@kinkai.cloud/vibecheck 0.2.0 → 0.3.1

package/dist/cli.js

@@ -5,20 +5,9 @@ var __export = (target, all2) => {
     __defProp(target, name, { get: all2[name], enumerable: true });
 };
 
-// ../../packages/checks/src/types.ts
-var SEVERITIES = ["fatal", "critical", "high", "medium", "low"];
-var NODE_KINDS = [
-  "browser",
-  "app",
-  "api",
-  "db",
-  "storage",
-  "auth",
-  "ai",
-  "payments",
-  "secrets"
-];
-var CATEGORIES = ["secrets", "data", "storage", "auth", "ai", "config"];
+// src/analyze.ts
+import { mkdirSync as mkdirSync2, writeFileSync as writeFileSync2, existsSync, lstatSync as lstatSync2, readFileSync as readFileSync3 } from "fs";
+import { resolve as resolve2, join as join3 } from "path";
 
 // ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/external.js
 var external_exports = {};
@@ -804,14 +793,14 @@ function promiseAllObject(promisesObj) {
 }
 function randomString(length = 10) {
   const chars = "abcdefghijklmnopqrstuvwxyz";
-  let str = "";
+  let str2 = "";
   for (let i = 0; i < length; i++) {
-    str += chars[Math.floor(Math.random() * chars.length)];
+    str2 += chars[Math.floor(Math.random() * chars.length)];
   }
-  return str;
+  return str2;
 }
-function esc(str) {
-  return JSON.stringify(str);
+function esc(str2) {
+  return JSON.stringify(str2);
 }
 function slugify(input) {
   return input.toLowerCase().trim().replace(/[^\w\s-]/g, "").replace(/[\s_-]+/g, "-").replace(/^-+|-+$/g, "");
@@ -925,8 +914,8 @@ var primitiveTypes = /* @__PURE__ */ new Set([
   "symbol",
   "undefined"
 ]);
-function escapeRegex(str) {
-  return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+function escapeRegex(str2) {
+  return str2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 function clone(inst, def, params) {
   const cl = new inst._zod.constr(def ?? inst._zod.def);
@@ -7658,8 +7647,8 @@ function ko_default() {
 }
 
 // ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/locales/lt.js
-var capitalizeFirstCharacter = (text) => {
-  return text.charAt(0).toUpperCase() + text.slice(1);
+var capitalizeFirstCharacter = (text2) => {
+  return text2.charAt(0).toUpperCase() + text2.slice(1);
 };
 function getUnitTypeFromNumber(number4) {
   const abs = Math.abs(number4);
@@ -14534,200 +14523,3506 @@ function date4(params) {
 // ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/external.js
 config(en_default());
 
-// ../../packages/graph/src/types.ts
-var EDGE_TYPES = ["imports", "calls", "contains"];
-var MAX_NODES = 400;
-var MAX_EDGES = 800;
-var MAX_COMMUNITIES = 9;
-var MAX_FILES_PER_NODE = 12;
-var MAX_COMMUNITY_FILES = 8;
-var MAX_BYTES = 256e3;
-var MAX_LABEL = 80;
-var MAX_ID = 64;
-var MAX_PATH = 180;
-var MAX_PACKAGES = 32;
-var MAX_HINT_ROUTES = 80;
-var MAX_HINT_TABLES = 40;
-var MAX_HINT_BUCKETS = 24;
-var MAX_HINT_COLLECTIONS = 24;
-var EMPTY_DATA = { tables: [], buckets: [], collections: [] };
-var pathSchema = external_exports.string().min(1).max(MAX_PATH);
-var nodeSchema = external_exports.object({
-  id: external_exports.string().min(1).max(MAX_ID),
-  kind: external_exports.enum(NODE_KINDS),
-  label: external_exports.string().min(1).max(MAX_LABEL),
-  files: external_exports.array(pathSchema).max(MAX_FILES_PER_NODE)
-});
-var edgeSchema = external_exports.object({
-  from: external_exports.string().min(1).max(MAX_ID),
-  to: external_exports.string().min(1).max(MAX_ID),
-  type: external_exports.enum(EDGE_TYPES)
-});
-var communitySchema = external_exports.object({
-  nodeKind: external_exports.enum(NODE_KINDS),
-  label: external_exports.string().min(1).max(MAX_LABEL),
-  files: external_exports.array(pathSchema).max(MAX_COMMUNITY_FILES)
-});
-var tableName = external_exports.string().regex(/^[A-Za-z_][A-Za-z0-9_]{0,62}$/);
-var bucketName = external_exports.string().regex(/^[A-Za-z0-9][A-Za-z0-9._-]{0,62}$/);
-var dataSchema = external_exports.object({
-  tables: external_exports.array(tableName).max(MAX_HINT_TABLES),
-  buckets: external_exports.array(bucketName).max(MAX_HINT_BUCKETS),
-  collections: external_exports.array(tableName).max(MAX_HINT_COLLECTIONS)
-});
-var scanGraphSchema = external_exports.object({
-  version: external_exports.literal(1),
-  advanced: external_exports.boolean(),
-  nodes: external_exports.array(nodeSchema).max(MAX_NODES),
-  edges: external_exports.array(edgeSchema).max(MAX_EDGES),
-  communities: external_exports.array(communitySchema).max(MAX_COMMUNITIES),
-  packages: external_exports.array(external_exports.string().min(1).max(MAX_LABEL)).max(MAX_PACKAGES),
-  data: dataSchema.optional()
-});
-var EMPTY_HINTS = {
-  apiRoutes: [],
-  tableNames: [],
-  buckets: [],
-  collections: []
-};
+// ../../packages/analysis/src/index.ts
+import { randomUUID } from "crypto";
+import {
+  mkdtempSync,
+  readFileSync as readFileSync2,
+  writeFileSync,
+  rmSync,
+  readdirSync,
+  lstatSync,
+  mkdirSync,
+  copyFileSync
+} from "fs";
+import { tmpdir } from "os";
+import { join as join2, relative, resolve, sep } from "path";
 
-// ../../packages/graph/src/hints.ts
-function uniqueCapped(values, cap) {
-  const seen = /* @__PURE__ */ new Set();
+// ../../packages/checks/src/code/types.ts
+var API_ROUTE_FILE = /(^|\/)(app\/.*\/route\.(ts|js|tsx|jsx)|pages\/api\/.+\.(ts|js))$/;
+function isApiRoute(path) {
+  return API_ROUTE_FILE.test(path);
+}
+
+// ../../packages/checks/src/code/checks.ts
+var MIGRATION_FILE = /(^|\/)supabase\/migrations\/[^/]+\.sql$/;
+var CREATE_TABLE = /create\s+table\s+(?:if\s+not\s+exists\s+)?(?:"?[a-z_][a-z0-9_]*"?\.)?"?([a-z_][a-z0-9_]*)"?/gi;
+var ENABLE_RLS = /alter\s+table\s+(?:if\s+exists\s+)?(?:only\s+)?(?:"?[a-z_][a-z0-9_]*"?\.)?"?([a-z_][a-z0-9_]*)"?\s+enable\s+row\s+level\s+security/gi;
+function all(pattern, text2) {
   const out = [];
-  for (const value of values) {
-    if (out.length >= cap) break;
-    if (seen.has(value)) continue;
-    seen.add(value);
-    out.push(value);
+  for (const m of text2.matchAll(pattern)) {
+    const nome = m[1];
+    if (nome !== void 0) out.push(nome.toLowerCase());
   }
   return out;
 }
-function routeFromFile(path) {
-  const normal = path.replaceAll("\\", "/");
-  const app = /(?:^|\/)app\/(.+)\/route\.(t|j)sx?$/i.exec(normal);
-  if (app?.[1] !== void 0) {
-    const segments = app[1].split("/").filter((s) => s.length > 0 && !s.startsWith("(") && !s.startsWith("@")).map((s) => s.replace(/^\[+\.\.\.(.+)\]+$/, "*").replace(/^\[+(.+)\]+$/, ":$1"));
-    if (segments.length === 0) return "/api";
-    return `/${segments.join("/")}`;
-  }
-  const pages = /(?:^|\/)pages\/api\/(.+)\.(t|j)sx?$/i.exec(normal);
-  if (pages?.[1] !== void 0) {
-    const withoutIndex = pages[1].replace(/\/index$/i, "");
-    return `/api/${withoutIndex}`;
-  }
-  return null;
-}
-function filesFromGraph(graph) {
-  return [
-    ...graph.nodes.flatMap((n) => n.files),
-    ...graph.communities.flatMap((c) => c.files)
-  ];
-}
-function hintsFromGraph(graph) {
-  if (graph === null || graph === void 0 || !graph.advanced) return EMPTY_HINTS;
-  const routes = [];
-  for (const file2 of filesFromGraph(graph)) {
-    const route = routeFromFile(file2);
-    if (route !== null) routes.push(route);
-  }
-  routes.sort((a, b) => a.localeCompare(b));
-  const data = graph.data ?? EMPTY_DATA;
-  return {
-    apiRoutes: uniqueCapped(routes, MAX_HINT_ROUTES),
-    tableNames: uniqueCapped(data.tables, MAX_HINT_TABLES),
-    buckets: uniqueCapped(data.buckets, MAX_HINT_BUCKETS),
-    collections: uniqueCapped(data.collections, MAX_HINT_COLLECTIONS)
-  };
+function isClientFile(file2) {
+  if (/^\s*['"]use client['"]/.test(file2.content)) return true;
+  if (/\.client\.(tsx|jsx|ts|js)$/.test(file2.path)) return true;
+  return /(^|\/)pages\/(?!api\/).+\.(tsx|jsx|ts|js)$/.test(file2.path);
 }
-
-// ../../packages/graph/src/metrics.ts
-function importCycles(graph) {
-  const adjacencia = /* @__PURE__ */ new Map();
-  for (const aresta of graph.edges) {
-    if (aresta.type !== "imports") continue;
-    const vizinhos = adjacencia.get(aresta.from) ?? [];
-    vizinhos.push(aresta.to);
-    adjacencia.set(aresta.from, vizinhos);
-  }
-  const indice = /* @__PURE__ */ new Map();
-  const lowlink = /* @__PURE__ */ new Map();
-  const naPilha = /* @__PURE__ */ new Set();
-  const pilha = [];
-  let proximo = 0;
-  let ciclos = 0;
-  for (const raiz of graph.nodes.map((n) => n.id)) {
-    if (indice.has(raiz)) continue;
-    const quadros = [{ no: raiz, vizinho: 0 }];
-    indice.set(raiz, proximo);
-    lowlink.set(raiz, proximo);
-    proximo += 1;
-    pilha.push(raiz);
-    naPilha.add(raiz);
-    while (quadros.length > 0) {
-      const quadro = quadros[quadros.length - 1];
-      if (quadro === void 0) break;
-      const vizinhos = adjacencia.get(quadro.no) ?? [];
-      if (quadro.vizinho < vizinhos.length) {
-        const vizinho = vizinhos[quadro.vizinho];
-        quadro.vizinho += 1;
-        if (!indice.has(vizinho)) {
-          indice.set(vizinho, proximo);
-          lowlink.set(vizinho, proximo);
-          proximo += 1;
-          pilha.push(vizinho);
-          naPilha.add(vizinho);
-          quadros.push({ no: vizinho, vizinho: 0 });
-        } else if (naPilha.has(vizinho)) {
-          lowlink.set(
-            quadro.no,
-            Math.min(lowlink.get(quadro.no) ?? 0, indice.get(vizinho) ?? 0)
-          );
-        }
-        continue;
-      }
-      quadros.pop();
-      const pai = quadros[quadros.length - 1];
-      if (pai !== void 0) {
-        lowlink.set(
-          pai.no,
-          Math.min(lowlink.get(pai.no) ?? 0, lowlink.get(quadro.no) ?? 0)
-        );
-      }
-      if (lowlink.get(quadro.no) === indice.get(quadro.no)) {
-        let tamanho = 0;
-        let atual;
-        do {
-          atual = pilha.pop();
-          if (atual === void 0) break;
-          naPilha.delete(atual);
-          tamanho += 1;
-        } while (atual !== quadro.no);
-        if (tamanho > 1) ciclos += 1;
+var TOUCHES_DB = /\b(supabase\.(?:from|rpc|storage)\b|prisma\.\w+\.\w+\(|drizzle\(|\bdb\.(?:select|insert|update|delete|query|execute|from)\(|\.from\(['"]|sql`|pool\.query\(|knex\(|mongoose\.|\.collection\(['"])/;
+var HAS_AUTH = /\b(getSession|getUser|auth\(\)|currentUser|requireAuth|verifyToken|verifyJwt|jwtVerify|authorization|Bearer|withAuth|clerk|next-auth|getServerSession|session)\b/i;
+var PUBLIC_ROUTE = /(^|\/)(webhooks?|health|healthz|ping|status|robots|sitemap|og|opengraph|cron)(\/|\.|$)/i;
+var AI_SDK = /from\s+['"](openai|@anthropic-ai\/sdk|ai|@ai-sdk\/[^'"]+|@google\/generative-ai|groq-sdk|cohere-ai|@mistralai\/mistralai)['"]/;
+var HAS_LIMITER = /\b(ratelimit|rateLimit|Ratelimit|upstash|limiter|throttle|slidingWindow|tokenBucket)\b/;
+var STRIPE_IMPORT = /from\s+['"]stripe['"]/;
+var WEBHOOK_PATH = /webhook/i;
+var SIGNATURE_CHECK = /constructEvent(?:Async)?\(|stripe-signature/;
+var SERVICE_ROLE_REF = /\b(SUPABASE_SERVICE_ROLE_KEY|SERVICE_ROLE_KEY|sb_secret_[A-Za-z0-9_]+|NEXT_PUBLIC_[A-Z0-9_]*(?:SECRET|SERVICE_ROLE|PRIVATE)[A-Z0-9_]*)\b/;
+var ENV_FILES = [
+  ".env",
+  ".env.local",
+  ".env.production",
+  ".env.development",
+  ".env.staging"
+];
+var codeRlsMissing = {
+  id: "code-rls-missing",
+  source: "code",
+  category: "data",
+  severity: "critical",
+  title: "Table created without row level security",
+  impact: "A migration creates a table and never turns on row level security for it. Once it has rows, anyone with the public key can read them \u2014 this is the hole the RLS check lights up from outside.",
+  howToDetect: (ctx) => {
+    const migrations = ctx.files.filter((f) => MIGRATION_FILE.test(f.path));
+    if (migrations.length === 0) return [];
+    const comRls = /* @__PURE__ */ new Set();
+    for (const m of migrations) for (const t of all(ENABLE_RLS, m.content)) comRls.add(t);
+    const out = [];
+    const vistas = /* @__PURE__ */ new Set();
+    for (const m of migrations) {
+      for (const tabela of all(CREATE_TABLE, m.content)) {
+        if (comRls.has(tabela) || vistas.has(tabela)) continue;
+        vistas.add(tabela);
+        out.push({
+          path: m.path,
+          reason: `table \`${tabela}\` is created without enable row level security`
+        });
       }
     }
-  }
-  return ciclos;
-}
-function graphMetrics(graph) {
-  return {
-    nodes: graph.nodes.length,
-    edges: graph.edges.length,
-    routes: hintsFromGraph(graph).apiRoutes.length,
-    packages: graph.packages.length,
-    cycles: importCycles(graph)
-  };
-}
+    return out;
+  },
+  fixPrompt: (a) => `In your code, ${a.reason} (${a.path}).
 
-// ../../packages/graph/src/identifiers.ts
-var FROM_CALL = /([A-Za-z_$][\w$]*)\s*\.\s*from\(\s*["'`]([A-Za-z0-9._-]{1,63})["'`]\s*\)/g;
-var NOT_A_DATABASE = /* @__PURE__ */ new Set([
-  "array",
-  "buffer",
-  "object",
-  "string",
-  "number",
-  "date",
+We do not know the columns or who should read what. We cannot write the policy from here.
+
+Good practice: every table starts with row level security on, in the same migration that creates it. Then one policy per real access: a person reads their own rows; a public catalog, if it exists, is a deliberate read policy; writes always go through a session. Do this in a new migration, never by editing one that already ran.
+
+After, deploy and read the table with the public key and no session \u2014 it must answer empty or denied.`
+};
+var codeServiceRoleInClient = {
+  id: "code-service-role-in-client",
+  source: "code",
+  category: "secrets",
+  severity: "fatal",
+  title: "Service key referenced in client code",
+  impact: "A file that runs in the browser mentions the Supabase service key or a NEXT_PUBLIC_ secret. Whatever the bundler inlines there ships to every visitor \u2014 this is the fatal finding from outside, one build away.",
+  howToDetect: (ctx) => ctx.files.filter(isClientFile).filter((f) => SERVICE_ROLE_REF.test(f.content)).map((f) => ({
+    path: f.path,
+    reason: "client-side file references a service or secret key"
+  })),
+  fixPrompt: (a) => `In your code, a client-side file references a service or secret key (${a.path}).
+
+We do not have the value and we do not want it. The problem is the place, not the string.
+
+Good practice: the service key lives only in server code \u2014 a route handler, a server action, an edge function \u2014 read from the environment without the NEXT_PUBLIC_ prefix. The browser talks to your API; your API talks to the database. Remove the reference from the client file and, if the key was ever bundled, rotate it in the dashboard.
+
+After, search the built bundle for the key prefix and confirm it is gone.`
+};
+var codeRouteWithoutAuth = {
+  id: "code-route-without-auth",
+  source: "code",
+  category: "auth",
+  severity: "high",
+  title: "API route touches data without a session check",
+  impact: "An API route reads or writes the database and nothing in it checks who is asking. If the middleware does not cover it, anyone can call it \u2014 this is what api-route-noauth lights up from outside.",
+  howToDetect: (ctx) => ctx.files.filter((f) => isApiRoute(f.path) && !PUBLIC_ROUTE.test(f.path)).filter((f) => TOUCHES_DB.test(f.content) && !HAS_AUTH.test(f.content)).map((f) => ({
+    path: f.path,
+    reason: "route reads or writes data with no session check in the file"
+  })),
+  fixPrompt: (a) => `In your code, a route reads or writes data with no session check in the file (${a.path}).
+
+We cannot see your middleware. If it already protects this path, mark the finding as known.
+
+Good practice: the route resolves the session first and answers 401 before touching data; what it reads or writes is scoped to that user. A public route is public on purpose, with a comment saying so, and never exposes rows that belong to someone.
+
+After, call the route from a logged-out client and confirm it answers 401 or 403.`
+};
+var codeEnvCommitted = {
+  id: "code-env-committed",
+  source: "code",
+  category: "secrets",
+  severity: "critical",
+  title: ".env file tracked by git",
+  impact: "An environment file is committed to the repository. Every clone, fork, CI log and AI tool that reads the repo has the secrets in it. Even after deleting it, the history keeps the values.",
+  // Só o nome. O conteúdo nunca é lido — é o único check que não recebe
+  // `content`, e é assim de propósito.
+  howToDetect: (ctx) => ENV_FILES.filter((nome) => ctx.tracked(nome)).map((nome) => ({
+    path: nome,
+    reason: `${nome} is tracked by git`
+  })),
+  fixPrompt: (a) => `In your code, ${a.reason}.
+
+We did not read it. We only saw that git tracks it.
+
+Good practice: environment files stay out of version control \u2014 add them to .gitignore, remove them from the index, and keep a committed .env.example with the variable names and no values. Every secret that was ever in the file is compromised: rotate each one in its provider.
+
+After, run git ls-files and confirm no .env file is listed.`
+};
+var codeAiRouteWithoutLimit = {
+  id: "code-ai-route-without-limit",
+  source: "code",
+  category: "ai",
+  severity: "high",
+  title: "AI route with no rate limit",
+  impact: "A route calls an LLM provider and nothing in it limits how often. A loop from one client turns your provider account into an open bill \u2014 this is ai-proxy-open, seen from inside.",
+  howToDetect: (ctx) => ctx.files.filter((f) => isApiRoute(f.path)).filter((f) => AI_SDK.test(f.content) && !HAS_LIMITER.test(f.content)).map((f) => ({
+    path: f.path,
+    reason: "route calls an AI provider with no rate limit in the file"
+  })),
+  fixPrompt: (a) => `In your code, a route calls an AI provider with no rate limit in the file (${a.path}).
+
+We cannot see limits applied elsewhere. If your gateway already throttles this path, mark the finding as known.
+
+Good practice: the route requires a session, then applies a per-user limit (so many calls per minute, so many tokens per day) before calling the provider, and answers 429 when it is hit. Cost caps at the provider are the second net, not the first.
+
+After, call the route in a loop from one client and confirm it starts answering 429.`
+};
+var codeWebhookUnsigned = {
+  id: "code-webhook-unsigned",
+  source: "code",
+  category: "config",
+  severity: "high",
+  title: "Stripe webhook without signature verification",
+  impact: 'A webhook route imports Stripe and never verifies the event signature. Anyone can POST a fake "payment succeeded" and your app will believe it \u2014 the one check we refuse to run from outside, because proving it would mean doing exactly that.',
+  howToDetect: (ctx) => ctx.files.filter((f) => isApiRoute(f.path) && WEBHOOK_PATH.test(f.path)).filter((f) => STRIPE_IMPORT.test(f.content) && !SIGNATURE_CHECK.test(f.content)).map((f) => ({
+    path: f.path,
+    reason: "Stripe webhook route never verifies the event signature"
+  })),
+  fixPrompt: (a) => `In your code, a Stripe webhook route never verifies the event signature (${a.path}).
+
+We cannot see the secret and do not want it.
+
+Good practice: the route reads the raw body and the stripe-signature header, builds the event with the webhook secret from the environment, and rejects anything that fails. Only the verified event drives state. Each event id is processed once.
+
+After, POST a fabricated event to the route and confirm it answers 400.`
+};
+var CODE_CHECKS = [
+  codeRlsMissing,
+  codeServiceRoleInClient,
+  codeRouteWithoutAuth,
+  codeEnvCommitted,
+  codeAiRouteWithoutLimit,
+  codeWebhookUnsigned
+];
+function runCodeChecks(ctx, catalog = CODE_CHECKS, options = {}) {
+  const out = [];
+  for (const check2 of catalog) {
+    let advisories = [];
+    try {
+      advisories = check2.howToDetect(ctx);
+    } catch {
+      if (options.failOnError) throw new Error(`Code check failed: ${check2.id}`);
+      advisories = [];
+    }
+    for (const a of advisories) {
+      out.push({
+        checkId: check2.id,
+        severity: check2.severity,
+        path: a.path,
+        reason: a.reason
+      });
+    }
+  }
+  return out;
+}
+
+// ../../packages/schema/src/analysis.ts
+var text = external_exports.string().max(400);
+var relativePath = external_exports.string().min(1).max(400).refine(
+  (p) => !p.startsWith("/") && !p.includes("\\") && !p.includes(":") && !p.split("/").includes("..") && ![...p].some((c) => c.charCodeAt(0) < 32),
+  "Expected repository-relative path"
+);
+var location = external_exports.object({ path: relativePath, line: external_exports.number().int().positive().optional() }).strict();
+var analysisFindingSchema = external_exports.object({
+  fingerprint: external_exports.string().regex(/^[a-f0-9]{64}$/),
+  matchKey: external_exports.string().regex(/^[a-f0-9]{64}$/).optional(),
+  observed: external_exports.boolean().optional(),
+  rule: text,
+  engine: text,
+  category: external_exports.enum(["security", "quality", "dependency", "secret"]),
+  severity: external_exports.enum(["critical", "high", "medium", "low", "unknown"]),
+  language: text,
+  title: text,
+  explanation: text,
+  remediation: text,
+  location,
+  flow: external_exports.array(location).max(100).default([]),
+  state: external_exports.enum(["new", "persisting", "resolved", "unverified", "accepted"]).default("new"),
+  package: external_exports.object({
+    name: text,
+    version: text,
+    ecosystem: text,
+    advisory: text,
+    fixed: external_exports.array(text).max(50),
+    relationship: external_exports.enum(["direct", "transitive", "unknown"])
+  }).strict().optional()
+}).strict();
+var engineSchema = external_exports.object({
+  id: text,
+  version: text,
+  rules: text,
+  status: external_exports.enum(["ran", "unavailable", "not-applicable", "failed"]),
+  durationMs: external_exports.number().nonnegative(),
+  files: external_exports.array(relativePath).max(1e5),
+  excluded: external_exports.array(relativePath).max(1e5),
+  message: text
+}).strict();
+var policySchema = external_exports.object({
+  version: external_exports.number().int().positive(),
+  coverage: external_exports.number().min(0).max(100),
+  requiredEngines: external_exports.array(external_exports.enum(["semgrep", "osv", "gitleaks", "builtin"])).max(4)
+}).strict();
+var DEFAULT_ANALYSIS_POLICY = {
+  version: 1,
+  coverage: 80,
+  requiredEngines: ["semgrep", "osv", "gitleaks", "builtin"]
+};
+var conditionSchema = external_exports.object({
+  id: external_exports.enum(["baseline", "engines", "security", "coverage", "tests"]),
+  status: external_exports.enum(["passed", "failed", "inconclusive", "not-applicable"]),
+  value: external_exports.number().nullable(),
+  limit: external_exports.number().nullable()
+}).strict();
+var analysisReportSchema = external_exports.object({
+  version: external_exports.literal(2),
+  projectId: external_exports.string().uuid(),
+  runId: external_exports.string().uuid(),
+  provenance: external_exports.literal("local-ci"),
+  startedAt: external_exports.string().datetime(),
+  commit: external_exports.string().regex(/^[a-f0-9]{40,64}$/).nullable(),
+  branch: text,
+  reference: text,
+  mergeBase: external_exports.string().regex(/^[a-f0-9]{40,64}$/).nullable(),
+  baselineRunId: external_exports.string().uuid().nullable(),
+  scope: external_exports.string().max(100),
+  engines: external_exports.array(engineSchema).max(30),
+  findings: external_exports.array(analysisFindingSchema).max(5e4),
+  coverage: external_exports.object({
+    status: external_exports.enum(["ran", "missing", "failed"]),
+    files: external_exports.array(
+      external_exports.object({
+        path: relativePath,
+        lines: external_exports.array(
+          external_exports.object({
+            line: external_exports.number().int().positive(),
+            hits: external_exports.number().int().nonnegative()
+          }).strict()
+        ).max(2e5)
+      }).strict()
+    ).max(1e5)
+  }).strict(),
+  tests: external_exports.object({
+    status: external_exports.enum(["ran", "missing", "failed"]),
+    total: external_exports.number().int().nonnegative(),
+    failed: external_exports.number().int().nonnegative(),
+    skipped: external_exports.number().int().nonnegative(),
+    failures: external_exports.array(
+      external_exports.object({
+        id: external_exports.string().regex(/^[a-f0-9]{64}$/),
+        location: location.optional(),
+        kind: external_exports.enum(["failure", "error"])
+      }).strict()
+    ).max(1e4).optional()
+  }).strict(),
+  changes: external_exports.array(
+    external_exports.object({
+      path: relativePath,
+      previousPath: relativePath.optional(),
+      lines: external_exports.array(external_exports.number().int().positive()).max(2e5)
+    }).strict()
+  ).max(1e5),
+  policy: policySchema,
+  conditions: external_exports.array(conditionSchema).max(10),
+  status: external_exports.enum(["passed", "failed", "inconclusive"])
+}).strict();
+function evaluateAnalysis(input, baseline, policy = DEFAULT_ANALYSIS_POLICY, exceptions = [], now = /* @__PURE__ */ new Date()) {
+  const comparable = baseline !== null && input.mergeBase !== null && baseline.commit === input.mergeBase && baseline.projectId === input.projectId && baseline.scope === input.scope;
+  const previous = new Map(
+    (comparable ? baseline.findings : []).filter((f) => f.observed !== false && f.state !== "resolved").map((f) => [f.fingerprint, f])
+  );
+  const observations = input.findings.filter((f) => f.observed !== false);
+  const current = new Set(observations.map((f) => f.fingerprint));
+  const renamed = new Map(
+    input.changes.filter((c) => c.previousPath).map((c) => [c.path, c.previousPath])
+  );
+  const matchedPrevious = /* @__PURE__ */ new Set();
+  const active = new Set(
+    exceptions.filter((e) => e.reason.trim() && new Date(e.expiresAt) > now).map((e) => e.fingerprint)
+  );
+  const findings = observations.map((f) => {
+    const engine = input.engines.find((e) => e.id === f.engine);
+    const oldEngine = baseline?.engines.find((e) => e.id === f.engine);
+    const old = previous.get(f.fingerprint) ?? (f.matchKey && renamed.has(f.location.path) ? [...previous.values()].find(
+      (p) => p.matchKey === f.matchKey && p.location.path === renamed.get(f.location.path)
+    ) : void 0);
+    const known = old !== void 0;
+    if (old) matchedPrevious.add(old.fingerprint);
+    const compatibleEngine = engine?.status === "ran" && oldEngine !== void 0 && ["ran", "not-applicable"].includes(oldEngine.status) && engine.version === oldEngine.version && engine.rules === oldEngine.rules;
+    return {
+      ...f,
+      observed: true,
+      state: active.has(f.fingerprint) ? "accepted" : !comparable || !compatibleEngine ? "unverified" : known ? "persisting" : "new"
+    };
+  });
+  if (comparable)
+    for (const old of previous.values()) {
+      if (current.has(old.fingerprint) || matchedPrevious.has(old.fingerprint)) continue;
+      const engine = input.engines.find((e) => e.id === old.engine);
+      const before = baseline.engines.find((e) => e.id === old.engine);
+      const covered2 = engine?.status === "ran" && engine.version === before?.version && engine.rules === before?.rules && engine.files.includes(old.location.path) && !engine.excluded.includes(old.location.path);
+      findings.push({
+        ...old,
+        observed: false,
+        state: covered2 ? "resolved" : "unverified"
+      });
+    }
+  const missingEngine = input.engines.some((e) => ["failed", "unavailable"].includes(e.status)) || input.engines.some(
+    (e) => input.changes.some((c) => c.lines.length > 0 && e.excluded.includes(c.path))
+  ) || comparable && input.engines.some((e) => {
+    const before = baseline.engines.find((b) => b.id === e.id);
+    return !before || before.rules !== e.rules || before.version !== e.version || !["ran", "not-applicable"].includes(before.status);
+  }) || policy.requiredEngines.some(
+    (id) => !input.engines.some(
+      (e) => e.id === id && ["ran", "not-applicable"].includes(e.status)
+    )
+  );
+  const coverageByPath = new Map(
+    input.coverage.files.map((f) => [
+      f.path,
+      new Map(f.lines.map((l) => [l.line, l.hits]))
+    ])
+  );
+  let executable = 0, covered = 0;
+  let unknownFile = false;
+  for (const change of input.changes) {
+    if (!change.lines.length || !/\.(tsx?|jsx?|py|go|java|cs)$/.test(change.path))
+      continue;
+    const lines = coverageByPath.get(change.path);
+    if (!lines) {
+      unknownFile = true;
+      continue;
+    }
+    for (const line of change.lines)
+      if (lines.has(line)) {
+        executable++;
+        if ((lines.get(line) ?? 0) > 0) covered++;
+      }
+  }
+  const percent = executable ? covered / executable * 100 : null;
+  const blockers = findings.filter(
+    (f) => f.state === "new" && (f.category === "secret" || f.category !== "quality" && ["critical", "high"].includes(f.severity))
+  ).length;
+  const uncertain = findings.some(
+    (f) => (f.state === "unverified" || f.state === "new" && f.severity === "unknown") && f.category !== "quality"
+  );
+  const conditions = [
+    {
+      id: "baseline",
+      status: comparable ? "passed" : "inconclusive",
+      value: null,
+      limit: null
+    },
+    {
+      id: "engines",
+      status: missingEngine || uncertain ? "inconclusive" : "passed",
+      value: null,
+      limit: null
+    },
+    {
+      id: "security",
+      status: blockers ? "failed" : comparable ? "passed" : "inconclusive",
+      value: blockers,
+      limit: 0
+    },
+    {
+      id: "coverage",
+      status: !comparable || unknownFile || input.coverage.status === "failed" || executable > 0 && input.coverage.status !== "ran" ? "inconclusive" : percent === null ? "not-applicable" : percent < policy.coverage ? "failed" : "passed",
+      value: percent,
+      limit: policy.coverage
+    },
+    {
+      id: "tests",
+      status: input.tests.status === "failed" ? "inconclusive" : input.tests.failed ? "failed" : input.tests.status === "missing" ? "not-applicable" : "passed",
+      value: input.tests.failed,
+      limit: 0
+    }
+  ];
+  return {
+    ...input,
+    findings,
+    policy,
+    conditions,
+    status: conditions.some((c) => c.status === "failed") ? "failed" : conditions.some((c) => c.status === "inconclusive") ? "inconclusive" : "passed"
+  };
+}
+
+// ../../packages/analysis/src/process.ts
+import { spawn } from "child_process";
+function execute(file2, args, cwd, timeoutMs = 12e4) {
+  return new Promise((resolve4) => {
+    const child = spawn(file2, args, {
+      cwd,
+      shell: false,
+      windowsHide: true,
+      detached: process.platform !== "win32",
+      env: { ...process.env, SEMGREP_SEND_METRICS: "off" },
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    let stdout = "", bytes = 0, done = false;
+    const finish = (code, unavailable = false) => {
+      if (done) return;
+      done = true;
+      clearTimeout(timer);
+      resolve4({ code, stdout, unavailable });
+    };
+    const timer = setTimeout(() => {
+      stop();
+      finish(124);
+    }, timeoutMs);
+    function stop() {
+      try {
+        if (process.platform !== "win32" && child.pid) process.kill(-child.pid, "SIGKILL");
+        else child.kill("SIGKILL");
+      } catch {
+      }
+    }
+    child.stdout.on("data", (chunk) => {
+      bytes += chunk.length;
+      if (bytes > 2e7) {
+        stop();
+        finish(125);
+      } else stdout += chunk.toString();
+    });
+    child.stderr.on("data", (chunk) => {
+      bytes += chunk.length;
+      if (bytes > 2e7) {
+        stop();
+        finish(125);
+      }
+    });
+    child.on("error", () => finish(127, true));
+    child.on("close", (code) => finish(code ?? 126));
+  });
+}
+
+// ../../packages/analysis/src/importers.ts
+import { createHash } from "crypto";
+
+// ../../node_modules/.pnpm/fast-xml-parser@5.3.8/node_modules/fast-xml-parser/src/util.js
+var nameStartChar = ":A-Za-z_\\u00C0-\\u00D6\\u00D8-\\u00F6\\u00F8-\\u02FF\\u0370-\\u037D\\u037F-\\u1FFF\\u200C-\\u200D\\u2070-\\u218F\\u2C00-\\u2FEF\\u3001-\\uD7FF\\uF900-\\uFDCF\\uFDF0-\\uFFFD";
+var nameChar = nameStartChar + "\\-.\\d\\u00B7\\u0300-\\u036F\\u203F-\\u2040";
+var nameRegexp = "[" + nameStartChar + "][" + nameChar + "]*";
+var regexName = new RegExp("^" + nameRegexp + "$");
+function getAllMatches(string4, regex) {
+  const matches = [];
+  let match = regex.exec(string4);
+  while (match) {
+    const allmatches = [];
+    allmatches.startIndex = regex.lastIndex - match[0].length;
+    const len = match.length;
+    for (let index = 0; index < len; index++) {
+      allmatches.push(match[index]);
+    }
+    matches.push(allmatches);
+    match = regex.exec(string4);
+  }
+  return matches;
+}
+var isName = function(string4) {
+  const match = regexName.exec(string4);
+  return !(match === null || typeof match === "undefined");
+};
+function isExist(v) {
+  return typeof v !== "undefined";
+}
+
+// ../../node_modules/.pnpm/fast-xml-parser@5.3.8/node_modules/fast-xml-parser/src/validator.js
+var defaultOptions = {
+  allowBooleanAttributes: false,
+  //A tag can have attributes without any value
+  unpairedTags: []
+};
+function validate(xmlData, options) {
+  options = Object.assign({}, defaultOptions, options);
+  const tags = [];
+  let tagFound = false;
+  let reachedRoot = false;
+  if (xmlData[0] === "\uFEFF") {
+    xmlData = xmlData.substr(1);
+  }
+  for (let i = 0; i < xmlData.length; i++) {
+    if (xmlData[i] === "<" && xmlData[i + 1] === "?") {
+      i += 2;
+      i = readPI(xmlData, i);
+      if (i.err) return i;
+    } else if (xmlData[i] === "<") {
+      let tagStartPos = i;
+      i++;
+      if (xmlData[i] === "!") {
+        i = readCommentAndCDATA(xmlData, i);
+        continue;
+      } else {
+        let closingTag = false;
+        if (xmlData[i] === "/") {
+          closingTag = true;
+          i++;
+        }
+        let tagName = "";
+        for (; i < xmlData.length && xmlData[i] !== ">" && xmlData[i] !== " " && xmlData[i] !== "	" && xmlData[i] !== "\n" && xmlData[i] !== "\r"; i++) {
+          tagName += xmlData[i];
+        }
+        tagName = tagName.trim();
+        if (tagName[tagName.length - 1] === "/") {
+          tagName = tagName.substring(0, tagName.length - 1);
+          i--;
+        }
+        if (!validateTagName(tagName)) {
+          let msg;
+          if (tagName.trim().length === 0) {
+            msg = "Invalid space after '<'.";
+          } else {
+            msg = "Tag '" + tagName + "' is an invalid name.";
+          }
+          return getErrorObject("InvalidTag", msg, getLineNumberForPosition(xmlData, i));
+        }
+        const result = readAttributeStr(xmlData, i);
+        if (result === false) {
+          return getErrorObject("InvalidAttr", "Attributes for '" + tagName + "' have open quote.", getLineNumberForPosition(xmlData, i));
+        }
+        let attrStr = result.value;
+        i = result.index;
+        if (attrStr[attrStr.length - 1] === "/") {
+          const attrStrStart = i - attrStr.length;
+          attrStr = attrStr.substring(0, attrStr.length - 1);
+          const isValid = validateAttributeString(attrStr, options);
+          if (isValid === true) {
+            tagFound = true;
+          } else {
+            return getErrorObject(isValid.err.code, isValid.err.msg, getLineNumberForPosition(xmlData, attrStrStart + isValid.err.line));
+          }
+        } else if (closingTag) {
+          if (!result.tagClosed) {
+            return getErrorObject("InvalidTag", "Closing tag '" + tagName + "' doesn't have proper closing.", getLineNumberForPosition(xmlData, i));
+          } else if (attrStr.trim().length > 0) {
+            return getErrorObject("InvalidTag", "Closing tag '" + tagName + "' can't have attributes or invalid starting.", getLineNumberForPosition(xmlData, tagStartPos));
+          } else if (tags.length === 0) {
+            return getErrorObject("InvalidTag", "Closing tag '" + tagName + "' has not been opened.", getLineNumberForPosition(xmlData, tagStartPos));
+          } else {
+            const otg = tags.pop();
+            if (tagName !== otg.tagName) {
+              let openPos = getLineNumberForPosition(xmlData, otg.tagStartPos);
+              return getErrorObject(
+                "InvalidTag",
+                "Expected closing tag '" + otg.tagName + "' (opened in line " + openPos.line + ", col " + openPos.col + ") instead of closing tag '" + tagName + "'.",
+                getLineNumberForPosition(xmlData, tagStartPos)
+              );
+            }
+            if (tags.length == 0) {
+              reachedRoot = true;
+            }
+          }
+        } else {
+          const isValid = validateAttributeString(attrStr, options);
+          if (isValid !== true) {
+            return getErrorObject(isValid.err.code, isValid.err.msg, getLineNumberForPosition(xmlData, i - attrStr.length + isValid.err.line));
+          }
+          if (reachedRoot === true) {
+            return getErrorObject("InvalidXml", "Multiple possible root nodes found.", getLineNumberForPosition(xmlData, i));
+          } else if (options.unpairedTags.indexOf(tagName) !== -1) {
+          } else {
+            tags.push({ tagName, tagStartPos });
+          }
+          tagFound = true;
+        }
+        for (i++; i < xmlData.length; i++) {
+          if (xmlData[i] === "<") {
+            if (xmlData[i + 1] === "!") {
+              i++;
+              i = readCommentAndCDATA(xmlData, i);
+              continue;
+            } else if (xmlData[i + 1] === "?") {
+              i = readPI(xmlData, ++i);
+              if (i.err) return i;
+            } else {
+              break;
+            }
+          } else if (xmlData[i] === "&") {
+            const afterAmp = validateAmpersand(xmlData, i);
+            if (afterAmp == -1)
+              return getErrorObject("InvalidChar", "char '&' is not expected.", getLineNumberForPosition(xmlData, i));
+            i = afterAmp;
+          } else {
+            if (reachedRoot === true && !isWhiteSpace(xmlData[i])) {
+              return getErrorObject("InvalidXml", "Extra text at the end", getLineNumberForPosition(xmlData, i));
+            }
+          }
+        }
+        if (xmlData[i] === "<") {
+          i--;
+        }
+      }
+    } else {
+      if (isWhiteSpace(xmlData[i])) {
+        continue;
+      }
+      return getErrorObject("InvalidChar", "char '" + xmlData[i] + "' is not expected.", getLineNumberForPosition(xmlData, i));
+    }
+  }
+  if (!tagFound) {
+    return getErrorObject("InvalidXml", "Start tag expected.", 1);
+  } else if (tags.length == 1) {
+    return getErrorObject("InvalidTag", "Unclosed tag '" + tags[0].tagName + "'.", getLineNumberForPosition(xmlData, tags[0].tagStartPos));
+  } else if (tags.length > 0) {
+    return getErrorObject("InvalidXml", "Invalid '" + JSON.stringify(tags.map((t) => t.tagName), null, 4).replace(/\r?\n/g, "") + "' found.", { line: 1, col: 1 });
+  }
+  return true;
+}
+function isWhiteSpace(char) {
+  return char === " " || char === "	" || char === "\n" || char === "\r";
+}
+function readPI(xmlData, i) {
+  const start = i;
+  for (; i < xmlData.length; i++) {
+    if (xmlData[i] == "?" || xmlData[i] == " ") {
+      const tagname = xmlData.substr(start, i - start);
+      if (i > 5 && tagname === "xml") {
+        return getErrorObject("InvalidXml", "XML declaration allowed only at the start of the document.", getLineNumberForPosition(xmlData, i));
+      } else if (xmlData[i] == "?" && xmlData[i + 1] == ">") {
+        i++;
+        break;
+      } else {
+        continue;
+      }
+    }
+  }
+  return i;
+}
+function readCommentAndCDATA(xmlData, i) {
+  if (xmlData.length > i + 5 && xmlData[i + 1] === "-" && xmlData[i + 2] === "-") {
+    for (i += 3; i < xmlData.length; i++) {
+      if (xmlData[i] === "-" && xmlData[i + 1] === "-" && xmlData[i + 2] === ">") {
+        i += 2;
+        break;
+      }
+    }
+  } else if (xmlData.length > i + 8 && xmlData[i + 1] === "D" && xmlData[i + 2] === "O" && xmlData[i + 3] === "C" && xmlData[i + 4] === "T" && xmlData[i + 5] === "Y" && xmlData[i + 6] === "P" && xmlData[i + 7] === "E") {
+    let angleBracketsCount = 1;
+    for (i += 8; i < xmlData.length; i++) {
+      if (xmlData[i] === "<") {
+        angleBracketsCount++;
+      } else if (xmlData[i] === ">") {
+        angleBracketsCount--;
+        if (angleBracketsCount === 0) {
+          break;
+        }
+      }
+    }
+  } else if (xmlData.length > i + 9 && xmlData[i + 1] === "[" && xmlData[i + 2] === "C" && xmlData[i + 3] === "D" && xmlData[i + 4] === "A" && xmlData[i + 5] === "T" && xmlData[i + 6] === "A" && xmlData[i + 7] === "[") {
+    for (i += 8; i < xmlData.length; i++) {
+      if (xmlData[i] === "]" && xmlData[i + 1] === "]" && xmlData[i + 2] === ">") {
+        i += 2;
+        break;
+      }
+    }
+  }
+  return i;
+}
+var doubleQuote = '"';
+var singleQuote = "'";
+function readAttributeStr(xmlData, i) {
+  let attrStr = "";
+  let startChar = "";
+  let tagClosed = false;
+  for (; i < xmlData.length; i++) {
+    if (xmlData[i] === doubleQuote || xmlData[i] === singleQuote) {
+      if (startChar === "") {
+        startChar = xmlData[i];
+      } else if (startChar !== xmlData[i]) {
+      } else {
+        startChar = "";
+      }
+    } else if (xmlData[i] === ">") {
+      if (startChar === "") {
+        tagClosed = true;
+        break;
+      }
+    }
+    attrStr += xmlData[i];
+  }
+  if (startChar !== "") {
+    return false;
+  }
+  return {
+    value: attrStr,
+    index: i,
+    tagClosed
+  };
+}
+var validAttrStrRegxp = new RegExp(`(\\s*)([^\\s=]+)(\\s*=)?(\\s*(['"])(([\\s\\S])*?)\\5)?`, "g");
+function validateAttributeString(attrStr, options) {
+  const matches = getAllMatches(attrStr, validAttrStrRegxp);
+  const attrNames = {};
+  for (let i = 0; i < matches.length; i++) {
+    if (matches[i][1].length === 0) {
+      return getErrorObject("InvalidAttr", "Attribute '" + matches[i][2] + "' has no space in starting.", getPositionFromMatch(matches[i]));
+    } else if (matches[i][3] !== void 0 && matches[i][4] === void 0) {
+      return getErrorObject("InvalidAttr", "Attribute '" + matches[i][2] + "' is without value.", getPositionFromMatch(matches[i]));
+    } else if (matches[i][3] === void 0 && !options.allowBooleanAttributes) {
+      return getErrorObject("InvalidAttr", "boolean attribute '" + matches[i][2] + "' is not allowed.", getPositionFromMatch(matches[i]));
+    }
+    const attrName = matches[i][2];
+    if (!validateAttrName(attrName)) {
+      return getErrorObject("InvalidAttr", "Attribute '" + attrName + "' is an invalid name.", getPositionFromMatch(matches[i]));
+    }
+    if (!Object.prototype.hasOwnProperty.call(attrNames, attrName)) {
+      attrNames[attrName] = 1;
+    } else {
+      return getErrorObject("InvalidAttr", "Attribute '" + attrName + "' is repeated.", getPositionFromMatch(matches[i]));
+    }
+  }
+  return true;
+}
+function validateNumberAmpersand(xmlData, i) {
+  let re = /\d/;
+  if (xmlData[i] === "x") {
+    i++;
+    re = /[\da-fA-F]/;
+  }
+  for (; i < xmlData.length; i++) {
+    if (xmlData[i] === ";")
+      return i;
+    if (!xmlData[i].match(re))
+      break;
+  }
+  return -1;
+}
+function validateAmpersand(xmlData, i) {
+  i++;
+  if (xmlData[i] === ";")
+    return -1;
+  if (xmlData[i] === "#") {
+    i++;
+    return validateNumberAmpersand(xmlData, i);
+  }
+  let count = 0;
+  for (; i < xmlData.length; i++, count++) {
+    if (xmlData[i].match(/\w/) && count < 20)
+      continue;
+    if (xmlData[i] === ";")
+      break;
+    return -1;
+  }
+  return i;
+}
+function getErrorObject(code, message, lineNumber) {
+  return {
+    err: {
+      code,
+      msg: message,
+      line: lineNumber.line || lineNumber,
+      col: lineNumber.col
+    }
+  };
+}
+function validateAttrName(attrName) {
+  return isName(attrName);
+}
+function validateTagName(tagname) {
+  return isName(tagname);
+}
+function getLineNumberForPosition(xmlData, index) {
+  const lines = xmlData.substring(0, index).split(/\r?\n/);
+  return {
+    line: lines.length,
+    // column number is last line's length + 1, because column numbering starts at 1:
+    col: lines[lines.length - 1].length + 1
+  };
+}
+function getPositionFromMatch(match) {
+  return match.startIndex + match[1].length;
+}
+
+// ../../node_modules/.pnpm/fast-xml-parser@5.3.8/node_modules/fast-xml-parser/src/xmlparser/OptionsBuilder.js
+var defaultOptions2 = {
+  preserveOrder: false,
+  attributeNamePrefix: "@_",
+  attributesGroupName: false,
+  textNodeName: "#text",
+  ignoreAttributes: true,
+  removeNSPrefix: false,
+  // remove NS from tag name or attribute name if true
+  allowBooleanAttributes: false,
+  //a tag can have attributes without any value
+  //ignoreRootElement : false,
+  parseTagValue: true,
+  parseAttributeValue: false,
+  trimValues: true,
+  //Trim string values of tag and attributes
+  cdataPropName: false,
+  numberParseOptions: {
+    hex: true,
+    leadingZeros: true,
+    eNotation: true
+  },
+  tagValueProcessor: function(tagName, val) {
+    return val;
+  },
+  attributeValueProcessor: function(attrName, val) {
+    return val;
+  },
+  stopNodes: [],
+  //nested tags will not be parsed even for errors
+  alwaysCreateTextNode: false,
+  isArray: () => false,
+  commentPropName: false,
+  unpairedTags: [],
+  processEntities: true,
+  htmlEntities: false,
+  ignoreDeclaration: false,
+  ignorePiTags: false,
+  transformTagName: false,
+  transformAttributeName: false,
+  updateTag: function(tagName, jPath, attrs) {
+    return tagName;
+  },
+  // skipEmptyListItem: false
+  captureMetaData: false,
+  maxNestedTags: 100
+};
+function normalizeProcessEntities(value) {
+  if (typeof value === "boolean") {
+    return {
+      enabled: value,
+      // true or false
+      maxEntitySize: 1e4,
+      maxExpansionDepth: 10,
+      maxTotalExpansions: 1e3,
+      maxExpandedLength: 1e5,
+      allowedTags: null,
+      tagFilter: null
+    };
+  }
+  if (typeof value === "object" && value !== null) {
+    return {
+      enabled: value.enabled !== false,
+      // default true if not specified
+      maxEntitySize: value.maxEntitySize ?? 1e4,
+      maxExpansionDepth: value.maxExpansionDepth ?? 10,
+      maxTotalExpansions: value.maxTotalExpansions ?? 1e3,
+      maxExpandedLength: value.maxExpandedLength ?? 1e5,
+      allowedTags: value.allowedTags ?? null,
+      tagFilter: value.tagFilter ?? null
+    };
+  }
+  return normalizeProcessEntities(true);
+}
+var buildOptions = function(options) {
+  const built = Object.assign({}, defaultOptions2, options);
+  built.processEntities = normalizeProcessEntities(built.processEntities);
+  return built;
+};
+
+// ../../node_modules/.pnpm/fast-xml-parser@5.3.8/node_modules/fast-xml-parser/src/xmlparser/xmlNode.js
+var METADATA_SYMBOL;
+if (typeof Symbol !== "function") {
+  METADATA_SYMBOL = "@@xmlMetadata";
+} else {
+  METADATA_SYMBOL = /* @__PURE__ */ Symbol("XML Node Metadata");
+}
+var XmlNode = class {
+  constructor(tagname) {
+    this.tagname = tagname;
+    this.child = [];
+    this[":@"] = /* @__PURE__ */ Object.create(null);
+  }
+  add(key, val) {
+    if (key === "__proto__") key = "#__proto__";
+    this.child.push({ [key]: val });
+  }
+  addChild(node, startIndex) {
+    if (node.tagname === "__proto__") node.tagname = "#__proto__";
+    if (node[":@"] && Object.keys(node[":@"]).length > 0) {
+      this.child.push({ [node.tagname]: node.child, [":@"]: node[":@"] });
+    } else {
+      this.child.push({ [node.tagname]: node.child });
+    }
+    if (startIndex !== void 0) {
+      this.child[this.child.length - 1][METADATA_SYMBOL] = { startIndex };
+    }
+  }
+  /** symbol used for metadata */
+  static getMetaDataSymbol() {
+    return METADATA_SYMBOL;
+  }
+};
+
+// ../../node_modules/.pnpm/fast-xml-parser@5.3.8/node_modules/fast-xml-parser/src/xmlparser/DocTypeReader.js
+var DocTypeReader = class {
+  constructor(options) {
+    this.suppressValidationErr = !options;
+    this.options = options;
+  }
+  readDocType(xmlData, i) {
+    const entities = /* @__PURE__ */ Object.create(null);
+    if (xmlData[i + 3] === "O" && xmlData[i + 4] === "C" && xmlData[i + 5] === "T" && xmlData[i + 6] === "Y" && xmlData[i + 7] === "P" && xmlData[i + 8] === "E") {
+      i = i + 9;
+      let angleBracketsCount = 1;
+      let hasBody = false, comment = false;
+      let exp = "";
+      for (; i < xmlData.length; i++) {
+        if (xmlData[i] === "<" && !comment) {
+          if (hasBody && hasSeq(xmlData, "!ENTITY", i)) {
+            i += 7;
+            let entityName, val;
+            [entityName, val, i] = this.readEntityExp(xmlData, i + 1, this.suppressValidationErr);
+            if (val.indexOf("&") === -1) {
+              const escaped = entityName.replace(/[.\-+*:]/g, "\\.");
+              entities[entityName] = {
+                regx: RegExp(`&${escaped};`, "g"),
+                val
+              };
+            }
+          } else if (hasBody && hasSeq(xmlData, "!ELEMENT", i)) {
+            i += 8;
+            const { index } = this.readElementExp(xmlData, i + 1);
+            i = index;
+          } else if (hasBody && hasSeq(xmlData, "!ATTLIST", i)) {
+            i += 8;
+          } else if (hasBody && hasSeq(xmlData, "!NOTATION", i)) {
+            i += 9;
+            const { index } = this.readNotationExp(xmlData, i + 1, this.suppressValidationErr);
+            i = index;
+          } else if (hasSeq(xmlData, "!--", i)) comment = true;
+          else throw new Error(`Invalid DOCTYPE`);
+          angleBracketsCount++;
+          exp = "";
+        } else if (xmlData[i] === ">") {
+          if (comment) {
+            if (xmlData[i - 1] === "-" && xmlData[i - 2] === "-") {
+              comment = false;
+              angleBracketsCount--;
+            }
+          } else {
+            angleBracketsCount--;
+          }
+          if (angleBracketsCount === 0) {
+            break;
+          }
+        } else if (xmlData[i] === "[") {
+          hasBody = true;
+        } else {
+          exp += xmlData[i];
+        }
+      }
+      if (angleBracketsCount !== 0) {
+        throw new Error(`Unclosed DOCTYPE`);
+      }
+    } else {
+      throw new Error(`Invalid Tag instead of DOCTYPE`);
+    }
+    return { entities, i };
+  }
+  readEntityExp(xmlData, i) {
+    i = skipWhitespace(xmlData, i);
+    let entityName = "";
+    while (i < xmlData.length && !/\s/.test(xmlData[i]) && xmlData[i] !== '"' && xmlData[i] !== "'") {
+      entityName += xmlData[i];
+      i++;
+    }
+    validateEntityName(entityName);
+    i = skipWhitespace(xmlData, i);
+    if (!this.suppressValidationErr) {
+      if (xmlData.substring(i, i + 6).toUpperCase() === "SYSTEM") {
+        throw new Error("External entities are not supported");
+      } else if (xmlData[i] === "%") {
+        throw new Error("Parameter entities are not supported");
+      }
+    }
+    let entityValue = "";
+    [i, entityValue] = this.readIdentifierVal(xmlData, i, "entity");
+    if (this.options.enabled !== false && this.options.maxEntitySize && entityValue.length > this.options.maxEntitySize) {
+      throw new Error(
+        `Entity "${entityName}" size (${entityValue.length}) exceeds maximum allowed size (${this.options.maxEntitySize})`
+      );
+    }
+    i--;
+    return [entityName, entityValue, i];
+  }
+  readNotationExp(xmlData, i) {
+    i = skipWhitespace(xmlData, i);
+    let notationName = "";
+    while (i < xmlData.length && !/\s/.test(xmlData[i])) {
+      notationName += xmlData[i];
+      i++;
+    }
+    !this.suppressValidationErr && validateEntityName(notationName);
+    i = skipWhitespace(xmlData, i);
+    const identifierType = xmlData.substring(i, i + 6).toUpperCase();
+    if (!this.suppressValidationErr && identifierType !== "SYSTEM" && identifierType !== "PUBLIC") {
+      throw new Error(`Expected SYSTEM or PUBLIC, found "${identifierType}"`);
+    }
+    i += identifierType.length;
+    i = skipWhitespace(xmlData, i);
+    let publicIdentifier = null;
+    let systemIdentifier = null;
+    if (identifierType === "PUBLIC") {
+      [i, publicIdentifier] = this.readIdentifierVal(xmlData, i, "publicIdentifier");
+      i = skipWhitespace(xmlData, i);
+      if (xmlData[i] === '"' || xmlData[i] === "'") {
+        [i, systemIdentifier] = this.readIdentifierVal(xmlData, i, "systemIdentifier");
+      }
+    } else if (identifierType === "SYSTEM") {
+      [i, systemIdentifier] = this.readIdentifierVal(xmlData, i, "systemIdentifier");
+      if (!this.suppressValidationErr && !systemIdentifier) {
+        throw new Error("Missing mandatory system identifier for SYSTEM notation");
+      }
+    }
+    return { notationName, publicIdentifier, systemIdentifier, index: --i };
+  }
+  readIdentifierVal(xmlData, i, type) {
+    let identifierVal = "";
+    const startChar = xmlData[i];
+    if (startChar !== '"' && startChar !== "'") {
+      throw new Error(`Expected quoted string, found "${startChar}"`);
+    }
+    i++;
+    while (i < xmlData.length && xmlData[i] !== startChar) {
+      identifierVal += xmlData[i];
+      i++;
+    }
+    if (xmlData[i] !== startChar) {
+      throw new Error(`Unterminated ${type} value`);
+    }
+    i++;
+    return [i, identifierVal];
+  }
+  readElementExp(xmlData, i) {
+    i = skipWhitespace(xmlData, i);
+    let elementName = "";
+    while (i < xmlData.length && !/\s/.test(xmlData[i])) {
+      elementName += xmlData[i];
+      i++;
+    }
+    if (!this.suppressValidationErr && !isName(elementName)) {
+      throw new Error(`Invalid element name: "${elementName}"`);
+    }
+    i = skipWhitespace(xmlData, i);
+    let contentModel = "";
+    if (xmlData[i] === "E" && hasSeq(xmlData, "MPTY", i)) i += 4;
+    else if (xmlData[i] === "A" && hasSeq(xmlData, "NY", i)) i += 2;
+    else if (xmlData[i] === "(") {
+      i++;
+      while (i < xmlData.length && xmlData[i] !== ")") {
+        contentModel += xmlData[i];
+        i++;
+      }
+      if (xmlData[i] !== ")") {
+        throw new Error("Unterminated content model");
+      }
+    } else if (!this.suppressValidationErr) {
+      throw new Error(`Invalid Element Expression, found "${xmlData[i]}"`);
+    }
+    return {
+      elementName,
+      contentModel: contentModel.trim(),
+      index: i
+    };
+  }
+  readAttlistExp(xmlData, i) {
+    i = skipWhitespace(xmlData, i);
+    let elementName = "";
+    while (i < xmlData.length && !/\s/.test(xmlData[i])) {
+      elementName += xmlData[i];
+      i++;
+    }
+    validateEntityName(elementName);
+    i = skipWhitespace(xmlData, i);
+    let attributeName = "";
+    while (i < xmlData.length && !/\s/.test(xmlData[i])) {
+      attributeName += xmlData[i];
+      i++;
+    }
+    if (!validateEntityName(attributeName)) {
+      throw new Error(`Invalid attribute name: "${attributeName}"`);
+    }
+    i = skipWhitespace(xmlData, i);
+    let attributeType = "";
+    if (xmlData.substring(i, i + 8).toUpperCase() === "NOTATION") {
+      attributeType = "NOTATION";
+      i += 8;
+      i = skipWhitespace(xmlData, i);
+      if (xmlData[i] !== "(") {
+        throw new Error(`Expected '(', found "${xmlData[i]}"`);
+      }
+      i++;
+      let allowedNotations = [];
+      while (i < xmlData.length && xmlData[i] !== ")") {
+        let notation = "";
+        while (i < xmlData.length && xmlData[i] !== "|" && xmlData[i] !== ")") {
+          notation += xmlData[i];
+          i++;
+        }
+        notation = notation.trim();
+        if (!validateEntityName(notation)) {
+          throw new Error(`Invalid notation name: "${notation}"`);
+        }
+        allowedNotations.push(notation);
+        if (xmlData[i] === "|") {
+          i++;
+          i = skipWhitespace(xmlData, i);
+        }
+      }
+      if (xmlData[i] !== ")") {
+        throw new Error("Unterminated list of notations");
+      }
+      i++;
+      attributeType += " (" + allowedNotations.join("|") + ")";
+    } else {
+      while (i < xmlData.length && !/\s/.test(xmlData[i])) {
+        attributeType += xmlData[i];
+        i++;
+      }
+      const validTypes = ["CDATA", "ID", "IDREF", "IDREFS", "ENTITY", "ENTITIES", "NMTOKEN", "NMTOKENS"];
+      if (!this.suppressValidationErr && !validTypes.includes(attributeType.toUpperCase())) {
+        throw new Error(`Invalid attribute type: "${attributeType}"`);
+      }
+    }
+    i = skipWhitespace(xmlData, i);
+    let defaultValue = "";
+    if (xmlData.substring(i, i + 8).toUpperCase() === "#REQUIRED") {
+      defaultValue = "#REQUIRED";
+      i += 8;
+    } else if (xmlData.substring(i, i + 7).toUpperCase() === "#IMPLIED") {
+      defaultValue = "#IMPLIED";
+      i += 7;
+    } else {
+      [i, defaultValue] = this.readIdentifierVal(xmlData, i, "ATTLIST");
+    }
+    return {
+      elementName,
+      attributeName,
+      attributeType,
+      defaultValue,
+      index: i
+    };
+  }
+};
+var skipWhitespace = (data, index) => {
+  while (index < data.length && /\s/.test(data[index])) {
+    index++;
+  }
+  return index;
+};
+function hasSeq(data, seq, i) {
+  for (let j = 0; j < seq.length; j++) {
+    if (seq[j] !== data[i + j + 1]) return false;
+  }
+  return true;
+}
+function validateEntityName(name) {
+  if (isName(name))
+    return name;
+  else
+    throw new Error(`Invalid entity name ${name}`);
+}
+
+// ../../node_modules/.pnpm/anynum@1.0.1/node_modules/anynum/digitTable.js
+var SCRIPT_ZEROS = [
+  // Basic Latin (ASCII) — included for completeness / pass-through
+  48,
+  // 0-9
+  // Arabic scripts
+  1632,
+  // Arabic-Indic ٠١٢٣٤٥٦٧٨٩
+  1776,
+  // Extended Arabic-Indic (Urdu/Persian/Sindhi) ۰۱۲۳
+  // Indic scripts
+  2406,
+  // Devanagari ०१२३४५६७८९
+  2534,
+  // Bengali ০১২৩৪৫৬৭৮৯
+  2662,
+  // Gurmukhi ੦੧੨੩੪੫੬੭੮੯
+  2790,
+  // Gujarati ૦૧૨૩૪૫૬૭૮૯
+  2918,
+  // Odia ୦୧୨୩୪୫୬୭୮୯
+  3046,
+  // Tamil ௦௧௨௩௪௫௬௭௮௯
+  3174,
+  // Telugu ౦౧౨౩౪౫౬౭౮౯
+  3302,
+  // Kannada ೦೧೨೩೪೫೬೭೮೯
+  3430,
+  // Malayalam ൦൧൨൩൪൫൬൭൮൯
+  3558,
+  // Sinhala Archaic ෦෧෨෩෪෫෬෭෮෯
+  // Southeast Asian scripts
+  3664,
+  // Thai ๐๑๒๓๔๕๖๗๘๙
+  3792,
+  // Lao ໐໑໒໓໔໕໖໗໘໙
+  3872,
+  // Tibetan ༠༡༢༣༤༥༦༧༨༩
+  4160,
+  // Myanmar ၀၁၂၃၄၅၆၇၈၉
+  4240,
+  // Myanmar Shan ႐႑႒႓႔႕႖႗႘႙
+  6112,
+  // Khmer ០១២៣៤៥៦៧៨៩
+  6160,
+  // Mongolian ᠐᠑᠒᠓᠔᠕᠖᠗᠘᠙
+  6470,
+  // Limbu ᥆᥇᥈᥉᥊᥋᥌᥍᥎᥏
+  6608,
+  // New Tai Lue ᧐᧑᧒᧓᧔᧕᧖᧗᧘᧙
+  6784,
+  // Tai Tham Hora ᪀᪁᪂᪃᪄᪅᪆᪇᪈᪉
+  6800,
+  // Tai Tham Tham ᪐᪑᪒᪓᪔᪕᪖᪗᪘᪙
+  6992,
+  // Balinese ᭐᭑᭒᭓᭔᭕᭖᭗᭘᭙
+  7088,
+  // Sundanese ᮰᮱᮲᮳᮴᮵᮶᮷᮸᮹
+  7232,
+  // Lepcha ᱀᱁᱂᱃᱄᱅᱆᱇᱈᱉
+  7248,
+  // Ol Chiki ᱐᱑᱒᱓᱔᱕᱖᱗᱘᱙
+  // Fullwidth (CJK context)
+  65296,
+  // Fullwidth ０１２３４５６７８９
+  // Mathematical digit variants (Unicode math block)
+  120782,
+  // Mathematical Bold
+  120792,
+  // Mathematical Double-Struck
+  120802,
+  // Mathematical Sans-Serif
+  120812,
+  // Mathematical Sans-Serif Bold
+  120822,
+  // Mathematical Monospace
+  // Other scripts
+  66720,
+  // Osmanya 𐒠𐒡𐒢𐒣𐒤𐒥𐒦𐒧𐒨𐒩
+  68912,
+  // Hanifi Rohingya 𐴰𐴱𐴲𐴳𐴴𐴵𐴶𐴷𐴸𐴹
+  69734,
+  // Brahmi 𑁦𑁧𑁨𑁩𑁪𑁫𑁬𑁭𑁮𑁯
+  69872,
+  // Sora Sompeng 𑃰𑃱𑃲𑃳𑃴𑃵𑃶𑃷𑃸𑃹
+  69942,
+  // Chakma 𑄶𑄷𑄸𑄹𑄺𑄻𑄼𑄽𑄾𑄿
+  70096,
+  // Sharada 𑇐𑇑𑇒𑇓𑇔𑇕𑇖𑇗𑇘𑇙
+  70384,
+  // Khudawadi 𑋰𑋱𑋲𑋳𑋴𑋵𑋶𑋷𑋸𑋹
+  70736,
+  // Newa 𑑐𑑑𑑒𑑓𑑔𑑕𑑖𑑗𑑘𑑙
+  70864,
+  // Tirhuta 𑓐𑓑𑓒𑓓𑓔𑓕𑓖𑓗𑓘𑓙
+  71248,
+  // Modi 𑙐𑙑𑙒𑙓𑙔𑙕𑙖𑙗𑙘𑙙
+  71360,
+  // Takri 𑛀𑛁𑛂𑛃𑛄𑛅𑛆𑛇𑛈𑛉
+  71472,
+  // Ahom 𑜰𑜱𑜲𑜳𑜴𑜵𑜶𑜷𑜸𑜹
+  71904,
+  // Warang Citi 𑣠𑣡𑣢𑣣𑣤𑣥𑣦𑣧𑣨𑣩
+  72016,
+  // Dives Akuru 𑥐𑥑𑥒𑥓𑥔𑥕𑥖𑥗𑥘𑥙
+  72688,
+  // Khitan Small Script 𑯰𑯱𑯲𑯳𑯴𑯵𑯶𑯷𑯸𑯹
+  72784,
+  // Bhaiksuki 𑱐𑱑𑱒𑱓𑱔𑱕𑱖𑱗𑱘𑱙
+  73040,
+  // Masaram Gondi 𑵐𑵑𑵒𑵓𑵔𑵕𑵖𑵗𑵘𑵙
+  73120,
+  // Gunjala Gondi 𑶠𑶡𑶢𑶣𑶤𑶥𑶦𑶧𑶨𑶩
+  73552,
+  // Kawi 𑽐𑽑𑽒𑽓𑽔𑽕𑽖𑽗𑽘𑽙
+  92768,
+  // Mro 𖩠𖩡𖩢𖩣𖩤𖩥𖩦𖩧𖩨𖩩
+  92864,
+  // Tangsa 𖫀𖫁𖫂𖫃𖫄𖫅𖫆𖫇𖫈𖫉
+  93008,
+  // Pahawh Hmong 𖭐𖭑𖭒𖭓𖭔𖭕𖭖𖭗𖭘𖭙
+  123200,
+  // Nyiakeng Puachue Hmong 𞅀𞅁𞅂𞅃𞅄𞅅𞅆𞅇𞅈𞅉
+  123632,
+  // Wancho 𞋰𞋱𞋲𞋳𞋴𞋵𞋶𞋷𞋸𞋹
+  124144,
+  // Nag Mundari 𞓰𞓱𞓲𞓳𞓴𞓵𞓶𞓷𞓸𞓹
+  125264,
+  // Adlam 𞥐𞥑𞥒𞥓𞥔𞥕𞥖𞥗𞥘𞥙
+  130032
+  // Segmented digit symbols 🯰🯱🯲🯳🯴🯵🯶🯷🯸🯹
+];
+var NOT_DIGIT = 255;
+var HIGH_MAP = /* @__PURE__ */ new Map();
+var LOW_MAX = 65535;
+var LOW_MIN = 1632;
+var TABLE_OFFSET = LOW_MIN;
+var TABLE_SIZE = LOW_MAX - LOW_MIN + 1;
+var TABLE = new Uint8Array(TABLE_SIZE).fill(NOT_DIGIT);
+for (const zero of SCRIPT_ZEROS) {
+  for (let d = 0; d < 10; d++) {
+    const cp = zero + d;
+    if (cp <= LOW_MAX) {
+      TABLE[cp - TABLE_OFFSET] = d;
+    } else {
+      HIGH_MAP.set(cp, d);
+    }
+  }
+}
+
+// ../../node_modules/.pnpm/anynum@1.0.1/node_modules/anynum/anynum.js
+var CHAR_0 = 48;
+var CHAR_9 = 57;
+var CHAR_MINUS = 45;
+var MINUS_SET = /* @__PURE__ */ new Set([8722, 65293, 65123]);
+function anynum(str2) {
+  if (typeof str2 !== "string") return str2;
+  const len = str2.length;
+  if (len === 0) return str2;
+  let firstHit = -1;
+  for (let i = 0; i < len; i++) {
+    const cc = str2.charCodeAt(i);
+    if (cc >= CHAR_0 && cc <= CHAR_9 || cc === CHAR_MINUS) continue;
+    if (cc < TABLE_OFFSET) {
+      if (MINUS_SET.has(cc)) {
+        firstHit = i;
+        break;
+      }
+      continue;
+    }
+    if (cc >= 55296 && cc <= 56319) {
+      if (i + 1 < len) {
+        const low = str2.charCodeAt(i + 1);
+        if (low >= 56320 && low <= 57343) {
+          const cp = 65536 + (cc - 55296 << 10) + (low - 56320);
+          if (HIGH_MAP.has(cp)) {
+            firstHit = i;
+            break;
+          }
+        }
+      }
+      continue;
+    }
+    if (TABLE[cc - TABLE_OFFSET] !== NOT_DIGIT || MINUS_SET.has(cc)) {
+      firstHit = i;
+      break;
+    }
+  }
+  if (firstHit === -1) return str2;
+  const chars = [];
+  if (firstHit > 0) chars.push(str2.slice(0, firstHit));
+  for (let i = firstHit; i < len; i++) {
+    const cc = str2.charCodeAt(i);
+    if (cc >= CHAR_0 && cc <= CHAR_9 || cc === CHAR_MINUS) {
+      chars.push(str2[i]);
+      continue;
+    }
+    if (cc < TABLE_OFFSET) {
+      chars.push(MINUS_SET.has(cc) ? "-" : str2[i]);
+      continue;
+    }
+    if (cc >= 55296 && cc <= 56319) {
+      if (i + 1 < len) {
+        const low = str2.charCodeAt(i + 1);
+        if (low >= 56320 && low <= 57343) {
+          const cp = 65536 + (cc - 55296 << 10) + (low - 56320);
+          const d2 = HIGH_MAP.get(cp);
+          if (d2 !== void 0) {
+            chars.push(String.fromCharCode(d2 + 48));
+            i++;
+            continue;
+          }
+        }
+      }
+      chars.push(str2[i]);
+      continue;
+    }
+    if (MINUS_SET.has(cc)) {
+      chars.push("-");
+      continue;
+    }
+    const d = TABLE[cc - TABLE_OFFSET];
+    chars.push(d !== NOT_DIGIT ? String.fromCharCode(d + 48) : str2[i]);
+  }
+  return chars.join("");
+}
+var anynum_default = anynum;
+
+// ../../node_modules/.pnpm/strnum@2.4.2/node_modules/strnum/strnum.js
+var hexRegex = /^[-+]?0x[a-fA-F0-9]+$/;
+var binRegex = /^0b[01]+$/;
+var octRegex = /^0o[0-7]+$/;
+var numRegex = /^([\-\+])?(0*)([0-9]*(\.[0-9]*)?)$/;
+var consider = {
+  hex: true,
+  binary: false,
+  octal: false,
+  leadingZeros: true,
+  decimalPoint: ".",
+  eNotation: true,
+  //skipLike: /regex/,
+  infinity: "original",
+  // "null", "infinity" (Infinity type), "string" ("Infinity" (the string literal))
+  unicode: false
+};
+function toNumber(str2, options = {}) {
+  options = Object.assign({}, consider, options);
+  if (!str2 || typeof str2 !== "string") return str2;
+  let trimmedStr = str2.trim();
+  if (trimmedStr.length === 0) return str2;
+  else if (options.skipLike !== void 0 && options.skipLike.test(trimmedStr)) return str2;
+  else if (trimmedStr === "0") return 0;
+  if (options.unicode) {
+    trimmedStr = anynum_default(trimmedStr);
+    if (trimmedStr === "0") return 0;
+  }
+  if (options.hex && hexRegex.test(trimmedStr)) {
+    return parse_int(trimmedStr, 16);
+  } else if (options.binary && binRegex.test(trimmedStr)) {
+    return parse_int(trimmedStr, 2);
+  } else if (options.octal && octRegex.test(trimmedStr)) {
+    return parse_int(trimmedStr, 8);
+  } else if (!isFinite(trimmedStr)) {
+    return handleInfinity(str2, Number(trimmedStr), options);
+  } else if (trimmedStr.includes("e") || trimmedStr.includes("E")) {
+    return resolveEnotation(str2, trimmedStr, options);
+  } else {
+    const match = numRegex.exec(trimmedStr);
+    if (match) {
+      const sign = match[1] || "";
+      const leadingZeros = match[2];
+      let numTrimmedByZeros = trimZeros(match[3]);
+      const decimalAdjacentToLeadingZeros = sign ? (
+        // 0., -00., 000.
+        str2[leadingZeros.length + 1] === "."
+      ) : str2[leadingZeros.length] === ".";
+      if (!options.leadingZeros && (leadingZeros.length > 1 || leadingZeros.length === 1 && !decimalAdjacentToLeadingZeros)) {
+        return str2;
+      } else {
+        const num2 = Number(trimmedStr);
+        const parsedStr = String(num2);
+        if (num2 === 0) return num2;
+        if (parsedStr.search(/[eE]/) !== -1) {
+          if (options.eNotation) return num2;
+          else return str2;
+        } else if (trimmedStr.indexOf(".") !== -1) {
+          if (parsedStr === "0") return num2;
+          else if (parsedStr === numTrimmedByZeros) return num2;
+          else if (parsedStr === `${sign}${numTrimmedByZeros}`) return num2;
+          else return str2;
+        }
+        let n = leadingZeros ? numTrimmedByZeros : trimmedStr;
+        if (leadingZeros) {
+          return n === parsedStr || sign + n === parsedStr ? num2 : str2;
+        } else {
+          return n === parsedStr || n === sign + parsedStr ? num2 : str2;
+        }
+      }
+    } else {
+      return str2;
+    }
+  }
+}
+var eNotationRegx = /^([-+])?(0*)(\d*(\.\d*)?[eE][-\+]?\d+)$/;
+function resolveEnotation(str2, trimmedStr, options) {
+  if (!options.eNotation) return str2;
+  const notation = trimmedStr.match(eNotationRegx);
+  if (notation) {
+    let sign = notation[1] || "";
+    const eChar = notation[3].indexOf("e") === -1 ? "E" : "e";
+    const leadingZeros = notation[2];
+    const eAdjacentToLeadingZeros = sign ? (
+      // 0E.
+      str2[leadingZeros.length + 1] === eChar
+    ) : str2[leadingZeros.length] === eChar;
+    if (leadingZeros.length > 1 && eAdjacentToLeadingZeros) return str2;
+    else if (leadingZeros.length === 1 && (notation[3].startsWith(`.${eChar}`) || notation[3][0] === eChar)) {
+      return Number(trimmedStr);
+    } else if (leadingZeros.length > 0) {
+      if (options.leadingZeros && !eAdjacentToLeadingZeros) {
+        trimmedStr = (notation[1] || "") + notation[3];
+        return Number(trimmedStr);
+      } else return str2;
+    } else {
+      return Number(trimmedStr);
+    }
+  } else {
+    return str2;
+  }
+}
+function trimZeros(numStr) {
+  if (numStr && numStr.indexOf(".") !== -1) {
+    let end = numStr.length;
+    while (end > 0 && numStr.charCodeAt(end - 1) === 48) end--;
+    numStr = numStr.slice(0, end);
+    if (numStr === ".") numStr = "0";
+    else if (numStr[0] === ".") numStr = "0" + numStr;
+    else if (numStr[numStr.length - 1] === ".") numStr = numStr.substring(0, numStr.length - 1);
+    return numStr;
+  }
+  return numStr;
+}
+function parse_int(numStr, base) {
+  const str2 = numStr.trim();
+  if (base === 2 || base === 8) numStr = str2.substring(2);
+  if (parseInt) return parseInt(numStr, base);
+  else if (Number.parseInt) return Number.parseInt(numStr, base);
+  else if (window && window.parseInt) return window.parseInt(numStr, base);
+  else throw new Error("parseInt, Number.parseInt, window.parseInt are not supported");
+}
+function handleInfinity(str2, num2, options) {
+  const isPositive = num2 === Infinity;
+  switch (options.infinity.toLowerCase()) {
+    case "null":
+      return null;
+    case "infinity":
+      return num2;
+    // Return Infinity or -Infinity
+    case "string":
+      return isPositive ? "Infinity" : "-Infinity";
+    case "original":
+    default:
+      return str2;
+  }
+}
+
+// ../../node_modules/.pnpm/fast-xml-parser@5.3.8/node_modules/fast-xml-parser/src/ignoreAttributes.js
+function getIgnoreAttributesFn(ignoreAttributes) {
+  if (typeof ignoreAttributes === "function") {
+    return ignoreAttributes;
+  }
+  if (Array.isArray(ignoreAttributes)) {
+    return (attrName) => {
+      for (const pattern of ignoreAttributes) {
+        if (typeof pattern === "string" && attrName === pattern) {
+          return true;
+        }
+        if (pattern instanceof RegExp && pattern.test(attrName)) {
+          return true;
+        }
+      }
+    };
+  }
+  return () => false;
+}
+
+// ../../node_modules/.pnpm/fast-xml-parser@5.3.8/node_modules/fast-xml-parser/src/xmlparser/OrderedObjParser.js
+var OrderedObjParser = class {
+  constructor(options) {
+    this.options = options;
+    this.currentNode = null;
+    this.tagsNodeStack = [];
+    this.docTypeEntities = {};
+    this.lastEntities = {
+      "apos": { regex: /&(apos|#39|#x27);/g, val: "'" },
+      "gt": { regex: /&(gt|#62|#x3E);/g, val: ">" },
+      "lt": { regex: /&(lt|#60|#x3C);/g, val: "<" },
+      "quot": { regex: /&(quot|#34|#x22);/g, val: '"' }
+    };
+    this.ampEntity = { regex: /&(amp|#38|#x26);/g, val: "&" };
+    this.htmlEntities = {
+      "space": { regex: /&(nbsp|#160);/g, val: " " },
+      // "lt" : { regex: /&(lt|#60);/g, val: "<" },
+      // "gt" : { regex: /&(gt|#62);/g, val: ">" },
+      // "amp" : { regex: /&(amp|#38);/g, val: "&" },
+      // "quot" : { regex: /&(quot|#34);/g, val: "\"" },
+      // "apos" : { regex: /&(apos|#39);/g, val: "'" },
+      "cent": { regex: /&(cent|#162);/g, val: "\xA2" },
+      "pound": { regex: /&(pound|#163);/g, val: "\xA3" },
+      "yen": { regex: /&(yen|#165);/g, val: "\xA5" },
+      "euro": { regex: /&(euro|#8364);/g, val: "\u20AC" },
+      "copyright": { regex: /&(copy|#169);/g, val: "\xA9" },
+      "reg": { regex: /&(reg|#174);/g, val: "\xAE" },
+      "inr": { regex: /&(inr|#8377);/g, val: "\u20B9" },
+      "num_dec": { regex: /&#([0-9]{1,7});/g, val: (_, str2) => fromCodePoint(str2, 10, "&#") },
+      "num_hex": { regex: /&#x([0-9a-fA-F]{1,6});/g, val: (_, str2) => fromCodePoint(str2, 16, "&#x") }
+    };
+    this.addExternalEntities = addExternalEntities;
+    this.parseXml = parseXml;
+    this.parseTextData = parseTextData;
+    this.resolveNameSpace = resolveNameSpace;
+    this.buildAttributesMap = buildAttributesMap;
+    this.isItStopNode = isItStopNode;
+    this.replaceEntitiesValue = replaceEntitiesValue;
+    this.readStopNodeData = readStopNodeData;
+    this.saveTextToParentTag = saveTextToParentTag;
+    this.addChild = addChild;
+    this.ignoreAttributesFn = getIgnoreAttributesFn(this.options.ignoreAttributes);
+    this.entityExpansionCount = 0;
+    this.currentExpandedLength = 0;
+    if (this.options.stopNodes && this.options.stopNodes.length > 0) {
+      this.stopNodesExact = /* @__PURE__ */ new Set();
+      this.stopNodesWildcard = /* @__PURE__ */ new Set();
+      for (let i = 0; i < this.options.stopNodes.length; i++) {
+        const stopNodeExp = this.options.stopNodes[i];
+        if (typeof stopNodeExp !== "string") continue;
+        if (stopNodeExp.startsWith("*.")) {
+          this.stopNodesWildcard.add(stopNodeExp.substring(2));
+        } else {
+          this.stopNodesExact.add(stopNodeExp);
+        }
+      }
+    }
+  }
+};
+function addExternalEntities(externalEntities) {
+  const entKeys = Object.keys(externalEntities);
+  for (let i = 0; i < entKeys.length; i++) {
+    const ent = entKeys[i];
+    const escaped = ent.replace(/[.\-+*:]/g, "\\.");
+    this.lastEntities[ent] = {
+      regex: new RegExp("&" + escaped + ";", "g"),
+      val: externalEntities[ent]
+    };
+  }
+}
+function parseTextData(val, tagName, jPath, dontTrim, hasAttributes, isLeafNode, escapeEntities) {
+  if (val !== void 0) {
+    if (this.options.trimValues && !dontTrim) {
+      val = val.trim();
+    }
+    if (val.length > 0) {
+      if (!escapeEntities) val = this.replaceEntitiesValue(val, tagName, jPath);
+      const newval = this.options.tagValueProcessor(tagName, val, jPath, hasAttributes, isLeafNode);
+      if (newval === null || newval === void 0) {
+        return val;
+      } else if (typeof newval !== typeof val || newval !== val) {
+        return newval;
+      } else if (this.options.trimValues) {
+        return parseValue(val, this.options.parseTagValue, this.options.numberParseOptions);
+      } else {
+        const trimmedVal = val.trim();
+        if (trimmedVal === val) {
+          return parseValue(val, this.options.parseTagValue, this.options.numberParseOptions);
+        } else {
+          return val;
+        }
+      }
+    }
+  }
+}
+function resolveNameSpace(tagname) {
+  if (this.options.removeNSPrefix) {
+    const tags = tagname.split(":");
+    const prefix = tagname.charAt(0) === "/" ? "/" : "";
+    if (tags[0] === "xmlns") {
+      return "";
+    }
+    if (tags.length === 2) {
+      tagname = prefix + tags[1];
+    }
+  }
+  return tagname;
+}
+var attrsRegx = new RegExp(`([^\\s=]+)\\s*(=\\s*(['"])([\\s\\S]*?)\\3)?`, "gm");
+function buildAttributesMap(attrStr, jPath, tagName) {
+  if (this.options.ignoreAttributes !== true && typeof attrStr === "string") {
+    const matches = getAllMatches(attrStr, attrsRegx);
+    const len = matches.length;
+    const attrs = {};
+    for (let i = 0; i < len; i++) {
+      const attrName = this.resolveNameSpace(matches[i][1]);
+      if (this.ignoreAttributesFn(attrName, jPath)) {
+        continue;
+      }
+      let oldVal = matches[i][4];
+      let aName = this.options.attributeNamePrefix + attrName;
+      if (attrName.length) {
+        if (this.options.transformAttributeName) {
+          aName = this.options.transformAttributeName(aName);
+        }
+        if (aName === "__proto__") aName = "#__proto__";
+        if (oldVal !== void 0) {
+          if (this.options.trimValues) {
+            oldVal = oldVal.trim();
+          }
+          oldVal = this.replaceEntitiesValue(oldVal, tagName, jPath);
+          const newVal = this.options.attributeValueProcessor(attrName, oldVal, jPath);
+          if (newVal === null || newVal === void 0) {
+            attrs[aName] = oldVal;
+          } else if (typeof newVal !== typeof oldVal || newVal !== oldVal) {
+            attrs[aName] = newVal;
+          } else {
+            attrs[aName] = parseValue(
+              oldVal,
+              this.options.parseAttributeValue,
+              this.options.numberParseOptions
+            );
+          }
+        } else if (this.options.allowBooleanAttributes) {
+          attrs[aName] = true;
+        }
+      }
+    }
+    if (!Object.keys(attrs).length) {
+      return;
+    }
+    if (this.options.attributesGroupName) {
+      const attrCollection = {};
+      attrCollection[this.options.attributesGroupName] = attrs;
+      return attrCollection;
+    }
+    return attrs;
+  }
+}
+var parseXml = function(xmlData) {
+  xmlData = xmlData.replace(/\r\n?/g, "\n");
+  const xmlObj = new XmlNode("!xml");
+  let currentNode = xmlObj;
+  let textData = "";
+  let jPath = "";
+  this.entityExpansionCount = 0;
+  this.currentExpandedLength = 0;
+  const docTypeReader = new DocTypeReader(this.options.processEntities);
+  for (let i = 0; i < xmlData.length; i++) {
+    const ch = xmlData[i];
+    if (ch === "<") {
+      if (xmlData[i + 1] === "/") {
+        const closeIndex = findClosingIndex(xmlData, ">", i, "Closing Tag is not closed.");
+        let tagName = xmlData.substring(i + 2, closeIndex).trim();
+        if (this.options.removeNSPrefix) {
+          const colonIndex = tagName.indexOf(":");
+          if (colonIndex !== -1) {
+            tagName = tagName.substr(colonIndex + 1);
+          }
+        }
+        if (this.options.transformTagName) {
+          tagName = this.options.transformTagName(tagName);
+        }
+        if (currentNode) {
+          textData = this.saveTextToParentTag(textData, currentNode, jPath);
+        }
+        const lastTagName = jPath.substring(jPath.lastIndexOf(".") + 1);
+        if (tagName && this.options.unpairedTags.indexOf(tagName) !== -1) {
+          throw new Error(`Unpaired tag can not be used as closing tag: </${tagName}>`);
+        }
+        let propIndex = 0;
+        if (lastTagName && this.options.unpairedTags.indexOf(lastTagName) !== -1) {
+          propIndex = jPath.lastIndexOf(".", jPath.lastIndexOf(".") - 1);
+          this.tagsNodeStack.pop();
+        } else {
+          propIndex = jPath.lastIndexOf(".");
+        }
+        jPath = jPath.substring(0, propIndex);
+        currentNode = this.tagsNodeStack.pop();
+        textData = "";
+        i = closeIndex;
+      } else if (xmlData[i + 1] === "?") {
+        let tagData = readTagExp(xmlData, i, false, "?>");
+        if (!tagData) throw new Error("Pi Tag is not closed.");
+        textData = this.saveTextToParentTag(textData, currentNode, jPath);
+        if (this.options.ignoreDeclaration && tagData.tagName === "?xml" || this.options.ignorePiTags) {
+        } else {
+          const childNode = new XmlNode(tagData.tagName);
+          childNode.add(this.options.textNodeName, "");
+          if (tagData.tagName !== tagData.tagExp && tagData.attrExpPresent) {
+            childNode[":@"] = this.buildAttributesMap(tagData.tagExp, jPath, tagData.tagName);
+          }
+          this.addChild(currentNode, childNode, jPath, i);
+        }
+        i = tagData.closeIndex + 1;
+      } else if (xmlData.substr(i + 1, 3) === "!--") {
+        const endIndex = findClosingIndex(xmlData, "-->", i + 4, "Comment is not closed.");
+        if (this.options.commentPropName) {
+          const comment = xmlData.substring(i + 4, endIndex - 2);
+          textData = this.saveTextToParentTag(textData, currentNode, jPath);
+          currentNode.add(this.options.commentPropName, [{ [this.options.textNodeName]: comment }]);
+        }
+        i = endIndex;
+      } else if (xmlData.substr(i + 1, 2) === "!D") {
+        const result = docTypeReader.readDocType(xmlData, i);
+        this.docTypeEntities = result.entities;
+        i = result.i;
+      } else if (xmlData.substr(i + 1, 2) === "![") {
+        const closeIndex = findClosingIndex(xmlData, "]]>", i, "CDATA is not closed.") - 2;
+        const tagExp = xmlData.substring(i + 9, closeIndex);
+        textData = this.saveTextToParentTag(textData, currentNode, jPath);
+        let val = this.parseTextData(tagExp, currentNode.tagname, jPath, true, false, true, true);
+        if (val == void 0) val = "";
+        if (this.options.cdataPropName) {
+          currentNode.add(this.options.cdataPropName, [{ [this.options.textNodeName]: tagExp }]);
+        } else {
+          currentNode.add(this.options.textNodeName, val);
+        }
+        i = closeIndex + 2;
+      } else {
+        let result = readTagExp(xmlData, i, this.options.removeNSPrefix);
+        let tagName = result.tagName;
+        const rawTagName = result.rawTagName;
+        let tagExp = result.tagExp;
+        let attrExpPresent = result.attrExpPresent;
+        let closeIndex = result.closeIndex;
+        if (this.options.transformTagName) {
+          const newTagName = this.options.transformTagName(tagName);
+          if (tagExp === tagName) {
+            tagExp = newTagName;
+          }
+          tagName = newTagName;
+        }
+        if (currentNode && textData) {
+          if (currentNode.tagname !== "!xml") {
+            textData = this.saveTextToParentTag(textData, currentNode, jPath, false);
+          }
+        }
+        const lastTag = currentNode;
+        if (lastTag && this.options.unpairedTags.indexOf(lastTag.tagname) !== -1) {
+          currentNode = this.tagsNodeStack.pop();
+          jPath = jPath.substring(0, jPath.lastIndexOf("."));
+        }
+        if (tagName !== xmlObj.tagname) {
+          jPath += jPath ? "." + tagName : tagName;
+        }
+        const startIndex = i;
+        if (this.isItStopNode(this.stopNodesExact, this.stopNodesWildcard, jPath, tagName)) {
+          let tagContent = "";
+          if (tagExp.length > 0 && tagExp.lastIndexOf("/") === tagExp.length - 1) {
+            if (tagName[tagName.length - 1] === "/") {
+              tagName = tagName.substr(0, tagName.length - 1);
+              jPath = jPath.substr(0, jPath.length - 1);
+              tagExp = tagName;
+            } else {
+              tagExp = tagExp.substr(0, tagExp.length - 1);
+            }
+            i = result.closeIndex;
+          } else if (this.options.unpairedTags.indexOf(tagName) !== -1) {
+            i = result.closeIndex;
+          } else {
+            const result2 = this.readStopNodeData(xmlData, rawTagName, closeIndex + 1);
+            if (!result2) throw new Error(`Unexpected end of ${rawTagName}`);
+            i = result2.i;
+            tagContent = result2.tagContent;
+          }
+          const childNode = new XmlNode(tagName);
+          if (tagName !== tagExp && attrExpPresent) {
+            childNode[":@"] = this.buildAttributesMap(tagExp, jPath, tagName);
+          }
+          if (tagContent) {
+            tagContent = this.parseTextData(tagContent, tagName, jPath, true, attrExpPresent, true, true);
+          }
+          jPath = jPath.substr(0, jPath.lastIndexOf("."));
+          childNode.add(this.options.textNodeName, tagContent);
+          this.addChild(currentNode, childNode, jPath, startIndex);
+        } else {
+          if (tagExp.length > 0 && tagExp.lastIndexOf("/") === tagExp.length - 1) {
+            if (tagName[tagName.length - 1] === "/") {
+              tagName = tagName.substr(0, tagName.length - 1);
+              jPath = jPath.substr(0, jPath.length - 1);
+              tagExp = tagName;
+            } else {
+              tagExp = tagExp.substr(0, tagExp.length - 1);
+            }
+            if (this.options.transformTagName) {
+              const newTagName = this.options.transformTagName(tagName);
+              if (tagExp === tagName) {
+                tagExp = newTagName;
+              }
+              tagName = newTagName;
+            }
+            const childNode = new XmlNode(tagName);
+            if (tagName !== tagExp && attrExpPresent) {
+              childNode[":@"] = this.buildAttributesMap(tagExp, jPath, tagName);
+            }
+            this.addChild(currentNode, childNode, jPath, startIndex);
+            jPath = jPath.substr(0, jPath.lastIndexOf("."));
+          } else {
+            const childNode = new XmlNode(tagName);
+            if (this.tagsNodeStack.length > this.options.maxNestedTags) {
+              throw new Error("Maximum nested tags exceeded");
+            }
+            this.tagsNodeStack.push(currentNode);
+            if (tagName !== tagExp && attrExpPresent) {
+              childNode[":@"] = this.buildAttributesMap(tagExp, jPath, tagName);
+            }
+            this.addChild(currentNode, childNode, jPath, startIndex);
+            currentNode = childNode;
+          }
+          textData = "";
+          i = closeIndex;
+        }
+      }
+    } else {
+      textData += xmlData[i];
+    }
+  }
+  return xmlObj.child;
+};
+function addChild(currentNode, childNode, jPath, startIndex) {
+  if (!this.options.captureMetaData) startIndex = void 0;
+  const result = this.options.updateTag(childNode.tagname, jPath, childNode[":@"]);
+  if (result === false) {
+  } else if (typeof result === "string") {
+    childNode.tagname = result;
+    currentNode.addChild(childNode, startIndex);
+  } else {
+    currentNode.addChild(childNode, startIndex);
+  }
+}
+var replaceEntitiesValue = function(val, tagName, jPath) {
+  if (val.indexOf("&") === -1) {
+    return val;
+  }
+  const entityConfig = this.options.processEntities;
+  if (!entityConfig.enabled) {
+    return val;
+  }
+  if (entityConfig.allowedTags) {
+    if (!entityConfig.allowedTags.includes(tagName)) {
+      return val;
+    }
+  }
+  if (entityConfig.tagFilter) {
+    if (!entityConfig.tagFilter(tagName, jPath)) {
+      return val;
+    }
+  }
+  for (let entityName in this.docTypeEntities) {
+    const entity = this.docTypeEntities[entityName];
+    const matches = val.match(entity.regx);
+    if (matches) {
+      this.entityExpansionCount += matches.length;
+      if (entityConfig.maxTotalExpansions && this.entityExpansionCount > entityConfig.maxTotalExpansions) {
+        throw new Error(
+          `Entity expansion limit exceeded: ${this.entityExpansionCount} > ${entityConfig.maxTotalExpansions}`
+        );
+      }
+      const lengthBefore = val.length;
+      val = val.replace(entity.regx, entity.val);
+      if (entityConfig.maxExpandedLength) {
+        this.currentExpandedLength += val.length - lengthBefore;
+        if (this.currentExpandedLength > entityConfig.maxExpandedLength) {
+          throw new Error(
+            `Total expanded content size exceeded: ${this.currentExpandedLength} > ${entityConfig.maxExpandedLength}`
+          );
+        }
+      }
+    }
+  }
+  if (val.indexOf("&") === -1) return val;
+  for (let entityName in this.lastEntities) {
+    const entity = this.lastEntities[entityName];
+    val = val.replace(entity.regex, entity.val);
+  }
+  if (val.indexOf("&") === -1) return val;
+  if (this.options.htmlEntities) {
+    for (let entityName in this.htmlEntities) {
+      const entity = this.htmlEntities[entityName];
+      val = val.replace(entity.regex, entity.val);
+    }
+  }
+  val = val.replace(this.ampEntity.regex, this.ampEntity.val);
+  return val;
+};
+function saveTextToParentTag(textData, currentNode, jPath, isLeafNode) {
+  if (textData) {
+    if (isLeafNode === void 0) isLeafNode = currentNode.child.length === 0;
+    textData = this.parseTextData(
+      textData,
+      currentNode.tagname,
+      jPath,
+      false,
+      currentNode[":@"] ? Object.keys(currentNode[":@"]).length !== 0 : false,
+      isLeafNode
+    );
+    if (textData !== void 0 && textData !== "")
+      currentNode.add(this.options.textNodeName, textData);
+    textData = "";
+  }
+  return textData;
+}
+function isItStopNode(stopNodesExact, stopNodesWildcard, jPath, currentTagName) {
+  if (stopNodesWildcard && stopNodesWildcard.has(currentTagName)) return true;
+  if (stopNodesExact && stopNodesExact.has(jPath)) return true;
+  return false;
+}
+function tagExpWithClosingIndex(xmlData, i, closingChar = ">") {
+  let attrBoundary;
+  let tagExp = "";
+  for (let index = i; index < xmlData.length; index++) {
+    let ch = xmlData[index];
+    if (attrBoundary) {
+      if (ch === attrBoundary) attrBoundary = "";
+    } else if (ch === '"' || ch === "'") {
+      attrBoundary = ch;
+    } else if (ch === closingChar[0]) {
+      if (closingChar[1]) {
+        if (xmlData[index + 1] === closingChar[1]) {
+          return {
+            data: tagExp,
+            index
+          };
+        }
+      } else {
+        return {
+          data: tagExp,
+          index
+        };
+      }
+    } else if (ch === "	") {
+      ch = " ";
+    }
+    tagExp += ch;
+  }
+}
+function findClosingIndex(xmlData, str2, i, errMsg) {
+  const closingIndex = xmlData.indexOf(str2, i);
+  if (closingIndex === -1) {
+    throw new Error(errMsg);
+  } else {
+    return closingIndex + str2.length - 1;
+  }
+}
+function readTagExp(xmlData, i, removeNSPrefix, closingChar = ">") {
+  const result = tagExpWithClosingIndex(xmlData, i + 1, closingChar);
+  if (!result) return;
+  let tagExp = result.data;
+  const closeIndex = result.index;
+  const separatorIndex = tagExp.search(/\s/);
+  let tagName = tagExp;
+  let attrExpPresent = true;
+  if (separatorIndex !== -1) {
+    tagName = tagExp.substring(0, separatorIndex);
+    tagExp = tagExp.substring(separatorIndex + 1).trimStart();
+  }
+  const rawTagName = tagName;
+  if (removeNSPrefix) {
+    const colonIndex = tagName.indexOf(":");
+    if (colonIndex !== -1) {
+      tagName = tagName.substr(colonIndex + 1);
+      attrExpPresent = tagName !== result.data.substr(colonIndex + 1);
+    }
+  }
+  return {
+    tagName,
+    tagExp,
+    closeIndex,
+    attrExpPresent,
+    rawTagName
+  };
+}
+function readStopNodeData(xmlData, tagName, i) {
+  const startIndex = i;
+  let openTagCount = 1;
+  for (; i < xmlData.length; i++) {
+    if (xmlData[i] === "<") {
+      if (xmlData[i + 1] === "/") {
+        const closeIndex = findClosingIndex(xmlData, ">", i, `${tagName} is not closed`);
+        let closeTagName = xmlData.substring(i + 2, closeIndex).trim();
+        if (closeTagName === tagName) {
+          openTagCount--;
+          if (openTagCount === 0) {
+            return {
+              tagContent: xmlData.substring(startIndex, i),
+              i: closeIndex
+            };
+          }
+        }
+        i = closeIndex;
+      } else if (xmlData[i + 1] === "?") {
+        const closeIndex = findClosingIndex(xmlData, "?>", i + 1, "StopNode is not closed.");
+        i = closeIndex;
+      } else if (xmlData.substr(i + 1, 3) === "!--") {
+        const closeIndex = findClosingIndex(xmlData, "-->", i + 3, "StopNode is not closed.");
+        i = closeIndex;
+      } else if (xmlData.substr(i + 1, 2) === "![") {
+        const closeIndex = findClosingIndex(xmlData, "]]>", i, "StopNode is not closed.") - 2;
+        i = closeIndex;
+      } else {
+        const tagData = readTagExp(xmlData, i, ">");
+        if (tagData) {
+          const openTagName = tagData && tagData.tagName;
+          if (openTagName === tagName && tagData.tagExp[tagData.tagExp.length - 1] !== "/") {
+            openTagCount++;
+          }
+          i = tagData.closeIndex;
+        }
+      }
+    }
+  }
+}
+function parseValue(val, shouldParse, options) {
+  if (shouldParse && typeof val === "string") {
+    const newval = val.trim();
+    if (newval === "true") return true;
+    else if (newval === "false") return false;
+    else return toNumber(val, options);
+  } else {
+    if (isExist(val)) {
+      return val;
+    } else {
+      return "";
+    }
+  }
+}
+function fromCodePoint(str2, base, prefix) {
+  const codePoint = Number.parseInt(str2, base);
+  if (codePoint >= 0 && codePoint <= 1114111) {
+    return String.fromCodePoint(codePoint);
+  } else {
+    return prefix + str2 + ";";
+  }
+}
+
+// ../../node_modules/.pnpm/fast-xml-parser@5.3.8/node_modules/fast-xml-parser/src/xmlparser/node2json.js
+var METADATA_SYMBOL2 = XmlNode.getMetaDataSymbol();
+function prettify(node, options) {
+  return compress(node, options);
+}
+function compress(arr, options, jPath) {
+  let text2;
+  const compressedObj = {};
+  for (let i = 0; i < arr.length; i++) {
+    const tagObj = arr[i];
+    const property = propName(tagObj);
+    let newJpath = "";
+    if (jPath === void 0) newJpath = property;
+    else newJpath = jPath + "." + property;
+    if (property === options.textNodeName) {
+      if (text2 === void 0) text2 = tagObj[property];
+      else text2 += "" + tagObj[property];
+    } else if (property === void 0) {
+      continue;
+    } else if (tagObj[property]) {
+      let val = compress(tagObj[property], options, newJpath);
+      const isLeaf = isLeafTag(val, options);
+      if (tagObj[":@"]) {
+        assignAttributes(val, tagObj[":@"], newJpath, options);
+      } else if (Object.keys(val).length === 1 && val[options.textNodeName] !== void 0 && !options.alwaysCreateTextNode) {
+        val = val[options.textNodeName];
+      } else if (Object.keys(val).length === 0) {
+        if (options.alwaysCreateTextNode) val[options.textNodeName] = "";
+        else val = "";
+      }
+      if (tagObj[METADATA_SYMBOL2] !== void 0 && typeof val === "object" && val !== null) {
+        val[METADATA_SYMBOL2] = tagObj[METADATA_SYMBOL2];
+      }
+      if (compressedObj[property] !== void 0 && Object.prototype.hasOwnProperty.call(compressedObj, property)) {
+        if (!Array.isArray(compressedObj[property])) {
+          compressedObj[property] = [compressedObj[property]];
+        }
+        compressedObj[property].push(val);
+      } else {
+        if (options.isArray(property, newJpath, isLeaf)) {
+          compressedObj[property] = [val];
+        } else {
+          compressedObj[property] = val;
+        }
+      }
+    }
+  }
+  if (typeof text2 === "string") {
+    if (text2.length > 0) compressedObj[options.textNodeName] = text2;
+  } else if (text2 !== void 0) compressedObj[options.textNodeName] = text2;
+  return compressedObj;
+}
+function propName(obj) {
+  const keys = Object.keys(obj);
+  for (let i = 0; i < keys.length; i++) {
+    const key = keys[i];
+    if (key !== ":@") return key;
+  }
+}
+function assignAttributes(obj, attrMap, jpath, options) {
+  if (attrMap) {
+    const keys = Object.keys(attrMap);
+    const len = keys.length;
+    for (let i = 0; i < len; i++) {
+      const atrrName = keys[i];
+      if (options.isArray(atrrName, jpath + "." + atrrName, true, true)) {
+        obj[atrrName] = [attrMap[atrrName]];
+      } else {
+        obj[atrrName] = attrMap[atrrName];
+      }
+    }
+  }
+}
+function isLeafTag(obj, options) {
+  const { textNodeName } = options;
+  const propCount = Object.keys(obj).length;
+  if (propCount === 0) {
+    return true;
+  }
+  if (propCount === 1 && (obj[textNodeName] || typeof obj[textNodeName] === "boolean" || obj[textNodeName] === 0)) {
+    return true;
+  }
+  return false;
+}
+
+// ../../node_modules/.pnpm/fast-xml-parser@5.3.8/node_modules/fast-xml-parser/src/xmlparser/XMLParser.js
+var XMLParser = class {
+  constructor(options) {
+    this.externalEntities = {};
+    this.options = buildOptions(options);
+  }
+  /**
+   * Parse XML dats to JS object 
+   * @param {string|Uint8Array} xmlData 
+   * @param {boolean|Object} validationOption 
+   */
+  parse(xmlData, validationOption) {
+    if (typeof xmlData !== "string" && xmlData.toString) {
+      xmlData = xmlData.toString();
+    } else if (typeof xmlData !== "string") {
+      throw new Error("XML data is accepted in String or Bytes[] form.");
+    }
+    if (validationOption) {
+      if (validationOption === true) validationOption = {};
+      const result = validate(xmlData, validationOption);
+      if (result !== true) {
+        throw Error(`${result.err.msg}:${result.err.line}:${result.err.col}`);
+      }
+    }
+    const orderedObjParser = new OrderedObjParser(this.options);
+    orderedObjParser.addExternalEntities(this.externalEntities);
+    const orderedResult = orderedObjParser.parseXml(xmlData);
+    if (this.options.preserveOrder || orderedResult === void 0) return orderedResult;
+    else return prettify(orderedResult, this.options);
+  }
+  /**
+   * Add Entity which is not by default supported by this library
+   * @param {string} key 
+   * @param {string} value 
+   */
+  addEntity(key, value) {
+    if (value.indexOf("&") !== -1) {
+      throw new Error("Entity value can't have '&'");
+    } else if (key.indexOf("&") !== -1 || key.indexOf(";") !== -1) {
+      throw new Error("An entity must be set without '&' and ';'. Eg. use '#xD' for '&#xD;'");
+    } else if (value === "&") {
+      throw new Error("An entity with value '&' is not permitted");
+    } else {
+      this.externalEntities[key] = value;
+    }
+  }
+  /**
+   * Returns a Symbol that can be used to access the metadata
+   * property on a node.
+   * 
+   * If Symbol is not available in the environment, an ordinary property is used
+   * and the name of the property is here returned.
+   * 
+   * The XMLMetaData property is only present when `captureMetaData`
+   * is true in the options.
+   */
+  static getMetaDataSymbol() {
+    return XmlNode.getMetaDataSymbol();
+  }
+};
+
+// ../../node_modules/.pnpm/fast-xml-parser@5.3.8/node_modules/fast-xml-parser/src/fxp.js
+var XMLValidator = {
+  validate
+};
+
+// ../../packages/analysis/src/cvss.ts
+function cvss3(vector) {
+  if (!/^CVSS:3\.[01]\//.test(vector)) return null;
+  const metrics = Object.fromEntries(
+    vector.split("/").slice(1).map((m) => m.split(":"))
+  );
+  const pick2 = (key, values) => values[metrics[key] ?? ""];
+  const changed = metrics.S === "C";
+  if (!["C", "U"].includes(metrics.S ?? "")) return null;
+  const av = pick2("AV", { N: 0.85, A: 0.62, L: 0.55, P: 0.2 });
+  const ac = pick2("AC", { L: 0.77, H: 0.44 });
+  const pr = pick2(
+    "PR",
+    changed ? { N: 0.85, L: 0.68, H: 0.5 } : { N: 0.85, L: 0.62, H: 0.27 }
+  );
+  const ui = pick2("UI", { N: 0.85, R: 0.62 });
+  const c = pick2("C", { H: 0.56, L: 0.22, N: 0 });
+  const i = pick2("I", { H: 0.56, L: 0.22, N: 0 });
+  const a = pick2("A", { H: 0.56, L: 0.22, N: 0 });
+  if ([av, ac, pr, ui, c, i, a].some((v) => v === void 0)) return null;
+  const iss = 1 - (1 - c) * (1 - i) * (1 - a);
+  const impact = changed ? 7.52 * (iss - 0.029) - 3.25 * (iss - 0.02) ** 15 : 6.42 * iss;
+  if (impact <= 0) return 0;
+  const exploitability = 8.22 * av * ac * pr * ui;
+  return Math.ceil(
+    Math.min((changed ? 1.08 : 1) * (impact + exploitability), 10) * 10 - 1e-8
+  ) / 10;
+}
+
+// ../../packages/analysis/src/importers.ts
+var record2 = (v) => v !== null && typeof v === "object" && !Array.isArray(v) ? v : {};
+var list = (v) => v == null ? [] : Array.isArray(v) ? v : [v];
+var str = (v) => typeof v === "string" ? v : "";
+var num = (v) => Number.isFinite(Number(v)) ? Math.max(0, Number(v)) : 0;
+function pathOf(v) {
+  const result = relativePath.safeParse(str(v).replace(/^\.\//, ""));
+  if (!result.success) throw new Error("Unsafe report path");
+  return result.data;
+}
+var fingerprint = (...parts) => createHash("sha256").update(JSON.stringify(parts)).digest("hex");
+var language = (path) => ({
+  ts: "typescript",
+  tsx: "typescript",
+  js: "javascript",
+  jsx: "javascript",
+  py: "python",
+  go: "go",
+  java: "java",
+  cs: "csharp"
+})[path.split(".").pop() ?? ""] ?? "other";
+function finding(engine, rule, path, line, key, category = "security") {
+  return {
+    engine,
+    rule: rule.slice(0, 400),
+    fingerprint: fingerprint(engine, rule, path, key),
+    matchKey: fingerprint(engine, rule, key),
+    observed: true,
+    category,
+    severity: "high",
+    language: language(path),
+    title: rule.slice(0, 400),
+    explanation: "Review the reported operation and its inputs.",
+    remediation: "Validate untrusted input and verify the fix with a regression test.",
+    location: { path: pathOf(path), ...line > 0 ? { line: Math.floor(line) } : {} },
+    flow: [],
+    state: "new"
+  };
+}
+function semgrep(json2) {
+  const root = record2(json2);
+  if (!Array.isArray(root.results) || list(root.errors).length)
+    throw new Error("Semgrep returned incomplete results");
+  return root.results.map((raw) => {
+    const r = record2(raw), extra = record2(r.extra), meta3 = record2(extra.metadata);
+    const f = finding(
+      "semgrep",
+      str(r.check_id),
+      pathOf(r.path),
+      num(record2(r.start).line),
+      fingerprint(str(extra.lines).replace(/\s+/g, " ").trim()),
+      meta3.category === "quality" ? "quality" : "security"
+    );
+    f.severity = extra.severity === "WARNING" ? "medium" : extra.severity === "INFO" ? "low" : "high";
+    return f;
+  });
+}
+function gitleaks(json2) {
+  if (!Array.isArray(json2)) throw new Error("Invalid Gitleaks report");
+  return json2.map((raw) => {
+    const r = record2(raw);
+    const f = finding(
+      "gitleaks",
+      str(r.RuleID),
+      pathOf(r.File),
+      num(r.StartLine),
+      fingerprint(str(r.Secret)),
+      "secret"
+    );
+    f.severity = "critical";
+    f.explanation = "A credential pattern was found. Its value was removed locally.";
+    f.remediation = "Remove the credential, rotate it at the provider and scan again.";
+    return f;
+  });
+}
+function osv(json2) {
+  const root = record2(json2);
+  if (!Array.isArray(root.results)) throw new Error("Invalid OSV report");
+  return root.results.flatMap((raw) => {
+    const r = record2(raw), path = pathOf(record2(r.source).path);
+    return list(r.packages).flatMap((rawPackage) => {
+      const p = record2(rawPackage), pkg = record2(p.package);
+      return list(p.vulnerabilities).map((rawV) => {
+        const v = record2(rawV), id = str(v.id), f = finding(
+          "osv",
+          id,
+          path,
+          0,
+          `${str(pkg.ecosystem)}:${str(pkg.name)}:${id}`,
+          "dependency"
+        );
+        const affected = list(v.affected).filter((a) => {
+          const target = record2(record2(a).package);
+          return !target.name || target.name === pkg.name && target.ecosystem === pkg.ecosystem;
+        });
+        const fixed = affected.flatMap(
+          (a) => list(record2(a).ranges).flatMap(
+            (r2) => list(record2(r2).events).map((e) => str(record2(e).fixed)).filter(Boolean)
+          )
+        );
+        const severity = str(record2(v.database_specific).severity).toLowerCase();
+        const scores = list(v.severity).map((s) => cvss3(str(record2(s).score))).filter((n) => n !== null);
+        const score = scores.length ? Math.max(...scores) : null;
+        f.severity = ["critical", "high", "medium", "low"].includes(severity) ? severity : score === null ? "unknown" : score >= 9 ? "critical" : score >= 7 ? "high" : score >= 4 ? "medium" : "low";
+        f.package = {
+          name: str(pkg.name),
+          version: str(pkg.version),
+          ecosystem: str(pkg.ecosystem),
+          advisory: id,
+          fixed: [...new Set(fixed)].slice(0, 50),
+          relationship: "unknown"
+        };
+        f.title = id;
+        f.explanation = "The resolved package version is affected by a published advisory.";
+        f.remediation = "Review the advisory and upgrade to a compatible fixed version; run your tests.";
+        return f;
+      });
+    });
+  });
+}
+function sarif(json2) {
+  const root = record2(json2);
+  if (root.version !== "2.1.0" || !Array.isArray(root.runs))
+    throw new Error("Expected SARIF 2.1.0");
+  return root.runs.flatMap((rawRun) => {
+    const run = record2(rawRun);
+    if (list(run.invocations).some((i) => record2(i).executionSuccessful === false))
+      throw new Error("SARIF analysis did not complete");
+    const artifactPath = (location2) => {
+      const artifact = record2(location2.artifactLocation);
+      const indexed = record2(list(run.artifacts)[Number(artifact.index)]);
+      return pathOf(artifact.uri ?? record2(indexed.location).uri);
+    };
+    return list(run.results).map((raw) => {
+      const r = record2(raw), loc = record2(record2(list(r.locations)[0]).physicalLocation);
+      const f = finding(
+        "sarif",
+        str(r.ruleId),
+        artifactPath(loc),
+        num(record2(loc.region).startLine),
+        str(record2(r.partialFingerprints)["vibecheck"]) || str(record2(r.partialFingerprints)["primaryLocationLineHash"]) || fingerprint(
+          str(r.ruleId),
+          String(num(record2(loc.region).startLine)),
+          String(num(record2(loc.region).startColumn))
+        )
+      );
+      f.severity = r.level === "warning" ? "medium" : r.level === "note" ? "low" : "high";
+      f.flow = list(r.codeFlows).flatMap(
+        (c) => list(record2(c).threadFlows).flatMap(
+          (t) => list(record2(t).locations).map((rawLoc) => {
+            const l = record2(record2(record2(rawLoc).location).physicalLocation);
+            return {
+              path: artifactPath(l),
+              line: Math.max(1, num(record2(l.region).startLine))
+            };
+          })
+        )
+      ).slice(0, 100);
+      return f;
+    });
+  });
+}
+function importSarif(json2, reportPath) {
+  const root = record2(json2);
+  if (root.version !== "2.1.0" || !Array.isArray(root.runs) || !root.runs.length)
+    throw new Error("Expected nonempty SARIF 2.1.0 runs");
+  const engines = [];
+  const findings = [];
+  for (const [index, raw] of root.runs.entries()) {
+    const run = record2(raw), driver = record2(record2(run.tool).driver);
+    const name = str(driver.name);
+    if (!name || !Array.isArray(run.results))
+      throw new Error("SARIF tool or results missing");
+    const id = "sarif:" + fingerprint(reportPath, name, String(index)).slice(0, 24);
+    const rules = fingerprint(
+      JSON.stringify(
+        list(driver.rules).map((r) => record2(r)).sort((a, b) => str(a.id).localeCompare(str(b.id)))
+      )
+    );
+    const imported = sarif({ version: "2.1.0", runs: [run] }).map((f) => ({
+      ...f,
+      engine: id,
+      fingerprint: fingerprint(id, f.fingerprint),
+      matchKey: fingerprint(id, f.matchKey ?? f.fingerprint)
+    }));
+    const files = list(run.artifacts).filter((a) => list(record2(a).roles).includes("analysisTarget")).map((a) => pathOf(record2(record2(a).location).uri));
+    engines.push({
+      id,
+      version: str(driver.semanticVersion) || str(driver.version) || "unknown",
+      rules,
+      status: "ran",
+      durationMs: 0,
+      files: [...new Set(files)],
+      excluded: [],
+      message: ""
+    });
+    findings.push(...imported);
+  }
+  return { engines, findings };
+}
+function xml(input) {
+  input = input.replace(
+    /<!DOCTYPE report PUBLIC "-\/\/JACOCO\/\/DTD Report 1\.1\/\/EN" "report\.dtd">/g,
+    ""
+  );
+  if (/<!DOCTYPE|<!ENTITY/i.test(input) || input.length > 2e7 || XMLValidator.validate(input) !== true)
+    throw new Error("Invalid XML report");
+  return record2(
+    new XMLParser({
+      ignoreAttributes: false,
+      attributeNamePrefix: "",
+      processEntities: false
+    }).parse(input)
+  );
+}
+function importCoverage(input, format) {
+  const files = /* @__PURE__ */ new Map();
+  function add(path, line, hits) {
+    if (!Number.isInteger(line) || line < 1) throw new Error("Invalid coverage line");
+    const lines = files.get(path) ?? /* @__PURE__ */ new Map();
+    lines.set(line, Math.max(hits, lines.get(line) ?? 0));
+    files.set(path, lines);
+  }
+  if (format === "lcov") {
+    let path = "";
+    for (const row of input.split(/\r?\n/)) {
+      if (row.startsWith("SF:")) path = pathOf(row.slice(3));
+      if (row.startsWith("DA:")) {
+        const [line, hits] = row.slice(3).split(",");
+        if (!path) throw new Error("LCOV record without file");
+        add(path, Number(line), num(hits));
+      }
+    }
+  } else if (format === "cobertura") {
+    const root = record2(xml(input).coverage);
+    for (const p of list(record2(root.packages).package))
+      for (const c of list(record2(record2(p).classes).class)) {
+        const item = record2(c), path = pathOf(item.filename);
+        for (const l of list(record2(item.lines).line))
+          add(path, num(record2(l).number), num(record2(l).hits));
+      }
+  } else {
+    const root = record2(xml(input).report);
+    for (const p of list(root.package))
+      for (const s of list(record2(p).sourcefile)) {
+        const source = record2(s), prefix = str(record2(p).name);
+        const path = pathOf(`${prefix ? prefix + "/" : ""}${str(source.name)}`);
+        for (const l of list(source.line))
+          add(path, num(record2(l).nr), num(record2(l).ci) > 0 ? 1 : 0);
+      }
+  }
+  if (!files.size) throw new Error("Coverage report contains no files");
+  return {
+    status: "ran",
+    files: [...files].map(([path, lines]) => ({
+      path,
+      lines: [...lines].map(([line, hits]) => ({ line, hits }))
+    }))
+  };
+}
+function importJunit(input) {
+  const tree = xml(input);
+  if (!("testsuite" in tree) && !("testsuites" in tree))
+    throw new Error("Expected JUnit testsuite or testsuites");
+  let total = 0, failed = 0, skipped = 0;
+  const failures = [];
+  function visit(node) {
+    const r = record2(node);
+    const before = { total, failed, skipped };
+    for (const test of list(r.testcase)) {
+      total++;
+      const t = record2(test);
+      if ("failure" in t || "error" in t) {
+        failed++;
+        const path = str(t.file) || str(r.file);
+        failures.push({
+          id: fingerprint(
+            str(r.name),
+            str(t.classname),
+            str(t.name),
+            path,
+            String(total)
+          ),
+          kind: "error" in t ? "error" : "failure",
+          ...path ? {
+            location: {
+              path: pathOf(path),
+              ...num(t.line) > 0 ? { line: Math.floor(num(t.line)) } : {}
+            }
+          } : {}
+        });
+      }
+      if ("skipped" in t) skipped++;
+    }
+    for (const s of list(r.testsuite)) visit(s);
+    if ("tests" in r && num(r.tests) !== total - before.total || "failures" in r && num(r.failures) + num(r.errors) !== failed - before.failed || "skipped" in r && num(r.skipped) !== skipped - before.skipped)
+      throw new Error("JUnit totals do not match test cases");
+  }
+  visit(tree.testsuites ?? tree);
+  return {
+    status: "ran",
+    total,
+    failed,
+    skipped,
+    ...failures.length ? { failures } : {}
+  };
+}
+function toAnalysisSarif(report) {
+  return {
+    $schema: "https://json.schemastore.org/sarif-2.1.0.json",
+    version: "2.1.0",
+    runs: [
+      {
+        tool: { driver: { name: "VibeCheck", version: "2" } },
+        results: report.findings.filter((f) => f.state !== "resolved").map((f) => ({
+          ruleId: f.rule,
+          level: ["critical", "high"].includes(f.severity) ? "error" : "warning",
+          message: { text: f.title },
+          partialFingerprints: { vibecheck: f.fingerprint },
+          locations: [
+            {
+              physicalLocation: {
+                artifactLocation: { uri: f.location.path },
+                ...f.location.line ? { region: { startLine: f.location.line } } : {}
+              }
+            }
+          ],
+          ...f.flow.length ? {
+            codeFlows: [
+              {
+                threadFlows: [
+                  {
+                    locations: f.flow.map((l) => ({
+                      location: {
+                        physicalLocation: {
+                          artifactLocation: { uri: l.path },
+                          region: { startLine: l.line ?? 1 }
+                        }
+                      }
+                    }))
+                  }
+                ]
+              }
+            ]
+          } : {}
+        }))
+      }
+    ]
+  };
+}
+
+// ../../packages/analysis/src/rules.ts
+var RULES_VERSION = "vibecheck-2026.1";
+var RULES = {
+  rules: [
+    {
+      id: "vc.js.dynamic-eval",
+      languages: ["javascript", "typescript"],
+      severity: "ERROR",
+      message: "Avoid evaluating dynamic code",
+      pattern: "eval($X)"
+    },
+    {
+      id: "vc.python.shell",
+      languages: ["python"],
+      severity: "ERROR",
+      message: "Avoid shell execution",
+      pattern: "subprocess.run(..., shell=True, ...)"
+    },
+    {
+      id: "vc.go.insecure-tls",
+      languages: ["go"],
+      severity: "ERROR",
+      message: "Verify TLS certificates",
+      pattern: "tls.Config{..., InsecureSkipVerify: true, ...}"
+    },
+    {
+      id: "vc.java.weak-hash",
+      languages: ["java"],
+      severity: "ERROR",
+      message: "Replace weak digest",
+      pattern: 'MessageDigest.getInstance("MD5")'
+    },
+    {
+      id: "vc.csharp.weak-hash",
+      languages: ["csharp"],
+      severity: "ERROR",
+      message: "Replace weak digest",
+      pattern: "MD5.Create()"
+    },
+    {
+      id: "vc.js.empty-catch",
+      languages: ["javascript", "typescript"],
+      severity: "WARNING",
+      metadata: { category: "quality" },
+      message: "Handle or explain the error",
+      pattern: "try { ... } catch ($E) { }"
+    }
+  ]
+};
+
+// ../../packages/analysis/src/dependencies.ts
+import { dirname, join } from "path";
+import { readFileSync } from "fs";
+function classifyDependencies(findings, root) {
+  const cache = /* @__PURE__ */ new Map();
+  for (const finding2 of findings) {
+    const pkg = finding2.package;
+    if (!pkg) continue;
+    const path = finding2.location.path;
+    if (!path.endsWith("package-lock.json") && !path.endsWith("packages.lock.json"))
+      continue;
+    let lock = cache.get(path);
+    if (!lock) {
+      try {
+        lock = record2(JSON.parse(readFileSync(join(root, path), "utf8")));
+      } catch {
+        continue;
+      }
+      cache.set(path, lock);
+    }
+    if (path.endsWith("packages.lock.json")) {
+      const entries = Object.values(record2(lock.dependencies)).map((target) => record2(record2(target)[pkg.name])).filter((entry) => str(entry.resolved) === pkg.version);
+      if (entries.some((entry) => entry.type === "Direct")) pkg.relationship = "direct";
+      else if (entries.length && entries.every((entry) => entry.type === "Transitive"))
+        pkg.relationship = "transitive";
+      continue;
+    }
+    const packages = record2(lock.packages);
+    if (!("" in packages)) continue;
+    const manifests = Object.entries(packages).filter(
+      ([name]) => !name.includes("node_modules")
+    );
+    const direct = manifests.some(([workspace, raw]) => {
+      const manifest = record2(raw);
+      const declared = [
+        "dependencies",
+        "devDependencies",
+        "optionalDependencies",
+        "peerDependencies"
+      ].some((key) => pkg.name in record2(manifest[key]));
+      if (!declared) return false;
+      let directory = workspace;
+      while (true) {
+        const resolved = record2(
+          packages[`${directory ? directory + "/" : ""}node_modules/${pkg.name}`]
+        );
+        if (str(resolved.version) === pkg.version) return true;
+        if (!directory || directory === ".") return false;
+        directory = dirname(directory);
+        if (directory === ".") directory = "";
+      }
+    });
+    pkg.relationship = direct ? "direct" : "transitive";
+  }
+}
+
+// ../../packages/analysis/src/index.ts
+var ENGINE_VERSIONS = {
+  semgrep: "1.176.0",
+  osv: "2.5.1",
+  gitleaks: "8.30.1"
+};
+var SKIP = /* @__PURE__ */ new Set([
+  ".git",
+  ".next",
+  ".vibecheck",
+  ".tools",
+  "__pycache__",
+  "node_modules",
+  "dist",
+  "build",
+  "coverage",
+  ".venv",
+  "vendor",
+  "bin",
+  "obj"
+]);
+function inventory(root) {
+  const out = [];
+  function visit(dir) {
+    for (const e of readdirSync(dir, { withFileTypes: true })) {
+      if (SKIP.has(e.name) || e.isSymbolicLink()) continue;
+      const path = join2(dir, e.name);
+      if (e.isDirectory()) visit(path);
+      else if (e.isFile()) {
+        if (out.length >= 1e5) throw new Error("Repository exceeds 100000 files");
+        out.push(relative(root, path).split(sep).join("/"));
+      }
+    }
+  }
+  visit(root);
+  return out.sort();
+}
+function localFile(root, path) {
+  const full = resolve(root, path), rel = relative(root, full);
+  if (rel.startsWith("..") || rel.startsWith(sep))
+    throw new Error("Report is outside repository");
+  let cursor = root;
+  for (const part of rel.split(sep)) {
+    cursor = join2(cursor, part);
+    if (lstatSync(cursor).isSymbolicLink())
+      throw new Error("Symlink report is not allowed");
+  }
+  if (lstatSync(full).size > 2e7) throw new Error("Report exceeds 20 MB");
+  return readFileSync2(full, "utf8");
+}
+function parseDiff(diff) {
+  const changes = [];
+  let current;
+  let previousPath;
+  for (const line of diff.split("\n")) {
+    if (line.startsWith("diff --git ")) {
+      current = void 0;
+      previousPath = void 0;
+    }
+    if (line.startsWith("rename from ")) previousPath = line.slice(12);
+    if (line.startsWith("rename to ")) {
+      current = { path: line.slice(10), previousPath, lines: [] };
+      changes.push(current);
+    }
+    if (line.startsWith("+++ b/")) {
+      if (current?.path !== line.slice(6)) {
+        current = { path: line.slice(6), lines: [] };
+        changes.push(current);
+      }
+    }
+    const match = /^@@ .* \+(\d+)(?:,(\d+))? @@/.exec(line);
+    if (match && current) {
+      const start = Number(match[1]), count = match[2] === void 0 ? 1 : Number(match[2]);
+      for (let i = 0; i < count; i++) current.lines.push(start + i);
+    }
+  }
+  return changes;
+}
+async function analyze(options) {
+  const root = resolve(options.root), files = inventory(root), reference = options.reference ?? "main", work = mkdtempSync(join2(tmpdir(), "vibecheck-analysis-"));
+  const git = async (args) => execute(
+    "git",
+    ["-c", "core.fsmonitor=false", "-c", `safe.directory=${root}`, ...args],
+    root,
+    1e4
+  );
+  const [head, branch, base] = await Promise.all([
+    git(["rev-parse", "HEAD"]),
+    git(["branch", "--show-current"]),
+    git(["merge-base", "HEAD", reference])
+  ]);
+  const sha = (s) => /^[a-f0-9]{40,64}$/.test(s.trim()) ? s.trim() : null;
+  const mergeBase = sha(base.stdout);
+  const diff = mergeBase ? await git([
+    "-c",
+    "core.quotePath=false",
+    "diff",
+    "--no-ext-diff",
+    "--no-textconv",
+    "--unified=0",
+    "--find-renames",
+    mergeBase,
+    "--"
+  ]) : null;
+  const report = {
+    version: 2,
+    projectId: options.projectId,
+    runId: randomUUID(),
+    provenance: "local-ci",
+    startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    commit: sha(head.stdout),
+    branch: branch.stdout.trim() || "detached",
+    reference,
+    mergeBase,
+    baselineRunId: options.baseline?.runId ?? null,
+    scope: fingerprint([...SKIP].join(",")),
+    engines: [],
+    findings: [],
+    coverage: { status: "missing", files: [] },
+    tests: { status: "missing", total: 0, failed: 0, skipped: 0 },
+    changes: diff?.code === 0 ? parseDiff(diff.stdout) : [],
+    policy: DEFAULT_ANALYSIS_POLICY,
+    conditions: [],
+    status: "inconclusive"
+  };
+  if (diff && diff.code !== 0) report.mergeBase = null;
+  const [untracked, dirty] = await Promise.all([
+    git(["ls-files", "--others", "--exclude-standard", "-z"]),
+    git(["status", "--porcelain", "-z"])
+  ]);
+  if (dirty.stdout.length) report.commit = null;
+  for (const path of untracked.stdout.split("\0").filter((p) => files.includes(p) && /\.(tsx?|jsx?|py|go|java|cs)$/.test(p))) {
+    const count = localFile(root, path).split("\n").length;
+    report.changes.push({ path, lines: Array.from({ length: count }, (_, i) => i + 1) });
+  }
+  try {
+    const rules = join2(work, "rules.json");
+    writeFileSync(rules, JSON.stringify(RULES));
+    const snapshot = join2(work, "repository");
+    mkdirSync(snapshot);
+    const omitted = files.filter(
+      (f) => lstatSync(join2(root, f)).size > 1e6 || /(^|\/)(\.gitleaks\.toml|\.gitleaksignore|\.semgrepignore)$/.test(f)
+    );
+    const selectedFiles = files.filter((f) => !omitted.includes(f));
+    for (const path of selectedFiles) {
+      const dest = join2(snapshot, path);
+      mkdirSync(join2(dest, ".."), { recursive: true });
+      copyFileSync(join2(root, path), dest);
+    }
+    const sourceFiles = selectedFiles.filter(
+      (f) => /\.(tsx?|jsx?|py|go|java|cs)$/.test(f)
+    );
+    const locks = selectedFiles.filter(
+      (f) => /(^|\/)(pnpm-lock.yaml|package-lock.json|yarn.lock|poetry.lock|uv.lock|requirements.txt|go.sum|pom.xml|gradle.lockfile|packages.lock.json)$/.test(
+        f
+      )
+    );
+    const outputs = [
+      {
+        id: "semgrep",
+        binary: "semgrep",
+        args: [
+          "scan",
+          "--config",
+          rules,
+          "--json",
+          "--metrics=off",
+          "--disable-version-check",
+          "--disable-nosem",
+          "--max-target-bytes",
+          "1000000",
+          ...[...SKIP].flatMap((s) => ["--exclude", s]),
+          "."
+        ],
+        files: sourceFiles,
+        parser: semgrep
+      },
+      {
+        id: "osv",
+        binary: "osv-scanner",
+        args: ["scan", "source", "--format=json", ...locks.map((f) => "--lockfile=" + f)],
+        files: locks,
+        parser: osv
+      },
+      {
+        id: "gitleaks",
+        binary: "gitleaks",
+        args: [
+          "dir",
+          ".",
+          "--no-banner",
+          "--report-format",
+          "json",
+          "--report-path",
+          join2(work, "gitleaks.json")
+        ],
+        files: selectedFiles,
+        parser: gitleaks
+      }
+    ];
+    for (const spec of outputs) {
+      const engine = {
+        id: spec.id,
+        version: ENGINE_VERSIONS[spec.id],
+        rules: spec.id === "semgrep" ? RULES_VERSION : "bundled",
+        status: "not-applicable",
+        durationMs: 0,
+        files: [],
+        excluded: omitted,
+        message: ""
+      };
+      report.engines.push(engine);
+      if (!spec.files.length) continue;
+      const started = Date.now();
+      const actual = await execute(
+        spec.binary,
+        [spec.id === "gitleaks" ? "version" : "--version"],
+        root,
+        1e4
+      );
+      if (actual.unavailable) {
+        engine.status = "unavailable";
+        engine.message = "Install the pinned engine version";
+        continue;
+      }
+      if (actual.code !== 0 || !actual.stdout.split(/\s+/).includes(ENGINE_VERSIONS[spec.id])) {
+        engine.status = "unavailable";
+        engine.message = "Engine version differs from the pinned version";
+        continue;
+      }
+      const result = await execute(spec.binary, spec.args, snapshot);
+      engine.durationMs = Date.now() - started;
+      if (![0, 1].includes(result.code)) {
+        engine.status = "failed";
+        engine.message = "Engine did not finish successfully";
+        continue;
+      }
+      try {
+        const raw = JSON.parse(
+          spec.id === "gitleaks" ? readFileSync2(join2(work, "gitleaks.json"), "utf8") : result.stdout
+        );
+        if (spec.id === "osv")
+          for (const item of list(record2(raw).results)) {
+            const source = record2(record2(item).source);
+            if (str(source.path).startsWith(snapshot + sep))
+              source.path = relative(snapshot, str(source.path)).split(sep).join("/");
+          }
+        const imported = spec.parser(raw);
+        if (spec.id === "osv") classifyDependencies(imported, snapshot);
+        report.findings.push(...imported);
+        engine.status = "ran";
+        engine.files = spec.files;
+        if (spec.id === "semgrep") {
+          const paths = record2(record2(raw).paths);
+          if (Array.isArray(paths.scanned))
+            engine.files = paths.scanned.map((p) => str(p).replace(/^\.\//, ""));
+          engine.excluded = [
+            ...omitted,
+            ...spec.files.filter((p) => !engine.files.includes(p))
+          ];
+        }
+      } catch {
+        engine.status = "failed";
+        engine.message = "Engine output was incomplete or invalid";
+      }
+    }
+    const builtin = {
+      id: "builtin",
+      version: "2",
+      rules: RULES_VERSION,
+      status: "ran",
+      durationMs: 0,
+      files: [],
+      excluded: [],
+      message: ""
+    };
+    report.engines.push(builtin);
+    try {
+      const eligible = files.filter((f) => /\.(tsx?|jsx?|sql)$/.test(f));
+      const selected = eligible.filter((f) => lstatSync(join2(root, f)).size <= 512e3);
+      builtin.files = selected;
+      builtin.excluded = eligible.filter((f) => !selected.includes(f));
+      const tracked = await git(["ls-files", "-z"]);
+      const names = new Set(tracked.code === 0 ? tracked.stdout.split("\0") : []);
+      const found = runCodeChecks(
+        {
+          files: selected.map((path) => ({ path, content: localFile(root, path) })),
+          tracked: (p) => names.has(p)
+        },
+        void 0,
+        { failOnError: true }
+      );
+      report.findings.push(
+        ...found.map((f) => {
+          const r = finding("builtin", f.checkId, f.path, 0, f.checkId);
+          r.severity = f.severity === "fatal" ? "critical" : f.severity;
+          return r;
+        })
+      );
+    } catch {
+      builtin.status = "failed";
+      builtin.message = "Built-in analysis failed";
+    }
+    for (const path of options.sarif ?? [])
+      try {
+        const imported = importSarif(JSON.parse(localFile(root, path)), path);
+        report.findings.push(...imported.findings);
+        report.engines.push(...imported.engines);
+      } catch {
+        report.engines.push({
+          id: "sarif:" + fingerprint(path).slice(0, 24),
+          version: "2.1.0",
+          rules: "unknown",
+          status: "failed",
+          durationMs: 0,
+          files: [],
+          excluded: [],
+          message: "Invalid SARIF"
+        });
+      }
+    for (const item of options.coverage ?? [])
+      try {
+        const parsed = importCoverage(localFile(root, item.path), item.format);
+        for (const file2 of parsed.files) {
+          if (item.sourceRoot)
+            file2.path = pathOf(item.sourceRoot.replace(/\/$/, "") + "/" + file2.path);
+          const existing = report.coverage.files.find((f) => f.path === file2.path);
+          if (!existing) report.coverage.files.push(file2);
+          else {
+            const lines = new Map(existing.lines.map((l) => [l.line, l.hits]));
+            for (const line of file2.lines)
+              lines.set(line.line, Math.max(lines.get(line.line) ?? 0, line.hits));
+            existing.lines = [...lines].map(([line, hits]) => ({ line, hits }));
+          }
+        }
+        if (report.coverage.status !== "failed") report.coverage.status = "ran";
+      } catch {
+        report.coverage.status = "failed";
+      }
+    for (const path of options.junit ?? [])
+      try {
+        const parsed = importJunit(localFile(root, path));
+        if (report.tests.status !== "failed") report.tests.status = "ran";
+        report.tests.total += parsed.total;
+        report.tests.failed += parsed.failed;
+        report.tests.skipped += parsed.skipped;
+        if (parsed.failures?.length)
+          report.tests.failures = [...report.tests.failures ?? [], ...parsed.failures];
+      } catch {
+        report.tests.status = "failed";
+      }
+    report.findings = [
+      ...new Map(report.findings.map((f) => [f.fingerprint, f])).values()
+    ];
+    return analysisReportSchema.parse(evaluateAnalysis(report, options.baseline ?? null));
+  } finally {
+    rmSync(work, { recursive: true, force: true });
+  }
+}
+
+// src/analyze.ts
+var configSchema = external_exports.object({
+  version: external_exports.literal(2).default(2),
+  projectId: external_exports.string().uuid(),
+  reference: external_exports.string().regex(/^[\w./-]{1,100}$/).default("main"),
+  baseline: external_exports.string().optional(),
+  coverage: external_exports.array(
+    external_exports.object({
+      path: external_exports.string(),
+      format: external_exports.enum(["lcov", "cobertura", "jacoco"]),
+      sourceRoot: external_exports.string().optional()
+    })
+  ).default([]),
+  junit: external_exports.array(external_exports.string()).default([]),
+  sarif: external_exports.array(external_exports.string()).default([])
+}).strict();
+function loadLocalEnv(root) {
+  const file2 = join3(root, ".env");
+  if (!existsSync(file2) || lstatSync2(file2).isSymbolicLink() || !lstatSync2(file2).isFile())
+    return;
+  for (const line of readFileSync3(file2, "utf8").split(/\r?\n/)) {
+    const match = line.match(/^\s*(?:export\s+)?([A-Z_][A-Z0-9_]*)\s*=\s*(.*?)\s*$/);
+    const key = match?.[1];
+    if (!match || !key || process.env[key] !== void 0) continue;
+    let value = match[2];
+    if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'"))
+      value = value.slice(1, -1);
+    process.env[key] = value;
+  }
+}
+async function analyzeCommand(argv) {
+  if (argv.includes("--help")) {
+    console.warn(
+      "vibecheck analyze [--dir <repo>] [--config vibecheck.config.json] [--publish]\n\n1. Create a project and copy its configuration from the web Settings.\n2. Install the pinned engines and configure your existing coverage/JUnit/SARIF reports.\n3. Run analyze locally; add --publish with VIBECHECK_PROJECT_TOKEN to upload results.\n\nSetup / Como usar: https://vibecheck.kinkai.cloud/projects/help\nWrites .vibecheck/analysis.{json,sarif}. No arbitrary test commands are executed.\nQuality gate exit: 0 pass, 1 regression, 2 incomplete, 3 operational error.\nPublish the reference branch first; missing comparable evidence means incomplete, not pass."
+    );
+    return 0;
+  }
+  const value = (key) => {
+    const i = argv.indexOf(key);
+    return i < 0 ? void 0 : argv[i + 1];
+  };
+  const root = resolve2(value("--dir") ?? process.cwd()), configPath = value("--config") ?? "vibecheck.config.json";
+  loadLocalEnv(root);
+  const token = process.env["VIBECHECK_PROJECT_TOKEN"], base = process.env["VIBECHECK_URL"] ?? "https://vibecheck.kinkai.cloud";
+  let config2;
+  if (existsSync(join3(root, configPath))) {
+    config2 = configSchema.parse(JSON.parse(localFile(root, configPath)));
+  } else if (argv.includes("--publish") && token) {
+    const response = await fetch(new URL("/api/projects", base), {
+      headers: { authorization: "Bearer " + token },
+      signal: AbortSignal.timeout(3e4)
+    });
+    if (!response.ok) throw new Error("Project token rejected while discovering project");
+    const project = external_exports.object({ id: external_exports.string().uuid(), reference: external_exports.string() }).parse(await response.json());
+    config2 = {
+      version: 2,
+      projectId: project.id,
+      reference: project.reference,
+      baseline: void 0,
+      coverage: [],
+      junit: [],
+      sarif: []
+    };
+    console.warn(
+      "No vibecheck.config.json found; using project settings discovered from the token."
+    );
+  } else {
+    throw new Error(
+      "Create vibecheck.config.json, or set VIBECHECK_PROJECT_TOKEN and use --publish to discover the project automatically."
+    );
+  }
+  let baseline = config2.baseline ? analysisReportSchema.parse(JSON.parse(localFile(root, config2.baseline))) : null;
+  let report = await analyze({ root, ...config2, baseline });
+  const url2 = new URL(base);
+  if (url2.protocol !== "https:" && !["localhost", "127.0.0.1"].includes(url2.hostname))
+    throw new Error("Use HTTPS for project uploads");
+  const api = async (path, method = "GET", body) => {
+    const result = await fetch(new URL("/api/projects/" + config2.projectId + path, url2), {
+      method,
+      redirect: "error",
+      headers: { authorization: "Bearer " + token, "content-type": "application/json" },
+      ...body === void 0 ? {} : { body: JSON.stringify(body) },
+      signal: AbortSignal.timeout(3e4)
+    });
+    if (!result.ok) throw new Error("Project API rejected request: " + result.status);
+    return result.json();
+  };
+  if (argv.includes("--publish")) {
+    if (!token) throw new Error("VIBECHECK_PROJECT_TOKEN is required to publish");
+    const project = external_exports.object({ policy: policySchema, reference: external_exports.string() }).parse(await api(""));
+    if (project.reference !== config2.reference)
+      throw new Error("Config reference must match the project reference branch");
+    if (!baseline && report.mergeBase) {
+      const runs = external_exports.array(external_exports.object({ id: external_exports.string().uuid() })).parse(await api("/runs?commit=" + report.mergeBase));
+      if (runs[0]) baseline = analysisReportSchema.parse(await api("/runs/" + runs[0].id));
+    }
+    report = evaluateAnalysis(
+      { ...report, baselineRunId: baseline?.runId ?? null },
+      baseline,
+      project.policy
+    );
+  }
+  const dir = join3(root, ".vibecheck");
+  if (existsSync(dir) && lstatSync2(dir).isSymbolicLink())
+    throw new Error("Unsafe artifact directory");
+  mkdirSync2(dir, { recursive: true });
+  const save = (r) => {
+    for (const name of ["analysis.json", "analysis.sarif"]) {
+      const target = join3(dir, name);
+      if (existsSync(target) && (lstatSync2(target).isSymbolicLink() || !lstatSync2(target).isFile()))
+        throw new Error("Unsafe artifact file");
+    }
+    writeFileSync2(join3(dir, "analysis.json"), JSON.stringify(r, null, 2) + "\n");
+    writeFileSync2(
+      join3(dir, "analysis.sarif"),
+      JSON.stringify(toAnalysisSarif(r), null, 2) + "\n"
+    );
+  };
+  save(report);
+  if (argv.includes("--publish")) {
+    const serialized = JSON.stringify(report), parts = serialized.match(/[\s\S]{1,100000}/g) ?? [];
+    await api("/runs", "POST", { runId: report.runId, batches: parts.length });
+    for (const [batch, payload] of parts.entries())
+      await api("/runs/" + report.runId + "/batches", "PUT", { batch, payload });
+    await api("/runs/" + report.runId + "/finalize", "POST", {});
+    report = analysisReportSchema.parse(await api("/runs/" + report.runId));
+    save(report);
+    console.warn(new URL("/projects/" + config2.projectId, url2).href);
+  }
+  console.warn(
+    `${report.status}: ${report.findings.filter((f) => f.state === "new").length} new findings`
+  );
+  for (const engine of report.engines)
+    console.warn(`${engine.id} ${engine.version}: ${engine.status}`);
+  return report.status === "passed" ? 0 : report.status === "failed" ? 1 : 2;
+}
+
+// ../../packages/checks/src/types.ts
+var SEVERITIES = ["fatal", "critical", "high", "medium", "low"];
+var NODE_KINDS = [
+  "browser",
+  "app",
+  "api",
+  "db",
+  "storage",
+  "auth",
+  "ai",
+  "payments",
+  "secrets"
+];
+var CATEGORIES = ["secrets", "data", "storage", "auth", "ai", "config"];
+
+// ../../packages/graph/src/types.ts
+var EDGE_TYPES = ["imports", "calls", "contains"];
+var MAX_NODES = 400;
+var MAX_EDGES = 800;
+var MAX_COMMUNITIES = 9;
+var MAX_FILES_PER_NODE = 12;
+var MAX_COMMUNITY_FILES = 8;
+var MAX_BYTES = 256e3;
+var MAX_LABEL = 80;
+var MAX_ID = 64;
+var MAX_PATH = 180;
+var MAX_PACKAGES = 32;
+var MAX_HINT_ROUTES = 80;
+var MAX_HINT_TABLES = 40;
+var MAX_HINT_BUCKETS = 24;
+var MAX_HINT_COLLECTIONS = 24;
+var EMPTY_DATA = { tables: [], buckets: [], collections: [] };
+var pathSchema = external_exports.string().min(1).max(MAX_PATH);
+var nodeSchema = external_exports.object({
+  id: external_exports.string().min(1).max(MAX_ID),
+  kind: external_exports.enum(NODE_KINDS),
+  label: external_exports.string().min(1).max(MAX_LABEL),
+  files: external_exports.array(pathSchema).max(MAX_FILES_PER_NODE)
+});
+var edgeSchema = external_exports.object({
+  from: external_exports.string().min(1).max(MAX_ID),
+  to: external_exports.string().min(1).max(MAX_ID),
+  type: external_exports.enum(EDGE_TYPES)
+});
+var communitySchema = external_exports.object({
+  nodeKind: external_exports.enum(NODE_KINDS),
+  label: external_exports.string().min(1).max(MAX_LABEL),
+  files: external_exports.array(pathSchema).max(MAX_COMMUNITY_FILES)
+});
+var tableName = external_exports.string().regex(/^[A-Za-z_][A-Za-z0-9_]{0,62}$/);
+var bucketName = external_exports.string().regex(/^[A-Za-z0-9][A-Za-z0-9._-]{0,62}$/);
+var dataSchema = external_exports.object({
+  tables: external_exports.array(tableName).max(MAX_HINT_TABLES),
+  buckets: external_exports.array(bucketName).max(MAX_HINT_BUCKETS),
+  collections: external_exports.array(tableName).max(MAX_HINT_COLLECTIONS)
+});
+var scanGraphSchema = external_exports.object({
+  version: external_exports.literal(1),
+  advanced: external_exports.boolean(),
+  nodes: external_exports.array(nodeSchema).max(MAX_NODES),
+  edges: external_exports.array(edgeSchema).max(MAX_EDGES),
+  communities: external_exports.array(communitySchema).max(MAX_COMMUNITIES),
+  packages: external_exports.array(external_exports.string().min(1).max(MAX_LABEL)).max(MAX_PACKAGES),
+  data: dataSchema.optional()
+});
+var EMPTY_HINTS = {
+  apiRoutes: [],
+  tableNames: [],
+  buckets: [],
+  collections: []
+};
+
+// ../../packages/graph/src/hints.ts
+function uniqueCapped(values, cap) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const value of values) {
+    if (out.length >= cap) break;
+    if (seen.has(value)) continue;
+    seen.add(value);
+    out.push(value);
+  }
+  return out;
+}
+function routeFromFile(path) {
+  const normal = path.replaceAll("\\", "/");
+  const app = /(?:^|\/)app\/(.+)\/route\.(t|j)sx?$/i.exec(normal);
+  if (app?.[1] !== void 0) {
+    const segments = app[1].split("/").filter((s) => s.length > 0 && !s.startsWith("(") && !s.startsWith("@")).map((s) => s.replace(/^\[+\.\.\.(.+)\]+$/, "*").replace(/^\[+(.+)\]+$/, ":$1"));
+    if (segments.length === 0) return "/api";
+    return `/${segments.join("/")}`;
+  }
+  const pages = /(?:^|\/)pages\/api\/(.+)\.(t|j)sx?$/i.exec(normal);
+  if (pages?.[1] !== void 0) {
+    const withoutIndex = pages[1].replace(/\/index$/i, "");
+    return `/api/${withoutIndex}`;
+  }
+  return null;
+}
+function filesFromGraph(graph) {
+  return [
+    ...graph.nodes.flatMap((n) => n.files),
+    ...graph.communities.flatMap((c) => c.files)
+  ];
+}
+function hintsFromGraph(graph) {
+  if (graph === null || graph === void 0 || !graph.advanced) return EMPTY_HINTS;
+  const routes = [];
+  for (const file2 of filesFromGraph(graph)) {
+    const route = routeFromFile(file2);
+    if (route !== null) routes.push(route);
+  }
+  routes.sort((a, b) => a.localeCompare(b));
+  const data = graph.data ?? EMPTY_DATA;
+  return {
+    apiRoutes: uniqueCapped(routes, MAX_HINT_ROUTES),
+    tableNames: uniqueCapped(data.tables, MAX_HINT_TABLES),
+    buckets: uniqueCapped(data.buckets, MAX_HINT_BUCKETS),
+    collections: uniqueCapped(data.collections, MAX_HINT_COLLECTIONS)
+  };
+}
+
+// ../../packages/graph/src/metrics.ts
+function importCycles(graph) {
+  const adjacencia = /* @__PURE__ */ new Map();
+  for (const aresta of graph.edges) {
+    if (aresta.type !== "imports") continue;
+    const vizinhos = adjacencia.get(aresta.from) ?? [];
+    vizinhos.push(aresta.to);
+    adjacencia.set(aresta.from, vizinhos);
+  }
+  const indice = /* @__PURE__ */ new Map();
+  const lowlink = /* @__PURE__ */ new Map();
+  const naPilha = /* @__PURE__ */ new Set();
+  const pilha = [];
+  let proximo = 0;
+  let ciclos = 0;
+  for (const raiz of graph.nodes.map((n) => n.id)) {
+    if (indice.has(raiz)) continue;
+    const quadros = [{ no: raiz, vizinho: 0 }];
+    indice.set(raiz, proximo);
+    lowlink.set(raiz, proximo);
+    proximo += 1;
+    pilha.push(raiz);
+    naPilha.add(raiz);
+    while (quadros.length > 0) {
+      const quadro = quadros[quadros.length - 1];
+      if (quadro === void 0) break;
+      const vizinhos = adjacencia.get(quadro.no) ?? [];
+      if (quadro.vizinho < vizinhos.length) {
+        const vizinho = vizinhos[quadro.vizinho];
+        quadro.vizinho += 1;
+        if (!indice.has(vizinho)) {
+          indice.set(vizinho, proximo);
+          lowlink.set(vizinho, proximo);
+          proximo += 1;
+          pilha.push(vizinho);
+          naPilha.add(vizinho);
+          quadros.push({ no: vizinho, vizinho: 0 });
+        } else if (naPilha.has(vizinho)) {
+          lowlink.set(
+            quadro.no,
+            Math.min(lowlink.get(quadro.no) ?? 0, indice.get(vizinho) ?? 0)
+          );
+        }
+        continue;
+      }
+      quadros.pop();
+      const pai = quadros[quadros.length - 1];
+      if (pai !== void 0) {
+        lowlink.set(
+          pai.no,
+          Math.min(lowlink.get(pai.no) ?? 0, lowlink.get(quadro.no) ?? 0)
+        );
+      }
+      if (lowlink.get(quadro.no) === indice.get(quadro.no)) {
+        let tamanho = 0;
+        let atual;
+        do {
+          atual = pilha.pop();
+          if (atual === void 0) break;
+          naPilha.delete(atual);
+          tamanho += 1;
+        } while (atual !== quadro.no);
+        if (tamanho > 1) ciclos += 1;
+      }
+    }
+  }
+  return ciclos;
+}
+function graphMetrics(graph) {
+  return {
+    nodes: graph.nodes.length,
+    edges: graph.edges.length,
+    routes: hintsFromGraph(graph).apiRoutes.length,
+    packages: graph.packages.length,
+    cycles: importCycles(graph)
+  };
+}
+
+// ../../packages/graph/src/identifiers.ts
+var FROM_CALL = /([A-Za-z_$][\w$]*)\s*\.\s*from\(\s*["'`]([A-Za-z0-9._-]{1,63})["'`]\s*\)/g;
+var NOT_A_DATABASE = /* @__PURE__ */ new Set([
+  "array",
+  "buffer",
+  "object",
+  "string",
+  "number",
+  "date",
   "map",
   "set",
   "promise",
@@ -14837,7 +18132,7 @@ var KIND_LABEL = {
   payments: "payments",
   secrets: "security"
 };
-var RULES = [
+var RULES2 = [
   {
     kind: "api",
     test: /app\/.+\/route\.(t|j)sx?\b|pages\/api\//i
@@ -14854,16 +18149,16 @@ var RULES = [
   { kind: "browser", test: /\b(middleware\.(t|j)s|proxy\.(t|j)s)\b/i }
 ];
 function mapKind(signal) {
-  const text = `${signal.label} ${signal.files.join(" ")}`;
-  for (const rule of RULES) {
-    if (rule.test.test(text)) return rule.kind;
+  const text2 = `${signal.label} ${signal.files.join(" ")}`;
+  for (const rule of RULES2) {
+    if (rule.test.test(text2)) return rule.kind;
   }
   return "app";
 }
 
 // ../../packages/graph/src/packages.ts
 var SECRETISH2 = /(sk_live_|sk_test_|rk_live_|pk_live_|pk_test_|sb_secret_|eyJ[A-Za-z0-9_-]{20,}|gsk_[A-Za-z0-9]|sk-ant-|sk-proj-|sk-or-v1-)/i;
-var RULES2 = [
+var RULES3 = [
   { id: "next", test: /^next(?:\/|$)/ },
   { id: "react", test: /^react(?:-dom)?(?:\/|$)/ },
   { id: "vue", test: /^vue(?:\/|$)/ },
@@ -14903,7 +18198,7 @@ function packageId(spec) {
   if (cleaned.length === 0 || cleaned.startsWith(".") || cleaned.startsWith("/"))
     return null;
   if (cleaned.startsWith("node:") || cleaned.startsWith("#")) return null;
-  for (const rule of RULES2) {
+  for (const rule of RULES3) {
     if (rule.test.test(cleaned)) return rule.id;
   }
   return null;
@@ -15046,9 +18341,9 @@ function firstExport(value) {
 }
 function nodesFromDump(dump) {
   const raw = dump["nodes"] ?? dump["nos"];
-  const list = Array.isArray(raw) ? raw : isRecord(raw) ? Object.entries(raw).map(([id, n]) => isRecord(n) ? { id, ...n } : { id }) : [];
+  const list2 = Array.isArray(raw) ? raw : isRecord(raw) ? Object.entries(raw).map(([id, n]) => isRecord(n) ? { id, ...n } : { id }) : [];
   const nodes = [];
-  for (const [i, item] of list.entries()) {
+  for (const [i, item] of list2.entries()) {
     if (!isRecord(item)) continue;
     const files = filesFrom(
       item["files"] ?? item["files"] ?? item["source_file"] ?? item["sourceFile"] ?? item["file"] ?? item["path"]
@@ -15070,10 +18365,10 @@ function nodesFromDump(dump) {
 }
 function edgesFromDump(dump, ids) {
   const raw = dump["edges"] ?? dump["edges"];
-  const list = Array.isArray(raw) ? raw : [];
+  const list2 = Array.isArray(raw) ? raw : [];
   const out = [];
   const seen = /* @__PURE__ */ new Set();
-  for (const item of list) {
+  for (const item of list2) {
     if (!isRecord(item)) continue;
     const from = idFrom(item["from"] ?? item["de"] ?? item["source"], "");
     const to = idFrom(item["to"] ?? item["para"] ?? item["target"], "");
@@ -15386,19 +18681,19 @@ var sequencedScanEventSchema = external_exports.intersection(
 );
 
 // src/consent.ts
-import { chmodSync as chmodSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
+import { chmodSync as chmodSync2, mkdirSync as mkdirSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
 import { createInterface } from "readline/promises";
-import { join as join2, resolve } from "path";
+import { join as join5, resolve as resolve3 } from "path";
 
 // src/token.ts
-import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { chmodSync, mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
 import { homedir } from "os";
-import { join } from "path";
+import { join as join4 } from "path";
 function dirConfig() {
-  return join(homedir(), ".config", "vibecheck");
+  return join4(homedir(), ".config", "vibecheck");
 }
 function caminhoToken() {
-  return join(dirConfig(), "token");
+  return join4(dirConfig(), "token");
 }
 function lerToken() {
   const env = process.env["VIBECHECK_TOKEN"];
@@ -15407,7 +18702,7 @@ function lerToken() {
     return { token: env, host: hostEnv ?? "" };
   }
   try {
-    const bruto = readFileSync(caminhoToken(), "utf8").trim();
+    const bruto = readFileSync4(caminhoToken(), "utf8").trim();
     const [token, host] = bruto.split("\n");
     if (token === void 0 || token.length === 0) return null;
     return { token, host: host ?? "" };
@@ -15417,9 +18712,9 @@ function lerToken() {
 }
 function gravarToken(token, host) {
   const dir = dirConfig();
-  mkdirSync(dir, { recursive: true, mode: 448 });
+  mkdirSync3(dir, { recursive: true, mode: 448 });
   const destino = caminhoToken();
-  writeFileSync(destino, `${token}
+  writeFileSync3(destino, `${token}
 ${host}
 `, { encoding: "utf8", mode: 384 });
   chmodSync(destino, 384);
@@ -15429,14 +18724,14 @@ ${host}
 var ARQUIVO = "code-consent.json";
 var ENV_CI_ALLOW = "VIBECHECK_ALLOW_CODE_SCAN";
 function caminho(deps) {
-  return join2((deps.configDir ?? dirConfig)(), ARQUIVO);
+  return join5((deps.configDir ?? dirConfig)(), ARQUIVO);
 }
 function repoKey(dir) {
-  return resolve(dir);
+  return resolve3(dir);
 }
 function listarConsentimentos(deps = {}) {
   try {
-    const bruto = JSON.parse(readFileSync2(caminho(deps), "utf8"));
+    const bruto = JSON.parse(readFileSync5(caminho(deps), "utf8"));
     if (!Array.isArray(bruto)) return [];
     return bruto.filter(
       (e) => e !== null && typeof e === "object" && typeof e.repo === "string" && typeof e.acceptedAt === "string"
@@ -15447,9 +18742,9 @@ function listarConsentimentos(deps = {}) {
 }
 function gravar(entradas, deps) {
   const dir = (deps.configDir ?? dirConfig)();
-  mkdirSync2(dir, { recursive: true, mode: 448 });
-  const arquivo = join2(dir, ARQUIVO);
-  writeFileSync2(arquivo, `${JSON.stringify(entradas, null, 2)}
+  mkdirSync4(dir, { recursive: true, mode: 448 });
+  const arquivo = join5(dir, ARQUIVO);
+  writeFileSync4(arquivo, `${JSON.stringify(entradas, null, 2)}
 `, { mode: 384 });
   chmodSync2(arquivo, 384);
 }
@@ -15547,227 +18842,26 @@ async function followScan(base, scanId, shareToken, options = {}) {
 }
 
 // src/gate.ts
-import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync3 } from "fs";
-import { join as join3 } from "path";
-
-// ../../packages/checks/src/code/types.ts
-var API_ROUTE_FILE = /(^|\/)(app\/.*\/route\.(ts|js|tsx|jsx)|pages\/api\/.+\.(ts|js))$/;
-function isApiRoute(path) {
-  return API_ROUTE_FILE.test(path);
-}
-
-// ../../packages/checks/src/code/checks.ts
-var MIGRATION_FILE = /(^|\/)supabase\/migrations\/[^/]+\.sql$/;
-var CREATE_TABLE = /create\s+table\s+(?:if\s+not\s+exists\s+)?(?:"?[a-z_][a-z0-9_]*"?\.)?"?([a-z_][a-z0-9_]*)"?/gi;
-var ENABLE_RLS = /alter\s+table\s+(?:if\s+exists\s+)?(?:only\s+)?(?:"?[a-z_][a-z0-9_]*"?\.)?"?([a-z_][a-z0-9_]*)"?\s+enable\s+row\s+level\s+security/gi;
-function all(pattern, text) {
-  const out = [];
-  for (const m of text.matchAll(pattern)) {
-    const nome = m[1];
-    if (nome !== void 0) out.push(nome.toLowerCase());
-  }
-  return out;
-}
-function isClientFile(file2) {
-  if (/^\s*['"]use client['"]/.test(file2.content)) return true;
-  if (/\.client\.(tsx|jsx|ts|js)$/.test(file2.path)) return true;
-  return /(^|\/)pages\/(?!api\/).+\.(tsx|jsx|ts|js)$/.test(file2.path);
-}
-var TOUCHES_DB = /\b(supabase\.(?:from|rpc|storage)\b|prisma\.\w+\.\w+\(|drizzle\(|\bdb\.(?:select|insert|update|delete|query|execute|from)\(|\.from\(['"]|sql`|pool\.query\(|knex\(|mongoose\.|\.collection\(['"])/;
-var HAS_AUTH = /\b(getSession|getUser|auth\(\)|currentUser|requireAuth|verifyToken|verifyJwt|jwtVerify|authorization|Bearer|withAuth|clerk|next-auth|getServerSession|session)\b/i;
-var PUBLIC_ROUTE = /(^|\/)(webhooks?|health|healthz|ping|status|robots|sitemap|og|opengraph|cron)(\/|\.|$)/i;
-var AI_SDK = /from\s+['"](openai|@anthropic-ai\/sdk|ai|@ai-sdk\/[^'"]+|@google\/generative-ai|groq-sdk|cohere-ai|@mistralai\/mistralai)['"]/;
-var HAS_LIMITER = /\b(ratelimit|rateLimit|Ratelimit|upstash|limiter|throttle|slidingWindow|tokenBucket)\b/;
-var STRIPE_IMPORT = /from\s+['"]stripe['"]/;
-var WEBHOOK_PATH = /webhook/i;
-var SIGNATURE_CHECK = /constructEvent(?:Async)?\(|stripe-signature/;
-var SERVICE_ROLE_REF = /\b(SUPABASE_SERVICE_ROLE_KEY|SERVICE_ROLE_KEY|sb_secret_[A-Za-z0-9_]+|NEXT_PUBLIC_[A-Z0-9_]*(?:SECRET|SERVICE_ROLE|PRIVATE)[A-Z0-9_]*)\b/;
-var ENV_FILES = [
-  ".env",
-  ".env.local",
-  ".env.production",
-  ".env.development",
-  ".env.staging"
-];
-var codeRlsMissing = {
-  id: "code-rls-missing",
-  source: "code",
-  category: "data",
-  severity: "critical",
-  title: "Table created without row level security",
-  impact: "A migration creates a table and never turns on row level security for it. Once it has rows, anyone with the public key can read them \u2014 this is the hole the RLS check lights up from outside.",
-  howToDetect: (ctx) => {
-    const migrations = ctx.files.filter((f) => MIGRATION_FILE.test(f.path));
-    if (migrations.length === 0) return [];
-    const comRls = /* @__PURE__ */ new Set();
-    for (const m of migrations) for (const t of all(ENABLE_RLS, m.content)) comRls.add(t);
-    const out = [];
-    const vistas = /* @__PURE__ */ new Set();
-    for (const m of migrations) {
-      for (const tabela of all(CREATE_TABLE, m.content)) {
-        if (comRls.has(tabela) || vistas.has(tabela)) continue;
-        vistas.add(tabela);
-        out.push({
-          path: m.path,
-          reason: `table \`${tabela}\` is created without enable row level security`
-        });
-      }
-    }
-    return out;
-  },
-  fixPrompt: (a) => `In your code, ${a.reason} (${a.path}).
-
-We do not know the columns or who should read what. We cannot write the policy from here.
-
-Good practice: every table starts with row level security on, in the same migration that creates it. Then one policy per real access: a person reads their own rows; a public catalog, if it exists, is a deliberate read policy; writes always go through a session. Do this in a new migration, never by editing one that already ran.
-
-After, deploy and read the table with the public key and no session \u2014 it must answer empty or denied.`
-};
-var codeServiceRoleInClient = {
-  id: "code-service-role-in-client",
-  source: "code",
-  category: "secrets",
-  severity: "fatal",
-  title: "Service key referenced in client code",
-  impact: "A file that runs in the browser mentions the Supabase service key or a NEXT_PUBLIC_ secret. Whatever the bundler inlines there ships to every visitor \u2014 this is the fatal finding from outside, one build away.",
-  howToDetect: (ctx) => ctx.files.filter(isClientFile).filter((f) => SERVICE_ROLE_REF.test(f.content)).map((f) => ({
-    path: f.path,
-    reason: "client-side file references a service or secret key"
-  })),
-  fixPrompt: (a) => `In your code, a client-side file references a service or secret key (${a.path}).
-
-We do not have the value and we do not want it. The problem is the place, not the string.
-
-Good practice: the service key lives only in server code \u2014 a route handler, a server action, an edge function \u2014 read from the environment without the NEXT_PUBLIC_ prefix. The browser talks to your API; your API talks to the database. Remove the reference from the client file and, if the key was ever bundled, rotate it in the dashboard.
-
-After, search the built bundle for the key prefix and confirm it is gone.`
-};
-var codeRouteWithoutAuth = {
-  id: "code-route-without-auth",
-  source: "code",
-  category: "auth",
-  severity: "high",
-  title: "API route touches data without a session check",
-  impact: "An API route reads or writes the database and nothing in it checks who is asking. If the middleware does not cover it, anyone can call it \u2014 this is what api-route-noauth lights up from outside.",
-  howToDetect: (ctx) => ctx.files.filter((f) => isApiRoute(f.path) && !PUBLIC_ROUTE.test(f.path)).filter((f) => TOUCHES_DB.test(f.content) && !HAS_AUTH.test(f.content)).map((f) => ({
-    path: f.path,
-    reason: "route reads or writes data with no session check in the file"
-  })),
-  fixPrompt: (a) => `In your code, a route reads or writes data with no session check in the file (${a.path}).
-
-We cannot see your middleware. If it already protects this path, mark the finding as known.
-
-Good practice: the route resolves the session first and answers 401 before touching data; what it reads or writes is scoped to that user. A public route is public on purpose, with a comment saying so, and never exposes rows that belong to someone.
-
-After, call the route from a logged-out client and confirm it answers 401 or 403.`
-};
-var codeEnvCommitted = {
-  id: "code-env-committed",
-  source: "code",
-  category: "secrets",
-  severity: "critical",
-  title: ".env file tracked by git",
-  impact: "An environment file is committed to the repository. Every clone, fork, CI log and AI tool that reads the repo has the secrets in it. Even after deleting it, the history keeps the values.",
-  // Só o nome. O conteúdo nunca é lido — é o único check que não recebe
-  // `content`, e é assim de propósito.
-  howToDetect: (ctx) => ENV_FILES.filter((nome) => ctx.tracked(nome)).map((nome) => ({
-    path: nome,
-    reason: `${nome} is tracked by git`
-  })),
-  fixPrompt: (a) => `In your code, ${a.reason}.
-
-We did not read it. We only saw that git tracks it.
-
-Good practice: environment files stay out of version control \u2014 add them to .gitignore, remove them from the index, and keep a committed .env.example with the variable names and no values. Every secret that was ever in the file is compromised: rotate each one in its provider.
-
-After, run git ls-files and confirm no .env file is listed.`
-};
-var codeAiRouteWithoutLimit = {
-  id: "code-ai-route-without-limit",
-  source: "code",
-  category: "ai",
-  severity: "high",
-  title: "AI route with no rate limit",
-  impact: "A route calls an LLM provider and nothing in it limits how often. A loop from one client turns your provider account into an open bill \u2014 this is ai-proxy-open, seen from inside.",
-  howToDetect: (ctx) => ctx.files.filter((f) => isApiRoute(f.path)).filter((f) => AI_SDK.test(f.content) && !HAS_LIMITER.test(f.content)).map((f) => ({
-    path: f.path,
-    reason: "route calls an AI provider with no rate limit in the file"
-  })),
-  fixPrompt: (a) => `In your code, a route calls an AI provider with no rate limit in the file (${a.path}).
-
-We cannot see limits applied elsewhere. If your gateway already throttles this path, mark the finding as known.
-
-Good practice: the route requires a session, then applies a per-user limit (so many calls per minute, so many tokens per day) before calling the provider, and answers 429 when it is hit. Cost caps at the provider are the second net, not the first.
-
-After, call the route in a loop from one client and confirm it starts answering 429.`
-};
-var codeWebhookUnsigned = {
-  id: "code-webhook-unsigned",
-  source: "code",
-  category: "config",
-  severity: "high",
-  title: "Stripe webhook without signature verification",
-  impact: 'A webhook route imports Stripe and never verifies the event signature. Anyone can POST a fake "payment succeeded" and your app will believe it \u2014 the one check we refuse to run from outside, because proving it would mean doing exactly that.',
-  howToDetect: (ctx) => ctx.files.filter((f) => isApiRoute(f.path) && WEBHOOK_PATH.test(f.path)).filter((f) => STRIPE_IMPORT.test(f.content) && !SIGNATURE_CHECK.test(f.content)).map((f) => ({
-    path: f.path,
-    reason: "Stripe webhook route never verifies the event signature"
-  })),
-  fixPrompt: (a) => `In your code, a Stripe webhook route never verifies the event signature (${a.path}).
-
-We cannot see the secret and do not want it.
-
-Good practice: the route reads the raw body and the stripe-signature header, builds the event with the webhook secret from the environment, and rejects anything that fails. Only the verified event drives state. Each event id is processed once.
-
-After, POST a fabricated event to the route and confirm it answers 400.`
-};
-var CODE_CHECKS = [
-  codeRlsMissing,
-  codeServiceRoleInClient,
-  codeRouteWithoutAuth,
-  codeEnvCommitted,
-  codeAiRouteWithoutLimit,
-  codeWebhookUnsigned
-];
-function runCodeChecks(ctx, catalog = CODE_CHECKS) {
-  const out = [];
-  for (const check2 of catalog) {
-    let advisories = [];
-    try {
-      advisories = check2.howToDetect(ctx);
-    } catch {
-      advisories = [];
-    }
-    for (const a of advisories) {
-      out.push({
-        checkId: check2.id,
-        severity: check2.severity,
-        path: a.path,
-        reason: a.reason
-      });
-    }
-  }
-  return out;
-}
-
-// src/gate.ts
+import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync5 } from "fs";
+import { join as join6 } from "path";
 var GATE_DIR = ".vibecheck";
 var GATE_JSON = "quality-gate.json";
 var GATE_SARIF = "quality-gate.sarif";
-function escreverArtefatos(dir, report, sarif, deps) {
+function escreverArtefatos(dir, report, sarif2, deps) {
   deps.writeArtifact(
-    join3(dir, GATE_DIR, GATE_JSON),
+    join6(dir, GATE_DIR, GATE_JSON),
     `${JSON.stringify(report, null, 2)}
 `
   );
   deps.writeArtifact(
-    join3(dir, GATE_DIR, GATE_SARIF),
-    `${JSON.stringify(sarif, null, 2)}
+    join6(dir, GATE_DIR, GATE_SARIF),
+    `${JSON.stringify(sarif2, null, 2)}
 `
   );
 }
 function gravarNoDisco(caminho2, conteudo) {
-  mkdirSync3(join3(caminho2, ".."), { recursive: true });
-  writeFileSync3(caminho2, conteudo);
+  mkdirSync5(join6(caminho2, ".."), { recursive: true });
+  writeFileSync5(caminho2, conteudo);
 }
 async function rodarHttp(input, grafo, deps) {
   const headers = {
@@ -15845,7 +18939,9 @@ async function runGate(input, deps) {
   const grafo = await deps.extractGraph(input.dir);
   const metrics = grafo === null ? null : graphMetrics(grafo);
   const repo = deps.readRepo(input.dir);
-  const codeIssues = runCodeChecks(repo).map((i) => ({
+  const codeIssues = runCodeChecks(repo, void 0, {
+    failOnError: true
+  }).map((i) => ({
     checkId: i.checkId,
     severity: i.severity,
     path: i.path,
@@ -15897,31 +18993,31 @@ async function enviarGate(scanId, report, input, deps) {
 }
 
 // src/graphify.ts
-import { spawn } from "child_process";
+import { spawn as spawn2 } from "child_process";
 import { readFile } from "fs/promises";
-import { join as join4 } from "path";
+import { join as join7 } from "path";
 async function tentarGraphify(raiz) {
-  const json2 = join4(raiz, "graphify-out", "graph.json");
+  const json2 = join7(raiz, "graphify-out", "graph.json");
   try {
     return JSON.parse(await readFile(json2, "utf8"));
   } catch {
   }
-  const ok = await new Promise((resolve2) => {
-    const child = spawn("graphify", [".", "--no-viz"], {
+  const ok = await new Promise((resolve4) => {
+    const child = spawn2("graphify", [".", "--no-viz"], {
       cwd: raiz,
       stdio: "ignore"
     });
     const timer = setTimeout(() => {
       child.kill();
-      resolve2(false);
+      resolve4(false);
     }, 2e4);
     child.on("exit", (code) => {
       clearTimeout(timer);
-      resolve2(code === 0);
+      resolve4(code === 0);
     });
     child.on("error", () => {
       clearTimeout(timer);
-      resolve2(false);
+      resolve4(false);
     });
   });
   if (!ok) return null;
@@ -15933,7 +19029,7 @@ async function tentarGraphify(raiz) {
 }
 
 // src/login.ts
-import { spawn as spawn2 } from "child_process";
+import { spawn as spawn3 } from "child_process";
 function urlBase() {
   return (process.env["VIBECHECK_URL"] ?? "https://vibecheck.kinkai.cloud").replace(
     /\/$/,
@@ -15953,12 +19049,12 @@ function comandosAbrirBrowser(url2, platform = process.platform, env = process.e
   return [["xdg-open", [url2]]];
 }
 function tentarSpawn(cmd, args) {
-  return new Promise((resolve2) => {
-    const child = spawn2(cmd, args, { stdio: "ignore", detached: true });
-    child.once("error", () => resolve2(false));
+  return new Promise((resolve4) => {
+    const child = spawn3(cmd, args, { stdio: "ignore", detached: true });
+    child.once("error", () => resolve4(false));
     child.once("spawn", () => {
       child.unref();
-      resolve2(true);
+      resolve4(true);
     });
   });
 }
@@ -16018,8 +19114,8 @@ async function loginDevice(ci, options = {}) {
 
 // src/repo.ts
 import { execFileSync } from "child_process";
-import { lstatSync, readdirSync, readFileSync as readFileSync3 } from "fs";
-import { join as join5, relative } from "path";
+import { lstatSync as lstatSync3, readdirSync as readdirSync2, readFileSync as readFileSync6 } from "fs";
+import { join as join8, relative as relative2 } from "path";
 var MAX_FILES = 800;
 var MAX_BYTES2 = 64e3;
 var MAX_SQL_BYTES = 512e3;
@@ -16053,23 +19149,23 @@ function walk(dir, raiz, out) {
   if (out.length >= MAX_FILES) return;
   let entradas;
   try {
-    entradas = readdirSync(dir);
+    entradas = readdirSync2(dir);
   } catch {
     return;
   }
   for (const nome of entradas) {
     if (out.length >= MAX_FILES) return;
     if (SKIP_DIR.has(nome) || nome.startsWith(".") && nome !== ".env") continue;
-    const caminho2 = join5(dir, nome);
+    const caminho2 = join8(dir, nome);
     let st;
     try {
-      st = lstatSync(caminho2);
+      st = lstatSync3(caminho2);
     } catch {
       continue;
     }
     if (st.isSymbolicLink()) continue;
     if (st.isDirectory()) walk(caminho2, raiz, out);
-    else if (SOURCE.test(nome)) out.push(relative(raiz, caminho2).split("\\").join("/"));
+    else if (SOURCE.test(nome)) out.push(relative2(raiz, caminho2).split("\\").join("/"));
   }
 }
 function readCodeContext(dir) {
@@ -16079,9 +19175,9 @@ function readCodeContext(dir) {
   const files = [];
   for (const path of caminhos) {
     try {
-      const st = lstatSync(join5(dir, path));
+      const st = lstatSync3(join8(dir, path));
       if (st.size > (path.endsWith(".sql") ? MAX_SQL_BYTES : MAX_BYTES2)) continue;
-      files.push({ path, content: readFileSync3(join5(dir, path), "utf8") });
+      files.push({ path, content: readFileSync6(join8(dir, path), "utf8") });
     } catch {
     }
   }
@@ -16107,7 +19203,7 @@ function regras(issues) {
   for (const issue2 of issues) {
     if (!vistos.has(issue2.checkId)) vistos.set(issue2.checkId, issue2.reason);
   }
-  return [...vistos].map(([id, text]) => ({ id, shortDescription: { text } }));
+  return [...vistos].map(([id, text2]) => ({ id, shortDescription: { text: text2 } }));
 }
 function toSarif(report, version2) {
   return {
@@ -16135,8 +19231,8 @@ function toSarif(report, version2) {
 }
 
 // src/walker.ts
-import { lstatSync as lstatSync2, readdirSync as readdirSync2, readFileSync as readFileSync4 } from "fs";
-import { join as join6, relative as relative2 } from "path";
+import { lstatSync as lstatSync4, readdirSync as readdirSync3, readFileSync as readFileSync7 } from "fs";
+import { join as join9, relative as relative3 } from "path";
 var IGNORAR = /* @__PURE__ */ new Set([
   "node_modules",
   ".git",
@@ -16171,16 +19267,16 @@ var HANDLERS = /* @__PURE__ */ new Set(["GET", "POST", "PUT", "PATCH", "DELETE",
 function listar(raiz, dir, acc) {
   let nomes;
   try {
-    nomes = readdirSync2(dir);
+    nomes = readdirSync3(dir);
   } catch {
     return;
   }
   for (const nome of nomes) {
     if (IGNORAR.has(nome) || nome.startsWith(".")) continue;
-    const cheio = join6(dir, nome);
+    const cheio = join9(dir, nome);
     let stat;
     try {
-      stat = lstatSync2(cheio);
+      stat = lstatSync4(cheio);
     } catch {
       continue;
     }
@@ -16194,7 +19290,7 @@ function listar(raiz, dir, acc) {
   }
 }
 function posixRel(raiz, cheio) {
-  return relative2(raiz, cheio).replaceAll("\\", "/");
+  return relative3(raiz, cheio).replaceAll("\\", "/");
 }
 function dirnamePosix(caminho2) {
   const i = caminho2.lastIndexOf("/");
@@ -16266,12 +19362,12 @@ function resolverSpec(de, spec, indice) {
   }
   return null;
 }
-function rotuloDe(rel, exports) {
+function rotuloDe(rel, exports2) {
   const rota = routeFromFile(rel);
-  const handlers = exports.filter((e) => HANDLERS.has(e));
+  const handlers = exports2.filter((e) => HANDLERS.has(e));
   if (rota !== null && handlers.length > 0) return `${handlers[0]} ${rota}`;
   if (rota !== null) return rota;
-  const simbolo = exports.find((e) => !HANDLERS.has(e));
+  const simbolo = exports2.find((e) => !HANDLERS.has(e));
   if (simbolo !== void 0) return simbolo;
   const base = rel.split("/").at(-1)?.replace(/\.(m?[jt]sx?)$/i, "");
   return base !== void 0 && base.length > 0 && base !== "index" ? base : rel;
@@ -16280,16 +19376,16 @@ function lerArquivo(raiz, cheio) {
   const rel = posixRel(raiz, cheio);
   let conteudo = "";
   try {
-    conteudo = readFileSync4(cheio, "utf8").slice(0, MAX_BYTES_ARQUIVO);
+    conteudo = readFileSync7(cheio, "utf8").slice(0, MAX_BYTES_ARQUIVO);
   } catch {
     return null;
   }
-  const exports = exportsDe(conteudo);
+  const exports2 = exportsDe(conteudo);
   const specs = specsDe(conteudo);
   return {
     rel,
-    label: rotuloDe(rel, exports),
-    exports,
+    label: rotuloDe(rel, exports2),
+    exports: exports2,
     importsRel: specs.filter(
       (s) => s.startsWith(".") || s.startsWith("@/") || s.startsWith("~/")
     ),
@@ -16402,11 +19498,14 @@ function isAdvancedScan(grafo) {
 }
 
 // src/cli.ts
-var VERSION = "0.2.0";
+var VERSION = "0.3.1";
 var AJUDA = `vibecheck \u2014 security check for AI-built apps
 
   npx @kinkai.cloud/vibecheck [options]
 
+Commands
+  analyze           project quality and security analysis (analyze --help)
+
 Options
   --url <url>        target; defaults to https://<verified host of the token>
   --dir <path>       repository root (default: current directory)
@@ -16421,6 +19520,7 @@ Options
 
 Environment
   VIBECHECK_TOKEN, VIBECHECK_HOST, VIBECHECK_URL
+  VIBECHECK_PROJECT_TOKEN       project token for analyze --publish
   VIBECHECK_ALLOW_CODE_SCAN=1    required by --gate in CI
 `;
 function arg(nome, argv) {
@@ -16476,6 +19576,7 @@ async function comandoConsentimento(acao, raiz) {
   return GATE_EXIT.operational;
 }
 async function main(argv) {
+  if (argv[0] === "analyze") return analyzeCommand(argv.slice(1));
   if (temFlag("--help", argv) || temFlag("-h", argv)) {
     console.warn(AJUDA);
     return 0;