oxlint-plugin-react-doctor 0.9.20-dev.39152dc → 0.9.20-dev.5a2c6f5

package/dist/{capability-CN4mTeHg.js → capability-hsEmdGJQ.js}

@@ -3,30 +3,30 @@ import*as e from"node:fs";import{readFileSync as t}from"node:fs";import*as n fro
 * Update external systems with the latest state from React.
 * Subscribe for updates from some external system, calling setState in a callback function when external state changes.
 
-Calling setState synchronously within an effect body causes cascading renders that can hurt performance, and is not recommended. (https://react.dev/learn/you-might-not-need-an-effect)`,Ta=new Set([`useEffect`,`useLayoutEffect`,`useMemo`,`useCallback`]),Ea=new Set([`use`,`useState`,`useRef`,`useMemo`,`useCallback`,`useReducer`,`useContext`,`useEffect`,`useLayoutEffect`,`useInsertionEffect`,`useImperativeHandle`,`useSyncExternalStore`,`useDeferredValue`,`useTransition`,`useId`,`useDebugValue`]),Da=new Set([`memo`,`forwardRef`,`React.memo`,`React.forwardRef`]),Oa=new Set([`useMemo`,`useCallback`]),ka=new Set([`memo`,`forwardRef`,`observer`,`lazy`]),Aa=new Set([`subscribe`,`addEventListener`,`addListener`,`on`,`watch`,`listen`,`sub`]),ja=new Set([`subscribe`,`sub`,`listen`]),Ma=new Set([`unsubscribe`,`removeEventListener`,`removeListener`,`off`,`unwatch`,`unlisten`,`unsub`,`abort`,`disconnect`,`unobserve`,`close`]),Na=new Set([`remove`,`cleanup`,`dispose`,`destroy`,`stop`,`teardown`]),Pa=new Set([...Ma,`cleanup`,`dispose`,`destroy`,`teardown`]),Fa=new Set([...Aa,`connect`,`disconnect`,`open`,`close`,`fetch`,`post`,`put`,`patch`]),Ia=new Set([`get`,`head`,`options`,`delete`]),La=new Set([...Gi,...ta]),Ra=new Set([...Gi,`post`,`put`,`patch`,`navigate`,`navigateTo`,`showNotification`,`toast`,`alert`,`confirm`,`logVisit`,`captureEvent`]),za=new Set([`post`,`put`,`patch`,`delete`,`navigate`,`capture`,`track`,`logEvent`]),Ba=new Set([`push`,`replace`]),Va=new Set([`router`,`navigation`,`navigator`,`history`,`location`]),Ha=new Map([[`react_ujs`,new Set([`useContext`,`useContexts`])]]),Ua={},Wa=new WeakMap,Ga=(e,t)=>typeof e==`string`?e===t:e.has(t),Ka=e=>{let t=Wa.get(e);if(t)return t;let n=e.declarationNode.parent,r=!!(e.kind===`import`&&n&&n.type===`ImportDeclaration`&&typeof n.source.value==`string`&&ua.has(n.source.value)),i={importedName:r?x(e.declarationNode):void 0,isReactImport:r};return Wa.set(e,i),i},qa=e=>Ka(e).isReactImport,Ja=(e,t,n,r)=>{if(e.type!==`Identifier`)return!1;let i=r?F(e,n):n.symbolFor(e);if(!i)return!1;let a=Ka(i);return!!(a.isReactImport&&a.importedName&&Ga(t,a.importedName))},Ya=(e,t)=>{let n=F(e,t);if(!n)return!1;let r=Ka(n);return r.isReactImport?n.declarationNode.type===`ImportDefaultSpecifier`||n.declarationNode.type===`ImportNamespaceSpecifier`||r.importedName===`default`:!1},Xa=(e,t,n)=>e.type===`Identifier`?Ya(e,t)?!0:!!(n.allowGlobalReactNamespace&&e.name===`React`&&t.isGlobalReference(e)):!1,Za=(e,t,n,r)=>{let i=n.symbolFor(e);if(!i||i.kind!==`const`||!i.initializer||i.declarationNode.type!==`VariableDeclarator`)return!1;let a=i.declarationNode.id;if(a.type!==`ObjectPattern`)return!1;for(let e of a.properties){if(e.type!==`Property`||e.value!==i.bindingIdentifier)continue;let a=S(e);return!!(a&&Ga(t,a)&&Xa(w(i.initializer),n,r))}return!1},Qa=(e,t,n,r=Ua)=>e.type===`CallExpression`?$a(e.callee,t,n,r):!1,$a=(e,t,n,r,i)=>{let a=w(e);if(r.resolveConditionalAliases&&a.type===`ConditionalExpression`)return $a(a.consequent,t,n,r,new Set(i))&&$a(a.alternate,t,n,r,new Set(i));if(a.type===`Identifier`){if(Ja(a,t,n,!!r.resolveNamedAliases)||r.resolveNamedAliases&&Za(a,t,n,r))return!0;if(r.resolveConditionalAliases){let e=n.symbolFor(a);if(e?.kind===`const`&&e.initializer&&!i?.has(e.id)){let a=i??new Set;return a.add(e.id),$a(e.initializer,t,n,r,a)}}return!!(r.allowUnboundBareCalls&&Ga(t,a.name)&&n.isGlobalReference(a))}return a.type!==`MemberExpression`||!Ga(t,C(a)??``)?!1:Xa(w(a.object),n,r)},eo=e=>e.includes(`\\`)?e.replaceAll(`\\`,`/`):e,to=e=>{let t=new Set(e);if(t.size!==1)return null;let[n]=t;return n??null},no=(e,t,n,r)=>{let i=Vn(e,n);return i?ro(i,t,new Set(r))||(si(i,t)?i:null):null},ro=(e,t,n=new Set)=>{if(n.has(e))return null;n.add(e);let r=Di(e);if(!r.isBarrel)return null;let i=r.exportsByName.get(t);if(i){let t=Vn(e,i.source);return t?ro(t,i.importedName,n)??t:null}return t===`default`?null:to(r.starExportSources.map(r=>no(e,t,r,n)).filter(e=>!!e))},io=(e,t,n)=>{let r=R(e,t,n);return r?{filePath:r.filePath,node:r.exportedNode,programNode:r.programNode,kind:O(r.exportedNode)?`function`:`initializer`}:null},ao=(e,t)=>{if(!b(e,`ArrowFunctionExpression`)&&!b(e,`FunctionExpression`)&&!b(e,`FunctionDeclaration`))return null;let n=e.params[0],r=b(n,`AssignmentPattern`)?n.left:n;if(b(r,`ObjectPattern`)){let e=r.properties.find(e=>b(e,`Property`)&&S(e,{allowComputedString:!0})===`children`);if(!e||!b(e,`Property`))return null;let n=b(e.value,`AssignmentPattern`)?e.value.left:e.value;if(!b(n,`Identifier`))return null;let i=t.symbolFor(n);return!i||i.references.length===0||i.references.some(e=>e.flag!==`read`)?null:i.references.map(e=>e.identifier)}if(!b(r,`Identifier`))return null;let i=t.symbolFor(r);if(!i||i.references.length===0)return null;let a=[];for(let e of i.references){if(e.flag!==`read`)return null;let t=[],n=P(e.identifier);for(;n.parent&&b(n.parent,`MemberExpression`)&&n.parent.object===n;){let e=C(n.parent);if(!e)return null;t.push(e),n=P(n.parent)}if(t[0]!==`children`){if(t.length===0)return null;continue}if(t.length!==1)return null;a.push(n)}return a.length>0?a:null},oo=e=>{let t=new Map,n=e.body??[];for(let e of n){if(e.type!==`ImportDeclaration`||!(`source`in e)||!e.source)continue;let n=e.source.value;if(typeof n==`string`&&!(!(`specifiers`in e)||!Array.isArray(e.specifiers)))for(let r of e.specifiers){if(!(`local`in r)||!r.local)continue;let e=r.local;if(typeof e.name==`string`){if(r.type===`ImportDefaultSpecifier`)t.set(e.name,{source:n,imported:null,isDefault:!0,isNamespace:!1});else if(r.type===`ImportNamespaceSpecifier`)t.set(e.name,{source:n,imported:null,isDefault:!1,isNamespace:!0});else if(r.type===`ImportSpecifier`){let i=r.imported,a=i?.name??(typeof i?.value==`string`?i.value:null);t.set(e.name,{source:n,imported:a,isDefault:!1,isNamespace:!1})}}}}return t},so=new WeakMap,co=e=>{let t=Bt(e);if(!t)return null;let n=so.get(t);return n||(n=oo(t),so.set(t,n)),n},lo=(e,t)=>{let n=co(e);if(!n)return!1;for(let e of n.values())if(t.includes(e.source))return!0;return!1},uo=(e,t,n)=>{let r=co(e);if(!r)return!1;let i=r.get(t);return i?i.source===n:!1},fo=(e,t,n)=>{let r=co(e);if(!r)return!1;let i=r.get(t);return i?i.isNamespace&&i.source===n:!1},po=(e,t,n)=>{let r=co(e);if(!r)return!1;let i=r.get(t);return i?i.isDefault&&i.source===n:!1},mo=(e,t,n)=>{let r=co(e);if(!r)return null;let i=r.get(t);return!i||i.source!==n?null:i.imported},ho=(e,t)=>{let n=co(e);return n?n.get(t)?.source??null:null},go=(e,t)=>{let n=co(e)?.get(t);return n?n.isNamespace?{source:n.source,exportedName:null,isNamespace:!0}:{source:n.source,exportedName:n.isDefault?`default`:n.imported,isNamespace:!1}:null},_o=(e,t)=>{let n=e.parent;for(;n;){if(`typeParameters`in n){let e=n.typeParameters;if(e&&b(e,`TSTypeParameterDeclaration`)&&e.params.some(e=>b(e,`TSTypeParameter`)&&b(e.name,`Identifier`)&&e.name.name===t))return!0}n=n.parent}return!1},vo=e=>{if(!b(e,`Identifier`)||_o(e,e.name))return!1;let t=go(e,e.name);return!!(t&&t.source===`react`&&(t.isNamespace||t.exportedName===`default`))},yo=e=>{let t=Bt(e);return!t||!b(t,`Program`)?!1:t.body.some(e=>b(e,`TSModuleDeclaration`)&&b(e.id,`Identifier`)&&e.id.name===`JSX`)},bo=(e,t)=>{if(!b(e,`TSTypeReference`))return!1;let n=e.typeName;if(b(n,`Identifier`)){if(_o(n,n.name))return!1;let e=mo(n,n.name,`react`);return e===`ReactElement`||t&&e===`ReactNode`}if(!b(n,`TSQualifiedName`)||!b(n.right,`Identifier`))return!1;if((n.right.name===`ReactElement`||t&&n.right.name===`ReactNode`)&&vo(n.left))return!0;if(n.right.name!==`Element`)return!1;if(b(n.left,`Identifier`)){if(n.left.name!==`JSX`)return!1;let e=go(n.left,n.left.name);return e?e.source===`react`&&e.exportedName===`JSX`:!yo(n.left)}return b(n.left,`TSQualifiedName`)&&b(n.left.right,`Identifier`)&&n.left.right.name===`JSX`&&vo(n.left.left)},xo=(e,t)=>b(e,`TSUnionType`)?t?e.types.every(e=>b(e,`TSNullKeyword`)||b(e,`TSUndefinedKeyword`)||xo(e,t)):e.types.some(e=>xo(e,t)):bo(e,t),So=(e,t=!1)=>{let n=Reflect.get(e,`returnType`);return b(n,`TSTypeAnnotation`)?xo(n.typeAnnotation,t):!1},Co=e=>{let t=e,n=t.parent;for(;n&&w(n)===e;)t=n,n=t.parent;return n&&b(n,`AssignmentExpression`)&&n.operator===`=`&&n.left===t?n.right:null},wo=e=>{let t=e.range?.[0];return typeof t==`number`?t:null},To=new Set([`let`,`var`]),Eo=new Set([`ConditionalExpression`,`LogicalExpression`]),Do=new WeakMap,Oo=(e,t,n)=>{let r=e.parent??null;for(;r&&n.blockOf(r)===t;){if(Eo.has(r.type))return!0;r=r.parent??null}return!1},ko=(e,t)=>e.size===t.size&&[...e].every(e=>t.has(e)),Ao=(e,t)=>{let n=new Set(e);for(let e of t)e.isConditionalWithinBlock||(n=new Set),n.add(e);return n},jo=(e,t,n)=>{let r=j(t);if(j(e.bindingIdentifier)!==r||!r)return[];let i=n.cfgFor(r);if(!i)return[];let a=i.blockOf(t);if(!a)return[];let o=wo(t),s=wo(e.bindingIdentifier);if(o===null||s===null)return[];let c=new Map,l=(e,t,n)=>{let r=i.blockOf(t);if(!r)return;let a=c.get(r)??[];a.push({expression:e,position:n,isConditionalWithinBlock:Oo(t,r,i)}),c.set(r,a)};e.initializer&&l(e.initializer,e.bindingIdentifier,s);for(let t of e.references){let e=wo(t.identifier);if(t.flag===`read`||j(t.identifier)!==r||e===null||e>=o)continue;let n=Co(t.identifier);n&&l(n,t.identifier,e)}for(let e of c.values())e.sort((e,t)=>e.position-t.position);let u=new Map,d=new Map,f=new Set([i.entry]),p=[i.entry];for(;p.length>0;){let e=p.pop();if(!e)break;for(let t of e.successors)f.has(t.to)||(f.add(t.to),p.push(t.to))}if(!f.has(a))return[];let m=!0;for(;m;){m=!1;for(let e of i.blocks){if(!f.has(e))continue;let t=new Set;for(let n of e.predecessors)if(f.has(n.from))for(let e of d.get(n.from)??[])t.add(e);let n=Ao(t,c.get(e)??[]),r=u.get(e)??new Set,i=d.get(e)??new Set;(!ko(t,r)||!ko(n,i))&&(u.set(e,t),d.set(e,n),m=!0)}}let h=(c.get(a)??[]).filter(e=>e.position<o);return[...Ao(u.get(a)??new Set,h)].map(e=>e.expression)},Mo=(e,t,n)=>{if(!To.has(e.kind))return e.initializer?[e.initializer]:[];if(!n)return[];let r=Do.get(n);r||(r=new WeakMap,Do.set(n,r));let i=r.get(e);i||(i=new WeakMap,r.set(e,i));let a=i.get(t);if(a)return a;let o=jo(e,t,n);return i.set(t,o),o},No=e=>{if(!O(e)||!b(e.body,`BlockStatement`))return[];let t=[];return z(e.body,n=>{if(n!==e.body&&(O(n)||b(n,`ClassDeclaration`)||b(n,`ClassExpression`)))return!1;b(n,`ReturnStatement`)&&t.push(n)}),t},B=e=>{if(b(e,`ReturnStatement`)||b(e,`ThrowStatement`))return!0;if(b(e,`IfStatement`)){if(b(e.test,`Literal`)){let t=e.test.value?e.consequent:e.alternate;return t?B(t):!1}return!!(e.alternate&&B(e.consequent)&&B(e.alternate))}if(b(e,`TryStatement`))return e.finalizer&&B(e.finalizer)?!0:B(e.block)?e.handler?B(e.handler.body):!0:!1;if(b(e,`DoWhileStatement`))return B(e.body);if(b(e,`WhileStatement`)){let t=e.test;return!!(b(t,`Literal`)&&t.value&&B(e.body))}if(b(e,`ForStatement`)){let t=e.test;return!!((!t||b(t,`Literal`)&&t.value)&&B(e.body))}return b(e,`BlockStatement`)?e.body.some(e=>B(e)):!1},Po=new Set([`let`,`var`]),Fo=e=>!O(e)||!e.body?[]:b(e.body,`BlockStatement`)?No(e).flatMap(e=>e.argument?[e.argument]:[]):[e.body],Io=e=>{if(!O(e)||!b(e.body,`BlockStatement`))return!1;let t=!1;return z(e.body,n=>{if(t||n!==e.body&&O(n))return!1;b(n,`ReturnStatement`)&&!n.argument&&(t=!0)}),t},Lo=(e,t,n,r=`some`)=>{let i=new Set,a=new Set,o,s=e=>{if(a.has(e))return!1;a.add(e);try{let t=Fo(e);return r===`every`&&O(e)&&b(e.body,`BlockStatement`)&&(!B(e.body)||Io(e))?!1:t.length>0&&(r===`every`?t.every(o):t.some(o))}finally{a.delete(e)}};o=a=>{let l=w(a);if(i.has(l))return!1;i.add(l);try{if(t(l))return!0;if(b(l,`Identifier`)){let t=e.symbolFor(l);if(!t||t.kind!==`const`&&!Po.has(t.kind))return!1;let i=Mo(t,l,n),a=e=>{let t=w(e);return!O(t)&&o(t)};return r===`every`?i.length>0&&i.every(a):i.some(a)}if(b(l,`CallExpression`)){if(l.arguments.length!==0||!b(l.callee,`Identifier`))return!1;let t=e.symbolFor(l.callee);if(!t||t.kind!==`const`&&t.kind!==`function`)return!1;let n=t.initializer?w(t.initializer):null,r=null;return O(n)?r=n:O(t.declarationNode)&&(r=t.declarationNode),!r||r.async||r.generator||r.params.length!==0?!1:s(r)}return b(l,`ConditionalExpression`)?c(l.consequent,l.alternate):b(l,`LogicalExpression`)?c(l.left,l.right):!1}finally{i.delete(l)}};let c=(e,t)=>{let n=[o(e),o(t)];return r===`every`?n.every(Boolean):n.some(Boolean)};return{expressionMatches:o,functionMatches:s}},Ro=(e,t,n,r,i=`some`)=>Lo(t,n,r,i).functionMatches(e),zo=(e,t,n,r,i)=>{let a=i.cfgFor(e),o=a?.blockOf(t);if(!a||!o)return!1;let s=new Set(No(e).flatMap(e=>{if(!e.argument||!Lo(n,r,i,`every`).expressionMatches(e.argument))return[];let t=a.blockOf(e.argument);return t?[t]:[]}));if(s.size===0)return!1;let c=new Set([o]),l=[o];for(;l.length>0;){let e=l.pop();if(!e)break;if(!s.has(e))for(let t of e.successors){if(t.to===a.exit)return!1;c.has(t.to)||(c.add(t.to),l.push(t.to))}}return!0},Bo=e=>b(e,`Program`)?e.range[1]:e.range[0],Vo=new WeakMap,Ho=new WeakMap,Uo=(e,t)=>{let n=w(e);return b(n,`Identifier`)?t.symbolFor(n):null},Wo=(e,t)=>{let n=P(e),r=n.parent;return!r||!b(r,`AssignmentExpression`)||r.operator!==`=`||r.left!==n?null:Uo(r.right,t)},Go=e=>{let t=P(e),n=t.parent;return n&&b(n,`VariableDeclarator`)&&n.init===t&&(b(n.id,`Identifier`)||b(n.id,`ObjectPattern`))?!0:!!(n&&b(n,`AssignmentExpression`)&&n.operator===`=`&&n.right===t&&b(w(n.left),`Identifier`))},Ko=(e,t,n)=>{if(e.initializer&&b(e.declarationNode,`VariableDeclarator`)&&e.declarationNode.id===e.bindingIdentifier){let r=Uo(e.initializer,n);if(r&&t.has(r.id))return!0}return e.references.some(e=>{let r=Wo(e.identifier,n);return!!(r&&t.has(r.id))})},qo=(e,t)=>{let n=F(e,t);if(!n)return[];let r=Vo.get(t);r||(r=new Map,Vo.set(t,r));let i=r.get(n.id);if(i)return i;let a=[],o=[t.rootScope];for(;o.length>0;){let e=o.pop();e&&(a.push(...e.symbols),o.push(...e.children))}let s=new Set([n.id]),c=!0;for(;c;){c=!1;for(let e of a)s.has(e.id)||Ko(e,s,t)&&(s.add(e.id),c=!0)}let l=a.filter(e=>s.has(e.id));return r.set(n.id,l),l},Jo=e=>{let t=e;for(;t;){if(O(t)||b(t,`Program`))return t;t=t.parent??null}return null},Yo=new WeakMap,Xo=(e,t)=>{let n=Yo.get(t);if(!n){let r=new Map,i=new Map,a=Bt(e);a&&z(a,e=>{if(!b(e,`CallExpression`))return;let n=w(e.callee),a=b(n,`Identifier`)?t.symbolFor(n):null,o=a?i.get(a.id):void 0;o===void 0&&(o=cn(e.callee,t),a&&i.set(a.id,o));for(let t of o){let n=r.get(t)??[];n.push(e),r.set(t,n)}}),n=r,Yo.set(t,n)}return n.get(e)??[]},Zo=new WeakMap,Qo=(e,t)=>{let n=Zo.get(t);if(n===void 0){let e=null;z(t,n=>{b(n,`AwaitExpression`)&&j(n)===t&&(e===null||n.range[0]<e)&&(e=n.range[0])}),n=e,Zo.set(t,n)}return n===null||e.range[0]<n},$o=(e,t,n,r=new Set,i=null,a)=>{if(r.has(e)||!O(e)||e.generator||i!==null&&!Jt(i,e)||i!==null&&a!==void 0&&!a(i)||i!==null&&e.async&&!Qo(i,e))return[];r.add(e);let o=Jo(t);return o?Xo(e,n).flatMap(e=>{let s=Jo(e);return!s||i!==null&&!Jt(e,s)||i!==null&&a!==void 0&&!a(e)?[]:s===o?e.range[0]<Bo(t)?[[e.range[0]]]:[]:O(s)?$o(s,t,n,new Set(r),i===null?null:e,a).map(t=>[...t,e.range[0]]):[]}):[]},es=(e,t,n,r=new Set,i=null)=>$o(e,t,n,r,i).length>0,ts=e=>{let t=e.parent;return t?b(t,`AssignmentExpression`)?t.left===e:(b(t,`UpdateExpression`)||b(t,`UnaryExpression`)&&t.operator===`delete`)&&t.argument===e:!1},ns=e=>{let t=e.parent;for(;t&&w(t)===e;)t=t.parent;return!t||!b(t,`MemberExpression`)||w(t.object)!==e||!ts(t)?null:t},rs=(e,t,n)=>{let r=ns(e);return r&&I(r,n)===t?r:null},is=(e,t,n,r)=>e.references.some(e=>{let i=rs(e.identifier,t,r);if(!i)return!1;let a=Jo(i),o=Jo(n);return!a||!o||!Jt(i,a)?!1:a===o?i.range[0]<Bo(n):O(a)&&es(a,n,r)}),as=e=>{if(Go(e))return!0;let t=P(e),n=t.parent;return!!(n&&b(n,`MemberExpression`)&&w(n.object)===t)},os=e=>{if(Go(e))return!0;let t=P(e),n=t.parent;if(!n||!b(n,`MemberExpression`)||w(n.object)!==t)return!1;let r=P(n),i=r.parent;return!(i&&b(i,`CallExpression`)&&i.callee===r)},ss=(e,t,n)=>b(e,`Identifier`)?qo(e,n).some(e=>e.references.some(e=>{let r=ns(e.identifier);if(!r)return!1;let i=I(r,n);return i===null||i===t})):!1,cs=(e,t,n)=>{let r=Jo(e),i=Jo(t);return!r||!i?!0:r===i?e.range[0]<Bo(t):O(r)?es(r,t,n):!0},ls=(e,t,n,r)=>b(e,`Identifier`)?qo(e,r).some(e=>e.references.some(e=>{let i=ns(e.identifier);if(!i||!cs(i,n,r))return!1;let a=I(i,r);return a===null||a===t})):!1,us=(e,t,n)=>{if(!b(e,`Identifier`))return!1;let r=F(e,n);if(!r)return!1;let i=Ho.get(n)??new Map;Ho.set(n,i);let a=i.get(r.id)??new Map;i.set(r.id,a);let o=a.get(t);if(o!==void 0)return o;let s=ss(e,t,n)||qo(e,n).some(e=>e.references.some(e=>!as(e.identifier)));return a.set(t,s),s},ds=(e,t,n,r)=>b(e,`Identifier`)?ls(e,t,n,r)?!0:qo(e,r).some(e=>e.references.some(e=>!os(e.identifier)&&cs(e.identifier,n,r))):!1,fs=(e,t)=>{let n=w(e);if(!b(n,`CallExpression`))return!1;let r=w(n.callee);if(!b(r,`MemberExpression`))return!1;let i=C(r);if(i===null)return!1;let a=w(r.object);return b(a,`Identifier`)&&ss(a,i,t)},ps=(e,t,n,r)=>b(e,`Identifier`)?Wt(e,r).some(e=>is(e,t,n,r)):!1,ms=(e,t,n,r={})=>{let i=j(e);return i===j(t)?e.range[0]>=Bo(t)||r.requireSynchronousWrite&&(!i||!Jt(e,i)||r.isSynchronousNode!==void 0&&!r.isSynchronousNode(e))?[]:[[e.range[0]]]:i?r.requireSynchronousWrite?$o(i,t,n,new Set,e,r.isSynchronousNode).map(t=>[...t,e.range[0]]):$o(i,t,n).map(t=>[...t,e.range[0]]):r.requireSynchronousWrite?[]:[[-1/0,e.range[0]]]},hs=(e,t,n,r={})=>ms(e,t,n,r).length>0,V=(e,t,n,r={})=>e.references.some(e=>e.flag===`read`?!1:hs(e.identifier,t,n,r)),gs=(e,t)=>{if(!b(e,`CallExpression`))return!1;let n=w(e.callee);if(b(n,`Identifier`)){let e=t.symbolFor(n);return!!(e&&!V(e,n,t))}if(!b(n,`MemberExpression`))return!1;let r=C(n),i=w(n.object);return!!(r&&b(i,`Identifier`)&&!ps(i,r,n,t))},_s=new Set([`FunctionDeclaration`,`FunctionExpression`,`ArrowFunctionExpression`,`ClassDeclaration`,`ClassExpression`]),vs={allowGlobalReactNamespace:!1,allowUnboundBareCalls:!1},ys=new Set([`lodash/sortBy`,`lodash/sortBy.js`,`lodash-es/sortBy`,`lodash-es/sortBy.js`]),bs=e=>b(e,`TSArrayType`)||b(e,`TSTupleType`)?!0:b(e,`TSTypeReference`)?b(e.typeName,`Identifier`)&&(e.typeName.name===`Array`||e.typeName.name===`ReadonlyArray`):!1,xs=e=>{if(!b(e,`Identifier`))return!1;let t=e.typeAnnotation;return!!(t&&b(t,`TSTypeAnnotation`)&&bs(t.typeAnnotation))},Ss=(e,t)=>{if(!b(e,`CallExpression`))return!1;let n=w(e.callee);if(!b(n,`Identifier`))return!1;let r=t.symbolFor(n);if(!r||V(r,n,t)||!b(r.declarationNode,`ImportDefaultSpecifier`)&&!b(r.declarationNode,`ImportSpecifier`))return!1;let i=go(n,n.name);return!i||i.isNamespace?!1:ys.has(i.source)&&i.exportedName===`default`?!0:(i.source===`lodash`||i.source===`lodash-es`)&&i.exportedName===`sortBy`},Cs=(e,t,n,r=new Set)=>{let i=w(e);if(b(i,`ArrayExpression`)||Ss(i,t))return!0;if(!b(i,`Identifier`))return!1;let a=t.symbolFor(i);return!a||r.has(a.id)||V(a,n,t)?!1:xs(a.bindingIdentifier)?!0:a.initializer?(r.add(a.id),Cs(a.initializer,t,n,r)):!1},ws=(e,t)=>{if(!b(e,`CallExpression`))return!1;let n=w(e.callee);if(!b(n,`MemberExpression`)||C(n)!==`map`)return!1;let r=w(n.object);return Cs(r,t,e)?!(b(r,`Identifier`)&&ps(r,`map`,e,t)):!1},Ts=(e,t)=>{if(e.type!==`ArrowFunctionExpression`&&e.type!==`FunctionExpression`)return!1;let n=e.parent;if(b(n,`CallExpression`))return Qa(n,`useMemo`,t,{resolveNamedAliases:!0})&&gs(n,t)?n.arguments[0]===e:n.arguments.some(t=>t===e)&&ws(n,t);if(b(n,`Property`)&&n.kind===`init`&&n.value===e){let e=n.parent;if(!b(e,`ObjectExpression`))return!1;let r=e.parent;if(!b(r,`CallExpression`)||!r.arguments.some(t=>t===e)||!gs(r,t))return!1;let i=sn(r.callee,t);return!!(i&&So(i,!0))}return!1},Es=(e,t)=>_s.has(e.type)&&!Ts(e,t),Ds=(e,t)=>e.type===`JSXElement`||e.type===`JSXFragment`||Qa(e,`createElement`,t,vs)||Os(e,t),Os=(e,t)=>{if(!b(e,`CallExpression`))return!1;let n=w(e.callee);if(b(n,`Identifier`))return t.symbolFor(n)?.kind===`import`&&mo(n,n.name,`react-dom`)===`createPortal`;if(!b(n,`MemberExpression`)||n.computed||!b(n.object,`Identifier`)||!b(n.property,`Identifier`)||n.property.name!==`createPortal`)return!1;let r=t.symbolFor(n.object);return!r||r.kind!==`import`?!1:po(n.object,n.object.name,`react-dom`)||fo(n.object,n.object.name,`react-dom`)},ks=(e,t)=>{if(Es(e,t))return!1;let n=!1;return z(e,r=>{if(n||r!==e&&Es(r,t))return!1;if(Ds(r,t))return n=!0,!1}),n},As=new WeakMap,js=(e,t,n)=>{let r=As.get(e);if(r&&r.scopes===t&&r.controlFlow===n)return r.hasRenderOutput;let i=Ro(e,t,e=>ks(e,t),n);return As.set(e,{scopes:t,controlFlow:n,hasRenderOutput:i}),i},Ms=e=>b(e,`JSXIdentifier`)?e.name:b(e,`JSXNamespacedName`)?`${e.namespace.name}:${e.name.name}`:null,Ns=new Set([`Component`,`PureComponent`]),Ps=(e,t,n,r)=>{let i=w(e);if(b(i,`MemberExpression`)){let e=C(i),n=w(i.object);return!!(e&&Ns.has(e)&&b(n,`Identifier`)&&!ps(n,e,i,t)&&Ya(n,t))}if(b(i,`ClassExpression`))return Fs(i,t,n,r);if(!b(i,`Identifier`))return!1;let a=t.symbolFor(i);if(!a||r.has(a.id)||V(a,i,t))return!1;if(r.add(a.id),qa(a)){let e=x(a.declarationNode);return!!(e&&Ns.has(e))}return b(a.declarationNode,`ClassDeclaration`)||b(a.declarationNode,`ClassExpression`)?Fs(a.declarationNode,t,n,r):!!(a.kind===`const`&&a.initializer&&Ps(a.initializer,t,n,r))},Fs=(e,t,n=new Set,r=new Set)=>!b(e,`ClassDeclaration`)&&!b(e,`ClassExpression`)||n.has(e)||!e.superClass?!1:(n.add(e),Ps(e.superClass,t,n,r)),Is=new Set([`FunctionDeclaration`,`FunctionExpression`,`ArrowFunctionExpression`,`MethodDefinition`,`Program`]),Ls=e=>{let t=e;for(;t;){if(Is.has(t.type))return t;t=t.parent??null}return null},Rs=(e,t)=>{if(t!==`let`&&t!==`const`)return Ls(e);let n=e.parent;for(;n;){if(n.type===`BlockStatement`){let t=n.parent;return t&&(t.type===`FunctionDeclaration`||t.type===`FunctionExpression`||t.type===`ArrowFunctionExpression`||t.type===`MethodDefinition`)?Ls(e):n}if(Is.has(n.type))return n;n=n.parent??null}return null},zs=(e,t,n,r)=>{if(b(e,`Identifier`)){let i=r.get(e.name)??[];i.push({bindingIdentifier:e,initializer:t,scopeOwner:n}),r.set(e.name,i);return}if(b(e,`ObjectPattern`)){for(let t of e.properties)if(b(t,`Property`)){let e=t.value;zs(e,b(e,`AssignmentPattern`)?e.right:null,n,r)}else b(t,`RestElement`)&&zs(t.argument,null,n,r);return}if(b(e,`ArrayPattern`)){for(let t of e.elements)t&&zs(t,b(t,`AssignmentPattern`)?t.right??null:null,n,r);return}if(b(e,`AssignmentPattern`)){zs(e.left,e.right??null,n,r);return}b(e,`RestElement`)&&zs(e.argument,null,n,r)},Bs=e=>{let t=new Map;return z(e,e=>{switch(e.type){case`VariableDeclarator`:{let n=e.parent,r=Rs(e,n?.type===`VariableDeclaration`?n.kind:void 0);r&&zs(e.id,e.init??null,r,t);break}case`FunctionDeclaration`:case`FunctionExpression`:case`ArrowFunctionExpression`:if(e.type!==`ArrowFunctionExpression`&&e.id){let n=e.parent?Ls(e.parent):null;if(n){let r=t.get(e.id.name)??[];r.push({bindingIdentifier:e.id,initializer:e,scopeOwner:n}),t.set(e.id.name,r)}}for(let n of e.params)zs(n,null,e,t);break;case`ClassDeclaration`:case`ClassExpression`:{if(!e.id)break;let n=e.parent?Ls(e.parent):null;if(n){let r=t.get(e.id.name)??[];r.push({bindingIdentifier:e.id,initializer:e,scopeOwner:n}),t.set(e.id.name,r)}break}case`ImportDeclaration`:{let n=Ls(e);if(!n)break;for(let r of e.specifiers){let e=r.local;if(e&&b(e,`Identifier`)){let i=t.get(e.name)??[];i.push({bindingIdentifier:e,initializer:r,scopeOwner:n}),t.set(e.name,i)}}break}case`TSImportEqualsDeclaration`:case`TSEnumDeclaration`:case`TSModuleDeclaration`:{let n=e.id;if(n?.type===`Identifier`){let r=Ls(e);if(r){let e=t.get(n.name)??[];e.push({bindingIdentifier:n,initializer:null,scopeOwner:r}),t.set(n.name,e)}}break}}}),t},Vs=new WeakMap,Hs=new WeakMap,Us=e=>{let t=Bt(e);if(!t)return null;let n=Vs.get(t);return n||(n=Bs(t),Vs.set(t,n)),n},Ws=(e,t,n)=>{let r=Us(e);if(!r)return null;let i=r.get(t);if(!i||i.length===0)return null;let a=i[0];if(i.length===1&&a){let t=e;for(;t;){if(t===a.scopeOwner)return a;t=t.parent??null}return null}let o=e;for(;o;){let t=null;for(let r of i)if(r.scopeOwner===o){if(t===null){t=r;continue}if(n?.preferInitializerBeforeReference){let n=!!(r.initializer&&(b(r.initializer,`FunctionDeclaration`)||r.bindingIdentifier.range[0]<e.range[0]));if(n!==!!(t.initializer&&(b(t.initializer,`FunctionDeclaration`)||t.bindingIdentifier.range[0]<e.range[0]))){n&&(t=r);continue}}(r.initializer!==null||t.initializer===null)&&(t=r)}if(t)return t;o=o.parent??null}return null},Gs=(e,t,n)=>{let r=Hs.get(e),i;if(!r)i={},Hs.set(e,{primaryBindingName:t,primaryLookup:i});else if(r.primaryBindingName===t)i=r.primaryLookup;else{let e=r.additionalLookups;e||(e=new Map,r.additionalLookups=e);let n=e.get(t);n?i=n:(i={},e.set(t,i))}let a=n?.preferInitializerBeforeReference?`preferredResult`:`defaultResult`;if(a in i)return i[a]??null;let o=Ws(e,t,n);return i[a]=o,o},Ks=e=>_a.test(e),qs=e=>{let t=Gs(e,e.name);if(!t?.initializer)return null;let n=t.bindingIdentifier.parent;if(!n||!b(n,`VariableDeclarator`)||n.id!==t.bindingIdentifier)return null;let r=n.parent;if(!r||!b(r,`VariableDeclaration`)||r.kind!==`const`)return null;let i=w(t.initializer);return b(i,`Literal`)&&typeof i.value==`string`?i.value:null},Js=e=>b(e,`JSXIdentifier`)?e.name:b(e,`JSXMemberExpression`)?`${Js(e.object)}.${e.property.name}`:b(e,`JSXNamespacedName`)?`${e.namespace.name}:${e.name.name}`:``,Ys=e=>{let t=e.name;return b(t,`JSXIdentifier`)?Ks(t.name)?qs(t)??t.name:t.name:Js(t)},Xs=(e,t)=>{if(!b(e.name,`JSXIdentifier`))return!1;let n=Ys(e);if(n[0]===n[0]?.toLowerCase())return!0;let r=new Set,i=e=>{let n=P(e);if(b(n,`Literal`))return typeof n.value==`string`;if(b(n,`Identifier`)||b(n,`JSXIdentifier`)){let e=t.symbolFor(n);if(!e||e.kind!==`const`||!e.initializer||r.has(e.id))return!1;r.add(e.id);let a=i(e.initializer);return r.delete(e.id),a}return b(n,`ConditionalExpression`)?i(n.consequent)&&i(n.alternate):!1};return i(e.name)},Zs=(e,t,n=new Set)=>{if(!e)return null;let r=w(e);if(O(r))return r;if(b(r,`Identifier`)){let e=t.symbolFor(r);return!e||n.has(e.id)||!e.initializer||V(e,r,t)?null:(n.add(e.id),Zs(e.initializer,t,n))}if(!b(r,`CallExpression`)||!Qa(r,`memo`,t,{resolveNamedAliases:!0})&&!Qa(r,`forwardRef`,t,{resolveNamedAliases:!0}))return null;let i=r.arguments[0];return!i||b(i,`SpreadElement`)?null:Zs(i,t,n)},Qs=(e,t)=>{let n=P(e);if(!O(n)||n.async||n.generator)return!1;let r=n.parent;if(!r||!b(r,`JSXExpressionContainer`))return!1;let i=r.parent;if(!i||!b(i,`JSXAttribute`)||Ms(i.name)!==`ref`)return!1;let a=i.parent;return!!(a&&b(a,`JSXOpeningElement`)&&Xs(a,t))},$s=(e,t)=>t.every((t,n)=>e[n]===t),ec=e=>{let t=P(e);for(;t.parent&&b(t.parent,`MemberExpression`)&&t.parent.object===t;){if(!C(t.parent))return null;t=P(t.parent)}return t},tc=(e,t,n,r)=>{if(t.length!==n.length+1||!$s(t,n)||t[n.length]!==`current`)return!1;let i=ec(e),a=i?.parent;if(!i||!a||!b(a,`AssignmentExpression`)||a.operator!==`=`||a.left!==i)return!1;let o=j(e);if(!o)return!1;if(Qs(o,r))return!0;if(!O(o)||o.async||o.generator)return!1;let s=j(o);if(!s||!Qs(s,r))return!1;let c=P(o),l=c.parent;return!!(b(l,`ReturnStatement`)&&l.argument===c&&j(l)===s||b(s,`ArrowFunctionExpression`)&&s.body===c)},nc=(e,t)=>{if(!b(e,`JSXOpeningElement`))return!1;let n=e.name;if(b(n,`JSXIdentifier`)){if(!t)return n.name===`Fragment`;let e=F(n,t);return e?qa(e)&&x(e.declarationNode)===`Fragment`:n.name===`Fragment`&&t.isGlobalReference(n)}return b(n,`JSXMemberExpression`)?!b(n.object,`JSXIdentifier`)||n.property.name!==`Fragment`?!1:t?Ya(n.object,t)?!0:n.object.name===`React`&&t.isGlobalReference(n.object):n.object.name===`React`:!1},rc=(e,t,n,r,i)=>{let a=P(e),o=a.parent;if(!o)return!1;if(b(o,`ReturnStatement`)&&o.argument===a)return j(o)===t;if(b(o,`ArrowFunctionExpression`)&&o.body===a)return o===t;if(b(o,`JSXFragment`)&&o.children.some(e=>e===a)||b(o,`JSXElement`)&&o.children.some(e=>e===a)&&(Xs(o.openingElement,n)||nc(o.openingElement,n)||i.doesCustomElementRenderChildren?.(o.openingElement)))return rc(o,t,n,r,i);if(b(o,`JSXExpressionContainer`)&&o.expression===a&&o.parent&&(b(o.parent,`JSXFragment`)||b(o.parent,`JSXElement`)&&(Xs(o.parent.openingElement,n)||nc(o.parent.openingElement,n)||i.doesCustomElementRenderChildren?.(o.parent.openingElement))))return rc(o.parent,t,n,r,i);if(b(o,`ConditionalExpression`)&&(o.consequent===a||o.alternate===a)||b(o,`LogicalExpression`)&&(o.left===a||o.right===a)||b(o,`ArrayExpression`)&&o.elements.some(e=>e===a))return rc(o,t,n,r,i);if(!b(o,`VariableDeclarator`)||o.init!==a||!b(o.id,`Identifier`))return!1;let s=n.symbolFor(o.id);if(!s||s.kind!==`const`||s.references.length===0||r.has(s.id))return!1;r.add(s.id);let c=s.references.every(e=>e.flag===`read`&&rc(e.identifier,t,n,r,i));return r.delete(s.id),c},ic=(e,t,n={})=>rc(e,j(e),t,new Set,n),ac=(e,t)=>t.every((t,n)=>e[n]===t),oc=(e,t)=>ac(e,t)||ac(t,e),sc=e=>O(e)&&b(e.body,`BlockStatement`)&&e.body.body.length===0,cc=(e,t,n)=>Qa(e,t,n,{resolveNamedAliases:!0}),lc=(e,t,n=new Set)=>b(e,`ObjectExpression`)?e.properties.every(e=>{if(b(e,`SpreadElement`)){let r=P(e.argument);if(b(r,`ObjectExpression`))return lc(r,t,n);if(!b(r,`Identifier`))return!1;let i=t.symbolFor(r);if(!i||i.kind!==`const`||n.has(i.id)||!b(i.initializer,`ObjectExpression`))return!1;n.add(i.id);let a=lc(i.initializer,t,n);return n.delete(i.id),a}return b(e,`Property`)?!O(e.value)||sc(e.value):!1}):!1,uc=e=>C(e)||(e.computed&&b(e.property,`Literal`)&&typeof e.property.value==`number`&&Number.isSafeInteger(e.property.value)&&e.property.value>=0?String(e.property.value):null),dc=e=>{let t=[],n=P(e);for(;n.parent&&b(n.parent,`MemberExpression`)&&n.parent.object===n;){let e=uc(n.parent);if(!e)return null;t.push(e),n=P(n.parent)}return{expression:n,propertyPath:t}},fc=(e,t,n)=>{let r=n.environmentsByProgram.get(e);if(r)return r;let i={filename:t,program:e,scopes:A(e)};return n.environmentsByProgram.set(e,i),i},pc=(e,t,n=new Set)=>{let r=P(e);if(b(r,`Identifier`)){let e=t.symbolFor(r);return!e||!e.initializer||n.has(e.id)||V(e,r,t)?!1:(n.add(e.id),pc(e.initializer,t,n))}if(!b(r,`CallExpression`))return!1;if(cc(r,`forwardRef`,t))return!0;if(!cc(r,`memo`,t))return!1;let i=r.arguments[0];return!i||b(i,`SpreadElement`)?!1:pc(i,t,n)},mc=(e,t)=>{let n=fc(e.programNode,e.filePath,t),r=Zs(e.exportedNode,n.scopes);return r?{environment:n,functionNode:r,isForwardRef:pc(e.exportedNode,n.scopes)}:null},hc=(e,t,n)=>{if(!b(e,`Identifier`)&&!b(e,`JSXIdentifier`))return null;let r=t.scopes.symbolFor(e);if(r&&r.kind!==`import`){if(V(r,e,t.scopes))return null;let n=Zs(r.initializer,t.scopes);return n?{environment:t,functionNode:n,isForwardRef:!!(r.initializer&&pc(r.initializer,t.scopes))}:null}let i=go(e,e.name);if(!i||i.isNamespace||i.exportedName===null)return null;let a=R(t.filename,i.source,i.exportedName);return a?mc(a,n):null},gc=(e,t,n)=>{if(b(e,`JSXIdentifier`))return hc(e,t,n);if(!b(e,`JSXMemberExpression`)||!b(e.object,`JSXIdentifier`))return null;let r=go(e.object,e.object.name);if(!r?.isNamespace)return null;let i=R(t.filename,r.source,e.property.name);return i?mc(i,n):null},_c=(e,t,n=new Set)=>{let r=P(e);if(b(r,`Identifier`)){let e=t.scopes.symbolFor(r);return!e||!e.initializer||n.has(e.id)||V(e,r,t.scopes)?!1:(n.add(e.id),_c(e.initializer,t,n))}return Fs(r,t.scopes)},vc=(e,t,n)=>{if(!b(e,`JSXIdentifier`))return!1;let r=t.scopes.symbolFor(e);if(r&&r.kind!==`import`)return V(r,e,t.scopes)?!1:!!(r.initializer&&_c(r.initializer,t));let i=go(e,e.name);if(!i||i.isNamespace||i.exportedName===null)return!1;let a=R(t.filename,i.source,i.exportedName);if(!a)return!1;let o=fc(a.programNode,a.filePath,n);return _c(a.exportedNode,o)},yc=(e,t)=>{if(!e)return null;let n=P(e);return!b(n,`ClassDeclaration`)&&!b(n,`ClassExpression`)||!_c(n,t)?null:{classNode:n,environment:t}},bc=(e,t,n)=>{if(!b(e,`JSXIdentifier`))return null;let r=t.scopes.symbolFor(e);if(r&&r.kind!==`import`)return V(r,e,t.scopes)?null:yc(r.initializer,t);let i=go(e,e.name);if(!i||i.isNamespace||i.exportedName===null)return null;let a=R(t.filename,i.source,i.exportedName);if(!a)return null;let o=fc(a.programNode,a.filePath,n);return yc(a.exportedNode,o)},xc=(e,t,n)=>{let r=[...t],i=P(e);for(;i.parent;){let e=i.parent;if(b(e,`ArrayExpression`)){if(e.elements.some(e=>e&&b(e,`SpreadElement`)))return null;let t=e.elements.findIndex(e=>e===i);if(t<0)return null;r.unshift(String(t)),i=P(e);continue}if(b(e,`Property`)&&e.value===i){let t=S(e,{allowComputedString:!0}),a=e.parent;if(!t||!a||!lc(a,n.scopes))return null;r.unshift(t),i=P(a);continue}if(b(e,`ConditionalExpression`)&&(e.consequent===i||e.alternate===i)||b(e,`LogicalExpression`)&&(e.left===i||e.right===i)){i=P(e);continue}if(b(e,`VariableDeclarator`)&&e.init===i&&b(e.id,`Identifier`)){let t=n.scopes.symbolFor(e.id);return!t||t.kind!==`const`?null:{environment:n,propertyPath:r,symbol:t}}if(b(e,`AssignmentExpression`)&&e.operator===`=`&&e.right===i&&b(e.left,`MemberExpression`)){let t=[],i=e.left;for(;b(i,`MemberExpression`);){let e=uc(i);if(!e)return null;t.unshift(e),i=P(i.object)}if(!b(i,`Identifier`))return null;let a=n.scopes.symbolFor(i);return!a||a.kind!==`const`?null:{environment:n,originWriteReference:i,propertyPath:[...t,...r],symbol:a}}return null}return null},Sc=(e,t,n,r,i)=>{if(b(e,`AssignmentPattern`))return Sc(e.left,t,n,r,i);if(b(e,`Identifier`)){let a=n.scopes.symbolFor(e);return!!(a&&Rc({environment:n,propertyPath:t,symbol:a},r,i-1))}if(!b(e,`ObjectPattern`)||t.length===0)return!1;let[a,...o]=t;for(let t of e.properties){if(!b(t,`Property`))continue;let e=S(t,{allowComputedString:!0});if(!e)return!1;if(e===a)return Sc(t.value,o,n,r,i)}let s=e.properties.find(e=>b(e,`RestElement`));return s?Sc(s.argument,t,n,r,i):!0},Cc=(e,t)=>{let n=e.arguments[0];return!n||b(n,`SpreadElement`)?!1:cc(e,`createElement`,t.scopes)?b(n,`Literal`)&&typeof n.value==`string`:!cc(e,`cloneElement`,t.scopes)||!b(n,`JSXElement`)?!1:Xs(n.openingElement,t.scopes)},wc=(e,t,n,r,i)=>{if(t.length>0)return!1;let a=e.parent;if(!a||!b(a,`Property`)||a.value!==e||S(a,{allowComputedString:!0})!==`ref`)return!1;let o=a.parent;if(!o||!b(o,`ObjectExpression`))return!1;let s=o.parent;return!(!s||!b(s,`CallExpression`)||s.arguments[1]!==o||!Cc(s,n)||!Oc(s,n,r,i))},Tc=(e,t,n,r,i)=>{if(i<=0||!O(e.functionNode)||e.functionNode.async||e.functionNode.generator)return!1;let a=e.functionNode.params[t];return!!(a&&Sc(a,n,e.environment,r,i))},Ec=e=>{if(!b(e,`MemberExpression`)||C(e)!==`children`)return!1;let t=P(e.object);return!!(b(t,`MemberExpression`)&&C(t)===`props`&&b(P(t.object),`ThisExpression`))},Dc=(e,t)=>{if(!b(e,`JSXOpeningElement`)||!b(e.name,`JSXMemberExpression`)||e.name.property.name!==`Provider`||!b(e.name.object,`JSXIdentifier`))return!1;let n=t.scopes.symbolFor(e.name.object);return!!(n?.kind===`const`&&n.initializer&&b(n.initializer,`CallExpression`)&&cc(n.initializer,`createContext`,t.scopes))},Oc=(e,t,n,r)=>ic(e,t.scopes,{doesCustomElementRenderChildren:e=>jc(e,t,n,r-1)}),kc=(e,t,n)=>{let{functionNode:r}=e;if(n<=0||t.activeRenderedChildrenComponents.has(r)||!b(r,`ArrowFunctionExpression`)&&!b(r,`FunctionExpression`)&&!b(r,`FunctionDeclaration`)||r.async||r.generator)return!1;let i=ao(r,e.environment.scopes);if(!i)return!1;t.activeRenderedChildrenComponents.add(r);let a=i.every(r=>Oc(r,e.environment,t,n));return t.activeRenderedChildrenComponents.delete(r),a},Ac=(e,t,n)=>{let{classNode:r,environment:i}=e;if(n<=0||t.activeRenderedChildrenComponents.has(r)||!b(r,`ClassDeclaration`)&&!b(r,`ClassExpression`))return!1;let a=r.body.body.find(e=>b(e,`MethodDefinition`)&&!e.computed&&b(e.key,`Identifier`)&&e.key.name===`render`);if(!a||!b(a,`MethodDefinition`))return!1;let o=[];if(z(r,e=>{Ec(e)&&o.push(e)}),o.length===0)return!1;t.activeRenderedChildrenComponents.add(r);let s=o.every(e=>j(e)===a.value&&Oc(e,i,t,n));return t.activeRenderedChildrenComponents.delete(r),s},jc=(e,t,n,r)=>{if(r<=0||!b(e,`JSXOpeningElement`))return!1;if(Dc(e,t))return!0;let i=gc(e.name,t,n);if(i)return kc(i,n,r);let a=bc(e.name,t,n);return!!(a&&Ac(a,n,r))},Mc=(e,t,n,r,i)=>{let a=Ms(e.name),o=e.parent;if(!a||!o||!b(o,`JSXOpeningElement`))return!1;let s=o.parent;if(!s||!b(s,`JSXElement`)||!Oc(s,n,r,i))return!1;if(Xs(o,n.scopes))return a===`ref`&&t.length===0;if(b(o.name,`JSXIdentifier`)&&a===`ref`&&t.length===0&&vc(o.name,n,r))return!0;let c=gc(o.name,n,r);return c?a===`ref`&&c.isForwardRef?Tc(c,1,t,r,i):Tc(c,0,[a,...t],r,i):!1},Nc=(e,t,n,r,i,a)=>{let o=e.arguments.findIndex(e=>e===t);if(o<0)return!1;if(o===0&&b(e.callee,`Identifier`)&&e.callee.name===`Boolean`&&r.scopes.isGlobalReference(e.callee))return!0;if(o===0&&cc(e,`useImperativeHandle`,r.scopes))return n.length===0;if(o===1&&n.length===1&&n[0]===`ref`&&Cc(e,r)&&Oc(e,r,i,a))return!0;let s=P(e.callee);if(O(s))return js(s,r.scopes)&&!Oc(e,r,i,a)?!1:Tc({environment:r,functionNode:s,isForwardRef:!1},o,n,i,a);if(!b(e.callee,`Identifier`))return!1;let c=hc(e.callee,r,i);return!!(c&&(!js(c.functionNode,c.environment.scopes)||Oc(e,r,i,a))&&Tc(c,o,n,i,a))},Pc=(e,t,n,r,i)=>{let a;if(t.length===1&&t[0]===`ref`)a=e.parent;else if(t.length===0){let t=e.parent;if(!t||!b(t,`Property`)||t.value!==e||S(t,{allowComputedString:!0})!==`ref`)return!1;a=t.parent?.parent}if(!a||!b(a,`JSXSpreadAttribute`))return!1;let o=a.parent;if(!o||!b(o,`JSXOpeningElement`))return!1;let s=o.parent;return!!(Xs(o,n.scopes)&&s&&b(s,`JSXElement`)&&Oc(s,n,r,i))},Fc=(e,t,n,r,i)=>{let a=P(e),o=a.parent;if(!o)return!1;if(b(o,`ExpressionStatement`)||b(o,`UnaryExpression`)&&o.operator===`void`&&o.argument===a)return!0;if(t.length===0&&b(o,`BinaryExpression`)&&(o.operator===`===`||o.operator===`!==`||o.operator===`==`||o.operator===`!=`)){let e=o.left===a?o.right:o.left;return!!(b(a,`Identifier`)&&b(e,`Identifier`)&&n.scopes.symbolFor(a)?.id===n.scopes.symbolFor(e)?.id)}if(Pc(a,t,n,r,i)||wc(a,t,n,r,i)||t.length>0&&(b(o,`LogicalExpression`)&&o.left===a||b(o,`ConditionalExpression`)&&o.test===a||b(o,`IfStatement`)&&o.test===a||b(o,`UnaryExpression`)&&o.operator===`!`&&o.argument===a))return!0;if(b(o,`JSXExpressionContainer`)&&o.expression===a){let e=o.parent;return!!(e&&b(e,`JSXAttribute`)&&Mc(e,t,n,r,i))}if(b(o,`CallExpression`))return Nc(o,a,t,n,r,i);if(b(o,`VariableDeclarator`)&&o.init===a&&!b(o.id,`Identifier`))return Sc(o.id,t,n,r,i);let s=xc(a,t,n);return!!(s&&Rc(s,r,i-1))},Ic=e=>{let t=e.parent;return t&&b(t,`VariableDeclarator`)&&t.init===e&&b(t.id,`Identifier`)?t.id:(b(e,`FunctionDeclaration`)||b(e,`FunctionExpression`))&&e.id?e.id:null},Lc=(e,t,n)=>{if(!e||!t||!O(e)||e.async||e.generator)return!1;let r=Ic(e);if(!r||((b(e,`FunctionDeclaration`)||b(e,`FunctionExpression`))&&e.id===r?j(e):j(r))!==t)return!1;let i=b(e,`FunctionDeclaration`)?n.ownScopeFor(t)?.symbolsByName.get(r.name):n.symbolFor(r);return!!(i&&i.references.length>0&&i.references.every(e=>{let r=P(e.identifier),i=r.parent;return!!(i&&b(i,`CallExpression`)&&i.callee===r&&j(i)===t&&ic(i,n))}))},Rc=(e,t,n)=>{if(n<=0)return!1;let r=`${e.environment.filename}:${e.symbol.id}:${e.propertyPath.join(`.`)}`;if(t.activePaths.has(r))return!1;t.activePaths.add(r);let i=j(e.symbol.bindingIdentifier),a=e.symbol.references.every(r=>{if(r.identifier===e.originWriteReference)return!0;let a=r.identifier.parent;if(a&&b(a,`Property`)&&!a.computed&&a.key===r.identifier&&a.value!==r.identifier)return!0;let o=dc(r.identifier);if(!o)return!1;if(!oc(o.propertyPath,e.propertyPath))return!0;let s=j(r.identifier);if(s!==i&&!Lc(s,i,e.environment.scopes))return!!tc(r.identifier,o.propertyPath,e.propertyPath,e.environment.scopes);if(r.flag!==`read`)return!1;if(ac(o.propertyPath,e.propertyPath)){if(o.propertyPath.length>e.propertyPath.length){let t=o.expression.parent;return!!(o.propertyPath.length===e.propertyPath.length+1&&o.propertyPath[e.propertyPath.length]===`current`&&t&&b(t,`UnaryExpression`)&&t.operator===`void`&&t.argument===o.expression)}return Fc(o.expression,[],e.environment,t,n)}return Fc(o.expression,e.propertyPath.slice(o.propertyPath.length),e.environment,t,n)});return t.activePaths.delete(r),a},zc=(e,t,n)=>{if(!t)return!1;let r=Bt(e);if(!r)return!1;let i={filename:t,program:r,scopes:n},a={activePaths:new Set,activeRenderedChildrenComponents:new WeakSet,environmentsByProgram:new WeakMap([[r,i]])},o=xc(e,[],i);return o?Rc(o,a,12):Fc(e,[],i,a,12)},Bc=e=>{let t=[];for(let n of e)for(let e of n.entries){if(e.importName.kind===`NamespaceObject`)continue;let r=e.importName.kind===`Default`?`default`:e.importName.name??null;r!==null&&t.push({source:n.moduleRequest.value,exportedName:r})}return t},Vc=({absoluteFilePath:e,staticImports:t})=>{let n=!1;for(let r of t){let t=r.moduleRequest.value;if(!t.startsWith(`.`))continue;let i=r.entries.filter(e=>!e.isType);if(i.length===0)continue;let a=Vn(e,t);if(!(!a||!Oi(a))){n||(n=!0,Yr(e));for(let e of i){let t=e.importName.kind===`Default`?`default`:e.importName.name;t&&ro(a,t)}}}},Hc=({absoluteFilePath:e})=>{vr.test(e)&&(Sr.test(e)||li(e))},Uc=({absoluteFilePath:e,staticImports:t})=>{if(yr.test(e)&&!fi(e))for(let n of Bc(t))cr(e,n.source,n.exportedName)},H=({absoluteFilePath:e,staticImports:t})=>{Pe(e);for(let n of Bc(t))cr(e,n.source,n.exportedName)},Wc=({absoluteFilePath:e,getProgram:t})=>{let n=t();dn(n);let r=A(n);z(n,t=>{if(!b(t,`CallExpression`))return;let n=Se(t.callee,r);!n?.importedName||!n.source.startsWith(`.`)||cr(e,n.source,n.importedName)})},Gc=({absoluteFilePath:e,staticImports:t})=>{for(let n of Bc(t))R(e,n.source,n.exportedName)},Kc=(e,t,n,r)=>{let i=n.get(t);if(!(i!==void 0&&i<=r)){n.set(t,r);for(let i of e.body??[]){let e=pi(i);if(!e)continue;let a=ir(t,e);if(!a||r>=8)continue;let o=r+1,s=n.get(a);if(s!==void 0&&s<=o)continue;let c=bn(a);if(!c){n.set(a,o);continue}Kc(c,a,n,o)}}},qc=e=>{Gc(e);let t=e.getProgram(),n=!1;z(t,e=>{if(n)return!1;if(!b(e,`CallExpression`))return;let t=w(e.callee);if(!b(t,`MemberExpression`))return;let r=C(t);n=r===`add`||r===`set`}),n&&Kc(t,e.absoluteFilePath,new Map,0)},Jc=({absoluteFilePath:e,staticImports:t})=>{for(let n of Bc(t))io(e,n.source,n.exportedName)},Yc=e=>{let t=[];for(let n of e.body??[]){if(n.type!==`ImportDeclaration`)continue;let e=n.source?.value;if(typeof e==`string`){for(let r of n.specifiers??[])if(r.type===`ImportDefaultSpecifier`)t.push({source:e,exportedName:`default`});else if(r.type===`ImportSpecifier`){let n=r.imported,i=null;typeof n?.name==`string`?i=n.name:typeof n?.value==`string`&&(i=n.value),i&&t.push({source:e,exportedName:i})}}}return t},Xc=({absoluteFilePath:e,staticImports:t},n,r=()=>!0,i=()=>!0)=>{let a=new Map,o=(e,t,n)=>{if(!((a.get(e)??-1)>=n)){a.set(e,n);for(let a of Yc(t)){let t=R(e,a.source,a.exportedName);!t||n===0||!r(t)||!i(t.filePath)||o(t.filePath,t.programNode,n-1)}}};for(let a of Bc(t)){let t=R(e,a.source,a.exportedName);!t||!r(t)||!i(t.filePath)||o(t.filePath,t.programNode,n)}},Zc=e=>{let t=e.getProgram();dn(t);let n=A(t);z(t,t=>{if(b(t,`BlockStatement`))for(let[r,i]of t.body.entries()){let a=t.body[r+1];!b(i,`VariableDeclaration`)||!b(a,`VariableDeclaration`)||gr(i,a,n,e.absoluteFilePath)}})},Qc=e=>{Xc(e,4),Gc(e),We(e.absoluteFilePath,`@xstate/react`)},$c=({absoluteFilePath:e,sourceText:t,getProgram:n})=>{if(!t.includes(`createRef`)&&!t.includes(`\\u`))return;let r=n();dn(r);let i=A(r);z(r,t=>{!b(t,`CallExpression`)||!Qa(t,`createRef`,i,{allowGlobalReactNamespace:!0,allowUnboundBareCalls:!0,resolveNamedAliases:!0})||zc(t,e,i)})},el=({absoluteFilePath:e,sourceText:t,staticImports:n,getProgram:r})=>{let i=new Set,a=new Set;for(let e of n)if(e.moduleRequest.value===`react`)for(let t of e.entries){let{importName:e}=t;e.kind===`Name`&&e.name===`useReducer`?i.add(t.localName.value):(e.kind===`Default`||e.kind===`NamespaceObject`)&&a.add(t.localName.value)}if(!(i.size>0||a.size>0&&(t.includes(`useReducer`)||t.includes(`\\u`))))return;let o=r(),s=e=>{if(e?.type!==`Identifier`)return null;let{name:t}=e;return typeof t==`string`?t:null},c=e=>{let t=s(e);if(t!==null)return i.has(t);if(e.type!==`MemberExpression`)return!1;let n=e,r=s(n.object);return r!==null&&a.has(r)&&s(n.property)===`useReducer`},l=new Set;if(z(o,e=>{if(e.type!==`CallExpression`)return;let t=e;if(!t.callee||!c(t.callee))return;let n=t.arguments?.[0];if(!n)return;let r=s(w(n));r!==null&&l.add(r)}),l.size!==0)for(let t of n)for(let n of t.entries){if(n.importName.kind===`NamespaceObject`||!l.has(n.localName.value))continue;let r=n.importName.kind===`Default`?`default`:n.importName.name;r&&cr(e,t.moduleRequest.value,r)}},tl=({absoluteFilePath:e,staticImports:t,getProgram:n})=>{Yr(e),Xr({absoluteFilePath:e,staticImports:t,program:n()})},U=({absoluteFilePath:e})=>{Yr(e)},nl=e=>{U(e),Jc(e)},rl=e=>{U(e),Xc(e,1/0,e=>O(e.exportedNode),e=>!e.split(/[\\/]/).includes(`node_modules`))},il=({absoluteFilePath:e})=>{Vi(e)},al=({absoluteFilePath:e})=>{We(e,`react-native`)},ol=({absoluteFilePath:e})=>{Hi(e)},sl=e=>{ol(e),Xr({absoluteFilePath:e.absoluteFilePath,staticImports:e.staticImports,program:e.getProgram()})},cl=new Map([...re.map(e=>[e,ol]),[`ink-no-raw-text`,sl],[`client-passive-event-listeners`,H],[`effect-needs-cleanup`,H],[`effect-listener-cleanup-reference-mismatch`,H],[`exhaustive-deps`,Qc],[`rules-of-hooks`,Wc],[`no-barrel-import`,Vc],[`nextjs-async-dynamic-api-not-awaited`,U],[`nextjs-missing-metadata`,Hc],[`nextjs-no-use-search-params-without-suspense`,Uc],[`no-dynamic-import-path`,U],[`no-full-lodash-import`,U],[`no-hydration-branch-on-browser-global`,nl],[`no-indeterminate-attribute`,U],[`no-locale-format-in-render`,U],[`no-match-media-in-state-initializer`,U],[`no-create-ref-in-function-component`,$c],[`no-adjust-state-on-prop-change`,H],[`no-set-state-after-await-in-effect`,H],[`forwarded-set-state-in-effect`,H],[`no-derived-state`,H],[`no-derived-state-effect`,H],[`no-event-handler`,H],[`no-initialize-state`,H],[`no-reset-all-state-on-prop-change`,H],[`no-mutating-reducer-state`,el],[`no-side-effect-in-state-updater-function`,qc],[`no-unguarded-browser-global-at-module-scope`,Jc],[`no-unguarded-browser-global-in-render-or-hook-init`,rl],[`prefer-dynamic-import`,U],[`rendering-hydration-mismatch-time`,U],[`rendering-hydration-no-flicker`,H],[`rerender-memo-with-default-value`,Qc],[`server-sequential-independent-await`,Zc],[`rn-no-deprecated-modules`,al],[`rn-no-legacy-shadow-styles`,il],[`rn-no-raw-text`,tl],[`rn-prefer-expo-image`,U],[`rn-style-prefer-boxshadow`,il],...se.map(e=>[e,U])]),ll=new Set([`anchor-target-exists`,`nextjs-no-img-element`,`no-img-without-dimensions`,`no-loading-flag-reset-outside-finally`,`only-export-components`,`remotion-calculate-metadata-fetch-signal`,`remotion-deterministic-randomness`,`remotion-no-css-animation`,`remotion-no-css-transition`,`remotion-no-css-url-assets`,`remotion-no-native-media-elements`,`remotion-no-next-image`,`window-open-without-noopener`]),ul=e=>{let t=new Set;for(let n of e.ruleIds){let e=cl.get(n);if(!e)return null;t.add(e)}let n=eo(e.absoluteFilePath),r,i;try{let t=gn(n,e.sourceText);if(t.errors.some(e=>e.severity===`Error`))return null;r=t.module.staticImports;let a;i=()=>(a??=t.program,a)}catch{return null}let a={absoluteFilePath:n,sourceText:e.sourceText,staticImports:r,getProgram:i};return De(()=>{for(let e of t)e(a)})},dl={},fl=(e,t,n)=>!e||e.length===0?!1:e.every(e=>b(e,t)&&e[n]===`type`),pl=e=>e.importKind===`type`||fl(e.specifiers,`ImportSpecifier`,`importKind`),ml=new Set([`solid-js`,`solid-js/web`,`solid-js/store`,`solid-js/h`,`solid-js/html`,`@builder.io/qwik`,`@builder.io/qwik-city`,`@builder.io/qwik-react`,`voby`,`vidode`]),hl=[`solid-js`,`@builder.io/qwik`],gl=[`react`,`react-dom`,`preact`],_l=new WeakMap,vl=new WeakMap,yl=(e,t)=>t.some(t=>e===t||e.startsWith(`${t}/`)),bl=e=>{let t=_l.get(e);if(t)return t;let n=!1,r=!1,i=!1,a=!1,o=!1,s=!1;for(let t of e.body){if(i||z(t,e=>{if(i)return!1;if(b(e,`JSXOpeningElement`)&&xl(e))return i=!0,!1;b(e,`JSXOpeningElement`)&&b(e.name,`JSXIdentifier`)&&/^[a-z]/.test(e.name.name)&&e.attributes.some(e=>b(e,`JSXAttribute`)&&Ms(e.name)===`class`)&&(s=!0)}),!b(t,`ImportDeclaration`))continue;let e=t,c=e.source,l=c&&typeof c.value==`string`?c.value:null;if(l){if(l===`solid-js`)for(let t of e.specifiers){if(!b(t,`ImportSpecifier`)||e.importKind!==`type`&&t.importKind!==`type`)continue;let n=x(t);n===`Component`&&(a=!0),n===`JSX`&&(o=!0)}pl(e)||((ml.has(l)||yl(l,hl))&&(n=!0),yl(l,gl)&&(r=!0))}}let c={hasNonReactMarker:i||a||o&&s,hasNonReactRuntime:n,hasReactRuntime:r};return _l.set(e,c),c},xl=e=>{let t=vl.get(e);if(t!==void 0)return t;let n=!1;for(let t of e.attributes){if(!b(t,`JSXAttribute`))continue;let r=Ms(t.name);if(r&&(r===`classList`&&b(t.value,`JSXExpressionContainer`)&&b(t.value.expression,`ObjectExpression`)||b(e.name,`JSXIdentifier`)&&/^[a-z]/.test(e.name.name)&&(r.startsWith(`class:`)||r.startsWith(`bind:`)||r.startsWith(`on:`)||r.startsWith(`oncapture:`)))){n=!0;break}}return vl.set(e,n),n},Sl=new Set(`/playground/./playgrounds/./examples/./example/./demo/./demos/./sandbox/./sandboxes/./specs/./spec/./integration/./it/./perf/./scripts/./cli/./bin/./tooling/./tools/./codemods/./codemod/./migrations/./migration/./generators/./generator/./runbooks/./devtools/./internal-tools/./seeds/./seed/./dev-seeder/`.split(`.`)),Cl=new Set,wl=[`/test/`,`/tests/`,`/testing/`,`/__tests__/`,`/__test__/`,`/__fixtures__/`,`/fixtures/`,`/__mocks__/`,`/mocks/`,`/testUtils/`,`/test-utils/`,`/test-stubs/`,`/testutils/`,`/cypress/`,`/playwright/`,`/.storybook/`,`/.dumi/`,`/stories/`,`/__stories__/`,...Sl,`/e2e/`,`/e2e-tests/`,`/integration-tests/`,`/benchmarks/`,`/benchmark/`,`/__benchmarks__/`,`/perf-tests/`],Tl=[`.test.`,`.spec.`,`.cy.`,`.stories.`,`.story.`,`.bench.`,`.benchmark.`,`.e2e.`,`.integration-spec.`,`.int-spec.`,`.mock.`,`.mocks.`,`.fixture.`],El=new Set(`setuptests.js,setuptests.ts,setuptests.jsx,setuptests.tsx,setupvitest.js,setupvitest.ts,setupvitest.jsx,setupvitest.tsx,setupjest.js,setupjest.ts,vitest.setup.js,vitest.setup.ts,vitest.setup.mjs,vitest.config.ts,vitest.config.js,vitest.config.mts,vitest.config.mjs,jest.setup.js,jest.setup.ts,jest.setup.jsx,jest.setup.tsx,jest.config.js,jest.config.ts,jest.config.mjs,playwright.config.ts,playwright.config.js,cypress.config.ts,cypress.config.js,karma.conf.js,karma.conf.ts,vite.config.ts,vite.config.js,vite.config.mts,vite.config.mjs,webpack.config.ts,webpack.config.js,webpack.config.mjs,rollup.config.ts,rollup.config.js,rollup.config.mjs,esbuild.config.ts,esbuild.config.js,esbuild.config.mjs,tsup.config.ts,tsup.config.js,tsup.config.mjs,rsbuild.config.ts,rsbuild.config.js,rspack.config.ts,rspack.config.js,next.config.ts,next.config.js,next.config.mjs,remix.config.js,remix.config.ts,astro.config.ts,astro.config.js,astro.config.mjs,tailwind.config.ts,tailwind.config.js,tailwind.config.mjs,postcss.config.ts,postcss.config.js,postcss.config.mjs,biome.config.ts,biome.config.js,drizzle.config.ts,drizzle.config.js,prisma.config.ts,prisma.config.js,knip.config.ts,knip.config.js,knip.config.mjs,lint-staged.config.js,lint-staged.config.mjs`.split(`,`)),Dl=[`/src/`,`/app/`,`/lib/`,`/components/`,`/pages/`,`/features/`,`/modules/`,`/packages/`,`/apps/`,`/frontend/`,`/client/`],Ol=wl.filter(e=>e.startsWith(`/.`)),kl=e=>{let t=-1;for(let n of Dl){let r=e.lastIndexOf(n);r>t&&(t=r)}return t<0?e:e.slice(t)};let Al,jl=!1,Ml,Nl=!1;const Pl=e=>e?e===Al?jl:(Al=e,jl=Ll(e),jl):!1,Fl=e=>{if(!e)return!1;if(e===Ml)return Nl;Ml=e;let t=e.replaceAll(`\\`,`/`),n=t.startsWith(`/`)?t:`/${t}`;return Nl=Ll(n,Dl.some(e=>n.includes(e))?Sl:Cl),Nl},Il=(e,t)=>e?Ll(e,t):!1,Ll=(e,t=Cl)=>{let n=e.replaceAll(`\\`,`/`),r=n.lastIndexOf(`/`),i=r===-1?n:n.slice(r+1);if(El.has(i.toLowerCase()))return!0;for(let e of Tl)if(i.includes(e))return!0;let a=n.startsWith(`/`)?n:`/${n}`;for(let e of Ol)if(!t.has(e)&&a.includes(e))return!0;let o=kl(n);for(let e of wl)if(!t.has(e)&&(e.startsWith(`/.`)?n:o).includes(e))return!0;return!1},Rl=(e,t=Pl)=>n=>t(n.filename)?dl:e(n),zl=e=>{let t=e?.[`react-doctor`];return typeof t!=`object`||!t||Array.isArray(t)?null:t},Bl=(e,t)=>Object.getOwnPropertyDescriptor(e,t)?.value,Vl=(e,t)=>{let n=zl(e);if(!n)return;let r=Bl(n,t);return typeof r==`string`?r:void 0},Hl=(e,t)=>{let n=zl(e);if(!n)return;let r=Bl(n,t);return typeof r==`number`&&Number.isFinite(r)?r:void 0},Ul=new WeakMap,Wl=(e,t)=>{let n=Bl(e,t);if(Array.isArray(n))return n.filter(e=>typeof e==`string`&&e.length>0)},Gl=(e,t)=>{let n=zl(e);if(!n)return;let r=Ul.get(n);if(r||(r=new Map,Ul.set(n,r)),r.has(t))return r.get(t);let i=Wl(n,t);return r.set(t,i),i},Kl=(e,t)=>Gl(e,t)??[],ql=(e,t)=>Kl(e,`capabilities`).includes(t),Jl=(e,t)=>{let n=zl(e);return!n||Bl(n,`capabilities`)===void 0?!0:ql(e,t)},Yl=(e,t,n)=>!t?.some(t=>!Jl(e,t))&&!n?.some(t=>ql(e,t)),Xl=(e,t,n)=>r=>Yl(r.settings,t,n)?e(r):dl,Zl=e=>(t=>{let n=e(t),r=!1,i=!1,a={};for(let e in n){if(!Object.hasOwn(n,e))continue;let t=n[e];if(typeof t!=`function`){a[e]=t;continue}let o=e.charAt(0);if(o<`A`||o>`Z`){a[e]=t;continue}if(e===`Program`){a.Program=e=>{let n=bl(e);i=n.hasReactRuntime,r=!n.hasReactRuntime&&(n.hasNonReactRuntime||n.hasNonReactMarker),!r&&t(e)};continue}if(e===`JSXOpeningElement`){a.JSXOpeningElement=e=>{!i&&!r&&xl(e)&&(r=!0),!r&&t(e)};continue}a[e]=e=>{r||t(e)}}return`Program`in a||(a.Program=e=>{let t=bl(e);i=t.hasReactRuntime,r=!t.hasReactRuntime&&(t.hasNonReactRuntime||t.hasNonReactMarker)}),a}),W=e=>{if(!(`create`in e))return{...e,create:()=>dl};let t=e.tags,n=e.create,r=t?.includes(`test-noise`)&&!t?.includes(`migration-hint`);return t?.includes(`react-jsx-only`)&&(n=Zl(n)),r&&(n=Rl(n,Fl)),(e.requires||e.disabledWhen)&&(n=Xl(n,e.requires,e.disabledWhen)),n===e.create?e:{...e,create:n}};let Ql;const $l=e=>{let t=[0];for(let n=0;n<e.length;n+=1){let r=e[n];if(r===`\r`&&e[n+1]===`
+Calling setState synchronously within an effect body causes cascading renders that can hurt performance, and is not recommended. (https://react.dev/learn/you-might-not-need-an-effect)`,Ta=new Set([`useEffect`,`useLayoutEffect`,`useMemo`,`useCallback`]),Ea=new Set([`useReducer`]),Da=new Set([`use`,`useState`,`useRef`,`useMemo`,`useCallback`,`useReducer`,`useContext`,`useEffect`,`useLayoutEffect`,`useInsertionEffect`,`useImperativeHandle`,`useSyncExternalStore`,`useDeferredValue`,`useTransition`,`useId`,`useDebugValue`]),Oa=new Set([`memo`,`forwardRef`,`React.memo`,`React.forwardRef`]),ka=new Set([`useMemo`,`useCallback`]),Aa=new Set([`memo`,`forwardRef`,`observer`,`lazy`]),ja=new Set([`subscribe`,`addEventListener`,`addListener`,`on`,`watch`,`listen`,`sub`]),Ma=new Set([`subscribe`,`sub`,`listen`]),Na=new Set([`unsubscribe`,`removeEventListener`,`removeListener`,`off`,`unwatch`,`unlisten`,`unsub`,`abort`,`disconnect`,`unobserve`,`close`]),Pa=new Set([`remove`,`cleanup`,`dispose`,`destroy`,`stop`,`teardown`]),Fa=new Set([...Na,`cleanup`,`dispose`,`destroy`,`teardown`]),Ia=new Set([...ja,`connect`,`disconnect`,`open`,`close`,`fetch`,`post`,`put`,`patch`]),La=new Set([`get`,`head`,`options`,`delete`]),Ra=new Set([...Gi,...ta]),za=new Set([...Gi,`post`,`put`,`patch`,`navigate`,`navigateTo`,`showNotification`,`toast`,`alert`,`confirm`,`logVisit`,`captureEvent`]),Ba=new Set([`post`,`put`,`patch`,`delete`,`navigate`,`capture`,`track`,`logEvent`]),Va=new Set([`push`,`replace`]),Ha=new Set([`router`,`navigation`,`navigator`,`history`,`location`]),Ua=new Map([[`react_ujs`,new Set([`useContext`,`useContexts`])]]),Wa={},Ga=new WeakMap,Ka=(e,t)=>typeof e==`string`?e===t:e.has(t),qa=e=>{let t=Ga.get(e);if(t)return t;let n=e.declarationNode.parent,r=!!(e.kind===`import`&&n&&n.type===`ImportDeclaration`&&typeof n.source.value==`string`&&ua.has(n.source.value)),i={importedName:r?x(e.declarationNode):void 0,isReactImport:r};return Ga.set(e,i),i},Ja=e=>qa(e).isReactImport,Ya=(e,t,n,r)=>{if(e.type!==`Identifier`)return!1;let i=r?F(e,n):n.symbolFor(e);if(!i)return!1;let a=qa(i);return!!(a.isReactImport&&a.importedName&&Ka(t,a.importedName))},Xa=(e,t)=>{let n=F(e,t);if(!n)return!1;let r=qa(n);return r.isReactImport?n.declarationNode.type===`ImportDefaultSpecifier`||n.declarationNode.type===`ImportNamespaceSpecifier`||r.importedName===`default`:!1},Za=(e,t,n)=>e.type===`Identifier`?Xa(e,t)?!0:!!(n.allowGlobalReactNamespace&&e.name===`React`&&t.isGlobalReference(e)):!1,Qa=(e,t,n,r)=>{let i=n.symbolFor(e);if(!i||i.kind!==`const`||!i.initializer||i.declarationNode.type!==`VariableDeclarator`)return!1;let a=i.declarationNode.id;if(a.type!==`ObjectPattern`)return!1;for(let e of a.properties){if(e.type!==`Property`||e.value!==i.bindingIdentifier)continue;let a=S(e);return!!(a&&Ka(t,a)&&Za(w(i.initializer),n,r))}return!1},$a=(e,t,n,r=Wa)=>e.type===`CallExpression`?eo(e.callee,t,n,r):!1,eo=(e,t,n,r,i)=>{let a=w(e);if(r.resolveConditionalAliases&&a.type===`ConditionalExpression`)return eo(a.consequent,t,n,r,new Set(i))&&eo(a.alternate,t,n,r,new Set(i));if(a.type===`Identifier`){if(Ya(a,t,n,!!r.resolveNamedAliases)||r.resolveNamedAliases&&Qa(a,t,n,r))return!0;if(r.resolveConditionalAliases){let e=n.symbolFor(a);if(e?.kind===`const`&&e.initializer&&!i?.has(e.id)){let a=i??new Set;return a.add(e.id),eo(e.initializer,t,n,r,a)}}return!!(r.allowUnboundBareCalls&&Ka(t,a.name)&&n.isGlobalReference(a))}return a.type!==`MemberExpression`||!Ka(t,C(a)??``)?!1:Za(w(a.object),n,r)},to=e=>e.includes(`\\`)?e.replaceAll(`\\`,`/`):e,no=e=>{let t=new Set(e);if(t.size!==1)return null;let[n]=t;return n??null},ro=(e,t,n,r)=>{let i=Vn(e,n);return i?io(i,t,new Set(r))||(si(i,t)?i:null):null},io=(e,t,n=new Set)=>{if(n.has(e))return null;n.add(e);let r=Di(e);if(!r.isBarrel)return null;let i=r.exportsByName.get(t);if(i){let t=Vn(e,i.source);return t?io(t,i.importedName,n)??t:null}return t===`default`?null:no(r.starExportSources.map(r=>ro(e,t,r,n)).filter(e=>!!e))},ao=(e,t,n)=>{let r=R(e,t,n);return r?{filePath:r.filePath,node:r.exportedNode,programNode:r.programNode,kind:O(r.exportedNode)?`function`:`initializer`}:null},oo=(e,t)=>{if(!b(e,`ArrowFunctionExpression`)&&!b(e,`FunctionExpression`)&&!b(e,`FunctionDeclaration`))return null;let n=e.params[0],r=b(n,`AssignmentPattern`)?n.left:n;if(b(r,`ObjectPattern`)){let e=r.properties.find(e=>b(e,`Property`)&&S(e,{allowComputedString:!0})===`children`);if(!e||!b(e,`Property`))return null;let n=b(e.value,`AssignmentPattern`)?e.value.left:e.value;if(!b(n,`Identifier`))return null;let i=t.symbolFor(n);return!i||i.references.length===0||i.references.some(e=>e.flag!==`read`)?null:i.references.map(e=>e.identifier)}if(!b(r,`Identifier`))return null;let i=t.symbolFor(r);if(!i||i.references.length===0)return null;let a=[];for(let e of i.references){if(e.flag!==`read`)return null;let t=[],n=P(e.identifier);for(;n.parent&&b(n.parent,`MemberExpression`)&&n.parent.object===n;){let e=C(n.parent);if(!e)return null;t.push(e),n=P(n.parent)}if(t[0]!==`children`){if(t.length===0)return null;continue}if(t.length!==1)return null;a.push(n)}return a.length>0?a:null},so=e=>{let t=new Map,n=e.body??[];for(let e of n){if(e.type!==`ImportDeclaration`||!(`source`in e)||!e.source)continue;let n=e.source.value;if(typeof n==`string`&&!(!(`specifiers`in e)||!Array.isArray(e.specifiers)))for(let r of e.specifiers){if(!(`local`in r)||!r.local)continue;let e=r.local;if(typeof e.name==`string`){if(r.type===`ImportDefaultSpecifier`)t.set(e.name,{source:n,imported:null,isDefault:!0,isNamespace:!1});else if(r.type===`ImportNamespaceSpecifier`)t.set(e.name,{source:n,imported:null,isDefault:!1,isNamespace:!0});else if(r.type===`ImportSpecifier`){let i=r.imported,a=i?.name??(typeof i?.value==`string`?i.value:null);t.set(e.name,{source:n,imported:a,isDefault:!1,isNamespace:!1})}}}}return t},co=new WeakMap,lo=e=>{let t=Bt(e);if(!t)return null;let n=co.get(t);return n||(n=so(t),co.set(t,n)),n},uo=(e,t)=>{let n=lo(e);if(!n)return!1;for(let e of n.values())if(t.includes(e.source))return!0;return!1},fo=(e,t,n)=>{let r=lo(e);if(!r)return!1;let i=r.get(t);return i?i.source===n:!1},po=(e,t,n)=>{let r=lo(e);if(!r)return!1;let i=r.get(t);return i?i.isNamespace&&i.source===n:!1},mo=(e,t,n)=>{let r=lo(e);if(!r)return!1;let i=r.get(t);return i?i.isDefault&&i.source===n:!1},ho=(e,t,n)=>{let r=lo(e);if(!r)return null;let i=r.get(t);return!i||i.source!==n?null:i.imported},go=(e,t)=>{let n=lo(e);return n?n.get(t)?.source??null:null},_o=(e,t)=>{let n=lo(e)?.get(t);return n?n.isNamespace?{source:n.source,exportedName:null,isNamespace:!0}:{source:n.source,exportedName:n.isDefault?`default`:n.imported,isNamespace:!1}:null},vo=(e,t)=>{let n=e.parent;for(;n;){if(`typeParameters`in n){let e=n.typeParameters;if(e&&b(e,`TSTypeParameterDeclaration`)&&e.params.some(e=>b(e,`TSTypeParameter`)&&b(e.name,`Identifier`)&&e.name.name===t))return!0}n=n.parent}return!1},yo=e=>{if(!b(e,`Identifier`)||vo(e,e.name))return!1;let t=_o(e,e.name);return!!(t&&t.source===`react`&&(t.isNamespace||t.exportedName===`default`))},bo=e=>{let t=Bt(e);return!t||!b(t,`Program`)?!1:t.body.some(e=>b(e,`TSModuleDeclaration`)&&b(e.id,`Identifier`)&&e.id.name===`JSX`)},xo=(e,t)=>{if(!b(e,`TSTypeReference`))return!1;let n=e.typeName;if(b(n,`Identifier`)){if(vo(n,n.name))return!1;let e=ho(n,n.name,`react`);return e===`ReactElement`||t&&e===`ReactNode`}if(!b(n,`TSQualifiedName`)||!b(n.right,`Identifier`))return!1;if((n.right.name===`ReactElement`||t&&n.right.name===`ReactNode`)&&yo(n.left))return!0;if(n.right.name!==`Element`)return!1;if(b(n.left,`Identifier`)){if(n.left.name!==`JSX`)return!1;let e=_o(n.left,n.left.name);return e?e.source===`react`&&e.exportedName===`JSX`:!bo(n.left)}return b(n.left,`TSQualifiedName`)&&b(n.left.right,`Identifier`)&&n.left.right.name===`JSX`&&yo(n.left.left)},So=(e,t)=>b(e,`TSUnionType`)?t?e.types.every(e=>b(e,`TSNullKeyword`)||b(e,`TSUndefinedKeyword`)||So(e,t)):e.types.some(e=>So(e,t)):xo(e,t),Co=(e,t=!1)=>{let n=Reflect.get(e,`returnType`);return b(n,`TSTypeAnnotation`)?So(n.typeAnnotation,t):!1},wo=e=>{let t=e,n=t.parent;for(;n&&w(n)===e;)t=n,n=t.parent;return n&&b(n,`AssignmentExpression`)&&n.operator===`=`&&n.left===t?n.right:null},To=e=>{let t=e.range?.[0];return typeof t==`number`?t:null},Eo=new Set([`let`,`var`]),Do=new Set([`ConditionalExpression`,`LogicalExpression`]),Oo=new WeakMap,ko=(e,t,n)=>{let r=e.parent??null;for(;r&&n.blockOf(r)===t;){if(Do.has(r.type))return!0;r=r.parent??null}return!1},Ao=(e,t)=>e.size===t.size&&[...e].every(e=>t.has(e)),jo=(e,t)=>{let n=new Set(e);for(let e of t)e.isConditionalWithinBlock||(n=new Set),n.add(e);return n},Mo=(e,t,n)=>{let r=j(t);if(j(e.bindingIdentifier)!==r||!r)return[];let i=n.cfgFor(r);if(!i)return[];let a=i.blockOf(t);if(!a)return[];let o=To(t),s=To(e.bindingIdentifier);if(o===null||s===null)return[];let c=new Map,l=(e,t,n)=>{let r=i.blockOf(t);if(!r)return;let a=c.get(r)??[];a.push({expression:e,position:n,isConditionalWithinBlock:ko(t,r,i)}),c.set(r,a)};e.initializer&&l(e.initializer,e.bindingIdentifier,s);for(let t of e.references){let e=To(t.identifier);if(t.flag===`read`||j(t.identifier)!==r||e===null||e>=o)continue;let n=wo(t.identifier);n&&l(n,t.identifier,e)}for(let e of c.values())e.sort((e,t)=>e.position-t.position);let u=new Map,d=new Map,f=new Set([i.entry]),p=[i.entry];for(;p.length>0;){let e=p.pop();if(!e)break;for(let t of e.successors)f.has(t.to)||(f.add(t.to),p.push(t.to))}if(!f.has(a))return[];let m=!0;for(;m;){m=!1;for(let e of i.blocks){if(!f.has(e))continue;let t=new Set;for(let n of e.predecessors)if(f.has(n.from))for(let e of d.get(n.from)??[])t.add(e);let n=jo(t,c.get(e)??[]),r=u.get(e)??new Set,i=d.get(e)??new Set;(!Ao(t,r)||!Ao(n,i))&&(u.set(e,t),d.set(e,n),m=!0)}}let h=(c.get(a)??[]).filter(e=>e.position<o);return[...jo(u.get(a)??new Set,h)].map(e=>e.expression)},No=(e,t,n)=>{if(!Eo.has(e.kind))return e.initializer?[e.initializer]:[];if(!n)return[];let r=Oo.get(n);r||(r=new WeakMap,Oo.set(n,r));let i=r.get(e);i||(i=new WeakMap,r.set(e,i));let a=i.get(t);if(a)return a;let o=Mo(e,t,n);return i.set(t,o),o},Po=e=>{if(!O(e)||!b(e.body,`BlockStatement`))return[];let t=[];return z(e.body,n=>{if(n!==e.body&&(O(n)||b(n,`ClassDeclaration`)||b(n,`ClassExpression`)))return!1;b(n,`ReturnStatement`)&&t.push(n)}),t},B=e=>{if(b(e,`ReturnStatement`)||b(e,`ThrowStatement`))return!0;if(b(e,`IfStatement`)){if(b(e.test,`Literal`)){let t=e.test.value?e.consequent:e.alternate;return t?B(t):!1}return!!(e.alternate&&B(e.consequent)&&B(e.alternate))}if(b(e,`TryStatement`))return e.finalizer&&B(e.finalizer)?!0:B(e.block)?e.handler?B(e.handler.body):!0:!1;if(b(e,`DoWhileStatement`))return B(e.body);if(b(e,`WhileStatement`)){let t=e.test;return!!(b(t,`Literal`)&&t.value&&B(e.body))}if(b(e,`ForStatement`)){let t=e.test;return!!((!t||b(t,`Literal`)&&t.value)&&B(e.body))}return b(e,`BlockStatement`)?e.body.some(e=>B(e)):!1},Fo=new Set([`let`,`var`]),Io=e=>!O(e)||!e.body?[]:b(e.body,`BlockStatement`)?Po(e).flatMap(e=>e.argument?[e.argument]:[]):[e.body],Lo=e=>{if(!O(e)||!b(e.body,`BlockStatement`))return!1;let t=!1;return z(e.body,n=>{if(t||n!==e.body&&O(n))return!1;b(n,`ReturnStatement`)&&!n.argument&&(t=!0)}),t},Ro=(e,t,n,r=`some`)=>{let i=new Set,a=new Set,o,s=e=>{if(a.has(e))return!1;a.add(e);try{let t=Io(e);return r===`every`&&O(e)&&b(e.body,`BlockStatement`)&&(!B(e.body)||Lo(e))?!1:t.length>0&&(r===`every`?t.every(o):t.some(o))}finally{a.delete(e)}};o=a=>{let l=w(a);if(i.has(l))return!1;i.add(l);try{if(t(l))return!0;if(b(l,`Identifier`)){let t=e.symbolFor(l);if(!t||t.kind!==`const`&&!Fo.has(t.kind))return!1;let i=No(t,l,n),a=e=>{let t=w(e);return!O(t)&&o(t)};return r===`every`?i.length>0&&i.every(a):i.some(a)}if(b(l,`CallExpression`)){if(l.arguments.length!==0||!b(l.callee,`Identifier`))return!1;let t=e.symbolFor(l.callee);if(!t||t.kind!==`const`&&t.kind!==`function`)return!1;let n=t.initializer?w(t.initializer):null,r=null;return O(n)?r=n:O(t.declarationNode)&&(r=t.declarationNode),!r||r.async||r.generator||r.params.length!==0?!1:s(r)}return b(l,`ConditionalExpression`)?c(l.consequent,l.alternate):b(l,`LogicalExpression`)?c(l.left,l.right):!1}finally{i.delete(l)}};let c=(e,t)=>{let n=[o(e),o(t)];return r===`every`?n.every(Boolean):n.some(Boolean)};return{expressionMatches:o,functionMatches:s}},zo=(e,t,n,r,i=`some`)=>Ro(t,n,r,i).functionMatches(e),Bo=(e,t,n,r,i)=>{let a=i.cfgFor(e),o=a?.blockOf(t);if(!a||!o)return!1;let s=new Set(Po(e).flatMap(e=>{if(!e.argument||!Ro(n,r,i,`every`).expressionMatches(e.argument))return[];let t=a.blockOf(e.argument);return t?[t]:[]}));if(s.size===0)return!1;let c=new Set([o]),l=[o];for(;l.length>0;){let e=l.pop();if(!e)break;if(!s.has(e))for(let t of e.successors){if(t.to===a.exit)return!1;c.has(t.to)||(c.add(t.to),l.push(t.to))}}return!0},Vo=e=>b(e,`Program`)?e.range[1]:e.range[0],Ho=new WeakMap,Uo=new WeakMap,Wo=(e,t)=>{let n=w(e);return b(n,`Identifier`)?t.symbolFor(n):null},Go=(e,t)=>{let n=P(e),r=n.parent;return!r||!b(r,`AssignmentExpression`)||r.operator!==`=`||r.left!==n?null:Wo(r.right,t)},Ko=e=>{let t=P(e),n=t.parent;return n&&b(n,`VariableDeclarator`)&&n.init===t&&(b(n.id,`Identifier`)||b(n.id,`ObjectPattern`))?!0:!!(n&&b(n,`AssignmentExpression`)&&n.operator===`=`&&n.right===t&&b(w(n.left),`Identifier`))},qo=(e,t,n)=>{if(e.initializer&&b(e.declarationNode,`VariableDeclarator`)&&e.declarationNode.id===e.bindingIdentifier){let r=Wo(e.initializer,n);if(r&&t.has(r.id))return!0}return e.references.some(e=>{let r=Go(e.identifier,n);return!!(r&&t.has(r.id))})},Jo=(e,t)=>{let n=F(e,t);if(!n)return[];let r=Ho.get(t);r||(r=new Map,Ho.set(t,r));let i=r.get(n.id);if(i)return i;let a=[],o=[t.rootScope];for(;o.length>0;){let e=o.pop();e&&(a.push(...e.symbols),o.push(...e.children))}let s=new Set([n.id]),c=!0;for(;c;){c=!1;for(let e of a)s.has(e.id)||qo(e,s,t)&&(s.add(e.id),c=!0)}let l=a.filter(e=>s.has(e.id));return r.set(n.id,l),l},Yo=e=>{let t=e;for(;t;){if(O(t)||b(t,`Program`))return t;t=t.parent??null}return null},Xo=new WeakMap,Zo=(e,t)=>{let n=Xo.get(t);if(!n){let r=new Map,i=new Map,a=Bt(e);a&&z(a,e=>{if(!b(e,`CallExpression`))return;let n=w(e.callee),a=b(n,`Identifier`)?t.symbolFor(n):null,o=a?i.get(a.id):void 0;o===void 0&&(o=cn(e.callee,t),a&&i.set(a.id,o));for(let t of o){let n=r.get(t)??[];n.push(e),r.set(t,n)}}),n=r,Xo.set(t,n)}return n.get(e)??[]},Qo=new WeakMap,$o=(e,t)=>{let n=Qo.get(t);if(n===void 0){let e=null;z(t,n=>{b(n,`AwaitExpression`)&&j(n)===t&&(e===null||n.range[0]<e)&&(e=n.range[0])}),n=e,Qo.set(t,n)}return n===null||e.range[0]<n},es=(e,t,n,r=new Set,i=null,a)=>{if(r.has(e)||!O(e)||e.generator||i!==null&&!Jt(i,e)||i!==null&&a!==void 0&&!a(i)||i!==null&&e.async&&!$o(i,e))return[];r.add(e);let o=Yo(t);return o?Zo(e,n).flatMap(e=>{let s=Yo(e);return!s||i!==null&&!Jt(e,s)||i!==null&&a!==void 0&&!a(e)?[]:s===o?e.range[0]<Vo(t)?[[e.range[0]]]:[]:O(s)?es(s,t,n,new Set(r),i===null?null:e,a).map(t=>[...t,e.range[0]]):[]}):[]},ts=(e,t,n,r=new Set,i=null)=>es(e,t,n,r,i).length>0,ns=e=>{let t=e.parent;return t?b(t,`AssignmentExpression`)?t.left===e:(b(t,`UpdateExpression`)||b(t,`UnaryExpression`)&&t.operator===`delete`)&&t.argument===e:!1},rs=e=>{let t=e.parent;for(;t&&w(t)===e;)t=t.parent;return!t||!b(t,`MemberExpression`)||w(t.object)!==e||!ns(t)?null:t},is=(e,t,n)=>{let r=rs(e);return r&&I(r,n)===t?r:null},as=(e,t,n,r)=>e.references.some(e=>{let i=is(e.identifier,t,r);if(!i)return!1;let a=Yo(i),o=Yo(n);return!a||!o||!Jt(i,a)?!1:a===o?i.range[0]<Vo(n):O(a)&&ts(a,n,r)}),os=e=>{if(Ko(e))return!0;let t=P(e),n=t.parent;return!!(n&&b(n,`MemberExpression`)&&w(n.object)===t)},ss=e=>{if(Ko(e))return!0;let t=P(e),n=t.parent;if(!n||!b(n,`MemberExpression`)||w(n.object)!==t)return!1;let r=P(n),i=r.parent;return!(i&&b(i,`CallExpression`)&&i.callee===r)},cs=(e,t,n)=>b(e,`Identifier`)?Jo(e,n).some(e=>e.references.some(e=>{let r=rs(e.identifier);if(!r)return!1;let i=I(r,n);return i===null||i===t})):!1,ls=(e,t,n)=>{let r=Yo(e),i=Yo(t);return!r||!i?!0:r===i?e.range[0]<Vo(t):O(r)?ts(r,t,n):!0},us=(e,t,n,r)=>b(e,`Identifier`)?Jo(e,r).some(e=>e.references.some(e=>{let i=rs(e.identifier);if(!i||!ls(i,n,r))return!1;let a=I(i,r);return a===null||a===t})):!1,ds=(e,t,n)=>{if(!b(e,`Identifier`))return!1;let r=F(e,n);if(!r)return!1;let i=Uo.get(n)??new Map;Uo.set(n,i);let a=i.get(r.id)??new Map;i.set(r.id,a);let o=a.get(t);if(o!==void 0)return o;let s=cs(e,t,n)||Jo(e,n).some(e=>e.references.some(e=>!os(e.identifier)));return a.set(t,s),s},fs=(e,t,n,r)=>b(e,`Identifier`)?us(e,t,n,r)?!0:Jo(e,r).some(e=>e.references.some(e=>!ss(e.identifier)&&ls(e.identifier,n,r))):!1,ps=(e,t)=>{let n=w(e);if(!b(n,`CallExpression`))return!1;let r=w(n.callee);if(!b(r,`MemberExpression`))return!1;let i=C(r);if(i===null)return!1;let a=w(r.object);return b(a,`Identifier`)&&cs(a,i,t)},ms=(e,t,n,r)=>b(e,`Identifier`)?Wt(e,r).some(e=>as(e,t,n,r)):!1,hs=(e,t,n,r={})=>{let i=j(e);return i===j(t)?e.range[0]>=Vo(t)||r.requireSynchronousWrite&&(!i||!Jt(e,i)||r.isSynchronousNode!==void 0&&!r.isSynchronousNode(e))?[]:[[e.range[0]]]:i?r.requireSynchronousWrite?es(i,t,n,new Set,e,r.isSynchronousNode).map(t=>[...t,e.range[0]]):es(i,t,n).map(t=>[...t,e.range[0]]):r.requireSynchronousWrite?[]:[[-1/0,e.range[0]]]},gs=(e,t,n,r={})=>hs(e,t,n,r).length>0,V=(e,t,n,r={})=>e.references.some(e=>e.flag===`read`?!1:gs(e.identifier,t,n,r)),_s=(e,t)=>{if(!b(e,`CallExpression`))return!1;let n=w(e.callee);if(b(n,`Identifier`)){let e=t.symbolFor(n);return!!(e&&!V(e,n,t))}if(!b(n,`MemberExpression`))return!1;let r=C(n),i=w(n.object);return!!(r&&b(i,`Identifier`)&&!ms(i,r,n,t))},vs=new Set([`FunctionDeclaration`,`FunctionExpression`,`ArrowFunctionExpression`,`ClassDeclaration`,`ClassExpression`]),ys={allowGlobalReactNamespace:!1,allowUnboundBareCalls:!1},bs=new Set([`lodash/sortBy`,`lodash/sortBy.js`,`lodash-es/sortBy`,`lodash-es/sortBy.js`]),xs=e=>b(e,`TSArrayType`)||b(e,`TSTupleType`)?!0:b(e,`TSTypeReference`)?b(e.typeName,`Identifier`)&&(e.typeName.name===`Array`||e.typeName.name===`ReadonlyArray`):!1,Ss=e=>{if(!b(e,`Identifier`))return!1;let t=e.typeAnnotation;return!!(t&&b(t,`TSTypeAnnotation`)&&xs(t.typeAnnotation))},Cs=(e,t)=>{if(!b(e,`CallExpression`))return!1;let n=w(e.callee);if(!b(n,`Identifier`))return!1;let r=t.symbolFor(n);if(!r||V(r,n,t)||!b(r.declarationNode,`ImportDefaultSpecifier`)&&!b(r.declarationNode,`ImportSpecifier`))return!1;let i=_o(n,n.name);return!i||i.isNamespace?!1:bs.has(i.source)&&i.exportedName===`default`?!0:(i.source===`lodash`||i.source===`lodash-es`)&&i.exportedName===`sortBy`},ws=(e,t,n,r=new Set)=>{let i=w(e);if(b(i,`ArrayExpression`)||Cs(i,t))return!0;if(!b(i,`Identifier`))return!1;let a=t.symbolFor(i);return!a||r.has(a.id)||V(a,n,t)?!1:Ss(a.bindingIdentifier)?!0:a.initializer?(r.add(a.id),ws(a.initializer,t,n,r)):!1},Ts=(e,t)=>{if(!b(e,`CallExpression`))return!1;let n=w(e.callee);if(!b(n,`MemberExpression`)||C(n)!==`map`)return!1;let r=w(n.object);return ws(r,t,e)?!(b(r,`Identifier`)&&ms(r,`map`,e,t)):!1},Es=(e,t)=>{if(e.type!==`ArrowFunctionExpression`&&e.type!==`FunctionExpression`)return!1;let n=e.parent;if(b(n,`CallExpression`))return $a(n,`useMemo`,t,{resolveNamedAliases:!0})&&_s(n,t)?n.arguments[0]===e:n.arguments.some(t=>t===e)&&Ts(n,t);if(b(n,`Property`)&&n.kind===`init`&&n.value===e){let e=n.parent;if(!b(e,`ObjectExpression`))return!1;let r=e.parent;if(!b(r,`CallExpression`)||!r.arguments.some(t=>t===e)||!_s(r,t))return!1;let i=sn(r.callee,t);return!!(i&&Co(i,!0))}return!1},Ds=(e,t)=>vs.has(e.type)&&!Es(e,t),Os=(e,t)=>e.type===`JSXElement`||e.type===`JSXFragment`||$a(e,`createElement`,t,ys)||ks(e,t),ks=(e,t)=>{if(!b(e,`CallExpression`))return!1;let n=w(e.callee);if(b(n,`Identifier`))return t.symbolFor(n)?.kind===`import`&&ho(n,n.name,`react-dom`)===`createPortal`;if(!b(n,`MemberExpression`)||n.computed||!b(n.object,`Identifier`)||!b(n.property,`Identifier`)||n.property.name!==`createPortal`)return!1;let r=t.symbolFor(n.object);return!r||r.kind!==`import`?!1:mo(n.object,n.object.name,`react-dom`)||po(n.object,n.object.name,`react-dom`)},As=(e,t)=>{if(Ds(e,t))return!1;let n=!1;return z(e,r=>{if(n||r!==e&&Ds(r,t))return!1;if(Os(r,t))return n=!0,!1}),n},js=new WeakMap,Ms=(e,t,n)=>{let r=js.get(e);if(r&&r.scopes===t&&r.controlFlow===n)return r.hasRenderOutput;let i=zo(e,t,e=>As(e,t),n);return js.set(e,{scopes:t,controlFlow:n,hasRenderOutput:i}),i},Ns=e=>b(e,`JSXIdentifier`)?e.name:b(e,`JSXNamespacedName`)?`${e.namespace.name}:${e.name.name}`:null,Ps=new Set([`Component`,`PureComponent`]),Fs=(e,t,n,r)=>{let i=w(e);if(b(i,`MemberExpression`)){let e=C(i),n=w(i.object);return!!(e&&Ps.has(e)&&b(n,`Identifier`)&&!ms(n,e,i,t)&&Xa(n,t))}if(b(i,`ClassExpression`))return Is(i,t,n,r);if(!b(i,`Identifier`))return!1;let a=t.symbolFor(i);if(!a||r.has(a.id)||V(a,i,t))return!1;if(r.add(a.id),Ja(a)){let e=x(a.declarationNode);return!!(e&&Ps.has(e))}return b(a.declarationNode,`ClassDeclaration`)||b(a.declarationNode,`ClassExpression`)?Is(a.declarationNode,t,n,r):!!(a.kind===`const`&&a.initializer&&Fs(a.initializer,t,n,r))},Is=(e,t,n=new Set,r=new Set)=>!b(e,`ClassDeclaration`)&&!b(e,`ClassExpression`)||n.has(e)||!e.superClass?!1:(n.add(e),Fs(e.superClass,t,n,r)),Ls=new Set([`FunctionDeclaration`,`FunctionExpression`,`ArrowFunctionExpression`,`MethodDefinition`,`Program`]),Rs=e=>{let t=e;for(;t;){if(Ls.has(t.type))return t;t=t.parent??null}return null},zs=(e,t)=>{if(t!==`let`&&t!==`const`)return Rs(e);let n=e.parent;for(;n;){if(n.type===`BlockStatement`){let t=n.parent;return t&&(t.type===`FunctionDeclaration`||t.type===`FunctionExpression`||t.type===`ArrowFunctionExpression`||t.type===`MethodDefinition`)?Rs(e):n}if(Ls.has(n.type))return n;n=n.parent??null}return null},Bs=(e,t,n,r)=>{if(b(e,`Identifier`)){let i=r.get(e.name)??[];i.push({bindingIdentifier:e,initializer:t,scopeOwner:n}),r.set(e.name,i);return}if(b(e,`ObjectPattern`)){for(let t of e.properties)if(b(t,`Property`)){let e=t.value;Bs(e,b(e,`AssignmentPattern`)?e.right:null,n,r)}else b(t,`RestElement`)&&Bs(t.argument,null,n,r);return}if(b(e,`ArrayPattern`)){for(let t of e.elements)t&&Bs(t,b(t,`AssignmentPattern`)?t.right??null:null,n,r);return}if(b(e,`AssignmentPattern`)){Bs(e.left,e.right??null,n,r);return}b(e,`RestElement`)&&Bs(e.argument,null,n,r)},Vs=e=>{let t=new Map;return z(e,e=>{switch(e.type){case`VariableDeclarator`:{let n=e.parent,r=zs(e,n?.type===`VariableDeclaration`?n.kind:void 0);r&&Bs(e.id,e.init??null,r,t);break}case`FunctionDeclaration`:case`FunctionExpression`:case`ArrowFunctionExpression`:if(e.type!==`ArrowFunctionExpression`&&e.id){let n=e.parent?Rs(e.parent):null;if(n){let r=t.get(e.id.name)??[];r.push({bindingIdentifier:e.id,initializer:e,scopeOwner:n}),t.set(e.id.name,r)}}for(let n of e.params)Bs(n,null,e,t);break;case`ClassDeclaration`:case`ClassExpression`:{if(!e.id)break;let n=e.parent?Rs(e.parent):null;if(n){let r=t.get(e.id.name)??[];r.push({bindingIdentifier:e.id,initializer:e,scopeOwner:n}),t.set(e.id.name,r)}break}case`ImportDeclaration`:{let n=Rs(e);if(!n)break;for(let r of e.specifiers){let e=r.local;if(e&&b(e,`Identifier`)){let i=t.get(e.name)??[];i.push({bindingIdentifier:e,initializer:r,scopeOwner:n}),t.set(e.name,i)}}break}case`TSImportEqualsDeclaration`:case`TSEnumDeclaration`:case`TSModuleDeclaration`:{let n=e.id;if(n?.type===`Identifier`){let r=Rs(e);if(r){let e=t.get(n.name)??[];e.push({bindingIdentifier:n,initializer:null,scopeOwner:r}),t.set(n.name,e)}}break}}}),t},Hs=new WeakMap,Us=new WeakMap,Ws=e=>{let t=Bt(e);if(!t)return null;let n=Hs.get(t);return n||(n=Vs(t),Hs.set(t,n)),n},Gs=(e,t,n)=>{let r=Ws(e);if(!r)return null;let i=r.get(t);if(!i||i.length===0)return null;let a=i[0];if(i.length===1&&a){let t=e;for(;t;){if(t===a.scopeOwner)return a;t=t.parent??null}return null}let o=e;for(;o;){let t=null;for(let r of i)if(r.scopeOwner===o){if(t===null){t=r;continue}if(n?.preferInitializerBeforeReference){let n=!!(r.initializer&&(b(r.initializer,`FunctionDeclaration`)||r.bindingIdentifier.range[0]<e.range[0]));if(n!==!!(t.initializer&&(b(t.initializer,`FunctionDeclaration`)||t.bindingIdentifier.range[0]<e.range[0]))){n&&(t=r);continue}}(r.initializer!==null||t.initializer===null)&&(t=r)}if(t)return t;o=o.parent??null}return null},Ks=(e,t,n)=>{let r=Us.get(e),i;if(!r)i={},Us.set(e,{primaryBindingName:t,primaryLookup:i});else if(r.primaryBindingName===t)i=r.primaryLookup;else{let e=r.additionalLookups;e||(e=new Map,r.additionalLookups=e);let n=e.get(t);n?i=n:(i={},e.set(t,i))}let a=n?.preferInitializerBeforeReference?`preferredResult`:`defaultResult`;if(a in i)return i[a]??null;let o=Gs(e,t,n);return i[a]=o,o},qs=e=>_a.test(e),Js=e=>{let t=Ks(e,e.name);if(!t?.initializer)return null;let n=t.bindingIdentifier.parent;if(!n||!b(n,`VariableDeclarator`)||n.id!==t.bindingIdentifier)return null;let r=n.parent;if(!r||!b(r,`VariableDeclaration`)||r.kind!==`const`)return null;let i=w(t.initializer);return b(i,`Literal`)&&typeof i.value==`string`?i.value:null},Ys=e=>b(e,`JSXIdentifier`)?e.name:b(e,`JSXMemberExpression`)?`${Ys(e.object)}.${e.property.name}`:b(e,`JSXNamespacedName`)?`${e.namespace.name}:${e.name.name}`:``,Xs=e=>{let t=e.name;return b(t,`JSXIdentifier`)?qs(t.name)?Js(t)??t.name:t.name:Ys(t)},Zs=(e,t)=>{if(!b(e.name,`JSXIdentifier`))return!1;let n=Xs(e);if(n[0]===n[0]?.toLowerCase())return!0;let r=new Set,i=e=>{let n=P(e);if(b(n,`Literal`))return typeof n.value==`string`;if(b(n,`Identifier`)||b(n,`JSXIdentifier`)){let e=t.symbolFor(n);if(!e||e.kind!==`const`||!e.initializer||r.has(e.id))return!1;r.add(e.id);let a=i(e.initializer);return r.delete(e.id),a}return b(n,`ConditionalExpression`)?i(n.consequent)&&i(n.alternate):!1};return i(e.name)},Qs=(e,t,n=new Set)=>{if(!e)return null;let r=w(e);if(O(r))return r;if(b(r,`Identifier`)){let e=t.symbolFor(r);return!e||n.has(e.id)||!e.initializer||V(e,r,t)?null:(n.add(e.id),Qs(e.initializer,t,n))}if(!b(r,`CallExpression`)||!$a(r,`memo`,t,{resolveNamedAliases:!0})&&!$a(r,`forwardRef`,t,{resolveNamedAliases:!0}))return null;let i=r.arguments[0];return!i||b(i,`SpreadElement`)?null:Qs(i,t,n)},$s=(e,t)=>{let n=P(e);if(!O(n)||n.async||n.generator)return!1;let r=n.parent;if(!r||!b(r,`JSXExpressionContainer`))return!1;let i=r.parent;if(!i||!b(i,`JSXAttribute`)||Ns(i.name)!==`ref`)return!1;let a=i.parent;return!!(a&&b(a,`JSXOpeningElement`)&&Zs(a,t))},ec=(e,t)=>t.every((t,n)=>e[n]===t),tc=e=>{let t=P(e);for(;t.parent&&b(t.parent,`MemberExpression`)&&t.parent.object===t;){if(!C(t.parent))return null;t=P(t.parent)}return t},nc=(e,t,n,r)=>{if(t.length!==n.length+1||!ec(t,n)||t[n.length]!==`current`)return!1;let i=tc(e),a=i?.parent;if(!i||!a||!b(a,`AssignmentExpression`)||a.operator!==`=`||a.left!==i)return!1;let o=j(e);if(!o)return!1;if($s(o,r))return!0;if(!O(o)||o.async||o.generator)return!1;let s=j(o);if(!s||!$s(s,r))return!1;let c=P(o),l=c.parent;return!!(b(l,`ReturnStatement`)&&l.argument===c&&j(l)===s||b(s,`ArrowFunctionExpression`)&&s.body===c)},rc=(e,t)=>{if(!b(e,`JSXOpeningElement`))return!1;let n=e.name;if(b(n,`JSXIdentifier`)){if(!t)return n.name===`Fragment`;let e=F(n,t);return e?Ja(e)&&x(e.declarationNode)===`Fragment`:n.name===`Fragment`&&t.isGlobalReference(n)}return b(n,`JSXMemberExpression`)?!b(n.object,`JSXIdentifier`)||n.property.name!==`Fragment`?!1:t?Xa(n.object,t)?!0:n.object.name===`React`&&t.isGlobalReference(n.object):n.object.name===`React`:!1},ic=(e,t,n,r,i)=>{let a=P(e),o=a.parent;if(!o)return!1;if(b(o,`ReturnStatement`)&&o.argument===a)return j(o)===t;if(b(o,`ArrowFunctionExpression`)&&o.body===a)return o===t;if(b(o,`JSXFragment`)&&o.children.some(e=>e===a)||b(o,`JSXElement`)&&o.children.some(e=>e===a)&&(Zs(o.openingElement,n)||rc(o.openingElement,n)||i.doesCustomElementRenderChildren?.(o.openingElement)))return ic(o,t,n,r,i);if(b(o,`JSXExpressionContainer`)&&o.expression===a&&o.parent&&(b(o.parent,`JSXFragment`)||b(o.parent,`JSXElement`)&&(Zs(o.parent.openingElement,n)||rc(o.parent.openingElement,n)||i.doesCustomElementRenderChildren?.(o.parent.openingElement))))return ic(o.parent,t,n,r,i);if(b(o,`ConditionalExpression`)&&(o.consequent===a||o.alternate===a)||b(o,`LogicalExpression`)&&(o.left===a||o.right===a)||b(o,`ArrayExpression`)&&o.elements.some(e=>e===a))return ic(o,t,n,r,i);if(!b(o,`VariableDeclarator`)||o.init!==a||!b(o.id,`Identifier`))return!1;let s=n.symbolFor(o.id);if(!s||s.kind!==`const`||s.references.length===0||r.has(s.id))return!1;r.add(s.id);let c=s.references.every(e=>e.flag===`read`&&ic(e.identifier,t,n,r,i));return r.delete(s.id),c},ac=(e,t,n={})=>ic(e,j(e),t,new Set,n),oc=(e,t)=>t.every((t,n)=>e[n]===t),sc=(e,t)=>oc(e,t)||oc(t,e),cc=e=>O(e)&&b(e.body,`BlockStatement`)&&e.body.body.length===0,lc=(e,t,n)=>$a(e,t,n,{resolveNamedAliases:!0}),uc=(e,t,n=new Set)=>b(e,`ObjectExpression`)?e.properties.every(e=>{if(b(e,`SpreadElement`)){let r=P(e.argument);if(b(r,`ObjectExpression`))return uc(r,t,n);if(!b(r,`Identifier`))return!1;let i=t.symbolFor(r);if(!i||i.kind!==`const`||n.has(i.id)||!b(i.initializer,`ObjectExpression`))return!1;n.add(i.id);let a=uc(i.initializer,t,n);return n.delete(i.id),a}return b(e,`Property`)?!O(e.value)||cc(e.value):!1}):!1,dc=e=>C(e)||(e.computed&&b(e.property,`Literal`)&&typeof e.property.value==`number`&&Number.isSafeInteger(e.property.value)&&e.property.value>=0?String(e.property.value):null),fc=e=>{let t=[],n=P(e);for(;n.parent&&b(n.parent,`MemberExpression`)&&n.parent.object===n;){let e=dc(n.parent);if(!e)return null;t.push(e),n=P(n.parent)}return{expression:n,propertyPath:t}},pc=(e,t,n)=>{let r=n.environmentsByProgram.get(e);if(r)return r;let i={filename:t,program:e,scopes:A(e)};return n.environmentsByProgram.set(e,i),i},mc=(e,t,n=new Set)=>{let r=P(e);if(b(r,`Identifier`)){let e=t.symbolFor(r);return!e||!e.initializer||n.has(e.id)||V(e,r,t)?!1:(n.add(e.id),mc(e.initializer,t,n))}if(!b(r,`CallExpression`))return!1;if(lc(r,`forwardRef`,t))return!0;if(!lc(r,`memo`,t))return!1;let i=r.arguments[0];return!i||b(i,`SpreadElement`)?!1:mc(i,t,n)},hc=(e,t)=>{let n=pc(e.programNode,e.filePath,t),r=Qs(e.exportedNode,n.scopes);return r?{environment:n,functionNode:r,isForwardRef:mc(e.exportedNode,n.scopes)}:null},gc=(e,t,n)=>{if(!b(e,`Identifier`)&&!b(e,`JSXIdentifier`))return null;let r=t.scopes.symbolFor(e);if(r&&r.kind!==`import`){if(V(r,e,t.scopes))return null;let n=Qs(r.initializer,t.scopes);return n?{environment:t,functionNode:n,isForwardRef:!!(r.initializer&&mc(r.initializer,t.scopes))}:null}let i=_o(e,e.name);if(!i||i.isNamespace||i.exportedName===null)return null;let a=R(t.filename,i.source,i.exportedName);return a?hc(a,n):null},_c=(e,t,n)=>{if(b(e,`JSXIdentifier`))return gc(e,t,n);if(!b(e,`JSXMemberExpression`)||!b(e.object,`JSXIdentifier`))return null;let r=_o(e.object,e.object.name);if(!r?.isNamespace)return null;let i=R(t.filename,r.source,e.property.name);return i?hc(i,n):null},vc=(e,t,n=new Set)=>{let r=P(e);if(b(r,`Identifier`)){let e=t.scopes.symbolFor(r);return!e||!e.initializer||n.has(e.id)||V(e,r,t.scopes)?!1:(n.add(e.id),vc(e.initializer,t,n))}return Is(r,t.scopes)},yc=(e,t,n)=>{if(!b(e,`JSXIdentifier`))return!1;let r=t.scopes.symbolFor(e);if(r&&r.kind!==`import`)return V(r,e,t.scopes)?!1:!!(r.initializer&&vc(r.initializer,t));let i=_o(e,e.name);if(!i||i.isNamespace||i.exportedName===null)return!1;let a=R(t.filename,i.source,i.exportedName);if(!a)return!1;let o=pc(a.programNode,a.filePath,n);return vc(a.exportedNode,o)},bc=(e,t)=>{if(!e)return null;let n=P(e);return!b(n,`ClassDeclaration`)&&!b(n,`ClassExpression`)||!vc(n,t)?null:{classNode:n,environment:t}},xc=(e,t,n)=>{if(!b(e,`JSXIdentifier`))return null;let r=t.scopes.symbolFor(e);if(r&&r.kind!==`import`)return V(r,e,t.scopes)?null:bc(r.initializer,t);let i=_o(e,e.name);if(!i||i.isNamespace||i.exportedName===null)return null;let a=R(t.filename,i.source,i.exportedName);if(!a)return null;let o=pc(a.programNode,a.filePath,n);return bc(a.exportedNode,o)},Sc=(e,t,n)=>{let r=[...t],i=P(e);for(;i.parent;){let e=i.parent;if(b(e,`ArrayExpression`)){if(e.elements.some(e=>e&&b(e,`SpreadElement`)))return null;let t=e.elements.findIndex(e=>e===i);if(t<0)return null;r.unshift(String(t)),i=P(e);continue}if(b(e,`Property`)&&e.value===i){let t=S(e,{allowComputedString:!0}),a=e.parent;if(!t||!a||!uc(a,n.scopes))return null;r.unshift(t),i=P(a);continue}if(b(e,`ConditionalExpression`)&&(e.consequent===i||e.alternate===i)||b(e,`LogicalExpression`)&&(e.left===i||e.right===i)){i=P(e);continue}if(b(e,`VariableDeclarator`)&&e.init===i&&b(e.id,`Identifier`)){let t=n.scopes.symbolFor(e.id);return!t||t.kind!==`const`?null:{environment:n,propertyPath:r,symbol:t}}if(b(e,`AssignmentExpression`)&&e.operator===`=`&&e.right===i&&b(e.left,`MemberExpression`)){let t=[],i=e.left;for(;b(i,`MemberExpression`);){let e=dc(i);if(!e)return null;t.unshift(e),i=P(i.object)}if(!b(i,`Identifier`))return null;let a=n.scopes.symbolFor(i);return!a||a.kind!==`const`?null:{environment:n,originWriteReference:i,propertyPath:[...t,...r],symbol:a}}return null}return null},Cc=(e,t,n,r,i)=>{if(b(e,`AssignmentPattern`))return Cc(e.left,t,n,r,i);if(b(e,`Identifier`)){let a=n.scopes.symbolFor(e);return!!(a&&zc({environment:n,propertyPath:t,symbol:a},r,i-1))}if(!b(e,`ObjectPattern`)||t.length===0)return!1;let[a,...o]=t;for(let t of e.properties){if(!b(t,`Property`))continue;let e=S(t,{allowComputedString:!0});if(!e)return!1;if(e===a)return Cc(t.value,o,n,r,i)}let s=e.properties.find(e=>b(e,`RestElement`));return s?Cc(s.argument,t,n,r,i):!0},wc=(e,t)=>{let n=e.arguments[0];return!n||b(n,`SpreadElement`)?!1:lc(e,`createElement`,t.scopes)?b(n,`Literal`)&&typeof n.value==`string`:!lc(e,`cloneElement`,t.scopes)||!b(n,`JSXElement`)?!1:Zs(n.openingElement,t.scopes)},Tc=(e,t,n,r,i)=>{if(t.length>0)return!1;let a=e.parent;if(!a||!b(a,`Property`)||a.value!==e||S(a,{allowComputedString:!0})!==`ref`)return!1;let o=a.parent;if(!o||!b(o,`ObjectExpression`))return!1;let s=o.parent;return!(!s||!b(s,`CallExpression`)||s.arguments[1]!==o||!wc(s,n)||!kc(s,n,r,i))},Ec=(e,t,n,r,i)=>{if(i<=0||!O(e.functionNode)||e.functionNode.async||e.functionNode.generator)return!1;let a=e.functionNode.params[t];return!!(a&&Cc(a,n,e.environment,r,i))},Dc=e=>{if(!b(e,`MemberExpression`)||C(e)!==`children`)return!1;let t=P(e.object);return!!(b(t,`MemberExpression`)&&C(t)===`props`&&b(P(t.object),`ThisExpression`))},Oc=(e,t)=>{if(!b(e,`JSXOpeningElement`)||!b(e.name,`JSXMemberExpression`)||e.name.property.name!==`Provider`||!b(e.name.object,`JSXIdentifier`))return!1;let n=t.scopes.symbolFor(e.name.object);return!!(n?.kind===`const`&&n.initializer&&b(n.initializer,`CallExpression`)&&lc(n.initializer,`createContext`,t.scopes))},kc=(e,t,n,r)=>ac(e,t.scopes,{doesCustomElementRenderChildren:e=>Mc(e,t,n,r-1)}),Ac=(e,t,n)=>{let{functionNode:r}=e;if(n<=0||t.activeRenderedChildrenComponents.has(r)||!b(r,`ArrowFunctionExpression`)&&!b(r,`FunctionExpression`)&&!b(r,`FunctionDeclaration`)||r.async||r.generator)return!1;let i=oo(r,e.environment.scopes);if(!i)return!1;t.activeRenderedChildrenComponents.add(r);let a=i.every(r=>kc(r,e.environment,t,n));return t.activeRenderedChildrenComponents.delete(r),a},jc=(e,t,n)=>{let{classNode:r,environment:i}=e;if(n<=0||t.activeRenderedChildrenComponents.has(r)||!b(r,`ClassDeclaration`)&&!b(r,`ClassExpression`))return!1;let a=r.body.body.find(e=>b(e,`MethodDefinition`)&&!e.computed&&b(e.key,`Identifier`)&&e.key.name===`render`);if(!a||!b(a,`MethodDefinition`))return!1;let o=[];if(z(r,e=>{Dc(e)&&o.push(e)}),o.length===0)return!1;t.activeRenderedChildrenComponents.add(r);let s=o.every(e=>j(e)===a.value&&kc(e,i,t,n));return t.activeRenderedChildrenComponents.delete(r),s},Mc=(e,t,n,r)=>{if(r<=0||!b(e,`JSXOpeningElement`))return!1;if(Oc(e,t))return!0;let i=_c(e.name,t,n);if(i)return Ac(i,n,r);let a=xc(e.name,t,n);return!!(a&&jc(a,n,r))},Nc=(e,t,n,r,i)=>{let a=Ns(e.name),o=e.parent;if(!a||!o||!b(o,`JSXOpeningElement`))return!1;let s=o.parent;if(!s||!b(s,`JSXElement`)||!kc(s,n,r,i))return!1;if(Zs(o,n.scopes))return a===`ref`&&t.length===0;if(b(o.name,`JSXIdentifier`)&&a===`ref`&&t.length===0&&yc(o.name,n,r))return!0;let c=_c(o.name,n,r);return c?a===`ref`&&c.isForwardRef?Ec(c,1,t,r,i):Ec(c,0,[a,...t],r,i):!1},Pc=(e,t,n,r,i,a)=>{let o=e.arguments.findIndex(e=>e===t);if(o<0)return!1;if(o===0&&b(e.callee,`Identifier`)&&e.callee.name===`Boolean`&&r.scopes.isGlobalReference(e.callee))return!0;if(o===0&&lc(e,`useImperativeHandle`,r.scopes))return n.length===0;if(o===1&&n.length===1&&n[0]===`ref`&&wc(e,r)&&kc(e,r,i,a))return!0;let s=P(e.callee);if(O(s))return Ms(s,r.scopes)&&!kc(e,r,i,a)?!1:Ec({environment:r,functionNode:s,isForwardRef:!1},o,n,i,a);if(!b(e.callee,`Identifier`))return!1;let c=gc(e.callee,r,i);return!!(c&&(!Ms(c.functionNode,c.environment.scopes)||kc(e,r,i,a))&&Ec(c,o,n,i,a))},Fc=(e,t,n,r,i)=>{let a;if(t.length===1&&t[0]===`ref`)a=e.parent;else if(t.length===0){let t=e.parent;if(!t||!b(t,`Property`)||t.value!==e||S(t,{allowComputedString:!0})!==`ref`)return!1;a=t.parent?.parent}if(!a||!b(a,`JSXSpreadAttribute`))return!1;let o=a.parent;if(!o||!b(o,`JSXOpeningElement`))return!1;let s=o.parent;return!!(Zs(o,n.scopes)&&s&&b(s,`JSXElement`)&&kc(s,n,r,i))},Ic=(e,t,n,r,i)=>{let a=P(e),o=a.parent;if(!o)return!1;if(b(o,`ExpressionStatement`)||b(o,`UnaryExpression`)&&o.operator===`void`&&o.argument===a)return!0;if(t.length===0&&b(o,`BinaryExpression`)&&(o.operator===`===`||o.operator===`!==`||o.operator===`==`||o.operator===`!=`)){let e=o.left===a?o.right:o.left;return!!(b(a,`Identifier`)&&b(e,`Identifier`)&&n.scopes.symbolFor(a)?.id===n.scopes.symbolFor(e)?.id)}if(Fc(a,t,n,r,i)||Tc(a,t,n,r,i)||t.length>0&&(b(o,`LogicalExpression`)&&o.left===a||b(o,`ConditionalExpression`)&&o.test===a||b(o,`IfStatement`)&&o.test===a||b(o,`UnaryExpression`)&&o.operator===`!`&&o.argument===a))return!0;if(b(o,`JSXExpressionContainer`)&&o.expression===a){let e=o.parent;return!!(e&&b(e,`JSXAttribute`)&&Nc(e,t,n,r,i))}if(b(o,`CallExpression`))return Pc(o,a,t,n,r,i);if(b(o,`VariableDeclarator`)&&o.init===a&&!b(o.id,`Identifier`))return Cc(o.id,t,n,r,i);let s=Sc(a,t,n);return!!(s&&zc(s,r,i-1))},Lc=e=>{let t=e.parent;return t&&b(t,`VariableDeclarator`)&&t.init===e&&b(t.id,`Identifier`)?t.id:(b(e,`FunctionDeclaration`)||b(e,`FunctionExpression`))&&e.id?e.id:null},Rc=(e,t,n)=>{if(!e||!t||!O(e)||e.async||e.generator)return!1;let r=Lc(e);if(!r||((b(e,`FunctionDeclaration`)||b(e,`FunctionExpression`))&&e.id===r?j(e):j(r))!==t)return!1;let i=b(e,`FunctionDeclaration`)?n.ownScopeFor(t)?.symbolsByName.get(r.name):n.symbolFor(r);return!!(i&&i.references.length>0&&i.references.every(e=>{let r=P(e.identifier),i=r.parent;return!!(i&&b(i,`CallExpression`)&&i.callee===r&&j(i)===t&&ac(i,n))}))},zc=(e,t,n)=>{if(n<=0)return!1;let r=`${e.environment.filename}:${e.symbol.id}:${e.propertyPath.join(`.`)}`;if(t.activePaths.has(r))return!1;t.activePaths.add(r);let i=j(e.symbol.bindingIdentifier),a=e.symbol.references.every(r=>{if(r.identifier===e.originWriteReference)return!0;let a=r.identifier.parent;if(a&&b(a,`Property`)&&!a.computed&&a.key===r.identifier&&a.value!==r.identifier)return!0;let o=fc(r.identifier);if(!o)return!1;if(!sc(o.propertyPath,e.propertyPath))return!0;let s=j(r.identifier);if(s!==i&&!Rc(s,i,e.environment.scopes))return!!nc(r.identifier,o.propertyPath,e.propertyPath,e.environment.scopes);if(r.flag!==`read`)return!1;if(oc(o.propertyPath,e.propertyPath)){if(o.propertyPath.length>e.propertyPath.length){let t=o.expression.parent;return!!(o.propertyPath.length===e.propertyPath.length+1&&o.propertyPath[e.propertyPath.length]===`current`&&t&&b(t,`UnaryExpression`)&&t.operator===`void`&&t.argument===o.expression)}return Ic(o.expression,[],e.environment,t,n)}return Ic(o.expression,e.propertyPath.slice(o.propertyPath.length),e.environment,t,n)});return t.activePaths.delete(r),a},Bc=(e,t,n)=>{if(!t)return!1;let r=Bt(e);if(!r)return!1;let i={filename:t,program:r,scopes:n},a={activePaths:new Set,activeRenderedChildrenComponents:new WeakSet,environmentsByProgram:new WeakMap([[r,i]])},o=Sc(e,[],i);return o?zc(o,a,12):Ic(e,[],i,a,12)},Vc=e=>{let t=[];for(let n of e)for(let e of n.entries){if(e.importName.kind===`NamespaceObject`)continue;let r=e.importName.kind===`Default`?`default`:e.importName.name??null;r!==null&&t.push({source:n.moduleRequest.value,exportedName:r})}return t},Hc=({absoluteFilePath:e,staticImports:t})=>{let n=!1;for(let r of t){let t=r.moduleRequest.value;if(!t.startsWith(`.`))continue;let i=r.entries.filter(e=>!e.isType);if(i.length===0)continue;let a=Vn(e,t);if(!(!a||!Oi(a))){n||(n=!0,Yr(e));for(let e of i){let t=e.importName.kind===`Default`?`default`:e.importName.name;t&&io(a,t)}}}},Uc=({absoluteFilePath:e})=>{vr.test(e)&&(Sr.test(e)||li(e))},Wc=({absoluteFilePath:e,staticImports:t})=>{if(yr.test(e)&&!fi(e))for(let n of Vc(t))cr(e,n.source,n.exportedName)},H=({absoluteFilePath:e,staticImports:t})=>{Pe(e);for(let n of Vc(t))cr(e,n.source,n.exportedName)},Gc=({absoluteFilePath:e,getProgram:t})=>{let n=t();dn(n);let r=A(n);z(n,t=>{if(!b(t,`CallExpression`))return;let n=Se(t.callee,r);!n?.importedName||!n.source.startsWith(`.`)||cr(e,n.source,n.importedName)})},Kc=({absoluteFilePath:e,staticImports:t})=>{for(let n of Vc(t))R(e,n.source,n.exportedName)},qc=(e,t,n,r)=>{let i=n.get(t);if(!(i!==void 0&&i<=r)){n.set(t,r);for(let i of e.body??[]){let e=pi(i);if(!e)continue;let a=ir(t,e);if(!a||r>=8)continue;let o=r+1,s=n.get(a);if(s!==void 0&&s<=o)continue;let c=bn(a);if(!c){n.set(a,o);continue}qc(c,a,n,o)}}},Jc=e=>{Kc(e);let t=e.getProgram(),n=!1;z(t,e=>{if(n)return!1;if(!b(e,`CallExpression`))return;let t=w(e.callee);if(!b(t,`MemberExpression`))return;let r=C(t);n=r===`add`||r===`set`}),n&&qc(t,e.absoluteFilePath,new Map,0)},Yc=({absoluteFilePath:e,staticImports:t})=>{for(let n of Vc(t))ao(e,n.source,n.exportedName)},Xc=e=>{let t=[];for(let n of e.body??[]){if(n.type!==`ImportDeclaration`)continue;let e=n.source?.value;if(typeof e==`string`){for(let r of n.specifiers??[])if(r.type===`ImportDefaultSpecifier`)t.push({source:e,exportedName:`default`});else if(r.type===`ImportSpecifier`){let n=r.imported,i=null;typeof n?.name==`string`?i=n.name:typeof n?.value==`string`&&(i=n.value),i&&t.push({source:e,exportedName:i})}}}return t},Zc=({absoluteFilePath:e,staticImports:t},n,r=()=>!0,i=()=>!0)=>{let a=new Map,o=(e,t,n)=>{if(!((a.get(e)??-1)>=n)){a.set(e,n);for(let a of Xc(t)){let t=R(e,a.source,a.exportedName);!t||n===0||!r(t)||!i(t.filePath)||o(t.filePath,t.programNode,n-1)}}};for(let a of Vc(t)){let t=R(e,a.source,a.exportedName);!t||!r(t)||!i(t.filePath)||o(t.filePath,t.programNode,n)}},Qc=e=>{let t=e.getProgram();dn(t);let n=A(t);z(t,t=>{if(b(t,`BlockStatement`))for(let[r,i]of t.body.entries()){let a=t.body[r+1];!b(i,`VariableDeclaration`)||!b(a,`VariableDeclaration`)||gr(i,a,n,e.absoluteFilePath)}})},$c=e=>{Zc(e,4),Kc(e),We(e.absoluteFilePath,`@xstate/react`)},el=({absoluteFilePath:e,sourceText:t,getProgram:n})=>{if(!t.includes(`createRef`)&&!t.includes(`\\u`))return;let r=n();dn(r);let i=A(r);z(r,t=>{!b(t,`CallExpression`)||!$a(t,`createRef`,i,{allowGlobalReactNamespace:!0,allowUnboundBareCalls:!0,resolveNamedAliases:!0})||Bc(t,e,i)})},tl=({absoluteFilePath:e,sourceText:t,staticImports:n,getProgram:r})=>{let i=new Set,a=new Set;for(let e of n)if(e.moduleRequest.value===`react`)for(let t of e.entries){let{importName:e}=t;e.kind===`Name`&&e.name===`useReducer`?i.add(t.localName.value):(e.kind===`Default`||e.kind===`NamespaceObject`)&&a.add(t.localName.value)}if(!(i.size>0||a.size>0&&(t.includes(`useReducer`)||t.includes(`\\u`))))return;let o=r(),s=e=>{if(e?.type!==`Identifier`)return null;let{name:t}=e;return typeof t==`string`?t:null},c=e=>{let t=s(e);if(t!==null)return i.has(t);if(e.type!==`MemberExpression`)return!1;let n=e,r=s(n.object);return r!==null&&a.has(r)&&s(n.property)===`useReducer`},l=new Set;if(z(o,e=>{if(e.type!==`CallExpression`)return;let t=e;if(!t.callee||!c(t.callee))return;let n=t.arguments?.[0];if(!n)return;let r=s(w(n));r!==null&&l.add(r)}),l.size!==0)for(let t of n)for(let n of t.entries){if(n.importName.kind===`NamespaceObject`||!l.has(n.localName.value))continue;let r=n.importName.kind===`Default`?`default`:n.importName.name;r&&cr(e,t.moduleRequest.value,r)}},nl=({absoluteFilePath:e,staticImports:t,getProgram:n})=>{Yr(e),Xr({absoluteFilePath:e,staticImports:t,program:n()})},U=({absoluteFilePath:e})=>{Yr(e)},rl=e=>{U(e),Yc(e)},il=e=>{U(e),Zc(e,1/0,e=>O(e.exportedNode),e=>!e.split(/[\\/]/).includes(`node_modules`))},al=({absoluteFilePath:e})=>{Vi(e)},ol=({absoluteFilePath:e})=>{We(e,`react-native`)},sl=({absoluteFilePath:e})=>{Hi(e)},cl=e=>{sl(e),Xr({absoluteFilePath:e.absoluteFilePath,staticImports:e.staticImports,program:e.getProgram()})},ll=new Map([...re.map(e=>[e,sl]),[`ink-no-raw-text`,cl],[`client-passive-event-listeners`,H],[`effect-needs-cleanup`,H],[`effect-listener-cleanup-reference-mismatch`,H],[`exhaustive-deps`,$c],[`rules-of-hooks`,Gc],[`no-barrel-import`,Hc],[`nextjs-async-dynamic-api-not-awaited`,U],[`nextjs-missing-metadata`,Uc],[`nextjs-no-use-search-params-without-suspense`,Wc],[`no-dynamic-import-path`,U],[`no-full-lodash-import`,U],[`no-hydration-branch-on-browser-global`,rl],[`no-indeterminate-attribute`,U],[`no-locale-format-in-render`,U],[`no-match-media-in-state-initializer`,U],[`no-create-ref-in-function-component`,el],[`no-adjust-state-on-prop-change`,H],[`no-set-state-after-await-in-effect`,H],[`forwarded-set-state-in-effect`,H],[`no-derived-state`,H],[`no-derived-state-effect`,H],[`no-event-handler`,H],[`no-initialize-state`,H],[`no-reset-all-state-on-prop-change`,H],[`no-mutating-reducer-state`,tl],[`no-side-effect-in-state-updater-function`,Jc],[`no-unguarded-browser-global-at-module-scope`,Yc],[`no-unguarded-browser-global-in-render-or-hook-init`,il],[`prefer-dynamic-import`,U],[`rendering-hydration-mismatch-time`,U],[`rendering-hydration-no-flicker`,H],[`rerender-memo-with-default-value`,$c],[`server-sequential-independent-await`,Qc],[`rn-no-deprecated-modules`,ol],[`rn-no-legacy-shadow-styles`,al],[`rn-no-raw-text`,nl],[`rn-prefer-expo-image`,U],[`rn-style-prefer-boxshadow`,al],...se.map(e=>[e,U])]),ul=new Set([`anchor-target-exists`,`nextjs-no-img-element`,`no-img-without-dimensions`,`no-loading-flag-reset-outside-finally`,`only-export-components`,`remotion-calculate-metadata-fetch-signal`,`remotion-deterministic-randomness`,`remotion-no-css-animation`,`remotion-no-css-transition`,`remotion-no-css-url-assets`,`remotion-no-native-media-elements`,`remotion-no-next-image`,`window-open-without-noopener`]),dl=e=>{let t=new Set;for(let n of e.ruleIds){let e=ll.get(n);if(!e)return null;t.add(e)}let n=to(e.absoluteFilePath),r,i;try{let t=gn(n,e.sourceText);if(t.errors.some(e=>e.severity===`Error`))return null;r=t.module.staticImports;let a;i=()=>(a??=t.program,a)}catch{return null}let a={absoluteFilePath:n,sourceText:e.sourceText,staticImports:r,getProgram:i};return De(()=>{for(let e of t)e(a)})},fl={},pl=(e,t,n)=>!e||e.length===0?!1:e.every(e=>b(e,t)&&e[n]===`type`),ml=e=>e.importKind===`type`||pl(e.specifiers,`ImportSpecifier`,`importKind`),hl=new Set([`solid-js`,`solid-js/web`,`solid-js/store`,`solid-js/h`,`solid-js/html`,`@builder.io/qwik`,`@builder.io/qwik-city`,`@builder.io/qwik-react`,`voby`,`vidode`]),gl=[`solid-js`,`@builder.io/qwik`],_l=[`react`,`react-dom`,`preact`],vl=new WeakMap,yl=new WeakMap,bl=(e,t)=>t.some(t=>e===t||e.startsWith(`${t}/`)),xl=e=>{let t=vl.get(e);if(t)return t;let n=!1,r=!1,i=!1,a=!1,o=!1,s=!1;for(let t of e.body){if(i||z(t,e=>{if(i)return!1;if(b(e,`JSXOpeningElement`)&&Sl(e))return i=!0,!1;b(e,`JSXOpeningElement`)&&b(e.name,`JSXIdentifier`)&&/^[a-z]/.test(e.name.name)&&e.attributes.some(e=>b(e,`JSXAttribute`)&&Ns(e.name)===`class`)&&(s=!0)}),!b(t,`ImportDeclaration`))continue;let e=t,c=e.source,l=c&&typeof c.value==`string`?c.value:null;if(l){if(l===`solid-js`)for(let t of e.specifiers){if(!b(t,`ImportSpecifier`)||e.importKind!==`type`&&t.importKind!==`type`)continue;let n=x(t);n===`Component`&&(a=!0),n===`JSX`&&(o=!0)}ml(e)||((hl.has(l)||bl(l,gl))&&(n=!0),bl(l,_l)&&(r=!0))}}let c={hasNonReactMarker:i||a||o&&s,hasNonReactRuntime:n,hasReactRuntime:r};return vl.set(e,c),c},Sl=e=>{let t=yl.get(e);if(t!==void 0)return t;let n=!1;for(let t of e.attributes){if(!b(t,`JSXAttribute`))continue;let r=Ns(t.name);if(r&&(r===`classList`&&b(t.value,`JSXExpressionContainer`)&&b(t.value.expression,`ObjectExpression`)||b(e.name,`JSXIdentifier`)&&/^[a-z]/.test(e.name.name)&&(r.startsWith(`class:`)||r.startsWith(`bind:`)||r.startsWith(`on:`)||r.startsWith(`oncapture:`)))){n=!0;break}}return yl.set(e,n),n},Cl=new Set(`/playground/./playgrounds/./examples/./example/./demo/./demos/./sandbox/./sandboxes/./specs/./spec/./integration/./it/./perf/./scripts/./cli/./bin/./tooling/./tools/./codemods/./codemod/./migrations/./migration/./generators/./generator/./runbooks/./devtools/./internal-tools/./seeds/./seed/./dev-seeder/`.split(`.`)),wl=new Set,Tl=[`/test/`,`/tests/`,`/testing/`,`/__tests__/`,`/__test__/`,`/__fixtures__/`,`/fixtures/`,`/__mocks__/`,`/mocks/`,`/testUtils/`,`/test-utils/`,`/test-stubs/`,`/testutils/`,`/cypress/`,`/playwright/`,`/.storybook/`,`/.dumi/`,`/stories/`,`/__stories__/`,...Cl,`/e2e/`,`/e2e-tests/`,`/integration-tests/`,`/benchmarks/`,`/benchmark/`,`/__benchmarks__/`,`/perf-tests/`],El=[`.test.`,`.spec.`,`.cy.`,`.stories.`,`.story.`,`.bench.`,`.benchmark.`,`.e2e.`,`.integration-spec.`,`.int-spec.`,`.mock.`,`.mocks.`,`.fixture.`],Dl=new Set(`setuptests.js,setuptests.ts,setuptests.jsx,setuptests.tsx,setupvitest.js,setupvitest.ts,setupvitest.jsx,setupvitest.tsx,setupjest.js,setupjest.ts,vitest.setup.js,vitest.setup.ts,vitest.setup.mjs,vitest.config.ts,vitest.config.js,vitest.config.mts,vitest.config.mjs,jest.setup.js,jest.setup.ts,jest.setup.jsx,jest.setup.tsx,jest.config.js,jest.config.ts,jest.config.mjs,playwright.config.ts,playwright.config.js,cypress.config.ts,cypress.config.js,karma.conf.js,karma.conf.ts,vite.config.ts,vite.config.js,vite.config.mts,vite.config.mjs,webpack.config.ts,webpack.config.js,webpack.config.mjs,rollup.config.ts,rollup.config.js,rollup.config.mjs,esbuild.config.ts,esbuild.config.js,esbuild.config.mjs,tsup.config.ts,tsup.config.js,tsup.config.mjs,rsbuild.config.ts,rsbuild.config.js,rspack.config.ts,rspack.config.js,next.config.ts,next.config.js,next.config.mjs,remix.config.js,remix.config.ts,astro.config.ts,astro.config.js,astro.config.mjs,tailwind.config.ts,tailwind.config.js,tailwind.config.mjs,postcss.config.ts,postcss.config.js,postcss.config.mjs,biome.config.ts,biome.config.js,drizzle.config.ts,drizzle.config.js,prisma.config.ts,prisma.config.js,knip.config.ts,knip.config.js,knip.config.mjs,lint-staged.config.js,lint-staged.config.mjs`.split(`,`)),Ol=[`/src/`,`/app/`,`/lib/`,`/components/`,`/pages/`,`/features/`,`/modules/`,`/packages/`,`/apps/`,`/frontend/`,`/client/`],kl=Tl.filter(e=>e.startsWith(`/.`)),Al=e=>{let t=-1;for(let n of Ol){let r=e.lastIndexOf(n);r>t&&(t=r)}return t<0?e:e.slice(t)};let jl,Ml=!1,Nl,Pl=!1;const Fl=e=>e?e===jl?Ml:(jl=e,Ml=Rl(e),Ml):!1,Il=e=>{if(!e)return!1;if(e===Nl)return Pl;Nl=e;let t=e.replaceAll(`\\`,`/`),n=t.startsWith(`/`)?t:`/${t}`;return Pl=Rl(n,Ol.some(e=>n.includes(e))?Cl:wl),Pl},Ll=(e,t)=>e?Rl(e,t):!1,Rl=(e,t=wl)=>{let n=e.replaceAll(`\\`,`/`),r=n.lastIndexOf(`/`),i=r===-1?n:n.slice(r+1);if(Dl.has(i.toLowerCase()))return!0;for(let e of El)if(i.includes(e))return!0;let a=n.startsWith(`/`)?n:`/${n}`;for(let e of kl)if(!t.has(e)&&a.includes(e))return!0;let o=Al(n);for(let e of Tl)if(!t.has(e)&&(e.startsWith(`/.`)?n:o).includes(e))return!0;return!1},zl=(e,t=Fl)=>n=>t(n.filename)?fl:e(n),Bl=e=>{let t=e?.[`react-doctor`];return typeof t!=`object`||!t||Array.isArray(t)?null:t},Vl=(e,t)=>Object.getOwnPropertyDescriptor(e,t)?.value,Hl=(e,t)=>{let n=Bl(e);if(!n)return;let r=Vl(n,t);return typeof r==`string`?r:void 0},Ul=(e,t)=>{let n=Bl(e);if(!n)return;let r=Vl(n,t);return typeof r==`number`&&Number.isFinite(r)?r:void 0},Wl=new WeakMap,Gl=(e,t)=>{let n=Vl(e,t);if(Array.isArray(n))return n.filter(e=>typeof e==`string`&&e.length>0)},Kl=(e,t)=>{let n=Bl(e);if(!n)return;let r=Wl.get(n);if(r||(r=new Map,Wl.set(n,r)),r.has(t))return r.get(t);let i=Gl(n,t);return r.set(t,i),i},ql=(e,t)=>Kl(e,t)??[],Jl=(e,t)=>ql(e,`capabilities`).includes(t),Yl=(e,t)=>{let n=Bl(e);return!n||Vl(n,`capabilities`)===void 0?!0:Jl(e,t)},Xl=(e,t,n)=>!t?.some(t=>!Yl(e,t))&&!n?.some(t=>Jl(e,t)),Zl=(e,t,n)=>r=>Xl(r.settings,t,n)?e(r):fl,Ql=e=>(t=>{let n=e(t),r=!1,i=!1,a={};for(let e in n){if(!Object.hasOwn(n,e))continue;let t=n[e];if(typeof t!=`function`){a[e]=t;continue}let o=e.charAt(0);if(o<`A`||o>`Z`){a[e]=t;continue}if(e===`Program`){a.Program=e=>{let n=xl(e);i=n.hasReactRuntime,r=!n.hasReactRuntime&&(n.hasNonReactRuntime||n.hasNonReactMarker),!r&&t(e)};continue}if(e===`JSXOpeningElement`){a.JSXOpeningElement=e=>{!i&&!r&&Sl(e)&&(r=!0),!r&&t(e)};continue}a[e]=e=>{r||t(e)}}return`Program`in a||(a.Program=e=>{let t=xl(e);i=t.hasReactRuntime,r=!t.hasReactRuntime&&(t.hasNonReactRuntime||t.hasNonReactMarker)}),a}),W=e=>{if(!(`create`in e))return{...e,create:()=>fl};let t=e.tags,n=e.create,r=t?.includes(`test-noise`)&&!t?.includes(`migration-hint`);return t?.includes(`react-jsx-only`)&&(n=Ql(n)),r&&(n=zl(n,Il)),(e.requires||e.disabledWhen)&&(n=Zl(n,e.requires,e.disabledWhen)),n===e.create?e:{...e,create:n}};let $l;const eu=e=>{let t=[0];for(let n=0;n<e.length;n+=1){let r=e[n];if(r===`\r`&&e[n+1]===`
 `){n+=1,t.push(n+1);continue}(r===`\r`||r===`
-`||r===`\u2028`||r===`\u2029`)&&t.push(n+1)}return t},eu=e=>{if(Ql?.content===e)return Ql.lineStartOffsets;let t=$l(e);return Ql={content:e,lineStartOffsets:t},t},G=(e,t)=>{if(Number.isNaN(t)||t<0)return{line:1,column:1};let n=eu(e),r=Math.min(Math.trunc(t),e.length),i=0,a=n.length-1;for(;i<a;){let e=i+a+1>>1;n[e]<=r?i=e:a=e-1}return{line:i+1,column:r-n[i]+1}},tu=(e,t)=>G(e,e.search(t)),nu=/\.(?:[cm]?[jt]sx?|json|jsonc|map|html?|mdx?|ya?ml|toml|sql|rules|env|txt|log|svg|xml|pem|key|crt|cert|pub|py|php)$/i,ru=/(?:^|\/)\.env(?:\.|$)/,iu=/\.(?:[cm]?[jt]sx?)$/i,au=/\.(?:[cm]?[jt]sx?|py|php)$/i,ou=/\.(?:[cm]?[jt]sx?|py)$/i,su=/(?:^|\/)(?:api|backend|server|servers|middleware|route|routes|functions|lambdas|workers)(?:\/|$)|(?:^|\/)[^/]+\.server\.[cm]?[jt]sx?$/i,cu=/(?:^|\/)(?:__fixtures__|__mocks__|__tests__|__integration__|fixtures|mocks|test|tests|testdata|test-data|e2e|playwright|cypress|specs?)(?:\/|$)|^(?:test|spec)-[^/]+\.[cm]?[jt]sx?$|\.(?:test|spec|e2e|e2e-spec|integration-test|fixture|fixtures|stories|story)\.[cm]?[jt]sx?$|(?:^|\/)(?:playwright|cypress|vitest|jest|karma)[^/]*\.conf(?:ig)?\.[cm]?[jt]s$|(?:^|\/)(?:test_[^/]+|[^/]+_test|conftest)\.py$|\.env\.[^/]*(?:test|e2e)[^/]*$/i,lu=/(?:^|\/)(?:vite|next|nuxt|astro|remix|webpack|rollup|rspack|rsbuild|esbuild|tsup|metro|expo|babel|tailwind|postcss|svelte|farm|parcel|snowpack)[^/]*\.config\.[cm]?[jt]sx?$/i,uu=/(?:^|\/)scripts(?:\/|$)/i,du=/(?:^|\/)(?:examples?|tutorials?|demos?|samples?|playgrounds?)(?:\/|$)/i,fu=/(?:^|\/)(?:README|CHANGELOG|CONTRIBUTING|PUBLISHING|DOCS)\.mdx?$|\.mdx?$/i,pu=/(?:^|\/)(?:generated|__generated__|dist|build|coverage|out|storybook-static|vendor|vendors|third[-_]?party|libraries)(?:\/|$)|(?:^|\/)\.next\/|(?:^|\/)\.open-next\/|(?:^|\/)\.yarn\/|(?:^|\/)public\/(?:chunks?|assets?|build|dist|static)\/|(?:generated|\.gen)\.[cm]?[jt]sx?$|@\d+\.\d+\.\d+(?:[-.][\w.]+)?\.[cm]?js$|[.-]min\.[cm]?js$|\.asm\.js$|(?:^|\/)[\w-]+[.@-]\d+\.\d+\.\d+(?:[-.][\w.]+)?\//i,mu=/\.(iife|umd|global|min)\.js$/i,hu=[/(?:^|\/)\.next\/static\//,/(?:^|\/)\.output\/public\//,/(?:^|\/)build\/static\//,/(?:^|\/)dist\/assets\//,/(?:^|\/)public\//,/(?:^|\/)out\//,/(?:^|\/)storybook-static\//],gu=/\b(?:exec|execSync|spawn|child_process|eval|new Function|vm\.run|readFile|writeFile|fs\.read|fs\.write|fetch|axios|http\.request|sandbox|runCode|executeCode)\b/,_u=new Set([`.next`,`.output`]),vu=e=>{let t=e.split(`/`);for(let e=0;e<t.length;e+=1)if(_u.has(t[e])&&(t[e]===`.next`&&t[e+1]===`dev`||t[e+1]===`server`&&e+2<t.length))return!0;return!1},yu=(e,t)=>vu(e)?!1:t||e.endsWith(`.map`)?!0:hu.some(t=>t.test(e)),bu=e=>/(?:^|\/)(?:package\.json|Dockerfile|docker-compose\.ya?ml|\.github\/workflows\/[^/]+\.ya?ml|vercel\.json|next\.config\.[cm]?[jt]s|netlify\.toml)$/i.test(e),xu=new Map,Su=(e,t)=>{let n=xu.get(t);n||(n=new Map,xu.set(t,n));let r=n.get(e);if(r!==void 0)return r;let i=t.test(e)&&!cu.test(e)&&!uu.test(e)&&!fu.test(e)&&!pu.test(e);return n.set(e,i),i},K=e=>/\.d\.[cm]?[jt]s$/i.test(e)?!1:Su(e,iu),Cu=/<script\b|on(?:load|error|click|mouseover)\s*=/i,wu=/dangerouslyAllowSVG\s*:\s*true/i,Tu=/<(?:object|embed|iframe)\b[^>]+(?:data|src)=["'][^"']+\.svg(?:\?[^"']*)?["']/i,Eu=W({id:`active-static-asset`,title:`Executable SVG exposure`,severity:`warn`,recommendation:"Prefer `<img>` for SVG images; if SVG must be served directly, use attachment disposition and a CSP that blocks scripts and objects.",scan:e=>{let t=[];if(e.relativePath.endsWith(`.svg`)&&yu(e.relativePath,e.isGeneratedBundle)){if(Cu.test(e.content)){let n=tu(e.content,Cu);t.push({message:`A browser-reachable SVG contains script or event-handler code.`,line:n.line,column:n.column,severity:`error`,title:`Active SVG in public assets`,help:`Serve untrusted SVG as downloads, sanitize it, or isolate it on a cookieless asset origin with a restrictive CSP.`})}return t}if(!K(e.relativePath)&&!bu(e.relativePath))return t;let n=[wu,Tu].find(t=>t.test(e.content));if(n!==void 0){let r=tu(e.content,n);t.push({message:`The app enables or embeds SVG in an executable browser context.`,line:r.line,column:r.column})}return t}}),Du=e=>/(?:^|\/)(?:firestore\.rules|storage\.rules|database\.rules\.json)$/.test(e),Ou=/\s/,ku=/[\p{ID_Continue}$]/u,Au=/["'`/]/g,ju=/["'`/{}]/g,Mu=/["\\\n]/g,Nu=/['\\\n]/g,Pu=/[`\\$\n]/g,Fu=new Set([`return`,`typeof`,`case`,`in`,`of`,`new`,`delete`,`void`,`instanceof`,`do`,`else`,`yield`,`await`,`throw`]),Iu=()=>{let e=[],t=[],n=-1,r=-1,i=()=>{n<0||(e.push(n),t.push(r),n=-1,r=-1)},a=(e,t)=>{if(e===r){r=t;return}if(e<r){r=Math.max(r,t);return}i(),n=e,r=t};return{blank:e=>a(e,e+1),blankSpan:a,isBlanked:i=>{if(i>=n&&i<r)return!0;for(let n=e.length-1;n>=0;--n)if(!(e[n]>i))return t[n]>i;return!1},apply:n=>{if(i(),e.length===0)return n;let r=[],a=0;for(let i=0;i<e.length;i+=1)r.push(n.slice(a,e[i]),` `.repeat(t[i]-e[i])),a=t[i];return r.push(n.slice(a)),r.join(``)}}},Lu=(e,t,n)=>{let r=n=>t.isBlanked(n)?` `:e[n],i=n-1;for(;i>=0&&Ou.test(r(i));)--i;if(i<0)return!0;let a=r(i),o=i>0?r(i-1):``;if(ku.test(a)){let t=i;for(;t>0&&ku.test(r(t-1));)--t;return t>0&&r(t-1)===`.`?!1:Fu.has(e.slice(t,i+1))}return a===`<`?!1:a===`>`?o===`=`:a===`+`||a===`-`?o!==a:a===`!`?!(ku.test(o)||o===`)`||o===`]`):!(a===`)`||a===`]`||a===`}`||a===`"`||a===`'`||a==="`")},Ru=(e,t)=>{let n=t+1,r=!1;for(;n<e.length;){let t=e[n];if(t===`\\`){n+=2;continue}if(t===`
-`)return null;if(t===`[`)r=!0;else if(t===`]`)r=!1;else if(t===`/`&&!r)return e[n+1]===`/`?null:n+1;n+=1}return null},zu=(e,t,n)=>{for(let r=t+1;r<e.length;r+=1){let t=e.charCodeAt(r);if(t===92){r+=1;continue}if(t===n)return!1;if(Ou.test(e[r]))return!0}return!1},Bu=(e,t)=>{let n=e.length,r=Iu(),i=-1,a=!1,o=[],s=0,c=t=>{t>=n||e.charCodeAt(t)===10||r.blank(t)};for(;s<n;){if(i===-1){let t=o.length>0?ju:Au;t.lastIndex=s;let n=t.exec(e);if(n===null)break;s=n.index}else{let t=i===34?Mu:i===39?Nu:Pu;t.lastIndex=s;let o=t.exec(e),c=o===null?n:o.index;if(a&&c>s&&r.blankSpan(s,c),s=c,o===null)break}let l=e.charCodeAt(s),u=e.charCodeAt(s+1);if(i!==-1){if(l===92){a&&(c(s),c(s+1)),s+=2;continue}if(l===10&&i!==96){i=-1,s+=1;continue}if(l===i){i=-1,s+=1;continue}if(t&&i===96&&l===36&&u===123){o.push(0),i=-1,s+=2;continue}a&&c(s),s+=1;continue}if(l===34||l===39){i=l,a=t&&zu(e,s,l),s+=1;continue}if(l===96){i=96,a=t,s+=1;continue}if(l===47&&u===47){for(;s<n&&e.charCodeAt(s)!==10;)r.blank(s),s+=1;continue}if(l===47&&u===42){for(;s<n;){if(e.charCodeAt(s)===42&&e.charCodeAt(s+1)===47){r.blank(s),r.blank(s+1),s+=2;break}c(s),s+=1}continue}if(l===47){let n=Lu(e,r,s)?Ru(e,s):null;if(n!==null){if(t)for(let e=s+1;e<n-1;e+=1)c(e);s=n;continue}}if(o.length>0){let e=o.length-1;l===123?o[e]+=1:l===125&&(o[e]===0?(o.pop(),i=96,a=t):--o[e])}s+=1}return r.apply(e)},Vu=e=>e.includes(`//`)||e.includes(`/*`)?Bu(e,!1):e,Hu=e=>Bu(e,!0),Uu=new WeakMap,Wu=new WeakMap,Gu=(e,t=!1)=>{if(!iu.test(e.relativePath)&&!Du(e.relativePath))return e.content;let n=t?Wu:Uu,r=n.get(e);if(r!==void 0)return r;let i=t?Hu(e.content):Vu(e.content);return n.set(e,i),i},q=({shouldScan:e,pattern:t,requireAll:n,suppressWhen:r,ignoreStringLiterals:i,message:a})=>o=>{if(!e(o))return[];let s=Gu(o,i);if(n!==void 0&&!n.every(e=>e.test(s)))return[];let c=-1;if(t instanceof RegExp)c=s.search(t);else for(let e=0;e<t.length&&(c=s.search(t[e]),!(c>=0));e+=1);if(c<0||r!==void 0&&r.test(s))return[];let{line:l,column:u}=G(s,c);return[{message:a,line:l,column:u}]},Ku=/\b(?:tool\s*\(\s*\{|createTool\s*\(|defineTool\s*\(|new\s+(?:DynamicTool|StructuredTool)\s*\()/,qu=/\b(?:tool|createTool|defineTool|DynamicTool|StructuredTool)\b/,Ju=/(?:^|\/)(?:agents?|tools?|mcp)(?:\/|$)|(?:agent|tool|mcp)[^/]*\.[cm]?[jt]sx?$/i,Yu=W({id:`agent-tool-capability-risk`,defaultEnabled:!1,title:`Agent tool exposes dangerous capability`,severity:`warn`,recommendation:`Treat tool inputs as prompt-injection controlled. Validate arguments, scope permissions per call, and avoid exposing shell/file/network primitives directly to agents.`,scan:q({shouldScan:e=>K(e.relativePath)&&Ju.test(e.relativePath)&&qu.test(e.content)&&gu.test(e.content),pattern:Ku,requireAll:[gu],ignoreStringLiterals:!0,message:`An agent-callable tool appears to expose network, filesystem, shell, or code-execution capability.`})}),Xu=W({id:`artifact-baas-authority-surface`,defaultEnabled:!1,title:`BaaS authority map shipped in browser artifact`,severity:`warn`,recommendation:`Client BaaS config is often public, but shipped collection names plus owner, role, tenant, or admin fields give attackers a precise authorization map. Verify rules/RLS enforce every boundary server-side.`,scan:q({shouldScan:e=>yu(e.relativePath,e.isGeneratedBundle),pattern:/\b(?:collection\s*\(\s*["'](?:boosts|sessions|sessions_admin|users|orgs|candidateJobs|conversations|documents|profiles)|from\s*\(\s*["'](?:users|profiles|documents|organizations|memberships)|creatorID|creatorId|providerId|ghostOrg|ownerId|orgId|tenantId|workspaceId|isAdmin|SuperAdmin)\b/i,requireAll:[/\b(?:initializeApp|firebase|firestore|getFirestore)\b[\s\S]{0,700}\b(?:apiKey|authDomain|projectId|databaseURL|storageBucket)\b|\b(?:apiKey|authDomain|projectId|databaseURL|storageBucket)\b[\s\S]{0,700}\b(?:firebase|firestore|getFirestore|initializeApp)\b|\bcreateClient\b[\s\S]{0,700}\b(?:supabase|SUPABASE_URL)\b|\b(?:supabase|SUPABASE_URL)\b[\s\S]{0,700}\bcreateClient\b/i],message:`A browser artifact exposes Firebase/Supabase config together with sensitive collections or authorization fields.`})}),Zu=new Set([`auth`,`getSession`,`getServerSession`,`getUser`,`requireAuth`,`checkAuth`,`verifyAuth`,`authenticate`,`currentUser`,`getAuth`,`validateSession`]),Qu=/^auth(?:n|z|ed|enticate[ds]?|enticating|entication|orize[ds]?|orizing|orization|orizer)?$/,$u=new Set([`signedin`,`loggedin`,`signin`]),ed=new Set([`require`,`ensure`,`assert`,`verify`,`validate`,`check`,`protect`,`enforce`,`guard`,`gate`,`restrict`,`is`,`has`,`can`,`must`]),td=new Set([`get`,`fetch`,`load`,`read`,`resolve`,`retrieve`,`use`]),nd=new Set([`current`,`my`,`own`]),rd=new Set([`session`,`sessions`,`login`,`admin`,`admins`,`superadmin`,`superuser`,`role`,`roles`,`permission`,`permissions`,`jwt`,`identity`,`principal`,`credential`,`credentials`]),id=new Set([`user`,`users`,`account`,`accounts`,`token`,`tokens`,`access`,`me`,`viewer`,`caller`,`subject`,`scope`,`scopes`]),ad=new Set([`getUser`]),od=/(?:^|[._])(?:auth|authn|authz|clerk|session|jwt|firebase|supabase|nextauth|kinde|workos|stytch|descope|cognito|propelauth|lucia)/i,sd=[/^sk_live_/,/^sk_test_/,/^AKIA[0-9A-Z]{16}$/,/^ghp_[a-zA-Z0-9]{36}$/,/^gho_[a-zA-Z0-9]{36}$/,/^github_pat_/,/^glpat-/,/^xox[bporas]-/,/^sk-[a-zA-Z0-9]{32,}$/],cd=[/\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/,/\bAWS_SECRET_ACCESS_KEY\s*[:=]\s*["']?[A-Za-z0-9/+=]{35,}["']?/,/\bgithub_pat_[A-Za-z0-9_]{30,}\b/,/\bgh[pousr]_[A-Za-z0-9]{30,}\b/,/\bglpat-[A-Za-z0-9_-]{20,}\b/,/\bxox[baprs]-[A-Za-z0-9-]{20,}\b/,/\bsk_(?:live|test)_[A-Za-z0-9]{16,}\b/,/\brk_(?:live|test)_[A-Za-z0-9]{16,}\b/,/\bsk-[A-Za-z0-9_-]{32,}\b/,/\bsk-ant-api\d{2}-[A-Za-z0-9_-]{20,}\b/,/\blin_(?:api|oauth)_[A-Za-z0-9]{20,}\b/,/\bvercel_[A-Za-z0-9]{20,}\b/,/\bsntrys_[A-Za-z0-9_-]{20,}\b/,/\bkey-[a-f0-9]{32}\b/i,/\bnpm_[A-Za-z0-9]{30,}\b/,/\bSG\.[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}\b/,/https:\/\/hooks\.slack\.com\/services\/T[A-Z0-9]+\/B[A-Z0-9]+\/[A-Za-z0-9]+/,/https:\/\/discord(?:app)?\.com\/api\/webhooks\/\d+\/[A-Za-z0-9_-]+/,/\bsb_secret_[A-Za-z0-9_]{20,}\b/,/\bservice_role\b/i,/"private_key"\s*:\s*"-----BEGIN PRIVATE KEY-----/,/-----BEGIN (?:RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----/,/\b(?:postgres|mysql|mongodb(?:\+srv)?|redis):\/\/[^:\s/@]+:(?!(?:pass(?:word)?|my[a-z]*pass(?:word)?|mysecretpassword|myusername|postgres|mysql|redis|root|admin|minioadmin|secret|example|changeme|change_me|test|guest|placeholder|default|user(?:name)?|x{3,}|\*{2,}|\$\{[^}]*\}|\$[A-Z_]+|<[^>]*>|%[\w.]+%|\{\{[^}]*\}\})@)[^@\s/]+@(?!(?:localhost|127\.0\.0\.1|0\.0\.0\.0|host\.docker\.internal)(?:[:/\s]|$))[^\s:/@]*\./i],ld=/\beyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{16,}\b/,ud=/\b(?:NEXT_PUBLIC|VITE|REACT_APP|EXPO_PUBLIC)_[A-Z0-9_]*(?:SECRET|TOKEN|PASSWORD|PRIVATE|DATABASE_URL|SERVICE_ROLE|AWS_ACCESS_KEY|AWS_SECRET)[A-Z0-9_]*\b/i,dd=/\b(?:process\s*\.\s*env|import\s*\.\s*meta\s*\.\s*env|window\.__[A-Z0-9_]*ENV[A-Z0-9_]*__|__[A-Z0-9_]*ENV[A-Z0-9_]*__)\b/,fd=/\b(?:(?:process|window)\s*(?:\/[*/]|<!--|-->|\.\s*(?:\/[*/]|<!--|-->))|import\s*(?:\/[*/]|<!--|-->|\.\s*(?:\/[*/]|<!--|-->|meta\s*(?:\/[*/]|<!--|-->|\.\s*(?:\/[*/]|<!--|-->)))))/,pd=/\b(?:DATABASE_URL|AWS_SECRET_ACCESS_KEY|AWS_ACCESS_KEY_ID|MAILGUN_API_KEY|SALESFORCE_CLIENT_SECRET|OKTA_CLIENT_SECRET|SESSION_SECRET|COOKIE_SECRET|PRIVATE_KEY|SERVICE_ROLE)\b/,md=/(?:SENTRY_DSN|PUBLIC_KEY|(?:^|_)PUBLIC_TOKEN$|PUBLISHABLE|ANON_KEY|POSTHOG_(?:PROJECT_)?TOKEN|POSTHOG_KEY|TLDRAW_LICENSE_KEY|CLERK_PUBLISHABLE_KEY|ALGOLIA_SEARCH_KEY|GC_API_KEY|GOOGLE_MAPS_API_KEY|MAPBOX_TOKEN|MIXPANEL_TOKEN|FACEBOOK_CLIENT_TOKEN|(?:NEXT_PUBLIC|VITE|REACT_APP|EXPO_PUBLIC)_(?:DISABLE|ENABLE|ALLOW|REQUIRE)_)|(?:TOKEN|SECRET|PASSWORD|PRIVATE)_(?:KIND|TYPE|URL|URI|ENDPOINT|HEADER|NAME)$/i,hd=[/^appl_/,/^goog_/,/^amzn_/,/^strp_/,/^pk_(?:live|test)_/,/^sb_publishable_/,/^phc_/,/^public-token-(?:live|test)-/,/^pk\.eyJ/],gd=[/^[\s._\-*\u2022xX]{8,}$/,/(?:\.{3,}|\u2026|[*\u2022]{3,})/,/(?:^|[_\-\s])(?:your|redacted|masked|placeholder|replace[_\-\s]?me|changeme)(?:$|[_\-\s])/i,/<[^>]*(?:auth|credential|key|password|secret|token|your|redacted|placeholder|masked)[^>]*>/i,/\[[^\]]*(?:auth|credential|key|password|secret|token|your|redacted|placeholder|masked)[^\]]*\]/i,/\{[^}]*(?:auth|credential|key|password|secret|token|your|redacted|placeholder|masked)[^}]*\}/i],_d=[/(?:^|[_\-\s])(?:example|sample|dummy)(?:$|[_\-\s])/i],vd=/(?:placeholder|example|sample|dummy|masked|redacted|mask)/i,yd=/(?:api_?key|secret|token|password|credential|auth(?!or(?!i[sz])))/i,bd=/(?:^|\/)[^/]+\.config\.[cm]?[jt]s$/,xd=/(?:^|\/)(?:\.[a-z-]+rc|[a-z-]+\.rc)\.[cm]?[jt]s$/,Sd=/(?:^|\/)[^/]+\.(?:test|spec|stories|story|fixture|fixtures)\.[cm]?[jt]sx?$/,Cd=/(?:^|\/)[^/]+\.server\.[cm]?[jt]sx?$/,wd=/(?:^|\/)(?:middleware|proxy|route)\.[cm]?[jt]sx?$/,Td=/(?:^|\/)pages\/api\/.+\.[cm]?[jt]sx?$/,Ed=/(?:^|\/)[^/]+\.(?:client|browser|web)\.[cm]?[jt]sx?$/,Dd=/(?:^|\/)(?:src\/)?(?:main|index|[Aa]pp|client)\.[cm]?[jt]sx?$/,Od=new Set([`backend`,`functions`,`lambdas`,`lambda`,`middleware`,`server`,`servers`]),kd=new Set([`api`,`backend`,`edge`,`function`,`functions`,`lambda`,`lambdas`,`server`,`servers`,`worker`,`workers`]),Ad=new Set([`__fixtures__`,`__mocks__`,`__tests__`,`fixtures`,`mocks`,`test`,`tests`]),jd=new Set([`bin`,`config`,`configs`,`script`,`scripts`,`tooling`,`tools`]),Md=new Set([`components`,`features`,`hooks`,`pages`,`ui`,`views`,`widgets`]),Nd=new Set(`alert.modal.label.text.title.name.id.url.path.route.page.param.field.column.header.placeholder.prefix.description.type.icon.class.style.variant.event.action.status.state.mode.flag.option.config.message.error.display.view.component.element.container.wrapper.button.link.input.select.dialog.menu.form.step.index.count.length.role.scope.context.provider.ref.handler.query.schema.constant`.split(`.`)),Pd=new Set([`start`,`end`]),J=e=>e.replace(/[.*+?^${}()|[\]\\]/g,`\\$&`),Fd=new RegExp(ud.source,`gi`),Id=e=>{for(let t of e.matchAll(Fd)){let e=t[0]??``;if(!md.test(e))return new RegExp(J(e))}},Ld=e=>dd.test(e)&&pd.test(e),Rd=/\.(?:[cm]?[jt]sx?)$/i,zd=/\/\/|\/\*|<!--/,Bd=new Set([`\r`,`
-`,`\u2028`,`\u2029`]),Vd=e=>{let t=0;for(;t<e.length;){let n=e.indexOf(`-->`,t);if(n===-1)return!1;let r=n-1;for(;r>=0&&!Bd.has(e[r]??``)&&e[r]?.trim()===``;)--r;if(r<0||Bd.has(e[r]??``))return!0;t=n+3}return!1},Hd=(e,t)=>{if(!Rd.test(e)||!t.startsWith(`#!`)&&!zd.test(t)&&!Vd(t))return t;try{let n=i(e,t,{astType:`ts`,lang:pn(e)});if(n.errors.some(e=>e.severity===`Error`))return;let r=t.search(/[\r\n\u2028\u2029]/),a=[...t.startsWith(`#!`)?[{start:0,end:r===-1?t.length:r}]:[],...n.comments];if(a.length===0)return t;let o=[],s=0;for(let e of a)o.push(t.slice(s,e.start)),o.push(t.slice(e.start,e.end).replace(/[^\r\n\u2028\u2029]/g,` `)),s=e.end;return o.push(t.slice(s)),o.join(``)}catch{return}},Ud=/\.map$/i,Wd=/\s/,Gd=/[^\r\n\u2028\u2029]/g,Y=(e,t)=>{let n=t;for(;n<e.length&&Wd.test(e[n]??``);)n+=1;return n},Kd=(e,t)=>{if(e[t]!==`"`)return;let n=t+1;for(;n<e.length;){if(e[n]===`\\`){n+=2;continue}if(e[n]===`"`)return n+1;n+=1}},qd=(e,t)=>{let n=Y(e,t);if(e[n]===`"`)return Kd(e,n);if(e[n]!==`[`&&e[n]!==`{`){let t=n;for(;t<e.length&&![`,`,`]`,`}`].includes(e[t]??``);)t+=1;return t}let r=[e[n]===`[`?`]`:`}`],i=n+1;for(;i<e.length&&r.length>0;){if(e[i]===`"`){let t=Kd(e,i);if(t===void 0)return;i=t;continue}e[i]===`[`&&r.push(`]`),e[i]===`{`&&r.push(`}`),e[i]===r.at(-1)&&r.pop(),i+=1}return r.length===0?i:void 0},Jd=(e,t)=>{let n=Y(e,0);if(e[n]!==`{`)return;n=Y(e,n+1);let r;for(;n<e.length&&e[n]!==`}`;){let i=Kd(e,n);if(i===void 0)return;let a=JSON.parse(e.slice(n,i));if(n=Y(e,i),e[n]!==`:`)return;if(n=Y(e,n+1),a===t){if(r!==void 0)return;r=n}let o=qd(e,n);if(o===void 0)return;if(n=Y(e,o),e[n]===`,`){n=Y(e,n+1);continue}if(e[n]!==`}`)return}return r},Yd=(e,t,n)=>{let r=Y(e,t);if(e[r]!==`[`)return;r=Y(e,r+1);let i=[];for(let t of n){if(typeof t==`string`){let t=Kd(e,r);if(t===void 0)return;i.push({start:r,end:t}),r=t}else if(t===null&&e.startsWith(`null`,r))i.push({start:r,end:r+4}),r+=4;else return;if(r=Y(e,r),e[r]===`,`){r=Y(e,r+1);continue}}return e[r]===`]`?i:void 0},Xd=(e,t)=>`${e}/${t}`.split(/[\\/]/).includes(`node_modules`),Zd=(e,t)=>{if(!Ud.test(e)||!t.includes(`"sourcesContent"`))return t;try{let e=JSON.parse(t);if(typeof e!=`object`||!e||Array.isArray(e))return t;let n=Reflect.get(e,`sources`),r=Reflect.get(e,`sourcesContent`),i=Reflect.get(e,`sourceRoot`);if(!Array.isArray(n)||!n.every(e=>typeof e==`string`)||!Array.isArray(r)||n.length!==r.length||i!==void 0&&typeof i!=`string`)return t;let a=Jd(t,`sourcesContent`);if(a===void 0)return t;let o=Yd(t,a,r);if(o===void 0)return t;let s=i??``,c=[],l=0;for(let[e,r]of n.entries()){if(!Xd(s,r))continue;let n=o[e];if(n===void 0)return t;c.push(t.slice(l,n.start)),c.push(t.slice(n.start,n.end).replace(Gd,` `)),l=n.end}return l===0?t:(c.push(t.slice(l)),c.join(``))}catch{return t}},Qd=(e,t,n)=>{if(fu.test(e.relativePath)||!yu(e.relativePath,e.isGeneratedBundle))return[];let r=t(e.content);if(r===void 0)return[];let i=tu(e.content,r);return[{message:n,line:i.line,column:i.column}]},$d=`A browser artifact contains server-secret environment names or a full environment dump shape.`,ef=e=>Id(e)??(Ld(e)?pd:void 0),tf=W({id:`artifact-env-leak`,title:`Server env leaked to browser artifact`,severity:`error`,recommendation:`Treat public env prefixes as publication, not secrecy; keep secret env vars server-only and rebuild after rotating leaked keys.`,scan:e=>{let t=Zd(e.relativePath,e.content),n=t===e.content?e:{...e,content:t},r=!1,i=Qd(n,e=>{let t=Id(e);if(t)return r=!0,t;if(pd.test(e))return dd.test(e)?(r=!0,pd):fd.test(e)?pd:void 0},$d);if(i.length===0)return i;let a=r?i:Qd(n,ef,$d),o=Hd(n.relativePath,n.content);return o===void 0?i:o===n.content?a:Qd({...n,content:o},ef,$d)}}),nf=W({id:`artifact-secret-leak`,title:`Secret shipped in browser artifact`,severity:`error`,recommendation:`Remove the secret from client bundles/static assets, rotate it, and route privileged service calls through server-only code.`,scan:e=>Qd(e,e=>cd.find(t=>t.test(e)),`A browser-delivered artifact contains a secret-looking credential value.`)}),rf=/(?:npm|pnpm|yarn|bun)\s+(?:install|ci)\b(?:(?!--ignore-scripts)[\s\S]){0,700}\bsecrets\.[A-Z0-9_]+|\bsecrets\.[A-Z0-9_]+(?:(?!--ignore-scripts)[\s\S]){0,700}(?:npm|pnpm|yarn|bun)\s+(?:install|ci)\b/i,af=/(?:npm|pnpm|yarn|bun)\s+(?:install|ci)\b/i,of=/\bsecrets\.[A-Z0-9_]+/,sf=/--ignore-scripts\b/,cf=`The build or install pipeline can execute package lifecycle code while CI secrets may be present.`,lf=e=>/(?:^|\/)\.github\/workflows\/[^/]+\.ya?ml$/i.test(e),uf=e=>{let t=e.split(`
-`),n=[],r=[],i,a,o;for(let e=0;e<t.length;e+=1){let s=t[e],c=s.trim();if(c===``||c.startsWith(`#`))continue;let l=s.length-s.trimStart().length;if(i!==void 0&&l<=i&&(i=void 0,a=void 0,o=void 0),i===void 0){/^steps:\s*(?:#.*)?$/.test(c)?i=l:n.push(s);continue}if((c===`-`||c.startsWith(`- `))&&(a===void 0||l===a)){a=l,o={startLineIndex:e,lines:[s]},r.push(o);continue}o===void 0?n.push(s):o.lines.push(s)}let s=of.test(n.join(`
+`||r===`\u2028`||r===`\u2029`)&&t.push(n+1)}return t},tu=e=>{if($l?.content===e)return $l.lineStartOffsets;let t=eu(e);return $l={content:e,lineStartOffsets:t},t},G=(e,t)=>{if(Number.isNaN(t)||t<0)return{line:1,column:1};let n=tu(e),r=Math.min(Math.trunc(t),e.length),i=0,a=n.length-1;for(;i<a;){let e=i+a+1>>1;n[e]<=r?i=e:a=e-1}return{line:i+1,column:r-n[i]+1}},nu=(e,t)=>G(e,e.search(t)),ru=/\.(?:[cm]?[jt]sx?|json|jsonc|map|html?|mdx?|ya?ml|toml|sql|rules|env|txt|log|svg|xml|pem|key|crt|cert|pub|py|php)$/i,iu=/(?:^|\/)\.env(?:\.|$)/,au=/\.(?:[cm]?[jt]sx?)$/i,ou=/\.(?:[cm]?[jt]sx?|py|php)$/i,su=/\.(?:[cm]?[jt]sx?|py)$/i,cu=/(?:^|\/)(?:api|backend|server|servers|middleware|route|routes|functions|lambdas|workers)(?:\/|$)|(?:^|\/)[^/]+\.server\.[cm]?[jt]sx?$/i,lu=/(?:^|\/)(?:__fixtures__|__mocks__|__tests__|__integration__|fixtures|mocks|test|tests|testdata|test-data|e2e|playwright|cypress|specs?)(?:\/|$)|^(?:test|spec)-[^/]+\.[cm]?[jt]sx?$|\.(?:test|spec|e2e|e2e-spec|integration-test|fixture|fixtures|stories|story)\.[cm]?[jt]sx?$|(?:^|\/)(?:playwright|cypress|vitest|jest|karma)[^/]*\.conf(?:ig)?\.[cm]?[jt]s$|(?:^|\/)(?:test_[^/]+|[^/]+_test|conftest)\.py$|\.env\.[^/]*(?:test|e2e)[^/]*$/i,uu=/(?:^|\/)(?:vite|next|nuxt|astro|remix|webpack|rollup|rspack|rsbuild|esbuild|tsup|metro|expo|babel|tailwind|postcss|svelte|farm|parcel|snowpack)[^/]*\.config\.[cm]?[jt]sx?$/i,du=/(?:^|\/)scripts(?:\/|$)/i,fu=/(?:^|\/)(?:examples?|tutorials?|demos?|samples?|playgrounds?)(?:\/|$)/i,pu=/(?:^|\/)(?:README|CHANGELOG|CONTRIBUTING|PUBLISHING|DOCS)\.mdx?$|\.mdx?$/i,mu=/(?:^|\/)(?:generated|__generated__|dist|build|coverage|out|storybook-static|vendor|vendors|third[-_]?party|libraries)(?:\/|$)|(?:^|\/)\.next\/|(?:^|\/)\.open-next\/|(?:^|\/)\.yarn\/|(?:^|\/)public\/(?:chunks?|assets?|build|dist|static)\/|(?:generated|\.gen)\.[cm]?[jt]sx?$|@\d+\.\d+\.\d+(?:[-.][\w.]+)?\.[cm]?js$|[.-]min\.[cm]?js$|\.asm\.js$|(?:^|\/)[\w-]+[.@-]\d+\.\d+\.\d+(?:[-.][\w.]+)?\//i,hu=/\.(iife|umd|global|min)\.js$/i,gu=[/(?:^|\/)\.next\/static\//,/(?:^|\/)\.output\/public\//,/(?:^|\/)build\/static\//,/(?:^|\/)dist\/assets\//,/(?:^|\/)public\//,/(?:^|\/)out\//,/(?:^|\/)storybook-static\//],_u=/\b(?:exec|execSync|spawn|child_process|eval|new Function|vm\.run|readFile|writeFile|fs\.read|fs\.write|fetch|axios|http\.request|sandbox|runCode|executeCode)\b/,vu=new Set([`.next`,`.output`]),yu=e=>{let t=e.split(`/`);for(let e=0;e<t.length;e+=1)if(vu.has(t[e])&&(t[e]===`.next`&&t[e+1]===`dev`||t[e+1]===`server`&&e+2<t.length))return!0;return!1},bu=(e,t)=>yu(e)?!1:t||e.endsWith(`.map`)?!0:gu.some(t=>t.test(e)),xu=e=>/(?:^|\/)(?:package\.json|Dockerfile|docker-compose\.ya?ml|\.github\/workflows\/[^/]+\.ya?ml|vercel\.json|next\.config\.[cm]?[jt]s|netlify\.toml)$/i.test(e),Su=new Map,Cu=(e,t)=>{let n=Su.get(t);n||(n=new Map,Su.set(t,n));let r=n.get(e);if(r!==void 0)return r;let i=t.test(e)&&!lu.test(e)&&!du.test(e)&&!pu.test(e)&&!mu.test(e);return n.set(e,i),i},K=e=>/\.d\.[cm]?[jt]s$/i.test(e)?!1:Cu(e,au),wu=/<script\b|on(?:load|error|click|mouseover)\s*=/i,Tu=/dangerouslyAllowSVG\s*:\s*true/i,Eu=/<(?:object|embed|iframe)\b[^>]+(?:data|src)=["'][^"']+\.svg(?:\?[^"']*)?["']/i,Du=W({id:`active-static-asset`,title:`Executable SVG exposure`,severity:`warn`,recommendation:"Prefer `<img>` for SVG images; if SVG must be served directly, use attachment disposition and a CSP that blocks scripts and objects.",scan:e=>{let t=[];if(e.relativePath.endsWith(`.svg`)&&bu(e.relativePath,e.isGeneratedBundle)){if(wu.test(e.content)){let n=nu(e.content,wu);t.push({message:`A browser-reachable SVG contains script or event-handler code.`,line:n.line,column:n.column,severity:`error`,title:`Active SVG in public assets`,help:`Serve untrusted SVG as downloads, sanitize it, or isolate it on a cookieless asset origin with a restrictive CSP.`})}return t}if(!K(e.relativePath)&&!xu(e.relativePath))return t;let n=[Tu,Eu].find(t=>t.test(e.content));if(n!==void 0){let r=nu(e.content,n);t.push({message:`The app enables or embeds SVG in an executable browser context.`,line:r.line,column:r.column})}return t}}),Ou=e=>/(?:^|\/)(?:firestore\.rules|storage\.rules|database\.rules\.json)$/.test(e),ku=/\s/,Au=/[\p{ID_Continue}$]/u,ju=/["'`/]/g,Mu=/["'`/{}]/g,Nu=/["\\\n]/g,Pu=/['\\\n]/g,Fu=/[`\\$\n]/g,Iu=new Set([`return`,`typeof`,`case`,`in`,`of`,`new`,`delete`,`void`,`instanceof`,`do`,`else`,`yield`,`await`,`throw`]),Lu=()=>{let e=[],t=[],n=-1,r=-1,i=()=>{n<0||(e.push(n),t.push(r),n=-1,r=-1)},a=(e,t)=>{if(e===r){r=t;return}if(e<r){r=Math.max(r,t);return}i(),n=e,r=t};return{blank:e=>a(e,e+1),blankSpan:a,isBlanked:i=>{if(i>=n&&i<r)return!0;for(let n=e.length-1;n>=0;--n)if(!(e[n]>i))return t[n]>i;return!1},apply:n=>{if(i(),e.length===0)return n;let r=[],a=0;for(let i=0;i<e.length;i+=1)r.push(n.slice(a,e[i]),` `.repeat(t[i]-e[i])),a=t[i];return r.push(n.slice(a)),r.join(``)}}},Ru=(e,t,n)=>{let r=n=>t.isBlanked(n)?` `:e[n],i=n-1;for(;i>=0&&ku.test(r(i));)--i;if(i<0)return!0;let a=r(i),o=i>0?r(i-1):``;if(Au.test(a)){let t=i;for(;t>0&&Au.test(r(t-1));)--t;return t>0&&r(t-1)===`.`?!1:Iu.has(e.slice(t,i+1))}return a===`<`?!1:a===`>`?o===`=`:a===`+`||a===`-`?o!==a:a===`!`?!(Au.test(o)||o===`)`||o===`]`):!(a===`)`||a===`]`||a===`}`||a===`"`||a===`'`||a==="`")},zu=(e,t)=>{let n=t+1,r=!1;for(;n<e.length;){let t=e[n];if(t===`\\`){n+=2;continue}if(t===`
+`)return null;if(t===`[`)r=!0;else if(t===`]`)r=!1;else if(t===`/`&&!r)return e[n+1]===`/`?null:n+1;n+=1}return null},Bu=(e,t,n)=>{for(let r=t+1;r<e.length;r+=1){let t=e.charCodeAt(r);if(t===92){r+=1;continue}if(t===n)return!1;if(ku.test(e[r]))return!0}return!1},Vu=(e,t)=>{let n=e.length,r=Lu(),i=-1,a=!1,o=[],s=0,c=t=>{t>=n||e.charCodeAt(t)===10||r.blank(t)};for(;s<n;){if(i===-1){let t=o.length>0?Mu:ju;t.lastIndex=s;let n=t.exec(e);if(n===null)break;s=n.index}else{let t=i===34?Nu:i===39?Pu:Fu;t.lastIndex=s;let o=t.exec(e),c=o===null?n:o.index;if(a&&c>s&&r.blankSpan(s,c),s=c,o===null)break}let l=e.charCodeAt(s),u=e.charCodeAt(s+1);if(i!==-1){if(l===92){a&&(c(s),c(s+1)),s+=2;continue}if(l===10&&i!==96){i=-1,s+=1;continue}if(l===i){i=-1,s+=1;continue}if(t&&i===96&&l===36&&u===123){o.push(0),i=-1,s+=2;continue}a&&c(s),s+=1;continue}if(l===34||l===39){i=l,a=t&&Bu(e,s,l),s+=1;continue}if(l===96){i=96,a=t,s+=1;continue}if(l===47&&u===47){for(;s<n&&e.charCodeAt(s)!==10;)r.blank(s),s+=1;continue}if(l===47&&u===42){for(;s<n;){if(e.charCodeAt(s)===42&&e.charCodeAt(s+1)===47){r.blank(s),r.blank(s+1),s+=2;break}c(s),s+=1}continue}if(l===47){let n=Ru(e,r,s)?zu(e,s):null;if(n!==null){if(t)for(let e=s+1;e<n-1;e+=1)c(e);s=n;continue}}if(o.length>0){let e=o.length-1;l===123?o[e]+=1:l===125&&(o[e]===0?(o.pop(),i=96,a=t):--o[e])}s+=1}return r.apply(e)},Hu=e=>e.includes(`//`)||e.includes(`/*`)?Vu(e,!1):e,Uu=e=>Vu(e,!0),Wu=new WeakMap,Gu=new WeakMap,Ku=(e,t=!1)=>{if(!au.test(e.relativePath)&&!Ou(e.relativePath))return e.content;let n=t?Gu:Wu,r=n.get(e);if(r!==void 0)return r;let i=t?Uu(e.content):Hu(e.content);return n.set(e,i),i},q=({shouldScan:e,pattern:t,requireAll:n,suppressWhen:r,ignoreStringLiterals:i,message:a})=>o=>{if(!e(o))return[];let s=Ku(o,i);if(n!==void 0&&!n.every(e=>e.test(s)))return[];let c=-1;if(t instanceof RegExp)c=s.search(t);else for(let e=0;e<t.length&&(c=s.search(t[e]),!(c>=0));e+=1);if(c<0||r!==void 0&&r.test(s))return[];let{line:l,column:u}=G(s,c);return[{message:a,line:l,column:u}]},qu=/\b(?:tool\s*\(\s*\{|createTool\s*\(|defineTool\s*\(|new\s+(?:DynamicTool|StructuredTool)\s*\()/,Ju=/\b(?:tool|createTool|defineTool|DynamicTool|StructuredTool)\b/,Yu=/(?:^|\/)(?:agents?|tools?|mcp)(?:\/|$)|(?:agent|tool|mcp)[^/]*\.[cm]?[jt]sx?$/i,Xu=W({id:`agent-tool-capability-risk`,defaultEnabled:!1,title:`Agent tool exposes dangerous capability`,severity:`warn`,recommendation:`Treat tool inputs as prompt-injection controlled. Validate arguments, scope permissions per call, and avoid exposing shell/file/network primitives directly to agents.`,scan:q({shouldScan:e=>K(e.relativePath)&&Yu.test(e.relativePath)&&Ju.test(e.content)&&_u.test(e.content),pattern:qu,requireAll:[_u],ignoreStringLiterals:!0,message:`An agent-callable tool appears to expose network, filesystem, shell, or code-execution capability.`})}),Zu=W({id:`artifact-baas-authority-surface`,defaultEnabled:!1,title:`BaaS authority map shipped in browser artifact`,severity:`warn`,recommendation:`Client BaaS config is often public, but shipped collection names plus owner, role, tenant, or admin fields give attackers a precise authorization map. Verify rules/RLS enforce every boundary server-side.`,scan:q({shouldScan:e=>bu(e.relativePath,e.isGeneratedBundle),pattern:/\b(?:collection\s*\(\s*["'](?:boosts|sessions|sessions_admin|users|orgs|candidateJobs|conversations|documents|profiles)|from\s*\(\s*["'](?:users|profiles|documents|organizations|memberships)|creatorID|creatorId|providerId|ghostOrg|ownerId|orgId|tenantId|workspaceId|isAdmin|SuperAdmin)\b/i,requireAll:[/\b(?:initializeApp|firebase|firestore|getFirestore)\b[\s\S]{0,700}\b(?:apiKey|authDomain|projectId|databaseURL|storageBucket)\b|\b(?:apiKey|authDomain|projectId|databaseURL|storageBucket)\b[\s\S]{0,700}\b(?:firebase|firestore|getFirestore|initializeApp)\b|\bcreateClient\b[\s\S]{0,700}\b(?:supabase|SUPABASE_URL)\b|\b(?:supabase|SUPABASE_URL)\b[\s\S]{0,700}\bcreateClient\b/i],message:`A browser artifact exposes Firebase/Supabase config together with sensitive collections or authorization fields.`})}),Qu=new Set([`auth`,`getSession`,`getServerSession`,`getUser`,`requireAuth`,`checkAuth`,`verifyAuth`,`authenticate`,`currentUser`,`getAuth`,`validateSession`]),$u=/^auth(?:n|z|ed|enticate[ds]?|enticating|entication|orize[ds]?|orizing|orization|orizer)?$/,ed=new Set([`signedin`,`loggedin`,`signin`]),td=new Set([`require`,`ensure`,`assert`,`verify`,`validate`,`check`,`protect`,`enforce`,`guard`,`gate`,`restrict`,`is`,`has`,`can`,`must`]),nd=new Set([`get`,`fetch`,`load`,`read`,`resolve`,`retrieve`,`use`]),rd=new Set([`current`,`my`,`own`]),id=new Set([`session`,`sessions`,`login`,`admin`,`admins`,`superadmin`,`superuser`,`role`,`roles`,`permission`,`permissions`,`jwt`,`identity`,`principal`,`credential`,`credentials`]),ad=new Set([`user`,`users`,`account`,`accounts`,`token`,`tokens`,`access`,`me`,`viewer`,`caller`,`subject`,`scope`,`scopes`]),od=new Set([`getUser`]),sd=/(?:^|[._])(?:auth|authn|authz|clerk|session|jwt|firebase|supabase|nextauth|kinde|workos|stytch|descope|cognito|propelauth|lucia)/i,cd=[/^sk_live_/,/^sk_test_/,/^AKIA[0-9A-Z]{16}$/,/^ghp_[a-zA-Z0-9]{36}$/,/^gho_[a-zA-Z0-9]{36}$/,/^github_pat_/,/^glpat-/,/^xox[bporas]-/,/^sk-[a-zA-Z0-9]{32,}$/],ld=[/\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/,/\bAWS_SECRET_ACCESS_KEY\s*[:=]\s*["']?[A-Za-z0-9/+=]{35,}["']?/,/\bgithub_pat_[A-Za-z0-9_]{30,}\b/,/\bgh[pousr]_[A-Za-z0-9]{30,}\b/,/\bglpat-[A-Za-z0-9_-]{20,}\b/,/\bxox[baprs]-[A-Za-z0-9-]{20,}\b/,/\bsk_(?:live|test)_[A-Za-z0-9]{16,}\b/,/\brk_(?:live|test)_[A-Za-z0-9]{16,}\b/,/\bsk-[A-Za-z0-9_-]{32,}\b/,/\bsk-ant-api\d{2}-[A-Za-z0-9_-]{20,}\b/,/\blin_(?:api|oauth)_[A-Za-z0-9]{20,}\b/,/\bvercel_[A-Za-z0-9]{20,}\b/,/\bsntrys_[A-Za-z0-9_-]{20,}\b/,/\bkey-[a-f0-9]{32}\b/i,/\bnpm_[A-Za-z0-9]{30,}\b/,/\bSG\.[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}\b/,/https:\/\/hooks\.slack\.com\/services\/T[A-Z0-9]+\/B[A-Z0-9]+\/[A-Za-z0-9]+/,/https:\/\/discord(?:app)?\.com\/api\/webhooks\/\d+\/[A-Za-z0-9_-]+/,/\bsb_secret_[A-Za-z0-9_]{20,}\b/,/\bservice_role\b/i,/"private_key"\s*:\s*"-----BEGIN PRIVATE KEY-----/,/-----BEGIN (?:RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----/,/\b(?:postgres|mysql|mongodb(?:\+srv)?|redis):\/\/[^:\s/@]+:(?!(?:pass(?:word)?|my[a-z]*pass(?:word)?|mysecretpassword|myusername|postgres|mysql|redis|root|admin|minioadmin|secret|example|changeme|change_me|test|guest|placeholder|default|user(?:name)?|x{3,}|\*{2,}|\$\{[^}]*\}|\$[A-Z_]+|<[^>]*>|%[\w.]+%|\{\{[^}]*\}\})@)[^@\s/]+@(?!(?:localhost|127\.0\.0\.1|0\.0\.0\.0|host\.docker\.internal)(?:[:/\s]|$))[^\s:/@]*\./i],ud=/\beyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{16,}\b/,dd=/\b(?:NEXT_PUBLIC|VITE|REACT_APP|EXPO_PUBLIC)_[A-Z0-9_]*(?:SECRET|TOKEN|PASSWORD|PRIVATE|DATABASE_URL|SERVICE_ROLE|AWS_ACCESS_KEY|AWS_SECRET)[A-Z0-9_]*\b/i,fd=/\b(?:process\s*\.\s*env|import\s*\.\s*meta\s*\.\s*env|window\.__[A-Z0-9_]*ENV[A-Z0-9_]*__|__[A-Z0-9_]*ENV[A-Z0-9_]*__)\b/,pd=/\b(?:(?:process|window)\s*(?:\/[*/]|<!--|-->|\.\s*(?:\/[*/]|<!--|-->))|import\s*(?:\/[*/]|<!--|-->|\.\s*(?:\/[*/]|<!--|-->|meta\s*(?:\/[*/]|<!--|-->|\.\s*(?:\/[*/]|<!--|-->)))))/,md=/\b(?:DATABASE_URL|AWS_SECRET_ACCESS_KEY|AWS_ACCESS_KEY_ID|MAILGUN_API_KEY|SALESFORCE_CLIENT_SECRET|OKTA_CLIENT_SECRET|SESSION_SECRET|COOKIE_SECRET|PRIVATE_KEY|SERVICE_ROLE)\b/,hd=/(?:SENTRY_DSN|PUBLIC_KEY|(?:^|_)PUBLIC_TOKEN$|PUBLISHABLE|ANON_KEY|POSTHOG_(?:PROJECT_)?TOKEN|POSTHOG_KEY|TLDRAW_LICENSE_KEY|CLERK_PUBLISHABLE_KEY|ALGOLIA_SEARCH_KEY|GC_API_KEY|GOOGLE_MAPS_API_KEY|MAPBOX_TOKEN|MIXPANEL_TOKEN|FACEBOOK_CLIENT_TOKEN|(?:NEXT_PUBLIC|VITE|REACT_APP|EXPO_PUBLIC)_(?:DISABLE|ENABLE|ALLOW|REQUIRE)_)|(?:TOKEN|SECRET|PASSWORD|PRIVATE)_(?:KIND|TYPE|URL|URI|ENDPOINT|HEADER|NAME)$/i,gd=[/^appl_/,/^goog_/,/^amzn_/,/^strp_/,/^pk_(?:live|test)_/,/^sb_publishable_/,/^phc_/,/^public-token-(?:live|test)-/,/^pk\.eyJ/],_d=[/^[\s._\-*\u2022xX]{8,}$/,/(?:\.{3,}|\u2026|[*\u2022]{3,})/,/(?:^|[_\-\s])(?:your|redacted|masked|placeholder|replace[_\-\s]?me|changeme)(?:$|[_\-\s])/i,/<[^>]*(?:auth|credential|key|password|secret|token|your|redacted|placeholder|masked)[^>]*>/i,/\[[^\]]*(?:auth|credential|key|password|secret|token|your|redacted|placeholder|masked)[^\]]*\]/i,/\{[^}]*(?:auth|credential|key|password|secret|token|your|redacted|placeholder|masked)[^}]*\}/i],vd=[/(?:^|[_\-\s])(?:example|sample|dummy)(?:$|[_\-\s])/i],yd=/(?:placeholder|example|sample|dummy|masked|redacted|mask)/i,bd=/(?:api_?key|secret|token|password|credential|auth(?!or(?!i[sz])))/i,xd=/(?:^|\/)[^/]+\.config\.[cm]?[jt]s$/,Sd=/(?:^|\/)(?:\.[a-z-]+rc|[a-z-]+\.rc)\.[cm]?[jt]s$/,Cd=/(?:^|\/)[^/]+\.(?:test|spec|stories|story|fixture|fixtures)\.[cm]?[jt]sx?$/,wd=/(?:^|\/)[^/]+\.server\.[cm]?[jt]sx?$/,Td=/(?:^|\/)(?:middleware|proxy|route)\.[cm]?[jt]sx?$/,Ed=/(?:^|\/)pages\/api\/.+\.[cm]?[jt]sx?$/,Dd=/(?:^|\/)[^/]+\.(?:client|browser|web)\.[cm]?[jt]sx?$/,Od=/(?:^|\/)(?:src\/)?(?:main|index|[Aa]pp|client)\.[cm]?[jt]sx?$/,kd=new Set([`backend`,`functions`,`lambdas`,`lambda`,`middleware`,`server`,`servers`]),Ad=new Set([`api`,`backend`,`edge`,`function`,`functions`,`lambda`,`lambdas`,`server`,`servers`,`worker`,`workers`]),jd=new Set([`__fixtures__`,`__mocks__`,`__tests__`,`fixtures`,`mocks`,`test`,`tests`]),Md=new Set([`bin`,`config`,`configs`,`script`,`scripts`,`tooling`,`tools`]),Nd=new Set([`components`,`features`,`hooks`,`pages`,`ui`,`views`,`widgets`]),Pd=new Set(`alert.modal.label.text.title.name.id.url.path.route.page.param.field.column.header.placeholder.prefix.description.type.icon.class.style.variant.event.action.status.state.mode.flag.option.config.message.error.display.view.component.element.container.wrapper.button.link.input.select.dialog.menu.form.step.index.count.length.role.scope.context.provider.ref.handler.query.schema.constant`.split(`.`)),Fd=new Set([`start`,`end`]),J=e=>e.replace(/[.*+?^${}()|[\]\\]/g,`\\$&`),Id=new RegExp(dd.source,`gi`),Ld=e=>{for(let t of e.matchAll(Id)){let e=t[0]??``;if(!hd.test(e))return new RegExp(J(e))}},Rd=e=>fd.test(e)&&md.test(e),zd=/\.(?:[cm]?[jt]sx?)$/i,Bd=/\/\/|\/\*|<!--/,Vd=new Set([`\r`,`
+`,`\u2028`,`\u2029`]),Hd=e=>{let t=0;for(;t<e.length;){let n=e.indexOf(`-->`,t);if(n===-1)return!1;let r=n-1;for(;r>=0&&!Vd.has(e[r]??``)&&e[r]?.trim()===``;)--r;if(r<0||Vd.has(e[r]??``))return!0;t=n+3}return!1},Ud=(e,t)=>{if(!zd.test(e)||!t.startsWith(`#!`)&&!Bd.test(t)&&!Hd(t))return t;try{let n=i(e,t,{astType:`ts`,lang:pn(e)});if(n.errors.some(e=>e.severity===`Error`))return;let r=t.search(/[\r\n\u2028\u2029]/),a=[...t.startsWith(`#!`)?[{start:0,end:r===-1?t.length:r}]:[],...n.comments];if(a.length===0)return t;let o=[],s=0;for(let e of a)o.push(t.slice(s,e.start)),o.push(t.slice(e.start,e.end).replace(/[^\r\n\u2028\u2029]/g,` `)),s=e.end;return o.push(t.slice(s)),o.join(``)}catch{return}},Wd=/\.map$/i,Gd=/\s/,Kd=/[^\r\n\u2028\u2029]/g,Y=(e,t)=>{let n=t;for(;n<e.length&&Gd.test(e[n]??``);)n+=1;return n},qd=(e,t)=>{if(e[t]!==`"`)return;let n=t+1;for(;n<e.length;){if(e[n]===`\\`){n+=2;continue}if(e[n]===`"`)return n+1;n+=1}},Jd=(e,t)=>{let n=Y(e,t);if(e[n]===`"`)return qd(e,n);if(e[n]!==`[`&&e[n]!==`{`){let t=n;for(;t<e.length&&![`,`,`]`,`}`].includes(e[t]??``);)t+=1;return t}let r=[e[n]===`[`?`]`:`}`],i=n+1;for(;i<e.length&&r.length>0;){if(e[i]===`"`){let t=qd(e,i);if(t===void 0)return;i=t;continue}e[i]===`[`&&r.push(`]`),e[i]===`{`&&r.push(`}`),e[i]===r.at(-1)&&r.pop(),i+=1}return r.length===0?i:void 0},Yd=(e,t)=>{let n=Y(e,0);if(e[n]!==`{`)return;n=Y(e,n+1);let r;for(;n<e.length&&e[n]!==`}`;){let i=qd(e,n);if(i===void 0)return;let a=JSON.parse(e.slice(n,i));if(n=Y(e,i),e[n]!==`:`)return;if(n=Y(e,n+1),a===t){if(r!==void 0)return;r=n}let o=Jd(e,n);if(o===void 0)return;if(n=Y(e,o),e[n]===`,`){n=Y(e,n+1);continue}if(e[n]!==`}`)return}return r},Xd=(e,t,n)=>{let r=Y(e,t);if(e[r]!==`[`)return;r=Y(e,r+1);let i=[];for(let t of n){if(typeof t==`string`){let t=qd(e,r);if(t===void 0)return;i.push({start:r,end:t}),r=t}else if(t===null&&e.startsWith(`null`,r))i.push({start:r,end:r+4}),r+=4;else return;if(r=Y(e,r),e[r]===`,`){r=Y(e,r+1);continue}}return e[r]===`]`?i:void 0},Zd=(e,t)=>`${e}/${t}`.split(/[\\/]/).includes(`node_modules`),Qd=(e,t)=>{if(!Wd.test(e)||!t.includes(`"sourcesContent"`))return t;try{let e=JSON.parse(t);if(typeof e!=`object`||!e||Array.isArray(e))return t;let n=Reflect.get(e,`sources`),r=Reflect.get(e,`sourcesContent`),i=Reflect.get(e,`sourceRoot`);if(!Array.isArray(n)||!n.every(e=>typeof e==`string`)||!Array.isArray(r)||n.length!==r.length||i!==void 0&&typeof i!=`string`)return t;let a=Yd(t,`sourcesContent`);if(a===void 0)return t;let o=Xd(t,a,r);if(o===void 0)return t;let s=i??``,c=[],l=0;for(let[e,r]of n.entries()){if(!Zd(s,r))continue;let n=o[e];if(n===void 0)return t;c.push(t.slice(l,n.start)),c.push(t.slice(n.start,n.end).replace(Kd,` `)),l=n.end}return l===0?t:(c.push(t.slice(l)),c.join(``))}catch{return t}},$d=(e,t,n)=>{if(pu.test(e.relativePath)||!bu(e.relativePath,e.isGeneratedBundle))return[];let r=t(e.content);if(r===void 0)return[];let i=nu(e.content,r);return[{message:n,line:i.line,column:i.column}]},ef=`A browser artifact contains server-secret environment names or a full environment dump shape.`,tf=e=>Ld(e)??(Rd(e)?md:void 0),nf=W({id:`artifact-env-leak`,title:`Server env leaked to browser artifact`,severity:`error`,recommendation:`Treat public env prefixes as publication, not secrecy; keep secret env vars server-only and rebuild after rotating leaked keys.`,scan:e=>{let t=Qd(e.relativePath,e.content),n=t===e.content?e:{...e,content:t},r=!1,i=$d(n,e=>{let t=Ld(e);if(t)return r=!0,t;if(md.test(e))return fd.test(e)?(r=!0,md):pd.test(e)?md:void 0},ef);if(i.length===0)return i;let a=r?i:$d(n,tf,ef),o=Ud(n.relativePath,n.content);return o===void 0?i:o===n.content?a:$d({...n,content:o},tf,ef)}}),rf=W({id:`artifact-secret-leak`,title:`Secret shipped in browser artifact`,severity:`error`,recommendation:`Remove the secret from client bundles/static assets, rotate it, and route privileged service calls through server-only code.`,scan:e=>$d(e,e=>ld.find(t=>t.test(e)),`A browser-delivered artifact contains a secret-looking credential value.`)}),af=/(?:npm|pnpm|yarn|bun)\s+(?:install|ci)\b(?:(?!--ignore-scripts)[\s\S]){0,700}\bsecrets\.[A-Z0-9_]+|\bsecrets\.[A-Z0-9_]+(?:(?!--ignore-scripts)[\s\S]){0,700}(?:npm|pnpm|yarn|bun)\s+(?:install|ci)\b/i,of=/(?:npm|pnpm|yarn|bun)\s+(?:install|ci)\b/i,sf=/\bsecrets\.[A-Z0-9_]+/,cf=/--ignore-scripts\b/,lf=`The build or install pipeline can execute package lifecycle code while CI secrets may be present.`,uf=e=>/(?:^|\/)\.github\/workflows\/[^/]+\.ya?ml$/i.test(e),df=e=>{let t=e.split(`
+`),n=[],r=[],i,a,o;for(let e=0;e<t.length;e+=1){let s=t[e],c=s.trim();if(c===``||c.startsWith(`#`))continue;let l=s.length-s.trimStart().length;if(i!==void 0&&l<=i&&(i=void 0,a=void 0,o=void 0),i===void 0){/^steps:\s*(?:#.*)?$/.test(c)?i=l:n.push(s);continue}if((c===`-`||c.startsWith(`- `))&&(a===void 0||l===a)){a=l,o={startLineIndex:e,lines:[s]},r.push(o);continue}o===void 0?n.push(s):o.lines.push(s)}let s=sf.test(n.join(`
 `));for(let e of r){let t=e.lines.join(`
-`);if(!af.test(t)||sf.test(t)||!s&&!of.test(t))continue;let n=Math.max(e.lines.findIndex(e=>af.test(e)),0),r=e.lines[n].search(af);return[{message:cf,line:e.startLineIndex+n+1,column:(r===-1?0:r)+1}]}return[]},df=q({shouldScan:e=>bu(e.relativePath)&&!e.relativePath.endsWith(`package.json`)&&!lf(e.relativePath),pattern:rf,message:cf}),ff=W({id:`build-pipeline-secret-boundary`,title:`Build pipeline runs code near secrets`,severity:`warn`,recommendation:`Run dependency installs with scripts disabled before exposing secrets, isolate untrusted build code, and move signing/deploy authority into a narrow privileged step.`,scan:e=>lf(e.relativePath)?uf(e.content):df(e)}),pf=W({id:`clickjacking-redirect-risk`,title:`Redirect or frame boundary risk`,severity:`warn`,recommendation:"Allowlist redirect origins/paths, set `frame-ancestors` for privileged pages, and avoid URL-prefilled privileged dialogs.",scan:q({shouldScan:e=>K(e.relativePath)||bu(e.relativePath),pattern:/\bredirect\s*\((?!\s*(?:await\s+)?[\w$]*(?:safe|valid|sanitiz|allowlist|whitelist)[\w$]*\s*\()[^)'"`\n]*\b(?:searchParams\.get|nextUrl\.searchParams|returnTo|callbackUrl|continue|next)\b|<iframe\b[\s\S]{0,700}(?:\b(?:next=|continue=|redirect=|redirect_uri|userstoinvite|sharingaction|\.\.)|[?&](?:amp;)?role=)|frame-ancestors\s+(?:\*|'self'\s+\*)|X-Frame-Options["']?\s*:\s*["']?ALLOW/i,message:`Redirect or framing configuration may let attacker-controlled URLs chain into privileged UI or clickjacking.`})}),mf=e=>/(?:^|\/)(?:tools?|scripts?)\/|(?:^|\/)management\/commands\/|(?:^|\/)(?:build|make|gulpfile|gruntfile)\.[cm]?[jt]s$/i.test(e),hf=e=>Su(e,au),gf=String.raw`(?:req\.|request\.|params\.|query\.|body\.|searchParams|\$_(?:GET|POST|REQUEST))`,_f=String.raw`(?:(?<![.\w$])(?:exec(?:Sync)?|system|passthru|proc_open|shell_exec)|\b(?:os\.system|subprocess\.(?:run|Popen|call)|(?:child_process|childProcess|cp)\.exec\w*))`,vf=String.raw`(?:(?<![.\w$])spawn(?:Sync)?|\b(?:child_process|childProcess|cp)\.spawn\w*)`,yf=String.raw`['"](?:sh|bash|zsh|dash|ksh|cmd(?:\.exe)?|powershell(?:\.exe)?|pwsh)['"]`,bf=String.raw`['"](?:-c|/c|-Command)['"]`,xf=W({id:`command-execution-input-risk`,title:`Command execution uses caller-shaped input`,severity:`error`,recommendation:`Avoid shell execution for caller-controlled values. Use fixed commands, argument arrays, strict allowlists, and no shell interpolation.`,scan:q({shouldScan:e=>hf(e.relativePath)&&!mf(e.relativePath),pattern:[new RegExp(String.raw`${_f}\s*\([^)]{0,220}(?:${gf}|shell\s*=\s*true|f['"\`][^'"\`]*\{)`,`i`),new RegExp(String.raw`${vf}\s*\((?:[^,)]{0,120}?${gf}|\s*${yf}\s*,\s*\[\s*${bf}\s*,[^\]]{0,220}${gf}|(?=[^)]{0,220}shell\s*[:=]\s*true)[^)]{0,220}${gf})`,`i`)],message:`Command execution appears to include request, query, body, or shell-interpolated input.`})}),Sf=W({id:`cors-cookie-trust-risk`,title:`Broad cookie or credentialed CORS trust`,severity:`warn`,recommendation:`Keep auth cookies host-only and HttpOnly, avoid credentialed CORS for less-trusted docs/vendor origins, and isolate documentation domains from app sessions.`,scan:q({shouldScan:e=>K(e.relativePath)||bu(e.relativePath),pattern:/Access-Control-Allow-Credentials["']?\s*[:,]\s*["']?true[\s\S]{0,700}Access-Control-Allow-Origin["']?\s*[:,]\s*["']?(?:\*|https:\/\/docs\.|https:\/\/.*mintlify)|\b(?:session|auth|token|jwt)[^=\n]{0,80}(?:=[^;\n]{0,120};[^=\n]{0,80})?\bDomain=\./i,message:`Credentialed CORS or broad auth-cookie scope can make a docs/custom-domain XSS become account compromise.`})}),Cf=(e,t)=>{let n=e[t],r=n===`(`?`)`:n===`{`?`}`:n===`[`?`]`:``;if(r===``)return-1;let i=0,a=null;for(let o=t;o<e.length;o+=1){let t=e[o];if(a!==null){t===`\\`?o+=1:t===a&&(a=null);continue}if(t===`"`||t===`'`||t==="`")a=t;else if(t===n)i+=1;else if(t===r&&(--i,i===0))return o}return-1},wf=e=>`end`in e&&typeof e.end==`number`?e.end:-1,X=e=>`start`in e&&typeof e.start==`number`?e.start:-1,Tf=e=>{let t=w(e);for(;b(t,`SequenceExpression`);){let e=t.expressions.at(-1);if(!e)break;t=w(e)}return t},Ef=e=>{let t=[],n=new Map;for(let r of e){let e=`${r.truthiness}:${r.nullishness}`,i=n.get(r.expression);i?.has(e)||(i?i.add(e):n.set(r.expression,new Set([e])),t.push(r))}return t},Df=e=>b(e,`JSXElement`)||b(e,`JSXFragment`)||b(e,`ArrayExpression`)||b(e,`ObjectExpression`)||b(e,`ArrowFunctionExpression`)||b(e,`FunctionExpression`)||b(e,`ClassExpression`)||b(e,`NewExpression`)?{expression:e,truthiness:`truthy`,nullishness:`non-nullish`}:b(e,`Literal`)?e.value===null?{expression:e,truthiness:`falsy`,nullishness:`nullish`}:{expression:e,truthiness:e.value?`truthy`:`falsy`,nullishness:`non-nullish`}:b(e,`UnaryExpression`)&&e.operator===`void`?{expression:e,truthiness:`falsy`,nullishness:`nullish`}:{expression:e,truthiness:`unknown`,nullishness:`unknown`},Of=e=>{let t=Tf(e);if(b(t,`ConditionalExpression`)){let e=Of(t.test);return e.every(e=>e.truthiness===`truthy`)?Of(t.consequent):e.every(e=>e.truthiness===`falsy`)?Of(t.alternate):Ef([...Of(t.consequent),...Of(t.alternate)])}if(!b(t,`LogicalExpression`))return[Df(t)];let n=Of(t.left),r=Of(t.right),i=[];for(let e of n){if(t.operator===`&&`){e.truthiness!==`truthy`&&i.push(e.truthiness===`falsy`?e:{...e,truthiness:`falsy`}),e.truthiness!==`falsy`&&i.push(...r);continue}if(t.operator===`||`){e.truthiness!==`falsy`&&i.push(e.truthiness===`truthy`?e:{...e,truthiness:`truthy`,nullishness:`non-nullish`}),e.truthiness!==`truthy`&&i.push(...r);continue}e.nullishness!==`nullish`&&i.push(e.nullishness===`non-nullish`?e:{...e,nullishness:`non-nullish`}),e.nullishness!==`non-nullish`&&i.push(...r)}return Ef(i)},kf=e=>{let t=[],n=new Set;for(let r of Of(e))n.has(r.expression)||(n.add(r.expression),t.push(r.expression));return t},Af=new Set([`assign`,`defineProperties`,`defineProperty`]),jf=new Set([`defineProperty`,`set`]),Mf=new WeakMap,Nf=e=>{let t=P(e);for(;t.parent;){let e=t.parent;if(!b(e,`MemberExpression`)||e.object!==t)break;t=P(e)}return t},Z=e=>{let t=e;for(;t;){if(O(t)||b(t,`Program`))return t;t=t.parent}return e},Pf=(e,t)=>{if(b(e,`ReturnStatement`)||b(e,`ThrowStatement`)||b(e,`BreakStatement`)||t&&b(e,`ContinueStatement`))return!0;if(b(e,`BlockStatement`))return e.body.some(e=>Pf(e,t));if(!b(e,`IfStatement`))return!1;if(b(e.test,`Literal`)){let n=e.test.value?e.consequent:e.alternate;return n?Pf(n,t):!1}return!!(e.alternate&&Pf(e.consequent,t)&&Pf(e.alternate,t))},Ff=e=>Pf(e,!0),If=(e,t)=>{let n=t.indexOf(e);return n>0&&t.slice(0,n).some(Ff)},Lf=(e,t)=>{let n=e;for(;n.parent&&n!==t;){let e=n.parent;if((b(e,`BlockStatement`)||b(e,`Program`))&&If(n,e.body)||(b(e,`WhileStatement`)&&b(e.test,`Literal`)&&!e.test.value||b(e,`ForStatement`)&&e.test&&b(e.test,`Literal`)&&!e.test.value)&&e.body===n||b(e,`SwitchCase`)&&If(n,e.consequent)||b(e,`IfStatement`)&&b(e.test,`Literal`)&&(e.test.value===!1&&e.consequent===n||e.test.value===!0&&e.alternate===n)||b(e,`ConditionalExpression`)&&b(e.test,`Literal`)&&(e.test.value===!1&&e.consequent===n||e.test.value===!0&&e.alternate===n)||b(e,`LogicalExpression`)&&e.right===n&&b(e.left,`Literal`)&&(e.operator===`&&`&&!e.left.value||e.operator===`||`&&e.left.value))return!0;n=e}return!1},Rf=(e,t)=>{let n=e;for(;n.parent&&n!==t;){let e=n.parent;if(b(e,`IfStatement`)&&(!b(e.test,`Literal`)||e.test.value===!0&&e.alternate===n||e.test.value===!1&&e.consequent===n)||b(e,`ConditionalExpression`)&&(!b(e.test,`Literal`)||e.test.value===!0&&e.alternate===n||e.test.value===!1&&e.consequent===n)||b(e,`LogicalExpression`)&&e.right===n&&(!b(e.left,`Literal`)||e.operator===`&&`&&!e.left.value||e.operator===`||`&&e.left.value)||b(e,`DoWhileStatement`)&&!(e.body===n&&b(e.test,`Literal`)&&!e.test.value)||b(e,`ForStatement`)||b(e,`ForInStatement`)||b(e,`ForOfStatement`)&&e.right!==n||b(e,`WhileStatement`)||b(e,`SwitchCase`)||b(e,`CatchClause`)||b(e,`TryStatement`)&&e.block===n||(b(e,`CallExpression`)||b(e,`MemberExpression`))&&e.optional)return!0;n=e}return!1},zf=(e,t)=>{let n=w(e);if(b(n,`Literal`))return!1;if(b(n,`Identifier`)){if(t.isGlobalReference(n)&&(n.name===`undefined`||n.name===`NaN`||n.name===`Infinity`))return!1;let e=t.symbolFor(n);return e?e.kind===`var`||e.kind===`function`||e.kind===`parameter`||e.kind===`import`?!1:X(e.declarationNode)>X(n):!0}if(b(n,`ArrayExpression`))return n.elements.some(e=>e?b(e,`SpreadElement`)?!0:zf(e,t):!1);if(b(n,`ObjectExpression`))return n.properties.length>0;if(b(n,`TemplateLiteral`))return n.expressions.length>0;if(b(n,`UnaryExpression`)){let e=w(n.argument);return n.operator===`typeof`&&b(e,`Identifier`)&&!t.symbolFor(e)?!1:zf(e,t)?!0:n.operator===`void`||n.operator===`typeof`||n.operator===`!`?!1:!(b(e,`Literal`)&&(typeof e.value==`number`||typeof e.value==`string`))}return!0},Bf=(e,t,n)=>{let r=e;for(;r.parent&&r.parent!==t;)r=r.parent;let i=t.body.findIndex(e=>e===r);return r.parent!==t||i<=0?!1:t.body.slice(0,i).some(e=>b(e,`EmptyStatement`)?!1:b(e,`ExpressionStatement`)?zf(e.expression,n):b(e,`VariableDeclaration`)?e.declarations.some(e=>!b(e.id,`Identifier`)||!!(e.init&&zf(e.init,n))):!0)},Vf=(e,t)=>b(e,`AwaitExpression`)?zf(e.argument,t):!1,Hf=(e,t,n)=>{let r=e;for(;r.parent&&r!==t;){let t=r.parent;if(b(t,`IfStatement`)&&(!b(t.test,`Literal`)||t.test.value===!0&&t.alternate===r||t.test.value===!1&&t.consequent===r)||b(t,`ConditionalExpression`)&&(!b(t.test,`Literal`)||t.test.value===!0&&t.alternate===r||t.test.value===!1&&t.consequent===r)||b(t,`LogicalExpression`)&&t.right===r&&(!b(t.left,`Literal`)||t.operator===`&&`&&!t.left.value||t.operator===`||`&&t.left.value)||b(t,`WhileStatement`)&&(!b(t.test,`Literal`)||!t.test.value)||b(t,`ForStatement`)&&t.test&&(!b(t.test,`Literal`)||!t.test.value)||b(t,`ForInStatement`)||b(t,`ForOfStatement`)||b(t,`SwitchCase`)||b(t,`CatchClause`)||b(t,`TryStatement`)&&t.block===r&&b(r,`BlockStatement`)&&(Bf(e,r,n)||Vf(e,n))||(b(t,`CallExpression`)||b(t,`MemberExpression`))&&t.optional)return!0;r=t}return!1},Uf=(e,t)=>{let n=e;for(;n;){if(n===t)return!0;n=n.parent}return!1},Wf=(e,t)=>{let n=e;for(;n.parent&&n!==t;){let e=n.parent;if(b(e,`IfStatement`)&&(!b(e.test,`Literal`)||e.test.value===!0&&e.alternate===n||e.test.value===!1&&e.consequent===n)||b(e,`ConditionalExpression`)&&(!b(e.test,`Literal`)||e.test.value===!0&&e.alternate===n||e.test.value===!1&&e.consequent===n)||b(e,`LogicalExpression`)&&e.right===n&&(!b(e.left,`Literal`)||e.operator===`&&`&&!e.left.value||e.operator===`||`&&e.left.value)||b(e,`ForStatement`)||b(e,`ForInStatement`)||b(e,`ForOfStatement`)||b(e,`WhileStatement`)||b(e,`SwitchCase`)||b(e,`CatchClause`)||b(e,`TryStatement`)&&e.block===n||(b(e,`CallExpression`)||b(e,`MemberExpression`))&&e.optional)return n;n=e}return null},Gf=e=>b(e,`AwaitExpression`)||b(e,`YieldExpression`)?e.argument?wf(e.argument):wf(e):b(e,`ForOfStatement`)?wf(e.right):X(e),Kf=(e,t,n)=>{if(X(t)<Gf(e))return!1;let r=Wf(e,n);return!!(r&&Uf(t,r))},qf=e=>{let t=Mf.get(e);if(t)return t;let n=(t,n,r)=>{let i=w(t);if(!b(i,`MemberExpression`))return!1;let a=w(i.object);return!!(b(a,`Identifier`)&&a.name===n&&e.isGlobalReference(a)&&r.has(C(i)??``))},r=e=>{let t=w(e);if(!b(t,`ObjectExpression`))return null;let n=new Set;for(let e of t.properties){if(!b(e,`Property`))return null;let t=S(e,{allowComputedString:!0});if(t===null)return null;n.add(t)}return n},i=e=>{let t=Nf(e),i=t.parent;if(i){if(b(i,`AssignmentExpression`)&&i.left===t||b(i,`UpdateExpression`)&&i.argument===t||b(i,`UnaryExpression`)&&i.operator===`delete`){if(!b(t,`MemberExpression`))return null;let e=C(t);return e===null?null:new Set([e])}if(!(!b(i,`CallExpression`)||i.arguments[0]!==t)){if(n(i.callee,`Object`,Af)){let e=w(i.callee);if(!b(e,`MemberExpression`))return;let t=C(e);if(t===`assign`){let e=i.arguments.slice(1).map(r);return e.some(e=>e===null)?null:new Set(e.flatMap(e=>[...e??[]]))}if(t===`defineProperties`){let e=i.arguments[1];return e?r(e):null}let n=i.arguments[1];return n&&b(n,`Literal`)&&typeof n.value==`string`?new Set([n.value]):null}if(n(i.callee,`Reflect`,jf)){let e=i.arguments[1];return e&&b(e,`Literal`)&&typeof e.value==`string`?new Set([e.value]):null}}}},a=e=>{let t=P(e),n=t.parent;if(b(n,`ForOfStatement`)&&n.right===t)return n.await||Pf(n.body,!1);let r=n;if(!b(r,`MemberExpression`)||r.object!==t||C(r)!==`next`)return!1;let i=P(r);return!!(b(i.parent,`CallExpression`)&&i.parent.callee===i)},o=e=>{let t=P(e),n=t.parent;return b(n,`ForOfStatement`)&&!n.await&&n.right===t&&!Pf(n.body,!1)?!0:!!(b(n,`SpreadElement`)&&n.parent&&!b(n.parent,`ObjectExpression`))},s=e=>{let t=P(e),n=t.parent;if(!b(n,`ForOfStatement`)||n.await||n.right!==t||Pf(n.body,!1))return[];let r=Z(n.body),i=new Set;return z(n.body,e=>{if(Z(e)!==r||!b(e,`BreakStatement`))return;let a=e;if(e.label){for(;a?.parent;){let t=a.parent;if(b(t,`LabeledStatement`)&&t.label.name===e.label.name){Uf(n,t.body)&&i.add(t);return}a=t}return}for(;a?.parent;){let e=a.parent;if(b(e,`ForStatement`)||b(e,`ForInStatement`)||b(e,`ForOfStatement`)||b(e,`WhileStatement`)||b(e,`DoWhileStatement`)||b(e,`SwitchStatement`)){b(e,`ForOfStatement`)&&e.right===t&&i.add(e);return}a=e}}),[...i]},c=t=>{let n=w(t.callee),r=null;if(O(n))r=n;else if(b(n,`Identifier`)){let t=F(n,e);if(t?.kind===`function`&&O(t.declarationNode))r=t.declarationNode;else if(t?.kind===`const`&&t.initializer){let e=w(t.initializer);O(e)&&(r=e)}}return r&&O(r)?r:null},l=e=>{let t=c(e);return!t||!O(t)?null:t.generator?a(e)||o(e)?t:null:t},u=[],d=new Map;z(e.rootScope.node,t=>{if(b(t,`CallExpression`)){let e=Z(t),n=l(t);n&&!Lf(t,e)&&u.push({argumentCall:t,call:t,conditionalExitTargets:O(n)&&n.generator?s(t):[],owner:e,targetOwner:n,yieldCount:O(n)&&n.generator&&a(t)?1:null})}if(!b(t,`Identifier`))return;let n=i(t);if(n===void 0)return;let r=F(t,e);if(!r)return;let o=Z(t);if(Lf(t,o))return;let c=d.get(r.id)??[];c.push({node:t,owner:o,propertyNames:n,symbolId:r.id}),d.set(r.id,c)});let f=t=>{let n=Z(t),r=X(t),i=new Set,a=(e,t)=>{for(let n of u)n.owner!==e||X(n.call)>=t||i.has(n.targetOwner)||(i.add(n.targetOwner),a(n.targetOwner,1/0))};return a(n,r),b(n,`Program`)||a(e.rootScope.node,1/0),i},p=e=>{if(b(e,`Program`))return 1/0;let t=u.find(t=>b(t.owner,`Program`)&&t.targetOwner===e);return t?X(t.call):1/0},m=new Map;for(let e of u){let t=m.get(e.owner)??[];t.push(e),m.set(e.owner,t)}let h=new WeakMap,g=(e,t)=>{let n=h.get(e)?.get(t);if(n!==void 0)return n;let r=[e],i=new Set,a=!1;for(;r.length>0;){let e=r.pop();if(!(!e||i.has(e))){if(e===t){a=!0;break}i.add(e);for(let t of m.get(e)??[])r.push(t.targetOwner)}}let o=h.get(e)??new WeakMap;return o.set(t,a),h.set(e,o),a},_=(e,t)=>{let n=new Set,r=e;for(;r?.parent&&r!==t;){let t=r.parent,i=b(t,`DoWhileStatement`)&&b(t.test,`Literal`)&&!t.test.value,a=b(t,`ForStatement`)||b(t,`ForInStatement`)||b(t,`ForOfStatement`)||b(t,`WhileStatement`)||b(t,`DoWhileStatement`)?t.body:null,o=e;for(;a&&b(a,`BlockStatement`)&&o&&o.parent!==a;)o=o.parent??null;let s=a&&b(a,`BlockStatement`)&&o?a.body.findIndex(e=>e===o):-1,c=!!(a&&b(a,`BlockStatement`)&&s>=0&&a.body.slice(s+1).some(e=>Pf(e,!1)));a&&!i&&!c&&n.add(t),r=t}return n},v=(e,t,n)=>{let r=_(e,n);return r.size===0?!1:[..._(t,n)].some(e=>r.has(e))},y=new WeakMap,ee=e=>{let t=y.get(e);if(t)return t;let n=new Map;for(let t of u){if(!g(t.targetOwner,e))continue;let r=n.get(t.owner)??[];r.push(t),n.set(t.owner,r)}return y.set(e,n),n},te=(e,t)=>{let n=ee(e),r=ee(t);for(let[e,t]of n){let n=r.get(e);if(n){for(let r of t)for(let t of n)if(r!==t&&(X(r.call)<X(t.call)||O(e)||v(r.call,t.call,e)))return!0}}return!1},ne=e=>{let t=Z(e);if(b(t,`Program`))return!1;let n=u.filter(e=>b(e.owner,`Program`)&&g(e.targetOwner,t));return n.length===0?!1:n.length!==1||n[0]?.targetOwner!==t},re=e=>{let t=Nf(e.node),n=t.parent;return!!(b(t,`Identifier`)&&n&&(b(n,`AssignmentExpression`)&&n.left===t||b(n,`UpdateExpression`)&&n.argument===t))},ie=(t,n)=>{let r=w(t);if(b(r,`Identifier`)){let t=F(r,e);return t&&n.has(t.id)?n.get(t.id)??!1:null}if(b(r,`SequenceExpression`)){let e=r.expressions.at(-1);return e?ie(e,n):null}if(b(r,`ConditionalExpression`)){let e=ie(r.consequent,n),t=ie(r.alternate,n);return e===null&&t===null?null:e===null||t===null?!0:e||t}if(b(r,`LogicalExpression`)){let e=ie(r.left,n),t=ie(r.right,n);return e===null?t===null?null:!0:r.operator===`&&`?t:e}return null},ae=(e,t)=>{let n=Nf(e.node).parent;if(!n||!b(n,`AssignmentExpression`)){t.delete(e.symbolId);return}let r=t.get(e.symbolId)??!1,i=null;n.operator===`||=`||n.operator===`??=`?i=r:(n.operator===`=`||n.operator===`&&=`)&&(i=ie(n.right,t));let a=Rf(e.node,e.owner);i===null?a?t.set(e.symbolId,!0):t.delete(e.symbolId):t.set(e.symbolId,a&&r||i)},oe=(t,n)=>{if(!O(t.targetOwner))return n;let r=new Map(n);for(let[i,a]of t.targetOwner.params.entries()){let o=b(a,`AssignmentPattern`)?a.left:a;if(!b(o,`Identifier`))continue;let s=t.argumentCall.arguments[i],c=s&&!b(s,`SpreadElement`)?w(s):null,l=null;if(b(a,`AssignmentPattern`)&&(!c||b(c,`Identifier`)&&c.name===`undefined`&&e.isGlobalReference(c)||b(c,`UnaryExpression`)&&c.operator===`void`)&&b(a,`AssignmentPattern`)?l=w(a.right):c&&(l=c),!b(l,`Identifier`))continue;let u=F(l,e);if(!u||!n.has(u.id))continue;let d=e.symbolFor(o);d&&r.set(d.id,n.get(u.id)??!1)}return r},se=(t,n)=>{if(!O(t.targetOwner))return{conditionalSuspensions:[],conditionalStartIndex:1/0,cutoffIndex:1/0};let r=new Set;t.targetOwner.async&&(r.add(`AwaitExpression`),r.add(`ForOfStatement`));let i=t.conditionalExitTargets.some(e=>!n||!Uf(n,e));(t.yieldCount!==null||i)&&r.add(`YieldExpression`);let a=[],o=1/0,s=1/0,c=0;return z(t.targetOwner.body,n=>{if(Z(n)!==t.targetOwner||Lf(n,t.targetOwner)||!(r.has(n.type)&&(!b(n,`ForOfStatement`)||n.await)))return;let l=b(n,`YieldExpression`)&&n.argument?w(n.argument):null;if(b(n,`YieldExpression`)&&n.delegate&&l&&(b(l,`ArrayExpression`)&&l.elements.length===0||b(l,`Literal`)&&l.value===``))return;let u=Gf(n);if(b(n,`YieldExpression`)){if(c+=1,i&&c>=1){o=Math.min(o,u);return}if(t.yieldCount===null||c>t.yieldCount)return}Hf(n,t.targetOwner,e)?(a.push(n),o=Math.min(o,u)):s=Math.min(s,u)}),{conditionalSuspensions:a,conditionalStartIndex:Math.min(o,s),cutoffIndex:s}},ce=(e,t,n)=>{let r=(e,t,i)=>{if(t.has(e.targetOwner))return!1;let a=new Set(t);a.add(e.targetOwner);let o=new Map(oe(e,i)),s=se(e),c=[...[...o.keys()].flatMap(e=>d.get(e)??[]).filter(t=>t.owner===e.targetOwner).map(e=>({event:e,index:X(e.node)})),...u.filter(t=>t.owner===e.targetOwner).map(e=>({call:e,index:X(e.call)}))].sort((e,t)=>e.index-t.index);for(let t of c){if(t.index>=s.cutoffIndex)break;let i=`event`in t?t.event.node:t.call.call;if(!s.conditionalSuspensions.some(t=>Kf(t,i,e.targetOwner))){if(`event`in t){if(!o.has(t.event.symbolId))continue;if(re(t.event)){ae(t.event,o);continue}if(n===null||t.event.propertyNames===null||t.event.propertyNames.has(n))return!0;continue}if(r(t.call,a,o))return!0}}return!1};return r(e,new Set,t)},le={getMutationPropertyNames:i,getEventsBefore:(t,n)=>{let r=[],i=(e,t,a,o,s,c,l)=>{if(s.has(e))return;let f=new Set(s);f.add(e);let p=new Map(l),m=[...[...p.keys()].flatMap(e=>d.get(e)??[]).filter(t=>t.owner===e).map(e=>({event:e,index:X(e.node)})),...u.filter(t=>t.owner===e).map(e=>({call:e,index:X(e.call)}))].sort((e,t)=>e.index-t.index);for(let s of m){if(s.index>=t)break;let l=`event`in s?s.event.node:s.call.call;if(o.some(t=>Kf(t,l,e)))continue;if(`event`in s){if(!p.has(s.event.symbolId))continue;let e=!!(c||p.get(s.event.symbolId)||Rf(s.event.node,s.event.owner)||s.index>a);if(re(s.event)){ae(s.event,p);continue}r.push({isConditional:e,node:s.event.node});continue}let u=se(s.call,n);i(s.call.targetOwner,u.cutoffIndex,u.conditionalStartIndex,u.conditionalSuspensions,f,c||Rf(s.call.call,s.call.owner)||s.index>a,oe(s.call,p))}},a=Z(n),o=new Map([[t.id,!1]]);return b(a,`Program`)||i(e.rootScope.node,p(a),1/0,[],new Set,!1,o),i(a,X(n),1/0,[],new Set,!1,o),r},getOutermostTarget:Nf,isGlobalNamespaceMethod:n,isExecutionOrderAmbiguous:ne,isMutationOrderAmbiguous:(e,t,n)=>{let r=Z(t),i=X(t);if((d.get(e.id)??[]).some(e=>n!==null&&e.propertyNames!==null&&!e.propertyNames.has(n)?!1:e.owner===r?X(e.node)>=i&&(O(r)||v(e.node,t,r)):b(e.owner,`Program`)?(ee(r).get(e.owner)??[]).some(t=>v(e.node,t.call,e.owner)):g(e.owner,r)||te(e.owner,r)))return!0;let a=new Map([[e.id,!1]]);return u.some(e=>e.owner===r&&X(e.call)>=i&&v(e.call,t,r)&&ce(e,a,n))},isMutatedBefore:(e,t,n)=>{let r=d.get(e.id);if(!r)return!1;let i=X(t),a=Z(t),o=f(t);return r.some(e=>n!==null&&e.propertyNames!==null&&!e.propertyNames.has(n)?!1:e.owner===a?X(e.node)<i:b(e.owner,`Program`)&&!b(a,`Program`)?X(e.node)<p(a):o.has(e.owner))}};return Mf.set(e,le),le},Jf=(e,t)=>t===`katex`?e===`katex`||e.startsWith(`katex/`):e===t,Yf=(e,t,n)=>{let r=w(e);if(!b(r,`CallExpression`))return!1;let i=w(r.callee),a=r.arguments[0];return!!(b(i,`Identifier`)&&i.name===`require`&&n.isGlobalReference(i)&&a&&b(a,`Literal`)&&typeof a.value==`string`&&Jf(a.value,t))},Xf=(e,t)=>{if(e.kind!==`ts-import-equals`)return!1;let n=e.declarationNode;if(!b(n,`TSImportEqualsDeclaration`))return!1;let r=n.moduleReference;return!!(b(r,`TSExternalModuleReference`)&&b(r.expression,`Literal`)&&typeof r.expression.value==`string`&&Jf(r.expression.value,t))},Zf=(e,t)=>{let n=w(e);return!!(b(n,`AwaitExpression`)&&b(n.argument,`ImportExpression`)&&b(n.argument.source,`Literal`)&&typeof n.argument.source.value==`string`&&Jf(n.argument.source.value,t))},Qf=(e,t,n,r,i)=>{let a=F(w(e),i),o=qf(i);if(!a||o.isExecutionOrderAmbiguous(r)||o.isMutationOrderAmbiguous(a,r,n)||o.isMutatedBefore(a,r,n))return null;let s=ve(a);if(typeof s?.source.value==`string`&&Jf(s.source.value,t))return b(a.declarationNode,`ImportDefaultSpecifier`)||b(a.declarationNode,`ImportNamespaceSpecifier`)||x(a.declarationNode)===`default`?a:null;if(Xf(a,t))return a;if(a.kind!==`const`||!a.initializer)return null;let c=w(a.initializer);return Yf(c,t,i)||b(c,`MemberExpression`)&&C(c)===`default`&&(Yf(c.object,t,i)||Zf(c.object,t))||Zf(c,t)?a:null},$f=(e,t,n,r,i)=>{let a=F(w(e),i);if(!a)return null;let o=ve(a),s=qf(i);return typeof o?.source.value!=`string`||!Jf(o.source.value,t)||x(a.declarationNode)!==n||s.isExecutionOrderAmbiguous(r)||s.isMutationOrderAmbiguous(a,r,null)||s.isMutatedBefore(a,r,null)?null:a},ep=(e,t,n)=>Qf(e,`katex`,`renderToString`,t,n)!==null||Yf(e,`katex`,n),tp=(e,t,n)=>{if($f(e,`katex`,`renderToString`,t,n))return!0;let r=w(e);if(!b(r,`Identifier`))return!1;let i=n.referenceFor(r)?.resolvedSymbol;if(!i||i.kind!==`const`||!i.initializer||qf(n).isMutatedBefore(i,t,null))return!1;let a=w(i.initializer),o=i.bindingIdentifier.parent;return b(o,`Property`)&&S(o,{allowComputedString:!0})===`renderToString`?ep(a,i.declarationNode,n):b(a,`MemberExpression`)&&C(a)===`renderToString`&&ep(a.object,i.declarationNode,n)?!0:b(a,`Identifier`)?tp(a,i.declarationNode,n):!1},np=(e,t)=>{let n=w(e);if(b(n,`Identifier`)){if(!/katex/i.test(n.name))return!1;let e=t.referenceFor(n)?.resolvedSymbol;return!!(e&&e.kind!==`parameter`&&e.kind!==`let`)}if(!b(n,`MemberExpression`)||C(n)!==`renderToString`)return!1;let r=w(n.object);if(!b(r,`Identifier`)||!/katex/i.test(r.name))return!1;let i=t.referenceFor(r)?.resolvedSymbol;if(!i)return!1;if(i.kind===`import`){if(!Jf(String(ve(i)?.source.value??``),`katex`))return!0;let e=qf(t);return e.isExecutionOrderAmbiguous(n)||e.isMutationOrderAmbiguous(i,n,`renderToString`)?!1:e.isMutatedBefore(i,n,`renderToString`)}if(i.kind===`parameter`||i.kind===`let`||i.kind===`var`)return!0;if(i.kind!==`const`||!i.initializer)return!1;let a=w(i.initializer);if(b(a,`ObjectExpression`))return!0;if(b(a,`CallExpression`)){let e=w(a.callee);return b(e,`Identifier`)&&e.name===`require`}return b(a,`AwaitExpression`)&&b(a.argument,`ImportExpression`)},rp=(e,t)=>{let n=w(e);if(!b(n,`ObjectExpression`))return null;let r;for(let e of n.properties){if(!b(e,`Property`)){r=null;continue}let n=S(e,{allowComputedString:!0});if(n===null){r=null;continue}n===t&&(r=e.kind===`init`?e.value:null)}return r},ip=e=>{let t=w(e);if(!b(t,`ObjectExpression`))return null;for(let e of t.properties){if(!b(e,`Property`))return null;let t=S(e,{allowComputedString:!0});if(t===null||t===`get`||t===`set`)return null}return rp(t,`value`)},ap=new WeakMap,op=(e,t)=>{let n=w(e);return b(n,`Identifier`)?n.name===`undefined`&&t.isGlobalReference(n):b(n,`Literal`)&&!n.value},sp=(e,t,n)=>{let r=ip(t);return r===null?`trusted`:r===void 0?e:op(r,n)?`untrusted`:`trusted`},cp=(e,t)=>e===t?e:e===`trusted`||t===`trusted`?`trusted`:e===`unsupported`||t===`unsupported`?`unsupported`:`untrusted`,lp=(e,t,n,r)=>{let i=qf(n),a=i.getOutermostTarget(t),o=a.parent;if(!o)return`unsupported`;if(b(o,`AssignmentExpression`)&&o.left===a){if(!b(a,`MemberExpression`))return`unsupported`;let t=C(a);return t===null?`trusted`:t===`trust`?op(o.right,n)?`untrusted`:`trusted`:e}if(b(o,`UnaryExpression`)&&o.operator===`delete`){if(!b(a,`MemberExpression`))return`unsupported`;let t=C(a);return t===null?`trusted`:t===`trust`?`absent`:e}if(b(o,`UpdateExpression`)){if(!b(a,`MemberExpression`))return`unsupported`;let t=C(a);return t===`trust`||t===null?`trusted`:e}if(!b(o,`CallExpression`)||o.arguments[0]!==a)return`unsupported`;if(i.isGlobalNamespaceMethod(o.callee,`Object`,Af)){let t=w(o.callee);if(!b(t,`MemberExpression`))return`unsupported`;let i=C(t);if(i===`assign`){let t=e;for(let e of o.arguments.slice(1)){let i=up(e,e,n,new Set(r));i!==`absent`&&(t=i)}return t}if(i===`defineProperties`){let t=o.arguments[1];if(!t)return`unsupported`;let r=rp(t,`trust`);return r===null?`trusted`:r===void 0?e:sp(e,r,n)}let a=o.arguments[1];if(!a||!b(a,`Literal`)||typeof a.value!=`string`)return`trusted`;if(a.value!==`trust`)return e;let s=o.arguments[2];return s?sp(e,s,n):`unsupported`}if(i.isGlobalNamespaceMethod(o.callee,`Reflect`,jf)){let t=w(o.callee);if(!b(t,`MemberExpression`))return`unsupported`;let r=C(t),i=o.arguments[1];if(!i||!b(i,`Literal`)||typeof i.value!=`string`)return`trusted`;if(i.value!==`trust`)return e;let a=o.arguments[2];return a?r===`defineProperty`?sp(e,a,n):op(a,n)?`untrusted`:`trusted`:`unsupported`}return`unsupported`},up=(e,t,n,r)=>{if(e===void 0)return`absent`;let i=w(e);if(b(i,`Identifier`)){if(i.name===`undefined`&&n.isGlobalReference(i))return`absent`;let e=F(i,n);if(!e||e.kind!==`const`||!e.initializer||r.has(e.id))return`unsupported`;let a=new Set(r);a.add(e.id);let o=qf(n);if(o.isMutationOrderAmbiguous(e,t,`trust`))return`unsupported`;let s=up(e.initializer,t,n,a);for(let r of o.getEventsBefore(e,t)){let e=lp(s,r.node,n,a);s=r.isConditional?cp(s,e):e}return s}if(!b(i,`ObjectExpression`))return`unsupported`;let a=`absent`;for(let e of i.properties){if(b(e,`SpreadElement`)){let t=up(e.argument,e.argument,n,new Set(r));t!==`absent`&&(a=t===`unsupported`?`trusted`:t);continue}if(!b(e,`Property`)){a=`trusted`;continue}let t=S(e,{allowComputedString:!0});if(t===null){a=`trusted`;continue}t===`trust`&&(a=op(e.value,n)?`untrusted`:`trusted`)}return a},dp=(e,t,n)=>{let r=ap.get(e),i=new Map(r);for(let[e,n]of t)i.set(e,n);ap.set(e,i);try{return n()}finally{r?ap.set(e,r):ap.delete(e)}},fp=(e,t,n,r)=>{let i=e?w(e):void 0;if(i&&b(i,`Identifier`)){let e=n.referenceFor(i)?.resolvedSymbol,t=e?ap.get(n)?.get(e.id):void 0;if(t)return t}let a=up(e,t,n,r);return{isSafe:a===`absent`||a===`untrusted`}},pp={containsKatex:!1,isConclusive:!0,isSafe:!0,isSafeInAttributeContext:!0},mp={containsKatex:!1,isConclusive:!0,isSafe:!0,isSafeInAttributeContext:!1},Q={containsKatex:!1,isConclusive:!1,isSafe:!1,isSafeInAttributeContext:!1},hp={containsKatex:!0,isConclusive:!1,isSafe:!1,isSafeInAttributeContext:!1},gp={containsKatex:!0,isConclusive:!0,isSafe:!1,isSafeInAttributeContext:!1},_p=new WeakMap,vp=new WeakMap,yp=(e,t,n)=>{_p.set(e,t),vp.set(e,n)},bp=e=>({containsKatex:e.some(e=>e.containsKatex),isConclusive:e.every(e=>e.isSafe)?e.filter(e=>e.containsKatex).every(e=>e.isConclusive):e.some(e=>e.containsKatex&&e.isConclusive&&!e.isSafe)||e.some(e=>e.containsKatex&&e.isConclusive)&&e.some(e=>!e.containsKatex&&!e.isSafe),isSafe:e.every(e=>e.isSafe),isSafeInAttributeContext:e.every(e=>e.isSafeInAttributeContext)}),xp=(e,t)=>{let n=w(e);if(!b(n,`ObjectExpression`))return{isKnown:!1,value:null};let r=!0,i=null;for(let e of n.properties){if(!b(e,`Property`)){r=!1,i=null;continue}let n=S(e,{allowComputedString:!0});n===null?(r=!1,i=null):n===t&&(r=!0,i=e.value)}return{isKnown:r,value:i}},Sp=(e,t)=>{let n=w(e);if(b(n,`Identifier`)){let e=F(n,t);return!!(e&&e.kind===`import`&&ve(e)?.source.value===`react`&&x(e.declarationNode)===`useMemo`)}if(!b(n,`MemberExpression`)||C(n)!==`useMemo`)return!1;let r=F(w(n.object),t);return!!(r&&r.kind===`import`&&ve(r)?.source.value===`react`&&(b(r.declarationNode,`ImportDefaultSpecifier`)||b(r.declarationNode,`ImportNamespaceSpecifier`)||x(r.declarationNode)===`default`))},Cp=(e,t)=>{let n=e=>{let r=w(e);if(b(r,`Identifier`)){let e=F(r,t);return!e||e.kind!==`const`||!e.initializer||e.references.some(e=>e.flag!==`read`)?null:n(e.initializer)}return!b(r,`Literal`)||!(`regex`in r)||!r.regex?null:r.regex},r=e=>{let t=w(e);if(!O(t))return null;if(!b(t.body,`BlockStatement`))return t.body;if(t.body.body.length!==1)return null;let n=t.body.body[0];return n&&b(n,`ReturnStatement`)?n.argument:null},i=e=>{let n=w(e);if(!O(n)||n.params.length!==1)return!1;let i=n.params[0],a=r(n);if(!i||!b(i,`Identifier`)||!a||!b(a,`MemberExpression`)||!a.computed||!b(w(a.property),`Identifier`))return!1;let o=w(a.property);if(t.referenceFor(o)?.resolvedSymbol!==t.symbolFor(i)||!b(w(a.object),`Identifier`))return!1;let s=F(w(a.object),t);if(!s||s.kind!==`const`||!s.initializer||s.references.some(e=>e.flag!==`read`))return!1;let c=xp(s.initializer,`<`);if(!c.isKnown||!c.value||!b(w(c.value),`Literal`))return!1;let l=w(c.value);return b(l,`Literal`)?typeof l.value==`string`&&!l.value.includes(`<`)&&!l.value.includes(`$`):!1},a=w(e),o=!1;for(;b(a,`CallExpression`);){let e=w(a.callee);if(!b(e,`MemberExpression`))return!1;let t=C(e);if(t!==`replace`&&t!==`replaceAll`)return!1;let r=a.arguments[0],s=a.arguments[1];if(!r||!s||!(b(s,`Literal`)&&typeof s.value==`string`&&!s.value.includes(`<`)&&!s.value.includes(`$`))&&!i(s))return!1;let c=n(r),l=t===`replaceAll`&&b(r,`Literal`)&&r.value===`<`,u=!!c?.flags.includes(`g`)&&(c?.pattern===`<`||/^\[[^\]]*<[^\]]*\]$/.test(c?.pattern??``));(l||u)&&(o=!0),a=w(e.object)}return!o||!b(a,`Identifier`)?!1:t.referenceFor(a)?.resolvedSymbol?.kind===`parameter`},wp=(e,t)=>{let n=w(e.callee);return b(n,`MemberExpression`)&&C(n)===`sanitize`&&(Qf(n.object,`dompurify`,`sanitize`,e,t)||Qf(n.object,`isomorphic-dompurify`,`sanitize`,e,t))?mp:b(n,`MemberExpression`)&&C(n)===`escape`&&Qf(n.object,`html-escaper`,`escape`,e,t)||$f(n,`html-escaper`,`escape`,e,t)?pp:$f(n,`dompurify`,`sanitize`,e,t)||$f(n,`isomorphic-dompurify`,`sanitize`,e,t)?mp:null},Tp=(e,t)=>{if(!t.isSafe)return null;let n=w(e.callee);if(!b(n,`MemberExpression`))return null;let r=C(n);if((r===`trim`||r===`trimEnd`||r===`trimStart`)&&e.arguments.length===0)return t;if(r!==`replace`&&r!==`replaceAll`)return null;let i=e.arguments[1];return!i||!b(i,`Literal`)||typeof i.value!=`string`||i.value.includes(`<`)?null:{containsKatex:t.containsKatex,isConclusive:t.isConclusive,isSafe:!0,isSafeInAttributeContext:t.isSafeInAttributeContext&&!/[&>"']/.test(i.value)}},Ep=e=>{let t=e.toLowerCase();for(let e of[`script`,`style`,`textarea`,`title`])if(t.lastIndexOf(`<${e}`)>t.lastIndexOf(`</${e}`))return`raw-text`;let n=e.lastIndexOf(`<`);if(n<=e.lastIndexOf(`>`))return`text`;let r=e.slice(n+1),i=null;for(let e=0;e<r.length;e+=1){let t=r[e];(t===`"`||t===`'`)&&r[e-1]!==`\\`&&(i===t?i=null:i===null&&(i=t))}return i===null?`unsafe-tag`:`attribute`},Dp=(e,t,n,r)=>{let i=e.expressions.map(e=>$(e,t,new Set(n),r)),a=``,o=!0;for(let t=0;t<i.length;t+=1){a+=e.quasis[t]?.value.raw??``;let n=Ep(a),r=i[t]??Q;n===`text`?o&&=r.isSafe:n===`attribute`?o&&=r.isSafeInAttributeContext:o=!1}return{containsKatex:i.some(e=>e.containsKatex),isConclusive:o?i.filter(e=>e.containsKatex).every(e=>e.isConclusive):i.some(e=>e.containsKatex&&e.isConclusive&&!e.isSafe)||i.some(e=>e.containsKatex&&e.isConclusive)&&i.some(e=>!e.containsKatex&&!e.isSafe),isSafe:o,isSafeInAttributeContext:!1}},Op=(e,t)=>{let n=e;for(;n.parent&&n!==t;){let e=n.parent;if(b(e,`BlockStatement`)){let t=e.body.findIndex(e=>e===n);if(t>0&&e.body.slice(0,t).some(e=>B(e)))return!0}if(b(e,`SwitchCase`)){let t=e.consequent.findIndex(e=>e===n);if(t>0&&e.consequent.slice(0,t).some(e=>B(e)))return!0}if(b(e,`IfStatement`)&&b(e.test,`Literal`)){let t=e.alternate,r=e.consequent,i=!!e.test.value;if(!i&&r===n||i&&t===n)return!0}if(b(e,`WhileStatement`)&&e.body===n){let t=e.test;if(b(t,`Literal`)&&!t.value)return!0}if(b(e,`ForStatement`)&&e.body===n){let t=e.test;if(t&&b(t,`Literal`)&&!t.value)return!0}n=e}return!1},kp=(e,t,n,r=new Map)=>{if(!O(e))return Q;if(!b(e.body,`BlockStatement`))return $(e.body,t,n,r);let i=e.body,a=[];return z(i,e=>{if(e!==i&&O(e))return!1;if(b(e,`ReturnStatement`))return Op(e,i)||a.push(e.argument?$(e.argument,t,new Set(n),r):pp),!1}),a.length===0?pp:bp(a)},Ap=(e,t,n,r,i=new Map)=>{if(!O(e))return Q;let a=[];if(!b(e.body,`BlockStatement`))a.push(e.body);else{let t=e.body;z(t,e=>{if(e!==t&&O(e))return!1;b(e,`ReturnStatement`)&&e.argument&&!Op(e,t)&&a.push(e.argument)})}return a.length===0?Q:bp(a.map(e=>{let a=xp(e,t);if(a.isKnown&&a.value!==null)return $(a.value,n,new Set(r),i);let o=w(e);return b(o,`CallExpression`)?Np(o,n,t)??Q:Q}))},jp=(e,t)=>{let n=w(e);if(!b(n,`Identifier`))return null;let r=F(n,t);if(!r||r.references.some(e=>e.flag!==`read`))return null;if(r.kind===`function`&&O(r.declarationNode))return{functionNode:r.declarationNode,symbol:r};if(r.kind!==`const`||!r.initializer)return null;let i=w(r.initializer);return O(i)?{functionNode:i,symbol:r}:null},Mp=(e,t,n,r)=>{let i=new Map;if(!O(e))return i;let a=(e,t)=>e===void 0||b(e,`Identifier`)&&e.name===`undefined`&&t.isGlobalReference(e)||b(e,`UnaryExpression`)&&e.operator===`void`,o=(e,t,n,a)=>a?dp(r,i,()=>fp(e,t,n,new Set)):fp(e,t,n,new Set);for(let[s,c]of e.params.entries()){let e=t.arguments[s],l=b(c,`AssignmentPattern`)&&a(e,n),u=l&&b(c,`AssignmentPattern`)?c.right:e,d=l?r:n,f=l?c:t,p=b(c,`AssignmentPattern`)?c.left:c;if(b(p,`Identifier`)){let e=r.symbolFor(p);if(!e||e.references.some(e=>e.flag!==`read`))continue;i.set(e.id,o(u,f,d,l));continue}if(!(!b(p,`ObjectPattern`)||!u))for(let e of p.properties){if(!b(e,`Property`))continue;let t=S(e,{allowComputedString:!0});if(t===null)continue;let n=xp(u,t),s=b(e.value,`AssignmentPattern`)?e.value.left:e.value;if(!b(s,`Identifier`))continue;let c=r.symbolFor(s);if(!n.isKnown||!c||c.references.some(e=>e.flag!==`read`))continue;let l=b(e.value,`AssignmentPattern`)&&(n.value===null||a(n.value??void 0,d)),p=l&&b(e.value,`AssignmentPattern`)?e.value.right:n.value??void 0,m=l?r:d,h=l?e:f;i.set(c.id,o(p,h,m,l))}}return i},Np=(e,t,n)=>{let r=w(e.callee);if(!b(r,`Identifier`))return null;let i=F(r,t);if(!i||i.kind!==`import`)return null;let a=ve(i),o=x(i.declarationNode),s=_p.get(t),c=a?.source.value,l=vp.get(t)??0;if(!s||typeof c!=`string`||!o||l>=2)return null;let u=lr(s,c,o);if(!u||!O(u.functionNode))return null;let d=A(u.programNode);return yp(d,u.filePath,l+1),dp(d,Mp(u.functionNode,e,t,d),()=>n?Ap(u.functionNode,n,d,new Set):kp(u.functionNode,d,new Set))},Pp=(e,t,n,r)=>{if(!b(e,`CallExpression`))return Q;let i=w(e.callee);if(b(i,`MemberExpression`)&&C(i)===`get`){let e=w(i.object);if(b(e,`Identifier`)){let i=F(e,t),a=i?.initializer?w(i.initializer):null,o=a&&b(a,`NewExpression`)?w(a.callee):null;if(i?.kind===`const`&&a&&b(a,`NewExpression`)&&b(o,`Identifier`)&&o.name===`Map`&&t.isGlobalReference(o)&&!n.has(i.id)){let e=new Set(n);e.add(i.id);let a=[],o=!1;for(let n of i.references){let i=n.identifier.parent;if(n.flag!==`read`||!i||!b(i,`MemberExpression`)||i.object!==n.identifier){o=!0;break}let s=C(i);if(s===`size`)continue;let c=i.parent;if(!c||!b(c,`CallExpression`)||c.callee!==i){o=!0;break}if(![`get`,`has`,`keys`,`values`,`entries`,`clear`,`delete`].includes(s??``)){if(s!==`set`||!c.arguments[1]){o=!0;break}a.push($(c.arguments[1],t,new Set(e),r))}}if(!o&&a.length>0)return bp(a)}}}if(b(i,`MemberExpression`)&&C(i)===`renderToString`&&ep(i.object,e,t)||tp(i,e,t))return{containsKatex:!0,isConclusive:!0,isSafe:fp(e.arguments[1],e,t,new Set).isSafe,isSafeInAttributeContext:!1};let a=Np(e,t);if(a?.containsKatex)return a;let o=jp(i,t);if(o&&!n.has(o.symbol.id)){let i=new Set(n);i.add(o.symbol.id);let a=e.arguments.map(e=>{let i=w(e);return O(i)?kp(i,t,new Set(n),r):$(i,t,new Set(n),r)}),s=new Map,c=!1;if(O(o.functionNode))for(let[e,n]of o.functionNode.params.entries()){if(!b(n,`Identifier`))continue;let r=t.symbolFor(n),i=a[e],o=r?.references.every(e=>e.flag===`read`);r&&i&&o&&s.set(r.id,i),i?.containsKatex&&r&&!o&&(c=!0)}let l=dp(t,Mp(o.functionNode,e,t,t),()=>kp(o.functionNode,t,i,s));return!a.some(e=>e.containsKatex)||l.containsKatex?l:c?hp:gp}if(np(i,t))return{containsKatex:!0,isConclusive:!0,isSafe:!1,isSafeInAttributeContext:!1};if(b(i,`MemberExpression`)){let a=$(i.object,t,new Set(n),r);if(a.containsKatex)return Tp(e,a)||(a.isConclusive?{containsKatex:!0,isConclusive:!0,isSafe:!1,isSafeInAttributeContext:!1}:hp)}let s=wp(e,t);if(s)return s;if(Cp(e,t))return mp;if(Sp(i,t)){let i=e.arguments[0];if(!i)return Q;let a=w(i);if(O(a))return kp(a,t,new Set(n),r);let o=jp(a,t);if(!o||n.has(o.symbol.id))return Q;let s=new Set(n);return s.add(o.symbol.id),kp(o.functionNode,t,s,r)}return e.arguments.some(e=>{let i=w(e);return(O(i)?kp(i,t,new Set(n),r):$(i,t,new Set(n),r)).containsKatex})?hp:Q},Fp=(e,t)=>{let n=Tf(e);if(b(n,`Literal`))return!!n.value;if(b(n,`Identifier`)&&(n.name===`undefined`||n.name===`NaN`)&&t.isGlobalReference(n))return!1;if(b(n,`TemplateLiteral`)){let e=Gt(n);return e===null?null:!!e}if(b(n,`ArrayExpression`)||b(n,`ObjectExpression`)||b(n,`ArrowFunctionExpression`)||b(n,`FunctionExpression`)||b(n,`ClassExpression`)||b(n,`NewExpression`)||b(n,`JSXElement`)||b(n,`JSXFragment`))return!0;if(b(n,`UnaryExpression`)){if(n.operator===`void`)return!1;if(n.operator===`typeof`)return!0;if(n.operator===`!`){let e=Fp(n.argument,t);return e===null?null:!e}}return null},$=(e,t,n,r=new Map)=>{let i=w(e);if(b(i,`Literal`)||b(i,`UnaryExpression`)&&i.operator===`void`)return pp;if(b(i,`Identifier`)){if((i.name===`undefined`||i.name===`NaN`)&&t.isGlobalReference(i))return pp;let e=t.referenceFor(i)?.resolvedSymbol,a=e?r.get(e.id):void 0;if(a)return a;if(!e||n.has(e.id))return Q;let o=new Set(n);if(o.add(e.id),e.kind===`let`||e.kind===`var`){let n=[];e.initializer&&n.push(e.initializer);for(let t of e.references){if(t.flag===`read`)continue;let e=Co(t.identifier);if(!e)return Q;n.push(e)}return n.length===0?Q:bp(n.map(e=>$(e,t,new Set(o),r)))}return e.kind!==`const`||!e.initializer?Q:$(e.initializer,t,o,r)}if(b(i,`CallExpression`))return Pp(i,t,n,r);if(b(i,`MemberExpression`)){let e=C(i),a=w(i.object);if(e&&b(a,`Identifier`)){let i=t.referenceFor(a)?.resolvedSymbol,o=i?.initializer?w(i.initializer):null;if(i?.kind===`const`&&o&&b(o,`CallExpression`)){if(Sp(o.callee,t)){let i=o.arguments[0],a=i?w(i):null;if(a&&O(a)){let i=Ap(a,e,t,new Set(n),r);if(i.containsKatex)return i}}let i=Np(o,t,e);if(i?.containsKatex)return i}}return Q}if(b(i,`TemplateLiteral`))return Dp(i,t,n,r);if(b(i,`ConditionalExpression`)){let e=Fp(i.test,t);return e===null?bp([$(i.consequent,t,new Set(n),r),$(i.alternate,t,new Set(n),r)]):$(e?i.consequent:i.alternate,t,new Set(n),r)}if(b(i,`LogicalExpression`)){let e=i.operator===`??`?null:Fp(i.left,t);if(e!==null)return $(i.operator===`&&`?e?i.right:i.left:e?i.left:i.right,t,new Set(n),r);let a=kf(i);if(a.length===1)return $(a[0]??i,t,new Set(n),r);let o=[i.left,i.right].map(e=>$(e,t,new Set(n),r));return{...i.operator===`&&`?o[1]??Q:bp(a.map(e=>$(e,t,new Set(n),r))),containsKatex:o.some(e=>e.containsKatex)}}if(b(i,`BinaryExpression`)&&i.operator===`+`)return bp([$(i.left,t,new Set(n),r),$(i.right,t,new Set(n),r)]);if(b(i,`SequenceExpression`)){let e=i.expressions.at(-1);return e?$(e,t,n,r):Q}return Q},Ip=e=>{let t=null;if(b(e,`JSXAttribute`)&&b(e.name,`JSXIdentifier`)&&e.name.name===`dangerouslySetInnerHTML`&&b(e.value,`JSXExpressionContainer`)&&b(e.value.expression,`ObjectExpression`)&&(t=e.value.expression),b(e,`Property`)&&S(e,{allowComputedString:!0})===`dangerouslySetInnerHTML`&&b(w(e.value),`ObjectExpression`)&&(t=w(e.value)),!b(t,`ObjectExpression`))return null;let n=null;for(let e of t.properties){if(b(e,`SpreadElement`)){n=null;continue}if(!b(e,`Property`)){n=null;continue}let t=S(e,{allowComputedString:!0});if(t===null){n=null;continue}t===`__html`&&(n=e.value)}return n},Lp=(e,t)=>{let n=_n({filename:t,sourceText:e});if(n===null)return[];let r=A(n);yp(r,t,0);let i=[];return z(n,e=>{let t=Ip(e);if(t===null)return;let n=$(t,r,new Set);if(!n.containsKatex)return;let a=X(e),o=wf(e);a<0||o<0||i.push({endIndex:o,proof:n,startIndex:a})}),i},Rp=/dangerouslySetInnerHTML|(?:\.(?:inner|outer)HTML|\[\s*["'](?:inner|outer)HTML["']\s*\])\s*[+]?=(?!=)|\.insertAdjacentHTML\s*\(|\bdocument\.write(?:ln)?\s*\(|\.(?:createContextualFragment|setHTMLUnsafe)\s*\(/,zp=/(?:__html\s*:|(?:\.(?:inner|outer)HTML|\[\s*["'](?:inner|outer)HTML["']\s*\])\s*[+]?=(?!=)|\.insertAdjacentHTML\s*\(\s*[^,]*,|\bdocument\.write(?:ln)?\s*\(|\.(?:createContextualFragment|setHTMLUnsafe)\s*\()\s*([\s\S]*)/,Bp=/searchParams|query|params|request|req\.|response\.|await|fetch|props\.|children|(?:user|untrusted|unsafe|raw|comment|message|cms|remote|external)\.|(?:user|untrusted|unsafe|raw|comment|message|cms|remote|external|content|profile|signature|subtitle)\w*(?:html|markup)|(?:html|markup)\w*(?:input|payload)|\b(?:load|read|receive|decode)\w*\s*\(|\bget\w*(?:Html|Markup|Content|Page|Message)\b|\blocation\b|document\.cookie|\breferrer\b|\blocalStorage\b|\bsessionStorage\b|URLSearchParams|window\.name/i,Vp=/^(?:"(?:\\.|[^"\\\n])*"|'(?:\\.|[^'\\\n])*'|`[^`$]*`)\s*(?:\/\/[^\n]*)?\s*(?:[;,})\n]|$)/,Hp=/^[A-Z][A-Z0-9_]*\s*(?:\/\/[^\n]*)?\s*(?:[;,})\n]|$)/,Up=/^[\w$]+(?:\??\.[\w$]+)*\??\.(?:inner|outer)HTML\b/,Wp=/\b(?:DOMPurify|sanitize\w*|purify|(?:escape|encode)[A-Za-z]*(?:Html|HTML|Entit\w*)|insane|xss)\b|(?<!un)safe|(?<!un)saniti[sz]/i,Gp=/[:=]\s*[^\n;]*\b(?:DOMPurify\b|sanitize\w*\s*\(|purify\w*\s*\()/i,Kp=/=\s*[\w$.?[\]]*\.(?:inner|outer)HTML\s*(?:[;,)\n]|$)/,qp=/process\.env/,Jp=/\b(?:t|i18n|translate|formatMessage|intl)\s*[.(]/,Yp=/^(?:[\w$.]+\.)?(?:toHtml|render[A-Za-z]*(?:Html|HTML)|renderToString|renderToStaticMarkup|codeToHtml|codeToHast|highlight[A-Za-z]*)\s*\(/,Xp=/\b(?:shiki|prism|hljs|highlightjs|getHighlighter|codeToHtml|codeToHast|refractor|lowlight|starry-night)\b|highlight\.js/i,Zp=/[:=]\s*[^\n;]*(?:\b(?:katex|shiki|hljs|prism|mermaid)\b|hast-util-to-html|renderHtmlFromRichText|(?:toHtml|render[A-Za-z]*(?:Html|HTML)|renderToString|renderToStaticMarkup|codeToHtml|codeToHast)\s*\()/i,Qp=/\b(?:(?:katex|shiki|hljs|prism|mermaid|highlighter)[\w$]*\.(?:render\w*|highlight\w*|codeTo(?:Html|Hast))|(?:toHtml|render(?:Html|HTML)[A-Za-z]*|render[A-Za-z]*(?:Html|HTML)|renderToString|renderToStaticMarkup|codeToHtml|codeToHast|highlight[A-Za-z]*))\s*\(/i,$p=/^[\w$]+\s*(?:[;,})\n]|$)/,em=/^[\w$]+\s*(?:\|\||\?\?)\s*(?:"[^"\n]*"|'[^'\n]*'|`[^`$]*`)\s*(?:[;,})\n]|$)/,tm=/^[\w$]+(?:\.[\w$]+|\[[^\]]*\])+\s*(?:[;,})\n]|$)/,nm=/<style\b[^<>]*$/,rm=/(?:^|\/)emails(?:\/|$)|email[-_.]templates?(?:\/|$)|RawHtml|[A-Za-z]*[Ee]mail[A-Za-z]*\.(?:t|j)sx?/i,im=/(?:^|\/)\.[\w-]+\//,am=/(?<!un)saniti[sz]e?d?[\w-]*\.[cm]?[jt]sx?$/i,om=/(?:^|[^\w$.])([\w$]+(?:\.[\w$]+)*)(?:(?:\.(?:inner|outer)HTML|\[\s*["'](?:inner|outer)HTML["']\s*\])\s*[+]?=(?!=)|\.insertAdjacentHTML\s*\()/,sm=/\b(?:appendChild|append|prepend|before|after|replaceWith|replaceChild|replaceChildren|insertBefore|insertAdjacentElement)\s*\(/,cm=5e3,lm=e=>{if(!e.startsWith("`"))return null;let t=e.indexOf("`",1);if(t<0||t>cm)return null;let n=e.slice(1,t).match(/\$\{[^}]*\}/g);return n===null?``:n.join(` `)},um=(e,t,n)=>{let r=_m(e,t,n);return r===null?null:n.slice(r.initializerStartIndex,r.initializerStartIndex+cm)},dm=e=>{if(!/^["']/.test(e))return!1;let t=e.replace(/"(?:\\.|[^"\\\n])*"|'(?:\\.|[^'\\\n])*'/g,``),n=t.search(/[;,})\]]/),r=n>=0?t.slice(0,n):t;return/^[\s+]*$/.test(r)},fm=(e,t)=>{let n=t.includes(`createElement`),r=t.includes(`createHTMLDocument`);if(!n&&!r)return!1;let i=J(e),a=J(e.split(`.`)[0]??e);if(RegExp(`\\b${a}\\s*=\\s*[^\\n;]*(?:getElementById|querySelector|getElementsBy|\\.current\\b|document\\.(?:body|head|documentElement))`).test(t))return!1;if(n&&(RegExp(`${i}\\s*=\\s*document\\.createElement\\(\\s*["'\`]template["'\`]`).test(t)||RegExp(`${a}\\s*=\\s*[^\\n;]*\\bcreateElement\\(\\s*["'\`](?:style|textarea)["'\`]`).test(t))||r&&RegExp(`${a}\\s*=\\s*[^\\n;]*\\bcreateHTMLDocument\\s*\\(`).test(t))return!0;if(!n||!RegExp(`${a}\\s*=\\s*[^\\n;]*\\bcreateElement\\s*\\(`).test(t))return!1;let o=RegExp(`${sm.source}[^)]*\\b${a}\\b`),s=RegExp(`\\breturn\\b[^\\n]*\\b${a}\\b(?!\\s*\\.\\s*(?:textContent|innerText|innerHTML|outerHTML))`);return o.test(t)||s.test(t)?!1:RegExp(`\\b${a}\\.(?:textContent|innerText|querySelector|querySelectorAll|children|childNodes)\\b`).test(t)},pm=e=>{let t=[],n=``,r=0,i=null;for(let a=0;a<e.length;a+=1){let o=e[a];if(i!==null){n+=o,o===i&&e[a-1]!==`\\`&&(i=null);continue}if(o===`"`||o===`'`||o==="`"){i=o,n+=o;continue}if(o===`(`||o===`[`||o===`{`?r+=1:(o===`)`||o===`]`||o===`}`)&&--r,o===`+`&&r===0&&e[a-1]!==`+`&&e[a+1]!==`+`){t.push(n),n=``;continue}n+=o}return t.push(n),t},mm=e=>{let t=e.replace(/[;}]\s*$/,``).trim();if(!t.includes(`+`))return!1;let n=[];for(let e of pm(t)){let t=e.trim();t.length>0&&n.push(t)}return n.length<2?!1:n.every(e=>{let t=e.replace(/\(\s*([\w$]+(?:\??\.[\w$]+)*)\s+as\s+[^)]*\)/g,`$1`);return Up.test(t)?!Bp.test(t.replace(Up,``)):!1})},hm=(e,t)=>{let n=0,r=null;for(let i=t;i<e.length;i+=1){let t=e[i];if(r!==null){t===r&&e[i-1]!==`\\`&&(r=null);continue}if(t===`"`||t===`'`||t==="`"){r=t;continue}if(t===`{`&&(n+=1),t===`}`&&(--n,n===0))return i}return e.length},gm=(e,t)=>{let n=[],r=null,i=!1,a=!1;for(let o=0;o<t;o+=1){let t=e[o],s=e[o+1];if(i){t===`
-`&&(i=!1);continue}if(a){t===`*`&&s===`/`&&(a=!1,o+=1);continue}if(r!==null){t===r&&e[o-1]!==`\\`&&(r=null);continue}if(t===`/`&&s===`/`){i=!0,o+=1;continue}if(t===`/`&&s===`*`){a=!0,o+=1;continue}if(t===`"`||t===`'`||t==="`"){r=t;continue}t===`{`&&n.push(o),t===`}`&&n.pop()}let o=n.at(-1);return o===void 0?e.length:hm(e,o)},_m=(e,t,n)=>{let r=RegExp(`(const|let|var)\\s+${J(e)}\\s*(?::[^=\\n]*)?=\\s*([^;\\n]+)`,`g`),i=null,a=-1;for(let e of n.matchAll(r)){let r=e.index;if(r===void 0||r>=t||r<=a||gm(n,r)<t)continue;a=r;let o=e[2];o!==void 0&&(i={declarationIndex:r,initializer:o,initializerStartIndex:r+e[0].length-o.length,isImmutable:e[1]===`const`})}return i},vm=(e,t,n,r)=>{if(t.isImmutable)return!0;let i=r.slice(t.initializerStartIndex+t.initializer.length,n);return!RegExp(`(?:^|[^\\w$.])${J(e)}\\s*=(?!=)`).test(i)},ym=(e,t,n)=>{if(!/highlight/i.test(e))return!1;let r=e.match(/^([\w$]+)/)?.[1];if(r===void 0)return!1;let i=_m(r,n,t);return i===null?/highlighted/i.test(e)||Xp.test(t):vm(r,i,n,t)&&Qp.test(i.initializer)},bm=(e,t,n,r=new Set)=>{let i=e.trim(),a=pm(i);if(a.length>1)return a.every(e=>bm(e,t,n,r));let o=[...i.matchAll(/\$\{([^}]*)\}/g)].flatMap(e=>e[1]===void 0?[]:[e[1]]);if(o.length>1)return o.every(e=>bm(e,t,n,r));let s=i.match(/^([\w$]+)(?:(?:\??\.[\w$]+)|(?:\[\s*(?:"[^"\n]*"|'[^'\n]*'|\d+)\s*\]))*$/)?.[1];if(s&&!r.has(s)){let e=_m(s,n,t);if(e&&vm(s,e,n,t)){let n=new Set(r);return n.add(s),bm(e.initializer,t,e.initializerStartIndex,n)}}return!!(Vp.test(`${i};`)||Hp.test(`${i};`)||Wp.test(i)||qp.test(i)||Jp.test(i)||Yp.test(i)||ym(i,t,n))},xm=(e,t,n,r,i=new Set)=>{let a=e.trim().match(/^([\w$]+)$/)?.[1];if(!a)return!1;if(a===t)return!0;if(i.has(a))return!1;let o=_m(a,n,r);if(!o?.isImmutable)return!1;let s=new Set(i);return s.add(a),xm(o.initializer,t,o.initializerStartIndex,r,s)},Sm=(e,t,n)=>{let r=n.slice(Math.max(0,t-cm),t),i=J(e);return RegExp(`(?:function\\s+[\\w$]+|(?:const|let|var)\\s+[\\w$]+\\s*=)\\s*\\(\\s*\\{[^}]*\\b${i}\\b[^}]*\\}`).test(r)},Cm=(e,t,n)=>{let r=[/function\s+([\w$]+)\s*\(([^)]*)\)\s*\{/g,/(?:const|let|var)\s+([\w$]+)\s*=\s*(?:async\s*)?\(([^)]*)\)\s*=>\s*\{/g],i=null,a=-1;for(let o of r)for(let r of n.matchAll(o)){let o=r.index;if(o===void 0||o>=t||o<a)continue;let s=hm(n,o+r[0].lastIndexOf(`{`));if(s<t)continue;let c=(r[2]??``).split(`,`).findIndex(t=>t.trim().match(/^(?:\.\.\.)?([\w$]+)/)?.[1]===e);if(c<0)continue;a=o;let l=r[1]??``;i={bodyEndIndex:s,declarationNameIndex:o+r[0].indexOf(l),functionName:l,parameterIndex:c}}return i},wm=e=>{let t=[],n=0,r=0,i=null;for(let a=0;a<e.length;a+=1){let o=e[a];if(i!==null){o===i&&e[a-1]!==`\\`&&(i=null);continue}if(o===`"`||o===`'`||o==="`"){i=o;continue}(o===`(`||o===`[`||o===`{`)&&(r+=1),(o===`)`||o===`]`||o===`}`)&&--r,o===`,`&&r===0&&(t.push(e.slice(n,a).trim()),n=a+1)}return t.push(e.slice(n).trim()),t},Tm=(e,t,n,r=new Set)=>{let i=e.trim().match(/^([\w$]+)$/)?.[1];if(i===void 0||r.has(i))return!1;if(Cm(i,t,n)!==null)return!0;let a=_m(i,t,n);if(!a||!vm(i,a,t,n))return!1;let o=new Set(r);return o.add(i),Tm(a.initializer,a.initializerStartIndex,n,o)},Em=(e,t,n,r,i)=>{let a=e.trim();if(bm(a,t,n))return!1;let o=a.match(/^([\w$]+)(?:\.|\s*(?:(?:\|\||\?\?)|[;,})\n]|$))/)?.[1];if(o===void 0)return Bp.test(a);if(Sm(o,n,t))return!0;if(r.has(o))return!1;r.add(o);let s=_m(o,n,t),c=Cm(o,n,t);if(s!==null&&(c===null||s.declarationIndex>c.declarationNameIndex))return vm(o,s,n,t)&&bm(s.initializer,t,s.initializerStartIndex)?!1:!vm(o,s,n,t)||Em(s.initializer,t,s.initializerStartIndex,r,i)?!0:Tm(s.initializer,s.initializerStartIndex,t)?!1:Bp.test(a);if(c!==null&&c.functionName.length>0){let e=RegExp(`\\b${J(c.functionName)}\\s*\\(`,`g`),n=!1;for(let a of t.matchAll(e)){if(a.index===c.declarationNameIndex||i.has(a.index))continue;let e=a.index+a[0].lastIndexOf(`(`),s=Cf(t,e);if(s<0)continue;let l=wm(t.slice(e+1,s))[c.parameterIndex];if(l===void 0||a.index>=c.declarationNameIndex&&a.index<=c.bodyEndIndex&&xm(l,o,a.index,t))continue;n=!0;let u=new Set(r);u.delete(o);let d=new Set(i);if(d.add(a.index),Em(l,t,a.index,u,d))return!0}if(n)return!1;let s=t.slice(Math.max(0,c.declarationNameIndex-48),c.declarationNameIndex);return/\bexport\s+(?:(?:default\s+)?(?:async\s+)?function|const|let|var)\s+$/.test(s)?!0:Bp.test(a)}return Bp.test(a)},Dm=W({id:`dangerous-html-sink`,title:`HTML injection sink with dynamic content`,severity:`warn`,recommendation:`Prefer rendering structured React nodes. If HTML is required, sanitize with a well-reviewed sanitizer and keep the trust boundary close to the sink.`,scan:e=>{if(e.isGeneratedBundle||!K(e.relativePath)||rm.test(e.relativePath)||im.test(e.relativePath)||am.test(e.relativePath)||!Rp.test(e.content))return[];let t=Lp(e.content,e.absolutePath),n=[],r=e.content.split(`
-`);for(let i=0;i<r.length;i+=1){let a=r[i]??``;if(!Rp.test(a))continue;let o=a.slice(0,a.search(Rp)).replace(/"[^"]*"|'[^']*'|`[^`]*`/g,``);if(/(?:^|[^:])\/\//.test(o)||/^\s*[/*]/.test(a))continue;let s=r.slice(i,i+1+4).join(`
-`),c=zp.exec(s);if(c===null)continue;let l=(c[1]??``).trimStart(),u=l.slice(0,300),d=u.search(/[;}]/),f=d>=0?u.slice(0,d+1):u,p=r.slice(0,i).join(`
-`).length+ +(i>0)+a.search(Rp),m=t.find(e=>p>=e.startIndex&&p<e.endIndex)?.proof;if(m?.isConclusive&&m.isSafe)continue;let h=m?.isConclusive===!0;if(Vp.test(f)||Hp.test(f))continue;if(Up.test(f)&&!f.includes(`+`)){let e=f.replace(Up,``);if(!Bp.test(e))continue}if(mm(f))continue;let g=zp.exec(r.slice(i,i+1+60).join(`
-`))?.[1]?.trimStart(),_=lm(g??l),v=$p.test(f)||tm.test(f)||em.test(f)?f.match(/^[\w$]+/)?.[0]:void 0;if(_===null&&v!==void 0&&$p.test(f)&&Cm(v,p,e.content)===null){let t=um(v,p,e.content);if(t!==null){if(dm(t))continue;_=lm(t)}}if(_===``)continue;let y=_??f,ee=pm(y).length>1||(_?.match(/\$\{/g)?.length??0)>1;if(!h&&!ee&&Wp.test(y)||!ee&&qp.test(y)||!ee&&Jp.test(y)||!h&&!Em(y,e.content,p,new Set,new Set)||!h&&Yp.test(f)||!h&&ym(f,e.content,p))continue;if(v!==void 0){let t=J(v),n=_m(v,p,e.content),r=n?.initializer;if(!(r!==void 0&&(pm(r).length>1||(r.match(/\$\{/g)?.length??0)>1))){let i=RegExp(`\\b${t}\\b\\s*${Zp.source}`,`i`);if(!h&&(r===void 0?i.test(e.content):n!==null&&vm(v,n,p,e.content)&&Qp.test(r)))continue;let a=RegExp(`\\b${t}\\b\\s*${Gp.source}`,`i`);if(!h&&(r===void 0?a.test(e.content):n!==null&&vm(v,n,p,e.content)&&Gp.test(`=${r}`)))continue}if(RegExp(`\\b${t}\\b\\s*${Kp.source}`).test(e.content)||RegExp(`highlight[\\w$]*\\s*\\.map\\(\\s*(?:async\\s+)?\\(?\\s*${t}\\b`,`i`).test(e.content)&&Xp.test(e.content))continue}if(tm.test(f)){let t=f.match(/\.([\w$]+)\s*(?:[;,})\n]|$)/)?.[1];if(t!==void 0&&RegExp(`\\b${J(t)}\\s*:\\s*${Jp.source}`).test(e.content))continue}let te=om.exec(a),ne=te?.[1]??te?.[2];if(ne!==void 0&&fm(ne,e.content))continue;let re=r.slice(Math.max(0,i-5),i+1).join(`
-`).slice(0,-a.length+a.search(Rp));nm.test(re)||n.push({message:`HTML is injected from a dynamic-looking source, which can become XSS if the value is user-controlled or unsanitized.`,line:i+1,column:a.search(/\S/)+1})}return n}}),Om=e=>!(!K(e)||su.test(e)||lu.test(e)),km=/firebase|firestore|supabase|\b(?:setDoc|addDoc)\s*\(/i,Am=W({id:`firebase-client-owned-authz-field`,title:`Client writes authorization field`,severity:`error`,recommendation:`Derive authority fields on the server or enforce them in Firebase/Supabase rules; never trust client-provided owner, org, or role values.`,scan:q({shouldScan:e=>Om(e.relativePath)&&(km.test(e.content)||km.test(e.relativePath)),pattern:/(?:\b(?:setDoc|updateDoc|addDoc)\s*\(|(?:\b(?:firebase|firestore|getFirestore)\b|\bcollection\s*\(|\.collection\s*\()[\s\S]{0,500}\.(?:set|update|add)\s*\()(?:[^;'"`]|'[^'\n]*'|"[^"\n]*"|`[^`]*`){0,700}\b(?:ownerId|ownerID|creatorId|creatorID|providerId|providerID|orgId|orgID|tenantId|tenantID|workspaceId|workspaceID|ghostOrg|role|roles|isAdmin)\b/i,message:`Client code writes an ownership, tenant, or role field that should be server-owned and immutable.`})}),jm=W({id:`firebase-permissive-rules`,title:`Permissive Firebase security rule`,severity:`error`,recommendation:"Bind every read/write to `request.auth.uid`, immutable ownership, and tenant membership instead of treating sign-in as authorization.",scan:q({shouldScan:e=>Du(e.relativePath),pattern:/allow\s+(?:read|write|create|update|delete|list|get|read,\s*write)\s*:\s*if\s+(?:true|request\.auth\s*!=\s*null)\s*;?/i,message:`Firebase rules grant broad access to everyone or to any signed-in user, which is the Chattr/Firewreck failure mode.`})}),Mm=W({id:`firebase-query-filter-as-auth`,defaultEnabled:!1,title:`Firestore query filter used as authorization`,severity:`warn`,recommendation:"Make sure Firestore rules compare the requested document against `request.auth.uid` and trusted membership data.",scan:q({shouldScan:e=>Om(e.relativePath),pattern:/\.where\s*\(\s*["'](?:uid|userId|userID|ownerId|ownerID|orgId|orgID|tenantId|tenantID|role)["']\s*,\s*["']==["']/i,message:`Firestore query code filters by an auth-shaped field; filtering is not authorization unless rules enforce the same boundary.`})}),Nm=/api\.github\.com|github\.com|gitlab\.com|bitbucket\.org/gi,Pm=/\$\{([^}]*)\}/g,Fm=/\b(?:params|searchParams|query|req|request|input|payload)\s*[.[]|\buntrusted|\bdecodeURI\w*/,Im=/encodeURIComponent\s*\(/,Lm=/^\s*[\w$]+\.toString\(\)\s*$/,Rm=W({id:`git-provider-url-injection-risk`,title:`Git provider URL built from interpolation`,severity:`warn`,recommendation:`Validate owner, repo, org, and branch identifiers against strict slugs and build URLs with URL/path encoders instead of raw interpolation.`,scan:e=>{if(!K(e.relativePath))return[];let t=[];for(let n of e.content.matchAll(Nm)){let r=e.content.slice(n.index,n.index+200),i=r.indexOf("`"),a=i>=0?r.slice(0,i):r;if(!Array.from(a.matchAll(Pm)).some(e=>{let t=e[1]??``;return Fm.test(t)&&!Im.test(t)&&!Lm.test(t)}))continue;let o=G(e.content,n.index);t.push({message:`GitHub/GitLab/Bitbucket URL construction interpolates path components that may be attacker-controlled.`,line:o.line,column:o.column});break}return t}}),zm=/child_process|childProcess|execa|subprocess|Deno\.run/,Bm=/(?:\b(?:eval|new\s+Function|vm\.runIn\w*)|(?<![.\w$])(?:exec(?:File)?(?:Sync)?|spawn(?:Sync)?)|\b(?:child_process|childProcess|cp)\.(?:exec|spawn)\w*)\s*\([^;]{0,200}(?<!["'])\b(?:exif|metadata|manifest|preset|plugin|upload|drop(?:ped|s)?\b|archive|zip|unzip|untar)(?!\w*["'])/,Vm=/(?:\b(?:eval|new\s+Function|vm\.runIn\w*)|\b(?:child_process|childProcess|cp)\.(?:exec|spawn)\w*)\s*\([^;]{0,200}(?<!["'])\b(?:exif|metadata|manifest|preset|plugin|upload|drop(?:ped|s)?\b|archive|zip|unzip|untar)(?!\w*["'])/,Hm=`Imported metadata, uploads, or plugin manifests appear to reach code execution.`,Um=q({shouldScan:()=>!0,pattern:Bm,ignoreStringLiterals:!0,message:Hm}),Wm=q({shouldScan:()=>!0,pattern:Vm,ignoreStringLiterals:!0,message:Hm}),Gm=W({id:`import-metadata-execution-risk`,title:`Imported metadata reaches code execution`,severity:`error`,recommendation:`Parse imported metadata as data with strict schemas; do not evaluate EXIF, manifests, presets, dropped files, or archives.`,scan:e=>K(e.relativePath)?zm.test(e.content)?Um(e):Wm(e):[]}),Km=/createHash\s*\(\s*["'](?:md5|sha1)["']|\bmd5\s*\(/gi,qm=/\b(?:password|token|secret|signature|signing|auth|credential|session|cookie|csrf|api.?key)\b/i,Jm=/(?<!cipher\.)\bcreate(?:Cipher|Decipher)\s*\(/,Ym=/\bcreate(?:Cipher|Decipher)iv\s*\(\s*["'](?:des|des3|des-?ede3?|rc4|rc2|bf|blowfish)\b/i,Xm=/\b(?:DES|RC4|Blowfish)\b/,Zm=/\b(?:cipher|decipher|encrypt|decrypt|crypto)\b/i,Qm=/[A-Za-z_$][\w$.]{0,100}signature[\w$]*(?:\([^)]*\))?\s*(?:===?|!==?)\s*[A-Za-z_$][\w$.]*(?:\([^)]*\))?|[A-Za-z_$][\w$.]{0,100}(?:\([^)]*\))?\s*(?:===?|!==?)\s*[A-Za-z_$][\w$.]{0,100}signature[\w$]*(?:\([^)]*\))?/i,$m=/(?:===?|!==?)\s*[A-Z](?:[a-z]|[A-Z0-9_]*\b(?!\s*[.(]))|^[A-Z](?:[a-z]|[A-Z0-9_]*\b(?!\s*[.(]))[\w$.]*(?:\([^)]*\))?\s*(?:===?|!==?)/,eh=/signature(?:Method|Type|Status|Algorithm|Kind|Mode|Version)\b/i,th=/(?:===?|!==?)\s*(?:true|false|null|undefined)\b/,nh=/\.(?:length|size|byteLength)\s*(?:===?|!==?)|\.(?:length|size|byteLength)\s*$/,rh=/\bcrypto\b|createH(?:mac|ash)|createSign|createVerify|\bsubtle\b|\bhmac\b|\bdigest\b|\bsha-?(?:1|256|384|512)\b|\bmd5\b|\bwebhook|x-(?:hub-)?signature/i,ih=/\.[cm]?[jt]sx$/i,ah=/timingSafeEqual|timing.?safe/i,oh=/gravatar|digest[-_ ]?auth|oauth[-_ ]?1|pkcs#?12|smime|\b_id\b|\betag\b|checksum|cache[-_ ]?key|fingerprint/i,sh=/token|secret|password|nonce|salt|csrf|credential|otp/i,ch=/(?:focus|render|refresh|remount|redraw|animation|layout|cache|update)[-_]?nonce/i,lh=/Math\.random\s*\(/g,uh=/createHash|md5|cipher|encrypt|decrypt|crypto|signature|Math\.random/i,dh=(e,t,n,r)=>{for(let i of e.matchAll(t)){let t=e.slice(Math.max(0,i.index-250),i.index+250);if(n.test(t)&&!r?.test(t))return i.index}return-1},fh=(e,t,n,r)=>{for(let i of e.matchAll(t)){let t=e.lastIndexOf(`
+`);if(!of.test(t)||cf.test(t)||!s&&!sf.test(t))continue;let n=Math.max(e.lines.findIndex(e=>of.test(e)),0),r=e.lines[n].search(of);return[{message:lf,line:e.startLineIndex+n+1,column:(r===-1?0:r)+1}]}return[]},ff=q({shouldScan:e=>xu(e.relativePath)&&!e.relativePath.endsWith(`package.json`)&&!uf(e.relativePath),pattern:af,message:lf}),pf=W({id:`build-pipeline-secret-boundary`,title:`Build pipeline runs code near secrets`,severity:`warn`,recommendation:`Run dependency installs with scripts disabled before exposing secrets, isolate untrusted build code, and move signing/deploy authority into a narrow privileged step.`,scan:e=>uf(e.relativePath)?df(e.content):ff(e)}),mf=W({id:`clickjacking-redirect-risk`,title:`Redirect or frame boundary risk`,severity:`warn`,recommendation:"Allowlist redirect origins/paths, set `frame-ancestors` for privileged pages, and avoid URL-prefilled privileged dialogs.",scan:q({shouldScan:e=>K(e.relativePath)||xu(e.relativePath),pattern:/\bredirect\s*\((?!\s*(?:await\s+)?[\w$]*(?:safe|valid|sanitiz|allowlist|whitelist)[\w$]*\s*\()[^)'"`\n]*\b(?:searchParams\.get|nextUrl\.searchParams|returnTo|callbackUrl|continue|next)\b|<iframe\b[\s\S]{0,700}(?:\b(?:next=|continue=|redirect=|redirect_uri|userstoinvite|sharingaction|\.\.)|[?&](?:amp;)?role=)|frame-ancestors\s+(?:\*|'self'\s+\*)|X-Frame-Options["']?\s*:\s*["']?ALLOW/i,message:`Redirect or framing configuration may let attacker-controlled URLs chain into privileged UI or clickjacking.`})}),hf=e=>/(?:^|\/)(?:tools?|scripts?)\/|(?:^|\/)management\/commands\/|(?:^|\/)(?:build|make|gulpfile|gruntfile)\.[cm]?[jt]s$/i.test(e),gf=e=>Cu(e,ou),_f=String.raw`(?:req\.|request\.|params\.|query\.|body\.|searchParams|\$_(?:GET|POST|REQUEST))`,vf=String.raw`(?:(?<![.\w$])(?:exec(?:Sync)?|system|passthru|proc_open|shell_exec)|\b(?:os\.system|subprocess\.(?:run|Popen|call)|(?:child_process|childProcess|cp)\.exec\w*))`,yf=String.raw`(?:(?<![.\w$])spawn(?:Sync)?|\b(?:child_process|childProcess|cp)\.spawn\w*)`,bf=String.raw`['"](?:sh|bash|zsh|dash|ksh|cmd(?:\.exe)?|powershell(?:\.exe)?|pwsh)['"]`,xf=String.raw`['"](?:-c|/c|-Command)['"]`,Sf=W({id:`command-execution-input-risk`,title:`Command execution uses caller-shaped input`,severity:`error`,recommendation:`Avoid shell execution for caller-controlled values. Use fixed commands, argument arrays, strict allowlists, and no shell interpolation.`,scan:q({shouldScan:e=>gf(e.relativePath)&&!hf(e.relativePath),pattern:[new RegExp(String.raw`${vf}\s*\([^)]{0,220}(?:${_f}|shell\s*=\s*true|f['"\`][^'"\`]*\{)`,`i`),new RegExp(String.raw`${yf}\s*\((?:[^,)]{0,120}?${_f}|\s*${bf}\s*,\s*\[\s*${xf}\s*,[^\]]{0,220}${_f}|(?=[^)]{0,220}shell\s*[:=]\s*true)[^)]{0,220}${_f})`,`i`)],message:`Command execution appears to include request, query, body, or shell-interpolated input.`})}),Cf=W({id:`cors-cookie-trust-risk`,title:`Broad cookie or credentialed CORS trust`,severity:`warn`,recommendation:`Keep auth cookies host-only and HttpOnly, avoid credentialed CORS for less-trusted docs/vendor origins, and isolate documentation domains from app sessions.`,scan:q({shouldScan:e=>K(e.relativePath)||xu(e.relativePath),pattern:/Access-Control-Allow-Credentials["']?\s*[:,]\s*["']?true[\s\S]{0,700}Access-Control-Allow-Origin["']?\s*[:,]\s*["']?(?:\*|https:\/\/docs\.|https:\/\/.*mintlify)|\b(?:session|auth|token|jwt)[^=\n]{0,80}(?:=[^;\n]{0,120};[^=\n]{0,80})?\bDomain=\./i,message:`Credentialed CORS or broad auth-cookie scope can make a docs/custom-domain XSS become account compromise.`})}),wf=(e,t)=>{let n=e[t],r=n===`(`?`)`:n===`{`?`}`:n===`[`?`]`:``;if(r===``)return-1;let i=0,a=null;for(let o=t;o<e.length;o+=1){let t=e[o];if(a!==null){t===`\\`?o+=1:t===a&&(a=null);continue}if(t===`"`||t===`'`||t==="`")a=t;else if(t===n)i+=1;else if(t===r&&(--i,i===0))return o}return-1},Tf=e=>`end`in e&&typeof e.end==`number`?e.end:-1,X=e=>`start`in e&&typeof e.start==`number`?e.start:-1,Ef=e=>{let t=w(e);for(;b(t,`SequenceExpression`);){let e=t.expressions.at(-1);if(!e)break;t=w(e)}return t},Df=e=>{let t=[],n=new Map;for(let r of e){let e=`${r.truthiness}:${r.nullishness}`,i=n.get(r.expression);i?.has(e)||(i?i.add(e):n.set(r.expression,new Set([e])),t.push(r))}return t},Of=e=>b(e,`JSXElement`)||b(e,`JSXFragment`)||b(e,`ArrayExpression`)||b(e,`ObjectExpression`)||b(e,`ArrowFunctionExpression`)||b(e,`FunctionExpression`)||b(e,`ClassExpression`)||b(e,`NewExpression`)?{expression:e,truthiness:`truthy`,nullishness:`non-nullish`}:b(e,`Literal`)?e.value===null?{expression:e,truthiness:`falsy`,nullishness:`nullish`}:{expression:e,truthiness:e.value?`truthy`:`falsy`,nullishness:`non-nullish`}:b(e,`UnaryExpression`)&&e.operator===`void`?{expression:e,truthiness:`falsy`,nullishness:`nullish`}:{expression:e,truthiness:`unknown`,nullishness:`unknown`},kf=e=>{let t=Ef(e);if(b(t,`ConditionalExpression`)){let e=kf(t.test);return e.every(e=>e.truthiness===`truthy`)?kf(t.consequent):e.every(e=>e.truthiness===`falsy`)?kf(t.alternate):Df([...kf(t.consequent),...kf(t.alternate)])}if(!b(t,`LogicalExpression`))return[Of(t)];let n=kf(t.left),r=kf(t.right),i=[];for(let e of n){if(t.operator===`&&`){e.truthiness!==`truthy`&&i.push(e.truthiness===`falsy`?e:{...e,truthiness:`falsy`}),e.truthiness!==`falsy`&&i.push(...r);continue}if(t.operator===`||`){e.truthiness!==`falsy`&&i.push(e.truthiness===`truthy`?e:{...e,truthiness:`truthy`,nullishness:`non-nullish`}),e.truthiness!==`truthy`&&i.push(...r);continue}e.nullishness!==`nullish`&&i.push(e.nullishness===`non-nullish`?e:{...e,nullishness:`non-nullish`}),e.nullishness!==`non-nullish`&&i.push(...r)}return Df(i)},Af=e=>{let t=[],n=new Set;for(let r of kf(e))n.has(r.expression)||(n.add(r.expression),t.push(r.expression));return t},jf=new Set([`assign`,`defineProperties`,`defineProperty`]),Mf=new Set([`defineProperty`,`set`]),Nf=new WeakMap,Pf=e=>{let t=P(e);for(;t.parent;){let e=t.parent;if(!b(e,`MemberExpression`)||e.object!==t)break;t=P(e)}return t},Z=e=>{let t=e;for(;t;){if(O(t)||b(t,`Program`))return t;t=t.parent}return e},Ff=(e,t)=>{if(b(e,`ReturnStatement`)||b(e,`ThrowStatement`)||b(e,`BreakStatement`)||t&&b(e,`ContinueStatement`))return!0;if(b(e,`BlockStatement`))return e.body.some(e=>Ff(e,t));if(!b(e,`IfStatement`))return!1;if(b(e.test,`Literal`)){let n=e.test.value?e.consequent:e.alternate;return n?Ff(n,t):!1}return!!(e.alternate&&Ff(e.consequent,t)&&Ff(e.alternate,t))},If=e=>Ff(e,!0),Lf=(e,t)=>{let n=t.indexOf(e);return n>0&&t.slice(0,n).some(If)},Rf=(e,t)=>{let n=e;for(;n.parent&&n!==t;){let e=n.parent;if((b(e,`BlockStatement`)||b(e,`Program`))&&Lf(n,e.body)||(b(e,`WhileStatement`)&&b(e.test,`Literal`)&&!e.test.value||b(e,`ForStatement`)&&e.test&&b(e.test,`Literal`)&&!e.test.value)&&e.body===n||b(e,`SwitchCase`)&&Lf(n,e.consequent)||b(e,`IfStatement`)&&b(e.test,`Literal`)&&(e.test.value===!1&&e.consequent===n||e.test.value===!0&&e.alternate===n)||b(e,`ConditionalExpression`)&&b(e.test,`Literal`)&&(e.test.value===!1&&e.consequent===n||e.test.value===!0&&e.alternate===n)||b(e,`LogicalExpression`)&&e.right===n&&b(e.left,`Literal`)&&(e.operator===`&&`&&!e.left.value||e.operator===`||`&&e.left.value))return!0;n=e}return!1},zf=(e,t)=>{let n=e;for(;n.parent&&n!==t;){let e=n.parent;if(b(e,`IfStatement`)&&(!b(e.test,`Literal`)||e.test.value===!0&&e.alternate===n||e.test.value===!1&&e.consequent===n)||b(e,`ConditionalExpression`)&&(!b(e.test,`Literal`)||e.test.value===!0&&e.alternate===n||e.test.value===!1&&e.consequent===n)||b(e,`LogicalExpression`)&&e.right===n&&(!b(e.left,`Literal`)||e.operator===`&&`&&!e.left.value||e.operator===`||`&&e.left.value)||b(e,`DoWhileStatement`)&&!(e.body===n&&b(e.test,`Literal`)&&!e.test.value)||b(e,`ForStatement`)||b(e,`ForInStatement`)||b(e,`ForOfStatement`)&&e.right!==n||b(e,`WhileStatement`)||b(e,`SwitchCase`)||b(e,`CatchClause`)||b(e,`TryStatement`)&&e.block===n||(b(e,`CallExpression`)||b(e,`MemberExpression`))&&e.optional)return!0;n=e}return!1},Bf=(e,t)=>{let n=w(e);if(b(n,`Literal`))return!1;if(b(n,`Identifier`)){if(t.isGlobalReference(n)&&(n.name===`undefined`||n.name===`NaN`||n.name===`Infinity`))return!1;let e=t.symbolFor(n);return e?e.kind===`var`||e.kind===`function`||e.kind===`parameter`||e.kind===`import`?!1:X(e.declarationNode)>X(n):!0}if(b(n,`ArrayExpression`))return n.elements.some(e=>e?b(e,`SpreadElement`)?!0:Bf(e,t):!1);if(b(n,`ObjectExpression`))return n.properties.length>0;if(b(n,`TemplateLiteral`))return n.expressions.length>0;if(b(n,`UnaryExpression`)){let e=w(n.argument);return n.operator===`typeof`&&b(e,`Identifier`)&&!t.symbolFor(e)?!1:Bf(e,t)?!0:n.operator===`void`||n.operator===`typeof`||n.operator===`!`?!1:!(b(e,`Literal`)&&(typeof e.value==`number`||typeof e.value==`string`))}return!0},Vf=(e,t,n)=>{let r=e;for(;r.parent&&r.parent!==t;)r=r.parent;let i=t.body.findIndex(e=>e===r);return r.parent!==t||i<=0?!1:t.body.slice(0,i).some(e=>b(e,`EmptyStatement`)?!1:b(e,`ExpressionStatement`)?Bf(e.expression,n):b(e,`VariableDeclaration`)?e.declarations.some(e=>!b(e.id,`Identifier`)||!!(e.init&&Bf(e.init,n))):!0)},Hf=(e,t)=>b(e,`AwaitExpression`)?Bf(e.argument,t):!1,Uf=(e,t,n)=>{let r=e;for(;r.parent&&r!==t;){let t=r.parent;if(b(t,`IfStatement`)&&(!b(t.test,`Literal`)||t.test.value===!0&&t.alternate===r||t.test.value===!1&&t.consequent===r)||b(t,`ConditionalExpression`)&&(!b(t.test,`Literal`)||t.test.value===!0&&t.alternate===r||t.test.value===!1&&t.consequent===r)||b(t,`LogicalExpression`)&&t.right===r&&(!b(t.left,`Literal`)||t.operator===`&&`&&!t.left.value||t.operator===`||`&&t.left.value)||b(t,`WhileStatement`)&&(!b(t.test,`Literal`)||!t.test.value)||b(t,`ForStatement`)&&t.test&&(!b(t.test,`Literal`)||!t.test.value)||b(t,`ForInStatement`)||b(t,`ForOfStatement`)||b(t,`SwitchCase`)||b(t,`CatchClause`)||b(t,`TryStatement`)&&t.block===r&&b(r,`BlockStatement`)&&(Vf(e,r,n)||Hf(e,n))||(b(t,`CallExpression`)||b(t,`MemberExpression`))&&t.optional)return!0;r=t}return!1},Wf=(e,t)=>{let n=e;for(;n;){if(n===t)return!0;n=n.parent}return!1},Gf=(e,t)=>{let n=e;for(;n.parent&&n!==t;){let e=n.parent;if(b(e,`IfStatement`)&&(!b(e.test,`Literal`)||e.test.value===!0&&e.alternate===n||e.test.value===!1&&e.consequent===n)||b(e,`ConditionalExpression`)&&(!b(e.test,`Literal`)||e.test.value===!0&&e.alternate===n||e.test.value===!1&&e.consequent===n)||b(e,`LogicalExpression`)&&e.right===n&&(!b(e.left,`Literal`)||e.operator===`&&`&&!e.left.value||e.operator===`||`&&e.left.value)||b(e,`ForStatement`)||b(e,`ForInStatement`)||b(e,`ForOfStatement`)||b(e,`WhileStatement`)||b(e,`SwitchCase`)||b(e,`CatchClause`)||b(e,`TryStatement`)&&e.block===n||(b(e,`CallExpression`)||b(e,`MemberExpression`))&&e.optional)return n;n=e}return null},Kf=e=>b(e,`AwaitExpression`)||b(e,`YieldExpression`)?e.argument?Tf(e.argument):Tf(e):b(e,`ForOfStatement`)?Tf(e.right):X(e),qf=(e,t,n)=>{if(X(t)<Kf(e))return!1;let r=Gf(e,n);return!!(r&&Wf(t,r))},Jf=e=>{let t=Nf.get(e);if(t)return t;let n=(t,n,r)=>{let i=w(t);if(!b(i,`MemberExpression`))return!1;let a=w(i.object);return!!(b(a,`Identifier`)&&a.name===n&&e.isGlobalReference(a)&&r.has(C(i)??``))},r=e=>{let t=w(e);if(!b(t,`ObjectExpression`))return null;let n=new Set;for(let e of t.properties){if(!b(e,`Property`))return null;let t=S(e,{allowComputedString:!0});if(t===null)return null;n.add(t)}return n},i=e=>{let t=Pf(e),i=t.parent;if(i){if(b(i,`AssignmentExpression`)&&i.left===t||b(i,`UpdateExpression`)&&i.argument===t||b(i,`UnaryExpression`)&&i.operator===`delete`){if(!b(t,`MemberExpression`))return null;let e=C(t);return e===null?null:new Set([e])}if(!(!b(i,`CallExpression`)||i.arguments[0]!==t)){if(n(i.callee,`Object`,jf)){let e=w(i.callee);if(!b(e,`MemberExpression`))return;let t=C(e);if(t===`assign`){let e=i.arguments.slice(1).map(r);return e.some(e=>e===null)?null:new Set(e.flatMap(e=>[...e??[]]))}if(t===`defineProperties`){let e=i.arguments[1];return e?r(e):null}let n=i.arguments[1];return n&&b(n,`Literal`)&&typeof n.value==`string`?new Set([n.value]):null}if(n(i.callee,`Reflect`,Mf)){let e=i.arguments[1];return e&&b(e,`Literal`)&&typeof e.value==`string`?new Set([e.value]):null}}}},a=e=>{let t=P(e),n=t.parent;if(b(n,`ForOfStatement`)&&n.right===t)return n.await||Ff(n.body,!1);let r=n;if(!b(r,`MemberExpression`)||r.object!==t||C(r)!==`next`)return!1;let i=P(r);return!!(b(i.parent,`CallExpression`)&&i.parent.callee===i)},o=e=>{let t=P(e),n=t.parent;return b(n,`ForOfStatement`)&&!n.await&&n.right===t&&!Ff(n.body,!1)?!0:!!(b(n,`SpreadElement`)&&n.parent&&!b(n.parent,`ObjectExpression`))},s=e=>{let t=P(e),n=t.parent;if(!b(n,`ForOfStatement`)||n.await||n.right!==t||Ff(n.body,!1))return[];let r=Z(n.body),i=new Set;return z(n.body,e=>{if(Z(e)!==r||!b(e,`BreakStatement`))return;let a=e;if(e.label){for(;a?.parent;){let t=a.parent;if(b(t,`LabeledStatement`)&&t.label.name===e.label.name){Wf(n,t.body)&&i.add(t);return}a=t}return}for(;a?.parent;){let e=a.parent;if(b(e,`ForStatement`)||b(e,`ForInStatement`)||b(e,`ForOfStatement`)||b(e,`WhileStatement`)||b(e,`DoWhileStatement`)||b(e,`SwitchStatement`)){b(e,`ForOfStatement`)&&e.right===t&&i.add(e);return}a=e}}),[...i]},c=t=>{let n=w(t.callee),r=null;if(O(n))r=n;else if(b(n,`Identifier`)){let t=F(n,e);if(t?.kind===`function`&&O(t.declarationNode))r=t.declarationNode;else if(t?.kind===`const`&&t.initializer){let e=w(t.initializer);O(e)&&(r=e)}}return r&&O(r)?r:null},l=e=>{let t=c(e);return!t||!O(t)?null:t.generator?a(e)||o(e)?t:null:t},u=[],d=new Map;z(e.rootScope.node,t=>{if(b(t,`CallExpression`)){let e=Z(t),n=l(t);n&&!Rf(t,e)&&u.push({argumentCall:t,call:t,conditionalExitTargets:O(n)&&n.generator?s(t):[],owner:e,targetOwner:n,yieldCount:O(n)&&n.generator&&a(t)?1:null})}if(!b(t,`Identifier`))return;let n=i(t);if(n===void 0)return;let r=F(t,e);if(!r)return;let o=Z(t);if(Rf(t,o))return;let c=d.get(r.id)??[];c.push({node:t,owner:o,propertyNames:n,symbolId:r.id}),d.set(r.id,c)});let f=t=>{let n=Z(t),r=X(t),i=new Set,a=(e,t)=>{for(let n of u)n.owner!==e||X(n.call)>=t||i.has(n.targetOwner)||(i.add(n.targetOwner),a(n.targetOwner,1/0))};return a(n,r),b(n,`Program`)||a(e.rootScope.node,1/0),i},p=e=>{if(b(e,`Program`))return 1/0;let t=u.find(t=>b(t.owner,`Program`)&&t.targetOwner===e);return t?X(t.call):1/0},m=new Map;for(let e of u){let t=m.get(e.owner)??[];t.push(e),m.set(e.owner,t)}let h=new WeakMap,g=(e,t)=>{let n=h.get(e)?.get(t);if(n!==void 0)return n;let r=[e],i=new Set,a=!1;for(;r.length>0;){let e=r.pop();if(!(!e||i.has(e))){if(e===t){a=!0;break}i.add(e);for(let t of m.get(e)??[])r.push(t.targetOwner)}}let o=h.get(e)??new WeakMap;return o.set(t,a),h.set(e,o),a},_=(e,t)=>{let n=new Set,r=e;for(;r?.parent&&r!==t;){let t=r.parent,i=b(t,`DoWhileStatement`)&&b(t.test,`Literal`)&&!t.test.value,a=b(t,`ForStatement`)||b(t,`ForInStatement`)||b(t,`ForOfStatement`)||b(t,`WhileStatement`)||b(t,`DoWhileStatement`)?t.body:null,o=e;for(;a&&b(a,`BlockStatement`)&&o&&o.parent!==a;)o=o.parent??null;let s=a&&b(a,`BlockStatement`)&&o?a.body.findIndex(e=>e===o):-1,c=!!(a&&b(a,`BlockStatement`)&&s>=0&&a.body.slice(s+1).some(e=>Ff(e,!1)));a&&!i&&!c&&n.add(t),r=t}return n},v=(e,t,n)=>{let r=_(e,n);return r.size===0?!1:[..._(t,n)].some(e=>r.has(e))},y=new WeakMap,ee=e=>{let t=y.get(e);if(t)return t;let n=new Map;for(let t of u){if(!g(t.targetOwner,e))continue;let r=n.get(t.owner)??[];r.push(t),n.set(t.owner,r)}return y.set(e,n),n},te=(e,t)=>{let n=ee(e),r=ee(t);for(let[e,t]of n){let n=r.get(e);if(n){for(let r of t)for(let t of n)if(r!==t&&(X(r.call)<X(t.call)||O(e)||v(r.call,t.call,e)))return!0}}return!1},ne=e=>{let t=Z(e);if(b(t,`Program`))return!1;let n=u.filter(e=>b(e.owner,`Program`)&&g(e.targetOwner,t));return n.length===0?!1:n.length!==1||n[0]?.targetOwner!==t},re=e=>{let t=Pf(e.node),n=t.parent;return!!(b(t,`Identifier`)&&n&&(b(n,`AssignmentExpression`)&&n.left===t||b(n,`UpdateExpression`)&&n.argument===t))},ie=(t,n)=>{let r=w(t);if(b(r,`Identifier`)){let t=F(r,e);return t&&n.has(t.id)?n.get(t.id)??!1:null}if(b(r,`SequenceExpression`)){let e=r.expressions.at(-1);return e?ie(e,n):null}if(b(r,`ConditionalExpression`)){let e=ie(r.consequent,n),t=ie(r.alternate,n);return e===null&&t===null?null:e===null||t===null?!0:e||t}if(b(r,`LogicalExpression`)){let e=ie(r.left,n),t=ie(r.right,n);return e===null?t===null?null:!0:r.operator===`&&`?t:e}return null},ae=(e,t)=>{let n=Pf(e.node).parent;if(!n||!b(n,`AssignmentExpression`)){t.delete(e.symbolId);return}let r=t.get(e.symbolId)??!1,i=null;n.operator===`||=`||n.operator===`??=`?i=r:(n.operator===`=`||n.operator===`&&=`)&&(i=ie(n.right,t));let a=zf(e.node,e.owner);i===null?a?t.set(e.symbolId,!0):t.delete(e.symbolId):t.set(e.symbolId,a&&r||i)},oe=(t,n)=>{if(!O(t.targetOwner))return n;let r=new Map(n);for(let[i,a]of t.targetOwner.params.entries()){let o=b(a,`AssignmentPattern`)?a.left:a;if(!b(o,`Identifier`))continue;let s=t.argumentCall.arguments[i],c=s&&!b(s,`SpreadElement`)?w(s):null,l=null;if(b(a,`AssignmentPattern`)&&(!c||b(c,`Identifier`)&&c.name===`undefined`&&e.isGlobalReference(c)||b(c,`UnaryExpression`)&&c.operator===`void`)&&b(a,`AssignmentPattern`)?l=w(a.right):c&&(l=c),!b(l,`Identifier`))continue;let u=F(l,e);if(!u||!n.has(u.id))continue;let d=e.symbolFor(o);d&&r.set(d.id,n.get(u.id)??!1)}return r},se=(t,n)=>{if(!O(t.targetOwner))return{conditionalSuspensions:[],conditionalStartIndex:1/0,cutoffIndex:1/0};let r=new Set;t.targetOwner.async&&(r.add(`AwaitExpression`),r.add(`ForOfStatement`));let i=t.conditionalExitTargets.some(e=>!n||!Wf(n,e));(t.yieldCount!==null||i)&&r.add(`YieldExpression`);let a=[],o=1/0,s=1/0,c=0;return z(t.targetOwner.body,n=>{if(Z(n)!==t.targetOwner||Rf(n,t.targetOwner)||!(r.has(n.type)&&(!b(n,`ForOfStatement`)||n.await)))return;let l=b(n,`YieldExpression`)&&n.argument?w(n.argument):null;if(b(n,`YieldExpression`)&&n.delegate&&l&&(b(l,`ArrayExpression`)&&l.elements.length===0||b(l,`Literal`)&&l.value===``))return;let u=Kf(n);if(b(n,`YieldExpression`)){if(c+=1,i&&c>=1){o=Math.min(o,u);return}if(t.yieldCount===null||c>t.yieldCount)return}Uf(n,t.targetOwner,e)?(a.push(n),o=Math.min(o,u)):s=Math.min(s,u)}),{conditionalSuspensions:a,conditionalStartIndex:Math.min(o,s),cutoffIndex:s}},ce=(e,t,n)=>{let r=(e,t,i)=>{if(t.has(e.targetOwner))return!1;let a=new Set(t);a.add(e.targetOwner);let o=new Map(oe(e,i)),s=se(e),c=[...[...o.keys()].flatMap(e=>d.get(e)??[]).filter(t=>t.owner===e.targetOwner).map(e=>({event:e,index:X(e.node)})),...u.filter(t=>t.owner===e.targetOwner).map(e=>({call:e,index:X(e.call)}))].sort((e,t)=>e.index-t.index);for(let t of c){if(t.index>=s.cutoffIndex)break;let i=`event`in t?t.event.node:t.call.call;if(!s.conditionalSuspensions.some(t=>qf(t,i,e.targetOwner))){if(`event`in t){if(!o.has(t.event.symbolId))continue;if(re(t.event)){ae(t.event,o);continue}if(n===null||t.event.propertyNames===null||t.event.propertyNames.has(n))return!0;continue}if(r(t.call,a,o))return!0}}return!1};return r(e,new Set,t)},le={getMutationPropertyNames:i,getEventsBefore:(t,n)=>{let r=[],i=(e,t,a,o,s,c,l)=>{if(s.has(e))return;let f=new Set(s);f.add(e);let p=new Map(l),m=[...[...p.keys()].flatMap(e=>d.get(e)??[]).filter(t=>t.owner===e).map(e=>({event:e,index:X(e.node)})),...u.filter(t=>t.owner===e).map(e=>({call:e,index:X(e.call)}))].sort((e,t)=>e.index-t.index);for(let s of m){if(s.index>=t)break;let l=`event`in s?s.event.node:s.call.call;if(o.some(t=>qf(t,l,e)))continue;if(`event`in s){if(!p.has(s.event.symbolId))continue;let e=!!(c||p.get(s.event.symbolId)||zf(s.event.node,s.event.owner)||s.index>a);if(re(s.event)){ae(s.event,p);continue}r.push({isConditional:e,node:s.event.node});continue}let u=se(s.call,n);i(s.call.targetOwner,u.cutoffIndex,u.conditionalStartIndex,u.conditionalSuspensions,f,c||zf(s.call.call,s.call.owner)||s.index>a,oe(s.call,p))}},a=Z(n),o=new Map([[t.id,!1]]);return b(a,`Program`)||i(e.rootScope.node,p(a),1/0,[],new Set,!1,o),i(a,X(n),1/0,[],new Set,!1,o),r},getOutermostTarget:Pf,isGlobalNamespaceMethod:n,isExecutionOrderAmbiguous:ne,isMutationOrderAmbiguous:(e,t,n)=>{let r=Z(t),i=X(t);if((d.get(e.id)??[]).some(e=>n!==null&&e.propertyNames!==null&&!e.propertyNames.has(n)?!1:e.owner===r?X(e.node)>=i&&(O(r)||v(e.node,t,r)):b(e.owner,`Program`)?(ee(r).get(e.owner)??[]).some(t=>v(e.node,t.call,e.owner)):g(e.owner,r)||te(e.owner,r)))return!0;let a=new Map([[e.id,!1]]);return u.some(e=>e.owner===r&&X(e.call)>=i&&v(e.call,t,r)&&ce(e,a,n))},isMutatedBefore:(e,t,n)=>{let r=d.get(e.id);if(!r)return!1;let i=X(t),a=Z(t),o=f(t);return r.some(e=>n!==null&&e.propertyNames!==null&&!e.propertyNames.has(n)?!1:e.owner===a?X(e.node)<i:b(e.owner,`Program`)&&!b(a,`Program`)?X(e.node)<p(a):o.has(e.owner))}};return Nf.set(e,le),le},Yf=(e,t)=>t===`katex`?e===`katex`||e.startsWith(`katex/`):e===t,Xf=(e,t,n)=>{let r=w(e);if(!b(r,`CallExpression`))return!1;let i=w(r.callee),a=r.arguments[0];return!!(b(i,`Identifier`)&&i.name===`require`&&n.isGlobalReference(i)&&a&&b(a,`Literal`)&&typeof a.value==`string`&&Yf(a.value,t))},Zf=(e,t)=>{if(e.kind!==`ts-import-equals`)return!1;let n=e.declarationNode;if(!b(n,`TSImportEqualsDeclaration`))return!1;let r=n.moduleReference;return!!(b(r,`TSExternalModuleReference`)&&b(r.expression,`Literal`)&&typeof r.expression.value==`string`&&Yf(r.expression.value,t))},Qf=(e,t)=>{let n=w(e);return!!(b(n,`AwaitExpression`)&&b(n.argument,`ImportExpression`)&&b(n.argument.source,`Literal`)&&typeof n.argument.source.value==`string`&&Yf(n.argument.source.value,t))},$f=(e,t,n,r,i)=>{let a=F(w(e),i),o=Jf(i);if(!a||o.isExecutionOrderAmbiguous(r)||o.isMutationOrderAmbiguous(a,r,n)||o.isMutatedBefore(a,r,n))return null;let s=ve(a);if(typeof s?.source.value==`string`&&Yf(s.source.value,t))return b(a.declarationNode,`ImportDefaultSpecifier`)||b(a.declarationNode,`ImportNamespaceSpecifier`)||x(a.declarationNode)===`default`?a:null;if(Zf(a,t))return a;if(a.kind!==`const`||!a.initializer)return null;let c=w(a.initializer);return Xf(c,t,i)||b(c,`MemberExpression`)&&C(c)===`default`&&(Xf(c.object,t,i)||Qf(c.object,t))||Qf(c,t)?a:null},ep=(e,t,n,r,i)=>{let a=F(w(e),i);if(!a)return null;let o=ve(a),s=Jf(i);return typeof o?.source.value!=`string`||!Yf(o.source.value,t)||x(a.declarationNode)!==n||s.isExecutionOrderAmbiguous(r)||s.isMutationOrderAmbiguous(a,r,null)||s.isMutatedBefore(a,r,null)?null:a},tp=(e,t,n)=>$f(e,`katex`,`renderToString`,t,n)!==null||Xf(e,`katex`,n),np=(e,t,n)=>{if(ep(e,`katex`,`renderToString`,t,n))return!0;let r=w(e);if(!b(r,`Identifier`))return!1;let i=n.referenceFor(r)?.resolvedSymbol;if(!i||i.kind!==`const`||!i.initializer||Jf(n).isMutatedBefore(i,t,null))return!1;let a=w(i.initializer),o=i.bindingIdentifier.parent;return b(o,`Property`)&&S(o,{allowComputedString:!0})===`renderToString`?tp(a,i.declarationNode,n):b(a,`MemberExpression`)&&C(a)===`renderToString`&&tp(a.object,i.declarationNode,n)?!0:b(a,`Identifier`)?np(a,i.declarationNode,n):!1},rp=(e,t)=>{let n=w(e);if(b(n,`Identifier`)){if(!/katex/i.test(n.name))return!1;let e=t.referenceFor(n)?.resolvedSymbol;return!!(e&&e.kind!==`parameter`&&e.kind!==`let`)}if(!b(n,`MemberExpression`)||C(n)!==`renderToString`)return!1;let r=w(n.object);if(!b(r,`Identifier`)||!/katex/i.test(r.name))return!1;let i=t.referenceFor(r)?.resolvedSymbol;if(!i)return!1;if(i.kind===`import`){if(!Yf(String(ve(i)?.source.value??``),`katex`))return!0;let e=Jf(t);return e.isExecutionOrderAmbiguous(n)||e.isMutationOrderAmbiguous(i,n,`renderToString`)?!1:e.isMutatedBefore(i,n,`renderToString`)}if(i.kind===`parameter`||i.kind===`let`||i.kind===`var`)return!0;if(i.kind!==`const`||!i.initializer)return!1;let a=w(i.initializer);if(b(a,`ObjectExpression`))return!0;if(b(a,`CallExpression`)){let e=w(a.callee);return b(e,`Identifier`)&&e.name===`require`}return b(a,`AwaitExpression`)&&b(a.argument,`ImportExpression`)},ip=(e,t)=>{let n=w(e);if(!b(n,`ObjectExpression`))return null;let r;for(let e of n.properties){if(!b(e,`Property`)){r=null;continue}let n=S(e,{allowComputedString:!0});if(n===null){r=null;continue}n===t&&(r=e.kind===`init`?e.value:null)}return r},ap=e=>{let t=w(e);if(!b(t,`ObjectExpression`))return null;for(let e of t.properties){if(!b(e,`Property`))return null;let t=S(e,{allowComputedString:!0});if(t===null||t===`get`||t===`set`)return null}return ip(t,`value`)},op=new WeakMap,sp=(e,t)=>{let n=w(e);return b(n,`Identifier`)?n.name===`undefined`&&t.isGlobalReference(n):b(n,`Literal`)&&!n.value},cp=(e,t,n)=>{let r=ap(t);return r===null?`trusted`:r===void 0?e:sp(r,n)?`untrusted`:`trusted`},lp=(e,t)=>e===t?e:e===`trusted`||t===`trusted`?`trusted`:e===`unsupported`||t===`unsupported`?`unsupported`:`untrusted`,up=(e,t,n,r)=>{let i=Jf(n),a=i.getOutermostTarget(t),o=a.parent;if(!o)return`unsupported`;if(b(o,`AssignmentExpression`)&&o.left===a){if(!b(a,`MemberExpression`))return`unsupported`;let t=C(a);return t===null?`trusted`:t===`trust`?sp(o.right,n)?`untrusted`:`trusted`:e}if(b(o,`UnaryExpression`)&&o.operator===`delete`){if(!b(a,`MemberExpression`))return`unsupported`;let t=C(a);return t===null?`trusted`:t===`trust`?`absent`:e}if(b(o,`UpdateExpression`)){if(!b(a,`MemberExpression`))return`unsupported`;let t=C(a);return t===`trust`||t===null?`trusted`:e}if(!b(o,`CallExpression`)||o.arguments[0]!==a)return`unsupported`;if(i.isGlobalNamespaceMethod(o.callee,`Object`,jf)){let t=w(o.callee);if(!b(t,`MemberExpression`))return`unsupported`;let i=C(t);if(i===`assign`){let t=e;for(let e of o.arguments.slice(1)){let i=dp(e,e,n,new Set(r));i!==`absent`&&(t=i)}return t}if(i===`defineProperties`){let t=o.arguments[1];if(!t)return`unsupported`;let r=ip(t,`trust`);return r===null?`trusted`:r===void 0?e:cp(e,r,n)}let a=o.arguments[1];if(!a||!b(a,`Literal`)||typeof a.value!=`string`)return`trusted`;if(a.value!==`trust`)return e;let s=o.arguments[2];return s?cp(e,s,n):`unsupported`}if(i.isGlobalNamespaceMethod(o.callee,`Reflect`,Mf)){let t=w(o.callee);if(!b(t,`MemberExpression`))return`unsupported`;let r=C(t),i=o.arguments[1];if(!i||!b(i,`Literal`)||typeof i.value!=`string`)return`trusted`;if(i.value!==`trust`)return e;let a=o.arguments[2];return a?r===`defineProperty`?cp(e,a,n):sp(a,n)?`untrusted`:`trusted`:`unsupported`}return`unsupported`},dp=(e,t,n,r)=>{if(e===void 0)return`absent`;let i=w(e);if(b(i,`Identifier`)){if(i.name===`undefined`&&n.isGlobalReference(i))return`absent`;let e=F(i,n);if(!e||e.kind!==`const`||!e.initializer||r.has(e.id))return`unsupported`;let a=new Set(r);a.add(e.id);let o=Jf(n);if(o.isMutationOrderAmbiguous(e,t,`trust`))return`unsupported`;let s=dp(e.initializer,t,n,a);for(let r of o.getEventsBefore(e,t)){let e=up(s,r.node,n,a);s=r.isConditional?lp(s,e):e}return s}if(!b(i,`ObjectExpression`))return`unsupported`;let a=`absent`;for(let e of i.properties){if(b(e,`SpreadElement`)){let t=dp(e.argument,e.argument,n,new Set(r));t!==`absent`&&(a=t===`unsupported`?`trusted`:t);continue}if(!b(e,`Property`)){a=`trusted`;continue}let t=S(e,{allowComputedString:!0});if(t===null){a=`trusted`;continue}t===`trust`&&(a=sp(e.value,n)?`untrusted`:`trusted`)}return a},fp=(e,t,n)=>{let r=op.get(e),i=new Map(r);for(let[e,n]of t)i.set(e,n);op.set(e,i);try{return n()}finally{r?op.set(e,r):op.delete(e)}},pp=(e,t,n,r)=>{let i=e?w(e):void 0;if(i&&b(i,`Identifier`)){let e=n.referenceFor(i)?.resolvedSymbol,t=e?op.get(n)?.get(e.id):void 0;if(t)return t}let a=dp(e,t,n,r);return{isSafe:a===`absent`||a===`untrusted`}},mp={containsKatex:!1,isConclusive:!0,isSafe:!0,isSafeInAttributeContext:!0},hp={containsKatex:!1,isConclusive:!0,isSafe:!0,isSafeInAttributeContext:!1},Q={containsKatex:!1,isConclusive:!1,isSafe:!1,isSafeInAttributeContext:!1},gp={containsKatex:!0,isConclusive:!1,isSafe:!1,isSafeInAttributeContext:!1},_p={containsKatex:!0,isConclusive:!0,isSafe:!1,isSafeInAttributeContext:!1},vp=new WeakMap,yp=new WeakMap,bp=(e,t,n)=>{vp.set(e,t),yp.set(e,n)},xp=e=>({containsKatex:e.some(e=>e.containsKatex),isConclusive:e.every(e=>e.isSafe)?e.filter(e=>e.containsKatex).every(e=>e.isConclusive):e.some(e=>e.containsKatex&&e.isConclusive&&!e.isSafe)||e.some(e=>e.containsKatex&&e.isConclusive)&&e.some(e=>!e.containsKatex&&!e.isSafe),isSafe:e.every(e=>e.isSafe),isSafeInAttributeContext:e.every(e=>e.isSafeInAttributeContext)}),Sp=(e,t)=>{let n=w(e);if(!b(n,`ObjectExpression`))return{isKnown:!1,value:null};let r=!0,i=null;for(let e of n.properties){if(!b(e,`Property`)){r=!1,i=null;continue}let n=S(e,{allowComputedString:!0});n===null?(r=!1,i=null):n===t&&(r=!0,i=e.value)}return{isKnown:r,value:i}},Cp=(e,t)=>{let n=w(e);if(b(n,`Identifier`)){let e=F(n,t);return!!(e&&e.kind===`import`&&ve(e)?.source.value===`react`&&x(e.declarationNode)===`useMemo`)}if(!b(n,`MemberExpression`)||C(n)!==`useMemo`)return!1;let r=F(w(n.object),t);return!!(r&&r.kind===`import`&&ve(r)?.source.value===`react`&&(b(r.declarationNode,`ImportDefaultSpecifier`)||b(r.declarationNode,`ImportNamespaceSpecifier`)||x(r.declarationNode)===`default`))},wp=(e,t)=>{let n=e=>{let r=w(e);if(b(r,`Identifier`)){let e=F(r,t);return!e||e.kind!==`const`||!e.initializer||e.references.some(e=>e.flag!==`read`)?null:n(e.initializer)}return!b(r,`Literal`)||!(`regex`in r)||!r.regex?null:r.regex},r=e=>{let t=w(e);if(!O(t))return null;if(!b(t.body,`BlockStatement`))return t.body;if(t.body.body.length!==1)return null;let n=t.body.body[0];return n&&b(n,`ReturnStatement`)?n.argument:null},i=e=>{let n=w(e);if(!O(n)||n.params.length!==1)return!1;let i=n.params[0],a=r(n);if(!i||!b(i,`Identifier`)||!a||!b(a,`MemberExpression`)||!a.computed||!b(w(a.property),`Identifier`))return!1;let o=w(a.property);if(t.referenceFor(o)?.resolvedSymbol!==t.symbolFor(i)||!b(w(a.object),`Identifier`))return!1;let s=F(w(a.object),t);if(!s||s.kind!==`const`||!s.initializer||s.references.some(e=>e.flag!==`read`))return!1;let c=Sp(s.initializer,`<`);if(!c.isKnown||!c.value||!b(w(c.value),`Literal`))return!1;let l=w(c.value);return b(l,`Literal`)?typeof l.value==`string`&&!l.value.includes(`<`)&&!l.value.includes(`$`):!1},a=w(e),o=!1;for(;b(a,`CallExpression`);){let e=w(a.callee);if(!b(e,`MemberExpression`))return!1;let t=C(e);if(t!==`replace`&&t!==`replaceAll`)return!1;let r=a.arguments[0],s=a.arguments[1];if(!r||!s||!(b(s,`Literal`)&&typeof s.value==`string`&&!s.value.includes(`<`)&&!s.value.includes(`$`))&&!i(s))return!1;let c=n(r),l=t===`replaceAll`&&b(r,`Literal`)&&r.value===`<`,u=!!c?.flags.includes(`g`)&&(c?.pattern===`<`||/^\[[^\]]*<[^\]]*\]$/.test(c?.pattern??``));(l||u)&&(o=!0),a=w(e.object)}return!o||!b(a,`Identifier`)?!1:t.referenceFor(a)?.resolvedSymbol?.kind===`parameter`},Tp=(e,t)=>{let n=w(e.callee);return b(n,`MemberExpression`)&&C(n)===`sanitize`&&($f(n.object,`dompurify`,`sanitize`,e,t)||$f(n.object,`isomorphic-dompurify`,`sanitize`,e,t))?hp:b(n,`MemberExpression`)&&C(n)===`escape`&&$f(n.object,`html-escaper`,`escape`,e,t)||ep(n,`html-escaper`,`escape`,e,t)?mp:ep(n,`dompurify`,`sanitize`,e,t)||ep(n,`isomorphic-dompurify`,`sanitize`,e,t)?hp:null},Ep=(e,t)=>{if(!t.isSafe)return null;let n=w(e.callee);if(!b(n,`MemberExpression`))return null;let r=C(n);if((r===`trim`||r===`trimEnd`||r===`trimStart`)&&e.arguments.length===0)return t;if(r!==`replace`&&r!==`replaceAll`)return null;let i=e.arguments[1];return!i||!b(i,`Literal`)||typeof i.value!=`string`||i.value.includes(`<`)?null:{containsKatex:t.containsKatex,isConclusive:t.isConclusive,isSafe:!0,isSafeInAttributeContext:t.isSafeInAttributeContext&&!/[&>"']/.test(i.value)}},Dp=e=>{let t=e.toLowerCase();for(let e of[`script`,`style`,`textarea`,`title`])if(t.lastIndexOf(`<${e}`)>t.lastIndexOf(`</${e}`))return`raw-text`;let n=e.lastIndexOf(`<`);if(n<=e.lastIndexOf(`>`))return`text`;let r=e.slice(n+1),i=null;for(let e=0;e<r.length;e+=1){let t=r[e];(t===`"`||t===`'`)&&r[e-1]!==`\\`&&(i===t?i=null:i===null&&(i=t))}return i===null?`unsafe-tag`:`attribute`},Op=(e,t,n,r)=>{let i=e.expressions.map(e=>$(e,t,new Set(n),r)),a=``,o=!0;for(let t=0;t<i.length;t+=1){a+=e.quasis[t]?.value.raw??``;let n=Dp(a),r=i[t]??Q;n===`text`?o&&=r.isSafe:n===`attribute`?o&&=r.isSafeInAttributeContext:o=!1}return{containsKatex:i.some(e=>e.containsKatex),isConclusive:o?i.filter(e=>e.containsKatex).every(e=>e.isConclusive):i.some(e=>e.containsKatex&&e.isConclusive&&!e.isSafe)||i.some(e=>e.containsKatex&&e.isConclusive)&&i.some(e=>!e.containsKatex&&!e.isSafe),isSafe:o,isSafeInAttributeContext:!1}},kp=(e,t)=>{let n=e;for(;n.parent&&n!==t;){let e=n.parent;if(b(e,`BlockStatement`)){let t=e.body.findIndex(e=>e===n);if(t>0&&e.body.slice(0,t).some(e=>B(e)))return!0}if(b(e,`SwitchCase`)){let t=e.consequent.findIndex(e=>e===n);if(t>0&&e.consequent.slice(0,t).some(e=>B(e)))return!0}if(b(e,`IfStatement`)&&b(e.test,`Literal`)){let t=e.alternate,r=e.consequent,i=!!e.test.value;if(!i&&r===n||i&&t===n)return!0}if(b(e,`WhileStatement`)&&e.body===n){let t=e.test;if(b(t,`Literal`)&&!t.value)return!0}if(b(e,`ForStatement`)&&e.body===n){let t=e.test;if(t&&b(t,`Literal`)&&!t.value)return!0}n=e}return!1},Ap=(e,t,n,r=new Map)=>{if(!O(e))return Q;if(!b(e.body,`BlockStatement`))return $(e.body,t,n,r);let i=e.body,a=[];return z(i,e=>{if(e!==i&&O(e))return!1;if(b(e,`ReturnStatement`))return kp(e,i)||a.push(e.argument?$(e.argument,t,new Set(n),r):mp),!1}),a.length===0?mp:xp(a)},jp=(e,t,n,r,i=new Map)=>{if(!O(e))return Q;let a=[];if(!b(e.body,`BlockStatement`))a.push(e.body);else{let t=e.body;z(t,e=>{if(e!==t&&O(e))return!1;b(e,`ReturnStatement`)&&e.argument&&!kp(e,t)&&a.push(e.argument)})}return a.length===0?Q:xp(a.map(e=>{let a=Sp(e,t);if(a.isKnown&&a.value!==null)return $(a.value,n,new Set(r),i);let o=w(e);return b(o,`CallExpression`)?Pp(o,n,t)??Q:Q}))},Mp=(e,t)=>{let n=w(e);if(!b(n,`Identifier`))return null;let r=F(n,t);if(!r||r.references.some(e=>e.flag!==`read`))return null;if(r.kind===`function`&&O(r.declarationNode))return{functionNode:r.declarationNode,symbol:r};if(r.kind!==`const`||!r.initializer)return null;let i=w(r.initializer);return O(i)?{functionNode:i,symbol:r}:null},Np=(e,t,n,r)=>{let i=new Map;if(!O(e))return i;let a=(e,t)=>e===void 0||b(e,`Identifier`)&&e.name===`undefined`&&t.isGlobalReference(e)||b(e,`UnaryExpression`)&&e.operator===`void`,o=(e,t,n,a)=>a?fp(r,i,()=>pp(e,t,n,new Set)):pp(e,t,n,new Set);for(let[s,c]of e.params.entries()){let e=t.arguments[s],l=b(c,`AssignmentPattern`)&&a(e,n),u=l&&b(c,`AssignmentPattern`)?c.right:e,d=l?r:n,f=l?c:t,p=b(c,`AssignmentPattern`)?c.left:c;if(b(p,`Identifier`)){let e=r.symbolFor(p);if(!e||e.references.some(e=>e.flag!==`read`))continue;i.set(e.id,o(u,f,d,l));continue}if(!(!b(p,`ObjectPattern`)||!u))for(let e of p.properties){if(!b(e,`Property`))continue;let t=S(e,{allowComputedString:!0});if(t===null)continue;let n=Sp(u,t),s=b(e.value,`AssignmentPattern`)?e.value.left:e.value;if(!b(s,`Identifier`))continue;let c=r.symbolFor(s);if(!n.isKnown||!c||c.references.some(e=>e.flag!==`read`))continue;let l=b(e.value,`AssignmentPattern`)&&(n.value===null||a(n.value??void 0,d)),p=l&&b(e.value,`AssignmentPattern`)?e.value.right:n.value??void 0,m=l?r:d,h=l?e:f;i.set(c.id,o(p,h,m,l))}}return i},Pp=(e,t,n)=>{let r=w(e.callee);if(!b(r,`Identifier`))return null;let i=F(r,t);if(!i||i.kind!==`import`)return null;let a=ve(i),o=x(i.declarationNode),s=vp.get(t),c=a?.source.value,l=yp.get(t)??0;if(!s||typeof c!=`string`||!o||l>=2)return null;let u=lr(s,c,o);if(!u||!O(u.functionNode))return null;let d=A(u.programNode);return bp(d,u.filePath,l+1),fp(d,Np(u.functionNode,e,t,d),()=>n?jp(u.functionNode,n,d,new Set):Ap(u.functionNode,d,new Set))},Fp=(e,t,n,r)=>{if(!b(e,`CallExpression`))return Q;let i=w(e.callee);if(b(i,`MemberExpression`)&&C(i)===`get`){let e=w(i.object);if(b(e,`Identifier`)){let i=F(e,t),a=i?.initializer?w(i.initializer):null,o=a&&b(a,`NewExpression`)?w(a.callee):null;if(i?.kind===`const`&&a&&b(a,`NewExpression`)&&b(o,`Identifier`)&&o.name===`Map`&&t.isGlobalReference(o)&&!n.has(i.id)){let e=new Set(n);e.add(i.id);let a=[],o=!1;for(let n of i.references){let i=n.identifier.parent;if(n.flag!==`read`||!i||!b(i,`MemberExpression`)||i.object!==n.identifier){o=!0;break}let s=C(i);if(s===`size`)continue;let c=i.parent;if(!c||!b(c,`CallExpression`)||c.callee!==i){o=!0;break}if(![`get`,`has`,`keys`,`values`,`entries`,`clear`,`delete`].includes(s??``)){if(s!==`set`||!c.arguments[1]){o=!0;break}a.push($(c.arguments[1],t,new Set(e),r))}}if(!o&&a.length>0)return xp(a)}}}if(b(i,`MemberExpression`)&&C(i)===`renderToString`&&tp(i.object,e,t)||np(i,e,t))return{containsKatex:!0,isConclusive:!0,isSafe:pp(e.arguments[1],e,t,new Set).isSafe,isSafeInAttributeContext:!1};let a=Pp(e,t);if(a?.containsKatex)return a;let o=Mp(i,t);if(o&&!n.has(o.symbol.id)){let i=new Set(n);i.add(o.symbol.id);let a=e.arguments.map(e=>{let i=w(e);return O(i)?Ap(i,t,new Set(n),r):$(i,t,new Set(n),r)}),s=new Map,c=!1;if(O(o.functionNode))for(let[e,n]of o.functionNode.params.entries()){if(!b(n,`Identifier`))continue;let r=t.symbolFor(n),i=a[e],o=r?.references.every(e=>e.flag===`read`);r&&i&&o&&s.set(r.id,i),i?.containsKatex&&r&&!o&&(c=!0)}let l=fp(t,Np(o.functionNode,e,t,t),()=>Ap(o.functionNode,t,i,s));return!a.some(e=>e.containsKatex)||l.containsKatex?l:c?gp:_p}if(rp(i,t))return{containsKatex:!0,isConclusive:!0,isSafe:!1,isSafeInAttributeContext:!1};if(b(i,`MemberExpression`)){let a=$(i.object,t,new Set(n),r);if(a.containsKatex)return Ep(e,a)||(a.isConclusive?{containsKatex:!0,isConclusive:!0,isSafe:!1,isSafeInAttributeContext:!1}:gp)}let s=Tp(e,t);if(s)return s;if(wp(e,t))return hp;if(Cp(i,t)){let i=e.arguments[0];if(!i)return Q;let a=w(i);if(O(a))return Ap(a,t,new Set(n),r);let o=Mp(a,t);if(!o||n.has(o.symbol.id))return Q;let s=new Set(n);return s.add(o.symbol.id),Ap(o.functionNode,t,s,r)}return e.arguments.some(e=>{let i=w(e);return(O(i)?Ap(i,t,new Set(n),r):$(i,t,new Set(n),r)).containsKatex})?gp:Q},Ip=(e,t)=>{let n=Ef(e);if(b(n,`Literal`))return!!n.value;if(b(n,`Identifier`)&&(n.name===`undefined`||n.name===`NaN`)&&t.isGlobalReference(n))return!1;if(b(n,`TemplateLiteral`)){let e=Gt(n);return e===null?null:!!e}if(b(n,`ArrayExpression`)||b(n,`ObjectExpression`)||b(n,`ArrowFunctionExpression`)||b(n,`FunctionExpression`)||b(n,`ClassExpression`)||b(n,`NewExpression`)||b(n,`JSXElement`)||b(n,`JSXFragment`))return!0;if(b(n,`UnaryExpression`)){if(n.operator===`void`)return!1;if(n.operator===`typeof`)return!0;if(n.operator===`!`){let e=Ip(n.argument,t);return e===null?null:!e}}return null},$=(e,t,n,r=new Map)=>{let i=w(e);if(b(i,`Literal`)||b(i,`UnaryExpression`)&&i.operator===`void`)return mp;if(b(i,`Identifier`)){if((i.name===`undefined`||i.name===`NaN`)&&t.isGlobalReference(i))return mp;let e=t.referenceFor(i)?.resolvedSymbol,a=e?r.get(e.id):void 0;if(a)return a;if(!e||n.has(e.id))return Q;let o=new Set(n);if(o.add(e.id),e.kind===`let`||e.kind===`var`){let n=[];e.initializer&&n.push(e.initializer);for(let t of e.references){if(t.flag===`read`)continue;let e=wo(t.identifier);if(!e)return Q;n.push(e)}return n.length===0?Q:xp(n.map(e=>$(e,t,new Set(o),r)))}return e.kind!==`const`||!e.initializer?Q:$(e.initializer,t,o,r)}if(b(i,`CallExpression`))return Fp(i,t,n,r);if(b(i,`MemberExpression`)){let e=C(i),a=w(i.object);if(e&&b(a,`Identifier`)){let i=t.referenceFor(a)?.resolvedSymbol,o=i?.initializer?w(i.initializer):null;if(i?.kind===`const`&&o&&b(o,`CallExpression`)){if(Cp(o.callee,t)){let i=o.arguments[0],a=i?w(i):null;if(a&&O(a)){let i=jp(a,e,t,new Set(n),r);if(i.containsKatex)return i}}let i=Pp(o,t,e);if(i?.containsKatex)return i}}return Q}if(b(i,`TemplateLiteral`))return Op(i,t,n,r);if(b(i,`ConditionalExpression`)){let e=Ip(i.test,t);return e===null?xp([$(i.consequent,t,new Set(n),r),$(i.alternate,t,new Set(n),r)]):$(e?i.consequent:i.alternate,t,new Set(n),r)}if(b(i,`LogicalExpression`)){let e=i.operator===`??`?null:Ip(i.left,t);if(e!==null)return $(i.operator===`&&`?e?i.right:i.left:e?i.left:i.right,t,new Set(n),r);let a=Af(i);if(a.length===1)return $(a[0]??i,t,new Set(n),r);let o=[i.left,i.right].map(e=>$(e,t,new Set(n),r));return{...i.operator===`&&`?o[1]??Q:xp(a.map(e=>$(e,t,new Set(n),r))),containsKatex:o.some(e=>e.containsKatex)}}if(b(i,`BinaryExpression`)&&i.operator===`+`)return xp([$(i.left,t,new Set(n),r),$(i.right,t,new Set(n),r)]);if(b(i,`SequenceExpression`)){let e=i.expressions.at(-1);return e?$(e,t,n,r):Q}return Q},Lp=e=>{let t=null;if(b(e,`JSXAttribute`)&&b(e.name,`JSXIdentifier`)&&e.name.name===`dangerouslySetInnerHTML`&&b(e.value,`JSXExpressionContainer`)&&b(e.value.expression,`ObjectExpression`)&&(t=e.value.expression),b(e,`Property`)&&S(e,{allowComputedString:!0})===`dangerouslySetInnerHTML`&&b(w(e.value),`ObjectExpression`)&&(t=w(e.value)),!b(t,`ObjectExpression`))return null;let n=null;for(let e of t.properties){if(b(e,`SpreadElement`)){n=null;continue}if(!b(e,`Property`)){n=null;continue}let t=S(e,{allowComputedString:!0});if(t===null){n=null;continue}t===`__html`&&(n=e.value)}return n},Rp=(e,t)=>{let n=_n({filename:t,sourceText:e});if(n===null)return[];let r=A(n);bp(r,t,0);let i=[];return z(n,e=>{let t=Lp(e);if(t===null)return;let n=$(t,r,new Set);if(!n.containsKatex)return;let a=X(e),o=Tf(e);a<0||o<0||i.push({endIndex:o,proof:n,startIndex:a})}),i},zp=/dangerouslySetInnerHTML|(?:\.(?:inner|outer)HTML|\[\s*["'](?:inner|outer)HTML["']\s*\])\s*[+]?=(?!=)|\.insertAdjacentHTML\s*\(|\bdocument\.write(?:ln)?\s*\(|\.(?:createContextualFragment|setHTMLUnsafe)\s*\(/,Bp=/(?:__html\s*:|(?:\.(?:inner|outer)HTML|\[\s*["'](?:inner|outer)HTML["']\s*\])\s*[+]?=(?!=)|\.insertAdjacentHTML\s*\(\s*[^,]*,|\bdocument\.write(?:ln)?\s*\(|\.(?:createContextualFragment|setHTMLUnsafe)\s*\()\s*([\s\S]*)/,Vp=/searchParams|query|params|request|req\.|response\.|await|fetch|props\.|children|(?:user|untrusted|unsafe|raw|comment|message|cms|remote|external)\.|(?:user|untrusted|unsafe|raw|comment|message|cms|remote|external|content|profile|signature|subtitle)\w*(?:html|markup)|(?:html|markup)\w*(?:input|payload)|\b(?:load|read|receive|decode)\w*\s*\(|\bget\w*(?:Html|Markup|Content|Page|Message)\b|\blocation\b|document\.cookie|\breferrer\b|\blocalStorage\b|\bsessionStorage\b|URLSearchParams|window\.name/i,Hp=/^(?:"(?:\\.|[^"\\\n])*"|'(?:\\.|[^'\\\n])*'|`[^`$]*`)\s*(?:\/\/[^\n]*)?\s*(?:[;,})\n]|$)/,Up=/^[A-Z][A-Z0-9_]*\s*(?:\/\/[^\n]*)?\s*(?:[;,})\n]|$)/,Wp=/^[\w$]+(?:\??\.[\w$]+)*\??\.(?:inner|outer)HTML\b/,Gp=/\b(?:DOMPurify|sanitize\w*|purify|(?:escape|encode)[A-Za-z]*(?:Html|HTML|Entit\w*)|insane|xss)\b|(?<!un)safe|(?<!un)saniti[sz]/i,Kp=/[:=]\s*[^\n;]*\b(?:DOMPurify\b|sanitize\w*\s*\(|purify\w*\s*\()/i,qp=/=\s*[\w$.?[\]]*\.(?:inner|outer)HTML\s*(?:[;,)\n]|$)/,Jp=/process\.env/,Yp=/\b(?:t|i18n|translate|formatMessage|intl)\s*[.(]/,Xp=/^(?:[\w$.]+\.)?(?:toHtml|render[A-Za-z]*(?:Html|HTML)|renderToString|renderToStaticMarkup|codeToHtml|codeToHast|highlight[A-Za-z]*)\s*\(/,Zp=/\b(?:shiki|prism|hljs|highlightjs|getHighlighter|codeToHtml|codeToHast|refractor|lowlight|starry-night)\b|highlight\.js/i,Qp=/[:=]\s*[^\n;]*(?:\b(?:katex|shiki|hljs|prism|mermaid)\b|hast-util-to-html|renderHtmlFromRichText|(?:toHtml|render[A-Za-z]*(?:Html|HTML)|renderToString|renderToStaticMarkup|codeToHtml|codeToHast)\s*\()/i,$p=/\b(?:(?:katex|shiki|hljs|prism|mermaid|highlighter)[\w$]*\.(?:render\w*|highlight\w*|codeTo(?:Html|Hast))|(?:toHtml|render(?:Html|HTML)[A-Za-z]*|render[A-Za-z]*(?:Html|HTML)|renderToString|renderToStaticMarkup|codeToHtml|codeToHast|highlight[A-Za-z]*))\s*\(/i,em=/^[\w$]+\s*(?:[;,})\n]|$)/,tm=/^[\w$]+\s*(?:\|\||\?\?)\s*(?:"[^"\n]*"|'[^'\n]*'|`[^`$]*`)\s*(?:[;,})\n]|$)/,nm=/^[\w$]+(?:\.[\w$]+|\[[^\]]*\])+\s*(?:[;,})\n]|$)/,rm=/<style\b[^<>]*$/,im=/(?:^|\/)emails(?:\/|$)|email[-_.]templates?(?:\/|$)|RawHtml|[A-Za-z]*[Ee]mail[A-Za-z]*\.(?:t|j)sx?/i,am=/(?:^|\/)\.[\w-]+\//,om=/(?<!un)saniti[sz]e?d?[\w-]*\.[cm]?[jt]sx?$/i,sm=/(?:^|[^\w$.])([\w$]+(?:\.[\w$]+)*)(?:(?:\.(?:inner|outer)HTML|\[\s*["'](?:inner|outer)HTML["']\s*\])\s*[+]?=(?!=)|\.insertAdjacentHTML\s*\()/,cm=/\b(?:appendChild|append|prepend|before|after|replaceWith|replaceChild|replaceChildren|insertBefore|insertAdjacentElement)\s*\(/,lm=5e3,um=e=>{if(!e.startsWith("`"))return null;let t=e.indexOf("`",1);if(t<0||t>lm)return null;let n=e.slice(1,t).match(/\$\{[^}]*\}/g);return n===null?``:n.join(` `)},dm=(e,t,n)=>{let r=vm(e,t,n);return r===null?null:n.slice(r.initializerStartIndex,r.initializerStartIndex+lm)},fm=e=>{if(!/^["']/.test(e))return!1;let t=e.replace(/"(?:\\.|[^"\\\n])*"|'(?:\\.|[^'\\\n])*'/g,``),n=t.search(/[;,})\]]/),r=n>=0?t.slice(0,n):t;return/^[\s+]*$/.test(r)},pm=(e,t)=>{let n=t.includes(`createElement`),r=t.includes(`createHTMLDocument`);if(!n&&!r)return!1;let i=J(e),a=J(e.split(`.`)[0]??e);if(RegExp(`\\b${a}\\s*=\\s*[^\\n;]*(?:getElementById|querySelector|getElementsBy|\\.current\\b|document\\.(?:body|head|documentElement))`).test(t))return!1;if(n&&(RegExp(`${i}\\s*=\\s*document\\.createElement\\(\\s*["'\`]template["'\`]`).test(t)||RegExp(`${a}\\s*=\\s*[^\\n;]*\\bcreateElement\\(\\s*["'\`](?:style|textarea)["'\`]`).test(t))||r&&RegExp(`${a}\\s*=\\s*[^\\n;]*\\bcreateHTMLDocument\\s*\\(`).test(t))return!0;if(!n||!RegExp(`${a}\\s*=\\s*[^\\n;]*\\bcreateElement\\s*\\(`).test(t))return!1;let o=RegExp(`${cm.source}[^)]*\\b${a}\\b`),s=RegExp(`\\breturn\\b[^\\n]*\\b${a}\\b(?!\\s*\\.\\s*(?:textContent|innerText|innerHTML|outerHTML))`);return o.test(t)||s.test(t)?!1:RegExp(`\\b${a}\\.(?:textContent|innerText|querySelector|querySelectorAll|children|childNodes)\\b`).test(t)},mm=e=>{let t=[],n=``,r=0,i=null;for(let a=0;a<e.length;a+=1){let o=e[a];if(i!==null){n+=o,o===i&&e[a-1]!==`\\`&&(i=null);continue}if(o===`"`||o===`'`||o==="`"){i=o,n+=o;continue}if(o===`(`||o===`[`||o===`{`?r+=1:(o===`)`||o===`]`||o===`}`)&&--r,o===`+`&&r===0&&e[a-1]!==`+`&&e[a+1]!==`+`){t.push(n),n=``;continue}n+=o}return t.push(n),t},hm=e=>{let t=e.replace(/[;}]\s*$/,``).trim();if(!t.includes(`+`))return!1;let n=[];for(let e of mm(t)){let t=e.trim();t.length>0&&n.push(t)}return n.length<2?!1:n.every(e=>{let t=e.replace(/\(\s*([\w$]+(?:\??\.[\w$]+)*)\s+as\s+[^)]*\)/g,`$1`);return Wp.test(t)?!Vp.test(t.replace(Wp,``)):!1})},gm=(e,t)=>{let n=0,r=null;for(let i=t;i<e.length;i+=1){let t=e[i];if(r!==null){t===r&&e[i-1]!==`\\`&&(r=null);continue}if(t===`"`||t===`'`||t==="`"){r=t;continue}if(t===`{`&&(n+=1),t===`}`&&(--n,n===0))return i}return e.length},_m=(e,t)=>{let n=[],r=null,i=!1,a=!1;for(let o=0;o<t;o+=1){let t=e[o],s=e[o+1];if(i){t===`
+`&&(i=!1);continue}if(a){t===`*`&&s===`/`&&(a=!1,o+=1);continue}if(r!==null){t===r&&e[o-1]!==`\\`&&(r=null);continue}if(t===`/`&&s===`/`){i=!0,o+=1;continue}if(t===`/`&&s===`*`){a=!0,o+=1;continue}if(t===`"`||t===`'`||t==="`"){r=t;continue}t===`{`&&n.push(o),t===`}`&&n.pop()}let o=n.at(-1);return o===void 0?e.length:gm(e,o)},vm=(e,t,n)=>{let r=RegExp(`(const|let|var)\\s+${J(e)}\\s*(?::[^=\\n]*)?=\\s*([^;\\n]+)`,`g`),i=null,a=-1;for(let e of n.matchAll(r)){let r=e.index;if(r===void 0||r>=t||r<=a||_m(n,r)<t)continue;a=r;let o=e[2];o!==void 0&&(i={declarationIndex:r,initializer:o,initializerStartIndex:r+e[0].length-o.length,isImmutable:e[1]===`const`})}return i},ym=(e,t,n,r)=>{if(t.isImmutable)return!0;let i=r.slice(t.initializerStartIndex+t.initializer.length,n);return!RegExp(`(?:^|[^\\w$.])${J(e)}\\s*=(?!=)`).test(i)},bm=(e,t,n)=>{if(!/highlight/i.test(e))return!1;let r=e.match(/^([\w$]+)/)?.[1];if(r===void 0)return!1;let i=vm(r,n,t);return i===null?/highlighted/i.test(e)||Zp.test(t):ym(r,i,n,t)&&$p.test(i.initializer)},xm=(e,t,n,r=new Set)=>{let i=e.trim(),a=mm(i);if(a.length>1)return a.every(e=>xm(e,t,n,r));let o=[...i.matchAll(/\$\{([^}]*)\}/g)].flatMap(e=>e[1]===void 0?[]:[e[1]]);if(o.length>1)return o.every(e=>xm(e,t,n,r));let s=i.match(/^([\w$]+)(?:(?:\??\.[\w$]+)|(?:\[\s*(?:"[^"\n]*"|'[^'\n]*'|\d+)\s*\]))*$/)?.[1];if(s&&!r.has(s)){let e=vm(s,n,t);if(e&&ym(s,e,n,t)){let n=new Set(r);return n.add(s),xm(e.initializer,t,e.initializerStartIndex,n)}}return!!(Hp.test(`${i};`)||Up.test(`${i};`)||Gp.test(i)||Jp.test(i)||Yp.test(i)||Xp.test(i)||bm(i,t,n))},Sm=(e,t,n,r,i=new Set)=>{let a=e.trim().match(/^([\w$]+)$/)?.[1];if(!a)return!1;if(a===t)return!0;if(i.has(a))return!1;let o=vm(a,n,r);if(!o?.isImmutable)return!1;let s=new Set(i);return s.add(a),Sm(o.initializer,t,o.initializerStartIndex,r,s)},Cm=(e,t,n)=>{let r=n.slice(Math.max(0,t-lm),t),i=J(e);return RegExp(`(?:function\\s+[\\w$]+|(?:const|let|var)\\s+[\\w$]+\\s*=)\\s*\\(\\s*\\{[^}]*\\b${i}\\b[^}]*\\}`).test(r)},wm=(e,t,n)=>{let r=[/function\s+([\w$]+)\s*\(([^)]*)\)\s*\{/g,/(?:const|let|var)\s+([\w$]+)\s*=\s*(?:async\s*)?\(([^)]*)\)\s*=>\s*\{/g],i=null,a=-1;for(let o of r)for(let r of n.matchAll(o)){let o=r.index;if(o===void 0||o>=t||o<a)continue;let s=gm(n,o+r[0].lastIndexOf(`{`));if(s<t)continue;let c=(r[2]??``).split(`,`).findIndex(t=>t.trim().match(/^(?:\.\.\.)?([\w$]+)/)?.[1]===e);if(c<0)continue;a=o;let l=r[1]??``;i={bodyEndIndex:s,declarationNameIndex:o+r[0].indexOf(l),functionName:l,parameterIndex:c}}return i},Tm=e=>{let t=[],n=0,r=0,i=null;for(let a=0;a<e.length;a+=1){let o=e[a];if(i!==null){o===i&&e[a-1]!==`\\`&&(i=null);continue}if(o===`"`||o===`'`||o==="`"){i=o;continue}(o===`(`||o===`[`||o===`{`)&&(r+=1),(o===`)`||o===`]`||o===`}`)&&--r,o===`,`&&r===0&&(t.push(e.slice(n,a).trim()),n=a+1)}return t.push(e.slice(n).trim()),t},Em=(e,t,n,r=new Set)=>{let i=e.trim().match(/^([\w$]+)$/)?.[1];if(i===void 0||r.has(i))return!1;if(wm(i,t,n)!==null)return!0;let a=vm(i,t,n);if(!a||!ym(i,a,t,n))return!1;let o=new Set(r);return o.add(i),Em(a.initializer,a.initializerStartIndex,n,o)},Dm=(e,t,n,r,i)=>{let a=e.trim();if(xm(a,t,n))return!1;let o=a.match(/^([\w$]+)(?:\.|\s*(?:(?:\|\||\?\?)|[;,})\n]|$))/)?.[1];if(o===void 0)return Vp.test(a);if(Cm(o,n,t))return!0;if(r.has(o))return!1;r.add(o);let s=vm(o,n,t),c=wm(o,n,t);if(s!==null&&(c===null||s.declarationIndex>c.declarationNameIndex))return ym(o,s,n,t)&&xm(s.initializer,t,s.initializerStartIndex)?!1:!ym(o,s,n,t)||Dm(s.initializer,t,s.initializerStartIndex,r,i)?!0:Em(s.initializer,s.initializerStartIndex,t)?!1:Vp.test(a);if(c!==null&&c.functionName.length>0){let e=RegExp(`\\b${J(c.functionName)}\\s*\\(`,`g`),n=!1;for(let a of t.matchAll(e)){if(a.index===c.declarationNameIndex||i.has(a.index))continue;let e=a.index+a[0].lastIndexOf(`(`),s=wf(t,e);if(s<0)continue;let l=Tm(t.slice(e+1,s))[c.parameterIndex];if(l===void 0||a.index>=c.declarationNameIndex&&a.index<=c.bodyEndIndex&&Sm(l,o,a.index,t))continue;n=!0;let u=new Set(r);u.delete(o);let d=new Set(i);if(d.add(a.index),Dm(l,t,a.index,u,d))return!0}if(n)return!1;let s=t.slice(Math.max(0,c.declarationNameIndex-48),c.declarationNameIndex);return/\bexport\s+(?:(?:default\s+)?(?:async\s+)?function|const|let|var)\s+$/.test(s)?!0:Vp.test(a)}return Vp.test(a)},Om=W({id:`dangerous-html-sink`,title:`HTML injection sink with dynamic content`,severity:`warn`,recommendation:`Prefer rendering structured React nodes. If HTML is required, sanitize with a well-reviewed sanitizer and keep the trust boundary close to the sink.`,scan:e=>{if(e.isGeneratedBundle||!K(e.relativePath)||im.test(e.relativePath)||am.test(e.relativePath)||om.test(e.relativePath)||!zp.test(e.content))return[];let t=Rp(e.content,e.absolutePath),n=[],r=e.content.split(`
+`);for(let i=0;i<r.length;i+=1){let a=r[i]??``;if(!zp.test(a))continue;let o=a.slice(0,a.search(zp)).replace(/"[^"]*"|'[^']*'|`[^`]*`/g,``);if(/(?:^|[^:])\/\//.test(o)||/^\s*[/*]/.test(a))continue;let s=r.slice(i,i+1+4).join(`
+`),c=Bp.exec(s);if(c===null)continue;let l=(c[1]??``).trimStart(),u=l.slice(0,300),d=u.search(/[;}]/),f=d>=0?u.slice(0,d+1):u,p=r.slice(0,i).join(`
+`).length+ +(i>0)+a.search(zp),m=t.find(e=>p>=e.startIndex&&p<e.endIndex)?.proof;if(m?.isConclusive&&m.isSafe)continue;let h=m?.isConclusive===!0;if(Hp.test(f)||Up.test(f))continue;if(Wp.test(f)&&!f.includes(`+`)){let e=f.replace(Wp,``);if(!Vp.test(e))continue}if(hm(f))continue;let g=Bp.exec(r.slice(i,i+1+60).join(`
+`))?.[1]?.trimStart(),_=um(g??l),v=em.test(f)||nm.test(f)||tm.test(f)?f.match(/^[\w$]+/)?.[0]:void 0;if(_===null&&v!==void 0&&em.test(f)&&wm(v,p,e.content)===null){let t=dm(v,p,e.content);if(t!==null){if(fm(t))continue;_=um(t)}}if(_===``)continue;let y=_??f,ee=mm(y).length>1||(_?.match(/\$\{/g)?.length??0)>1;if(!h&&!ee&&Gp.test(y)||!ee&&Jp.test(y)||!ee&&Yp.test(y)||!h&&!Dm(y,e.content,p,new Set,new Set)||!h&&Xp.test(f)||!h&&bm(f,e.content,p))continue;if(v!==void 0){let t=J(v),n=vm(v,p,e.content),r=n?.initializer;if(!(r!==void 0&&(mm(r).length>1||(r.match(/\$\{/g)?.length??0)>1))){let i=RegExp(`\\b${t}\\b\\s*${Qp.source}`,`i`);if(!h&&(r===void 0?i.test(e.content):n!==null&&ym(v,n,p,e.content)&&$p.test(r)))continue;let a=RegExp(`\\b${t}\\b\\s*${Kp.source}`,`i`);if(!h&&(r===void 0?a.test(e.content):n!==null&&ym(v,n,p,e.content)&&Kp.test(`=${r}`)))continue}if(RegExp(`\\b${t}\\b\\s*${qp.source}`).test(e.content)||RegExp(`highlight[\\w$]*\\s*\\.map\\(\\s*(?:async\\s+)?\\(?\\s*${t}\\b`,`i`).test(e.content)&&Zp.test(e.content))continue}if(nm.test(f)){let t=f.match(/\.([\w$]+)\s*(?:[;,})\n]|$)/)?.[1];if(t!==void 0&&RegExp(`\\b${J(t)}\\s*:\\s*${Yp.source}`).test(e.content))continue}let te=sm.exec(a),ne=te?.[1]??te?.[2];if(ne!==void 0&&pm(ne,e.content))continue;let re=r.slice(Math.max(0,i-5),i+1).join(`
+`).slice(0,-a.length+a.search(zp));rm.test(re)||n.push({message:`HTML is injected from a dynamic-looking source, which can become XSS if the value is user-controlled or unsanitized.`,line:i+1,column:a.search(/\S/)+1})}return n}}),km=e=>!(!K(e)||cu.test(e)||uu.test(e)),Am=/firebase|firestore|supabase|\b(?:setDoc|addDoc)\s*\(/i,jm=W({id:`firebase-client-owned-authz-field`,title:`Client writes authorization field`,severity:`error`,recommendation:`Derive authority fields on the server or enforce them in Firebase/Supabase rules; never trust client-provided owner, org, or role values.`,scan:q({shouldScan:e=>km(e.relativePath)&&(Am.test(e.content)||Am.test(e.relativePath)),pattern:/(?:\b(?:setDoc|updateDoc|addDoc)\s*\(|(?:\b(?:firebase|firestore|getFirestore)\b|\bcollection\s*\(|\.collection\s*\()[\s\S]{0,500}\.(?:set|update|add)\s*\()(?:[^;'"`]|'[^'\n]*'|"[^"\n]*"|`[^`]*`){0,700}\b(?:ownerId|ownerID|creatorId|creatorID|providerId|providerID|orgId|orgID|tenantId|tenantID|workspaceId|workspaceID|ghostOrg|role|roles|isAdmin)\b/i,message:`Client code writes an ownership, tenant, or role field that should be server-owned and immutable.`})}),Mm=W({id:`firebase-permissive-rules`,title:`Permissive Firebase security rule`,severity:`error`,recommendation:"Bind every read/write to `request.auth.uid`, immutable ownership, and tenant membership instead of treating sign-in as authorization.",scan:q({shouldScan:e=>Ou(e.relativePath),pattern:/allow\s+(?:read|write|create|update|delete|list|get|read,\s*write)\s*:\s*if\s+(?:true|request\.auth\s*!=\s*null)\s*;?/i,message:`Firebase rules grant broad access to everyone or to any signed-in user, which is the Chattr/Firewreck failure mode.`})}),Nm=W({id:`firebase-query-filter-as-auth`,defaultEnabled:!1,title:`Firestore query filter used as authorization`,severity:`warn`,recommendation:"Make sure Firestore rules compare the requested document against `request.auth.uid` and trusted membership data.",scan:q({shouldScan:e=>km(e.relativePath),pattern:/\.where\s*\(\s*["'](?:uid|userId|userID|ownerId|ownerID|orgId|orgID|tenantId|tenantID|role)["']\s*,\s*["']==["']/i,message:`Firestore query code filters by an auth-shaped field; filtering is not authorization unless rules enforce the same boundary.`})}),Pm=/api\.github\.com|github\.com|gitlab\.com|bitbucket\.org/gi,Fm=/\$\{([^}]*)\}/g,Im=/\b(?:params|searchParams|query|req|request|input|payload)\s*[.[]|\buntrusted|\bdecodeURI\w*/,Lm=/encodeURIComponent\s*\(/,Rm=/^\s*[\w$]+\.toString\(\)\s*$/,zm=W({id:`git-provider-url-injection-risk`,title:`Git provider URL built from interpolation`,severity:`warn`,recommendation:`Validate owner, repo, org, and branch identifiers against strict slugs and build URLs with URL/path encoders instead of raw interpolation.`,scan:e=>{if(!K(e.relativePath))return[];let t=[];for(let n of e.content.matchAll(Pm)){let r=e.content.slice(n.index,n.index+200),i=r.indexOf("`"),a=i>=0?r.slice(0,i):r;if(!Array.from(a.matchAll(Fm)).some(e=>{let t=e[1]??``;return Im.test(t)&&!Lm.test(t)&&!Rm.test(t)}))continue;let o=G(e.content,n.index);t.push({message:`GitHub/GitLab/Bitbucket URL construction interpolates path components that may be attacker-controlled.`,line:o.line,column:o.column});break}return t}}),Bm=/child_process|childProcess|execa|subprocess|Deno\.run/,Vm=/(?:\b(?:eval|new\s+Function|vm\.runIn\w*)|(?<![.\w$])(?:exec(?:File)?(?:Sync)?|spawn(?:Sync)?)|\b(?:child_process|childProcess|cp)\.(?:exec|spawn)\w*)\s*\([^;]{0,200}(?<!["'])\b(?:exif|metadata|manifest|preset|plugin|upload|drop(?:ped|s)?\b|archive|zip|unzip|untar)(?!\w*["'])/,Hm=/(?:\b(?:eval|new\s+Function|vm\.runIn\w*)|\b(?:child_process|childProcess|cp)\.(?:exec|spawn)\w*)\s*\([^;]{0,200}(?<!["'])\b(?:exif|metadata|manifest|preset|plugin|upload|drop(?:ped|s)?\b|archive|zip|unzip|untar)(?!\w*["'])/,Um=`Imported metadata, uploads, or plugin manifests appear to reach code execution.`,Wm=q({shouldScan:()=>!0,pattern:Vm,ignoreStringLiterals:!0,message:Um}),Gm=q({shouldScan:()=>!0,pattern:Hm,ignoreStringLiterals:!0,message:Um}),Km=W({id:`import-metadata-execution-risk`,title:`Imported metadata reaches code execution`,severity:`error`,recommendation:`Parse imported metadata as data with strict schemas; do not evaluate EXIF, manifests, presets, dropped files, or archives.`,scan:e=>K(e.relativePath)?Bm.test(e.content)?Wm(e):Gm(e):[]}),qm=/createHash\s*\(\s*["'](?:md5|sha1)["']|\bmd5\s*\(/gi,Jm=/\b(?:password|token|secret|signature|signing|auth|credential|session|cookie|csrf|api.?key)\b/i,Ym=/(?<!cipher\.)\bcreate(?:Cipher|Decipher)\s*\(/,Xm=/\bcreate(?:Cipher|Decipher)iv\s*\(\s*["'](?:des|des3|des-?ede3?|rc4|rc2|bf|blowfish)\b/i,Zm=/\b(?:DES|RC4|Blowfish)\b/,Qm=/\b(?:cipher|decipher|encrypt|decrypt|crypto)\b/i,$m=/[A-Za-z_$][\w$.]{0,100}signature[\w$]*(?:\([^)]*\))?\s*(?:===?|!==?)\s*[A-Za-z_$][\w$.]*(?:\([^)]*\))?|[A-Za-z_$][\w$.]{0,100}(?:\([^)]*\))?\s*(?:===?|!==?)\s*[A-Za-z_$][\w$.]{0,100}signature[\w$]*(?:\([^)]*\))?/i,eh=/(?:===?|!==?)\s*[A-Z](?:[a-z]|[A-Z0-9_]*\b(?!\s*[.(]))|^[A-Z](?:[a-z]|[A-Z0-9_]*\b(?!\s*[.(]))[\w$.]*(?:\([^)]*\))?\s*(?:===?|!==?)/,th=/signature(?:Method|Type|Status|Algorithm|Kind|Mode|Version)\b/i,nh=/(?:===?|!==?)\s*(?:true|false|null|undefined)\b/,rh=/\.(?:length|size|byteLength)\s*(?:===?|!==?)|\.(?:length|size|byteLength)\s*$/,ih=/\bcrypto\b|createH(?:mac|ash)|createSign|createVerify|\bsubtle\b|\bhmac\b|\bdigest\b|\bsha-?(?:1|256|384|512)\b|\bmd5\b|\bwebhook|x-(?:hub-)?signature/i,ah=/\.[cm]?[jt]sx$/i,oh=/timingSafeEqual|timing.?safe/i,sh=/gravatar|digest[-_ ]?auth|oauth[-_ ]?1|pkcs#?12|smime|\b_id\b|\betag\b|checksum|cache[-_ ]?key|fingerprint/i,ch=/token|secret|password|nonce|salt|csrf|credential|otp/i,lh=/(?:focus|render|refresh|remount|redraw|animation|layout|cache|update)[-_]?nonce/i,uh=/Math\.random\s*\(/g,dh=/createHash|md5|cipher|encrypt|decrypt|crypto|signature|Math\.random/i,fh=(e,t,n,r)=>{for(let i of e.matchAll(t)){let t=e.slice(Math.max(0,i.index-250),i.index+250);if(n.test(t)&&!r?.test(t))return i.index}return-1},ph=(e,t,n,r)=>{for(let i of e.matchAll(t)){let t=e.lastIndexOf(`
 `,i.index)+1,a=e.indexOf(`
-`,i.index),o=a<0?e.length:a,s=e.slice(t,o);if(!r.test(s)&&n.test(s))return i.index}return-1},ph=W({id:`insecure-crypto-risk`,title:`Weak cryptography in security context`,severity:`warn`,recommendation:"Use modern primitives, `crypto.randomBytes` / Web Crypto randomness, and timing-safe comparisons for signatures, digests, tokens, and auth material.",scan:e=>{if(!K(e.relativePath)||du.test(e.relativePath)||oh.test(e.relativePath)||!uh.test(e.content))return[];let t=Gu(e),n=dh(t,Km,qm,oh);if(n<0&&(n=t.search(Ym)),n<0&&(n=t.search(Jm)),n<0&&Zm.test(t)&&(n=t.search(Xm)),n<0&&!ah.test(t)&&!ih.test(e.relativePath)&&rh.test(t)){let e=Qm.exec(t);e!==null&&!$m.test(e[0])&&!eh.test(e[0])&&!th.test(e[0])&&!nh.test(e[0])&&(n=e.index)}if(n<0&&(n=fh(t,lh,sh,ch)),n<0)return[];let r=G(t,n);return[{message:`Code uses weak hashes, deprecated ciphers, timing-unsafe comparisons, or Math.random in a security-shaped context.`,line:r.line,column:r.column}]}}),mh=`(?<![A-Za-z0-9])(?:session|sess|sid|connect\\.sid|auth|jwt|access[_-]?token|refresh[_-]?token|id[_-]?token)(?![A-Za-z0-9])`,hh=`[\`"'][^\`"']*?${mh}[^\`"']*[\`"']`,gh=RegExp(`(?:\\.cookies\\.set|cookies\\(\\s*\\)\\.set|\\.cookie)\\s*\\(\\s*${hh}`,`gi`),_h=/httpOnly\s*:\s*false\b/i,vh=/"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'|`(?:[^`\\]|\\.)*`/g,yh=e=>{let t=e.split(``),n=0,r=null;for(;n<e.length;){let i=e[n];if(r!==null){if(i===`\\`){n+=2;continue}i===r?r=null:i!==`
-`&&(t[n]=` `),n+=1;continue}(i===`"`||i===`'`||i==="`")&&(r=i),n+=1}return t.join(``)},bh=/cookie\s*:\s*\{/gi,xh=RegExp(`document\\.cookie\\s*=\\s*[\`"'][^\`"'=;]*?${mh}[^\`"'=;]*=`,`gi`),Sh=e=>{if(e.trim().length===0)return 0;let t=0,n=null,r=1;for(let i=0;i<e.length;i+=1){let a=e[i];if(n!==null){a===`\\`?i+=1:a===n&&(n=null);continue}a===`"`||a===`'`||a==="`"?n=a:a===`(`||a===`[`||a===`{`?t+=1:a===`)`||a===`]`||a===`}`?--t:a===`,`&&t===0&&(r+=1)}return r},Ch=(e,t,n,r,i)=>{t.lastIndex=0;for(let a=t.exec(e);a!==null;a=t.exec(e)){if(!r(a.index,a[0]))continue;let t=G(e,a.index);i.push({message:n,line:t.line,column:t.column})}},wh=W({id:`insecure-session-cookie`,title:`Auth cookie missing HttpOnly protection`,severity:`warn`,recommendation:"Set auth/session cookies server-side with `httpOnly: true`, `secure: true`, and `sameSite`. Cookies set via `document.cookie` or with `httpOnly: false` are readable by any XSS payload and can be stolen.",scan:e=>{if(!K(e.relativePath))return[];let t=Gu(e);if(!/cookie/i.test(t))return[];let n=[],r=`An auth/session cookie is exposed to JavaScript (set via document.cookie, with httpOnly: false, or without cookie options), letting an XSS payload steal it.`;gh.lastIndex=0;for(let e=gh.exec(t);e!==null;e=gh.exec(t)){let i=e.index+e[0].lastIndexOf(`(`),a=Cf(t,i);if(a<0)continue;let o=t.slice(i+1,a),s=Sh(o)<3,c=o.replace(vh,``);if(!s&&!_h.test(c))continue;let l=G(t,e.index);n.push({message:r,line:l.line,column:l.column})}let i=yh(t);bh.lastIndex=0;for(let e=bh.exec(i);e!==null;e=bh.exec(i)){let t=e.index+e[0].length-1,a=Cf(i,t),o=a>=0?i.slice(t,a):i.slice(t,t+400);if(!_h.test(o))continue;let s=G(i,e.index);n.push({message:r,line:s.line,column:s.column})}return Ch(t,xh,r,()=>!0,n),n}}),Th=/\b(?:alg|algorithms?)\s*:\s*\[?\s*["'`]none["'`]/gi,Eh=(e,t)=>{let n=null,r=[];for(let i=0;i<t;i+=1){let t=e[i];if(n==="`"){t===`\\`?i+=1:t==="`"?n=null:t===`$`&&e[i+1]===`{`&&(r.push(0),n=null,i+=1);continue}if(n!==null){t===`\\`?i+=1:t===n&&(n=null);continue}if(t===`"`||t===`'`||t==="`")n=t;else if(r.length>0){let e=r.length-1;t===`{`?r[e]+=1:t===`}`&&(r[e]===0?(r.pop(),n="`"):--r[e])}}return n!==null},Dh=W({id:`jwt-insecure-verification`,title:`JWT verified with the 'none' algorithm`,severity:`error`,recommendation:"Never accept the `none` algorithm; it disables signature verification and lets any forged token through. Pin the real algorithm(s) explicitly (`jwt.verify(token, key, { algorithms: ['RS256'] })`).",scan:e=>{if(!K(e.relativePath))return[];let t=Gu(e);if(!/\bjwt\b|jsonwebtoken|\bjose\b/i.test(t))return[];let n=[];Th.lastIndex=0;for(let e=Th.exec(t);e!==null;e=Th.exec(t)){if(Eh(t,e.index))continue;let r=G(t,e.index);n.push({message:`JWT is configured with the 'none' algorithm, which disables signature verification, so any forged token is accepted.`,line:r.line,column:r.column})}return n}}),Oh=/PRIVATE KEY|SSH_PRIVATE_KEY|GPG_PRIVATE_KEY|DEPLOY_KEY|SIGNING_KEY/i,kh=W({id:`key-lifecycle-risk`,title:`Long-lived key material in repository`,severity:`error`,committedFilesOnly:!0,recommendation:`Remove private keys from source, rotate exposed credentials, prefer short-lived deploy credentials, and document revocation/expiry for release keys.`,scan:q({shouldScan:e=>!cu.test(e.relativePath)&&!fu.test(e.relativePath)&&Oh.test(e.content),pattern:/(?<!(?:placeholder|example|sample|dummy|fake)[\s\S]{0,40})-----BEGIN (?:RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----(?:\s|\\r|\\n)*[A-Za-z0-9+/=][A-Za-z0-9+/=\s]{38,}(?![^-]{0,160}\.\.\.)|\b(?:SSH_PRIVATE_KEY|GPG_PRIVATE_KEY|DEPLOY_KEY|SIGNING_KEY)\b\s*[:=]\s*["'][^"'\n]{16,}["']/i,message:`Private or long-lived release key material appears in the repository.`})}),Ah=W({id:`local-rpc-native-bridge-risk`,title:`Weak localhost native bridge boundary`,severity:`warn`,recommendation:`Use exact origin allowlists after URL parsing, per-request nonces, narrow methods, and never expose install/update commands to arbitrary web pages.`,scan:q({shouldScan:e=>K(e.relativePath),pattern:/\b(?:Access-Control-Allow-Origin|websocket|WebSocket|(?:127\.0\.0\.1|localhost)(?=[\s\S]{0,700}\b(?:UpdateApp|InstallApp)\b)|(?:127\.0\.0\.1|localhost)[\s\S]{0,350}\b(?:onmessage|message|request|req)\b)\b[\s\S]{0,700}(?:\b(?:UpdateApp|InstallApp|child_process)\b|(?<![.\w$])(?:exec(?:File)?(?:Sync)?|spawn(?:Sync)?)\s*\()/i,message:`Code appears to bridge browser code to localhost/native capabilities with weak origin or update/install checks.`})}),jh=/\bfrom\s+["']@modelcontextprotocol\/sdk[^"']*["']|\bMcpServer\b|\bMcpAgent\b/,Mh=/@modelcontextprotocol\/sdk|\bMcpServer\b|\bMcpAgent\b/,Nh=/\bserver\.\s*tool\s*\(|\bregisterTool\s*\(|\bsetRequestHandler\s*\(\s*CallToolRequestSchema/,Ph=/\b(?:tool|registerTool|setRequestHandler)\b/,Fh=W({id:`mcp-tool-capability-risk`,defaultEnabled:!1,title:`MCP tool exposes dangerous capability`,severity:`warn`,recommendation:`MCP tool calls run with the connecting client's authority. Validate inputs, enforce per-tool authorization, and avoid raw filesystem/shell/network access where possible.`,scan:q({shouldScan:e=>K(e.relativePath)&&Mh.test(e.content)&&Ph.test(e.content)&&gu.test(e.content),pattern:Nh,requireAll:[jh,gu],ignoreStringLiterals:!0,message:`An MCP tool/resource/prompt handler appears to expose file, shell, network, or code-execution capability.`})}),Ih=W({id:`mdx-ssr-execution-risk`,title:`Server-rendered MDX can execute code`,severity:`warn`,recommendation:`Use a constrained compiler for untrusted content, disable expressions/raw HTML, sandbox renderers, and avoid caching attacker-controlled output across tenants.`,scan:q({shouldScan:e=>K(e.relativePath),pattern:/(?:@mdx-js\/mdx|next-mdx-remote|\b(?:MDXRemote|compileMDX|evaluateMdx)\b)[\s\S]{0,700}\b(?:repo\b|customer|tenant|user[-_]?(?:content|markdown|mdx|input|provided|generated|submitted)|untrusted|searchParams|req\.|request\.|fetch\s*\(|prisma\.|db\.|database|rehypeRaw|allowDangerousHtml)/i,message:`MDX/markdown rendering code may evaluate user or repository content during SSR or static generation.`})}),Lh=W({id:`nosql-injection-risk`,title:`NoSQL query accepts operator-shaped input`,severity:`warn`,recommendation:"Coerce scalar fields before querying, reject operator keys from client input, and avoid `$where` or request-derived regexes.",scan:q({shouldScan:e=>Su(e.relativePath,ou),pattern:/\$where\s*['"]?\s*:\s*(?:f?['"`][^'"`]{0,200}\$\{|function|f['"])|\.find\s*\(\s*JSON\.parse\s*\(\s*(?:req|request)\.|\.aggregate\s*\(\s*\[?\s*\{[^}]{0,400}\$where|\bnew\s+RegExp\s*\(\s*(?:req|request)\.|\$regex['"]?\s*:\s*(?:req|request)\./i,message:"Code appears to pass raw JSON, regex, or `$where` style input into a NoSQL query."})}),Rh=[...cd.filter(e=>!e.test(`service_role`)),ld],zh=W({id:`package-metadata-secret`,title:`Secret-like package metadata`,severity:`warn`,recommendation:`Keep secrets out of package metadata and generated reports; they are often published to registries, logs, or browser artifacts.`,scan:e=>{if(!e.relativePath.endsWith(`package.json`))return[];let t=Id(e.content)??Rh.find(t=>t.test(e.content));if(t===void 0)return[];let n=tu(e.content,t);return[{message:`Package metadata contains secret-like values or public env secret names.`,line:n.line,column:n.column}]}}),Bh=W({id:`path-traversal-risk`,title:`Filesystem path uses caller input`,severity:`warn`,recommendation:`Resolve paths against a fixed base directory, reject traversal after normalization, and map user-visible identifiers to server-owned paths.`,scan:q({shouldScan:e=>K(e.relativePath)&&!mf(e.relativePath),pattern:/\b(?:readFile|readFileSync|writeFile|writeFileSync)\s*\(\s*(?:req\.|request\.|params\.|query\.|body\.|parsed\.|`[^`]*(?<![-./\w$'"`])(?:req\.|request\.|params\.|query\.|body\.))|\bpath\.(?:join|resolve)\s*\([^)]*(?<![-./\w$'"`])(?<!basename\(\s{0,4})(?:req\.|request\.|params\.|query\.|body\.|parsed\.)/,message:`Filesystem access appears to use request, query, params, or body data as part of the path.`})}),Vh=/\b(?:repoUrl|updateUrl|UpdateApp|InstallApp|auto.?updater?|installer|curl(?!\s+(?:-T\b|--upload-file\b))|wget)\b[\s\S]{0,250}(?:\.(?:zip|exe|dmg|appimage|msi|deb|rpm)\b|\.tar\.gz\b|\|\s*(?:bash|sh)\b)/i,Hh=/\b(?:curl|wget)\b(?=(?:[^\r\n]|\\\r?\n)*https?:\/\/)(?:[^\r\n]|\\\r?\n)*?\|\s*(?:bash|sh)\b/i,Uh=/sha(?:256|512|1)sum|--checksum|checksum=|EXPECTED_SHA|gpg\s+--verify|\.sha(?:256|512)\b/i,Wh=/\b(?:child_process|childProcess|execa|os\.system|subprocess\.|Deno\.run|autoUpdater|electron-updater)\b|\b(?:exec(?:File)?(?:Sync)?|spawn(?:Sync)?)\s*\(/,Gh=/.\/\.github\/workflows\//i,Kh=/(?:^|\/)[\w-]+[.@-]\d+\.\d+\.\d+(?:[-.][\w.]+)?\//,qh=e=>bu(e)&&!Gh.test(e)&&!Kh.test(e)&&!du.test(e),Jh=W({id:`plugin-update-trust-risk`,title:`Plugin or updater trust boundary risk`,severity:`warn`,recommendation:`Require signed updates/plugins, pin trusted repositories, verify hashes before execution, and keep custom repository installs behind explicit warnings.`,scan:e=>{if(!K(e.relativePath)&&!qh(e.relativePath))return[];let t=Gu(e),n=Hh.test(t);if(!n&&!Vh.test(t))return[];let r=n?Hh:Vh;if(Uh.test(t)||iu.test(e.relativePath)&&!Wh.test(t))return[];let i=tu(t,r);return[{message:`Code appears to download, install, update, or execute plugin/updater content across a trust boundary.`,line:i.line,column:i.column}]}}),Yh=/origin(?!al)|\.source\s*[!=]==?/i,Xh=/\b(?:event|e|evt|msg|message)\.data\b/,Zh=/\b(?:const|let|var)\s+[^;=]*=\s*$/,Qh=/port\d?\b|worker|channel|broadcast|socket|\bws\b|\bsse\b|eventsource|^_?self\.|^source\./i,$h=String.raw`=\s*new\s+(?:EventSource|WebSocket|Worker|SharedWorker|BroadcastChannel|MessageChannel)\b`,eg=(e,t)=>{let n=/^[\w$]+/.exec(e)?.[0];return n===void 0?!1:RegExp(`(?<![\\w$.])${J(n)}\\s*${$h}`).test(t)},tg=(e,t)=>{let n=/^[\w$]+/.exec(e)?.[0];return n===void 0?!1:RegExp(`(?:^|[(,{;]\\s*)${J(n)}\\s*[?!]?\\s*:\\s*(?:Worker|SharedWorker|MessagePort|BroadcastChannel|WebSocket|EventSource)\\b`,`m`).test(t)},ng=/worker/i,rg=(e,t)=>{let n=X(t),r=wf(t);return n<0||r<0?``:e.slice(n,r)},ig=(e,t)=>{if(t.type===`CallExpression`){let n=D(t.callee)?rg(e,t.callee):``;if(!n.endsWith(`addEventListener`))return null;let r=t.arguments[0];return D(r)&&r.type===`Literal`&&r.value===`message`?n:null}if(t.type===`AssignmentExpression`&&D(t.left)){let n=rg(e,t.left);return n.endsWith(`.onmessage`)?n:null}return null},ag=W({id:`postmessage-origin-risk`,title:`postMessage handler without origin check`,severity:`warn`,recommendation:"Validate `event.origin` against an exact allowlist before using `event.data`, especially when an iframe or parent window can be attacker-controlled.",scan:e=>{if(!K(e.relativePath)||ng.test(e.relativePath))return[];let t=e.content.includes(`onmessage`),n=e.content.includes(`addEventListener`)&&(e.content.includes(`message`)||e.content.includes(`\\`));if(!t&&!n)return[];let r=_n({filename:e.absolutePath,sourceText:e.content,shouldAttachParentReferences:!1});if(r===null)return[];let i=[];return z(r,t=>{let n=ig(e.content,t);if(n===null||Qh.test(n)||eg(n,e.content)||tg(n,e.content))return;let r=rg(e.content,t),a=r.search(Xh);if(a<0)return;let o=r.search(Yh);if(o>=0&&(Zh.test(r.slice(0,a))||o<a))return;let s=G(e.content,X(t));i.push({message:`A message event handler reads cross-window messages without an obvious origin check.`,line:s.line,column:s.column})}),i}}),og=/(?:^|\/)(?:locales?|i18n|lang|langs|translations?)\//i,sg=/(?:^|\/)(?:\.env(?:\.[^/]*)?|(?:debug|crash|trace|stack[-_]?trace|report|dump|phpinfo)(?:[-_.][^/]*)?\.(?:txt|log|json|html?)|[^/]+\.log)$/i,cg=e=>yu(e,mu.test(e))&&!og.test(e)&&sg.test(e),lg=W({id:`public-debug-artifact`,title:`Public debug artifact`,severity:`warn`,recommendation:`Remove debug artifacts from public output; logs and dumps often reveal source paths, internal routes, tokens, or environment snapshots.`,scan:e=>{if(!cg(e.relativePath))return[];let t={message:`A browser-reachable debug, log, dump, report, or env artifact is present.`,line:1,column:1};return[cd.some(t=>t.test(e.content))?{...t,severity:`error`}:t]}}),ug=/(?:^|\/)docs?\//i,dg=W({id:`public-env-secret-name`,title:`Secret-like public env variable`,severity:`warn`,recommendation:`Public env prefixes are inlined into browser bundles. Rename public values to non-secret names, and keep tokens, passwords, private keys, and service-role credentials server-only.`,scan:e=>{if(!Om(e.relativePath)||ug.test(e.relativePath))return[];let t=Id(e.content);if(t===void 0)return[];let n=tu(e.content,t);return[{message:`Client code references a public env variable whose name looks like a secret or privileged credential.`,line:n.line,column:n.column}]}}),fg=`(?:"[^"\\n]{0,200}"|'[^'\\n]{0,200}'|\`[^\`$]{0,200}\`)`,pg=`\\s*\\(?\\s*(?:${fg}|(?:[\\w\$]+(?:\\.[\\w\$]+)*\\.escape(?:Id|Literal|Identifier)|(?:[\\w\$]+\\.)*(?:connection|conn|client|pool|db|mysql|sqlstring|knex)\\.escape)\\s*\\([^()]{0,200}\\))\\s*\\)?`,mg=W({id:`raw-sql-injection-risk`,title:`Raw SQL built outside parameter binding`,severity:`warn`,recommendation:`Keep user input in driver parameters or ORM bind variables. Avoid unsafe/raw SQL helpers and string interpolation for queries.`,scan:q({shouldScan:e=>hf(e.relativePath),pattern:[/\$queryRawUnsafe\s*\(/,/\$executeRawUnsafe\s*\(/,/\bPrisma\.raw\s*\((?!\s*(?:["'][^"'\n]*["']\s*[,)]|`[^`$]*`))/,/\bsql\.\s*(?:raw|unsafe)\s*\((?!\s*(?:["'][^"'\n]*["']\s*[,)]|`[^`$]*`))/,/\b(?:client|pool|conn)\.query\s*\(\s*['"`]\s*(?:SELECT|INSERT|UPDATE|DELETE)\b[^)]{0,400}\$\{(?!\s*[\w$.]*(?:sanitiz|escape|quote)[\w$]*\s*\()/i,RegExp(`\\.query\\s*\\(\\s*${fg}(?:\\s*\\+${pg})*\\s*\\+(?!${pg})`,`i`),/\.(?:where|orderBy|having)Raw\s*\((?!\s*(?:["'][^"'\n]*["']\s*[,)]|`[^`$]*`))/,/\bcursor\.execute\s*\(\s*f['"]/,/\bcursor\.execute\s*\(\s*(?:"[^"]{0,400}"|'[^']{0,400}')\s*(?:%|\.format\s*\(|\+)/,/\b(?:engine|session)\.execute\s*\(\s*(?:text\s*\(\s*)?f['"]/,/\$[\w]+->(?:query|exec|prepare|executeQuery|executeStatement|createQuery|createNativeQuery)\s*\(\s*(?:"[^"]{0,400}"|'[^']{0,400}')\s*\.\s*\$/,/mysqli_query\s*\(\s*[^,]+,\s*(?:"[^"]{0,400}"|'[^']{0,400}')\s*\.\s*\$/],message:`Code uses a raw SQL escape hatch or string-built query shape that can bypass parameter binding.`})}),hg=e=>ru.test(e)||/(?:^|\/)\.npmrc$/.test(e)||/(?:^|\/)[^/]*(?:credential|credentials|service-account|serviceAccount|firebase-admin|google-service-account|gcp-service-account)[^/]*\.(?:json|env|pem|key)$/i.test(e),gg=e=>/(?:^|\/)\.env(?:\.[^./]+)*\.(?:example|sample|template|dist|defaults?)$|(?:^|\/)[^/]*(?:example|sample|template)[^/]*\.(?:env|json|pem|key)$/i.test(e),_g=W({id:`repository-secret-file`,title:`Secret file checked into repository`,severity:`error`,committedFilesOnly:!0,recommendation:`Remove committed env files, service-account credentials, npm auth tokens, and webhook URLs; rotate exposed values and keep only redacted examples in source.`,scan:e=>{if(!hg(e.relativePath)||gg(e.relativePath)||cu.test(e.relativePath))return[];let t=cd.find(t=>t.test(e.content))??Id(e.content);if(t===void 0)return[];let n=tu(e.content,t);return[{message:`A repository credential/config file contains secret-looking values.`,line:n.line,column:n.column}]}}),vg=`(?:req|request|ctx\\.req|ctx\\.request)\\.(?:body|query|params)|await\\s+(?:req|request)\\.json\\(\\s*\\)`,yg=W({id:`request-body-mass-assignment`,title:`Request input spread without field allowlist`,severity:`warn`,recommendation:"Assign explicit, allowlisted fields (or validate with a strict schema and no `.passthrough()`) instead of spreading/merging request input. Otherwise the client can set ownership, role, or price columns (mass assignment) or pollute the prototype.",scan:q({shouldScan:e=>K(e.relativePath),pattern:[RegExp(`\\.\\.\\.\\s*(?:${vg})`,`i`),RegExp(`(?:Object\\.assign\\s*\\(|_\\.(?:merge|mergeWith|defaultsDeep)\\s*\\(|(?:^|[^.\\w])(?:merge|defaultsDeep)\\s*\\()[\\s\\S]{0,80}?(?:${vg})`,`i`)],message:`Request input is spread or merged into an object without a field allowlist, enabling mass assignment (client-set owner/role/price fields) or prototype pollution.`})}),bg=W({id:`secret-in-fallback`,title:`Hardcoded secret fallback for env var`,severity:`error`,recommendation:"Remove the literal fallback and fail closed (throw when the variable is unset). The hardcoded value is a committed secret, and the `??`/`||` default makes the app run with it in any environment that forgot to set the var.",scan:q({shouldScan:e=>K(e.relativePath),pattern:/\bprocess\.env\.(?!(?:(?:(?:NEXT|EXPO|GATSBY|NUXT|REACT_APP|VITE)_)?PUBLIC_[A-Z0-9_]*(?<!_SECRET)(?<!_PRIVATE_KEY)(?<!_PASSWORD)(?<!_PASSWD)|[A-Z0-9_]*(?:PUBLISHABLE|ANON)_KEY)(?![A-Z0-9_]))[A-Z][A-Z0-9_]*(?:SECRET|TOKEN|PASSWORD|PASSWD|PRIVATE_KEY|API_?KEY|APIKEY|ACCESS_KEY|CLIENT_SECRET|CREDENTIAL|SIGNING_KEY|ENCRYPTION_KEY|WEBHOOK_SECRET|SERVICE_ROLE)[A-Z0-9_]*(?<!_(?:NAME|HEADER|ENDPOINT|URL|URI|ID|PREFIX|SUFFIX|PARAM|PARAMS|FIELD|ISSUER|AUDIENCE|ALGORITHM|ALG|REGION|BUCKET|HOST|HOSTNAME|PORT|PATH|VERSION|SCOPE|TYPE|FORMAT|EXPIRY|TTL))\s*(?:\?\?|\|\|)\s*(["'`])(?![0-9]+["'`])(?![a-z][a-z0-9]*(?:[_-][a-z0-9]+)*[_-](?:token|secret|key|password|passwd|credential)s?["'`])(?![\w-]{0,12}0{8,}["'`])(?!test test test test test test test test test test test junk["'`])(?!(?:changeme|change[_-]?me|placeholder|your[_-]|example|sample|dummy|development|local|todo|replace[_-]?me|https?:\/\/|x{3,}|\*{3,}))[^"'`\n]{8,}\1/i,message:`A secret env var has a hardcoded string fallback: the literal is a committed secret and the app fails open (uses it) when the variable is unset.`})}),xg=(e,t)=>{let n=null;if(b(e,`Program`)?n=e.body:(b(e,`FunctionDeclaration`)||b(e,`FunctionExpression`)||b(e,`ArrowFunctionExpression`))&&b(e.body,`BlockStatement`)&&(n=e.body.body),n===null)return!1;for(let e of n){if(!b(e,`ExpressionStatement`)||e.directive===void 0)return!1;if(e.directive===t)return!0}return!1},Sg=(e,t=`source.tsx`)=>{let n=_n({filename:t,sourceText:e,shouldAttachParentReferences:!1});return n===null?!1:xg(n,`use server`)},Cg=q({shouldScan:e=>Om(e.relativePath),pattern:/\b(?:ownerId|ownerID|creatorId|creatorID|userId|userID|uid|providerId|providerID|orgId|orgID|tenantId|tenantID|teamId|teamID|workspaceId|workspaceID|ghostOrg|role|roles|isAdmin|admin)\b/,requireAll:[/\b(?:supabase\b|\.from\s*\(\s*["'][^"']+["']\s*\))[\s\S]{0,700}\b(?:insert|upsert|update)\s*\(\s*(?:\{|\[?\s*\{)[\s\S]{0,700}\b(?:ownerId|creatorId|userId|orgId|tenantId|role|isAdmin)\b/i],message:`Client Supabase code appears to write user, tenant, owner, or role fields that should be enforced by RLS.`}),wg=W({id:`supabase-client-owned-authz-field`,title:`Client writes Supabase authorization field`,severity:`error`,recommendation:"Use RLS policies based on `auth.uid()` and server-owned membership rows; do not trust client-provided owner, org, or role columns.",scan:e=>{let t=Cg(e);return t.length===0?t:Sg(e.content,e.relativePath)?[]:t}}),Tg=e=>/(?:^|\/)supabase\/(?:migrations|schemas)\//.test(e),Eg=e=>e.endsWith(`.sql`)||Tg(e),Dg=/^\$[A-Za-z_]?\w*\$/,Og=new Set([`do`,`plpgsql`,`sql`,`plpython3u`,`plpythonu`,`plperl`,`plperlu`,`plv8`]),kg=(e,t)=>{let n=t-1;for(;n>=0&&/\s/.test(e[n]??``);)--n;let r=n;for(;r>=0&&/[A-Za-z0-9_]/.test(e[r]??``);)--r;return e.slice(r+1,n+1).toLowerCase()},Ag=(e,t,n,r)=>{let i=n,a=!1;for(;i<r;){let n=e[i];if(n===`;`){a=!1,i+=1;continue}if(/[A-Za-z_]/.test(n)){let t=i;for(;t<r&&/[A-Za-z0-9_]/.test(e[t]??``);)t+=1;e.slice(i,t).toLowerCase()===`execute`&&(a=!0),i=t;continue}if(n===`'`){let n=a;for(n||(t[i]=` `),i+=1;i<r;){if(e[i]===`'`){if(e[i+1]===`'`){n||(t[i]=` `,t[i+1]=` `),i+=2;continue}n||(t[i]=` `),i+=1;break}!n&&e[i]!==`
+`,i.index),o=a<0?e.length:a,s=e.slice(t,o);if(!r.test(s)&&n.test(s))return i.index}return-1},mh=W({id:`insecure-crypto-risk`,title:`Weak cryptography in security context`,severity:`warn`,recommendation:"Use modern primitives, `crypto.randomBytes` / Web Crypto randomness, and timing-safe comparisons for signatures, digests, tokens, and auth material.",scan:e=>{if(!K(e.relativePath)||fu.test(e.relativePath)||sh.test(e.relativePath)||!dh.test(e.content))return[];let t=Ku(e),n=fh(t,qm,Jm,sh);if(n<0&&(n=t.search(Xm)),n<0&&(n=t.search(Ym)),n<0&&Qm.test(t)&&(n=t.search(Zm)),n<0&&!oh.test(t)&&!ah.test(e.relativePath)&&ih.test(t)){let e=$m.exec(t);e!==null&&!eh.test(e[0])&&!th.test(e[0])&&!nh.test(e[0])&&!rh.test(e[0])&&(n=e.index)}if(n<0&&(n=ph(t,uh,ch,lh)),n<0)return[];let r=G(t,n);return[{message:`Code uses weak hashes, deprecated ciphers, timing-unsafe comparisons, or Math.random in a security-shaped context.`,line:r.line,column:r.column}]}}),hh=`(?<![A-Za-z0-9])(?:session|sess|sid|connect\\.sid|auth|jwt|access[_-]?token|refresh[_-]?token|id[_-]?token)(?![A-Za-z0-9])`,gh=`[\`"'][^\`"']*?${hh}[^\`"']*[\`"']`,_h=RegExp(`(?:\\.cookies\\.set|cookies\\(\\s*\\)\\.set|\\.cookie)\\s*\\(\\s*${gh}`,`gi`),vh=/httpOnly\s*:\s*false\b/i,yh=/"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'|`(?:[^`\\]|\\.)*`/g,bh=e=>{let t=e.split(``),n=0,r=null;for(;n<e.length;){let i=e[n];if(r!==null){if(i===`\\`){n+=2;continue}i===r?r=null:i!==`
+`&&(t[n]=` `),n+=1;continue}(i===`"`||i===`'`||i==="`")&&(r=i),n+=1}return t.join(``)},xh=/cookie\s*:\s*\{/gi,Sh=RegExp(`document\\.cookie\\s*=\\s*[\`"'][^\`"'=;]*?${hh}[^\`"'=;]*=`,`gi`),Ch=e=>{if(e.trim().length===0)return 0;let t=0,n=null,r=1;for(let i=0;i<e.length;i+=1){let a=e[i];if(n!==null){a===`\\`?i+=1:a===n&&(n=null);continue}a===`"`||a===`'`||a==="`"?n=a:a===`(`||a===`[`||a===`{`?t+=1:a===`)`||a===`]`||a===`}`?--t:a===`,`&&t===0&&(r+=1)}return r},wh=(e,t,n,r,i)=>{t.lastIndex=0;for(let a=t.exec(e);a!==null;a=t.exec(e)){if(!r(a.index,a[0]))continue;let t=G(e,a.index);i.push({message:n,line:t.line,column:t.column})}},Th=W({id:`insecure-session-cookie`,title:`Auth cookie missing HttpOnly protection`,severity:`warn`,recommendation:"Set auth/session cookies server-side with `httpOnly: true`, `secure: true`, and `sameSite`. Cookies set via `document.cookie` or with `httpOnly: false` are readable by any XSS payload and can be stolen.",scan:e=>{if(!K(e.relativePath))return[];let t=Ku(e);if(!/cookie/i.test(t))return[];let n=[],r=`An auth/session cookie is exposed to JavaScript (set via document.cookie, with httpOnly: false, or without cookie options), letting an XSS payload steal it.`;_h.lastIndex=0;for(let e=_h.exec(t);e!==null;e=_h.exec(t)){let i=e.index+e[0].lastIndexOf(`(`),a=wf(t,i);if(a<0)continue;let o=t.slice(i+1,a),s=Ch(o)<3,c=o.replace(yh,``);if(!s&&!vh.test(c))continue;let l=G(t,e.index);n.push({message:r,line:l.line,column:l.column})}let i=bh(t);xh.lastIndex=0;for(let e=xh.exec(i);e!==null;e=xh.exec(i)){let t=e.index+e[0].length-1,a=wf(i,t),o=a>=0?i.slice(t,a):i.slice(t,t+400);if(!vh.test(o))continue;let s=G(i,e.index);n.push({message:r,line:s.line,column:s.column})}return wh(t,Sh,r,()=>!0,n),n}}),Eh=/\b(?:alg|algorithms?)\s*:\s*\[?\s*["'`]none["'`]/gi,Dh=(e,t)=>{let n=null,r=[];for(let i=0;i<t;i+=1){let t=e[i];if(n==="`"){t===`\\`?i+=1:t==="`"?n=null:t===`$`&&e[i+1]===`{`&&(r.push(0),n=null,i+=1);continue}if(n!==null){t===`\\`?i+=1:t===n&&(n=null);continue}if(t===`"`||t===`'`||t==="`")n=t;else if(r.length>0){let e=r.length-1;t===`{`?r[e]+=1:t===`}`&&(r[e]===0?(r.pop(),n="`"):--r[e])}}return n!==null},Oh=W({id:`jwt-insecure-verification`,title:`JWT verified with the 'none' algorithm`,severity:`error`,recommendation:"Never accept the `none` algorithm; it disables signature verification and lets any forged token through. Pin the real algorithm(s) explicitly (`jwt.verify(token, key, { algorithms: ['RS256'] })`).",scan:e=>{if(!K(e.relativePath))return[];let t=Ku(e);if(!/\bjwt\b|jsonwebtoken|\bjose\b/i.test(t))return[];let n=[];Eh.lastIndex=0;for(let e=Eh.exec(t);e!==null;e=Eh.exec(t)){if(Dh(t,e.index))continue;let r=G(t,e.index);n.push({message:`JWT is configured with the 'none' algorithm, which disables signature verification, so any forged token is accepted.`,line:r.line,column:r.column})}return n}}),kh=/PRIVATE KEY|SSH_PRIVATE_KEY|GPG_PRIVATE_KEY|DEPLOY_KEY|SIGNING_KEY/i,Ah=W({id:`key-lifecycle-risk`,title:`Long-lived key material in repository`,severity:`error`,committedFilesOnly:!0,recommendation:`Remove private keys from source, rotate exposed credentials, prefer short-lived deploy credentials, and document revocation/expiry for release keys.`,scan:q({shouldScan:e=>!lu.test(e.relativePath)&&!pu.test(e.relativePath)&&kh.test(e.content),pattern:/(?<!(?:placeholder|example|sample|dummy|fake)[\s\S]{0,40})-----BEGIN (?:RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----(?:\s|\\r|\\n)*[A-Za-z0-9+/=][A-Za-z0-9+/=\s]{38,}(?![^-]{0,160}\.\.\.)|\b(?:SSH_PRIVATE_KEY|GPG_PRIVATE_KEY|DEPLOY_KEY|SIGNING_KEY)\b\s*[:=]\s*["'][^"'\n]{16,}["']/i,message:`Private or long-lived release key material appears in the repository.`})}),jh=W({id:`local-rpc-native-bridge-risk`,title:`Weak localhost native bridge boundary`,severity:`warn`,recommendation:`Use exact origin allowlists after URL parsing, per-request nonces, narrow methods, and never expose install/update commands to arbitrary web pages.`,scan:q({shouldScan:e=>K(e.relativePath),pattern:/\b(?:Access-Control-Allow-Origin|websocket|WebSocket|(?:127\.0\.0\.1|localhost)(?=[\s\S]{0,700}\b(?:UpdateApp|InstallApp)\b)|(?:127\.0\.0\.1|localhost)[\s\S]{0,350}\b(?:onmessage|message|request|req)\b)\b[\s\S]{0,700}(?:\b(?:UpdateApp|InstallApp|child_process)\b|(?<![.\w$])(?:exec(?:File)?(?:Sync)?|spawn(?:Sync)?)\s*\()/i,message:`Code appears to bridge browser code to localhost/native capabilities with weak origin or update/install checks.`})}),Mh=/\bfrom\s+["']@modelcontextprotocol\/sdk[^"']*["']|\bMcpServer\b|\bMcpAgent\b/,Nh=/@modelcontextprotocol\/sdk|\bMcpServer\b|\bMcpAgent\b/,Ph=/\bserver\.\s*tool\s*\(|\bregisterTool\s*\(|\bsetRequestHandler\s*\(\s*CallToolRequestSchema/,Fh=/\b(?:tool|registerTool|setRequestHandler)\b/,Ih=W({id:`mcp-tool-capability-risk`,defaultEnabled:!1,title:`MCP tool exposes dangerous capability`,severity:`warn`,recommendation:`MCP tool calls run with the connecting client's authority. Validate inputs, enforce per-tool authorization, and avoid raw filesystem/shell/network access where possible.`,scan:q({shouldScan:e=>K(e.relativePath)&&Nh.test(e.content)&&Fh.test(e.content)&&_u.test(e.content),pattern:Ph,requireAll:[Mh,_u],ignoreStringLiterals:!0,message:`An MCP tool/resource/prompt handler appears to expose file, shell, network, or code-execution capability.`})}),Lh=W({id:`mdx-ssr-execution-risk`,title:`Server-rendered MDX can execute code`,severity:`warn`,recommendation:`Use a constrained compiler for untrusted content, disable expressions/raw HTML, sandbox renderers, and avoid caching attacker-controlled output across tenants.`,scan:q({shouldScan:e=>K(e.relativePath),pattern:/(?:@mdx-js\/mdx|next-mdx-remote|\b(?:MDXRemote|compileMDX|evaluateMdx)\b)[\s\S]{0,700}\b(?:repo\b|customer|tenant|user[-_]?(?:content|markdown|mdx|input|provided|generated|submitted)|untrusted|searchParams|req\.|request\.|fetch\s*\(|prisma\.|db\.|database|rehypeRaw|allowDangerousHtml)/i,message:`MDX/markdown rendering code may evaluate user or repository content during SSR or static generation.`})}),Rh=W({id:`nosql-injection-risk`,title:`NoSQL query accepts operator-shaped input`,severity:`warn`,recommendation:"Coerce scalar fields before querying, reject operator keys from client input, and avoid `$where` or request-derived regexes.",scan:q({shouldScan:e=>Cu(e.relativePath,su),pattern:/\$where\s*['"]?\s*:\s*(?:f?['"`][^'"`]{0,200}\$\{|function|f['"])|\.find\s*\(\s*JSON\.parse\s*\(\s*(?:req|request)\.|\.aggregate\s*\(\s*\[?\s*\{[^}]{0,400}\$where|\bnew\s+RegExp\s*\(\s*(?:req|request)\.|\$regex['"]?\s*:\s*(?:req|request)\./i,message:"Code appears to pass raw JSON, regex, or `$where` style input into a NoSQL query."})}),zh=[...ld.filter(e=>!e.test(`service_role`)),ud],Bh=W({id:`package-metadata-secret`,title:`Secret-like package metadata`,severity:`warn`,recommendation:`Keep secrets out of package metadata and generated reports; they are often published to registries, logs, or browser artifacts.`,scan:e=>{if(!e.relativePath.endsWith(`package.json`))return[];let t=Ld(e.content)??zh.find(t=>t.test(e.content));if(t===void 0)return[];let n=nu(e.content,t);return[{message:`Package metadata contains secret-like values or public env secret names.`,line:n.line,column:n.column}]}}),Vh=W({id:`path-traversal-risk`,title:`Filesystem path uses caller input`,severity:`warn`,recommendation:`Resolve paths against a fixed base directory, reject traversal after normalization, and map user-visible identifiers to server-owned paths.`,scan:q({shouldScan:e=>K(e.relativePath)&&!hf(e.relativePath),pattern:/\b(?:readFile|readFileSync|writeFile|writeFileSync)\s*\(\s*(?:req\.|request\.|params\.|query\.|body\.|parsed\.|`[^`]*(?<![-./\w$'"`])(?:req\.|request\.|params\.|query\.|body\.))|\bpath\.(?:join|resolve)\s*\([^)]*(?<![-./\w$'"`])(?<!basename\(\s{0,4})(?:req\.|request\.|params\.|query\.|body\.|parsed\.)/,message:`Filesystem access appears to use request, query, params, or body data as part of the path.`})}),Hh=/\b(?:repoUrl|updateUrl|UpdateApp|InstallApp|auto.?updater?|installer|curl(?!\s+(?:-T\b|--upload-file\b))|wget)\b[\s\S]{0,250}(?:\.(?:zip|exe|dmg|appimage|msi|deb|rpm)\b|\.tar\.gz\b|\|\s*(?:bash|sh)\b)/i,Uh=/\b(?:curl|wget)\b(?=(?:[^\r\n]|\\\r?\n)*https?:\/\/)(?:[^\r\n]|\\\r?\n)*?\|\s*(?:bash|sh)\b/i,Wh=/sha(?:256|512|1)sum|--checksum|checksum=|EXPECTED_SHA|gpg\s+--verify|\.sha(?:256|512)\b/i,Gh=/\b(?:child_process|childProcess|execa|os\.system|subprocess\.|Deno\.run|autoUpdater|electron-updater)\b|\b(?:exec(?:File)?(?:Sync)?|spawn(?:Sync)?)\s*\(/,Kh=/.\/\.github\/workflows\//i,qh=/(?:^|\/)[\w-]+[.@-]\d+\.\d+\.\d+(?:[-.][\w.]+)?\//,Jh=e=>xu(e)&&!Kh.test(e)&&!qh.test(e)&&!fu.test(e),Yh=W({id:`plugin-update-trust-risk`,title:`Plugin or updater trust boundary risk`,severity:`warn`,recommendation:`Require signed updates/plugins, pin trusted repositories, verify hashes before execution, and keep custom repository installs behind explicit warnings.`,scan:e=>{if(!K(e.relativePath)&&!Jh(e.relativePath))return[];let t=Ku(e),n=Uh.test(t);if(!n&&!Hh.test(t))return[];let r=n?Uh:Hh;if(Wh.test(t)||au.test(e.relativePath)&&!Gh.test(t))return[];let i=nu(t,r);return[{message:`Code appears to download, install, update, or execute plugin/updater content across a trust boundary.`,line:i.line,column:i.column}]}}),Xh=/origin(?!al)|\.source\s*[!=]==?/i,Zh=/\b(?:event|e|evt|msg|message)\.data\b/,Qh=/\b(?:const|let|var)\s+[^;=]*=\s*$/,$h=/port\d?\b|worker|channel|broadcast|socket|\bws\b|\bsse\b|eventsource|^_?self\.|^source\./i,eg=String.raw`=\s*new\s+(?:EventSource|WebSocket|Worker|SharedWorker|BroadcastChannel|MessageChannel)\b`,tg=(e,t)=>{let n=/^[\w$]+/.exec(e)?.[0];return n===void 0?!1:RegExp(`(?<![\\w$.])${J(n)}\\s*${eg}`).test(t)},ng=(e,t)=>{let n=/^[\w$]+/.exec(e)?.[0];return n===void 0?!1:RegExp(`(?:^|[(,{;]\\s*)${J(n)}\\s*[?!]?\\s*:\\s*(?:Worker|SharedWorker|MessagePort|BroadcastChannel|WebSocket|EventSource)\\b`,`m`).test(t)},rg=/worker/i,ig=(e,t)=>{let n=X(t),r=Tf(t);return n<0||r<0?``:e.slice(n,r)},ag=(e,t)=>{if(t.type===`CallExpression`){let n=D(t.callee)?ig(e,t.callee):``;if(!n.endsWith(`addEventListener`))return null;let r=t.arguments[0];return D(r)&&r.type===`Literal`&&r.value===`message`?n:null}if(t.type===`AssignmentExpression`&&D(t.left)){let n=ig(e,t.left);return n.endsWith(`.onmessage`)?n:null}return null},og=W({id:`postmessage-origin-risk`,title:`postMessage handler without origin check`,severity:`warn`,recommendation:"Validate `event.origin` against an exact allowlist before using `event.data`, especially when an iframe or parent window can be attacker-controlled.",scan:e=>{if(!K(e.relativePath)||rg.test(e.relativePath))return[];let t=e.content.includes(`onmessage`),n=e.content.includes(`addEventListener`)&&(e.content.includes(`message`)||e.content.includes(`\\`));if(!t&&!n)return[];let r=_n({filename:e.absolutePath,sourceText:e.content,shouldAttachParentReferences:!1});if(r===null)return[];let i=[];return z(r,t=>{let n=ag(e.content,t);if(n===null||$h.test(n)||tg(n,e.content)||ng(n,e.content))return;let r=ig(e.content,t),a=r.search(Zh);if(a<0)return;let o=r.search(Xh);if(o>=0&&(Qh.test(r.slice(0,a))||o<a))return;let s=G(e.content,X(t));i.push({message:`A message event handler reads cross-window messages without an obvious origin check.`,line:s.line,column:s.column})}),i}}),sg=/(?:^|\/)(?:locales?|i18n|lang|langs|translations?)\//i,cg=/(?:^|\/)(?:\.env(?:\.[^/]*)?|(?:debug|crash|trace|stack[-_]?trace|report|dump|phpinfo)(?:[-_.][^/]*)?\.(?:txt|log|json|html?)|[^/]+\.log)$/i,lg=e=>bu(e,hu.test(e))&&!sg.test(e)&&cg.test(e),ug=W({id:`public-debug-artifact`,title:`Public debug artifact`,severity:`warn`,recommendation:`Remove debug artifacts from public output; logs and dumps often reveal source paths, internal routes, tokens, or environment snapshots.`,scan:e=>{if(!lg(e.relativePath))return[];let t={message:`A browser-reachable debug, log, dump, report, or env artifact is present.`,line:1,column:1};return[ld.some(t=>t.test(e.content))?{...t,severity:`error`}:t]}}),dg=/(?:^|\/)docs?\//i,fg=W({id:`public-env-secret-name`,title:`Secret-like public env variable`,severity:`warn`,recommendation:`Public env prefixes are inlined into browser bundles. Rename public values to non-secret names, and keep tokens, passwords, private keys, and service-role credentials server-only.`,scan:e=>{if(!km(e.relativePath)||dg.test(e.relativePath))return[];let t=Ld(e.content);if(t===void 0)return[];let n=nu(e.content,t);return[{message:`Client code references a public env variable whose name looks like a secret or privileged credential.`,line:n.line,column:n.column}]}}),pg=`(?:"[^"\\n]{0,200}"|'[^'\\n]{0,200}'|\`[^\`$]{0,200}\`)`,mg=`\\s*\\(?\\s*(?:${pg}|(?:[\\w\$]+(?:\\.[\\w\$]+)*\\.escape(?:Id|Literal|Identifier)|(?:[\\w\$]+\\.)*(?:connection|conn|client|pool|db|mysql|sqlstring|knex)\\.escape)\\s*\\([^()]{0,200}\\))\\s*\\)?`,hg=W({id:`raw-sql-injection-risk`,title:`Raw SQL built outside parameter binding`,severity:`warn`,recommendation:`Keep user input in driver parameters or ORM bind variables. Avoid unsafe/raw SQL helpers and string interpolation for queries.`,scan:q({shouldScan:e=>gf(e.relativePath),pattern:[/\$queryRawUnsafe\s*\(/,/\$executeRawUnsafe\s*\(/,/\bPrisma\.raw\s*\((?!\s*(?:["'][^"'\n]*["']\s*[,)]|`[^`$]*`))/,/\bsql\.\s*(?:raw|unsafe)\s*\((?!\s*(?:["'][^"'\n]*["']\s*[,)]|`[^`$]*`))/,/\b(?:client|pool|conn)\.query\s*\(\s*['"`]\s*(?:SELECT|INSERT|UPDATE|DELETE)\b[^)]{0,400}\$\{(?!\s*[\w$.]*(?:sanitiz|escape|quote)[\w$]*\s*\()/i,RegExp(`\\.query\\s*\\(\\s*${pg}(?:\\s*\\+${mg})*\\s*\\+(?!${mg})`,`i`),/\.(?:where|orderBy|having)Raw\s*\((?!\s*(?:["'][^"'\n]*["']\s*[,)]|`[^`$]*`))/,/\bcursor\.execute\s*\(\s*f['"]/,/\bcursor\.execute\s*\(\s*(?:"[^"]{0,400}"|'[^']{0,400}')\s*(?:%|\.format\s*\(|\+)/,/\b(?:engine|session)\.execute\s*\(\s*(?:text\s*\(\s*)?f['"]/,/\$[\w]+->(?:query|exec|prepare|executeQuery|executeStatement|createQuery|createNativeQuery)\s*\(\s*(?:"[^"]{0,400}"|'[^']{0,400}')\s*\.\s*\$/,/mysqli_query\s*\(\s*[^,]+,\s*(?:"[^"]{0,400}"|'[^']{0,400}')\s*\.\s*\$/],message:`Code uses a raw SQL escape hatch or string-built query shape that can bypass parameter binding.`})}),gg=e=>iu.test(e)||/(?:^|\/)\.npmrc$/.test(e)||/(?:^|\/)[^/]*(?:credential|credentials|service-account|serviceAccount|firebase-admin|google-service-account|gcp-service-account)[^/]*\.(?:json|env|pem|key)$/i.test(e),_g=e=>/(?:^|\/)\.env(?:\.[^./]+)*\.(?:example|sample|template|dist|defaults?)$|(?:^|\/)[^/]*(?:example|sample|template)[^/]*\.(?:env|json|pem|key)$/i.test(e),vg=W({id:`repository-secret-file`,title:`Secret file checked into repository`,severity:`error`,committedFilesOnly:!0,recommendation:`Remove committed env files, service-account credentials, npm auth tokens, and webhook URLs; rotate exposed values and keep only redacted examples in source.`,scan:e=>{if(!gg(e.relativePath)||_g(e.relativePath)||lu.test(e.relativePath))return[];let t=ld.find(t=>t.test(e.content))??Ld(e.content);if(t===void 0)return[];let n=nu(e.content,t);return[{message:`A repository credential/config file contains secret-looking values.`,line:n.line,column:n.column}]}}),yg=`(?:req|request|ctx\\.req|ctx\\.request)\\.(?:body|query|params)|await\\s+(?:req|request)\\.json\\(\\s*\\)`,bg=W({id:`request-body-mass-assignment`,title:`Request input spread without field allowlist`,severity:`warn`,recommendation:"Assign explicit, allowlisted fields (or validate with a strict schema and no `.passthrough()`) instead of spreading/merging request input. Otherwise the client can set ownership, role, or price columns (mass assignment) or pollute the prototype.",scan:q({shouldScan:e=>K(e.relativePath),pattern:[RegExp(`\\.\\.\\.\\s*(?:${yg})`,`i`),RegExp(`(?:Object\\.assign\\s*\\(|_\\.(?:merge|mergeWith|defaultsDeep)\\s*\\(|(?:^|[^.\\w])(?:merge|defaultsDeep)\\s*\\()[\\s\\S]{0,80}?(?:${yg})`,`i`)],message:`Request input is spread or merged into an object without a field allowlist, enabling mass assignment (client-set owner/role/price fields) or prototype pollution.`})}),xg=W({id:`secret-in-fallback`,title:`Hardcoded secret fallback for env var`,severity:`error`,recommendation:"Remove the literal fallback and fail closed (throw when the variable is unset). The hardcoded value is a committed secret, and the `??`/`||` default makes the app run with it in any environment that forgot to set the var.",scan:q({shouldScan:e=>K(e.relativePath),pattern:/\bprocess\.env\.(?!(?:(?:(?:NEXT|EXPO|GATSBY|NUXT|REACT_APP|VITE)_)?PUBLIC_[A-Z0-9_]*(?<!_SECRET)(?<!_PRIVATE_KEY)(?<!_PASSWORD)(?<!_PASSWD)|[A-Z0-9_]*(?:PUBLISHABLE|ANON)_KEY)(?![A-Z0-9_]))[A-Z][A-Z0-9_]*(?:SECRET|TOKEN|PASSWORD|PASSWD|PRIVATE_KEY|API_?KEY|APIKEY|ACCESS_KEY|CLIENT_SECRET|CREDENTIAL|SIGNING_KEY|ENCRYPTION_KEY|WEBHOOK_SECRET|SERVICE_ROLE)[A-Z0-9_]*(?<!_(?:NAME|HEADER|ENDPOINT|URL|URI|ID|PREFIX|SUFFIX|PARAM|PARAMS|FIELD|ISSUER|AUDIENCE|ALGORITHM|ALG|REGION|BUCKET|HOST|HOSTNAME|PORT|PATH|VERSION|SCOPE|TYPE|FORMAT|EXPIRY|TTL))\s*(?:\?\?|\|\|)\s*(["'`])(?![0-9]+["'`])(?![a-z][a-z0-9]*(?:[_-][a-z0-9]+)*[_-](?:token|secret|key|password|passwd|credential)s?["'`])(?![\w-]{0,12}0{8,}["'`])(?!test test test test test test test test test test test junk["'`])(?!(?:changeme|change[_-]?me|placeholder|your[_-]|example|sample|dummy|development|local|todo|replace[_-]?me|https?:\/\/|x{3,}|\*{3,}))[^"'`\n]{8,}\1/i,message:`A secret env var has a hardcoded string fallback: the literal is a committed secret and the app fails open (uses it) when the variable is unset.`})}),Sg=(e,t)=>{let n=null;if(b(e,`Program`)?n=e.body:(b(e,`FunctionDeclaration`)||b(e,`FunctionExpression`)||b(e,`ArrowFunctionExpression`))&&b(e.body,`BlockStatement`)&&(n=e.body.body),n===null)return!1;for(let e of n){if(!b(e,`ExpressionStatement`)||e.directive===void 0)return!1;if(e.directive===t)return!0}return!1},Cg=(e,t=`source.tsx`)=>{let n=_n({filename:t,sourceText:e,shouldAttachParentReferences:!1});return n===null?!1:Sg(n,`use server`)},wg=q({shouldScan:e=>km(e.relativePath),pattern:/\b(?:ownerId|ownerID|creatorId|creatorID|userId|userID|uid|providerId|providerID|orgId|orgID|tenantId|tenantID|teamId|teamID|workspaceId|workspaceID|ghostOrg|role|roles|isAdmin|admin)\b/,requireAll:[/\b(?:supabase\b|\.from\s*\(\s*["'][^"']+["']\s*\))[\s\S]{0,700}\b(?:insert|upsert|update)\s*\(\s*(?:\{|\[?\s*\{)[\s\S]{0,700}\b(?:ownerId|creatorId|userId|orgId|tenantId|role|isAdmin)\b/i],message:`Client Supabase code appears to write user, tenant, owner, or role fields that should be enforced by RLS.`}),Tg=W({id:`supabase-client-owned-authz-field`,title:`Client writes Supabase authorization field`,severity:`error`,recommendation:"Use RLS policies based on `auth.uid()` and server-owned membership rows; do not trust client-provided owner, org, or role columns.",scan:e=>{let t=wg(e);return t.length===0?t:Cg(e.content,e.relativePath)?[]:t}}),Eg=e=>/(?:^|\/)supabase\/(?:migrations|schemas)\//.test(e),Dg=e=>e.endsWith(`.sql`)||Eg(e),Og=/^\$[A-Za-z_]?\w*\$/,kg=new Set([`do`,`plpgsql`,`sql`,`plpython3u`,`plpythonu`,`plperl`,`plperlu`,`plv8`]),Ag=(e,t)=>{let n=t-1;for(;n>=0&&/\s/.test(e[n]??``);)--n;let r=n;for(;r>=0&&/[A-Za-z0-9_]/.test(e[r]??``);)--r;return e.slice(r+1,n+1).toLowerCase()},jg=(e,t,n,r)=>{let i=n,a=!1;for(;i<r;){let n=e[i];if(n===`;`){a=!1,i+=1;continue}if(/[A-Za-z_]/.test(n)){let t=i;for(;t<r&&/[A-Za-z0-9_]/.test(e[t]??``);)t+=1;e.slice(i,t).toLowerCase()===`execute`&&(a=!0),i=t;continue}if(n===`'`){let n=a;for(n||(t[i]=` `),i+=1;i<r;){if(e[i]===`'`){if(e[i+1]===`'`){n||(t[i]=` `,t[i+1]=` `),i+=2;continue}n||(t[i]=` `),i+=1;break}!n&&e[i]!==`
 `&&(t[i]=` `),i+=1}continue}if(n===`"`){for(i+=1;i<r;){if(e[i]===`"`){if(e[i+1]===`"`){i+=2;continue}i+=1;break}i+=1}continue}if(n===`-`&&e[i+1]===`-`){for(;i<r&&e[i]!==`
 `;)t[i]=` `,i+=1;continue}if(n===`/`&&e[i+1]===`*`){for(;i<r;){if(e[i]===`*`&&e[i+1]===`/`){t[i]=` `,t[i+1]=` `,i+=2;break}e[i]!==`
-`&&(t[i]=` `),i+=1}continue}i+=1}},jg=e=>{let t=e.split(``),n=0;for(;n<e.length;){let r=e[n];if(r===`-`&&e[n+1]===`-`){for(;n<e.length&&e[n]!==`
+`&&(t[i]=` `),i+=1}continue}i+=1}},Mg=e=>{let t=e.split(``),n=0;for(;n<e.length;){let r=e[n];if(r===`-`&&e[n+1]===`-`){for(;n<e.length&&e[n]!==`
 `;)t[n]=` `,n+=1;continue}if(r===`/`&&e[n+1]===`*`){for(;n<e.length;){if(e[n]===`*`&&e[n+1]===`/`){t[n]=` `,t[n+1]=` `,n+=2;break}e[n]!==`
 `&&(t[n]=` `),n+=1}continue}if(r===`'`){for(t[n]=` `,n+=1;n<e.length;){if(e[n]===`'`){if(e[n+1]===`'`){t[n]=` `,t[n+1]=` `,n+=2;continue}t[n]=` `,n+=1;break}e[n]!==`
-`&&(t[n]=` `),n+=1}continue}if(r===`$`){let r=Dg.exec(e.slice(n));if(r!==null){let i=r[0],a=e.indexOf(i,n+i.length),o=a<0?e.length:a+i.length,s=kg(e,n);if(Og.has(s))Ag(e,t,n+i.length,o);else for(let r=n;r<o;r+=1)e[r]!==`
-`&&(t[r]=` `);n=o;continue}}if(r===`"`){for(n+=1;n<e.length;){if(e[n]===`"`){if(e[n+1]===`"`){n+=2;continue}n+=1;break}n+=1}continue}n+=1}return t.join(``)},Mg=/disable\s+row\s+level\s+security/i,Ng=/auth\.role\(\)\s*=\s*["']service_role["']/i,Pg=/create\s+policy/gi,Fg=/;|create\s+policy/i,Ig=/\b(?:using|with\s+check)\s*\(\s*true\s*\)/i,Lg=/\bfor\s+select\b/i,Rg=/\bto\s+([\s\S]+?)(?=\s+(?:using|with\s+check|as|for)\b|;|$)/i,zg=new Set([`service_role`,`postgres`,`supabase_admin`]),Bg=e=>{let t=Rg.exec(e);if(t===null)return!1;let n=t[1].split(`,`).map(e=>e.trim().replace(/["'`]/g,``).toLowerCase()).filter(Boolean);return n.length>0&&n.every(e=>zg.has(e))},Vg=(e,t)=>Ng.test(t)?!0:!Ig.test(e)||Lg.test(e)?!1:!Bg(e),Hg=W({id:`supabase-rls-policy-risk`,title:`Permissive Supabase RLS policy`,severity:`error`,recommendation:"Keep public-read policies explicit, but gate inserts, updates, deletes, and service-role bypasses behind `auth.uid()` plus trusted tenant membership.",scan:e=>{if(!Eg(e.relativePath))return[];let t=jg(e.content),n=t.search(Mg);Pg.lastIndex=0;for(let r=Pg.exec(t);r!==null;r=Pg.exec(t)){let i=r.index+r[0].length,a=t.slice(i).search(Fg),o=a<0?t.length:i+a;if(Vg(t.slice(r.index,o),e.content.slice(r.index,o))){(n<0||r.index<n)&&(n=r.index);break}}if(n<0)return[];let{line:r,column:i}=G(t,n);return[{message:`Supabase policy SQL disables RLS, permits writes broadly, or references a service-role bypass.`,line:r,column:i}]}}),Ug=/create\s+(?:unlogged\s+)?table\s+(?:if\s+not\s+exists\s+)?(?!["`]?(?:auth|storage|realtime|vault|extensions|graphql|graphql_public|pgbouncer|net|supabase_functions|supabase_migrations|cron|pgsodium|pgmq|information_schema|pg_catalog|pg_temp|private|internal)["`]?\s*\.)(?:["`]?public["`]?\s*\.\s*)?["`]?([A-Za-z_][\w$]*)["`]?(?:\s*\(|\s+as\b)/gi,Wg=/alter\s+table\s+(?:if\s+exists\s+)?(?:only\s+)?(?:["`]?public["`]?\s*\.\s*)?["`]?([A-Za-z_][\w$]*)["`]?\s+(?:force\s+)?enable\s+row\s+level\s+security/gi,Gg=/\benable\s+row\s+level\s+security\b/gi,Kg=e=>{let t=new Map,n=0;for(let r of e.matchAll(Wg)){let e=r[1];e!==void 0&&(n+=1,t.set(e.toLowerCase(),r.index))}return{lastEnableIndexByTable:t,staticEnableCount:n}},qg=(e,t)=>(e.match(Gg)?.length??0)>t,Jg=W({id:`supabase-table-missing-rls`,title:`Supabase table created without Row Level Security`,severity:`error`,recommendation:"Enable RLS in the same migration (`alter table <name> enable row level security;`) and add `auth.uid()`-scoped policies for select/insert/update/delete. A public table without RLS is fully readable and writable with the public anon key.",scan:e=>{if(!Tg(e.relativePath))return[];let t=jg(e.content);if(!/create\s+(?:unlogged\s+)?table/i.test(t))return[];let n=[],{lastEnableIndexByTable:r,staticEnableCount:i}=Kg(t);if(qg(t,i))return[];Ug.lastIndex=0;for(let e=Ug.exec(t);e!==null;e=Ug.exec(t)){let i=e[1];if(i===void 0)continue;let a=r.get(i.toLowerCase());if(a!==void 0&&a>=e.index)continue;let o=G(t,e.index);n.push({message:`Supabase migration creates a public table but never enables Row Level Security, leaving every row exposed to the anon key.`,line:o.line,column:o.column})}return n}}),Yg=W({id:`svg-filter-clickjacking-risk`,title:`SVG-filtered iframe clickjacking primitive`,severity:`warn`,recommendation:"Avoid filtering cross-origin iframes. Use `frame-ancestors` on sensitive pages and keep SVG filters away from embedded privileged UI.",scan:q({shouldScan:e=>K(e.relativePath),pattern:/<iframe\b(?:=>|[^>]){0,300}\bfilter\s*:\s*["']?url\(#|filter\s*:\s*url\(#[\s\S]{0,700}<iframe\b|<fe(?:DisplacementMap|ColorMatrix|Composite|Tile|Morphology)\b[\s\S]{0,700}<iframe\b/i,message:`An iframe is rendered through an SVG/CSS filter, which can support advanced clickjacking or visual exfiltration tricks.`})}),Xg=e=>K(e)?su.test(e)?!0:/(?:^|\/)(?:middleware|route)\.[cm]?[jt]sx?$/.test(e):!1,Zg=W({id:`tenant-static-proxy-risk`,title:`Tenant-controlled static asset proxy`,severity:`warn`,recommendation:`Bind tenant identity to the trusted host or authenticated org, canonicalize after decoding, reject traversal, and never let one tenant choose another tenant's asset prefix.`,scan:q({shouldScan:e=>Xg(e.relativePath),pattern:/\b(?:fetch|path\.join|getObject\w*|GetObjectCommand|getSignedUrl|createReadStream)\s*\([^;]{0,200}(?:\$\{[^}]{0,100}\b(?:tenant|subdomain|workspace|hostPattern|(?<!\.)organization(?:Id|Slug)?)\b|\b(?:tenant|subdomain|workspace)(?:Id|Slug|Name)?\b\s*[,)+\].])/i,message:`Route code appears to compose tenant or subdomain input into a static/CDN/object-store fetch path.`})}),Qg=[/dangerouslySetInnerHTML\s*=\s*\{\{\s*__html\s*:[\s\S]{0,300}?\bJSON\.stringify\s*\(/gi,/<script\b[^>]*>(?:(?!<\/script>)[\s\S]){0,300}?\bJSON\.stringify\s*\(/gi],$g=/\$\{|["'`]\s*\+\s*$/,e_=/^\s*\{(?!\{)/,t_=/"(?:[^"\\\n]|\\.)*"|'(?:[^'\\\n]|\\.)*'/g,n_=/\b(?:true|false|null)\b|[\d.]+(?:e[+-]?\d+)?/gi,r_=e=>{if(e.includes("`")||e.includes("${"))return!1;let t=e.replace(t_,``).replace(n_,``);return!/[A-Za-z_$]/.test(t)},i_=/^[\s)]*\.replace\s*\([^)]*(?:\\u003[cC]|&lt;|<)/,a_=/^[\s)]*\.replaceAll\s*\(\s*["']<["']\s*,\s*["'](?:\\u003[cC]|&lt;)["']\s*\)/,o_=/(?:\b(?:escapeHtml|escapeJSON|escapeJson|htmlEscape|jsesc)|(?<![.\w])(?:serialize|serializeJavascript|devalue|uneval|superjson))\s*\(\s*$/i,s_=/\bJSON\.stringify\s*\($/i,c_=W({id:`unsafe-json-in-html`,title:`Unescaped JSON in HTML or script sink`,severity:`warn`,recommendation:'JSON.stringify does not HTML-escape, so a `<\/script>` (or `<`) in the data breaks out and becomes XSS. Use an HTML-safe serializer (serialize-javascript, devalue) or escape `<`, `>`, and `&`, or pass data via a JSON `<script type="application/json">` read with JSON.parse.',scan:e=>{if(!K(e.relativePath))return[];let t=Gu(e);if(!t.includes(`JSON.stringify`))return[];let n=[],r=new Set;for(let[e,i]of Qg.entries()){i.lastIndex=0;for(let a=i.exec(t);a!==null;a=i.exec(t)){let i=a[0].replace(s_,``);if(o_.test(i))continue;if(e===1){let e=t.indexOf(`>`,a.index),n=a[0].search(/\bJSON\.stringify\s*\($/i);if(e>=0&&n>=0){let r=t.slice(e+1,a.index+n);if(!$g.test(r)||e_.test(r))continue}}let o=a.index+a[0].length-1,s=Cf(t,o);if(s>=0){let e=t.slice(s+1,s+1+160);if(i_.test(e)||a_.test(e)||r_(t.slice(o+1,s)))continue}if(r.has(a.index))continue;r.add(a.index);let c=G(t,a.index);n.push({message:"JSON.stringify is embedded in HTML/script markup without HTML-escaping; data containing `<\/script>` or `<` breaks out and becomes XSS.",line:c.line,column:c.column})}}return n}}),l_=/(?:(?<![.\w$])fetch|\baxios\.\s*(?:get|post|put|delete|head)|\bgot|\bgot\.\s*(?:get|post))\s*\(\s*([^,)]+)/,u_=/\b(?:url|targetUrl|callbackUrl|redirectUrl|webhookUrl|companyUrl|websiteUrl|domainUrl|imageUrl|fetchUrl|next|return_to|returnTo|destination|location)\b/i,d_=/\breq\.|\brequest\.(?:query|body|params|nextUrl)|\bsearchParams\b|\bparams\.|\bbody\.|\bquery\./,f_=/\bredirect\s*:\s*["'](?:manual|error)["']/,p_=/\b(params|body|query)\./g,m_=(e,t)=>RegExp(`(?:const|let|var)\\s+${e}\\s*(?::[^=;\\n]{0,80})?=\\s*new\\s+URLSearchParams\\b`).test(t),h_=(e,t)=>{let n=e.replace(p_,(e,n)=>m_(n,t)?``:e);return d_.test(n)},g_=(e,t)=>{if(h_(e,t))return!0;let n=/^[\w$]+$/.exec(e.trim());if(n===null)return!1;let r=RegExp(`(?:const|let|var)[^=;\\n]{0,80}\\b${n[0]}\\b[^=;\\n]{0,80}=([^;\\n]*)`,`g`);for(let e of t.matchAll(r)){let n=e[1]??``;if(/\breq\.|\brequest\.|\bsearchParams\b|\$_(?:GET|POST|REQUEST)/.test(n)||h_(n,t))return!0}return!1},__=W({id:`untrusted-redirect-following`,title:`Server fetch follows redirects for caller-shaped URL`,severity:`warn`,recommendation:'Use `redirect: "manual"` or equivalent and re-validate every redirect target before following it to avoid SSRF redirect bypasses.',scan:e=>{if(!Xg(e.relativePath)||!l_.test(e.content))return[];let t=[],n=e.content.split(`
-`);for(let r=0;r<n.length;r+=1){let i=n[r]??``,a=i.match(l_),o=a?.[1]??``;if(!a||!u_.test(o)||!g_(o,e.content))continue;let s=n.slice(r,r+5).join(`
-`);f_.test(s)||t.push({message:`Server-side fetch code appears to follow redirects for a URL shaped like caller-controlled input.`,line:r+1,column:i.search(/\S/)+1})}return t}}),v_=W({id:`url-prefilled-privileged-action`,title:`URL pre-fills a privileged action`,severity:`warn`,recommendation:`Require server-side validation and explicit confirmation for URL-sourced invite, role, permission, redirect, or sharing parameters.`,scan:q({shouldScan:e=>Om(e.relativePath),pattern:/(?<!(?:safe|valid|sanitiz|relativ|allowlist|whitelist|parse|normaliz)[\w$]*\(\s*(?:new\s+)?(?:[\w$]+\s*\.\s*){0,4})\b(?:searchParams|useSearchParams\s*\(\s*\)|URLSearchParams\s*\([^)]{0,120}\))(?:[?!])?\.get(?:All)?\s*\(\s*["'](?:userstoinvite|role|permission|sharingaction|invite|admin|next|continue|returnTo|redirect_uri|callbackUrl)["']|\bsearchParams\.(?:userstoinvite|role|permission|sharingaction|invite|admin|returnTo|redirect_uri|callbackUrl)\b/i,message:`Client code reads sensitive action state from the URL, which can pre-fill invites, roles, redirects, or sharing flows with attacker values.`})}),y_=/(?:^|\/)[^/]*webhook[^/]*\/|(?:^|\/)[^/]*webhook[^/]*\.[cm]?[jt]s$|\bwebhook\b/i,b_=/\b(?:export\s+(?:async\s+)?function\s+POST|export\s+const\s+(?:POST|handler|webhook)|webhookHandler|webhookRoute)\b/i,x_=RegExp(`verifySignature|verify.*signature|verify\\w*(?:Webhook|Auth)|constructEvent|createHmac|timingSafeEqual|svix|webhookSecret|stripe\\.webhooks|["'][\\w-]*signature["']|\\b[A-Za-z]{0,40}(?:verif|valid|check|assert|authenticat|compare|guard)[A-Za-z]{0,40}(?:secret|signature|hmac|webhook|digest)[A-Za-z]{0,40}\\s*\\(`,`i`),S_=/webhook[\s_-]?ur[il]\w*/gi,C_=/process\.env\.\w*WEBHOOK_URL|\b(?:send|post|dispatch|publish|notify)\w*Webhook/,w_=/\b(?:req|request)\b/,T_=/\/\/[^\n]*|\/\*[\s\S]*?\*\/|"(?:\\.|[^"\\\n])*"|'(?:\\.|[^'\\\n])*'|`(?:\\.|[^`\\])*`/g,E_=W({id:`webhook-signature-risk`,title:`Webhook handler lacks signature verification`,severity:`warn`,recommendation:`Verify provider signatures before parsing or acting on webhook bodies. Use provider SDK helpers or HMAC verification with timing-safe comparison.`,scan:q({shouldScan:e=>{if(!K(e.relativePath)||C_.test(e.content))return!1;let t=e.content.replace(T_,``).replace(S_,``);return y_.test(e.relativePath)||y_.test(t)},pattern:b_,requireAll:[w_],suppressWhen:x_,message:`Webhook handler code does not show an obvious signature verification step.`})}),D_=/\.[cm]?[jt]sx?$/i,O_=/\.d\.[cm]?[jt]s$/i,k_=/\.mdx$/i,A_=/\.html?$/i,j_=new Set([`.angular`,`.astro`,`.cache`,`.contentlayer`,`.docusaurus`,`.expo`,`.git`,`.next`,`.nuxt`,`.output`,`.svelte-kit`,`.turbo`,`.vercel`,`build`,`coverage`,`dist`,`node_modules`,`out`,`storybook-static`]),M_=new WeakMap,N_=e=>{let t=M_.get(e);if(t)return t;let n=A(e);return M_.set(e,n),n},P_=t=>{let r=[],i=[],a=[t],o=!1;for(;a.length>0;){let t=a.pop();if(!t)continue;let s;try{s=e.readdirSync(t,{withFileTypes:!0})}catch{return null}for(let e of s){let s=n.join(t,e.name),c=j_.has(e.name)||e.name.startsWith(`.`)&&e.name!==`.dumi`&&e.name!==`.storybook`;if(!(e.isSymbolicLink()&&c)){if(e.isSymbolicLink())return null;if(e.isDirectory()){if(c)continue;a.push(s);continue}if(!(!e.isFile()||Pl(s))){if(k_.test(e.name)){o=!0;continue}if(A_.test(e.name)){i.push(eo(s));continue}D_.test(e.name)&&(O_.test(e.name)||r.push(eo(s)))}}}}return{sourceFilePaths:r,htmlFilePaths:i,hasOpaqueMdxConsumerSurface:o}},F_=(t,n)=>{for(let r of t){let t;try{t=e.readFileSync(r,`utf8`)}catch{return!0}for(let e of n)if(t.includes(`"${e}"`)||t.includes(`'${e}'`))return!0}return!1},I_=e=>{if(b(e,`ImportDeclaration`))return pl(e)?null:typeof e.source.value==`string`?e.source.value:null;if(b(e,`ExportNamedDeclaration`))return e.exportKind===`type`||fl(e.specifiers,`ExportSpecifier`,`exportKind`)?null:e.source&&typeof e.source.value==`string`?e.source.value:null;if(b(e,`ExportAllDeclaration`))return e.exportKind===`type`?null:typeof e.source.value==`string`?e.source.value:null;if(b(e,`ImportExpression`))return b(e.source,`Literal`)&&typeof e.source.value==`string`?e.source.value:null;if(b(e,`CallExpression`)&&b(e.callee,`Identifier`)&&e.callee.name===`require`&&e.arguments.length===1){let t=e.arguments[0];return t&&b(t,`Literal`)&&typeof t.value==`string`?t.value:null}return null},L_=(e,t,n,r)=>{z(e.programNode,i=>{let a=I_(i);if(!a)return;let o=ir(e.filePath,a);if(!o){r.add(a);return}let s=eo(o);n.set(i,s);let c=t.get(s)??new Set;c.add(e),t.set(s,c)})},R_=({rootDirectory:e,currentFilePath:t,currentProgramNode:n,currentScopes:r,requiredModuleSources:i=[],knownModuleSources:a})=>{if(i.length>0&&a!==void 0&&!i.some(e=>a.includes(e)))return null;let o=P_(e);if(!o||i.length>0&&a===void 0&&!F_(o.sourceFilePaths,i))return null;let s=new Map;for(let e of o.sourceFilePaths){if(e===t){s.set(e,{filePath:e,programNode:n,scopes:r});continue}let i=bn(e);if(!i||!b(i,`Program`))return null;s.set(e,{filePath:e,programNode:i,scopes:N_(i)})}let c=new Map,l=new WeakMap,u=new Set;for(let e of s.values())L_(e,c,l,u);return{modulesByFilePath:s,htmlFilePaths:o.htmlFilePaths,consumerModulesByFilePath:c,resolvedSourcePathByNode:l,unresolvedRuntimeSources:u,hasOpaqueMdxConsumerSurface:o.hasOpaqueMdxConsumerSurface}},z_=e=>{if(!e)return null;let t=w(e);return!b(t,`Literal`)||typeof t.value!=`boolean`?null:t.value},B_=(e,t,n={})=>{let r=n.maximumConstAliases===void 0?4:n.maximumConstAliases,i=n.shouldFoldStaticConditions??!1,a=n.shouldKeepKnownValues??!1,o=[],s=[{expression:e,remainingConstAliases:r,resolvingSymbols:new Set}];for(;s.length>0;){let e=s.pop();if(!e)continue;let n=w(e.expression);if(b(n,`Literal`)){if(typeof n.value!=`string`){if(a)continue;return null}o.push(n.value);continue}if(b(n,`TemplateLiteral`)){let e=Gt(n);if(e===null){if(a)continue;return null}o.push(e);continue}if(b(n,`ConditionalExpression`)){let t=i?z_(n.test):null;if(t!==null){s.push({expression:t?n.consequent:n.alternate,remainingConstAliases:e.remainingConstAliases,resolvingSymbols:e.resolvingSymbols});continue}s.push({expression:n.alternate,remainingConstAliases:e.remainingConstAliases,resolvingSymbols:new Set(e.resolvingSymbols)}),s.push({expression:n.consequent,remainingConstAliases:e.remainingConstAliases,resolvingSymbols:new Set(e.resolvingSymbols)});continue}if(a&&b(n,`LogicalExpression`)&&(n.operator===`??`||n.operator===`||`)){s.push({expression:n.right,remainingConstAliases:e.remainingConstAliases,resolvingSymbols:new Set(e.resolvingSymbols)}),s.push({expression:n.left,remainingConstAliases:e.remainingConstAliases,resolvingSymbols:new Set(e.resolvingSymbols)});continue}if(b(n,`Identifier`)){let r=t.referenceFor(n)?.resolvedSymbol;if(!r||r.kind!==`const`||!r.initializer||!b(r.declarationNode,`VariableDeclarator`)||r.declarationNode.id!==r.bindingIdentifier||e.remainingConstAliases===0||e.resolvingSymbols.has(r)){if(a)continue;return null}e.resolvingSymbols.add(r),s.push({expression:r.initializer,remainingConstAliases:e.remainingConstAliases===null?null:e.remainingConstAliases-1,resolvingSymbols:e.resolvingSymbols});continue}if(!a)return null}return o.length>0?o:null},V_=(e,t,n={})=>B_(e,t,n),H_=(e,t)=>B_(e,t,{shouldKeepKnownValues:!0}),U_=(e,t,n,r,i=!1)=>{let a=e.value;return a?b(a,`Literal`)?typeof a.value==`string`?[a.value]:null:b(a,`JSXExpressionContainer`)?V_(a.expression,t,{maximumConstAliases:n,shouldFoldStaticConditions:r,shouldKeepKnownValues:i}):null:null},W_=(e,t)=>U_(e,t,4,!1),G_=(e,t)=>U_(e,t,null,!0),K_=(e,t)=>U_(e,t,4,!1,!0),q_=(e,t)=>{let r=n.relative(t,e);return r===``||!r.startsWith(`..${n.sep}`)&&r!==`..`&&!n.isAbsolute(r)},J_={attribute:null,expression:null,isPresent:!1,isUnknown:!1},Y_={attribute:null,expression:null,isPresent:!1,isUnknown:!0},X_=(e,t,n)=>{for(let r=e.properties.length-1;r>=0;--r){let i=e.properties[r];if(!i)return Y_;if(b(i,`SpreadElement`)){if(!b(i.argument,`ObjectExpression`))return Y_;let e=X_(i.argument,t,n);if(e.isPresent||e.isUnknown)return e;continue}if(!b(i,`Property`))return Y_;let a=S(i,{allowComputedString:!0});if(!a)return Y_;if((n?a:a.toLowerCase())===t)return{attribute:null,expression:i.value,isPresent:!0,isUnknown:!1}}return J_},Z_=(e,t,n=!0)=>{let r=n?t:t.toLowerCase();for(let t=e.length-1;t>=0;--t){let i=e[t];if(!i)return Y_;if(b(i,`JSXSpreadAttribute`)){if(!b(i.argument,`ObjectExpression`))return Y_;let e=X_(i.argument,r,n);if(e.isPresent||e.isUnknown)return e;continue}if(!b(i,`JSXAttribute`))continue;let a=Ms(i.name);if((n?a:a?.toLowerCase())===r)return{attribute:i,expression:null,isPresent:!0,isUnknown:!1}}return J_},Q_=/(?<attributeName>[^\s"'<>/=]+)(?:\s*=\s*(?:"(?<doubleQuoted>[^"]*)"|'(?<singleQuoted>[^']*)'|(?<unquoted>[^\s"'=<>`]+)))?/g,$_=/<!--[\s\S]*?-->|(?<skippedContentOpeningTag><(?<skippedContentTag>script|style|textarea|title|xmp|iframe|noembed|noframes|plaintext|template)\b(?:"[^"]*"|'[^']*'|[^'"<>])*?>)[\s\S]*?(?:<\/\k<skippedContentTag>\s*>|$)|(?<openingTag><[A-Za-z][\w:-]*(?:"[^"]*"|'[^']*'|[^'"<>])*>)/gi,ev=new Map,tv=(e,t,n)=>{if(!e.isPresent)return;let r=e.attribute?K_(e.attribute,t):e.expression?H_(e.expression,t):null;for(let e of r??[]){let t=e?.trim();t&&n.add(t)}},nv=(e,t,n)=>{for(let r of e.properties){if(b(r,`SpreadElement`)){b(r.argument,`ObjectExpression`)&&nv(r.argument,t,n);continue}if(b(r,`Property`)&&S(r,{allowComputedString:!0})?.toLowerCase()===`id`)for(let e of H_(r.value,t)??[]){let t=e.trim();t&&n.add(t)}}},rv=e=>{let t=e.parent;for(b(t,`JSXElement`)&&t.openingElement===e&&(t=t.parent);t;){if(b(t,`JSXElement`)&&Ys(t.openingElement)===`template`)return!0;t=t.parent}return!1},iv=(e,t,n)=>{z(e,e=>{if(!b(e,`JSXOpeningElement`)||rv(e))return;let r=Z_(e.attributes,`id`,!1);if(r.isUnknown){for(let r of e.attributes)tv(Z_([r],`id`,!1),t,n),b(r,`JSXSpreadAttribute`)&&b(r.argument,`ObjectExpression`)&&nv(r.argument,t,n);return}tv(r,t,n)})},av=(e,t)=>{for(let n of e.matchAll($_)){let e=n.groups?.skippedContentOpeningTag??n.groups?.openingTag;if(e)for(let n of e.matchAll(Q_)){if(n.groups?.attributeName?.toLowerCase()!==`id`)continue;let e=n.groups?.doubleQuoted??n.groups?.singleQuoted??n.groups?.unquoted??``;e.trim()&&t.add(e.trim())}}},ov=e=>{if(!n.isAbsolute(e.currentFilePath))return null;let t=e.configuredRootDirectory?eo(e.configuredRootDirectory):null;return!t||!q_(e.currentFilePath,t)?null:t},sv=()=>{ev.clear()},cv=t=>{let n=new Set;iv(t.currentProgramNode,t.currentScopes,n);let r=ov(t);if(!r)return n;if(ev.has(r)){let e=ev.get(r);return e?new Set([...e,...n]):null}let i=R_({rootDirectory:r,currentFilePath:eo(t.currentFilePath),currentProgramNode:t.currentProgramNode,currentScopes:t.currentScopes});if(!i)return ev.set(r,null),null;let a=new Set;for(let e of i.modulesByFilePath.values())iv(e.programNode,e.scopes,a);try{for(let t of i.htmlFilePaths)av(e.readFileSync(t,`utf8`),a)}catch{return ev.set(r,null),null}return ev.set(r,a),new Set([...a,...n])},lv=new Map,uv=()=>{lv.clear()},dv=t=>{let n=lv.get(t);if(n!==void 0)return n;let r;try{r=e.realpathSync(t)}catch{r=t}return lv.set(t,r),r},fv=(e,t,n)=>{if(t===void 0||t.length===0)return!1;let r=eo(dv(e)),i=eo(t);if(n&&r===i)return!0;let a=i.endsWith(`/`)?i:`${i}/`;return r.startsWith(a)},pv=/webpackIgnore\s*:\s*true|@vite-ignore/,mv=new Map,hv=()=>{mv.clear()},gv=e=>{if(!e)return null;let n=mv.get(e);if(n!==void 0)return n===!1?null:n;let r=!1;try{let n=t(e,`utf8`);pv.test(n)&&(r=n)}catch{r=!1}return mv.set(e,r),r===!1?null:r},_v=()=>{hv(),or(),je(),Hn(),uv(),sv(),rr()},vv=e=>nu.test(e)||ru.test(e),yv=e=>{let t=mu.test(e);return hg(e)||Eg(e)||Du(e)||bu(e)?{bucket:`priority`,isGeneratedBundleByName:t}:yu(e,t)?{bucket:`artifact`,isGeneratedBundleByName:t}:vv(e)?{bucket:`other`,isGeneratedBundleByName:t}:null},bv=(e,t)=>t||vv(e)||bu(e)||hg(e),xv=(t,r)=>{let i=null;try{e.mkdirSync(n.dirname(t),{recursive:!0}),i=`${t}.${process.pid}.${c()}.tmp`,e.writeFileSync(i,r),e.renameSync(i,t),i=null}catch{return}finally{if(i!==null)try{e.rmSync(i,{force:!0})}catch{}}},Sv=t=>{let r=n.resolve(t.filename);try{r=e.realpathSync(r)}catch{r=n.normalize(r)}let i=[r,t.rule,t.offset,t.message],a=s(`sha256`).update(JSON.stringify(i)).digest(`hex`);return n.join(t.directory,`${encodeURIComponent(t.rule)}-${a}.json`)},Cv=[`nextjs`,`astro`,`vite`,`cra`,`remix`,`gatsby`,`expo`,`react-native`,`tanstack-start`,`preact`,`unknown`];export{qf as $,Nt as $i,qa as $n,Xi as $r,Rl as $t,mg as A,pe as Aa,Mr as Ai,ls as An,ga as Ar,vd as At,Ah as B,ne as Ba,bn as Bi,Co as Bn,Qi as Br,xd as Bt,Jg as C,S as Ca,Cr as Ci,V as Cn,Sa as Cr,Dd as Ct,bg as D,_e as Da,yr as Di,us as Dn,va as Dr,Nd as Dt,xg as E,b as Ea,vr as Ei,fs as En,da as Er,_d as Et,Bh as F,ce as Fa,cr as Fi,zo as Fn,_a as Fr,kd as Ft,Gm as G,h as Ga,I as Gi,mo as Gn,na as Gr,Eu as Gt,Dh as H,v as Ha,sn as Hi,_o as Hn,ia as Hr,yd as Ht,zh as I,fe as Ia,lr as Ii,B as In,ea as Ir,Ad as It,jm as J,f as Ja,F as Ji,uo as Jn,Ki as Jr,Gl as Jt,Rm as K,_ as Ka,Gt as Ki,lo as Kn,ra as Kr,W as Kt,Lh as L,le as La,R as Li,No as Ln,sa as Lr,Sd as Lt,lg as M,ae as Ma,dr as Mi,Bo as Mn,fa as Mr,Od as Mt,ag as N,oe as Na,z as Ni,Lo as Nn,Aa as Nr,wd as Nt,yg as O,ge as Oa,Er as Oi,ds as On,Da as Or,Td as Ot,Jh as P,me as Pa,ur as Pi,Ro as Pn,ma as Pr,Cd as Pt,rp as Q,u as Qa,It as Qi,eo as Qn,Zi as Qr,Jl as Qt,Ih as R,ue as Ra,ir as Ri,Mo as Rn,oa as Rr,jd as Rt,Yg as S,C as Sa,kr as Si,ms as Sn,Ha as Sr,hd as St,wg as T,ve as Ta,Pr as Ti,cs as Tn,Ca as Tr,Md as Tt,wh as U,te as Ua,Jt as Ui,go as Un,ca as Ur,Xu as Ut,kh as V,y as Va,un as Vi,So as Vn,$i as Vr,gd as Vt,ph as W,g as Wa,Kt as Wi,ho as Wn,ta as Wr,Yu as Wt,Dm as X,p as Xa,Lt as Xi,io as Xn,Ji as Xr,Vl as Xt,Am as Y,m as Ya,Rt as Yi,fo as Yn,Wi as Yr,Kl as Yt,ip as Z,d as Za,P as Zi,ro as Zn,qi as Zr,ql as Zt,E_ as _,E as _a,jr as _i,Ms as _n,Ta as _r,$u as _t,bv as a,Ct as aa,fi as ai,cl as an,ja as ar,wf as at,c_ as b,ye as ba,Sr as bi,Ts as bn,Oa as br,id as bt,gv as c,A as ca,Yr as ci,zc as cn,Ba as cr,pf as ct,Z_ as d,D as da,Ir as di,Zs as dn,Ia as dr,tf as dt,M as ea,Yi as ei,Pl as en,Qa as er,Af as et,q_ as f,Ke as fa,Lr as fi,Xs as fn,La as fr,ed as ft,R_ as g,Fe as ga,Ar as gi,Fs as gn,ba as gr,nd as gt,z_ as h,Pe as ha,Or as hi,Gs as hn,Ma as hr,od as ht,yv as i,j as ia,pi as ii,dl as in,Pa as ir,X as it,dg as j,ie as ja,gr as ji,ps as jn,ha as jr,Pd as jt,_g as k,de as ka,Dr as ki,ss as kn,ua as kr,sd as kt,fv as l,xt as la,Kr as li,nc as ln,Ra as lr,ff as lt,W_ as m,Ne as ma,wr as mi,Ks as mn,pa as mr,td as mt,Sv as n,Et as na,Vi as ni,fl as nn,Na as nr,kf as nt,_v as o,St as oa,di as oi,ll as on,ka as or,Sf as ot,G_ as p,We as pa,zr as pi,Ys as pn,Fa as pr,Zu as pt,Mm as q,ee as qa,Bt as qi,po as qn,Gi as qr,Hl as qt,xv as r,Tt as ra,Di as ri,pl as rn,Ea as rr,Tf as rt,pv as s,wt as sa,li as si,ul as sn,xa as sr,xf as st,Cv as t,At as ta,Ui as ti,Il as tn,Ya as tr,jf as tt,cv as u,O as ua,qr as ui,Qs as un,za as ur,nf as ut,v_ as v,Ce as va,Nr as vi,js as vn,ya as vr,rd as vt,Hg as w,x as wa,_r as wi,hs as wn,wa as wr,Ed as wt,Zg as x,w as xa,xr as xi,gs as xn,Va as xr,ad as xt,__ as y,Se as ya,Tr as yi,Os as yn,la as yr,Qu as yt,Fh as z,he as za,Vn as zi,wo as zn,aa as zr,bd as zt};
-//# sourceMappingURL=capability-CN4mTeHg.js.map
+`&&(t[n]=` `),n+=1}continue}if(r===`$`){let r=Og.exec(e.slice(n));if(r!==null){let i=r[0],a=e.indexOf(i,n+i.length),o=a<0?e.length:a+i.length,s=Ag(e,n);if(kg.has(s))jg(e,t,n+i.length,o);else for(let r=n;r<o;r+=1)e[r]!==`
+`&&(t[r]=` `);n=o;continue}}if(r===`"`){for(n+=1;n<e.length;){if(e[n]===`"`){if(e[n+1]===`"`){n+=2;continue}n+=1;break}n+=1}continue}n+=1}return t.join(``)},Ng=/disable\s+row\s+level\s+security/i,Pg=/auth\.role\(\)\s*=\s*["']service_role["']/i,Fg=/create\s+policy/gi,Ig=/;|create\s+policy/i,Lg=/\b(?:using|with\s+check)\s*\(\s*true\s*\)/i,Rg=/\bfor\s+select\b/i,zg=/\bto\s+([\s\S]+?)(?=\s+(?:using|with\s+check|as|for)\b|;|$)/i,Bg=new Set([`service_role`,`postgres`,`supabase_admin`]),Vg=e=>{let t=zg.exec(e);if(t===null)return!1;let n=t[1].split(`,`).map(e=>e.trim().replace(/["'`]/g,``).toLowerCase()).filter(Boolean);return n.length>0&&n.every(e=>Bg.has(e))},Hg=(e,t)=>Pg.test(t)?!0:!Lg.test(e)||Rg.test(e)?!1:!Vg(e),Ug=W({id:`supabase-rls-policy-risk`,title:`Permissive Supabase RLS policy`,severity:`error`,recommendation:"Keep public-read policies explicit, but gate inserts, updates, deletes, and service-role bypasses behind `auth.uid()` plus trusted tenant membership.",scan:e=>{if(!Dg(e.relativePath))return[];let t=Mg(e.content),n=t.search(Ng);Fg.lastIndex=0;for(let r=Fg.exec(t);r!==null;r=Fg.exec(t)){let i=r.index+r[0].length,a=t.slice(i).search(Ig),o=a<0?t.length:i+a;if(Hg(t.slice(r.index,o),e.content.slice(r.index,o))){(n<0||r.index<n)&&(n=r.index);break}}if(n<0)return[];let{line:r,column:i}=G(t,n);return[{message:`Supabase policy SQL disables RLS, permits writes broadly, or references a service-role bypass.`,line:r,column:i}]}}),Wg=/create\s+(?:unlogged\s+)?table\s+(?:if\s+not\s+exists\s+)?(?!["`]?(?:auth|storage|realtime|vault|extensions|graphql|graphql_public|pgbouncer|net|supabase_functions|supabase_migrations|cron|pgsodium|pgmq|information_schema|pg_catalog|pg_temp|private|internal)["`]?\s*\.)(?:["`]?public["`]?\s*\.\s*)?["`]?([A-Za-z_][\w$]*)["`]?(?:\s*\(|\s+as\b)/gi,Gg=/alter\s+table\s+(?:if\s+exists\s+)?(?:only\s+)?(?:["`]?public["`]?\s*\.\s*)?["`]?([A-Za-z_][\w$]*)["`]?\s+(?:force\s+)?enable\s+row\s+level\s+security/gi,Kg=/\benable\s+row\s+level\s+security\b/gi,qg=e=>{let t=new Map,n=0;for(let r of e.matchAll(Gg)){let e=r[1];e!==void 0&&(n+=1,t.set(e.toLowerCase(),r.index))}return{lastEnableIndexByTable:t,staticEnableCount:n}},Jg=(e,t)=>(e.match(Kg)?.length??0)>t,Yg=W({id:`supabase-table-missing-rls`,title:`Supabase table created without Row Level Security`,severity:`error`,recommendation:"Enable RLS in the same migration (`alter table <name> enable row level security;`) and add `auth.uid()`-scoped policies for select/insert/update/delete. A public table without RLS is fully readable and writable with the public anon key.",scan:e=>{if(!Eg(e.relativePath))return[];let t=Mg(e.content);if(!/create\s+(?:unlogged\s+)?table/i.test(t))return[];let n=[],{lastEnableIndexByTable:r,staticEnableCount:i}=qg(t);if(Jg(t,i))return[];Wg.lastIndex=0;for(let e=Wg.exec(t);e!==null;e=Wg.exec(t)){let i=e[1];if(i===void 0)continue;let a=r.get(i.toLowerCase());if(a!==void 0&&a>=e.index)continue;let o=G(t,e.index);n.push({message:`Supabase migration creates a public table but never enables Row Level Security, leaving every row exposed to the anon key.`,line:o.line,column:o.column})}return n}}),Xg=W({id:`svg-filter-clickjacking-risk`,title:`SVG-filtered iframe clickjacking primitive`,severity:`warn`,recommendation:"Avoid filtering cross-origin iframes. Use `frame-ancestors` on sensitive pages and keep SVG filters away from embedded privileged UI.",scan:q({shouldScan:e=>K(e.relativePath),pattern:/<iframe\b(?:=>|[^>]){0,300}\bfilter\s*:\s*["']?url\(#|filter\s*:\s*url\(#[\s\S]{0,700}<iframe\b|<fe(?:DisplacementMap|ColorMatrix|Composite|Tile|Morphology)\b[\s\S]{0,700}<iframe\b/i,message:`An iframe is rendered through an SVG/CSS filter, which can support advanced clickjacking or visual exfiltration tricks.`})}),Zg=e=>K(e)?cu.test(e)?!0:/(?:^|\/)(?:middleware|route)\.[cm]?[jt]sx?$/.test(e):!1,Qg=W({id:`tenant-static-proxy-risk`,title:`Tenant-controlled static asset proxy`,severity:`warn`,recommendation:`Bind tenant identity to the trusted host or authenticated org, canonicalize after decoding, reject traversal, and never let one tenant choose another tenant's asset prefix.`,scan:q({shouldScan:e=>Zg(e.relativePath),pattern:/\b(?:fetch|path\.join|getObject\w*|GetObjectCommand|getSignedUrl|createReadStream)\s*\([^;]{0,200}(?:\$\{[^}]{0,100}\b(?:tenant|subdomain|workspace|hostPattern|(?<!\.)organization(?:Id|Slug)?)\b|\b(?:tenant|subdomain|workspace)(?:Id|Slug|Name)?\b\s*[,)+\].])/i,message:`Route code appears to compose tenant or subdomain input into a static/CDN/object-store fetch path.`})}),$g=[/dangerouslySetInnerHTML\s*=\s*\{\{\s*__html\s*:[\s\S]{0,300}?\bJSON\.stringify\s*\(/gi,/<script\b[^>]*>(?:(?!<\/script>)[\s\S]){0,300}?\bJSON\.stringify\s*\(/gi],e_=/\$\{|["'`]\s*\+\s*$/,t_=/^\s*\{(?!\{)/,n_=/"(?:[^"\\\n]|\\.)*"|'(?:[^'\\\n]|\\.)*'/g,r_=/\b(?:true|false|null)\b|[\d.]+(?:e[+-]?\d+)?/gi,i_=e=>{if(e.includes("`")||e.includes("${"))return!1;let t=e.replace(n_,``).replace(r_,``);return!/[A-Za-z_$]/.test(t)},a_=/^[\s)]*\.replace\s*\([^)]*(?:\\u003[cC]|&lt;|<)/,o_=/^[\s)]*\.replaceAll\s*\(\s*["']<["']\s*,\s*["'](?:\\u003[cC]|&lt;)["']\s*\)/,s_=/(?:\b(?:escapeHtml|escapeJSON|escapeJson|htmlEscape|jsesc)|(?<![.\w])(?:serialize|serializeJavascript|devalue|uneval|superjson))\s*\(\s*$/i,c_=/\bJSON\.stringify\s*\($/i,l_=W({id:`unsafe-json-in-html`,title:`Unescaped JSON in HTML or script sink`,severity:`warn`,recommendation:'JSON.stringify does not HTML-escape, so a `<\/script>` (or `<`) in the data breaks out and becomes XSS. Use an HTML-safe serializer (serialize-javascript, devalue) or escape `<`, `>`, and `&`, or pass data via a JSON `<script type="application/json">` read with JSON.parse.',scan:e=>{if(!K(e.relativePath))return[];let t=Ku(e);if(!t.includes(`JSON.stringify`))return[];let n=[],r=new Set;for(let[e,i]of $g.entries()){i.lastIndex=0;for(let a=i.exec(t);a!==null;a=i.exec(t)){let i=a[0].replace(c_,``);if(s_.test(i))continue;if(e===1){let e=t.indexOf(`>`,a.index),n=a[0].search(/\bJSON\.stringify\s*\($/i);if(e>=0&&n>=0){let r=t.slice(e+1,a.index+n);if(!e_.test(r)||t_.test(r))continue}}let o=a.index+a[0].length-1,s=wf(t,o);if(s>=0){let e=t.slice(s+1,s+1+160);if(a_.test(e)||o_.test(e)||i_(t.slice(o+1,s)))continue}if(r.has(a.index))continue;r.add(a.index);let c=G(t,a.index);n.push({message:"JSON.stringify is embedded in HTML/script markup without HTML-escaping; data containing `<\/script>` or `<` breaks out and becomes XSS.",line:c.line,column:c.column})}}return n}}),u_=/(?:(?<![.\w$])fetch|\baxios\.\s*(?:get|post|put|delete|head)|\bgot|\bgot\.\s*(?:get|post))\s*\(\s*([^,)]+)/,d_=/\b(?:url|targetUrl|callbackUrl|redirectUrl|webhookUrl|companyUrl|websiteUrl|domainUrl|imageUrl|fetchUrl|next|return_to|returnTo|destination|location)\b/i,f_=/\breq\.|\brequest\.(?:query|body|params|nextUrl)|\bsearchParams\b|\bparams\.|\bbody\.|\bquery\./,p_=/\bredirect\s*:\s*["'](?:manual|error)["']/,m_=/\b(params|body|query)\./g,h_=(e,t)=>RegExp(`(?:const|let|var)\\s+${e}\\s*(?::[^=;\\n]{0,80})?=\\s*new\\s+URLSearchParams\\b`).test(t),g_=(e,t)=>{let n=e.replace(m_,(e,n)=>h_(n,t)?``:e);return f_.test(n)},__=(e,t)=>{if(g_(e,t))return!0;let n=/^[\w$]+$/.exec(e.trim());if(n===null)return!1;let r=RegExp(`(?:const|let|var)[^=;\\n]{0,80}\\b${n[0]}\\b[^=;\\n]{0,80}=([^;\\n]*)`,`g`);for(let e of t.matchAll(r)){let n=e[1]??``;if(/\breq\.|\brequest\.|\bsearchParams\b|\$_(?:GET|POST|REQUEST)/.test(n)||g_(n,t))return!0}return!1},v_=W({id:`untrusted-redirect-following`,title:`Server fetch follows redirects for caller-shaped URL`,severity:`warn`,recommendation:'Use `redirect: "manual"` or equivalent and re-validate every redirect target before following it to avoid SSRF redirect bypasses.',scan:e=>{if(!Zg(e.relativePath)||!u_.test(e.content))return[];let t=[],n=e.content.split(`
+`);for(let r=0;r<n.length;r+=1){let i=n[r]??``,a=i.match(u_),o=a?.[1]??``;if(!a||!d_.test(o)||!__(o,e.content))continue;let s=n.slice(r,r+5).join(`
+`);p_.test(s)||t.push({message:`Server-side fetch code appears to follow redirects for a URL shaped like caller-controlled input.`,line:r+1,column:i.search(/\S/)+1})}return t}}),y_=W({id:`url-prefilled-privileged-action`,title:`URL pre-fills a privileged action`,severity:`warn`,recommendation:`Require server-side validation and explicit confirmation for URL-sourced invite, role, permission, redirect, or sharing parameters.`,scan:q({shouldScan:e=>km(e.relativePath),pattern:/(?<!(?:safe|valid|sanitiz|relativ|allowlist|whitelist|parse|normaliz)[\w$]*\(\s*(?:new\s+)?(?:[\w$]+\s*\.\s*){0,4})\b(?:searchParams|useSearchParams\s*\(\s*\)|URLSearchParams\s*\([^)]{0,120}\))(?:[?!])?\.get(?:All)?\s*\(\s*["'](?:userstoinvite|role|permission|sharingaction|invite|admin|next|continue|returnTo|redirect_uri|callbackUrl)["']|\bsearchParams\.(?:userstoinvite|role|permission|sharingaction|invite|admin|returnTo|redirect_uri|callbackUrl)\b/i,message:`Client code reads sensitive action state from the URL, which can pre-fill invites, roles, redirects, or sharing flows with attacker values.`})}),b_=/(?:^|\/)[^/]*webhook[^/]*\/|(?:^|\/)[^/]*webhook[^/]*\.[cm]?[jt]s$|\bwebhook\b/i,x_=/\b(?:export\s+(?:async\s+)?function\s+POST|export\s+const\s+(?:POST|handler|webhook)|webhookHandler|webhookRoute)\b/i,S_=RegExp(`verifySignature|verify.*signature|verify\\w*(?:Webhook|Auth)|constructEvent|createHmac|timingSafeEqual|svix|webhookSecret|stripe\\.webhooks|["'][\\w-]*signature["']|\\b[A-Za-z]{0,40}(?:verif|valid|check|assert|authenticat|compare|guard)[A-Za-z]{0,40}(?:secret|signature|hmac|webhook|digest)[A-Za-z]{0,40}\\s*\\(`,`i`),C_=/webhook[\s_-]?ur[il]\w*/gi,w_=/process\.env\.\w*WEBHOOK_URL|\b(?:send|post|dispatch|publish|notify)\w*Webhook/,T_=/\b(?:req|request)\b/,E_=/\/\/[^\n]*|\/\*[\s\S]*?\*\/|"(?:\\.|[^"\\\n])*"|'(?:\\.|[^'\\\n])*'|`(?:\\.|[^`\\])*`/g,D_=W({id:`webhook-signature-risk`,title:`Webhook handler lacks signature verification`,severity:`warn`,recommendation:`Verify provider signatures before parsing or acting on webhook bodies. Use provider SDK helpers or HMAC verification with timing-safe comparison.`,scan:q({shouldScan:e=>{if(!K(e.relativePath)||w_.test(e.content))return!1;let t=e.content.replace(E_,``).replace(C_,``);return b_.test(e.relativePath)||b_.test(t)},pattern:x_,requireAll:[T_],suppressWhen:S_,message:`Webhook handler code does not show an obvious signature verification step.`})}),O_=/\.[cm]?[jt]sx?$/i,k_=/\.d\.[cm]?[jt]s$/i,A_=/\.mdx$/i,j_=/\.html?$/i,M_=new Set([`.angular`,`.astro`,`.cache`,`.contentlayer`,`.docusaurus`,`.expo`,`.git`,`.next`,`.nuxt`,`.output`,`.svelte-kit`,`.turbo`,`.vercel`,`build`,`coverage`,`dist`,`node_modules`,`out`,`storybook-static`]),N_=new WeakMap,P_=e=>{let t=N_.get(e);if(t)return t;let n=A(e);return N_.set(e,n),n},F_=t=>{let r=[],i=[],a=[t],o=!1;for(;a.length>0;){let t=a.pop();if(!t)continue;let s;try{s=e.readdirSync(t,{withFileTypes:!0})}catch{return null}for(let e of s){let s=n.join(t,e.name),c=M_.has(e.name)||e.name.startsWith(`.`)&&e.name!==`.dumi`&&e.name!==`.storybook`;if(!(e.isSymbolicLink()&&c)){if(e.isSymbolicLink())return null;if(e.isDirectory()){if(c)continue;a.push(s);continue}if(!(!e.isFile()||Fl(s))){if(A_.test(e.name)){o=!0;continue}if(j_.test(e.name)){i.push(to(s));continue}O_.test(e.name)&&(k_.test(e.name)||r.push(to(s)))}}}}return{sourceFilePaths:r,htmlFilePaths:i,hasOpaqueMdxConsumerSurface:o}},I_=(t,n)=>{for(let r of t){let t;try{t=e.readFileSync(r,`utf8`)}catch{return!0}for(let e of n)if(t.includes(`"${e}"`)||t.includes(`'${e}'`))return!0}return!1},L_=e=>{if(b(e,`ImportDeclaration`))return ml(e)?null:typeof e.source.value==`string`?e.source.value:null;if(b(e,`ExportNamedDeclaration`))return e.exportKind===`type`||pl(e.specifiers,`ExportSpecifier`,`exportKind`)?null:e.source&&typeof e.source.value==`string`?e.source.value:null;if(b(e,`ExportAllDeclaration`))return e.exportKind===`type`?null:typeof e.source.value==`string`?e.source.value:null;if(b(e,`ImportExpression`))return b(e.source,`Literal`)&&typeof e.source.value==`string`?e.source.value:null;if(b(e,`CallExpression`)&&b(e.callee,`Identifier`)&&e.callee.name===`require`&&e.arguments.length===1){let t=e.arguments[0];return t&&b(t,`Literal`)&&typeof t.value==`string`?t.value:null}return null},R_=(e,t,n,r)=>{z(e.programNode,i=>{let a=L_(i);if(!a)return;let o=ir(e.filePath,a);if(!o){r.add(a);return}let s=to(o);n.set(i,s);let c=t.get(s)??new Set;c.add(e),t.set(s,c)})},z_=({rootDirectory:e,currentFilePath:t,currentProgramNode:n,currentScopes:r,requiredModuleSources:i=[],knownModuleSources:a})=>{if(i.length>0&&a!==void 0&&!i.some(e=>a.includes(e)))return null;let o=F_(e);if(!o||i.length>0&&a===void 0&&!I_(o.sourceFilePaths,i))return null;let s=new Map;for(let e of o.sourceFilePaths){if(e===t){s.set(e,{filePath:e,programNode:n,scopes:r});continue}let i=bn(e);if(!i||!b(i,`Program`))return null;s.set(e,{filePath:e,programNode:i,scopes:P_(i)})}let c=new Map,l=new WeakMap,u=new Set;for(let e of s.values())R_(e,c,l,u);return{modulesByFilePath:s,htmlFilePaths:o.htmlFilePaths,consumerModulesByFilePath:c,resolvedSourcePathByNode:l,unresolvedRuntimeSources:u,hasOpaqueMdxConsumerSurface:o.hasOpaqueMdxConsumerSurface}},B_=e=>{if(!e)return null;let t=w(e);return!b(t,`Literal`)||typeof t.value!=`boolean`?null:t.value},V_=(e,t,n={})=>{let r=n.maximumConstAliases===void 0?4:n.maximumConstAliases,i=n.shouldFoldStaticConditions??!1,a=n.shouldKeepKnownValues??!1,o=[],s=[{expression:e,remainingConstAliases:r,resolvingSymbols:new Set}];for(;s.length>0;){let e=s.pop();if(!e)continue;let n=w(e.expression);if(b(n,`Literal`)){if(typeof n.value!=`string`){if(a)continue;return null}o.push(n.value);continue}if(b(n,`TemplateLiteral`)){let e=Gt(n);if(e===null){if(a)continue;return null}o.push(e);continue}if(b(n,`ConditionalExpression`)){let t=i?B_(n.test):null;if(t!==null){s.push({expression:t?n.consequent:n.alternate,remainingConstAliases:e.remainingConstAliases,resolvingSymbols:e.resolvingSymbols});continue}s.push({expression:n.alternate,remainingConstAliases:e.remainingConstAliases,resolvingSymbols:new Set(e.resolvingSymbols)}),s.push({expression:n.consequent,remainingConstAliases:e.remainingConstAliases,resolvingSymbols:new Set(e.resolvingSymbols)});continue}if(a&&b(n,`LogicalExpression`)&&(n.operator===`??`||n.operator===`||`)){s.push({expression:n.right,remainingConstAliases:e.remainingConstAliases,resolvingSymbols:new Set(e.resolvingSymbols)}),s.push({expression:n.left,remainingConstAliases:e.remainingConstAliases,resolvingSymbols:new Set(e.resolvingSymbols)});continue}if(b(n,`Identifier`)){let r=t.referenceFor(n)?.resolvedSymbol;if(!r||r.kind!==`const`||!r.initializer||!b(r.declarationNode,`VariableDeclarator`)||r.declarationNode.id!==r.bindingIdentifier||e.remainingConstAliases===0||e.resolvingSymbols.has(r)){if(a)continue;return null}e.resolvingSymbols.add(r),s.push({expression:r.initializer,remainingConstAliases:e.remainingConstAliases===null?null:e.remainingConstAliases-1,resolvingSymbols:e.resolvingSymbols});continue}if(!a)return null}return o.length>0?o:null},H_=(e,t,n={})=>V_(e,t,n),U_=(e,t)=>V_(e,t,{shouldKeepKnownValues:!0}),W_=(e,t,n,r,i=!1)=>{let a=e.value;return a?b(a,`Literal`)?typeof a.value==`string`?[a.value]:null:b(a,`JSXExpressionContainer`)?H_(a.expression,t,{maximumConstAliases:n,shouldFoldStaticConditions:r,shouldKeepKnownValues:i}):null:null},G_=(e,t)=>W_(e,t,4,!1),K_=(e,t)=>W_(e,t,null,!0),q_=(e,t)=>W_(e,t,4,!1,!0),J_=(e,t)=>{let r=n.relative(t,e);return r===``||!r.startsWith(`..${n.sep}`)&&r!==`..`&&!n.isAbsolute(r)},Y_={attribute:null,expression:null,isPresent:!1,isUnknown:!1},X_={attribute:null,expression:null,isPresent:!1,isUnknown:!0},Z_=(e,t,n)=>{for(let r=e.properties.length-1;r>=0;--r){let i=e.properties[r];if(!i)return X_;if(b(i,`SpreadElement`)){if(!b(i.argument,`ObjectExpression`))return X_;let e=Z_(i.argument,t,n);if(e.isPresent||e.isUnknown)return e;continue}if(!b(i,`Property`))return X_;let a=S(i,{allowComputedString:!0});if(!a)return X_;if((n?a:a.toLowerCase())===t)return{attribute:null,expression:i.value,isPresent:!0,isUnknown:!1}}return Y_},Q_=(e,t,n=!0)=>{let r=n?t:t.toLowerCase();for(let t=e.length-1;t>=0;--t){let i=e[t];if(!i)return X_;if(b(i,`JSXSpreadAttribute`)){if(!b(i.argument,`ObjectExpression`))return X_;let e=Z_(i.argument,r,n);if(e.isPresent||e.isUnknown)return e;continue}if(!b(i,`JSXAttribute`))continue;let a=Ns(i.name);if((n?a:a?.toLowerCase())===r)return{attribute:i,expression:null,isPresent:!0,isUnknown:!1}}return Y_},$_=/(?<attributeName>[^\s"'<>/=]+)(?:\s*=\s*(?:"(?<doubleQuoted>[^"]*)"|'(?<singleQuoted>[^']*)'|(?<unquoted>[^\s"'=<>`]+)))?/g,ev=/<!--[\s\S]*?-->|(?<skippedContentOpeningTag><(?<skippedContentTag>script|style|textarea|title|xmp|iframe|noembed|noframes|plaintext|template)\b(?:"[^"]*"|'[^']*'|[^'"<>])*?>)[\s\S]*?(?:<\/\k<skippedContentTag>\s*>|$)|(?<openingTag><[A-Za-z][\w:-]*(?:"[^"]*"|'[^']*'|[^'"<>])*>)/gi,tv=new Map,nv=(e,t,n)=>{if(!e.isPresent)return;let r=e.attribute?q_(e.attribute,t):e.expression?U_(e.expression,t):null;for(let e of r??[]){let t=e?.trim();t&&n.add(t)}},rv=(e,t,n)=>{for(let r of e.properties){if(b(r,`SpreadElement`)){b(r.argument,`ObjectExpression`)&&rv(r.argument,t,n);continue}if(b(r,`Property`)&&S(r,{allowComputedString:!0})?.toLowerCase()===`id`)for(let e of U_(r.value,t)??[]){let t=e.trim();t&&n.add(t)}}},iv=e=>{let t=e.parent;for(b(t,`JSXElement`)&&t.openingElement===e&&(t=t.parent);t;){if(b(t,`JSXElement`)&&Xs(t.openingElement)===`template`)return!0;t=t.parent}return!1},av=(e,t,n)=>{z(e,e=>{if(!b(e,`JSXOpeningElement`)||iv(e))return;let r=Q_(e.attributes,`id`,!1);if(r.isUnknown){for(let r of e.attributes)nv(Q_([r],`id`,!1),t,n),b(r,`JSXSpreadAttribute`)&&b(r.argument,`ObjectExpression`)&&rv(r.argument,t,n);return}nv(r,t,n)})},ov=(e,t)=>{for(let n of e.matchAll(ev)){let e=n.groups?.skippedContentOpeningTag??n.groups?.openingTag;if(e)for(let n of e.matchAll($_)){if(n.groups?.attributeName?.toLowerCase()!==`id`)continue;let e=n.groups?.doubleQuoted??n.groups?.singleQuoted??n.groups?.unquoted??``;e.trim()&&t.add(e.trim())}}},sv=e=>{if(!n.isAbsolute(e.currentFilePath))return null;let t=e.configuredRootDirectory?to(e.configuredRootDirectory):null;return!t||!J_(e.currentFilePath,t)?null:t},cv=()=>{tv.clear()},lv=t=>{let n=new Set;av(t.currentProgramNode,t.currentScopes,n);let r=sv(t);if(!r)return n;if(tv.has(r)){let e=tv.get(r);return e?new Set([...e,...n]):null}let i=z_({rootDirectory:r,currentFilePath:to(t.currentFilePath),currentProgramNode:t.currentProgramNode,currentScopes:t.currentScopes});if(!i)return tv.set(r,null),null;let a=new Set;for(let e of i.modulesByFilePath.values())av(e.programNode,e.scopes,a);try{for(let t of i.htmlFilePaths)ov(e.readFileSync(t,`utf8`),a)}catch{return tv.set(r,null),null}return tv.set(r,a),new Set([...a,...n])},uv=new Map,dv=()=>{uv.clear()},fv=t=>{let n=uv.get(t);if(n!==void 0)return n;let r;try{r=e.realpathSync(t)}catch{r=t}return uv.set(t,r),r},pv=(e,t,n)=>{if(t===void 0||t.length===0)return!1;let r=to(fv(e)),i=to(t);if(n&&r===i)return!0;let a=i.endsWith(`/`)?i:`${i}/`;return r.startsWith(a)},mv=/webpackIgnore\s*:\s*true|@vite-ignore/,hv=new Map,gv=()=>{hv.clear()},_v=e=>{if(!e)return null;let n=hv.get(e);if(n!==void 0)return n===!1?null:n;let r=!1;try{let n=t(e,`utf8`);mv.test(n)&&(r=n)}catch{r=!1}return hv.set(e,r),r===!1?null:r},vv=()=>{gv(),or(),je(),Hn(),dv(),cv(),rr()},yv=e=>ru.test(e)||iu.test(e),bv=e=>{let t=hu.test(e);return gg(e)||Dg(e)||Ou(e)||xu(e)?{bucket:`priority`,isGeneratedBundleByName:t}:bu(e,t)?{bucket:`artifact`,isGeneratedBundleByName:t}:yv(e)?{bucket:`other`,isGeneratedBundleByName:t}:null},xv=(e,t)=>t||yv(e)||xu(e)||gg(e),Sv=(t,r)=>{let i=null;try{e.mkdirSync(n.dirname(t),{recursive:!0}),i=`${t}.${process.pid}.${c()}.tmp`,e.writeFileSync(i,r),e.renameSync(i,t),i=null}catch{return}finally{if(i!==null)try{e.rmSync(i,{force:!0})}catch{}}},Cv=t=>{let r=n.resolve(t.filename);try{r=e.realpathSync(r)}catch{r=n.normalize(r)}let i=[r,t.rule,t.offset,t.message],a=s(`sha256`).update(JSON.stringify(i)).digest(`hex`);return n.join(t.directory,`${encodeURIComponent(t.rule)}-${a}.json`)},wv=[`nextjs`,`astro`,`vite`,`cra`,`remix`,`gatsby`,`expo`,`react-native`,`tanstack-start`,`preact`,`unknown`];export{Jf as $,u as $a,It as $i,Ja as $n,Zi as $r,zl as $t,hg as A,de as Aa,Dr as Ai,us as An,Ea as Ar,yd as At,jh as B,he as Ba,Vn as Bi,wo as Bn,aa as Br,Sd as Bt,Yg as C,C as Ca,kr as Ci,V as Cn,Sa as Cr,Od as Ct,xg as D,b as Da,vr as Di,ds as Dn,va as Dr,Pd as Dt,Sg as E,ve as Ea,Pr as Ei,ps as En,da as Er,vd as Et,Vh as F,me as Fa,ur as Fi,Bo as Fn,ma as Fr,Ad as Ft,Km as G,g as Ga,Kt as Gi,ho as Gn,ta as Gr,Du as Gt,Oh as H,y as Ha,un as Hi,vo as Hn,$i as Hr,bd as Ht,Bh as I,ce as Ia,cr as Ii,B as In,_a as Ir,jd as It,Mm as J,ee as Ja,Bt as Ji,fo as Jn,Gi as Jr,Kl as Jt,zm as K,h as Ka,I as Ki,uo as Kn,na as Kr,W as Kt,Rh as L,fe as La,lr as Li,Po as Ln,ea as Lr,Cd as Lt,ug as M,ie as Ma,gr as Mi,Vo as Mn,ha as Mr,kd as Mt,og as N,ae as Na,dr as Ni,Ro as Nn,fa as Nr,Td as Nt,bg as O,_e as Oa,yr as Oi,fs as On,Oa as Or,Ed as Ot,Yh as P,oe as Pa,z as Pi,zo as Pn,ja as Pr,wd as Pt,ip as Q,d as Qa,P as Qi,to as Qn,qi as Qr,Yl as Qt,Lh as R,le as Ra,R as Ri,No as Rn,sa as Rr,Md as Rt,Xg as S,w as Sa,xr as Si,hs as Sn,Ua as Sr,gd as St,Tg as T,x as Ta,_r as Ti,ls as Tn,Ca as Tr,Nd as Tt,Th as U,v as Ua,sn as Ui,_o as Un,ia as Ur,Zu as Ut,Ah as V,ne as Va,bn as Vi,Co as Vn,Qi as Vr,_d as Vt,mh as W,te as Wa,Jt as Wi,go as Wn,ca as Wr,Xu as Wt,Om as X,m as Xa,Rt as Xi,ao as Xn,Wi as Xr,Hl as Xt,jm as Y,f as Ya,F as Yi,po as Yn,Ki as Yr,ql as Yt,ap as Z,p as Za,Lt as Zi,io as Zn,Ji as Zr,Jl as Zt,D_ as _,Fe as _a,Ar as _i,Ns as _n,Ta as _r,ed as _t,xv as a,j as aa,pi as ai,ll as an,Ma as ar,Tf as at,l_ as b,Se as ba,Tr as bi,Es as bn,ka as br,ad as bt,_v as c,wt as ca,li as ci,Bc as cn,Va as cr,mf as ct,Q_ as d,O as da,qr as di,Qs as dn,La as dr,nf as dt,Nt as ea,Xi as ei,Fl as en,$a as er,jf as et,J_ as f,D as fa,Ir as fi,Zs as fn,Ra as fr,td as ft,z_ as g,Pe as ga,Or as gi,Is as gn,ba as gr,rd as gt,B_ as h,Ne as ha,wr as hi,Ks as hn,Na as hr,sd as ht,bv as i,Tt as ia,Di as ii,fl as in,Fa as ir,X as it,fg as j,pe as ja,Mr as ji,ms as jn,ga as jr,Fd as jt,vg as k,ge as ka,Er as ki,cs as kn,ua as kr,cd as kt,pv as l,A as la,Yr as li,rc as ln,za as lr,pf as lt,G_ as m,We as ma,zr as mi,qs as mn,pa as mr,nd as mt,Cv as n,At as na,Ui as ni,pl as nn,Pa as nr,Af as nt,vv as o,Ct as oa,fi as oi,ul as on,Aa as or,Cf as ot,K_ as p,Ke as pa,Lr as pi,Xs as pn,Ia as pr,Qu as pt,Nm as q,_ as qa,Gt as qi,mo as qn,ra as qr,Ul as qt,Sv as r,Et as ra,Vi as ri,ml as rn,Da as rr,Ef as rt,mv as s,St as sa,di as si,dl as sn,xa as sr,Sf as st,wv as t,M as ta,Yi as ti,Ll as tn,Xa as tr,Mf as tt,lv as u,xt as ua,Kr as ui,$s as un,Ba as ur,rf as ut,y_ as v,E as va,jr as vi,Ms as vn,ya as vr,id as vt,Ug as w,S as wa,Cr as wi,gs as wn,wa as wr,Dd as wt,Qg as x,ye as xa,Sr as xi,_s as xn,Ha as xr,od as xt,v_ as y,Ce as ya,Nr as yi,ks as yn,la as yr,$u as yt,Ih as z,ue as za,ir as zi,To as zn,oa as zr,xd as zt};
+//# sourceMappingURL=capability-hsEmdGJQ.js.map