}else{if(S!==void 0&&S.startsWith("--"))throw new Error(`unknown flag ${S}`);S!==void 0&&!d&&(n=S,d=!0)}}if(p===void 0!=(f===void 0))throw new Error("--model-shadow and --model-shadow-out must be given together");if(m&&p===void 0)throw new Error("--model-shadow-widened only means something with --model-shadow");if(g!==(y!==void 0))throw new Error("--binding-shadow and --binding-shadow-out must be given together");if(w!==void 0&&!I)throw new Error("--auth only means something with --push");return{dir:n,sarif:t,shard:o,shardPypi:r,failOnReachable:s,requireCompleteDenial:a,failOnUnknown:l,offline:i,entry:A,root:k,summaryShadow:u,modelShadow:p,modelShadowOut:f,modelShadowWidened:m,push:I,auth:w,bindingShadow:g,bindingShadowOut:y,partialRows:b,tsconfigPaths:x}}import{chmodSync as bg,mkdirSync as kg,readFileSync as Eg,renameSync as wg,statSync as vg,unlinkSync as Ig,writeFileSync as Ag}from"node:fs";import{randomBytes as _g}from"node:crypto";import{homedir as Ng}from"node:os";import Xn from"node:path";import{createPublicKey as mg,verify as hg}from"node:crypto";function Je(e,n){let t=new URL(e);if(t.protocol!=="https:")throw new Error(`refusing non-https url: ${e}`);if(t.username!==""||t.password!=="")throw new Error(`refusing url carrying userinfo for host ${t.hostname}`);if(t.port!=="")throw new Error(`refusing url with explicit port ${t.port} for host ${t.hostname}`);if(!n.has(t.hostname))throw new Error(`refusing unpinned host ${t.hostname} (allowed: ${[...n].join(", ")})`);if(t.origin!==`https://${t.hostname}`)throw new Error(`refusing non-canonical authority for host ${t.hostname}`);return t}async function id(e,n={}){let t=n.maxBytes??1073741824,o=n.timeoutMs??3e4,{get:r}=await import("node:https");return await new Promise((s,a)=>{let l=r(e,n.headers!==void 0?{headers:n.headers}:{},i=>{let d=i.statusCode??0;if(d<200||d>=300){i.resume(),a(new Error(`GET ${e} \u2192 HTTP ${String(d)}`));return}let u=[],p=0;i.on("data",f=>{if(p+=f.length,p>t){i.destroy(),a(new Error(`GET ${e} exceeded ${String(t)} bytes`));return}u.push(f)}),i.on("end",()=>{s(Buffer.concat(u))}),i.on("error",a)});l.on("error",a),l.setTimeout(o,()=>{l.destroy(new Error(`GET ${e} timed out after ${String(o)}ms`))})})}async function Vt(e,n,t,o,r,s=3e4){let{request:a}=await import("node:https"),l=new URL(n).hostname;return await new Promise((i,d)=>{let u=a(n,{method:e,headers:t},p=>{let f=[],m=0;p.on("data",g=>{if(m+=g.length,m>r){p.destroy(),d(new Error(`${e} to ${l} returned more than ${String(r)} bytes`));return}f.push(g)}),p.on("end",()=>{i({status:p.statusCode??0,body:Buffer.concat(f).toString("utf8")})}),p.on("error",()=>{d(new Error(`${e} to ${l} failed`))})});u.on("error",()=>{d(new Error(`${e} to ${l} failed`))}),u.setTimeout(s,()=>{u.destroy(new Error(`${e} to ${l} timed out after ${String(s)}ms`))}),o!==void 0&&u.write(o),u.end()})}var ie=class extends Error{constructor(n){super(n),this.name="DistError"}},Hn=class extends ie{constructor(n){super(n),this.name="NoCachedShardError"}},gg=Buffer.from("302a300506032b6570032100","hex"),yg=32;function cd(e){let n;try{n=Buffer.from(e,"base64")}catch{return}if(n.length===yg)try{return mg({key:Buffer.concat([gg,n]),format:"der",type:"spki"})}catch{return}}function Ss(e,n,t){for(let o of t){let r=cd(o);if(r!==void 0)try{if(hg(null,e,r,n))return!0}catch{}}return!1}function ud(e){return e.some(n=>cd(n)!==void 0)}var xg=/^[0-9a-f]{64}$/u,Sg=/^[a-z0-9-]+$/u;function ad(e,n){if(typeof e!="object"||e===null||Array.isArray(e))throw new ie(`${n} must be an object`);return e}function ld(e,n){if(!Array.isArray(e))throw new ie(`${n} must be an array`);return e}function Do(e,n){if(typeof e!="number"||!Number.isInteger(e))throw new ie(`${n} must be an integer`);return e}function Lo(e,n){if(typeof e!="string")throw new ie(`${n} must be a string`);return e}function dd(e,n){let t=Lo(e,n);if(Number.isNaN(Date.parse(t)))throw new ie(`${n} is not a valid timestamp: ${t}`);return t}function bs(e,n){let t;try{t=JSON.parse(e.toString("utf8"))}catch{throw new ie("distribution index is not valid JSON")}let o=ad(t,"index"),r=Do(o.schema_version,"schema_version");if(r!==n.supportedIndexSchemaVersion)throw new ie(`index schema_version ${String(r)} is not understood (this cupel speaks ${String(n.supportedIndexSchemaVersion)})`);let s=Do(o.sequence,"sequence");if(s<0)throw new ie("sequence must be non-negative");let a=dd(o.generated,"generated"),l=ld(o.shards,"shards"),i;for(let g of l){let y=ad(g,"shard entry"),b=Lo(y.ecosystem,"ecosystem");if(!Sg.test(b))throw new ie(`ecosystem ${JSON.stringify(b)} is malformed`);if(b===n.ecosystem){i=y;break}}if(i===void 0)throw new ie(`no shard for ecosystem ${JSON.stringify(n.ecosystem)}`);dd(i.built,"built");let d=Do(i.db_schema_version,"db_schema_version");if(d<1)throw new ie("db_schema_version must be >= 1");if(d>n.supportedDbSchemaVersion)throw new ie(`this shard needs a newer cupel (db_schema_version ${String(d)} > supported ${String(n.supportedDbSchemaVersion)}); upgrade cupel (npm i -g @cupel-sh/cli) or pass an older --shard`);let u=Lo(i.sha256,"sha256");if(!xg.test(u))throw new ie(`sha256 must be 64 lowercase hex, got ${JSON.stringify(u)}`);let p=Do(i.size_bytes,"size_bytes");if(p<=0||p>n.hardMaxBytes)throw new ie(`size_bytes ${String(p)} out of bounds (0, ${String(n.hardMaxBytes)}]`);let f=ld(i.urls,"urls");if(f.length===0)throw new ie("urls must be a non-empty array");let m=[];for(let g of f){let y=Lo(g,"url");try{m.push(Je(y,n.shardHosts))}catch(b){throw new ie(`refusing shard url ${JSON.stringify(y)}: ${b.message}`)}}return{ecosystem:n.ecosystem,sha256:u,sizeBytes:p,dbSchemaVersion:d,urls:m,sequence:s,generated:a}}var fd="CUPEL_CONFIG_DIR",pd="credentials.json",ks="cpd_",Rg="cpl_",Pg=ks.length+6+32,$g=200,Og=/^[A-Za-z0-9_-]+$/u,qt=class extends ie{constructor(n){super(n),this.name="StoredCredentialError"}};function md(e){let n=e.CUPEL_CONFIG_DIR;if(n!==void 0&&n!=="")return n;let t=Ng();if(process.platform==="darwin")return Xn.join(t,"Library","Application Support","cupel");if(process.platform==="win32"){let s=e.APPDATA,a=s!==void 0&&s!==""?s:Xn.join(t,"AppData","Roaming");return Xn.join(a,"cupel")}let o=e.XDG_CONFIG_HOME,r=o!==void 0&&o!==""?o:Xn.join(t,".config");return Xn.join(r,"cupel")}function Fo(e){return Xn.join(md(e),pd)}function Es(e){let n=e.trim();return n.startsWith(Rg)?{ok:!1,reason:"push-token"}:n.startsWith(ks)?n.length<Pg||n.length>$g?{ok:!1,reason:"malformed"}:Og.test(n.slice(ks.length))?{ok:!0,token:n}:{ok:!1,reason:"malformed"}:{ok:!1,reason:"malformed"}}function hd(e,n){let t=md(e),o=Xn.join(t,pd);kg(t,{recursive:!0,mode:448}),process.platform!=="win32"&&bg(t,448);let r=JSON.stringify({version:1,delivery_token:n,written_at:new Date().toISOString()}),s=`${o}.tmp-${_g(8).toString("hex")}`;return Ag(s,`${r}
-`,{flag:"wx",mode:384}),wg(s,o),o}function gd(e){let n=Fo(e),t;try{t=vg(n)}catch(a){if(a instanceof Error&&a.code==="ENOENT")return;throw a}if(process.platform!=="win32"&&(t.mode&63)!==0)throw new qt(`the stored delivery token at ${n} is readable by other users \u2014 run \`chmod 600 ${n}\`, or \`cupel login\` again to rewrite it`);let o;try{o=JSON.parse(Eg(n,"utf8"))}catch{throw new qt(`the stored delivery token at ${n} is not readable \u2014 run \`cupel login\` again to rewrite it`)}let r=typeof o=="object"&&o!==null&&"delivery_token"in o?o.delivery_token:void 0,s=Es(typeof r=="string"?r:"");if(!s.ok)throw new qt(`the stored credential at ${n} is not a delivery token \u2014 run \`cupel login\` with one from app.cupel.sh (Settings \u2192 Tokens)`);return s.token}function yd(e){try{return Ig(Fo(e)),!0}catch(n){if(n instanceof Error&&n.code==="ENOENT")return!1;throw n}}var Gt="CUPEL_DELIVERY_TOKEN",ws=class extends ie{constructor(n){super(n),this.name="NoDeliveryTokenError"}},vs=class extends ie{constructor(n){super(n),this.name="DeliveryCredentialError"}};function Cg(e){let n=e.CUPEL_DELIVERY_TOKEN;return n===void 0||n===""?void 0:n}function xd(e,n,t=()=>{}){let o=Cg(e)??t();return o!==void 0?()=>Promise.resolve(o):e.ACTIONS_ID_TOKEN_REQUEST_URL!==void 0&&e.ACTIONS_ID_TOKEN_REQUEST_URL!==""?n:void 0}async function Sd(e){if(e===void 0)throw new ws(`no delivery credential \u2014 on GitHub Actions add \`permissions: id-token: write\` to the workflow; elsewhere run \`cupel login\` with a delivery token from app.cupel.sh (Settings \u2192 Tokens), or set ${Gt} in CI; or pass --shard <path> (a local shard needs no account)`);try{return await e()}catch(n){throw new vs(`could not obtain a delivery credential: ${n instanceof Error?n.message:String(n)}`)}}var Mg="Paste a delivery token from app.cupel.sh (Settings \u2192 Tokens); input is hidden: ";function Tg(){return new Promise(e=>{let n=process.stdin;process.stderr.write(Mg),n.setRawMode(!0),n.resume(),n.setEncoding("utf8");let t="",o=s=>{n.setRawMode(!1),n.pause(),n.removeListener("data",r),process.stderr.write(`
-`),s===null&&process.exit(130),e(s)},r=s=>{for(let a of s){if(a==="")return o(null);if(a==="\r"||a===`
-`)return o(t);if(a==="\x7F"||a==="\b"){t=t.slice(0,-1);continue}t+=a}};n.on("data",r)})}async function Dg(){let e=[];for await(let t of process.stdin)e.push(Buffer.isBuffer(t)?t:Buffer.from(String(t),"utf8"));return Buffer.concat(e).toString("utf8").split(/\r?\n/u).find(t=>t.trim()!=="")??""}function bd(e,n){let t=e[0];return t===void 0?!1:(process.stderr.write(`cupel ${n}: unknown option '${W(t)}' \u2014 the token is read from standard input, never from an argument (it would land in shell history and \`ps\`)
-`),!0)}async function kd(e){if(bd(e,"login"))return 1;let n=process.stdin.isTTY?await Tg():await Dg(),t=Es(n);if(!t.ok)return process.stderr.write(t.reason==="push-token"?`cupel login: that is a push token (cpl_\u2026), which authenticates one repository's findings push and is set as CUPEL_TOKEN in CI. Sign in with a delivery token (cpd_\u2026) from app.cupel.sh \u2014 Settings \u2192 Tokens \u2014 which fetches the advisory database for the whole organisation.
+`:"",encoding:"utf8",maxBuffer:uy,timeout:n.timeoutMs??fy,env:t});if(a.error!==void 0){let m=a.error.code,h=m==="ENOENT";return{refused:h?"no-interpreter":"script-failed",interpreter:null,files:[],stdlib:[],diagnostics:[...o,h?`no Python interpreter: \`${r}\` is not on PATH (set ${gc} to the interpreter this project runs under)`:`the Python extract could not run (${m??a.error.message})`]}}if(a.status!==0){let m=(a.stderr??"").slice(-400).trim();return{refused:"script-failed",interpreter:null,files:[],stdlib:[],diagnostics:[...o,`the Python extract exited ${String(a.status??"on a signal")}${m!==""?`: ${m}`:""}`]}}let d=(a.stdout??"").split(`
+`).filter(m=>m.trim()!==""),l=null,c=[],p=[];for(let m of d){let h;try{h=JSON.parse(m)}catch{o.push("the Python extract emitted a line that is not JSON; it was skipped");continue}if(!Yn(h))continue;if(h.kind==="header"){l=ve(h.interpreter,64);let y=h.stdlib;Array.isArray(y)&&(c=y.filter(S=>typeof S=="string"&&S.length<=128));continue}let x=gy(h);if(x===null){o.push("the Python extract emitted a file row without a path; it was skipped");continue}p.push(x)}if(l===null)return{refused:"unreadable-output",interpreter:null,files:[],stdlib:[],diagnostics:[...o,"the Python extract did not report an interpreter version"]};let u=s.length-p.length;return u>0&&o.push(`${String(u)} file(s) asked for produced no row \u2014 treat the extract as incomplete`),{refused:null,interpreter:l,files:p,stdlib:c,diagnostics:o}}var xy="python3",Sy={"loader-escape":"dynamic-load","dynamic-load-set":"dynamic-load","module-registry-write":"dynamic-load","unresolved-import":"resolution-divergence","file-refused":"analysis-cap","module-cap":"analysis-cap","extract-refused":"analysis-cap"};function by(e,n,t=r=>xo([],{python:r}).refused===null){let r=ht.resolve(e,n.envRel);for(let o of["bin/python3","bin/python","Scripts/python.exe"]){let s=ht.join(r,o);try{if(!yy(s).isFile())continue}catch{continue}if(t(s))return s}return xy}function ky(e,n){let t=[e];for(let r of n.sitePackages)t.push(ht.resolve(e,r));for(let r of n.pthFiles)for(let o of r.paths)t.push(ht.isAbsolute(o)?o:ht.resolve(e,r.sitePackages,o));return{roots:[...new Set(t)]}}function wy(e){let n=[];for(let t of e.distInfos){let r=ar(t.metadata,{...t.topLevel!==void 0?{topLevelText:t.topLevel}:{},...t.record!==void 0?{recordText:t.record}:{},...t.directUrl!==void 0?{directUrlText:t.directUrl}:{},...t.entryPoints!==void 0?{entryPointsText:t.entryPoints}:{},...t.entryPointsUnknown===!0?{entryPointsUnknown:!0}:{}});r!==null&&n.push(r)}return n}function Ey(e){return n=>{let t=e.byImportName.get(n);return t===void 0||t.length===0?null:t.length===1?t[0]?.name??null:null}}function vy(e,n,t={}){let o=(t.readEnvironment??ur)(n),s=wy(o),i=Us(s),a=o.diagnostics.map(S=>S),d=t.python??by(n,o),l=ky(n,o),c=Ny(o,i,l),p=new Map;for(let S of s)p.set(S.name,Iy(S,c.distributions));for(let S of c.seen)a.push(`startup hook: ${S}`);for(let S of c.unattributed)a.push(`startup escape: ${S} \u2014 a module runs at interpreter start that no installed distribution claims`);let u=yi({projectRoot:n,paths:l,python:d});for(let S of u.gaps)a.push(`entrypoint \`${S.declaration}\` (${S.source}): ${S.detail}`);if(u.entrypoints.length===0)return a.push("no Python entrypoint was found (no console script, `__main__.py`, `manage.py` or launch declaration resolved), so no Python dependency can be reported unreachable"),{rootRel:e,graph:jt,incompleteness:[],analysisAborted:"no-entrypoint",entrypoints:[],entrypointGaps:u.gaps,interpreter:null,diagnostics:a,execution:p};let m=hi({projectRoot:n,paths:l,entryFiles:u.entrypoints.map(S=>ht.join(n,S.file)),environmentComplete:!o.truncated&&o.refused===null,externalRoots:o.sitePackages.map(S=>ht.resolve(n,S)),distributionOf:Ey(i),python:d,...t.maxModules!==void 0?{maxModules:t.maxModules}:{}});for(let S of m.diagnostics)a.push(`${S.code} at ${S.where}: ${S.detail}`);if(m.graph.modules.length===0)return{rootRel:e,graph:jt,incompleteness:[],analysisAborted:"analyzer-crash",entrypoints:u.entrypoints,entrypointGaps:u.gaps,interpreter:m.interpreter,diagnostics:a,execution:p};let h=new Map;for(let S of m.graph.modules)h.set(S.id,S.id),h.set(S.path,S.id);let x=m.graph.modules[0]?.id,y=m.diagnostics.map(S=>({source:h.get(S.where)??x,cause:Sy[S.code],reach:{kind:"unbounded"}}));return c.unattributed.length>0&&y.push({source:x,cause:"dynamic-load",reach:{kind:"unbounded"}}),{rootRel:e,graph:m.graph,incompleteness:y,analysisAborted:null,entrypoints:u.entrypoints,entrypointGaps:u.gaps,interpreter:m.interpreter,diagnostics:a,execution:p}}var jt={modules:[],exports:[],imports:[],functions:[],callSites:[],classes:[],callEdges:[],importEdges:[],exportBindings:[],inheritEdges:[]};function _y(e){if(e.length===0)return null;let n=[],t=new Map;for(let S of e){let k=S.rootRel===""?".":S.rootRel;for(let E of S.diagnostics)n.push(`${k}: ${E}`);for(let[E,g]of S.execution){let b=t.get(E);t.set(E,b===void 0?g:[...new Set([...b,...g])])}}let r=e.filter(S=>S.analysisAborted===null);if(r.length===0)return{graph:jt,incompleteness:[],analysisAborted:e[0]?.analysisAborted??"no-entrypoint",roots:e,diagnostics:n,execution:t};let o=[],s=[],i=[],a=[],d=[],l=[],c=[],p=[],u=[],m=[],h=[],x=new Set;for(let S of r){let k=S.rootRel===""?"":`${S.rootRel}::`,E=new Set(S.graph.modules.filter(_=>_.externalSurface===!0).map(_=>_.id)),g=_=>E.has(_)?_:`${k}${_}`,b=_=>`${k}${_}`,w=_=>`${k}${_}`,I=_=>`${k}${_}`,N=_=>`${k}${_}`,v=_=>`${k}${_}`;for(let _ of S.graph.modules){if(_.externalSurface===!0){if(x.has(_.id))continue;x.add(_.id),o.push(_);continue}o.push({..._,id:g(_.id)})}for(let _ of S.graph.imports)s.push({..._,id:b(_.id),moduleId:g(_.moduleId),..._.resolvedModuleId!==void 0?{resolvedModuleId:g(_.resolvedModuleId)}:{}});for(let _ of S.graph.importEdges)i.push({importId:b(_.importId),resolvedModuleId:g(_.resolvedModuleId)});for(let _ of S.incompleteness)h.push({..._,source:g(_.source)});for(let _ of S.graph.functions)a.push({..._,id:w(_.id),moduleId:g(_.moduleId),..._.enclosingClassId!==void 0?{enclosingClassId:I(_.enclosingClassId)}:{}});for(let _ of S.graph.classes)d.push({..._,id:I(_.id),moduleId:g(_.moduleId),members:_.members.map(w)});for(let _ of S.graph.exports)l.push({..._,id:v(_.id),moduleId:g(_.moduleId)});for(let _ of S.graph.exportBindings)c.push({exportId:v(_.exportId),target:_.target.kind==="function"?{kind:"function",functionId:w(_.target.functionId)}:{kind:"module",moduleId:g(_.target.moduleId)}});for(let _ of S.graph.callSites)p.push({..._,id:N(_.id),enclosingFunctionId:w(_.enclosingFunctionId),resolvedTargetIds:_.resolvedTargetIds.map(w)});for(let _ of S.graph.callEdges)u.push({..._,callSiteId:N(_.callSiteId),calleeFunctionId:w(_.calleeFunctionId)});for(let _ of S.graph.inheritEdges)m.push({..._,subclassId:I(_.subclassId),superclassId:I(_.superclassId)})}let y=o[0]?.id;for(let S of e)S.analysisAborted===null||y===void 0||h.push({source:y,cause:S.analysisAborted==="no-entrypoint"?"no-entrypoint":"analysis-cap",reach:{kind:"unbounded"}});return{graph:{modules:o,imports:s,importEdges:i,functions:a,classes:d,exports:l,exportBindings:c,callSites:p,callEdges:u,inheritEdges:m},incompleteness:h,analysisAborted:null,roots:e,diagnostics:n,execution:t}}function yc(e,n={}){let t=e.filter(r=>cr(r));return t.length===0?null:_y(t.map(r=>vy(r.rel,r.abs,n)))}function Iy(e,n){let t=[];return e.consoleScripts==="declared"&&t.push("bin"),e.extensionModules>0&&t.push("native-artifact"),n.has(e.name)&&t.push("install-script"),(e.consoleScripts==="unknown"||!e.recordKnown)&&t.push("manifest-unreadable"),t}var Ay=["sitecustomize","usercustomize"];function Ny(e,n,t){let r=new Set,o=[],s=[];for(let i of e.pthFiles){for(let d of i.importModules){let l=uo(n,d);for(let p of l)r.add(p.name);let c=Hn(t,d);if(c.resolved!==null){s.push(`${i.sitePackages}/${i.name}: \`import ${d}\` runs ${c.resolved.path}`);continue}l.length===0&&o.push(`${i.sitePackages}/${i.name}: \`import ${d}\``)}let a=i.importModules.length;i.importLines>a&&o.push(`${i.sitePackages}/${i.name}: ${String(i.importLines-a)} import line(s) whose module could not be read`)}for(let i of Ay){let a=Hn(t,i);if(a.resolved===null)continue;let d=uo(n,i);for(let l of d)r.add(l.name);d.length===0?o.push(`${a.resolved.path}: \`import ${i}\` runs at every interpreter start`):s.push(`${i}: \`import ${i}\` runs ${a.resolved.path}`)}return{distributions:r,unattributed:o,seen:s}}import{readdirSync as Ry,readFileSync as Py}from"node:fs";import Oy from"node:path";var $y=new Set(["summarized","crashed","over-cap"]),Cy=new Set(["function","method","ctor"]);function _e(e,n){throw new Error(`summary facts file ${e}: ${n}`)}function xi(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function My(e,n){xi(e)||_e(n,"edge is not an object");let{entryPath:t,entryExport:r,entryContainer:o,hops:s}=e;(typeof t!="string"||typeof r!="string")&&_e(n,"edge entry fields must be strings"),o!==null&&typeof o!="string"&&_e(n,"entryContainer must be string or null"),(typeof s!="number"||!Number.isInteger(s)||s<0)&&_e(n,"hops must be a non-negative integer");let i=e.target;if(xi(i)||_e(n,"edge target missing"),i.kind==="symbol"){let{exportName:a,container:d,symbolKind:l}=i;return typeof a!="string"&&_e(n,"symbol target exportName"),d!==null&&typeof d!="string"&&_e(n,"symbol target container"),(typeof l!="string"||!Cy.has(l))&&_e(n,`symbol target kind ${JSON.stringify(l)}`),{entryPath:t,entryExport:r,entryContainer:o,target:{kind:"symbol",exportName:a,container:d,symbolKind:l},hops:s}}if(i.kind==="dep"){let{calleePackage:a,calleeSubpath:d,calleeExport:l}=i;return(typeof a!="string"||a.length===0)&&_e(n,"dep target calleePackage"),d!==null&&typeof d!="string"&&_e(n,"dep target calleeSubpath"),(typeof l!="string"||l.length===0)&&_e(n,"dep target calleeExport"),{entryPath:t,entryExport:r,entryContainer:o,target:{kind:"dep",calleePackage:a,calleeSubpath:d,calleeExport:l},hops:s}}_e(n,`unknown target kind ${JSON.stringify(i.kind)}`)}function Ty(e,n){xi(e)||_e(n,"root is not an object");let{packageName:t,analyzedVersion:r,tool:o,toolVersion:s,maxIndirections:i,status:a}=e;(typeof t!="string"||t.length===0)&&_e(n,"packageName"),typeof r!="string"&&_e(n,"analyzedVersion"),o!=="jelly"&&_e(n,`tool ${JSON.stringify(o)} (only 'jelly' exists)`),typeof s!="string"&&_e(n,"toolVersion"),typeof i!="number"&&_e(n,"maxIndirections"),(typeof a!="string"||!$y.has(a))&&_e(n,`status ${JSON.stringify(a)} not in the enum`);let d=e.edges;return Array.isArray(d)||_e(n,"edges is not an array"),a!=="summarized"&&d.length>0&&_e(n,`status='${a}' with edges (CS-W6: edge rows only under summarized)`),{packageName:t,analyzedVersion:r,tool:o,toolVersion:s,maxIndirections:i,status:a,edges:d.map(l=>My(l,n))}}function xc(e){let n=new Map,t=Ry(e).filter(r=>r.endsWith(".summary.json"));for(let r of t){let o=Oy.join(e,r),s;try{s=JSON.parse(Py(o,"utf8"))}catch(d){_e(r,`unparseable JSON: ${d instanceof Error?d.message:String(d)}`)}let i=Ty(s,r),a=n.get(i.packageName);a===void 0?n.set(i.packageName,[i]):a.push(i)}return n}var Dy=12,Jn={maxFindings:2e4,maxPathSteps:512,maxUnresolvedSites:131072,maxStringLength:4096,maxReasonLength:8192,maxAdvisories:2e4,maxAdvisoryRanges:64,maxAdvisoryDetails:8e3,maxReachNodes:512,maxReachEdges:2048,maxPackageGraphNodes:256,maxPackageGraphEdges:1024,maxPackageGraphs:2e4,maxSourcePosition:1e7},jn=class extends Error{constructor(n){super(n),this.name="PayloadError"}};function bi(e){return{path:e.path,start:e.start,end:e.end}}function Ly(e){if(e.tier==="unknown"&&e.unknownKind===void 0)throw new jn(`finding ${e.advisoryId} is unknown with no kind \u2014 an unknown without its kind is a hedge`);let n=e.tier==="unknown"?e.unknownKind:null,t=e.modelId??null,r=e.modelPromotedFromKind??null;if(t===null!=(r===null))throw new jn(`finding ${e.advisoryId} carries half a model provenance \u2014 the model and the kind it promoted from travel together`);if(t!==null&&e.tier!=="reachable-low")throw new jn(`finding ${e.advisoryId} claims model provenance on ${e.tier}; only reachable-low can`);return{advisoryId:e.advisoryId,displayId:e.displayId,packageName:e.packageName,packageVersion:e.version,ecosystem:e.ecosystem,symbolName:e.symbolName,symbolContainer:e.symbolContainer,symbolPath:e.symbolPath,severity:e.severity,tier:e.tier,reason:e.reason,unknownKind:n,unknownOwner:n===null?null:wa(n),basis:e.basis??null,path:Fy(e),unresolvedSites:e.unresolvedEvidence.own.map(bi),unresolvedSets:[...e.unresolvedEvidence.sets],modelId:t,modelPromotedFromKind:r,surfaceComplete:e.surfaceComplete??null,reach:jy(e),introducedBy:e.introducedBy??null,influence:e.influence===void 0?null:{value:e.influence.value,kind:e.influence.kind,owner:Gt[e.influence.kind],sourceClass:null,mode:null,trigger:null,contractProvenance:null,witness:null}}}function Sc(e){return e===null?null:{line:e.line,column:e.column}}function Fy(e){if(e.path===void 0)return null;let n=e.located?.path??null;return n!==null&&n.length===e.path.length?n.map((t,r)=>({functionName:e.path?.[r]?.functionName??null,modulePath:t.modulePath,line:t.line,column:t.column,callSite:Sc(t.callSite)})):e.path.map(t=>({functionName:t.functionName??null,modulePath:t.modulePath,line:null,column:null,callSite:null}))}function jy(e){let n=e.located?.reach??null;return n===null?null:{nodes:n.nodes.map(t=>({id:t.id,functionName:t.functionName,modulePath:t.modulePath,line:t.line,column:t.column})),edges:n.edges.map(t=>({from:t.from,to:t.to,callSite:Sc(t.callSite)})),truncated:n.truncated}}var Si="";function By(e){let n=[e.advisoryId,e.packageName,e.packageVersion,e.symbolName??""];if(e.ecosystem==="npm")return n.join(Si);let{symbolContainer:t,symbolPath:r}=e;return t===null&&r===null?[...n,e.ecosystem].join(Si):[...n,e.ecosystem,t??"",r??""].join(Si)}function Ky(e){let n=new Map;for(let t of e){let r=By(t),o=n.get(r);if(o===void 0){n.set(r,t);continue}if(o.tier!==t.tier||o.unknownKind!==t.unknownKind)throw new jn(`the scan produced two different verdicts for ${t.advisoryId} on ${t.packageName}@${t.packageVersion}${t.symbolName===null?"":` (${t.symbolName})`}: ${o.tier} and ${t.tier}. They share one finding identity, so only the second would be stored \u2014 refusing to push rather than let a verdict be dropped. This is a cupel bug; please report it.`)}return[...n.values()]}function Uy(e){let n=Jn,t=(r,o,s)=>{throw new jn(`${r} has ${String(o)} entries, over the ${String(s)} the control plane accepts`)};e.findings.length>n.maxFindings&&t("the findings list",e.findings.length,n.maxFindings);for(let r of["dispatch","load"]){let o=e.unresolved[r].length;o>n.maxUnresolvedSites&&t(`the app-global ${r} set`,o,n.maxUnresolvedSites)}for(let r of e.findings)r.path!==null&&r.path.length>n.maxPathSteps&&t(`the call path of finding ${r.advisoryId}`,r.path.length,n.maxPathSteps),r.reach!==null&&r.reach.nodes.length>n.maxReachNodes&&t(`the reach graph of finding ${r.advisoryId}`,r.reach.nodes.length,n.maxReachNodes),r.reach!==null&&r.reach.edges.length>n.maxReachEdges&&t(`the reach graph's calls of finding ${r.advisoryId}`,r.reach.edges.length,n.maxReachEdges),r.unresolvedSites.length>n.maxUnresolvedSites&&t(`the unresolved sites of finding ${r.advisoryId}`,r.unresolvedSites.length,n.maxUnresolvedSites);e.packageGraphs.length>n.maxPackageGraphs&&t("the package graphs list",e.packageGraphs.length,n.maxPackageGraphs);for(let r of e.packageGraphs)r.nodes.length>n.maxPackageGraphNodes&&t(`package graph ${r.id}`,r.nodes.length,n.maxPackageGraphNodes),r.edges.length>n.maxPackageGraphEdges&&t(`the links of package graph ${r.id}`,r.edges.length,n.maxPackageGraphEdges);e.advisories.length>n.maxAdvisories&&t("the advisories list",e.advisories.length,n.maxAdvisories);for(let r of e.advisories){if(r.ranges.length>n.maxAdvisoryRanges&&t(`the ranges of advisory ${r.id}`,r.ranges.length,n.maxAdvisoryRanges),r.summary!==null&&r.summary.length>n.maxStringLength)throw new jn(`the summary of advisory ${r.id} is ${String(r.summary.length)} characters, over the ${String(n.maxStringLength)} the control plane accepts`);if(r.details!==null&&r.details.length>n.maxAdvisoryDetails)throw new jn(`the description of advisory ${r.id} is ${String(r.details.length)} characters, over the ${String(n.maxAdvisoryDetails)} the control plane accepts`)}}function zy(e,n){let t=new Set(n.map(r=>r.advisoryId));return e.advisories.filter(r=>t.has(r.advisory.id)).map(r=>({id:r.advisory.id,cveId:r.advisory.cveId,osvId:r.advisory.osvId,summary:r.advisory.summary,details:r.advisory.details??null,severity:r.advisory.severity,published:r.advisory.published,source:r.advisory.source,ranges:r.ranges.map(o=>({packageName:o.packageName,introduced:o.introduced,fixed:o.fixed,lastAffected:o.lastAffected}))}))}function Gy(e,n){let t=new Set(n.flatMap(r=>r.introducedBy===null?[]:[r.introducedBy]));return(e.packageGraphs??[]).filter(r=>t.has(r.id)).map(r=>({id:r.id,nodes:r.nodes.map(o=>({id:o.id,name:o.name,version:o.version,direct:o.direct,declaredIn:o.declaredIn===null?null:{path:o.declaredIn.path,line:o.declaredIn.line}})),edges:r.edges.map(o=>({from:o.from,to:o.to})),truncated:r.truncated}))}function bc(e,n){let t=Ky(e.findings.map(Ly)),r={version:Dy,scanId:n.scanId,scannedAt:n.scannedAt,context:{shardSequence:n.shardSequence,shardSchemaVersion:e.shardSchemaVersion,ecosystem:n.ecosystem,analysisAborted:e.analysisAborted,entrypointCount:e.entrypointSources.length,installedPackageCount:e.installed.packages.length},findings:t,unresolved:{dispatch:e.unresolved.dispatch.map(bi),load:e.unresolved.load.map(bi)},advisories:zy(e,t),packageGraphs:Gy(e,t)};return Uy(r),r}function kc(e){let n=new Set(e.installed.packages.map(r=>r.ecosystem??"npm")),t=["npm","PyPI"].filter(r=>n.has(r));return t.length===0?"npm":t.join("+")}var wi=class{#n;#t;#e=new Map;constructor(n,t){this.#n=n,this.#t=t}point(n,t){if(!Number.isInteger(t)||t<0)return null;let r=this.#r(n);if(r===null)return null;let o=(typeof r.text=="string",r.text.length);if(t>o)return null;let s=0,i=r.starts.length-1;for(;s<i;){let p=s+i+1>>1;(r.starts[p]??0)<=t?s=p:i=p-1}let a=r.starts[s]??0,d=typeof r.text=="string"?t-a+1:r.text.subarray(a,t).toString("utf8").length+1,l=s+1,c=Jn.maxSourcePosition;return l>c||d>c?null:{line:l,column:d}}#r(n){let t=this.#e.get(n);if(t!==void 0)return t;let r=this.#n.read(n),o=null;if(r!==null){let s=[0];if(this.#t==="utf8-bytes"){for(let i=0;i<r.length;i+=1)r[i]===10&&s.push(i+1);o={text:r,starts:s}}else{let i=r.toString("utf8");for(let a=0;a<i.length;a+=1)i.charCodeAt(a)===10&&s.push(a+1);o={text:i,starts:s}}}return this.#e.set(n,o),o}},yr=class{#n;#t;#e;#r;#s;#i;constructor(n,t,r,o){this.#n=n,this.#t=new wi(t,r),this.#e=o,this.#r=new Map(n.functions.map(s=>[s.id,s])),this.#s=new Map(n.modules.map(s=>[s.id,s])),this.#i=new Map(n.callSites.map(s=>[s.id,s]))}locate(n){let t=n.path;if(t===void 0||t.length===0)return{path:null,reach:null};let r=t.map((i,a)=>{let d=this.#r.get(i.functionId),l=d===void 0?"":this.#e(d.moduleId),c=d===void 0?null:this.#o(l,d.declRange),p=t[a+1]?.calledAt??null;return{modulePath:ki(l,i.modulePath),line:c?.line??null,column:c?.column??null,callSite:p===null?null:this.#o(l,p)}}),o=t[t.length-1]?.functionId,s=o===void 0?null:Ko(this.#n,o,n.tier==="reachable-medium");return{path:r,reach:s===null?null:this.#a(s)}}#a(n){let t=Wy(n),r=new Map(n.functions.slice(0,t).map((i,a)=>[i.functionId,a])),o=n.functions.slice(0,t).map((i,a)=>{let d=this.#r.get(i.functionId),l=d===void 0?void 0:this.#s.get(d.moduleId),c=d===void 0?"":this.#e(d.moduleId),p=d===void 0?null:this.#o(c,d.declRange);return{id:`n${String(a)}`,functionName:d?.name??null,modulePath:ki(c,l?.path??""),line:p?.line??null,column:p?.column??null}}),s=n.edges.flatMap(i=>{let a=r.get(i.from),d=r.get(i.to);if(a===void 0||d===void 0)return[];let l=this.#i.get(i.site),c=this.#r.get(i.from),p=c===void 0?"":this.#e(c.moduleId);return[{from:`n${String(a)}`,to:`n${String(d)}`,callSite:l===void 0?null:this.#o(p,l.range)}]});return{nodes:o,edges:s,truncated:n.functions.length-t}}#o(n,t){return t.path===""?null:this.#t.point(ki(n,t.path),t.start)}};function Wy(e){let n=Jn,t=new Map(e.functions.map((i,a)=>[i.functionId,a])),r=new Array(e.functions.length).fill(0);for(let i of e.edges){let a=Math.max(t.get(i.from)??0,t.get(i.to)??0);r[a]=(r[a]??0)+1}let o=0,s=0;for(;s<e.functions.length&&s<n.maxReachNodes;){let i=r[s]??0;if(o+i>n.maxReachEdges)break;o+=i,s+=1}return s}function ki(e,n){return e===""||n===""?n:`${e}/${n}`}function wc(e){let n=e.filter(t=>t!=="").sort((t,r)=>r.length-t.length);return t=>n.find(r=>t.startsWith(`${r}::`))??""}import In from"node:path";import{closeSync as qy,constants as Ec,fstatSync as Vy,openSync as Hy,readSync as Xy,realpathSync as vc}from"node:fs";import Ei from"node:path";var Yy=8*1024*1024;function xr(e){return e==="PyPI"?"utf8-bytes":"utf16-units"}var Zn=class{#n;#t;#e=new Map;constructor(n,t=Yy){this.#t=t;let r;try{r=vc(n)}catch{r=null}this.#n=r}read(n){let t=this.#e.get(n);if(t!==void 0)return t;let r=this.#r(n);return this.#e.set(n,r),r}#r(n){let t=this.#n;if(t===null||n===""||Ei.isAbsolute(n))return null;let r;try{r=vc(Ei.join(t,n))}catch{return null}if(r!==t&&!r.startsWith(`${t}${Ei.sep}`))return null;let o;try{o=Hy(r,Ec.O_RDONLY|Ec.O_NONBLOCK)}catch{return null}try{let s=Vy(o);if(!s.isFile()||s.size>this.#t)return null;let i=Buffer.alloc(s.size),a=0;for(;a<s.size;){let d=Xy(o,i,a,s.size-a,a);if(d===0)break;a+=d}return a===s.size?i:null}catch{return null}finally{qy(o)}}};function _c(e,n,t){if(!Number.isInteger(n)||n<0)return null;if(t==="utf8-bytes"){if(n>e.length)return null;let i=e.subarray(0,n),a=1;for(let l of i)l===10&&(a+=1);let d=i.lastIndexOf(10)+1;return[a,e.subarray(d,n).toString("utf8").length+1]}let r=e.toString("utf8");if(n>r.length)return null;let o=r.slice(0,n),s=1;for(let i=0;i<o.length;i+=1)o.charCodeAt(i)===10&&(s+=1);return[s,n-(o.lastIndexOf(`
+`)+1)+1]}function Ic(e,n,t){if(n.end<n.start)return null;let r=e.read(n.path);if(r===null)return null;let o=_c(r,n.start,t),s=_c(r,n.end,t);return o===null||s===null?null:{startLine:o[0],startColumn:o[1],endLine:s[0],endColumn:s[1]}}function Jy(e,n){let t=e.read(n);if(t===null)return null;let r=t.toString("utf8"),o=In.posix.basename(n);if(o==="package-lock.json"||o==="npm-shrinkwrap.json")return Gs(r);if(o==="pnpm-lock.yaml")return Ws(r);if(o==="yarn.lock")return qs(r,Zy(e,n));if(o==="uv.lock")return Js(r);if(o==="poetry.lock"){let s=e.read(In.posix.join(In.posix.dirname(n),"pyproject.toml")),i=s===null?[]:[...mo(s.toString("utf8")).keys()];return Zs(r,i)}return null}function Zy(e,n){let t=new Map,r=e.read(In.posix.join(In.posix.dirname(n),"package.json"));if(r===null)return t;let o;try{o=JSON.parse(r.toString("utf8"))}catch{return t}if(typeof o!="object"||o===null)return t;for(let s of["dependencies","devDependencies","optionalDependencies"]){let i=o[s];if(!(typeof i!="object"||i===null||Array.isArray(i)))for(let[a,d]of Object.entries(i))typeof d=="string"&&!t.has(a)&&t.set(a,d)}return t}function Ac(e,n,t=[]){let r=new Zn(e,si),o=new Map,s=new Map,i=new Map,a=[],d=u=>{if(!s.has(u)){let h=r.read(u)?.toString("utf8")??null,x=In.posix.basename(u);s.set(u,h===null?null:x==="pyproject.toml"?mo(h):x.endsWith(".txt")?Qs(h):Hs(h))}return s.get(u)??null},l=(u,m)=>{let h=u.endsWith("pyproject.toml"),x=h?Ln(m):m,y=h?[u,In.posix.join(In.posix.dirname(u),"requirements.txt")]:[u];for(let S of y){let k=d(S)?.get(x);if(k!==void 0)return{path:S,line:k}}return null},c=(u,m,h)=>{let x=JSON.stringify([u,m,h]),y=i.get(x);if(y!==void 0)return y;o.has(u)||o.set(u,Jy(r,u));let S=o.get(u)??null,k=S===null?null:Vs(S,m,h,{maxNodes:Jn.maxPackageGraphNodes,maxEdges:Jn.maxPackageGraphEdges}),E=null;if(k!==null&&a.length<Jn.maxPackageGraphs){E=`g${String(a.length)}`;let g=In.posix.dirname(u);a.push({id:E,nodes:k.nodes.map(b=>{let w=b.directFrom===null?null:In.posix.join(g,b.directFrom);return{id:b.id,name:b.name,version:b.version,direct:b.directFrom!==null,declaredIn:w===null?null:l(w,b.name)}}),edges:k.edges.map(b=>({from:b.from,to:b.to})),truncated:k.truncated})}return i.set(x,E),E},p=n.map(u=>{if(u.tier==="not-affected")return null;if(u.ecosystem==="PyPI"){for(let m of t){let h=c(m,u.packageName,u.version);if(h!==null)return h}return null}return u.packageLocation===null?null:c(u.packageLocation,u.packageName,u.version)});return{graphs:a,idOf:p}}import{isBuiltin as Nc}from"node:module";function W(e){let n="";for(let t of e){let r=t.charCodeAt(0),o=r<32||r>=127&&r<=159;n+=o?"\\x"+r.toString(16).padStart(2,"0"):t}return n}var Rc=1024,Pc=4096,bo=8,Oc=512,$c=512,vi=8,Qy=160,ex=new Set(["unresolved-specifier","declaration-shadow","unresolved-reexport","unanalyzable-module"]),_i=new Set(["limit-exceeded","parse-error","unsupported-syntax"]),nx=/^(@[^/@\s]+\/)?[^/@\s.][^/\s]*$/u,tx=/\.[cm]?[jt]sx?$/u;function Cc(e,n){let t=n.get(e);if(t!==void 0)return t.packageName;let r=e.lastIndexOf("node_modules/");if(r!==-1){let o=e.slice(r+13).split("/"),s=o[0]??"";return s.startsWith("@")?o[1]===void 0?null:`${s}/${o[1]}`:s===""?null:s}return nx.test(e)&&!tx.test(e)?e:null}function rx(e){return W(`${e.code} ${e.path}: ${e.detail}`.slice(0,Qy))}function Mc(e){let{graph:n,facts:t,diagnostics:r}=e,o=new Map(n.modules.map(M=>[M.id,M])),s=new Map(n.modules.map(M=>[M.path,M])),i=bn(n),a=new Set;for(let M of i){let Q=o.get(M);Q!==void 0&&a.add(Q.packageName)}let d=new Map,l=0,c=!1,p=!1,u=M=>M.startsWith(`${e.appRootReal}/`)?M.slice(e.appRootReal.length+1):M;for(let M of r){if(M.code==="limit-exceeded"&&M.path===e.appRootReal){c=!0;continue}let Q=Cc(u(M.path),s);if(Q===null){M.code==="out-of-root"&&l++,_i.has(M.code)&&(p=!0);continue}let re=s.get(u(M.path));re!==void 0&&_i.has(M.code)&&!re.path.includes("node_modules/")&&(p=!0);let de=d.get(Q);de===void 0?d.set(Q,[M]):de.push(M)}let m=new Map(n.imports.map(M=>[M.id,M])),h=new Set;for(let M of n.importEdges){let Q=m.get(M.importId);Q!==void 0&&o.get(Q.moduleId)?.externalSurface===!0&&h.add(Q.moduleId)}let x=[],y=new Set,S=n.modules.filter(M=>M.externalSurface===!0);for(let M of S){let Q=d.get(M.packageName)??[],re=h.has(M.id),de=[],be=pe=>pe.code==="dependency-body"&&pe.anchor===void 0&&/syntax/u.test(pe.detail),et=pe=>pe.code==="loader-escape"||pe.code==="dependency-body"&&pe.anchor===void 0&&!/syntax/u.test(pe.detail),yn=Q.filter(pe=>ex.has(pe.code)),nt=Q.filter(et),tt=Q.filter(pe=>_i.has(pe.code)||be(pe)),$=Q.filter(pe=>pe.code==="out-of-root"),T=re&&yn.length===0,z=nt.length===0,X=!c&&tt.length===0,ce=l===0&&$.length===0;re||de.push("(a) the package's entry was never followed to a module");for(let pe of[...yn,...nt,...tt,...$]){if(de.length>=vi)break;de.push(rx(pe))}c&&de.length<vi&&de.push("(c) the dependency module closure hit its cap \u2014 every follow is truncated"),l>0&&de.length<vi&&de.push(`(d) ${String(l)} out-of-root diagnostic(s) no package can be read from`);let xe=["a","b","c","d"].filter(pe=>!{a:T,b:z,c:X,d:ce}[pe]),Ke=xe.length===0;Ke&&y.add(M.id),x.push({packageName:W(M.packageName),module:W(String(M.id)),inReach:i.has(M.id),builtin:Nc(M.packageName),followed:re,d1:{a:T,b:z,c:X,d:ce},failing:xe,transparent:Ke,evidence:de})}let k=new Set;for(let M of t)M.reach.kind==="unbounded"&&k.add(M.source);let E=M=>({module:W(String(M.module)),kind:M.kind,packageName:o.get(M.module)?.packageName??null}),g=new Set(S.filter(M=>Nc(M.packageName)).map(M=>M.id)),b=new Set([...y,...g]),w=[],I=new Map,N=0,v=0,_=0,P=0,R=[],L=new Set;for(let M of t)M.reach.kind==="unbounded"&&L.add(M.cause);for(let M of t){if(M.reach.kind==="class-scope"){R.push({packageName:M.reach.packageName,container:M.reach.container});continue}if(M.reach.kind==="unbounded")continue;P++;let Q=M.reach.anchor,re=I.get(String(Q));re===void 0&&(re={today:qt(n,Q,k),d1:qt(n,Q,k,y),d1Builtins:qt(n,Q,k,b)},I.set(String(Q),re)),re.d1Builtins.length>0&&_++,re.today.length>0&&(N++,L.add(M.cause)),re.d1.length>0&&v++,w.length<Pc&&w.push({anchor:W(String(Q)),packageName:W(o.get(Q)?.packageName??""),cause:M.cause,reachKind:M.reach.kind,blockersToday:re.today.slice(0,bo).map(E),blockersUnderD1:re.d1.slice(0,bo).map(E),blockedUnderD1Builtins:re.d1Builtins.length>0,moreToday:Math.max(0,re.today.length-bo),moreUnderD1:Math.max(0,re.d1.length-bo)})}let O=r.filter(M=>M.anchor===void 0&&M.classScope===void 0),F=new Map(e.loadSites.map(M=>[M.importId,M])),K=new Map;for(let M of e.loadSites){let Q=K.get(M.path);Q===void 0?K.set(M.path,[M.shape]):Q.push(M.shape)}let ee=M=>{if(M.code!=="loader-escape")return!1;let Q=M.escapes??[];if(Q.length===0||Q.some(de=>de!=="non-literal-load"))return!1;let re=K.get(M.path)??[];return re.length>0&&re.every(de=>de==="relative-bounded")},U=O.slice(0,$c).map(M=>({cause:e.causeOf(M.code),code:M.code,path:W(u(M.path)),attributedPackage:Cc(u(M.path),s),...M.escapes!==void 0?{escapes:[...M.escapes]}:{},...M.reason!==void 0?{reason:M.reason}:{},d2Dischargeable:ee(M)})),J={};for(let M of O){if(M.code!=="unresolved-specifier")continue;let Q=M.reason??"(none)";J[Q]=(J[Q]??0)+1}let B=k.size===0?0:t.filter(M=>M.reach.kind==="unbounded").length,D=Math.max(0,B-O.length),Y=B-O.filter(ee).length,Z=[],H=0,ne=0,se=0;for(let M of n.imports){if(M.specifierIsLiteral)continue;se++;let Q=i.has(M.moduleId),re=F.get(String(M.id)),de=re?.shape??"unrecorded";Q&&(H++,de==="relative-bounded"&&ne++),Z.length<Oc&&Z.push({importId:W(String(M.id)),path:W(o.get(M.moduleId)?.path??""),shape:de,text:W(re?.text??""),inReach:Q})}return{report:{adr:"ADR-105",aborted:e.analysisAborted,rootBudget:e.rootBudget,closureCapHit:c,appCapHit:p,unattributedOutOfRoot:l,blindUnbounded:D,unbounded:U,anchors:w,surfaces:x.slice(0,Rc),loads:Z,counts:{modules:n.modules.length,reachMods:i.size,surfaces:S.length,surfacesInReach:x.filter(M=>M.inReach).length,transparentSurfaces:y.size,builtinSurfaces:g.size,anchors:P,anchorsBlockedToday:N,anchorsBlockedUnderD1:v,anchorsBlockedUnderD1Builtins:_,unbounded:B,loadsInReach:H,loadsRelativeBounded:ne,unresolvedByReason:J,conditionUnions:e.conditionUnions.length,provenAbsent:e.provenAbsent.length},truncated:{surfaces:Math.max(0,x.length-Rc),anchors:Math.max(0,P-Pc),loads:Math.max(0,se-Oc),unbounded:Math.max(0,O.length-$c)}},reachedPackages:a,aborted:e.analysisAborted,unboundedFacts:B,unboundedHard:Y,anchorsBlockedToday:N,anchorsBlockedUnderD1:v,anchorsBlockedUnderD1Builtins:_,loadsInReach:H,loadsAllBounded:H>0&&ne===H,d2Eligible:e.rootBudget==="complete"&&!p&&!c,classScope:R,taintCausesToday:L}}var ox=new Set(["unverified-symbol","db-gap","symbol-unsupported","incomplete-surface"]),sx=["no-entrypoint","dynamic-load","resolution-divergence","analysis-cap","dep-opaque"];function Tc(e,n,t,r,o){if(t===null||e.reachedPackages.has(t.packageName))return;let s=e.classScope.some(N=>N.packageName===t.packageName&&N.container===t.container),i=e.aborted!==null||e.unboundedFacts>0||e.anchorsBlockedToday>0||s,a=t.symbolKind==="method"||t.symbolKind==="ctor",l=!t.verified||t.symbolKind==="accessor"||t.symbolKind==="pattern"||a||n.unknownKind!==void 0&&ox.has(n.unknownKind)?"pre-2b":n.tier==="not-reachable"?"denial":e.loadsInReach>0?"load":i?"taint":r>0?"oog":"unexpected",c=new Set(e.taintCausesToday);s&&c.add("dep-opaque");let p=e.aborted!==null?e.aborted:sx.find(N=>c.has(N)),u=l==="pre-2b"?n.tier==="unknown"&&(a?n.unknownKind==="dep-opaque":!0):l==="denial"?n.tier==="not-reachable":l==="load"?n.tier==="unknown"&&n.unknownKind==="dynamic-load":l==="taint"?n.tier==="unknown"&&n.unknownKind===p:l==="oog"?n.tier==="unknown"&&n.unknownKind==="analysis-cap":!1,m=t.verified&&o===!0,h=e.aborted===null&&e.unboundedFacts===0&&!s&&r===0,x=e.loadsInReach===0||e.d2Eligible&&e.loadsAllBounded,y=m&&l==="taint"&&h&&e.loadsInReach===0&&e.anchorsBlockedUnderD1===0,S=m&&l==="load"&&h&&e.d2Eligible&&e.loadsAllBounded&&e.anchorsBlockedToday===0,k=m&&(l==="load"||l==="taint")&&h&&x&&e.anchorsBlockedUnderD1===0,E=e.aborted===null&&e.unboundedHard===0&&!s&&r===0,g=m&&l==="load"&&E&&e.d2Eligible&&e.loadsAllBounded&&e.anchorsBlockedToday===0,b=m&&(l==="load"||l==="taint")&&E&&x&&e.anchorsBlockedUnderD1===0,w=m&&l==="taint"&&h&&e.loadsInReach===0&&e.anchorsBlockedUnderD1Builtins===0,I=m&&(l==="load"||l==="taint")&&E&&x&&e.anchorsBlockedUnderD1Builtins===0;return{unloaded:!0,exit:l,agrees:u,verified:t.verified,surfaceComplete:o,oog:r,classScoped:s,predicted:{d1:y,d2:S,d1d2:k,d2Amended:g,d1d2Amended:b,d1Builtins:w,d1d2AmendedBuiltins:I}}}import{readFileSync as ix,statSync as ax}from"node:fs";var Ai=/^(@[A-Za-z0-9_.-]{1,100}\/)?[A-Za-z0-9_.-]{1,100}$/u,ko=/^[A-Za-z0-9_$.-]{1,128}$/u,Dc=64,Lc=1024*1024,Fc=/^(0|\d{1,10}\.\d{1,10}\.\d{1,10})$/u,jc=/^[A-Za-z0-9@_.-]{1,128}$/u;function Ne(e){throw new Error(`model claims rejected: ${e}`)}function Ii(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function lx(e,n){Ii(e)||Ne(`${n}: edge is not an object`);let{kind:t,anchorExport:r,anchorContainer:o,calleePackage:s,calleeContainer:i,calleeExport:a}=e;return t!=="alias"&&t!=="dispatch"&&Ne(`${n}: edge kind`),(typeof r!="string"||!ko.test(r))&&Ne(`${n}: anchorExport ${JSON.stringify(r)}`),o!==null&&(typeof o!="string"||!ko.test(o))&&Ne(`${n}: anchorContainer`),(typeof s!="string"||!Ai.test(s))&&Ne(`${n}: calleePackage ${JSON.stringify(s)}`),i!==null&&(typeof i!="string"||!ko.test(i))&&Ne(`${n}: calleeContainer`),(typeof a!="string"||!ko.test(a))&&Ne(`${n}: calleeExport ${JSON.stringify(a)}`),{kind:t,anchorExport:r,anchorContainer:o,calleePackage:s,calleeContainer:i,calleeExport:a}}function Bc(e){let n=ax(e).size;n>Lc&&Ne(`file is ${String(n)} bytes, over the ${String(Lc)} cap`);let t;try{t=JSON.parse(ix(e,"utf8"))}catch(o){Ne(`unparseable JSON: ${o instanceof Error?o.message:String(o)}`)}Array.isArray(t)||Ne("root is not an array"),t.length>Dc&&Ne(`${String(t.length)} claims over cap ${String(Dc)}`);let r=[];for(let o of t){Ii(o)||Ne("claim is not an object");let{packageName:s,modelId:i,range:a,edges:d}=o;(typeof s!="string"||!Ai.test(s))&&Ne("packageName"),(typeof i!="string"||!jc.test(i))&&Ne("modelId (identifier charset, 1-128 chars)"),r.some(c=>c.model.modelId===i)&&Ne(`duplicate modelId ${i} \u2014 the V5 promote\u2192claim join must be unambiguous`),(!Ii(a)||typeof a.introduced!="string")&&Ne(`${i}: range`),Fc.test(a.introduced)||Ne(`${i}: range.introduced ${JSON.stringify(a.introduced)} is not '0' or an exact x.y.z triple`);let l=a.fixedBefore;l!==null&&typeof l!="string"&&Ne(`${i}: fixedBefore`),typeof l=="string"&&!Fc.test(l)&&Ne(`${i}: range.fixedBefore ${JSON.stringify(l)} is not an exact x.y.z triple`),Array.isArray(d)||Ne(`${i}: edges`),d.length>64&&Ne(`${i}: ${String(d.length)} edges over cap ${String(64)}`),r.push({model:{packageName:s,modelId:i,edges:d.map(c=>lx(c,i))},introduced:a.introduced,fixedBefore:l})}return r}var dx=["in-app-purchase@1-v1"];function Ni(e,n,t){let r=[],o=[],s=[],i=(a,d,l,c)=>{o.push(l),s.push({modelId:c??a.model.modelId,status:d,reason:l,edgeCount:a.model.edges.length})};for(let a of e){if(!Ai.test(a.model.packageName)||!jc.test(a.model.modelId)){i(a,"refused","model (unprintable id): hostile-shaped packageName/modelId \u2014 refused WHOLE","(unprintable id)");continue}if(t?.shadowConsultDenylisted!==!0&&dx.includes(a.model.modelId)){i(a,"denylisted",`model ${a.model.modelId}: DENYLISTED (ADR-081 F-081-A a-prime) \u2014 dropped, never consulted`);continue}if(a.model.edges.some(c=>c.kind!=="alias"&&c.kind!=="dispatch")){i(a,"refused",`model ${a.model.modelId}: unknown edge kind \u2014 refused WHOLE`);continue}let d=n(a.model.packageName);if(typeof d!="string"&&d!==void 0){i(a,"inert",`model ${a.model.modelId}: anchor ${a.model.packageName} installed at more than one version (${d.join(", ")}) \u2014 inert, never guessed (ADR-071)`);continue}if(d===void 0){i(a,"inert",`model ${a.model.modelId}: anchor ${a.model.packageName} not installed \u2014 inert`);continue}let l;try{l=it(d,{advisoryId:a.model.modelId,packageName:a.model.packageName,introduced:a.introduced,...a.fixedBefore!==null?{fixed:a.fixedBefore}:{},surfaceComplete:!1})}catch{i(a,"inert",`model ${a.model.modelId}: installed ${a.model.packageName}@${d} not an exact triple \u2014 inert (never guessed)`);continue}if(!l){i(a,"inert",`model ${a.model.modelId}: installed ${a.model.packageName}@${d} outside [${a.introduced}, ${a.fixedBefore??"\u221E"}) \u2014 inert`);continue}r.push(a.model),s.push({modelId:a.model.modelId,status:"active",reason:null,edgeCount:a.model.edges.length})}return{models:r,notes:o,dispositions:s}}var ux=4,fx={additiveForms:!0,namelessExports:!0},px=new Set(["dep-opaque","dynamic-load","dispatch"]),mx={base:new Set(["symbol-reachable"]),widened:new Set(["symbol-reachable","call-path-confirmed"])};function Di(e,n,t){return e.tier==="unknown"&&mx[t].has(e.decidedAtStage)&&e.unknownKind!==void 0&&px.has(e.unknownKind)&&n!==null&&n.verified}var hx=()=>({"not-affected":0,"not-reachable":0,"reachable-high":0,"reachable-medium":0,"reachable-low":0,unknown:0}),hn=class extends Error{},Li="cupel/coverage-gap",Gc={"loader-escape":"dynamic-load","out-of-root":"resolution-divergence","unresolved-specifier":"resolution-divergence","declaration-shadow":"resolution-divergence","unanalyzable-module":"resolution-divergence","unresolved-reexport":"resolution-divergence","limit-exceeded":"analysis-cap","parse-error":"analysis-cap","unsupported-syntax":"analysis-cap","unresolved-launch-entry":"analysis-cap","unresolved-entry-declaration":"analysis-cap","framework-derived-entry":"analysis-cap","unanalyzed-project-root":"no-entrypoint","dependency-body":"dep-opaque","dep-class-corridor":"dep-opaque"};function br(e,n,t){return{advisoryId:e,packageName:n,...t.ecosystem==="PyPI"?{ecosystem:"PyPI"}:{},introduced:t.introduced??"0",...t.fixed!==null?{fixed:t.fixed}:{},...t.lastAffected!==null?{lastAffected:t.lastAffected}:{},surfaceComplete:t.surfaceComplete===1}}function Kc(e,n){return e===0?"no-entrypoint":n.modules.length===0?"analyzer-crash":null}function Uc(e,n,t){let r=new Map(e.modules.map(i=>[i.path,i.id])),o=e.modules[0]?.id;if(o===void 0)return[];let s=n.map(i=>({source:r.get(i.path)??o,cause:Gc[i.code],reach:i.classScope!==void 0?{kind:"class-scope",packageName:i.classScope.packageName,container:i.classScope.container}:i.anchor!==void 0?{kind:"via-module",anchor:i.anchor}:{kind:"unbounded"}}));for(let i of t)s.push({source:o,reach:{kind:"unbounded"},cause:i});return s}function Ci(e,n,t,r,o){let s=t.filter(i=>i.exportName!==null&&(r===1||o||i.verified!==1));return s.length>0?s.map(i=>({advisoryId:e,packageName:n,exportName:i.exportName??"",container:i.container,symbolKind:i.symbolKind,sourcePath:i.sourcePath??"",derivation:i.derivation,confidence:i.confidence,verified:i.verified===1})):t.length===0||t.every(i=>i.exportName!==null&&i.verified===1)?[null]:[]}function gx(e,n){let t;try{t=kr(e)}catch{return!0}let r=3,o=(s,i)=>{if(i>r)return!1;let a;try{a=zc(s)}catch{return!1}for(let d of a){if(d==="node_modules"||d.startsWith("."))continue;let l=gn.join(s,d),c;try{c=Ti(l)}catch{continue}if(!c.isDirectory())continue;let p=gn.relative(t,l).split(gn.sep).join("/");try{if(Ti(gn.join(l,"package.json")).isFile()&&!n.has(p))return!0}catch{}if(o(l,i+1))return!0}return!1};return o(t,1)}function yx(e,n){let t="";for(let r of e)r.rel!==""&&n.startsWith(`${r.rel}/`)&&r.rel.length>t.length&&(t=r.rel);return t}function xx(e,n,t){let r=[];if(t&&r.push("nested-app-root"),n==="")return[...r,"manifest-unreadable"];let o;try{if(o=kr(gn.resolve(e,n)),!o.startsWith(kr(e)+gn.sep))return[...r,"manifest-unreadable"]}catch{return[...r,"manifest-unreadable"]}let s;try{let c=gn.join(o,"package.json");if(!Ti(c).isFile())return[...r,"manifest-unreadable"];s=cx(c,"utf8")}catch{return[...r,"manifest-unreadable"]}let i;try{i=JSON.parse(s)}catch{return[...r,"manifest-unreadable"]}if(typeof i!="object"||i===null)return[...r,"manifest-unreadable"];let a=i;(typeof a.bin=="string"||typeof a.bin=="object"&&a.bin!==null)&&r.push("bin");let d=["preinstall","install","postinstall","prepare","prepublish"],l=a.scripts;if(typeof l=="object"&&l!==null){let c=l;d.some(p=>typeof c[p]=="string")&&r.push("install-script")}return(a.gypfile===!0||Sx(o))&&r.push("native-artifact"),r}function Sx(e){for(let n of["","build/Release","build/Debug","prebuilds","lib/binding"]){let t=gn.join(e,n),r;try{r=zc(t)}catch{continue}if(r.some(o=>o.endsWith(".node")))return!0}return!1}function bx(e,n){let t=new Set(["npm",...n.ecosystems?.()??[]]),r=[];for(let o of e.perRoot){let s=new Map;for(let i of o.packages){let a=i.ecosystem??"npm";t.has(a)||s.set(a,(s.get(a)??0)+1)}for(let[i,a]of[...s.entries()].sort())r.push({kind:"ecosystem-uncovered",detail:`${o.rootRel===""?"":`${o.rootRel}: `}${String(a)} ${i} distribution(s) were enumerated but the loaded shard carries no ${i} advisories: they were NOT assessed, so this is not a clean bill of health for them. Scan with a ${i} shard to assess them (ADR-109 D5).`,blindsAnalysis:!1,rootRel:o.rootRel})}return r}function Wc(e){return JSON.stringify([e.ecosystem??"npm",e.name,e.version,e.lockKey])}function kx(e,n,t){return new Map(n.map(r=>[Wc(r),xx(e,r.lockKey,t)]))}function wx(e){let n=new Map;for(let t of e){let r=n.get(t.advisory.id);r===void 0?n.set(t.advisory.id,[t]):r.push(t)}return n}function Ex(e,n,t){return n.symbolsDecidable||e.tier!=="not-reachable"||!n.graph.modules.some(o=>o.packageName===t.name)?e:{...e,tier:"unknown",reason:`${t.name} is loaded, and cupel does not yet follow calls in this ecosystem's code \u2014 "no call path found" here is a property of the analysis, not of the application`,unknownKind:"symbol-unsupported",basis:void 0,path:void 0}}function vx(e,n,t,r,o,s,i){let{finding:a}=Sr(e,n,{name:t.name,version:t.version,...t.ecosystem!==void 0?{ecosystem:t.ecosystem}:{},devOnly:t.dev,outOfGraphExecution:i(t)},br(r.advisory.id,t.name,r.affected),null,o,s);return a.decidedAtStage!=="presence"&&a.decidedAtStage!=="version-match"}function Sr(e,n,t,r,o,s,i){let a=zo({graph:e,installed:t,range:r,symbol:o,coverage:null,incompleteness:s,analysisAborted:i});if(n!==null&&o!==null&&Di(a,o,"base")){let d=Vt(e,n.modulesById,n.reachMods,o,n.records);if(d!==null)return{finding:a,hit:d}}return{finding:a,hit:null}}function _x(e,n){let t=new Set,r=[];for(let o of e.packages)if((o.ecosystem??"npm")==="npm")for(let{advisory:s,affected:i}of n.advisoriesForPackage(o.ecosystem??"npm",o.name)){let a=br(s.id,o.name,i),d;try{d=it(o.version,a)}catch{continue}if(d)for(let l of n.symbolsForAffected(i.id)){if(l.verified!==1||l.symbolKind!=="method"&&l.symbolKind!=="ctor"||l.container===null||l.sourcePath===null)continue;let c=`${o.lockKey}\0${l.container}\0${l.sourcePath}`;t.has(c)||(t.add(c),r.push({packageName:o.name,packageRootRel:o.lockKey,container:l.container,sourcePath:l.sourcePath}))}}return r.sort((o,s)=>`${o.packageRootRel}\0${o.container}\0${o.sourcePath}`.localeCompare(`${s.packageRootRel}\0${s.container}\0${s.sourcePath}`)),r.slice(0,Qr)}function Ix(e,n,t){let r=new Map(e.functions.map(a=>[a.id,a])),o=new Map(e.classes.map(a=>[a.id,a.name])),s=new Map(e.callSites.map(a=>[a.id,a])),i=[];for(let a of e.callEdges){if(a.resolution!=="resolved"&&a.resolution!=="field-based")continue;let d=s.get(a.callSiteId);if(d===void 0)continue;let l=r.get(d.enclosingFunctionId);if(l===void 0||!t.has(l.moduleId))continue;let c=n.get(l.moduleId);if(c===void 0)continue;let p=r.get(a.calleeFunctionId);if(p===void 0||p.name===void 0)continue;let u=n.get(p.moduleId);u!==void 0&&u.packageName!==c.packageName&&i.push({packageName:u.packageName,exportName:p.name,container:p.enclosingClassId!==void 0?o.get(p.enclosingClassId)??null:null,resolution:a.resolution,callerFunctionId:l.id})}return i}function Ax(e){let n=new Set(e.modules.filter(c=>c.isEntrypoint).map(c=>c.id)),t=new Map(e.modules.map(c=>[c.id,c])),r=new Map(e.functions.map(c=>[c.id,c])),o=new Set;for(let c of e.functions)n.has(c.moduleId)&&(c.publicSurfaceReachable||c.name==="<toplevel>")&&o.add(c.id);let s=new Map(e.exports.map(c=>[c.id,c]));for(let c of e.exportBindings){if(c.target.kind!=="function")continue;let p=s.get(c.exportId);if(p===void 0||!n.has(p.moduleId))continue;let u=r.get(c.target.functionId);u===void 0||t.get(u.moduleId)?.externalSurface===!0||o.add(u.id)}let i=new Map(e.callSites.map(c=>[c.id,c.enclosingFunctionId])),a=new Map;for(let c of e.callEdges){if(c.resolution!=="resolved"&&c.resolution!=="field-based")continue;let p=i.get(c.callSiteId);if(p===void 0)continue;let u=a.get(p);u===void 0?a.set(p,[c.calleeFunctionId]):u.push(c.calleeFunctionId)}let d=new Set(o),l=[...o];for(;l.length>0;){let c=l.pop();if(c!==void 0)for(let p of a.get(c)??[])d.has(p)||(d.add(p),l.push(p))}return d}function Nx(e,n,t,r){for(let o of n){if(o.modelId!==e.modelId||o.anchor.packageName!==e.anchorPackage||o.anchor.exportName!==e.entryExport)continue;let s=t.filter(a=>a.packageName===o.anchor.packageName&&a.exportName===o.anchor.exportName&&a.container===o.anchor.container),i=s.find(a=>a.resolution==="resolved")??s[0];if(i!==void 0)return r.has(i.callerFunctionId)}return null}function Rx(e,n,t){if(t===void 0||t===!1)return!1;if(t===!0||t==="all")return n>0||e.some(s=>s.modelId!==void 0);let r=new Set(t),o=s=>r.has(s)||r.has(Ze[s]??"");return e.some(s=>s.tier==="unknown"&&s.unknownKind!==void 0&&o(s.unknownKind)||s.modelPromotedFromKind!==void 0&&o(s.modelPromotedFromKind))}function Fi(e){let n=Bt.now(),t=kr(e.dir),r=e.reader??(e.shardPathPypi!==void 0?Vo([Ht(e.shardPath),Ht(e.shardPathPypi)]):Ht(e.shardPath)),o=e.partialRows===!0;try{if(!/^\d+$/u.test(r.schemaVersion)||Number(r.schemaVersion)>Number(vt))throw new hn(`shard schema ${JSON.stringify(r.schemaVersion)} is unreadable or newer than this cupel understands (v${vt})`);let s=null;if(e.summaryShadow!==void 0)try{s=xc(e.summaryShadow)}catch(j){throw new hn(`--summary-shadow facts dir rejected: ${j instanceof Error?j.message:String(j)}`)}let i=null;if(e.modelShadow!==void 0)try{i=Bc(e.modelShadow.claimsPath)}catch(j){throw new hn(`--model-shadow claims rejected: ${j instanceof Error?j.message:String(j)}`)}let a=ni(t,{...e.rootDiscovery,...e.root!==void 0?{operatorRoots:e.root}:{}}),d=Yd(t,a,e.installedSet);if(d.truncated){let j=d.perRoot.filter(ie=>ie.truncated).map(ie=>ie.rootRel===""?"the scan root":`\`${ie.rootRel}\``);throw new hn(`the dependency enumeration hit a hard cap and is incomplete at ${j.length>0?j.join(", "):"the union across roots"} (${d.diagnostics.join("; ")}) \u2014 refusing to report a partial (possibly false-clean) scan`)}let l=yc(a.roots),c=l?.execution??null,p=Zd(d.packages.filter(j=>(j.ecosystem??"npm")==="npm")),u=e.entry??[],m=u.length>0?cd(t,u):{entrypoints:[],rejected:[]},h=m.rejected,x=dd(t,a.roots),y=[...new Set([...x.entrypoints,...m.entrypoints])],S=[...x.sources];for(let j of m.entrypoints)x.entrypoints.includes(j)||S.push({source:"--entry",specifier:j,entrypoint:j,launch:!1,root:yx(a.roots,j)});let k=[...S];for(let j of l?.roots??[])for(let ie of j.entrypoints)S.push({source:`python:${ie.source}`,specifier:ie.declaration,entrypoint:j.rootRel===""?ie.file:`${j.rootRel}/${ie.file}`,launch:ie.source==="console-script"||ie.source==="launch-declaration",root:j.rootRel});let E=_x(d,r),g=e.bindingForms??fx,b=e.callablePackageResolver===!0,w=e.tsconfigPaths!==!1,I=gx(t,pr(S)),N=kx(t,d.packages,I),v=j=>(j.ecosystem??"npm")!=="npm"?c?.get(j.name)??["manifest-unreadable"]:N.get(Wc(j))??["manifest-unreadable"],_=Ms({appRoot:t,entrypoints:y,depClassAnchors:E,bindingForms:g,callablePackageResolver:b,tsconfigPaths:w}),P=_.graph,R=Uo(P),L=[...x.diagnostics,...Ts(x),...Ds(x,y.length),...li(a,k),..._.diagnostics],O=Kc(y.length,P),F=j=>d.packages.some(ie=>(ie.ecosystem??"npm")===j),K=l===null?"no-entrypoint":l.analysisAborted,ee=(F("npm")?O:null)??(F("PyPI")?K:null)??(F("npm")||F("PyPI")?null:O),U=[...d.gaps,...Qd(a),...bx(d,r)],J=ec(U),B=Uc(P,L,J),D={graph:jt,incompleteness:[],analysisAborted:"no-entrypoint",symbolsDecidable:!1},Y=j=>(j.ecosystem??"npm")==="npm"?{graph:P,incompleteness:B,analysisAborted:O,symbolsDecidable:!0}:l===null?D:{...l,symbolsDecidable:!0},Z=t;try{Z=kr(t)}catch{}let H=Mc({graph:P,facts:B,diagnostics:L,analysisAborted:O,loadSites:_.loadSites,conditionUnions:_.conditionUnions,provenAbsent:_.provenAbsent,appRootReal:Z,rootBudget:a.budget,causeOf:j=>Gc[j]}),ne=r.allModels?.()??[],se=Ni(ne.map(j=>({model:{packageName:j.packageName,modelId:j.modelId,edges:j.edges},introduced:j.introduced,fixedBefore:j.fixedBefore})),p),oe=se.models.length>0?rr(P,se.models).delta:null,M=oe!==null?{records:oe.records,reachMods:bn(P),modulesById:new Map(P.modules.map(j=>[j.id,j]))}:null,Q=Bt.now(),re=[],de=new Map,be=hx(),et=[],yn=[];for(let j of d.packages){let ie=Y(j),$e=(j.ecosystem??"npm")==="npm"?M:null;for(let[,Oe]of wx(r.advisoriesForPackage(j.ecosystem??"npm",j.name))){let Le=Oe[0];if(Le!==void 0){let we=de.get(Le.advisory.id),ln=Oe.map(Ue=>Ue.affected);we===void 0?de.set(Le.advisory.id,{advisory:Le.advisory,ranges:ln}):we.ranges.push(...ln)}let ke=Oe.filter(we=>vx(ie.graph,$e,j,we,ie.incompleteness,ie.analysisAborted,v)),Nn=ke.length>0?ke:Oe.slice(0,1),Rn=ke.length===0;for(let{advisory:we,affected:ln}of Nn){let Ue=br(we.id,j.name,ln),Pn=we.cveId??we.id,ot=Rn?[]:r.symbolsForAffected(ln.id),Ut=ot.filter(Se=>Se.exportName===null),On=Ci(we.id,j.name,ot,ln.surfaceComplete,o),$n=Sr(ie.graph,$e,{name:j.name,version:j.version,...j.ecosystem!==void 0?{ecosystem:j.ecosystem}:{},devOnly:j.dev,outOfGraphExecution:v(j)},Ue,null,ie.incompleteness,ie.analysisAborted).finding;if($n.decidedAtStage==="presence"||$n.decidedAtStage==="version-match"){be[$n.tier]+=1,re.push({...$n,modelId:void 0,modelPromotedFromKind:void 0,surfaceComplete:Ue.surfaceComplete,advisoryId:we.id,displayId:Pn,packageName:j.name,version:j.version,ecosystem:j.ecosystem??"npm",symbolName:null,symbolPath:null,symbolContainer:null,severity:we.severity,packageLocation:ho(d,j)});continue}for(let Se of On){let{finding:dn,hit:Je}=Sr(ie.graph,$e,{name:j.name,version:j.version,...j.ecosystem!==void 0?{ecosystem:j.ecosystem}:{},devOnly:j.dev,outOfGraphExecution:v(j)},Ue,Se,ie.incompleteness,ie.analysisAborted),q=Ex(dn,ie,j),te,ue;Je!==null&&Se!==null&&(te=Je.modelId,ue=dn.unknownKind,q={basis:void 0,tier:Je.tier,decidedAtStage:dn.decidedAtStage,reason:`boundary model ${Je.modelId}: ${Je.anchorPackage}.${Je.entryExport} reaches ${Se.exportName} [${Je.pathLabels.join(" \u2192 ")}]`,unknownKind:void 0,attribution:Tr(Se),path:void 0,unresolvedSites:dn.unresolvedSites,unresolvedEvidence:dn.unresolvedEvidence}),be[q.tier]+=1;let Ce=Tc(H,q,Se,v(j).length,Ue.surfaceComplete),me={...q,...Ce!==void 0?{adr105:Ce}:{},modelId:te,modelPromotedFromKind:ue,surfaceComplete:Ue.surfaceComplete,advisoryId:we.id,displayId:Pn,packageName:j.name,version:j.version,ecosystem:j.ecosystem??"npm",symbolName:Se?.exportName??null,symbolPath:Se?.sourcePath||null,symbolContainer:Se?.container??null,severity:we.severity,packageLocation:ho(d,j)};re.push(me);let fe=new Set(["dep-opaque","dynamic-load","dispatch"]);s!==null&&me.tier==="unknown"&&me.decidedAtStage==="symbol-reachable"&&me.unknownKind!==void 0&&fe.has(me.unknownKind)&&Se!==null&&et.push({finding:me,symbol:Se}),i!==null&&me.tier==="unknown"&&Se!==null&&yn.push({finding:me,symbol:Se})}for(let Se of Ut)be.unknown+=1,re.push({modelId:void 0,modelPromotedFromKind:void 0,surfaceComplete:Ue.surfaceComplete,tier:"unknown",decidedAtStage:"symbol-reachable",reason:`advisory ${Pn} carries a ${Se.symbolKind} pattern symbol; pattern matching is not evaluated yet`,unknownKind:"symbol-unsupported",attribution:void 0,basis:void 0,path:void 0,unresolvedSites:[],unresolvedEvidence:{own:[],sets:[]},advisoryId:we.id,displayId:Pn,packageName:j.name,version:j.version,ecosystem:j.ecosystem??"npm",symbolName:null,symbolPath:null,symbolContainer:null,severity:we.severity,packageLocation:ho(d,j)})}}}for(let j of U)be.unknown+=1,re.push({modelId:void 0,modelPromotedFromKind:void 0,surfaceComplete:void 0,tier:"unknown",decidedAtStage:"presence",reason:j.detail,attribution:void 0,basis:void 0,path:void 0,unresolvedSites:[],unresolvedEvidence:{own:[],sets:[]},advisoryId:Li,displayId:Li,packageName:j.kind,version:"",ecosystem:"npm",symbolName:null,symbolPath:null,symbolContainer:null,severity:null,unknownKind:"coverage-gap",packageLocation:Jd(d,j)});let nt=Bt.now()-Q,tt=be["reachable-high"]+be["reachable-medium"],$=e.failOnReachable===!0&&tt>0,T=Rx(re,be.unknown,e.failOnUnknown),z=e.requireCompleteDenial===!0&&re.some(j=>j.tier==="not-reachable"&&j.basis==="loader-assumption"),X=$||T||z?2:0,ce;if(s!==null){let j=bn(P),ie=new Map(P.modules.map(Oe=>[Oe.id,Oe])),$e=[];for(let{finding:Oe,symbol:Le}of et){let ke=Do(P,ie,j,Le,s,ux);$e.push({advisoryId:Oe.advisoryId,packageName:Oe.packageName,symbolName:Oe.symbolName,unknownKind:Oe.unknownKind??null,wouldPromote:ke!==null,...ke!==null?{anchorPackage:ke.anchorPackage,entryExport:ke.entryExport,viaPackages:ke.viaPackages,totalHops:ke.totalHops}:{}})}ce={records:$e}}let xe;if(i!==null&&e.modelShadow!==void 0){let j=e.modelShadow.widened===!0?"widened":"base",{models:ie,notes:$e,dispositions:Oe}=Ni(i,p,{shadowConsultDenylisted:!0}),{delta:Le}=rr(P,ie),ke=bn(P),Nn=new Map(P.modules.map(q=>[q.id,q])),Rn=Ix(P,Nn,ke),we=Ax(P),ln=Le.records.some(q=>Rn.some(te=>te.packageName===q.anchor.packageName&&te.exportName===q.anchor.exportName&&te.container===q.anchor.container)),Ue=[],Pn=Date.now();for(let{finding:q,symbol:te}of yn){let ue=Le.records,Ce=Di(q,te,j),me=Ce?Vt(P,Nn,ke,te,ue):null,fe=Le.records.filter(De=>De.callee.packageName===te.packageName&&De.callee.exportName===te.exportName&&De.callee.container===te.container||De.callee.packageName===te.packageName&&De.callee.realFunctionId!==null);Ue.push({advisoryId:q.advisoryId,packageName:q.packageName,symbolName:q.symbolName,unknownKind:q.unknownKind??null,decidedAtStage:q.decidedAtStage,consultSurface:j,noHitReason:me!==null?null:Ce?ln?"no-key-match-no-continuation":"no-matching-anchor":"not-eligible-base",anchorFunctionEntryReachable:me!==null?Nx(me,ue,Rn,we):null,verdictBefore:q.tier,verdictAfter:me!==null?"reachable-low":q.tier,wouldPromote:me!==null,...me!==null?{modelId:me.modelId,anchorPackage:me.anchorPackage,entryExport:me.entryExport,pathLabels:me.pathLabels,calleeBinding:fe.find(De=>De.callee.realFunctionId!==null)?.callee.realFunctionId??"key:any-installed-in-range-copy"}:Ce?fe.length>0?{reason:"model-covers-symbol-but-no-baseline-anchor",nearestBlockedHop:`anchor:${fe[0]?.anchor.packageName??"?"}#${fe[0]?.anchor.exportName??"?"} (no resolved|field-based baseline edge from a reachable module)`}:{reason:"no-model-coverage"}:{}})}let ot=Date.now()-Pn,Ut=Oe.map(q=>{if(q.status!=="active")return{modelId:q.modelId,state:q.status,reason:q.reason,edgesLowered:0,edgesReferenceGated:0};let te=Le.records.filter(Ce=>Ce.modelId===q.modelId).length;if(te>0)return{modelId:q.modelId,state:"lowered",reason:null,edgesLowered:te,edgesReferenceGated:q.edgeCount-te};let ue=Le.notes.find(Ce=>Ce.startsWith(`model ${q.modelId}:`)||Ce.startsWith(`model-edge ${q.modelId}:`));return{modelId:q.modelId,state:"refused",reason:ue??"refused \u2014 no anchor surface in the graph (all edges reference-gated)",edgesLowered:0,edgesReferenceGated:q.edgeCount}}),On=Ue.filter(q=>q.wouldPromote).length,$n=be.unknown-On,Se=be["reachable-high"]+be["reachable-medium"],dn=q=>({none:0,"fail-on-reachable":Se>0?2:0,"fail-on-unknown":q>0?2:0,both:Se>0||q>0?2:0});xe={records:Ue,notes:[...$e,...Le.notes],laneStates:Ut,exitCodes:{baseline:dn(be.unknown),withModels:dn($n)},overlayWallMs:ot},Pi(gn.dirname(e.modelShadow.outPath),{recursive:!0});let Je=`${e.modelShadow.outPath}.tmp-${Ri(8).toString("hex")}`;$i(Je,`${JSON.stringify(xe,null,2)}
+`,{encoding:"utf8",flag:"wx"}),Oi(Je,e.modelShadow.outPath)}let Ke;if(e.bindingShadow!==void 0){let j=Date.now(),ie=q=>se.models.length>0?{records:rr(q,se.models).delta.records,reachMods:bn(q),modulesById:new Map(q.modules.map(te=>[te.id,te]))}:null,$e=(q,te,ue,Ce)=>{let me=[];for(let fe of d.packages)for(let{advisory:De,affected:st}of r.advisoriesForPackage(fe.ecosystem??"npm",fe.name)){let bt=br(De.id,fe.name,st),Du=Ci(De.id,fe.name,r.symbolsForAffected(st.id),st.surfaceComplete,o);for(let ia of Du){let{finding:aa,hit:Mo}=Sr(q,Ce,{name:fe.name,version:fe.version,...fe.ecosystem!==void 0?{ecosystem:fe.ecosystem}:{},devOnly:fe.dev,outOfGraphExecution:v(fe)},bt,ia,te,ue);me.push({advisoryId:De.id,packageName:fe.name,symbolName:ia?.exportName??null,tier:Mo!==null?Mo.tier:aa.tier,unknownKind:Mo!==null?null:aa.unknownKind??null})}}return me},Oe=q=>{let te=Ms({appRoot:t,entrypoints:y,depClassAnchors:E,bindingForms:q,callablePackageResolver:b,tsconfigPaths:w}),ue=[...x.diagnostics,...Ts(x),...Ds(x,y.length),...li(a,k),...te.diagnostics];return{graph:te.graph,inc:Uc(te.graph,ue,J),aborted:Kc(y.length,te.graph),live:ie(te.graph),applicability:te.bindingApplicability}},Le=q=>{let te=Oe(q);return $e(te.graph,te.inc,te.aborted,te.live)},ke=Oe({}),Nn=$e(ke.graph,ke.inc,ke.aborted,ke.live),Rn=$e(P,B,O,M);if(Rn.length!==Nn.length)throw new hn("--binding-shadow dual-run row counts diverged; refusing to write a misaligned diff");let we=(q,te)=>te.tier!==q.tier||te.unknownKind!==q.unknownKind,ln=Nn.some((q,te)=>{let ue=Rn[te];return ue!==void 0&&we(q,ue)}),Ue=ln?Le({additiveForms:!0}):null,Pn=ln?Le({namelessExports:!0}):null,ot=0,Ut=Nn.map((q,te)=>{let ue=Rn[te];if(ue===void 0||ue.advisoryId!==q.advisoryId||ue.packageName!==q.packageName||ue.symbolName!==q.symbolName)throw new hn("--binding-shadow dual-run row identities diverged; refusing to write a misaligned diff");let Ce={advisoryId:q.advisoryId,packageName:q.packageName,symbolName:q.symbolName,unknownKind:q.unknownKind,verdictBefore:q.tier,verdictAfter:ue.tier,wouldPromote:ue.tier!==q.tier&&(ue.tier==="reachable-high"||ue.tier==="reachable-medium"||ue.tier==="reachable-low")};if(!we(q,ue)||Ue===null||Pn===null)return Ce;ot+=1;let me=Ue[te],fe=Pn[te],De=me!==void 0&&we(q,me),st=fe!==void 0&&we(q,fe);return{...Ce,attributedArm:De&&!st?"additiveForms":st&&!De?"namelessExports":"both",...me!==void 0?{verdictArmA:me.tier}:{},...fe!==void 0?{verdictArmB:fe.tier}:{}}}),On={...be};Nn.forEach((q,te)=>{let ue=Rn[te];ue!==void 0&&ue.tier!==q.tier&&(On[ue.tier]-=1,On[q.tier]+=1)});let $n=(q,te)=>({none:0,"fail-on-reachable":q>0?2:0,"fail-on-unknown":te>0?2:0,both:q>0||te>0?2:0}),Se;if(se.models.length>0&&M!==null){Se=[];for(let q of d.packages)for(let{advisory:te,affected:ue}of r.advisoriesForPackage(q.ecosystem??"npm",q.name)){let Ce=br(te.id,q.name,ue),me=Ci(te.id,q.name,r.symbolsForAffected(ue.id),ue.surfaceComplete,o);for(let fe of me){if(fe===null||!fe.verified)continue;let De=Sr(ke.graph,ke.live,{name:q.name,version:q.version,...q.ecosystem!==void 0?{ecosystem:q.ecosystem}:{},devOnly:q.dev,outOfGraphExecution:v(q)},Ce,fe,ke.inc,ke.aborted);if(!(De.hit===null&&Di(De.finding,fe,"base")))continue;let bt=Vt(P,M.modulesById,M.reachMods,fe,M.records);Se.push({advisoryId:te.id,packageName:q.name,symbolName:fe.exportName,modelWouldPromote:bt!==null,...bt!==null?{modelId:bt.modelId}:{},anchorCleared:bt!==null})}}}let dn=re.some(q=>q.modelId!==void 0);Ke={records:Ut,deltas:ot,exitCodes:{baseline:$n(On["reachable-high"]+On["reachable-medium"],On.unknown+(dn?1:0)),withBindingForms:$n(be["reachable-high"]+be["reachable-medium"],be.unknown+(dn?1:0))},dualRunWallMs:Date.now()-j,..._.bindingApplicability!==void 0?{applicability:_.bindingApplicability}:{},...Se!==void 0?{modelProbe:Se}:{}},Pi(gn.dirname(e.bindingShadow.outPath),{recursive:!0});let Je=`${e.bindingShadow.outPath}.tmp-${Ri(8).toString("hex")}`;$i(Je,`${JSON.stringify(Ke,null,2)}
+`,{encoding:"utf8",flag:"wx"}),Oi(Je,e.bindingShadow.outPath)}let pe=new Zn(t),xn=new Map,Te=j=>{let ie=xn.get(j);if(ie!==void 0)return ie;let $e=j==="npm"?new yr(P,pe,xr("npm"),()=>""):new yr(l?.graph??jt,pe,xr("PyPI"),wc((l?.roots??[]).map(Oe=>Oe.rootRel)));return xn.set(j,$e),$e},sn=ne.length>0||se.notes.length>0?{active:se.models.length,stored:ne.length,promoted:re.filter(j=>j.modelId!==void 0).length,notes:[...se.notes,...oe!==null?oe.notes:[]]}:void 0,Sn=Px(re,n,nt),Kt=Sn.findings.map(j=>j.path===void 0?j:{...j,located:Te(j.ecosystem).locate(j)}),rt=Ac(t,Kt,d.perRoot.flatMap(j=>j.pythonLockfilePath?[j.pythonLockfilePath]:[])),St;if(e.influenceShadow!==void 0){let j=_a(P,Sn.findings,()=>Bt.now());Pi(gn.dirname(e.influenceShadow.outPath),{recursive:!0});let ie=`${e.influenceShadow.outPath}.tmp-${Ri(8).toString("hex")}`;$i(ie,`${JSON.stringify(j,null,2)}
+`,{encoding:"utf8",flag:"wx"}),Oi(ie,e.influenceShadow.outPath),St={ports:j.totals.ports,byOutcome:j.totals.byOutcome,wallMs:j.wallMs}}return{...St!==void 0?{influenceShadow:St}:{},...ce!==void 0?{summaryShadow:ce}:{},...xe!==void 0?{modelShadow:xe}:{},...Ke!==void 0?{bindingShadow:Ke}:{},...sn!==void 0?{modelLane:sn}:{},dir:t,shardSchemaVersion:r.schemaVersion,installed:d,findings:Kt.map((j,ie)=>{let $e=rt.idOf[ie]??null;return $e===null?j:{...j,introducedBy:$e}}),packageGraphs:rt.graphs,timings:Sn.timings,counts:be,analyzerDiagnostics:L,pythonDiagnostics:l?.diagnostics??[],analysisAborted:ee,rejectedEntries:h,entrypointSources:S,entrypointGaps:[...x.gaps,...x.surfaceGaps],entrypointObservations:x.observations,framework:x.framework,unresolved:R,advisories:[...de.values()],rootSet:a,exitCode:X,adr105:H.report}}finally{e.reader===void 0&&r.close()}}var Mi=e=>Math.round(e*10)/10;function Px(e,n,t){let r=Bt.now(),o=e.map(i=>{let a=jo(i.tier);return a===void 0?i:{...i,influence:a}}),s=Bt.now()-r;return{findings:o,timings:{scanMs:Mi(r-n),cascadeMs:Mi(t),stage6Ms:Mi(s)}}}var Ox="cupel",$x="reachability-first SCA \u2014 verdict + call path + confidence";function ji(e){return[`${Ox} v${e} \u2014 ${$x}`,`cascade: ${ba.join(" \u2192 ")}`,`verdicts: ${ka.join(", ")}`,"","usage: cupel scan <dir> [--shard <npm.sqlite>] [--sarif <file>] [--fail-on-reachable] [--fail-on-unknown]","  --shard               path to the npm symbol shard (or set CUPEL_SHARD_NPM)","  --shard-pypi          path to the PyPI shard (or set CUPEL_SHARD_PYPI); Python distributions","                        found in a .venv are assessed against it, else reported as not assessed","  --sarif               also write a SARIF 2.1.0 report","  --fail-on-reachable   exit 2 when any reachable finding is present (for CI)","  --fail-on-unknown     exit 2 when any unknown verdict is present (strict CI)","","       cupel login     store a delivery token for this machine (read from stdin)","       cupel logout    forget it","  On GitHub Actions neither is needed: the workflow authenticates with a token GitHub","  signs per run. Elsewhere a scan fetches the advisory database with the stored token,","  or CUPEL_DELIVERY_TOKEN, or works offline from a shard you already have (--shard)."].join(`
+`)}var Cx=new Set([...Go,...Wo]);function An(e,n,t){let r=e[n+1];if(r===void 0||r.startsWith("--"))throw new Error(`${t} requires a value`);return r}function Mx(e){let n=e.split(",").map(o=>o.trim()),t=[...Go,...Wo].join(", ");if(n.length===0||n.some(o=>o===""))throw new Error(`--fail-on-unknown= requires a non-empty comma-separated list of: ${t} (or pass the bare --fail-on-unknown to fail on every kind)`);let r=[];for(let o of n){if(!Cx.has(o))throw new Error(`unknown --fail-on-unknown selector ${JSON.stringify(o)}; valid: ${t}`);r.push(o)}return r}function qc(e){let n=".",t,r,o,s=!1,i=!1,a=!1,d=!1,l=!1,c,p,u,m=!1,h=!1,x,y,S=!1,k=!0,E=!1,g,b=[],w=[];for(let I=0;I<e.length;I+=1){let N=e[I];if(N==="--require-complete-denial"){i=!0;continue}if(N==="--fail-on-reachable")s=!0;else if(N==="--fail-on-unknown")a="all";else if(N!==void 0&&N.startsWith("--fail-on-unknown="))a=Mx(N.slice(18));else if(N==="--offline")d=!0;else if(N==="--sarif")t=An(e,I,"--sarif"),I+=1;else if(N==="--shard")r=An(e,I,"--shard"),I+=1;else if(N==="--shard-pypi")o=An(e,I,"--shard-pypi"),I+=1;else if(N==="--entry")b.push(An(e,I,"--entry")),I+=1;else if(N==="--root")w.push(An(e,I,"--root")),I+=1;else if(N==="--summary-shadow")c=An(e,I,"--summary-shadow"),I+=1;else if(N==="--model-shadow")p=An(e,I,"--model-shadow"),I+=1;else if(N==="--model-shadow-out")u=An(e,I,"--model-shadow-out"),I+=1;else if(N==="--model-shadow-widened")m=!0;else if(N==="--binding-shadow")h=!0;else if(N==="--x-influence-shadow")y=An(e,I,"--x-influence-shadow"),I+=1;else if(N==="--binding-shadow-out")x=An(e,I,"--binding-shadow-out"),I+=1;else if(N==="--x-partial-rows")S=!0;else if(N==="--no-tsconfig-paths")k=!1;else if(N==="--x-tsconfig-paths")k=!0;else if(N==="--push")E=!0;else if(N!==void 0&&N.startsWith("--auth=")){let v=N.slice(7);if(v!=="oidc"&&v!=="token")throw new Error(`--auth must be oidc or token, got ${JSON.stringify(v)}`);g=v}else{if(N!==void 0&&N.startsWith("--"))throw new Error(`unknown flag ${N}`);N!==void 0&&!l&&(n=N,l=!0)}}if(p===void 0!=(u===void 0))throw new Error("--model-shadow and --model-shadow-out must be given together");if(m&&p===void 0)throw new Error("--model-shadow-widened only means something with --model-shadow");if(h!==(x!==void 0))throw new Error("--binding-shadow and --binding-shadow-out must be given together");if(g!==void 0&&!E)throw new Error("--auth only means something with --push");return{dir:n,sarif:t,shard:r,shardPypi:o,failOnReachable:s,requireCompleteDenial:i,failOnUnknown:a,offline:d,entry:b,root:w,summaryShadow:c,modelShadow:p,modelShadowOut:u,modelShadowWidened:m,push:E,auth:g,bindingShadow:h,bindingShadowOut:x,influenceShadowOut:y,partialRows:S,tsconfigPaths:k}}import{chmodSync as Kx,mkdirSync as Ux,readFileSync as zx,renameSync as Gx,statSync as Wx,unlinkSync as qx,writeFileSync as Vx}from"node:fs";import{randomBytes as Hx}from"node:crypto";import{homedir as Xx}from"node:os";import yt from"node:path";import{createPublicKey as Tx,verify as Dx}from"node:crypto";function rn(e,n){let t=new URL(e);if(t.protocol!=="https:")throw new Error(`refusing non-https url: ${e}`);if(t.username!==""||t.password!=="")throw new Error(`refusing url carrying userinfo for host ${t.hostname}`);if(t.port!=="")throw new Error(`refusing url with explicit port ${t.port} for host ${t.hostname}`);if(!n.has(t.hostname))throw new Error(`refusing unpinned host ${t.hostname} (allowed: ${[...n].join(", ")})`);if(t.origin!==`https://${t.hostname}`)throw new Error(`refusing non-canonical authority for host ${t.hostname}`);return t}async function Vc(e,n={}){let t=n.maxBytes??1073741824,r=n.timeoutMs??3e4,{get:o}=await import("node:https");return await new Promise((s,i)=>{let a=o(e,n.headers!==void 0?{headers:n.headers}:{},d=>{let l=d.statusCode??0;if(l<200||l>=300){d.resume(),i(new Error(`GET ${e} \u2192 HTTP ${String(l)}`));return}let c=[],p=0;d.on("data",u=>{if(p+=u.length,p>t){d.destroy(),i(new Error(`GET ${e} exceeded ${String(t)} bytes`));return}c.push(u)}),d.on("end",()=>{s(Buffer.concat(c))}),d.on("error",i)});a.on("error",i),a.setTimeout(r,()=>{a.destroy(new Error(`GET ${e} timed out after ${String(r)}ms`))})})}async function wr(e,n,t,r,o,s=3e4){let{request:i}=await import("node:https"),a=new URL(n).hostname;return await new Promise((d,l)=>{let c=i(n,{method:e,headers:t},p=>{let u=[],m=0;p.on("data",h=>{if(m+=h.length,m>o){p.destroy(),l(new Error(`${e} to ${a} returned more than ${String(o)} bytes`));return}u.push(h)}),p.on("end",()=>{d({status:p.statusCode??0,body:Buffer.concat(u).toString("utf8")})}),p.on("error",()=>{l(new Error(`${e} to ${a} failed`))})});c.on("error",()=>{l(new Error(`${e} to ${a} failed`))}),c.setTimeout(s,()=>{c.destroy(new Error(`${e} to ${a} timed out after ${String(s)}ms`))}),r!==void 0&&c.write(r),c.end()})}var ae=class extends Error{constructor(n){super(n),this.name="DistError"}},gt=class extends ae{constructor(n){super(n),this.name="NoCachedShardError"}},Lx=Buffer.from("302a300506032b6570032100","hex"),Fx=32;function Jc(e){let n;try{n=Buffer.from(e,"base64")}catch{return}if(n.length===Fx)try{return Tx({key:Buffer.concat([Lx,n]),format:"der",type:"spki"})}catch{return}}function Bi(e,n,t){for(let r of t){let o=Jc(r);if(o!==void 0)try{if(Dx(null,e,o,n))return!0}catch{}}return!1}function Zc(e){return e.some(n=>Jc(n)!==void 0)}var jx=/^[0-9a-f]{64}$/u,Bx=/^[a-z0-9-]+$/u;function Hc(e,n){if(typeof e!="object"||e===null||Array.isArray(e))throw new ae(`${n} must be an object`);return e}function Xc(e,n){if(!Array.isArray(e))throw new ae(`${n} must be an array`);return e}function wo(e,n){if(typeof e!="number"||!Number.isInteger(e))throw new ae(`${n} must be an integer`);return e}function Eo(e,n){if(typeof e!="string")throw new ae(`${n} must be a string`);return e}function Yc(e,n){let t=Eo(e,n);if(Number.isNaN(Date.parse(t)))throw new ae(`${n} is not a valid timestamp: ${t}`);return t}function Ki(e,n){let t;try{t=JSON.parse(e.toString("utf8"))}catch{throw new ae("distribution index is not valid JSON")}let r=Hc(t,"index"),o=wo(r.schema_version,"schema_version");if(o!==n.supportedIndexSchemaVersion)throw new ae(`index schema_version ${String(o)} is not understood (this cupel speaks ${String(n.supportedIndexSchemaVersion)})`);let s=wo(r.sequence,"sequence");if(s<0)throw new ae("sequence must be non-negative");let i=Yc(r.generated,"generated"),a=Xc(r.shards,"shards"),d;for(let h of a){let x=Hc(h,"shard entry"),y=Eo(x.ecosystem,"ecosystem");if(!Bx.test(y))throw new ae(`ecosystem ${JSON.stringify(y)} is malformed`);if(y===n.ecosystem){d=x;break}}if(d===void 0)throw new ae(`no shard for ecosystem ${JSON.stringify(n.ecosystem)}`);Yc(d.built,"built");let l=wo(d.db_schema_version,"db_schema_version");if(l<1)throw new ae("db_schema_version must be >= 1");if(l>n.supportedDbSchemaVersion)throw new ae(`this shard needs a newer cupel (db_schema_version ${String(l)} > supported ${String(n.supportedDbSchemaVersion)}); upgrade cupel (npm i -g @cupel-sh/cli) or pass an older --shard`);let c=Eo(d.sha256,"sha256");if(!jx.test(c))throw new ae(`sha256 must be 64 lowercase hex, got ${JSON.stringify(c)}`);let p=wo(d.size_bytes,"size_bytes");if(p<=0||p>n.hardMaxBytes)throw new ae(`size_bytes ${String(p)} out of bounds (0, ${String(n.hardMaxBytes)}]`);let u=Xc(d.urls,"urls");if(u.length===0)throw new ae("urls must be a non-empty array");let m=[];for(let h of u){let x=Eo(h,"url");try{m.push(rn(x,n.shardHosts))}catch(y){throw new ae(`refusing shard url ${JSON.stringify(x)}: ${y.message}`)}}return{ecosystem:n.ecosystem,sha256:c,sizeBytes:p,dbSchemaVersion:l,urls:m,sequence:s,generated:i}}var Qc="CUPEL_CONFIG_DIR",eu="credentials.json",Ui="cpd_",Yx="cpl_",Jx=Ui.length+6+32,Zx=200,Qx=/^[A-Za-z0-9_-]+$/u,Er=class extends ae{constructor(n){super(n),this.name="StoredCredentialError"}};function nu(e){let n=e.CUPEL_CONFIG_DIR;if(n!==void 0&&n!=="")return n;let t=Xx();if(process.platform==="darwin")return yt.join(t,"Library","Application Support","cupel");if(process.platform==="win32"){let s=e.APPDATA,i=s!==void 0&&s!==""?s:yt.join(t,"AppData","Roaming");return yt.join(i,"cupel")}let r=e.XDG_CONFIG_HOME,o=r!==void 0&&r!==""?r:yt.join(t,".config");return yt.join(o,"cupel")}function vo(e){return yt.join(nu(e),eu)}function zi(e){let n=e.trim();return n.startsWith(Yx)?{ok:!1,reason:"push-token"}:n.startsWith(Ui)?n.length<Jx||n.length>Zx?{ok:!1,reason:"malformed"}:Qx.test(n.slice(Ui.length))?{ok:!0,token:n}:{ok:!1,reason:"malformed"}:{ok:!1,reason:"malformed"}}function tu(e,n){let t=nu(e),r=yt.join(t,eu);Ux(t,{recursive:!0,mode:448}),process.platform!=="win32"&&Kx(t,448);let o=JSON.stringify({version:1,delivery_token:n,written_at:new Date().toISOString()}),s=`${r}.tmp-${Hx(8).toString("hex")}`;return Vx(s,`${o}
+`,{flag:"wx",mode:384}),Gx(s,r),r}function ru(e){let n=vo(e),t;try{t=Wx(n)}catch(i){if(i instanceof Error&&i.code==="ENOENT")return;throw i}if(process.platform!=="win32"&&(t.mode&63)!==0)throw new Er(`the stored delivery token at ${n} is readable by other users \u2014 run \`chmod 600 ${n}\`, or \`cupel login\` again to rewrite it`);let r;try{r=JSON.parse(zx(n,"utf8"))}catch{throw new Er(`the stored delivery token at ${n} is not readable \u2014 run \`cupel login\` again to rewrite it`)}let o=typeof r=="object"&&r!==null&&"delivery_token"in r?r.delivery_token:void 0,s=zi(typeof o=="string"?o:"");if(!s.ok)throw new Er(`the stored credential at ${n} is not a delivery token \u2014 run \`cupel login\` with one from app.cupel.sh (Settings \u2192 Tokens)`);return s.token}function ou(e){try{return qx(vo(e)),!0}catch(n){if(n instanceof Error&&n.code==="ENOENT")return!1;throw n}}var vr="CUPEL_DELIVERY_TOKEN",Gi=class extends ae{constructor(n){super(n),this.name="NoDeliveryTokenError"}},Wi=class extends ae{constructor(n){super(n),this.name="DeliveryCredentialError"}};function eS(e){let n=e.CUPEL_DELIVERY_TOKEN;return n===void 0||n===""?void 0:n}function su(e,n,t=()=>{}){let r=eS(e)??t();return r!==void 0?()=>Promise.resolve(r):e.ACTIONS_ID_TOKEN_REQUEST_URL!==void 0&&e.ACTIONS_ID_TOKEN_REQUEST_URL!==""?n:void 0}async function iu(e){if(e===void 0)throw new Gi(`no delivery credential \u2014 on GitHub Actions add \`permissions: id-token: write\` to the workflow; elsewhere run \`cupel login\` with a delivery token from app.cupel.sh (Settings \u2192 Tokens), or set ${vr} in CI; or pass --shard <path> (a local shard needs no account)`);try{return await e()}catch(n){throw new Wi(`could not obtain a delivery credential: ${n instanceof Error?n.message:String(n)}`)}}var nS="Paste a delivery token from app.cupel.sh (Settings \u2192 Tokens); input is hidden: ";function tS(){return new Promise(e=>{let n=process.stdin;process.stderr.write(nS),n.setRawMode(!0),n.resume(),n.setEncoding("utf8");let t="",r=s=>{n.setRawMode(!1),n.pause(),n.removeListener("data",o),process.stderr.write(`
+`),s===null&&process.exit(130),e(s)},o=s=>{for(let i of s){if(i==="")return r(null);if(i==="\r"||i===`
+`)return r(t);if(i==="\x7F"||i==="\b"){t=t.slice(0,-1);continue}t+=i}};n.on("data",o)})}async function rS(){let e=[];for await(let t of process.stdin)e.push(Buffer.isBuffer(t)?t:Buffer.from(String(t),"utf8"));return Buffer.concat(e).toString("utf8").split(/\r?\n/u).find(t=>t.trim()!=="")??""}function au(e,n){let t=e[0];return t===void 0?!1:(process.stderr.write(`cupel ${n}: unknown option '${W(t)}' \u2014 the token is read from standard input, never from an argument (it would land in shell history and \`ps\`)
+`),!0)}async function lu(e){if(au(e,"login"))return 1;let n=process.stdin.isTTY?await tS():await rS(),t=zi(n);if(!t.ok)return process.stderr.write(t.reason==="push-token"?`cupel login: that is a push token (cpl_\u2026), which authenticates one repository's findings push and is set as CUPEL_TOKEN in CI. Sign in with a delivery token (cpd_\u2026) from app.cupel.sh \u2014 Settings \u2192 Tokens \u2014 which fetches the advisory database for the whole organisation.
 `:`cupel login: that is not a delivery token. Paste the whole token as shown once on app.cupel.sh (Settings \u2192 Tokens); it starts with cpd_.
-`),1;let o=hd(process.env,t.token);return process.stdout.write(`signed in: delivery token stored at ${o} (readable by you alone). \`cupel scan\` uses it outside GitHub Actions; ${Gt} in the environment still wins, and \`cupel logout\` forgets it.
-`),0}function Ed(e){if(bd(e,"logout"))return 1;let n=Fo(process.env);return yd(process.env)?process.stdout.write(`signed out: removed ${n}. The token itself still works until it is revoked on app.cupel.sh (Settings \u2192 Tokens).
-`):process.stdout.write(`nothing to sign out of: no delivery token stored at ${n} (${fd} would point elsewhere).
-`),0}import yy from"node:path";import{randomBytes as Lg,createHash as Fg}from"node:crypto";import{mkdirSync as jg,readFileSync as Bg,renameSync as Kg,writeFileSync as Ug}from"node:fs";import{homedir as zg}from"node:os";import Yn from"node:path";var Is="latest.json",As="latest.json.sig";function jo(e){return Fg("sha256").update(e).digest("hex")}function _s(){let e=process.env.CUPEL_CACHE_DIR;if(e!==void 0&&e!=="")return e;let n=zg();if(process.platform==="darwin")return Yn.join(n,"Library","Caches","cupel","shards");if(process.platform==="win32"){let r=process.env.LOCALAPPDATA,s=r!==void 0&&r!==""?r:Yn.join(n,"AppData","Local");return Yn.join(s,"cupel","shards")}let t=process.env.XDG_CACHE_HOME,o=t!==void 0&&t!==""?t:Yn.join(n,".cache");return Yn.join(o,"cupel","shards")}function Ns(e,n,t){return Yn.join(e,`${n}-${t}.sqlite`)}function Bo(e,n){jg(Yn.dirname(e),{recursive:!0});let t=`${e}.tmp-${Lg(8).toString("hex")}`;Ug(t,n,{flag:"wx"}),Kg(t,e)}function Ht(e){try{return Bg(e)}catch(n){if(n instanceof Error&&n.code==="ENOENT")return;throw n}}function wd(e,n,t,o){let r=Ns(e,n,t),s=Ht(r);if(s===void 0)return;let a=jo(s);if(a!==t)throw o(`cached shard ${r} failed sha256 re-verify (expected ${t}, got ${a})`);return{path:r,bytes:s}}var vd="api.cupel.sh",Ko=new Set(["2b68896688aea5d7cd558798f0d8fbf8.r2.cloudflarestorage.com"]),Id=["tVK6LxjAkqVPe7fE3w09f3mOSGSI6mWf5BXatNoVv8k="];import Uo from"node:path";var Wg="/v1/resolve",Rs=1024*1024,Ps=4096,Ad=Rs+Ps+64*1024,Vg=8,qg=2048,Gg=/^[A-Za-z0-9+/]+={0,2}$/u,Hg=3e4,Pe=class extends ie{constructor(n){super(n),this.name="DeliveryRefusedError"}},Xt=class extends Pe{constructor(n){super(n),this.name="EcosystemUnpublishedError"}},Yt=class extends ie{constructor(n){super(n),this.name="ControlPlaneUnavailableError"}},Jt=class extends ie{constructor(n){super(n),this.name="SequenceFloorRefusedError"}};function Xg(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function Yg(e){if(typeof e!="string"||e.length===0)throw new Pe("the delivery response carried no index signature");if(e.length>Ps||!Gg.test(e))throw new Pe("the delivery response's index signature is not base64");let n=Buffer.from(e,"base64");if(n.toString("base64")!==e)throw new Pe("the delivery response's index signature is not canonical base64");return n}function Jg(e){if(typeof e!="string"||e.length===0)throw new Pe("the delivery response carried no index");let n=Buffer.from(e,"utf8");if(n.length>Rs)throw new Pe("the delivery response's index is larger than one can be");return n}function Zg(e){if(!Array.isArray(e)||e.length===0)throw new Pe("the delivery response named no shard urls");if(e.length>Vg)throw new Pe("the delivery response named more shard urls than one shard has");let n=[];for(let t of e){if(typeof t!="string"||t.length===0||t.length>qg)throw new Pe("the delivery response carried a malformed shard url");n.push(t)}return n}function Qg(e,n){throw e===401||e===403?new Pe(`${n} rejected the delivery credential \u2014 check ${Gt} or the token \`cupel login\` stored, or that the token has not been revoked in the dashboard (Settings \u2192 Tokens)`):e===404?new Xt(`${n} publishes no shard for this ecosystem \u2014 cannot scan without vulnerability data`):e===409?new Jt(`${n} holds nothing newer than the shard index already cached`):e===429?new Yt(`${n} rate-limited the delivery request`):e>=500?new Yt(`${n} answered ${String(e)}`):new Pe(`${n} refused the delivery request with status ${String(e)}`)}async function _d(e,n,t,o,r=Hg){let s=Je(`https://${e}${Wg}`,new Set([e])),a=JSON.stringify({ecosystem:t.ecosystem,sequence_floor:t.sequenceFloor}),l;try{l=await o(s.href,{authorization:`Bearer ${n}`,"content-type":"application/json",accept:"application/json","user-agent":"cupel"},a,r)}catch{throw new Yt(`${e} could not be reached`)}if(l.status!==200&&Qg(l.status,e),Buffer.byteLength(l.body,"utf8")>Ad)throw new Pe(`${e} returned a delivery response larger than one can be`);let i;try{i=JSON.parse(l.body)}catch{throw new Pe(`${e} returned a delivery response that is not JSON`)}if(!Xg(i))throw new Pe(`${e} returned a delivery response that is not an object`);return{index:Jg(i.index),sig:Yg(i.signature),shardUrls:Zg(i.shardUrls)}}var Nd=async(e,n,t,o)=>await Vt("POST",e,{...n,"content-length":String(Buffer.byteLength(t,"utf8"))},t,Ad,o);var ey=8,Os=class extends ie{constructor(n){super(n),this.name="NoUsableShardUrlError"}};function $s(e){return`${e.origin}${e.pathname}`}function Rd(e,n,t){let o=new Map;for(let a of n)o.set($s(a),a);let r=[],s=[];for(let a of e.slice(0,ey)){let l;try{l=Je(a,t)}catch(u){s.push(u.message);continue}if(l.hash!==""){s.push("a candidate carried a fragment");continue}let i=o.get($s(l));if(i===void 0){s.push("a candidate named an object the signed index does not list");continue}let d=new URL(`${$s(i)}${l.search}`);r.push(Je(d.href,t))}if(r.length===0)throw new Os(`no pre-signed shard url matched the signed index (${s.length===0?"none offered":s.join("; ")})`);return r}var ty=1,oy=1024*1024*1024;function ry(e=Ko){return{async resolve(n){return await _d(n.host,n.token,{ecosystem:n.ecosystem,sequenceFloor:n.sequenceFloor},Nd)},async fetchShard(n,t){return Je(n.href,e),await id(n.href,{maxBytes:t,timeoutMs:3e4})}}}function Cs(e){return e instanceof Error?e.message:String(e)}function Pd(e){return{ecosystem:e.ecosystem,supportedIndexSchemaVersion:ty,supportedDbSchemaVersion:e.supportedDbSchemaVersion,shardHosts:e.shardHosts,hardMaxBytes:oy}}function sy(e){let n=Ht(Uo.join(e.cacheDir,Is)),t=Ht(Uo.join(e.cacheDir,As));if(!(n===void 0||t===void 0)&&Ss(n,t,e.pubkeys))try{return bs(n,Pd(e))}catch{return}}function $d(e,n){let t=Date.parse(e.generated);if(Number.isNaN(t)||n.now-t<=n.maxAgeMs)return[];let o=Math.floor((n.now-t)/864e5);return[`the ${e.ecosystem} shard is ${String(o)} days old (built ${e.generated}); its advisory data may be stale \u2014 connect online to refresh`]}function zo(e,n,t){let o=wd(n.cacheDir,e.ecosystem,e.sha256,r=>new ie(r));if(o===void 0)throw new ie(`the cached index names ${e.ecosystem} shard ${e.sha256} but it is not in the cache \u2014 connect online to repopulate, or pass --shard <path>`);return{path:o.path,fromCache:!0,warnings:[...t,...$d(e,n)],sequence:e.sequence}}async function iy(e,n,t,o){let r=Ns(t.cacheDir,e.ecosystem,e.sha256),s=Ht(r);if(s!==void 0&&jo(s)===e.sha256)return{path:r,downloaded:!1};let a="no shard urls";for(let l of n){let i;try{i=await o.fetchShard(l,e.sizeBytes)}catch(u){a=Cs(u);continue}let d=jo(i);if(d!==e.sha256){a=`sha256 mismatch (expected ${e.sha256}, got ${d})`;continue}return Bo(r,i),{path:r,downloaded:!0}}throw new ie(`could not fetch a verified ${e.ecosystem} shard from any mirror: ${a}`)}function ay(e,n,t){if(e instanceof Pe)throw e;if(e instanceof Jt){if(n===void 0)throw new ie(`the control plane refused to serve an index at or above the requested sequence, and there is no cached ${t.ecosystem} shard \u2014 pass --shard <path>`);return zo(n,t,["the control plane holds nothing newer than the cached shard index; keeping the cached shard"])}if(n===void 0)throw new Hn(`no cached ${t.ecosystem} shard and the delivery seam is unreachable (${Cs(e)}) \u2014 cannot scan without vulnerability data; connect once to populate the cache, or pass --shard <path>`);return zo(n,t,[`could not refresh the shard index (${Cs(e)}); using the cached shard`])}async function Od(e,n){if(!e.activated)throw new ie("zero-config shard delivery is not yet available (ADR-063 token-gated delivery ships in P5) \u2014 pass --shard <path> or set CUPEL_SHARD_NPM");let t=n??ry(e.shardHosts);if(!ud(e.pubkeys))throw new ie("zero-config shard delivery is not activated in this build \u2014 pass --shard <path> or set CUPEL_SHARD_NPM");let o=sy(e);if(e.offline){if(o===void 0)throw new Hn(`--offline and no cached ${e.ecosystem} shard \u2014 connect once to populate the cache, or pass --shard <path>`);return zo(o,e,[])}let r=await Sd(e.credential),s;try{s=await t.resolve({host:e.indexHost,token:r,ecosystem:e.ecosystem,sequenceFloor:o?.sequence??0})}catch(d){return ay(d,o,e)}if(!Ss(s.index,s.sig,e.pubkeys))throw new ie("shard index signature did not verify against any pinned key");let a=bs(s.index,Pd(e));if(o!==void 0&&a.sequence<o.sequence)return zo(o,e,[`refusing a rolled-back shard index (served sequence ${String(a.sequence)} < cached ${String(o.sequence)}); keeping the newer cached shard`]);let l=Rd(s.shardUrls,a.urls,e.shardHosts),i=await iy(a,l,e,t);return Bo(Uo.join(e.cacheDir,Is),s.index),Bo(Uo.join(e.cacheDir,As),s.sig),{path:i.path,fromCache:!i.downloaded,warnings:$d(a,e),sequence:a.sequence}}var ly="https://api.cupel.sh",Cd=".actions.githubusercontent.com",dy=8192;function Md(e){return e.kind==="oidc"||/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/u.test(e.value)?"oidc":"token"}var Ze=class extends Error{constructor(n){super(n),this.name="PushCredentialError"}};function cy(e){let n;try{n=new URL(e).hostname}catch{throw new Ze("ACTIONS_ID_TOKEN_REQUEST_URL is not a URL")}let t=Cd.slice(1);if(n!==t&&!n.endsWith(Cd))throw new Ze(`refusing to send the ID-token request credential to unpinned host ${n}`);try{return Je(e,new Set([n]))}catch{throw new Ze(`ACTIONS_ID_TOKEN_REQUEST_URL for host ${n} is not a plain https authority`)}}async function Wo(e,n){let t=e.ACTIONS_ID_TOKEN_REQUEST_URL,o=e.ACTIONS_ID_TOKEN_REQUEST_TOKEN;if(t===void 0||t==="")throw new Ze("ACTIONS_ID_TOKEN_REQUEST_URL is not set \u2014 the workflow needs `permissions: id-token: write`");if(o===void 0||o==="")throw new Ze("ACTIONS_ID_TOKEN_REQUEST_TOKEN is not set \u2014 the workflow needs `permissions: id-token: write`");let r=cy(t);r.searchParams.set("audience",ly);let s;try{s=await n(r.href,{authorization:`Bearer ${o}`,accept:"application/json","user-agent":"cupel"})}catch{throw new Ze("the ID-token request failed")}if(s.length>dy)throw new Ze("the ID-token response was larger than a token can be");let a;try{a=JSON.parse(s)}catch{throw new Ze("the ID-token response was not JSON")}let l=typeof a=="object"&&a!==null?a.value:void 0;if(typeof l!="string"||l.length===0)throw new Ze("the ID-token response carried no token");return l}async function Td(e,n,t={}){let o=e.CUPEL_TOKEN!==void 0&&e.CUPEL_TOKEN!=="",r=e.ACTIONS_ID_TOKEN_REQUEST_URL!==void 0&&e.ACTIONS_ID_TOKEN_REQUEST_URL!=="";if(t.auth==="token"){if(!o)throw new Ze("--auth=token, but CUPEL_TOKEN is not set");return{kind:"token",value:e.CUPEL_TOKEN??""}}if(t.auth==="oidc")return{kind:"oidc",value:await Wo(e,n)};if(o)return r&&t.warn?.("both CUPEL_TOKEN and GitHub Actions OIDC are available; using CUPEL_TOKEN. Remove the secret to use keyless auth, or pass --auth=oidc."),{kind:"token",value:e.CUPEL_TOKEN??""};if(r)return{kind:"oidc",value:await Wo(e,n)};throw new Ze("no credential for the findings push: set CUPEL_TOKEN, or add `permissions: id-token: write` to the workflow")}var Ms="api.cupel.sh",uy=`https://${Ms}/v1/findings`,fy=64*1024,Vo=8*1024*1024,py=3e4,Mn=class extends Error{constructor(n){super(n),this.name="PushError"}};async function Dd(e,n,t,o={}){if(e.length>Vo)throw new Mn(`findings payload is ${String(e.length)} bytes, over the ${String(Vo)}-byte limit`);let r=Je(uy,new Set([Ms])),s;try{s=await t(r.href,{authorization:`Bearer ${n}`,"content-type":"application/json","user-agent":"cupel"},e,o.timeoutMs??py)}catch{throw new Mn(`the findings push to ${Ms} failed`)}if(s.body.length>fy)throw new Mn("the control plane returned a response larger than it should");if(!(s.status===202||s.status===200))throw s.status===401||s.status===403?new Mn("the control plane rejected the credential \u2014 check CUPEL_TOKEN, or that the workflow grants `permissions: id-token: write` and the repository is connected in the dashboard"):s.status===400?new Mn("the control plane rejected the findings payload as malformed"):new Mn(`the findings push was refused with status ${String(s.status)}`)}var my=64*1024,hy=64*1024,Ld=async(e,n,t,o)=>{if(Buffer.byteLength(t,"utf8")>Vo)throw new Error("findings payload is over the size limit");return await Vt("POST",e,{...n,"content-length":String(Buffer.byteLength(t,"utf8"))},t,hy,o)};async function qo(e,n){let t=await Vt("GET",e,n,void 0,my,15e3);if(t.status!==200)throw new Error(`the ID-token request was refused with status ${String(t.status)}`);return t.body}var xy=720*60*60*1e3,Sy=Number(jn);function Fd(e){let n=process.env.CUPEL_SHARD_PYPI;return e??(n!==void 0&&n!==""?n:void 0)}function jd(e){let n=process.env.CUPEL_SHARD_NPM,t=e??(n!==void 0&&n!==""?n:void 0);if(t===void 0)throw new ln("no npm shard configured \u2014 pass --shard <path> or set CUPEL_SHARD_NPM (zero-config token-gated delivery ships in P5 \u2014 ADR-063)");return t}async function Ts(e){let n=e.ecosystem??"npm",t=await Od({ecosystem:n,activated:!0,pubkeys:Id,indexHost:vd,shardHosts:Ko,credential:xd(process.env,()=>Wo(process.env,qo),()=>gd(process.env)),cacheDir:n==="npm"?_s():yy.join(_s(),n),offline:e.offline,now:Date.now(),maxAgeMs:xy,supportedDbSchemaVersion:Sy});for(let o of t.warnings)process.stderr.write(`cupel: ${o}
-`);return{path:t.path,sequence:t.sequence}}var by=9,ky={maxFindings:2e4,maxPathSteps:512,maxUnresolvedSites:131072,maxStringLength:4096,maxReasonLength:8192,maxAdvisories:2e4,maxAdvisoryRanges:64,maxAdvisoryDetails:8e3},vn=class extends Error{constructor(n){super(n),this.name="PayloadError"}};function Ds(e){return{path:e.path,start:e.start,end:e.end}}function Ey(e){if(e.tier==="unknown"&&e.unknownKind===void 0)throw new vn(`finding ${e.advisoryId} is unknown with no kind \u2014 an unknown without its kind is a hedge`);let n=e.tier==="unknown"?e.unknownKind:null,t=e.modelId??null,o=e.modelPromotedFromKind??null;if(t===null!=(o===null))throw new vn(`finding ${e.advisoryId} carries half a model provenance \u2014 the model and the kind it promoted from travel together`);if(t!==null&&e.tier!=="reachable-low")throw new vn(`finding ${e.advisoryId} claims model provenance on ${e.tier}; only reachable-low can`);return{advisoryId:e.advisoryId,displayId:e.displayId,packageName:e.packageName,packageVersion:e.version,ecosystem:e.ecosystem,symbolName:e.symbolName,severity:e.severity,tier:e.tier,reason:e.reason,unknownKind:n,unknownOwner:n===null?null:Zs(n),basis:e.basis??null,path:e.path===void 0?null:e.path.map(r=>({functionName:r.functionName??null,modulePath:r.modulePath})),unresolvedSites:e.unresolvedEvidence.own.map(Ds),unresolvedSets:[...e.unresolvedEvidence.sets],modelId:t,modelPromotedFromKind:o,surfaceComplete:e.surfaceComplete??null}}var wy="";function vy(e){let n=[e.advisoryId,e.packageName,e.packageVersion,e.symbolName??""];return(e.ecosystem==="npm"?n:[...n,e.ecosystem]).join(wy)}function Iy(e){let n=new Map;for(let t of e){let o=vy(t),r=n.get(o);if(r===void 0){n.set(o,t);continue}if(r.tier!==t.tier||r.unknownKind!==t.unknownKind)throw new vn(`the scan produced two different verdicts for ${t.advisoryId} on ${t.packageName}@${t.packageVersion}${t.symbolName===null?"":` (${t.symbolName})`}: ${r.tier} and ${t.tier}. They share one finding identity, so only the second would be stored \u2014 refusing to push rather than let a verdict be dropped. This is a cupel bug; please report it.`)}return[...n.values()]}function Ay(e){let n=ky,t=(o,r,s)=>{throw new vn(`${o} has ${String(r)} entries, over the ${String(s)} the control plane accepts`)};e.findings.length>n.maxFindings&&t("the findings list",e.findings.length,n.maxFindings);for(let o of["dispatch","load"]){let r=e.unresolved[o].length;r>n.maxUnresolvedSites&&t(`the app-global ${o} set`,r,n.maxUnresolvedSites)}for(let o of e.findings)o.path!==null&&o.path.length>n.maxPathSteps&&t(`the call path of finding ${o.advisoryId}`,o.path.length,n.maxPathSteps),o.unresolvedSites.length>n.maxUnresolvedSites&&t(`the unresolved sites of finding ${o.advisoryId}`,o.unresolvedSites.length,n.maxUnresolvedSites);e.advisories.length>n.maxAdvisories&&t("the advisories list",e.advisories.length,n.maxAdvisories);for(let o of e.advisories){if(o.ranges.length>n.maxAdvisoryRanges&&t(`the ranges of advisory ${o.id}`,o.ranges.length,n.maxAdvisoryRanges),o.summary!==null&&o.summary.length>n.maxStringLength)throw new vn(`the summary of advisory ${o.id} is ${String(o.summary.length)} characters, over the ${String(n.maxStringLength)} the control plane accepts`);if(o.details!==null&&o.details.length>n.maxAdvisoryDetails)throw new vn(`the description of advisory ${o.id} is ${String(o.details.length)} characters, over the ${String(n.maxAdvisoryDetails)} the control plane accepts`)}}function _y(e,n){let t=new Set(n.map(o=>o.advisoryId));return e.advisories.filter(o=>t.has(o.advisory.id)).map(o=>({id:o.advisory.id,cveId:o.advisory.cveId,osvId:o.advisory.osvId,summary:o.advisory.summary,details:o.advisory.details??null,severity:o.advisory.severity,published:o.advisory.published,source:o.advisory.source,ranges:o.ranges.map(r=>({packageName:r.packageName,introduced:r.introduced,fixed:r.fixed,lastAffected:r.lastAffected}))}))}function Bd(e,n){let t=Iy(e.findings.map(Ey)),o={version:by,scanId:n.scanId,scannedAt:n.scannedAt,context:{shardSequence:n.shardSequence,shardSchemaVersion:e.shardSchemaVersion,ecosystem:n.ecosystem,analysisAborted:e.analysisAborted,entrypointCount:e.entrypointSources.length,installedPackageCount:e.installed.packages.length},findings:t,unresolved:{dispatch:e.unresolved.dispatch.map(Ds),load:e.unresolved.load.map(Ds)},advisories:_y(e,t)};return Ay(o),o}function Kd(e){let n=new Set(e.installed.packages.map(o=>o.ecosystem??"npm")),t=["npm","PyPI"].filter(o=>n.has(o));return t.length===0?"npm":t.join("+")}function Ny(e){return e.counts["not-reachable"]===0?" (ignorable)":e.findings.some(t=>t.tier==="not-reachable"&&t.basis==="loader-assumption")?" (assumed: no dependency loader loads them)":" (ignorable)"}var Ry={"reachable-high":"HIGH ","reachable-medium":"MED  ","reachable-low":"LOW  "},Ud=4,Ls=3,Fs=10,zd={"no-entrypoint":"no entrypoint analyzed \u2014 pass --entry <file> or declare main","analyzer-crash":"cupel's analyzer produced no graph \u2014 please report this","version-undecidable":"installed version is not an exact x.y.z; pin a release to get a verdict","db-gap":"no symbol data for the advisory yet","unverified-symbol":"candidate symbol named but not gate-certified","symbol-unsupported":"the trigger is a property access or pattern, not a call","dep-opaque":"the corridor runs through dependency bodies cupel does not analyze","dynamic-load":"non-literal require/import or loader escape in reach",dispatch:"unresolved call target in reach","resolution-divergence":"cupel may be analyzing a different file than Node runs","analysis-cap":"cupel hit a budget or could not parse a file in reach","coverage-gap":"cupel's dependency enumeration was incomplete \u2014 packages may be missing","incomplete-surface":"the named symbols are not reached, but the advisory's symbol set is known incomplete \u2014 an unnamed one may be"},Py="(symbol set known incomplete)";function $y(e){let n=(e.path??[]).map(t=>W(t.functionName??"<anon>"));return n.length>0?n.join(" \u2192 "):"(no path)"}function Wd(e){return[...new Set(e.unresolvedSites.map(n=>n.path).filter(n=>n!==""))]}function Oy(e){let n=e.findings.filter(d=>d.tier==="unknown"&&d.unknownKind!==void 0);if(n.length===0)return[];let t=new Map;for(let d of n){let u=t.get(d.unknownKind)??[];u.push(d),t.set(d.unknownKind,u)}let o={cupel:0,project:0};for(let[d,u]of t)o[qe[d]]+=u.length;let r=[];r.push(`\u2753 Unknown (${String(n.length)}) \u2014 cupel could NOT decide reachability. This is not a clean result.`);let s=(d,u)=>{if(o[d]===0)return;r.push(""),r.push(`   ${u} (${String(o[d])}):`);let p=[...t.entries()].filter(([m])=>qe[m]===d).sort((m,g)=>g[1].length-m[1].length||m[0].localeCompare(g[0])),f=p.slice(0,Ud);for(let[m,g]of f){let y=d==="project"?[...new Set(g.flatMap(Wd))]:[],b=y.slice(0,Ls).map(W).join(", "),x=y.length>Ls?` (+${String(y.length-Ls)} more files)`:"";r.push(`     ${m.padEnd(21)} ${String(g.length).padStart(4)}  ${zd[m]}`+(b!==""?`
-       ${b}${x}`:""))}for(let[m,g]of p.slice(Ud))r.push(`     ${m.padEnd(21)} ${String(g.length).padStart(4)}  ${zd[m]}`)};s("project","Your code \u2014 a change on your side would produce a real verdict"),s("cupel","cupel's gap \u2014 nothing you can do today");let a=new Map;for(let d of n)if(qe[d.unknownKind]==="project")for(let u of Wd(d))a.set(u,(a.get(u)??0)+1);let l=[...a.entries()].sort((d,u)=>u[1]-d[1]||d[0].localeCompare(u[0]))[0];l!==void 0&&o.project>0&&(r.push(""),r.push(`   \u279C Start here: ${W(l[0])} appears in ${String(l[1])} of your ${String(o.project)} finding(s), across ${String(a.size)} file(s) total. A finding is decided only once EVERY site it lists resolves.`));let i=n.filter(d=>qe[d.unknownKind]==="project");if(i.length>0){r.push("");for(let d of i.slice(0,Fs))r.push(`     ${W(d.displayId)}  ${W(d.packageName)}@${W(d.version)}  [${d.unknownKind}] ${W(d.reason)}`);i.length>Fs&&r.push(`     \u2026 and ${String(i.length-Fs)} more`)}return r.push(""),r}function Vd(e){let n=[],t=e.counts,o=e.findings.filter(d=>d.tier==="reachable-high"||d.tier==="reachable-medium"||d.tier==="reachable-low");if(n.push(`cupel scan: ${W(e.dir)}`),n.push(`  ${e.installed.packages.length} installed packages (${e.installed.source}); shard schema v${e.shardSchemaVersion}`),n.push(""),e.entrypointSources.length>0){let d=e.entrypointSources.slice(0,8);n.push(`\u{1F4CD} Entrypoints analyzed (${String(e.entrypointSources.length)}): `+d.map(u=>`${W(u.entrypoint)} [${W(u.source)}]`).join(", ")+(e.entrypointSources.length>d.length?`, \u2026 and ${String(e.entrypointSources.length-d.length)} more`:"")),n.push("")}if(e.entrypointObservations.length>0){let d=new Map;for(let u of e.entrypointObservations)d.set(u.kind,(d.get(u.kind)??0)+1);n.push("\u2139\uFE0F  index.html scripts not seeded: "+[...d.entries()].map(([u,p])=>`${String(p)} ${u}`).join(", ")+` (${W(e.entrypointObservations[0]?.detail??"")}${e.entrypointObservations.length>1?", \u2026":""})`),n.push("")}if(e.rootSet.budget!=="not-attempted"){let d=e.rootSet,u=d.roots.slice(0,8);if(n.push(`\u{1F5C2}  Project roots (${String(d.counts.rootsAdmitted)}): `+u.map(m=>`${W(m.rel===""?".":m.rel)} [${m.witnesses.join("+")}${m.ecosystem==="PyPI"?"; PyPI":m.alsoPython===!0?"; npm+PyPI":""}]`).join(", ")+(d.roots.length>u.length?`, \u2026 and ${String(d.roots.length-u.length)} more`:"")),d.observations.length>0){let m=new Map;for(let g of d.observations)m.set(g.kind,(m.get(g.kind)??0)+1);n.push("    not admitted: "+[...m.entries()].map(([g,y])=>`${String(y)} ${g}`).join(", "))}n.push(`    walk: ${String(d.counts.dirsWalked)} dirs, ${String(d.counts.manifestsSeen)} manifests seen, ${String(d.counts.dotDirectoriesSkipped)} dot-dirs skipped \u2014 budget ${d.budget}`);let p=e.installed.perRoot.filter(m=>m.rootRel!=="");p.length>0&&n.push(`    enumerated (${String(p.length)} nested root${p.length===1?"":"s"}): `+p.slice(0,8).map(m=>`${W(m.rootRel)} (${String(m.packages.length)} packages, ${m.source})`).join(", ")+(p.length>8?`, \u2026 and ${String(p.length-8)} more`:""));let f=ct(d,e.entrypointSources);f.length>0&&n.push(`    NOT analyzed (${String(f.length)}): ${W(Yr(f.map(m=>m.rel===""?".":m.rel)))} \u2014 code there can load any installed package, so every not-reachable in this scan is capped at unknown until they are analyzed`),d.budget!=="complete"&&d.budget!=="not-attempted"&&n.push(`    the walk did not finish (${d.budget}) \u2014 a root with its own install may have been missed; every not-reachable in this scan is capped at unknown`),n.push("")}if(e.entrypointGaps.length>0){n.push(`\u26A0\uFE0F  Start command(s) cupel could not resolve to an entry file (${String(e.entrypointGaps.length)}) \u2014 that code was NOT analyzed:`);for(let d of e.entrypointGaps.slice(0,5))n.push(`  - ${W(d.source)} (${W(d.file)}): ${W(d.detail)}`);e.entrypointGaps.length>5&&n.push(`  \u2026 and ${String(e.entrypointGaps.length-5)} more`),n.push("   Fix: make it a direct `node <file.js>` invocation cupel can read. --entry <file> analyzes that code too, but verdicts stay capped while the command is unreadable."),n.push("")}e.rejectedEntries.length>0&&(n.push("\u26A0\uFE0F  Ignored --entry (did not resolve to a file inside the app root): "+e.rejectedEntries.map(W).join(", ")),n.push("")),e.analysisAborted==="no-entrypoint"?(n.push("\u{1F6D1} No entrypoint analyzed \u2014 this scan is NOT a clean bill of health."),n.push("   No app entrypoint was found (no --entry; package.json declares no main/bin/exports; no index.js; no usable scripts.start or Procfile command), so cupel analyzed ZERO application code and every finding below is capped at `unknown`, never `not-reachable`."),n.push(e.framework===null?'   Fix: pass --entry <file> (the file your start script or Procfile runs, e.g. --entry server.js), or declare "main" in package.json.':`   ${br(e.framework)}`),n.push("")):e.analysisAborted==="analyzer-crash"&&(n.push("\u{1F6D1} cupel's analyzer failed on this project \u2014 this scan is NOT a clean bill of health."),n.push("   An entrypoint WAS found, but the analyzer produced no module graph, so cupel analyzed ZERO application code and every finding below is capped at `unknown`, never `not-reachable`."),n.push('   Fix: this is a cupel bug \u2014 please report it at https://github.com/cupel-sh/cupel/issues (the "Analysis incomplete" diagnostics below name the file). `--entry` will not help.'),n.push(""));let r=e.installed.gaps,s=r.find(d=>d.kind==="no-enumeration")??null;s!==null&&(n.push("\u{1F6D1} No dependency enumerated \u2014 this scan is NOT a clean bill of health."),n.push(`   [no-enumeration] ${W(s.detail)}`),n.push("   cupel saw ZERO dependencies, so no advisory could be matched and nothing below is a verdict about your dependencies. Commit a lockfile (package-lock.json, yarn.lock or pnpm-lock.yaml) or install before scanning."),n.push(""));let a=r.filter(d=>d!==s);if(a.length>0){n.push(`\u{1F573}\uFE0F  Dependency enumeration INCOMPLETE (${String(a.length)}) \u2014 packages may be missing from this scan entirely; it is NOT a clean bill of health:`);for(let d of a.slice(0,10))n.push(`  - [${W(d.kind)}] ${W(d.detail)}`);a.length>10&&n.push(`  \u2026 and ${String(a.length-10)} more`),n.push("")}let l=new Set(r.map(d=>d.detail)),i=[...e.analyzerDiagnostics.map(d=>`${W(d.code)}: ${W(d.detail)}`),...e.pythonDiagnostics.map(d=>`python: ${W(d)}`),...e.installed.diagnostics.filter(d=>!l.has(d)).map(W)];if(i.length>0){n.push(`\u26A0\uFE0F  Analysis incomplete (${String(i.length)}) \u2014 verdicts are conservative:`);for(let d of i.slice(0,10))n.push(`  - ${d}`);i.length>10&&n.push(`  \u2026 and ${String(i.length-10)} more`),n.push("")}if(o.length>0){n.push(`\u{1F3AF} Reachable (${String(o.length)}) \u2014 fix these:`);for(let d of o)n.push(`  ${Ry[d.tier]} ${W(d.displayId)}  ${W(d.packageName)}@${W(d.version)}  ${W(d.symbolName??"")}`+(d.surfaceComplete===!1?`  ${Py}`:"")),n.push(`        path: ${$y(d)}`);n.push("")}return n.push(...Oy(e)),n.push(`Summary: ${String(t["reachable-high"])} high, ${String(t["reachable-medium"])} medium, ${String(t["reachable-low"])} low (modeled), ${String(t.unknown)} unknown, ${String(t["not-reachable"])} not-reachable${Ny(e)}, ${String(t["not-affected"])} not-affected.`),n.join(`
-`)}import{createHash as Cy}from"node:crypto";var My="https://json.schemastore.org/sarif-2.1.0.json",qd="cupel-reachability",js=new Set(["dispatch","dynamic-load","coverage-gap"]);function Ty(e,n){return(e==="no-entrypoint"||e==="analyzer-crash")&&n===e}var Dy=500,Ly=10;function Fy(e){return e.counts["not-reachable"]===0?{}:e.findings.some(t=>t.tier==="not-reachable"&&t.basis==="loader-assumption")?{denialBasis:{value:"loader-assumption",assumption:"no dynamic loader inside a dependency (a non-literal require/import(), eval/Function, a reflective or captured loader, or a global-object loader) loads this package at runtime"}}:{denialBasis:{value:"complete"}}}function jy(e,n){return`${e}::${n}`}function By(e){switch((e??"").toUpperCase()){case"CRITICAL":return"9.8";case"HIGH":return"7.5";case"MODERATE":case"MEDIUM":return"5.0";case"LOW":return"2.0";default:return}}function Ky(e){let n=e.path?.find(t=>t.modulePath!=="")?.modulePath??e.packageLocation??"";return Cy("sha256").update(`${e.displayId}:${e.packageName}:${e.symbolName??""}:${n}`).digest("hex").slice(0,32)}function Uy(e){return e.tier==="reachable-high"||e.tier==="reachable-medium"||e.tier==="reachable-low"?!0:e.tier!=="unknown"||e.unknownKind===void 0?!1:js.has(e.unknownKind)}var Gd={"no-entrypoint":"no application entrypoint was analyzed, so no finding below is a reachability result","analyzer-crash":"cupel's analyzer produced no module graph for this project","version-undecidable":"the installed version could not be compared against the advisory range (not an exact x.y.z)","db-gap":"cupel has no vulnerable-symbol data for these advisories yet (package-level only)","unverified-symbol":"cupel has a named but uncertified candidate symbol for these advisories; the name is in the finding","symbol-unsupported":"the vulnerable trigger is a property access or a pattern, not a call \u2014 cupel's call graph cannot express it","dep-opaque":"the corridor runs through dependency bodies cupel does not analyze (ADR-011 analysis depth)","dynamic-load":"code in reach can load modules cupel cannot enumerate",dispatch:"a call site in reach has no statically resolvable target","resolution-divergence":"cupel may be analyzing a different file than Node runs, or could not follow an import; the per-file diagnostics name each one","analysis-cap":"cupel hit a budget, could not parse a file in reach, or could not read a start command; the per-file diagnostics name each one","incomplete-surface":"cupel certified some of these advisories' symbols and none of them is reached \u2014 but the symbol set is known to be incomplete (ADR-087), so an unnamed symbol may still be; not a clean","coverage-gap":"cupel's dependency enumeration was incomplete, so packages may be missing from this scan entirely \u2014 never read this as clean"};function Hd(e){let n=[],t=new Map,o=[];for(let i of e.findings){if(!Uy(i))continue;let d=jy(i.displayId,i.packageName);if(!t.has(d)){t.set(d,n.length);let b=By(i.severity);n.push({id:W(d),properties:{tags:i.unknownKind==="coverage-gap"?["security","coverage-gap",`gap/${W(i.packageName)}`]:["security","reachability",`package/${W(i.packageName)}`],...b!==void 0?{"security-severity":b}:{}}})}let u=i.tier==="reachable-high"||i.tier==="reachable-medium"||i.tier==="reachable-low",p=i.path??[],f=p.find(b=>b.modulePath!==""),m=[...new Set(i.unresolvedSites.map(b=>b.path).filter(b=>b!==""))],g=u?f!==void 0?{physicalLocation:{artifactLocation:{uri:W(f.modulePath)}},message:{text:`calls ${W(i.symbolName??"the vulnerable symbol")}`}}:{physicalLocation:{artifactLocation:{uri:W(i.packageLocation??"package-lock.json")}}}:m[0]!==void 0?{physicalLocation:{artifactLocation:{uri:W(m[0])}},message:{text:`unresolved ${W(i.unknownKind??"access")} in reach`}}:{physicalLocation:{artifactLocation:{uri:W(i.packageLocation??(i.unknownKind==="coverage-gap"?"package.json":"package-lock.json"))}}},y=u?p.map(b=>({physicalLocation:{artifactLocation:{uri:W(b.modulePath||"package-lock.json")}},message:{text:W(b.functionName??"<step>")}})):m.slice(1,Ly+1).map(b=>({physicalLocation:{artifactLocation:{uri:W(b)}},message:{text:"also blocked here"}}));o.push({ruleId:W(d),ruleIndex:t.get(d),level:u?"error":"warning",message:{text:W(`[${i.tier}] ${i.displayId} in ${i.packageName}@${i.version}`+(i.symbolName!==null?` \u2014 reaches ${i.symbolName}`:"")+(i.surfaceComplete===!1?" (symbol set known incomplete)":"")+`. ${i.reason}`)},locations:[g],...y.length>0?{relatedLocations:y}:{},partialFingerprints:{"cupelReachability/v1":Ky(i)},properties:{tier:i.tier,advisoryId:W(i.advisoryId),...i.surfaceComplete===!1?{surfaceComplete:!1}:{},...i.modelId!==void 0?{modelId:W(i.modelId),modelPromotedFromKind:i.modelPromotedFromKind}:{},...i.unknownKind!==void 0?{unknownKind:i.unknownKind,unknownOwner:qe[i.unknownKind],unresolvedSiteCount:i.unresolvedSites.length}:{},...i.adr105!==void 0?{adr105:i.adr105}:{}}})}let r=new Map,s=new Map;for(let i of e.findings){if(i.tier!=="unknown"||i.unknownKind===void 0||(r.set(i.unknownKind,(r.get(i.unknownKind)??0)+1),js.has(i.unknownKind)))continue;let d=s.get(i.unknownKind)??[];d.length<Dy&&d.push({advisory:W(i.displayId),package:W(i.packageName),version:W(i.version)}),s.set(i.unknownKind,d)}let a={cupel:0,project:0};for(let[i,d]of r)a[qe[i]]+=d;let l={};for(let[i,d]of s){let u=r.get(i)??d.length;l[i]={count:u,owner:qe[i],note:Gd[i],truncated:u>d.length,advisories:d}}return{$schema:My,version:"2.1.0",runs:[{tool:{driver:{name:"cupel",informationUri:"https://cupel.sh",rules:n}},automationDetails:{id:qd},invocations:[{executionSuccessful:e.analysisAborted===null&&e.analyzerDiagnostics.length===0&&e.pythonDiagnostics.length===0&&e.installed.diagnostics.length===0,toolExecutionNotifications:[...e.analysisAborted==="no-entrypoint"?[{descriptor:{id:"no-entrypoint"},level:"error",message:{text:"no app entrypoint analyzed (no --entry; package.json declares no main/bin/exports; no index.js; no usable scripts.start or Procfile command); ZERO application code was analyzed \u2014 every finding is capped at unknown, not a clean result. Pass --entry <file> or declare main."}}]:[],...e.analysisAborted==="analyzer-crash"?[{descriptor:{id:"analyzer-crash"},level:"error",message:{text:"an app entrypoint was found but cupel's analyzer produced NO module graph; ZERO application code was analyzed \u2014 every finding is capped at unknown, not a clean result. This is a cupel bug: please report it (the analyzer diagnostics below name the file)."}}]:[],...e.entrypointSources.length>0?[{descriptor:{id:"entrypoints"},level:"note",message:{text:W(`analyzed ${String(e.entrypointSources.length)} entrypoint(s): `+e.entrypointSources.slice(0,20).map(i=>`${i.entrypoint} (${i.source})`).join(", ")+(e.entrypointSources.length>20?", \u2026":""))}}]:[],...[...r.keys()].filter(i=>!js.has(i)&&!Ty(i,e.analysisAborted)).sort().map(i=>({descriptor:{id:`unknown-${i}`},level:"warning",message:{text:`${String(r.get(i)??0)} finding(s) are unknown because ${Gd[i]} (owner: ${qe[i]}). These are counted in counts.unknown and itemised in run.properties.unknown.grouped["${i}"]; they are NOT a clean result.`}})),...e.entrypointGaps.slice(0,20).map(i=>({descriptor:{id:"entry-source-unresolved"},level:"warning",message:{text:W(`${i.source} (${i.file}): ${i.detail}`)}})),...e.rejectedEntries.map(i=>({descriptor:{id:"entry-rejected"},level:"warning",message:{text:W(`--entry did not resolve to a file inside the app root: ${i}`)}})),...e.entrypointObservations.map(i=>({descriptor:{id:`entrypoint-observation:${i.kind}`},level:"note",message:{text:W(`${i.detail} (${i.file})`)}})),...e.analyzerDiagnostics.map(i=>({descriptor:{id:i.code},level:"warning",message:{text:W(`${i.detail}${i.reason===void 0?"":` [reason: ${i.reason}]`} (${i.path})`)}})),...e.pythonDiagnostics.map(i=>({descriptor:{id:"python-analysis"},level:"warning",message:{text:W(i)}})),...e.installed.diagnostics.map(i=>({descriptor:{id:"resolve"},level:"warning",message:{text:W(i)}}))]}],results:o,properties:{category:qd,summary:e.counts,installed:{count:e.installed.packages.length,byRoot:e.installed.perRoot.slice(0,64).map(i=>({path:W(i.rootRel),count:i.packages.length,source:i.source}))},...e.rootSet.budget!=="not-attempted"?{roots:{budget:e.rootSet.budget,unanalyzed:{count:ct(e.rootSet,e.entrypointSources).length,named:ct(e.rootSet,e.entrypointSources).slice(0,8).map(i=>W(i.rel===""?".":i.rel))},analyzed:[...Ft(e.entrypointSources)].sort().slice(0,64).map(i=>W(i===""?".":i)),counts:e.rootSet.counts,admitted:e.rootSet.roots.slice(0,64).map(i=>({path:W(i.rel),witnesses:i.witnesses,...i.manifestRefused?{manifestRefused:!0}:{},...i.ecosystem!==void 0?{ecosystem:i.ecosystem}:{},...i.alsoPython===!0?{alsoPython:!0}:{}})),observations:e.rootSet.observations.slice(0,64).map(i=>({kind:i.kind,path:W(i.rel)}))}}:{},...Fy(e),unknown:{total:e.counts.unknown,byKind:Object.fromEntries([...r].sort((i,d)=>d[1]-i[1])),byOwner:a,grouped:l},dbCoverageGaps:e.findings.filter(i=>i.tier==="unknown"&&i.unknownKind==="db-gap").map(i=>({advisory:W(i.displayId),package:W(i.packageName),version:W(i.version)})),...e.adr105!==void 0?{adr105:{...e.adr105,findings:e.findings.filter(i=>i.adr105!==void 0).map(i=>({advisory:W(i.displayId),package:W(i.packageName),version:W(i.version),symbol:W(i.symbolName??""),tier:i.tier,...i.unknownKind!==void 0?{unknownKind:i.unknownKind}:{},...i.adr105}))}}:{}}}]}}process.removeAllListeners("warning");process.on("warning",e=>{e.name==="ExperimentalWarning"&&/SQLite/u.test(e.message)||process.stderr.write(`${e.name}: ${e.message}
-`)});function Xd(){try{let e=zy(qy(new URL("../package.json",import.meta.url)),"utf8"),n=JSON.parse(e);if(typeof n=="object"&&n!==null&&"version"in n&&typeof n.version=="string")return n.version}catch{}return"0.0.0"}function Gy(e,n){let t=`${JSON.stringify(n,null,2)}
-`,o=`${e}.tmp-${Yd(8).toString("hex")}`;Jd(o,t,{encoding:"utf8",flag:"wx"}),Wy(o,e)}async function Hy(e){let n=sd(e),t=n.shard!==void 0||(process.env.CUPEL_SHARD_NPM??"")!=="",o=t?{path:jd(n.shard),sequence:null}:await Ts({offline:n.offline}),r=o.path,a=Fd(n.shardPypi);if(a===void 0&&!t)try{a=(await Ts({offline:n.offline,ecosystem:"pypi"})).path}catch(i){if(i instanceof Xt||i instanceof Hn)process.stderr.write(`cupel: no PyPI shard available (${i.message}); Python distributions, if any, will be reported as not assessed
-`);else throw i}let l=ys({dir:n.dir,shardPath:r,...a!==void 0?{shardPathPypi:a}:{},failOnReachable:n.failOnReachable,requireCompleteDenial:n.requireCompleteDenial,failOnUnknown:n.failOnUnknown,entry:n.entry,root:n.root,...n.summaryShadow!==void 0?{summaryShadow:n.summaryShadow}:{},...n.modelShadow!==void 0&&n.modelShadowOut!==void 0?{modelShadow:{claimsPath:n.modelShadow,outPath:n.modelShadowOut,widened:n.modelShadowWidened}}:{},...n.bindingShadow&&n.bindingShadowOut!==void 0?{bindingShadow:{outPath:n.bindingShadowOut}}:{},...n.partialRows?{partialRows:!0}:{},tsconfigPaths:n.tsconfigPaths});if(process.stdout.write(`${Vd(l)}
-`),l.modelLane!==void 0){let i=l.modelLane.notes.length>0?` (${l.modelLane.notes.map(d=>W(d)).join("; ")})`:"";process.stdout.write(`boundary models: ${String(l.modelLane.active)}/${String(l.modelLane.stored)} active, ${String(l.modelLane.promoted)} promoted to reachable-low${i}
-`)}if(n.summaryShadow!==void 0&&l.summaryShadow!==void 0){let i=Vy.join(n.summaryShadow,"shadow-report.json");Jd(i,`${JSON.stringify(l.summaryShadow,null,2)}
-`),process.stdout.write(`summary-shadow: ${String(l.summaryShadow.records.length)} counterfactual record(s) -> ${i}
-`)}if(l.modelShadow!==void 0&&n.modelShadowOut!==void 0){let i=l.modelShadow.records.filter(d=>d.wouldPromote).length;process.stdout.write(`model-shadow: ${String(i)}/${String(l.modelShadow.records.length)} wouldPromote -> ${n.modelShadowOut}
-`)}if(l.bindingShadow!==void 0&&n.bindingShadowOut!==void 0&&process.stdout.write(`binding-shadow: ${String(l.bindingShadow.deltas)}/${String(l.bindingShadow.records.length)} verdict delta(s) -> ${n.bindingShadowOut}
-`),n.sarif!==void 0&&Gy(n.sarif,Hd(l)),n.push){let i=Bd(l,{scanId:Yd(16).toString("hex"),scannedAt:new Date().toISOString(),ecosystem:Kd(l),shardSequence:o.sequence}),d=await Td(process.env,qo,{...n.auth!==void 0?{auth:n.auth}:{},warn:p=>process.stderr.write(`cupel: ${p}
-`)});try{await Dd(JSON.stringify(i),d.value,Ld)}catch(p){let f=p instanceof Error?p.message:String(p);return process.stderr.write(`cupel: ${f}
-`),l.exitCode===0?1:l.exitCode}let u=o.sequence===null?" \u2014 shard version unverified, shown as unknown on the dashboard":"";process.stdout.write(`pushed ${String(i.findings.length)} finding(s) to api.cupel.sh (${Md(d)})${u}
-`)}return l.exitCode}async function Xy(){let e=process.argv.slice(2);if(e[0]==="scan")try{return await Hy(e.slice(1))}catch(t){let o=t instanceof Error?t.message:String(t);return process.stderr.write(`cupel scan: ${o}
-`),1}if(e[0]==="login")return await kd(e.slice(1));if(e[0]==="logout")return Ed(e.slice(1));let n=e[0];return n===void 0||n==="help"||n==="--help"||n==="-h"?(process.stdout.write(`${xs(Xd())}
+`),1;let r=tu(process.env,t.token);return process.stdout.write(`signed in: delivery token stored at ${r} (readable by you alone). \`cupel scan\` uses it outside GitHub Actions; ${vr} in the environment still wins, and \`cupel logout\` forgets it.
+`),0}function du(e){if(au(e,"logout"))return 1;let n=vo(process.env);return ou(process.env)?process.stdout.write(`signed out: removed ${n}. The token itself still works until it is revoked on app.cupel.sh (Settings \u2192 Tokens).
+`):process.stdout.write(`nothing to sign out of: no delivery token stored at ${n} (${Qc} would point elsewhere).
+`),0}import FS from"node:path";import{randomBytes as oS,createHash as sS}from"node:crypto";import{mkdirSync as iS,readFileSync as aS,renameSync as lS,writeFileSync as dS}from"node:fs";import{homedir as cS}from"node:os";import xt from"node:path";var qi="latest.json",Vi="latest.json.sig";function _o(e){return sS("sha256").update(e).digest("hex")}function Hi(){let e=process.env.CUPEL_CACHE_DIR;if(e!==void 0&&e!=="")return e;let n=cS();if(process.platform==="darwin")return xt.join(n,"Library","Caches","cupel","shards");if(process.platform==="win32"){let o=process.env.LOCALAPPDATA,s=o!==void 0&&o!==""?o:xt.join(n,"AppData","Local");return xt.join(s,"cupel","shards")}let t=process.env.XDG_CACHE_HOME,r=t!==void 0&&t!==""?t:xt.join(n,".cache");return xt.join(r,"cupel","shards")}function Xi(e,n,t){return xt.join(e,`${n}-${t}.sqlite`)}function Io(e,n){iS(xt.dirname(e),{recursive:!0});let t=`${e}.tmp-${oS(8).toString("hex")}`;dS(t,n,{flag:"wx"}),lS(t,e)}function _r(e){try{return aS(e)}catch(n){if(n instanceof Error&&n.code==="ENOENT")return;throw n}}function cu(e,n,t,r){let o=Xi(e,n,t),s=_r(o);if(s===void 0)return;let i=_o(s);if(i!==t)throw r(`cached shard ${o} failed sha256 re-verify (expected ${t}, got ${i})`);return{path:o,bytes:s}}var uu="api.cupel.sh",Ao=new Set(["2b68896688aea5d7cd558798f0d8fbf8.r2.cloudflarestorage.com"]),fu=["tVK6LxjAkqVPe7fE3w09f3mOSGSI6mWf5BXatNoVv8k="];import No from"node:path";var uS="/v1/resolve",Yi=1024*1024,Ji=4096,pu=Yi+Ji+64*1024,fS=8,pS=2048,mS=/^[A-Za-z0-9+/]+={0,2}$/u,hS=3e4,Me=class extends ae{constructor(n){super(n),this.name="DeliveryRefusedError"}},Ir=class extends Me{constructor(n){super(n),this.name="EcosystemUnpublishedError"}},Ar=class extends ae{constructor(n){super(n),this.name="ControlPlaneUnavailableError"}},Nr=class extends ae{constructor(n){super(n),this.name="SequenceFloorRefusedError"}};function gS(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function yS(e){if(typeof e!="string"||e.length===0)throw new Me("the delivery response carried no index signature");if(e.length>Ji||!mS.test(e))throw new Me("the delivery response's index signature is not base64");let n=Buffer.from(e,"base64");if(n.toString("base64")!==e)throw new Me("the delivery response's index signature is not canonical base64");return n}function xS(e){if(typeof e!="string"||e.length===0)throw new Me("the delivery response carried no index");let n=Buffer.from(e,"utf8");if(n.length>Yi)throw new Me("the delivery response's index is larger than one can be");return n}function SS(e){if(!Array.isArray(e)||e.length===0)throw new Me("the delivery response named no shard urls");if(e.length>fS)throw new Me("the delivery response named more shard urls than one shard has");let n=[];for(let t of e){if(typeof t!="string"||t.length===0||t.length>pS)throw new Me("the delivery response carried a malformed shard url");n.push(t)}return n}function bS(e,n){throw e===401||e===403?new Me(`${n} rejected the delivery credential \u2014 check ${vr} or the token \`cupel login\` stored, or that the token has not been revoked in the dashboard (Settings \u2192 Tokens)`):e===404?new Ir(`${n} publishes no shard for this ecosystem \u2014 cannot scan without vulnerability data`):e===409?new Nr(`${n} holds nothing newer than the shard index already cached`):e===429?new Ar(`${n} rate-limited the delivery request`):e>=500?new Ar(`${n} answered ${String(e)}`):new Me(`${n} refused the delivery request with status ${String(e)}`)}async function mu(e,n,t,r,o=hS){let s=rn(`https://${e}${uS}`,new Set([e])),i=JSON.stringify({ecosystem:t.ecosystem,sequence_floor:t.sequenceFloor}),a;try{a=await r(s.href,{authorization:`Bearer ${n}`,"content-type":"application/json",accept:"application/json","user-agent":"cupel"},i,o)}catch{throw new Ar(`${e} could not be reached`)}if(a.status!==200&&bS(a.status,e),Buffer.byteLength(a.body,"utf8")>pu)throw new Me(`${e} returned a delivery response larger than one can be`);let d;try{d=JSON.parse(a.body)}catch{throw new Me(`${e} returned a delivery response that is not JSON`)}if(!gS(d))throw new Me(`${e} returned a delivery response that is not an object`);return{index:xS(d.index),sig:yS(d.signature),shardUrls:SS(d.shardUrls)}}var hu=async(e,n,t,r)=>await wr("POST",e,{...n,"content-length":String(Buffer.byteLength(t,"utf8"))},t,pu,r);var kS=8,Qi=class extends ae{constructor(n){super(n),this.name="NoUsableShardUrlError"}};function Zi(e){return`${e.origin}${e.pathname}`}function gu(e,n,t){let r=new Map;for(let i of n)r.set(Zi(i),i);let o=[],s=[];for(let i of e.slice(0,kS)){let a;try{a=rn(i,t)}catch(c){s.push(c.message);continue}if(a.hash!==""){s.push("a candidate carried a fragment");continue}let d=r.get(Zi(a));if(d===void 0){s.push("a candidate named an object the signed index does not list");continue}let l=new URL(`${Zi(d)}${a.search}`);o.push(rn(l.href,t))}if(o.length===0)throw new Qi(`no pre-signed shard url matched the signed index (${s.length===0?"none offered":s.join("; ")})`);return o}var ES=1,vS=1024*1024*1024;function _S(e=Ao){return{async resolve(n){return await mu(n.host,n.token,{ecosystem:n.ecosystem,sequenceFloor:n.sequenceFloor},hu)},async fetchShard(n,t){return rn(n.href,e),await Vc(n.href,{maxBytes:t,timeoutMs:3e4})}}}function ea(e){return e instanceof Error?e.message:String(e)}function yu(e){return{ecosystem:e.ecosystem,supportedIndexSchemaVersion:ES,supportedDbSchemaVersion:e.supportedDbSchemaVersion,shardHosts:e.shardHosts,hardMaxBytes:vS}}function IS(e){let n=_r(No.join(e.cacheDir,qi)),t=_r(No.join(e.cacheDir,Vi));if(!(n===void 0||t===void 0)&&Bi(n,t,e.pubkeys))try{return Ki(n,yu(e))}catch{return}}function xu(e,n){let t=Date.parse(e.generated);if(Number.isNaN(t)||n.now-t<=n.maxAgeMs)return[];let r=Math.floor((n.now-t)/864e5);return[`the ${e.ecosystem} shard is ${String(r)} days old (built ${e.generated}); its advisory data may be stale \u2014 connect online to refresh`]}function Ro(e,n,t){let r=cu(n.cacheDir,e.ecosystem,e.sha256,o=>new ae(o));if(r===void 0)throw new ae(`the cached index names ${e.ecosystem} shard ${e.sha256} but it is not in the cache \u2014 connect online to repopulate, or pass --shard <path>`);return{path:r.path,fromCache:!0,warnings:[...t,...xu(e,n)],sequence:e.sequence}}async function AS(e,n,t,r){let o=Xi(t.cacheDir,e.ecosystem,e.sha256),s=_r(o);if(s!==void 0&&_o(s)===e.sha256)return{path:o,downloaded:!1};let i="no shard urls";for(let a of n){let d;try{d=await r.fetchShard(a,e.sizeBytes)}catch(c){i=ea(c);continue}let l=_o(d);if(l!==e.sha256){i=`sha256 mismatch (expected ${e.sha256}, got ${l})`;continue}return Io(o,d),{path:o,downloaded:!0}}throw new ae(`could not fetch a verified ${e.ecosystem} shard from any mirror: ${i}`)}function NS(e,n,t){if(e instanceof Me)throw e;if(e instanceof Nr){if(n===void 0)throw new ae(`the control plane refused to serve an index at or above the requested sequence, and there is no cached ${t.ecosystem} shard \u2014 pass --shard <path>`);return Ro(n,t,["the control plane holds nothing newer than the cached shard index; keeping the cached shard"])}if(n===void 0)throw new gt(`no cached ${t.ecosystem} shard and the delivery seam is unreachable (${ea(e)}) \u2014 cannot scan without vulnerability data; connect once to populate the cache, or pass --shard <path>`);return Ro(n,t,[`could not refresh the shard index (${ea(e)}); using the cached shard`])}async function Su(e,n){if(!e.activated)throw new ae("zero-config shard delivery is not yet available (ADR-063 token-gated delivery ships in P5) \u2014 pass --shard <path> or set CUPEL_SHARD_NPM");let t=n??_S(e.shardHosts);if(!Zc(e.pubkeys))throw new ae("zero-config shard delivery is not activated in this build \u2014 pass --shard <path> or set CUPEL_SHARD_NPM");let r=IS(e);if(e.offline){if(r===void 0)throw new gt(`--offline and no cached ${e.ecosystem} shard \u2014 connect once to populate the cache, or pass --shard <path>`);return Ro(r,e,[])}let o=await iu(e.credential),s;try{s=await t.resolve({host:e.indexHost,token:o,ecosystem:e.ecosystem,sequenceFloor:r?.sequence??0})}catch(l){return NS(l,r,e)}if(!Bi(s.index,s.sig,e.pubkeys))throw new ae("shard index signature did not verify against any pinned key");let i=Ki(s.index,yu(e));if(r!==void 0&&i.sequence<r.sequence)return Ro(r,e,[`refusing a rolled-back shard index (served sequence ${String(i.sequence)} < cached ${String(r.sequence)}); keeping the newer cached shard`]);let a=gu(s.shardUrls,i.urls,e.shardHosts),d=await AS(i,a,e,t);return Io(No.join(e.cacheDir,qi),s.index),Io(No.join(e.cacheDir,Vi),s.sig),{path:d.path,fromCache:!d.downloaded,warnings:xu(i,e),sequence:i.sequence}}var RS="https://api.cupel.sh",bu=".actions.githubusercontent.com",PS=8192;function ku(e){return e.kind==="oidc"||/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/u.test(e.value)?"oidc":"token"}var on=class extends Error{constructor(n){super(n),this.name="PushCredentialError"}};function OS(e){let n;try{n=new URL(e).hostname}catch{throw new on("ACTIONS_ID_TOKEN_REQUEST_URL is not a URL")}let t=bu.slice(1);if(n!==t&&!n.endsWith(bu))throw new on(`refusing to send the ID-token request credential to unpinned host ${n}`);try{return rn(e,new Set([n]))}catch{throw new on(`ACTIONS_ID_TOKEN_REQUEST_URL for host ${n} is not a plain https authority`)}}async function Po(e,n){let t=e.ACTIONS_ID_TOKEN_REQUEST_URL,r=e.ACTIONS_ID_TOKEN_REQUEST_TOKEN;if(t===void 0||t==="")throw new on("ACTIONS_ID_TOKEN_REQUEST_URL is not set \u2014 the workflow needs `permissions: id-token: write`");if(r===void 0||r==="")throw new on("ACTIONS_ID_TOKEN_REQUEST_TOKEN is not set \u2014 the workflow needs `permissions: id-token: write`");let o=OS(t);o.searchParams.set("audience",RS);let s;try{s=await n(o.href,{authorization:`Bearer ${r}`,accept:"application/json","user-agent":"cupel"})}catch{throw new on("the ID-token request failed")}if(s.length>PS)throw new on("the ID-token response was larger than a token can be");let i;try{i=JSON.parse(s)}catch{throw new on("the ID-token response was not JSON")}let a=typeof i=="object"&&i!==null?i.value:void 0;if(typeof a!="string"||a.length===0)throw new on("the ID-token response carried no token");return a}async function wu(e,n,t={}){let r=e.CUPEL_TOKEN!==void 0&&e.CUPEL_TOKEN!=="",o=e.ACTIONS_ID_TOKEN_REQUEST_URL!==void 0&&e.ACTIONS_ID_TOKEN_REQUEST_URL!=="";if(t.auth==="token"){if(!r)throw new on("--auth=token, but CUPEL_TOKEN is not set");return{kind:"token",value:e.CUPEL_TOKEN??""}}if(t.auth==="oidc")return{kind:"oidc",value:await Po(e,n)};if(r)return o&&t.warn?.("both CUPEL_TOKEN and GitHub Actions OIDC are available; using CUPEL_TOKEN. Remove the secret to use keyless auth, or pass --auth=oidc."),{kind:"token",value:e.CUPEL_TOKEN??""};if(o)return{kind:"oidc",value:await Po(e,n)};throw new on("no credential for the findings push: set CUPEL_TOKEN, or add `permissions: id-token: write` to the workflow")}var Rr="api.cupel.sh",$S=`https://${Rr}/v1/findings`,CS=64*1024,Oo=8*1024*1024,MS=3e4,Qn=class extends Error{constructor(n){super(n),this.name="PushError"}};async function Eu(e,n,t,r={}){if(e.length>Oo)throw new Qn(`findings payload is ${String(e.length)} bytes, over the ${String(Oo)}-byte limit`);let o=rn($S,new Set([Rr])),s;try{s=await t(o.href,{authorization:`Bearer ${n}`,"content-type":"application/json","user-agent":"cupel"},e,r.timeoutMs??MS)}catch{throw new Qn(`the findings push to ${Rr} failed`)}if(s.body.length>CS)throw new Qn("the control plane returned a response larger than it should");if(!(s.status===202||s.status===200))throw s.status===401||s.status===403?new Qn("the control plane rejected the credential \u2014 check CUPEL_TOKEN, or that the workflow grants `permissions: id-token: write` and the repository is connected in the dashboard"):s.status===400?new Qn("the control plane rejected the findings payload as malformed"):new Qn(`the findings push was refused with status ${String(s.status)}`)}var TS=64*1024,DS=64*1024,$o=async(e,n,t,r)=>{if(Buffer.byteLength(t,"utf8")>Oo)throw new Error("findings payload is over the size limit");return await wr("POST",e,{...n,"content-length":String(Buffer.byteLength(t,"utf8"))},t,DS,r)};async function Co(e,n){let t=await wr("GET",e,n,void 0,TS,15e3);if(t.status!==200)throw new Error(`the ID-token request was refused with status ${String(t.status)}`);return t.body}var jS=720*60*60*1e3,BS=Number(vt);function vu(e){let n=process.env.CUPEL_SHARD_PYPI;return e??(n!==void 0&&n!==""?n:void 0)}function _u(e){let n=process.env.CUPEL_SHARD_NPM,t=e??(n!==void 0&&n!==""?n:void 0);if(t===void 0)throw new hn("no npm shard configured \u2014 pass --shard <path> or set CUPEL_SHARD_NPM (zero-config token-gated delivery ships in P5 \u2014 ADR-063)");return t}async function na(e){let n=e.ecosystem??"npm",t=await Su({ecosystem:n,activated:!0,pubkeys:fu,indexHost:uu,shardHosts:Ao,credential:su(process.env,()=>Po(process.env,Co),()=>ru(process.env)),cacheDir:n==="npm"?Hi():FS.join(Hi(),n),offline:e.offline,now:Date.now(),maxAgeMs:jS,supportedDbSchemaVersion:BS});for(let r of t.warnings)process.stderr.write(`cupel: ${r}
+`);return{path:t.path,sequence:t.sequence}}var KS=`https://${Rr}/v1/scan-failed`,US=400;async function ta(e,n,t,r,o=1e4){try{let s=JSON.stringify({kind:e,detail:n.slice(0,US)});await r(KS,{authorization:`Bearer ${t}`,"content-type":"application/json","content-length":String(Buffer.byteLength(s,"utf8"))},s,o)}catch{}}function zS(e){return e.counts["not-reachable"]===0?" (ignorable)":e.findings.some(t=>t.tier==="not-reachable"&&t.basis==="loader-assumption")?" (assumed: no dependency loader loads them)":" (ignorable)"}var GS={"reachable-high":"HIGH ","reachable-medium":"MED  ","reachable-low":"LOW  "},Iu=4,ra=3,oa=10,Au={"no-entrypoint":"no entrypoint analyzed \u2014 pass --entry <file> or declare main","analyzer-crash":"cupel's analyzer produced no graph \u2014 please report this","version-undecidable":"installed version is not an exact x.y.z; pin a release to get a verdict","db-gap":"no symbol data for the advisory yet","unverified-symbol":"candidate symbol named but not gate-certified","symbol-unsupported":"the trigger is a property access or pattern, not a call","dep-opaque":"the corridor runs through dependency bodies cupel does not analyze","dynamic-load":"non-literal require/import or loader escape in reach",dispatch:"unresolved call target in reach","resolution-divergence":"cupel may be analyzing a different file than Node runs","analysis-cap":"cupel hit a budget or could not parse a file in reach","coverage-gap":"cupel's dependency enumeration was incomplete \u2014 packages may be missing","incomplete-surface":"the named symbols are not reached, but the advisory's symbol set is known incomplete \u2014 an unnamed one may be"},WS="(symbol set known incomplete)";function qS(e){let n=(e.path??[]).map(t=>W(t.functionName??"<anon>"));return n.length>0?n.join(" \u2192 "):"(no path)"}function Nu(e){return[...new Set(e.unresolvedSites.map(n=>n.path).filter(n=>n!==""))]}function VS(e){let n=e.findings.filter(l=>l.tier==="unknown"&&l.unknownKind!==void 0);if(n.length===0)return[];let t=new Map;for(let l of n){let c=t.get(l.unknownKind)??[];c.push(l),t.set(l.unknownKind,c)}let r={cupel:0,project:0};for(let[l,c]of t)r[Ze[l]]+=c.length;let o=[];o.push(`\u2753 Unknown (${String(n.length)}) \u2014 cupel could NOT decide reachability. This is not a clean result.`);let s=(l,c)=>{if(r[l]===0)return;o.push(""),o.push(`   ${c} (${String(r[l])}):`);let p=[...t.entries()].filter(([m])=>Ze[m]===l).sort((m,h)=>h[1].length-m[1].length||m[0].localeCompare(h[0])),u=p.slice(0,Iu);for(let[m,h]of u){let x=l==="project"?[...new Set(h.flatMap(Nu))]:[],y=x.slice(0,ra).map(W).join(", "),S=x.length>ra?` (+${String(x.length-ra)} more files)`:"";o.push(`     ${m.padEnd(21)} ${String(h.length).padStart(4)}  ${Au[m]}`+(y!==""?`
+       ${y}${S}`:""))}for(let[m,h]of p.slice(Iu))o.push(`     ${m.padEnd(21)} ${String(h.length).padStart(4)}  ${Au[m]}`)};s("project","Your code \u2014 a change on your side would produce a real verdict"),s("cupel","cupel's gap \u2014 nothing you can do today");let i=new Map;for(let l of n)if(Ze[l.unknownKind]==="project")for(let c of Nu(l))i.set(c,(i.get(c)??0)+1);let a=[...i.entries()].sort((l,c)=>c[1]-l[1]||l[0].localeCompare(c[0]))[0];a!==void 0&&r.project>0&&(o.push(""),o.push(`   \u279C Start here: ${W(a[0])} appears in ${String(a[1])} of your ${String(r.project)} finding(s), across ${String(i.size)} file(s) total. A finding is decided only once EVERY site it lists resolves.`));let d=n.filter(l=>Ze[l.unknownKind]==="project");if(d.length>0){o.push("");for(let l of d.slice(0,oa))o.push(`     ${W(l.displayId)}  ${W(l.packageName)}@${W(l.version)}  [${l.unknownKind}] ${W(l.reason)}`);d.length>oa&&o.push(`     \u2026 and ${String(d.length-oa)} more`)}return o.push(""),o}function Ru(e){let n=[],t=e.counts,r=e.findings.filter(l=>l.tier==="reachable-high"||l.tier==="reachable-medium"||l.tier==="reachable-low");if(n.push(`cupel scan: ${W(e.dir)}`),n.push(`  ${e.installed.packages.length} installed packages (${e.installed.source}); shard schema v${e.shardSchemaVersion}`),n.push(""),e.entrypointSources.length>0){let l=e.entrypointSources.slice(0,8);n.push(`\u{1F4CD} Entrypoints analyzed (${String(e.entrypointSources.length)}): `+l.map(c=>`${W(c.entrypoint)} [${W(c.source)}]`).join(", ")+(e.entrypointSources.length>l.length?`, \u2026 and ${String(e.entrypointSources.length-l.length)} more`:"")),n.push("")}if(e.entrypointObservations.length>0){let l=new Map;for(let c of e.entrypointObservations)l.set(c.kind,(l.get(c.kind)??0)+1);n.push("\u2139\uFE0F  index.html scripts not seeded: "+[...l.entries()].map(([c,p])=>`${String(p)} ${c}`).join(", ")+` (${W(e.entrypointObservations[0]?.detail??"")}${e.entrypointObservations.length>1?", \u2026":""})`),n.push("")}if(e.rootSet.budget!=="not-attempted"){let l=e.rootSet,c=l.roots.slice(0,8);if(n.push(`\u{1F5C2}  Project roots (${String(l.counts.rootsAdmitted)}): `+c.map(m=>`${W(m.rel===""?".":m.rel)} [${m.witnesses.join("+")}${m.ecosystem==="PyPI"?"; PyPI":m.alsoPython===!0?"; npm+PyPI":""}]`).join(", ")+(l.roots.length>c.length?`, \u2026 and ${String(l.roots.length-c.length)} more`:"")),l.observations.length>0){let m=new Map;for(let h of l.observations)m.set(h.kind,(m.get(h.kind)??0)+1);n.push("    not admitted: "+[...m.entries()].map(([h,x])=>`${String(x)} ${h}`).join(", "))}n.push(`    walk: ${String(l.counts.dirsWalked)} dirs, ${String(l.counts.manifestsSeen)} manifests seen, ${String(l.counts.dotDirectoriesSkipped)} dot-dirs skipped \u2014 budget ${l.budget}`);let p=e.installed.perRoot.filter(m=>m.rootRel!=="");p.length>0&&n.push(`    enumerated (${String(p.length)} nested root${p.length===1?"":"s"}): `+p.slice(0,8).map(m=>`${W(m.rootRel)} (${String(m.packages.length)} packages, ${m.source})`).join(", ")+(p.length>8?`, \u2026 and ${String(p.length-8)} more`:""));let u=Mt(l,e.entrypointSources);u.length>0&&n.push(`    NOT analyzed (${String(u.length)}): ${W(ai(u.map(m=>m.rel===""?".":m.rel)))} \u2014 code there can load any installed package, so every not-reachable in this scan is capped at unknown until they are analyzed`),l.budget!=="complete"&&l.budget!=="not-attempted"&&n.push(`    the walk did not finish (${l.budget}) \u2014 a root with its own install may have been missed; every not-reachable in this scan is capped at unknown`),n.push("")}if(e.entrypointGaps.length>0){n.push(`\u26A0\uFE0F  Start command(s) cupel could not resolve to an entry file (${String(e.entrypointGaps.length)}) \u2014 that code was NOT analyzed:`);for(let l of e.entrypointGaps.slice(0,5))n.push(`  - ${W(l.source)} (${W(l.file)}): ${W(l.detail)}`);e.entrypointGaps.length>5&&n.push(`  \u2026 and ${String(e.entrypointGaps.length-5)} more`),n.push("   Fix: make it a direct `node <file.js>` invocation cupel can read. --entry <file> analyzes that code too, but verdicts stay capped while the command is unreadable."),n.push("")}e.rejectedEntries.length>0&&(n.push("\u26A0\uFE0F  Ignored --entry (did not resolve to a file inside the app root): "+e.rejectedEntries.map(W).join(", ")),n.push("")),e.analysisAborted==="no-entrypoint"?(n.push("\u{1F6D1} No entrypoint analyzed \u2014 this scan is NOT a clean bill of health."),n.push("   No app entrypoint was found (no --entry; package.json declares no main/bin/exports; no index.js; no usable scripts.start or Procfile command), so cupel analyzed ZERO application code and every finding below is capped at `unknown`, never `not-reachable`."),n.push(e.framework===null?'   Fix: pass --entry <file> (the file your start script or Procfile runs, e.g. --entry server.js), or declare "main" in package.json.':`   ${fs(e.framework)}`),n.push("")):e.analysisAborted==="analyzer-crash"&&(n.push("\u{1F6D1} cupel's analyzer failed on this project \u2014 this scan is NOT a clean bill of health."),n.push("   An entrypoint WAS found, but the analyzer produced no module graph, so cupel analyzed ZERO application code and every finding below is capped at `unknown`, never `not-reachable`."),n.push('   Fix: this is a cupel bug \u2014 please report it at https://github.com/cupel-sh/cupel/issues (the "Analysis incomplete" diagnostics below name the file). `--entry` will not help.'),n.push(""));let o=e.installed.gaps,s=o.find(l=>l.kind==="no-enumeration")??null;s!==null&&(n.push("\u{1F6D1} No dependency enumerated \u2014 this scan is NOT a clean bill of health."),n.push(`   [no-enumeration] ${W(s.detail)}`),n.push("   cupel saw ZERO dependencies, so no advisory could be matched and nothing below is a verdict about your dependencies. Commit a lockfile (package-lock.json, yarn.lock or pnpm-lock.yaml) or install before scanning."),n.push(""));let i=o.filter(l=>l!==s);if(i.length>0){n.push(`\u{1F573}\uFE0F  Dependency enumeration INCOMPLETE (${String(i.length)}) \u2014 packages may be missing from this scan entirely; it is NOT a clean bill of health:`);for(let l of i.slice(0,10))n.push(`  - [${W(l.kind)}] ${W(l.detail)}`);i.length>10&&n.push(`  \u2026 and ${String(i.length-10)} more`),n.push("")}let a=new Set(o.map(l=>l.detail)),d=[...e.analyzerDiagnostics.map(l=>`${W(l.code)}: ${W(l.detail)}`),...e.pythonDiagnostics.map(l=>`python: ${W(l)}`),...e.installed.diagnostics.filter(l=>!a.has(l)).map(W)];if(d.length>0){n.push(`\u26A0\uFE0F  Analysis incomplete (${String(d.length)}) \u2014 verdicts are conservative:`);for(let l of d.slice(0,10))n.push(`  - ${l}`);d.length>10&&n.push(`  \u2026 and ${String(d.length-10)} more`),n.push("")}if(r.length>0){n.push(`\u{1F3AF} Reachable (${String(r.length)}) \u2014 fix these:`);for(let l of r)n.push(`  ${GS[l.tier]} ${W(l.displayId)}  ${W(l.packageName)}@${W(l.version)}  ${W(l.symbolName??"")}`+(l.surfaceComplete===!1?`  ${WS}`:"")),n.push(`        path: ${qS(l)}`);n.push("")}return n.push(...VS(e)),n.push(`Summary: ${String(t["reachable-high"])} high, ${String(t["reachable-medium"])} medium, ${String(t["reachable-low"])} low (modeled), ${String(t.unknown)} unknown, ${String(t["not-reachable"])} not-reachable${zS(e)}, ${String(t["not-affected"])} not-affected.`),n.join(`
+`)}import{createHash as HS}from"node:crypto";var XS="https://json.schemastore.org/sarif-2.1.0.json",Pu="cupel-reachability",sa=new Set(["dispatch","dynamic-load","coverage-gap"]);function YS(e,n){return(e==="no-entrypoint"||e==="analyzer-crash")&&n===e}var JS=500,ZS=10;function QS(e){return e.counts["not-reachable"]===0?{}:e.findings.some(t=>t.tier==="not-reachable"&&t.basis==="loader-assumption")?{denialBasis:{value:"loader-assumption",assumption:"no dynamic loader inside a dependency (a non-literal require/import(), eval/Function, a reflective or captured loader, or a global-object loader) loads this package at runtime"}}:{denialBasis:{value:"complete"}}}function eb(e,n){return`${e}::${n}`}function nb(e){switch((e??"").toUpperCase()){case"CRITICAL":return"9.8";case"HIGH":return"7.5";case"MODERATE":case"MEDIUM":return"5.0";case"LOW":return"2.0";default:return}}function tb(e){let n=e.path?.find(t=>t.modulePath!=="")?.modulePath??e.packageLocation??"";return HS("sha256").update(`${e.displayId}:${e.packageName}:${e.symbolName??""}:${n}`).digest("hex").slice(0,32)}function rb(e){return e.tier==="reachable-high"||e.tier==="reachable-medium"||e.tier==="reachable-low"?!0:e.tier!=="unknown"||e.unknownKind===void 0?!1:sa.has(e.unknownKind)}var Ou={"no-entrypoint":"no application entrypoint was analyzed, so no finding below is a reachability result","analyzer-crash":"cupel's analyzer produced no module graph for this project","version-undecidable":"the installed version could not be compared against the advisory range (not an exact x.y.z)","db-gap":"cupel has no vulnerable-symbol data for these advisories yet (package-level only)","unverified-symbol":"cupel has a named but uncertified candidate symbol for these advisories; the name is in the finding","symbol-unsupported":"the vulnerable trigger is a property access or a pattern, not a call \u2014 cupel's call graph cannot express it","dep-opaque":"the corridor runs through dependency bodies cupel does not analyze (ADR-011 analysis depth)","dynamic-load":"code in reach can load modules cupel cannot enumerate",dispatch:"a call site in reach has no statically resolvable target","resolution-divergence":"cupel may be analyzing a different file than Node runs, or could not follow an import; the per-file diagnostics name each one","analysis-cap":"cupel hit a budget, could not parse a file in reach, or could not read a start command; the per-file diagnostics name each one","incomplete-surface":"cupel certified some of these advisories' symbols and none of them is reached \u2014 but the symbol set is known to be incomplete (ADR-087), so an unnamed symbol may still be; not a clean","coverage-gap":"cupel's dependency enumeration was incomplete, so packages may be missing from this scan entirely \u2014 never read this as clean"};function $u(e){let n=[],t=new Map,r=[],o=new Zn(e.dir);for(let l of e.findings){if(!rb(l))continue;let c=eb(l.displayId,l.packageName);if(!t.has(c)){t.set(c,n.length);let w=nb(l.severity);n.push({id:W(c),properties:{tags:l.unknownKind==="coverage-gap"?["security","coverage-gap",`gap/${W(l.packageName)}`]:["security","reachability",`package/${W(l.packageName)}`],...w!==void 0?{"security-severity":w}:{}}})}let p=l.tier==="reachable-high"||l.tier==="reachable-medium"||l.tier==="reachable-low",u=l.path??[],m=u.findIndex(w=>w.modulePath!==""),h=m===-1?void 0:u[m],x=xr(l.ecosystem),y=w=>(w===null?null:Ic(o,w,x))??void 0,S=u[m+1]?.calledAt??null,k=h!==void 0&&S!==null&&S.path===h.modulePath?y(S):void 0,E=[...new Set(l.unresolvedSites.map(w=>w.path).filter(w=>w!==""))],g=p?h!==void 0?{physicalLocation:{artifactLocation:{uri:W(h.modulePath)},...k!==void 0?{region:k}:{}},message:{text:`calls ${W(l.symbolName??"the vulnerable symbol")}`}}:{physicalLocation:{artifactLocation:{uri:W(l.packageLocation??"package-lock.json")}}}:E[0]!==void 0?{physicalLocation:{artifactLocation:{uri:W(E[0])}},message:{text:`unresolved ${W(l.unknownKind??"access")} in reach`}}:{physicalLocation:{artifactLocation:{uri:W(l.packageLocation??(l.unknownKind==="coverage-gap"?"package.json":"package-lock.json"))}}},b=p?u.map(w=>({physicalLocation:{artifactLocation:{uri:W(w.modulePath||"package-lock.json")}},message:{text:W(w.functionName??"<step>")}})):E.slice(1,ZS+1).map(w=>({physicalLocation:{artifactLocation:{uri:W(w)}},message:{text:"also blocked here"}}));r.push({ruleId:W(c),ruleIndex:t.get(c),level:p?"error":"warning",message:{text:W(`[${l.tier}] ${l.displayId} in ${l.packageName}@${l.version}`+(l.symbolName!==null?` \u2014 reaches ${l.symbolName}`:"")+(l.surfaceComplete===!1?" (symbol set known incomplete)":"")+`. ${l.reason}`)},locations:[g],...b.length>0?{relatedLocations:b}:{},...p&&u.length>0?{codeFlows:[{threadFlows:[{locations:u.map((w,I)=>{let N=y(w.calledAt);return{location:{physicalLocation:{artifactLocation:{uri:W(w.calledAt?.path||w.modulePath||"package-lock.json")},...N!==void 0?{region:N}:{}},message:{text:W(I===0?`entry ${w.functionName??"<step>"}`:`calls ${w.functionName??"<step>"}`)}}}})}]}]}:{},partialFingerprints:{"cupelReachability/v1":tb(l)},properties:{tier:l.tier,advisoryId:W(l.advisoryId),...l.surfaceComplete===!1?{surfaceComplete:!1}:{},...l.modelId!==void 0?{modelId:W(l.modelId),modelPromotedFromKind:l.modelPromotedFromKind}:{},...l.unknownKind!==void 0?{unknownKind:l.unknownKind,unknownOwner:Ze[l.unknownKind],unresolvedSiteCount:l.unresolvedSites.length}:{},...l.adr105!==void 0?{adr105:l.adr105}:{},...l.influence!==void 0?{influence:{value:l.influence.value,kind:l.influence.kind,owner:Gt[l.influence.kind],sourceClass:null,mode:null,trigger:null,contractProvenance:null,witness:null}}:{}}})}let s=new Map,i=new Map;for(let l of e.findings){if(l.tier!=="unknown"||l.unknownKind===void 0||(s.set(l.unknownKind,(s.get(l.unknownKind)??0)+1),sa.has(l.unknownKind)))continue;let c=i.get(l.unknownKind)??[];c.length<JS&&c.push({advisory:W(l.displayId),package:W(l.packageName),version:W(l.version)}),i.set(l.unknownKind,c)}let a={cupel:0,project:0};for(let[l,c]of s)a[Ze[l]]+=c;let d={};for(let[l,c]of i){let p=s.get(l)??c.length;d[l]={count:p,owner:Ze[l],note:Ou[l],truncated:p>c.length,advisories:c}}return{$schema:XS,version:"2.1.0",runs:[{tool:{driver:{name:"cupel",informationUri:"https://cupel.sh",rules:n}},automationDetails:{id:Pu},invocations:[{executionSuccessful:e.analysisAborted===null&&e.analyzerDiagnostics.length===0&&e.pythonDiagnostics.length===0&&e.installed.diagnostics.length===0,toolExecutionNotifications:[...e.analysisAborted==="no-entrypoint"?[{descriptor:{id:"no-entrypoint"},level:"error",message:{text:"no app entrypoint analyzed (no --entry; package.json declares no main/bin/exports; no index.js; no usable scripts.start or Procfile command); ZERO application code was analyzed \u2014 every finding is capped at unknown, not a clean result. Pass --entry <file> or declare main."}}]:[],...e.analysisAborted==="analyzer-crash"?[{descriptor:{id:"analyzer-crash"},level:"error",message:{text:"an app entrypoint was found but cupel's analyzer produced NO module graph; ZERO application code was analyzed \u2014 every finding is capped at unknown, not a clean result. This is a cupel bug: please report it (the analyzer diagnostics below name the file)."}}]:[],...e.entrypointSources.length>0?[{descriptor:{id:"entrypoints"},level:"note",message:{text:W(`analyzed ${String(e.entrypointSources.length)} entrypoint(s): `+e.entrypointSources.slice(0,20).map(l=>`${l.entrypoint} (${l.source})`).join(", ")+(e.entrypointSources.length>20?", \u2026":""))}}]:[],...[...s.keys()].filter(l=>!sa.has(l)&&!YS(l,e.analysisAborted)).sort().map(l=>({descriptor:{id:`unknown-${l}`},level:"warning",message:{text:`${String(s.get(l)??0)} finding(s) are unknown because ${Ou[l]} (owner: ${Ze[l]}). These are counted in counts.unknown and itemised in run.properties.unknown.grouped["${l}"]; they are NOT a clean result.`}})),...e.entrypointGaps.slice(0,20).map(l=>({descriptor:{id:"entry-source-unresolved"},level:"warning",message:{text:W(`${l.source} (${l.file}): ${l.detail}`)}})),...e.rejectedEntries.map(l=>({descriptor:{id:"entry-rejected"},level:"warning",message:{text:W(`--entry did not resolve to a file inside the app root: ${l}`)}})),...e.entrypointObservations.map(l=>({descriptor:{id:`entrypoint-observation:${l.kind}`},level:"note",message:{text:W(`${l.detail} (${l.file})`)}})),...e.analyzerDiagnostics.map(l=>({descriptor:{id:l.code},level:"warning",message:{text:W(`${l.detail}${l.reason===void 0?"":` [reason: ${l.reason}]`} (${l.path})`)}})),...e.pythonDiagnostics.map(l=>({descriptor:{id:"python-analysis"},level:"warning",message:{text:W(l)}})),...e.installed.diagnostics.map(l=>({descriptor:{id:"resolve"},level:"warning",message:{text:W(l)}}))]}],results:r,properties:{category:Pu,summary:e.counts,...e.timings!==void 0?{timings:e.timings}:{},installed:{count:e.installed.packages.length,byRoot:e.installed.perRoot.slice(0,64).map(l=>({path:W(l.rootRel),count:l.packages.length,source:l.source}))},...e.rootSet.budget!=="not-attempted"?{roots:{budget:e.rootSet.budget,unanalyzed:{count:Mt(e.rootSet,e.entrypointSources).length,named:Mt(e.rootSet,e.entrypointSources).slice(0,8).map(l=>W(l.rel===""?".":l.rel))},analyzed:[...pr(e.entrypointSources)].sort().slice(0,64).map(l=>W(l===""?".":l)),counts:e.rootSet.counts,admitted:e.rootSet.roots.slice(0,64).map(l=>({path:W(l.rel),witnesses:l.witnesses,...l.manifestRefused?{manifestRefused:!0}:{},...l.ecosystem!==void 0?{ecosystem:l.ecosystem}:{},...l.alsoPython===!0?{alsoPython:!0}:{}})),observations:e.rootSet.observations.slice(0,64).map(l=>({kind:l.kind,path:W(l.rel)}))}}:{},...QS(e),unknown:{total:e.counts.unknown,byKind:Object.fromEntries([...s].sort((l,c)=>c[1]-l[1])),byOwner:a,grouped:d},dbCoverageGaps:e.findings.filter(l=>l.tier==="unknown"&&l.unknownKind==="db-gap").map(l=>({advisory:W(l.displayId),package:W(l.packageName),version:W(l.version)})),...e.adr105!==void 0?{adr105:{...e.adr105,findings:e.findings.filter(l=>l.adr105!==void 0).map(l=>({advisory:W(l.displayId),package:W(l.packageName),version:W(l.version),symbol:W(l.symbolName??""),tier:l.tier,...l.unknownKind!==void 0?{unknownKind:l.unknownKind}:{},...l.adr105}))}}:{}}}]}}process.removeAllListeners("warning");process.on("warning",e=>{e.name==="ExperimentalWarning"&&/SQLite/u.test(e.message)||process.stderr.write(`${e.name}: ${e.message}
+`)});function Cu(){try{let e=ob(ab(new URL("../package.json",import.meta.url)),"utf8"),n=JSON.parse(e);if(typeof n=="object"&&n!==null&&"version"in n&&typeof n.version=="string")return n.version}catch{}return"0.0.0"}function lb(e,n){let t=`${JSON.stringify(n,null,2)}
+`,r=`${e}.tmp-${Mu(8).toString("hex")}`;Tu(r,t,{encoding:"utf8",flag:"wx"}),sb(r,e)}async function db(e){let n=qc(e),t=n.shard!==void 0||(process.env.CUPEL_SHARD_NPM??"")!=="",r=t?{path:_u(n.shard),sequence:null}:await na({offline:n.offline}),o=r.path,i=vu(n.shardPypi);if(i===void 0&&!t)try{i=(await na({offline:n.offline,ecosystem:"pypi"})).path}catch(d){if(d instanceof Ir||d instanceof gt)process.stderr.write(`cupel: no PyPI shard available (${d.message}); Python distributions, if any, will be reported as not assessed
+`);else throw d}let a=Fi({dir:n.dir,shardPath:o,...i!==void 0?{shardPathPypi:i}:{},failOnReachable:n.failOnReachable,requireCompleteDenial:n.requireCompleteDenial,failOnUnknown:n.failOnUnknown,entry:n.entry,root:n.root,...n.summaryShadow!==void 0?{summaryShadow:n.summaryShadow}:{},...n.modelShadow!==void 0&&n.modelShadowOut!==void 0?{modelShadow:{claimsPath:n.modelShadow,outPath:n.modelShadowOut,widened:n.modelShadowWidened}}:{},...n.bindingShadow&&n.bindingShadowOut!==void 0?{bindingShadow:{outPath:n.bindingShadowOut}}:{},...n.influenceShadowOut!==void 0?{influenceShadow:{outPath:n.influenceShadowOut}}:{},...n.partialRows?{partialRows:!0}:{},tsconfigPaths:n.tsconfigPaths});if(process.stdout.write(`${Ru(a)}
+`),a.modelLane!==void 0){let d=a.modelLane.notes.length>0?` (${a.modelLane.notes.map(l=>W(l)).join("; ")})`:"";process.stdout.write(`boundary models: ${String(a.modelLane.active)}/${String(a.modelLane.stored)} active, ${String(a.modelLane.promoted)} promoted to reachable-low${d}
+`)}if(n.summaryShadow!==void 0&&a.summaryShadow!==void 0){let d=ib.join(n.summaryShadow,"shadow-report.json");Tu(d,`${JSON.stringify(a.summaryShadow,null,2)}
+`),process.stdout.write(`summary-shadow: ${String(a.summaryShadow.records.length)} counterfactual record(s) -> ${d}
+`)}if(a.modelShadow!==void 0&&n.modelShadowOut!==void 0){let d=a.modelShadow.records.filter(l=>l.wouldPromote).length;process.stdout.write(`model-shadow: ${String(d)}/${String(a.modelShadow.records.length)} wouldPromote -> ${n.modelShadowOut}
+`)}if(a.bindingShadow!==void 0&&n.bindingShadowOut!==void 0&&process.stdout.write(`binding-shadow: ${String(a.bindingShadow.deltas)}/${String(a.bindingShadow.records.length)} verdict delta(s) -> ${n.bindingShadowOut}
+`),a.influenceShadow!==void 0&&n.influenceShadowOut!==void 0){let d=a.influenceShadow.byOutcome;process.stderr.write(`influence-shadow: ${String(a.influenceShadow.ports)} port(s) \u2014 ${String(d.influenced)} influenced, ${String(d["no-source-reached"])} no-source-reached, ${String(d["reaches-entry-parameter"])} reaches-entry-parameter, ${String(d.unknown)} unknown (${String(a.influenceShadow.wallMs)} ms) -> ${n.influenceShadowOut}
+`)}if(n.sarif!==void 0&&lb(n.sarif,$u(a)),n.push){let d=await wu(process.env,Co,{...n.auth!==void 0?{auth:n.auth}:{},warn:p=>process.stderr.write(`cupel: ${p}
+`)}),l;try{l=bc(a,{scanId:Mu(16).toString("hex"),scannedAt:new Date().toISOString(),ecosystem:kc(a),shardSequence:r.sequence})}catch(p){let u=p instanceof Error?p.message:String(p);return process.stderr.write(`cupel: ${u}
+`),await ta("push-refused",u,d.value,$o),a.exitCode===0?1:a.exitCode}try{await Eu(JSON.stringify(l),d.value,$o)}catch(p){let u=p instanceof Error?p.message:String(p);return process.stderr.write(`cupel: ${u}
+`),await ta("scan-error",u,d.value,$o),a.exitCode===0?1:a.exitCode}let c=r.sequence===null?" \u2014 shard version unverified, shown as unknown on the dashboard":"";process.stdout.write(`pushed ${String(l.findings.length)} finding(s) to api.cupel.sh (${ku(d)})${c}
+`)}return a.exitCode}async function cb(){let e=process.argv.slice(2);if(e[0]==="scan")try{return await db(e.slice(1))}catch(t){let r=t instanceof Error?t.message:String(t);return process.stderr.write(`cupel scan: ${r}
+`),1}if(e[0]==="login")return await lu(e.slice(1));if(e[0]==="logout")return du(e.slice(1));let n=e[0];return n===void 0||n==="help"||n==="--help"||n==="-h"?(process.stdout.write(`${ji(Cu())}
 `),0):(process.stderr.write(`cupel: unknown command '${W(n)}'
-`),process.stderr.write(`${xs(Xd())}
-`),1)}Xy().then(e=>{process.exit(e)},e=>{let n=e instanceof Error?e.message:String(e);process.stderr.write(`cupel: ${n}
+`),process.stderr.write(`${ji(Cu())}
+`),1)}cb().then(e=>{process.exit(e)},e=>{let n=e instanceof Error?e.message:String(e);process.stderr.write(`cupel: ${n}
 `),process.exit(1)});