oxlint-plugin-react-doctor 0.9.6 → 0.9.7

package/dist/{capability-DSccjvGM.js → capability-BN46vnIK.js}

@@ -9,23 +9,23 @@ import{parseSync as e,visitorKeys as t}from"oxc-parser";import{KEYS as n}from"es
 `,`\u2028`,`\u2029`]),fu=e=>{let t=0;for(;t<e.length;){let n=e.indexOf(`-->`,t);if(n===-1)return!1;let r=n-1;for(;r>=0&&!du.has(e[r]??``)&&e[r]?.trim()===``;)--r;if(r<0||du.has(e[r]??``))return!0;t=n+3}return!1},pu=(t,n)=>{if(!lu.test(t)||!n.startsWith(`#!`)&&!uu.test(n)&&!fu(n))return n;try{let r=e(t,n,{astType:`ts`,lang:Ft(t)});if(r.errors.some(e=>e.severity===`Error`))return;let i=n.search(/[\r\n\u2028\u2029]/),a=[...n.startsWith(`#!`)?[{start:0,end:i===-1?n.length:i}]:[],...r.comments];if(a.length===0)return n;let o=[],s=0;for(let e of a)o.push(n.slice(s,e.start)),o.push(n.slice(e.start,e.end).replace(/[^\r\n\u2028\u2029]/g,` `)),s=e.end;return o.push(n.slice(s)),o.join(``)}catch{return}},mu=(e,t,n)=>{if(Uc.test(e.relativePath)||!Xc(e.relativePath,e.isGeneratedBundle))return[];let r=t(e.content);if(r===void 0)return[];let i=Mc(e.content,r);return[{message:n,line:i.line,column:i.column}]},hu=`A browser artifact contains server-secret environment names or a full environment dump shape.`,gu=e=>su(e)??(cu(e)?Rl:void 0),_u=U({id:`artifact-env-leak`,title:`Server env leaked to browser artifact`,severity:`error`,recommendation:`Treat public env prefixes as publication, not secrecy; keep secret env vars server-only and rebuild after rotating leaked keys.`,scan:e=>{let t=!1,n=mu(e,e=>{let n=su(e);if(n)return t=!0,n;if(Rl.test(e))return Il.test(e)?(t=!0,Rl):Ll.test(e)?Rl:void 0},hu);if(n.length===0)return n;let r=t?n:mu(e,gu,hu),i=pu(e.relativePath,e.content);return i===void 0?n:i===e.content?r:mu({...e,content:i},gu,hu)}}),vu=U({id:`artifact-secret-leak`,title:`Secret shipped in browser artifact`,severity:`error`,recommendation:`Remove the secret from client bundles/static assets, rotate it, and route privileged service calls through server-only code.`,scan:e=>mu(e,e=>Nl.find(t=>t.test(e)),`A browser-delivered artifact contains a secret-looking credential value.`)}),yu=/(?:npm|pnpm|yarn|bun)\s+(?:install|ci)\b(?:(?!--ignore-scripts)[\s\S]){0,700}\bsecrets\.[A-Z0-9_]+|\bsecrets\.[A-Z0-9_]+(?:(?!--ignore-scripts)[\s\S]){0,700}(?:npm|pnpm|yarn|bun)\s+(?:install|ci)\b/i,bu=/(?:npm|pnpm|yarn|bun)\s+(?:install|ci)\b/i,xu=/\bsecrets\.[A-Z0-9_]+/,Su=/--ignore-scripts\b/,Cu=`The build or install pipeline can execute package lifecycle code while CI secrets may be present.`,wu=e=>/(?:^|\/)\.github\/workflows\/[^/]+\.ya?ml$/i.test(e),Tu=e=>{let t=e.split(`
 `),n=[],r=[],i,a,o;for(let e=0;e<t.length;e+=1){let s=t[e],c=s.trim();if(c===``||c.startsWith(`#`))continue;let l=s.length-s.trimStart().length;if(i!==void 0&&l<=i&&(i=void 0,a=void 0,o=void 0),i===void 0){/^steps:\s*(?:#.*)?$/.test(c)?i=l:n.push(s);continue}if((c===`-`||c.startsWith(`- `))&&(a===void 0||l===a)){a=l,o={startLineIndex:e,lines:[s]},r.push(o);continue}o===void 0?n.push(s):o.lines.push(s)}let s=xu.test(n.join(`
 `));for(let e of r){let t=e.lines.join(`
-`);if(!bu.test(t)||Su.test(t)||!s&&!xu.test(t))continue;let n=Math.max(e.lines.findIndex(e=>bu.test(e)),0),r=e.lines[n].search(bu);return[{message:Cu,line:e.startLineIndex+n+1,column:(r===-1?0:r)+1}]}return[]},Eu=K({shouldScan:e=>Zc(e.relativePath)&&!e.relativePath.endsWith(`package.json`)&&!wu(e.relativePath),pattern:yu,message:Cu}),Du=U({id:`build-pipeline-secret-boundary`,title:`Build pipeline runs code near secrets`,severity:`warn`,recommendation:`Run dependency installs with scripts disabled before exposing secrets, isolate untrusted build code, and move signing/deploy authority into a narrow privileged step.`,scan:e=>wu(e.relativePath)?Tu(e.content):Eu(e)}),Ou=U({id:`clickjacking-redirect-risk`,title:`Redirect or frame boundary risk`,severity:`warn`,recommendation:"Allowlist redirect origins/paths, set `frame-ancestors` for privileged pages, and avoid URL-prefilled privileged dialogs.",scan:K({shouldScan:e=>G(e.relativePath)||Zc(e.relativePath),pattern:/\bredirect\s*\((?!\s*(?:await\s+)?[\w$]*(?:safe|valid|sanitiz|allowlist|whitelist)[\w$]*\s*\()[^)'"`\n]*\b(?:searchParams\.get|nextUrl\.searchParams|returnTo|callbackUrl|continue|next)\b|<iframe\b[\s\S]{0,700}(?:\b(?:next=|continue=|redirect=|redirect_uri|userstoinvite|sharingaction|\.\.)|[?&](?:amp;)?role=)|frame-ancestors\s+(?:\*|'self'\s+\*)|X-Frame-Options["']?\s*:\s*["']?ALLOW/i,message:`Redirect or framing configuration may let attacker-controlled URLs chain into privileged UI or clickjacking.`})}),ku=e=>/(?:^|\/)(?:tools?|scripts?)\/|(?:^|\/)management\/commands\/|(?:^|\/)(?:build|make|gulpfile|gruntfile)\.[cm]?[jt]s$/i.test(e),Au=e=>$c(e,Ic),ju=String.raw`(?:req\.|request\.|params\.|query\.|body\.|searchParams|\$_(?:GET|POST|REQUEST))`,Mu=String.raw`(?:(?<![.\w$])(?:exec(?:Sync)?|system|passthru|proc_open|shell_exec)|\b(?:os\.system|subprocess\.(?:run|Popen|call)|(?:child_process|childProcess|cp)\.exec\w*))`,Nu=String.raw`(?:(?<![.\w$])spawn(?:Sync)?|\b(?:child_process|childProcess|cp)\.spawn\w*)`,Pu=String.raw`['"](?:sh|bash|zsh|dash|ksh|cmd(?:\.exe)?|powershell(?:\.exe)?|pwsh)['"]`,Fu=String.raw`['"](?:-c|/c|-Command)['"]`,Iu=U({id:`command-execution-input-risk`,title:`Command execution uses caller-shaped input`,severity:`error`,recommendation:`Avoid shell execution for caller-controlled values. Use fixed commands, argument arrays, strict allowlists, and no shell interpolation.`,scan:K({shouldScan:e=>Au(e.relativePath)&&!ku(e.relativePath),pattern:[new RegExp(String.raw`${Mu}\s*\([^)]{0,220}(?:${ju}|shell\s*=\s*true|f['"\`][^'"\`]*\{)`,`i`),new RegExp(String.raw`${Nu}\s*\((?:[^,)]{0,120}?${ju}|\s*${Pu}\s*,\s*\[\s*${Fu}\s*,[^\]]{0,220}${ju}|(?=[^)]{0,220}shell\s*[:=]\s*true)[^)]{0,220}${ju})`,`i`)],message:`Command execution appears to include request, query, body, or shell-interpolated input.`})}),Lu=U({id:`cors-cookie-trust-risk`,title:`Broad cookie or credentialed CORS trust`,severity:`warn`,recommendation:`Keep auth cookies host-only and HttpOnly, avoid credentialed CORS for less-trusted docs/vendor origins, and isolate documentation domains from app sessions.`,scan:K({shouldScan:e=>G(e.relativePath)||Zc(e.relativePath),pattern:/Access-Control-Allow-Credentials["']?\s*[:,]\s*["']?true[\s\S]{0,700}Access-Control-Allow-Origin["']?\s*[:,]\s*["']?(?:\*|https:\/\/docs\.|https:\/\/.*mintlify)|\b(?:session|auth|token|jwt)[^=\n]{0,80}(?:=[^;\n]{0,120};[^=\n]{0,80})?\bDomain=\./i,message:`Credentialed CORS or broad auth-cookie scope can make a docs/custom-domain XSS become account compromise.`})}),Ru=(e,t)=>{let n=e[t],r=n===`(`?`)`:n===`{`?`}`:n===`[`?`]`:``;if(r===``)return-1;let i=0,a=null;for(let o=t;o<e.length;o+=1){let t=e[o];if(a!==null){t===`\\`?o+=1:t===a&&(a=null);continue}if(t===`"`||t===`'`||t==="`")a=t;else if(t===n)i+=1;else if(t===r&&(--i,i===0))return o}return-1},zu=e=>`end`in e&&typeof e.end==`number`?e.end:-1,J=e=>`start`in e&&typeof e.start==`number`?e.start:-1,Bu=e=>{let t=O(e);for(;S(t,`SequenceExpression`);){let e=t.expressions.at(-1);if(!e)break;t=O(e)}return t},Vu=e=>{if(e.kind!==`import`)return null;let t=e.declarationNode.parent;return S(t,`ImportDeclaration`)?t:null},Hu=e=>{let t=[],n=new Map;for(let r of e){let e=`${r.truthiness}:${r.nullishness}`,i=n.get(r.expression);i?.has(e)||(i?i.add(e):n.set(r.expression,new Set([e])),t.push(r))}return t},Uu=e=>S(e,`JSXElement`)||S(e,`JSXFragment`)||S(e,`ArrayExpression`)||S(e,`ObjectExpression`)||S(e,`ArrowFunctionExpression`)||S(e,`FunctionExpression`)||S(e,`ClassExpression`)||S(e,`NewExpression`)?{expression:e,truthiness:`truthy`,nullishness:`non-nullish`}:S(e,`Literal`)?e.value===null?{expression:e,truthiness:`falsy`,nullishness:`nullish`}:{expression:e,truthiness:e.value?`truthy`:`falsy`,nullishness:`non-nullish`}:S(e,`UnaryExpression`)&&e.operator===`void`?{expression:e,truthiness:`falsy`,nullishness:`nullish`}:{expression:e,truthiness:`unknown`,nullishness:`unknown`},Y=e=>{let t=Bu(e);if(S(t,`ConditionalExpression`)){let e=Y(t.test);return e.every(e=>e.truthiness===`truthy`)?Y(t.consequent):e.every(e=>e.truthiness===`falsy`)?Y(t.alternate):Hu([...Y(t.consequent),...Y(t.alternate)])}if(!S(t,`LogicalExpression`))return[Uu(t)];let n=Y(t.left),r=Y(t.right),i=[];for(let e of n){if(t.operator===`&&`){e.truthiness!==`truthy`&&i.push(e.truthiness===`falsy`?e:{...e,truthiness:`falsy`}),e.truthiness!==`falsy`&&i.push(...r);continue}if(t.operator===`||`){e.truthiness!==`falsy`&&i.push(e.truthiness===`truthy`?e:{...e,truthiness:`truthy`,nullishness:`non-nullish`}),e.truthiness!==`truthy`&&i.push(...r);continue}e.nullishness!==`nullish`&&i.push(e.nullishness===`non-nullish`?e:{...e,nullishness:`non-nullish`}),e.nullishness!==`non-nullish`&&i.push(...r)}return Hu(i)},Wu=e=>{let t=[],n=new Set;for(let r of Y(e))n.has(r.expression)||(n.add(r.expression),t.push(r.expression));return t},Gu=new Set([`assign`,`defineProperties`,`defineProperty`]),Ku=new Set([`defineProperty`,`set`]),qu=new WeakMap,Ju=e=>{let t=F(e);for(;t.parent;){let e=t.parent;if(!S(e,`MemberExpression`)||e.object!==t)break;t=F(e)}return t},X=e=>{let t=e;for(;t;){if(x(t)||S(t,`Program`))return t;t=t.parent}return e},Z=(e,t)=>{if(S(e,`ReturnStatement`)||S(e,`ThrowStatement`)||S(e,`BreakStatement`)||t&&S(e,`ContinueStatement`))return!0;if(S(e,`BlockStatement`))return e.body.some(e=>Z(e,t));if(!S(e,`IfStatement`))return!1;if(S(e.test,`Literal`)){let n=e.test.value?e.consequent:e.alternate;return n?Z(n,t):!1}return!!(e.alternate&&Z(e.consequent,t)&&Z(e.alternate,t))},Yu=e=>Z(e,!0),Xu=(e,t)=>{let n=t.indexOf(e);return n>0&&t.slice(0,n).some(Yu)},Zu=(e,t)=>{let n=e;for(;n.parent&&n!==t;){let e=n.parent;if((S(e,`BlockStatement`)||S(e,`Program`))&&Xu(n,e.body)||(S(e,`WhileStatement`)&&S(e.test,`Literal`)&&!e.test.value||S(e,`ForStatement`)&&e.test&&S(e.test,`Literal`)&&!e.test.value)&&e.body===n||S(e,`SwitchCase`)&&Xu(n,e.consequent)||S(e,`IfStatement`)&&S(e.test,`Literal`)&&(e.test.value===!1&&e.consequent===n||e.test.value===!0&&e.alternate===n)||S(e,`ConditionalExpression`)&&S(e.test,`Literal`)&&(e.test.value===!1&&e.consequent===n||e.test.value===!0&&e.alternate===n)||S(e,`LogicalExpression`)&&e.right===n&&S(e.left,`Literal`)&&(e.operator===`&&`&&!e.left.value||e.operator===`||`&&e.left.value))return!0;n=e}return!1},Qu=(e,t)=>{let n=e;for(;n.parent&&n!==t;){let e=n.parent;if(S(e,`IfStatement`)&&(!S(e.test,`Literal`)||e.test.value===!0&&e.alternate===n||e.test.value===!1&&e.consequent===n)||S(e,`ConditionalExpression`)&&(!S(e.test,`Literal`)||e.test.value===!0&&e.alternate===n||e.test.value===!1&&e.consequent===n)||S(e,`LogicalExpression`)&&e.right===n&&(!S(e.left,`Literal`)||e.operator===`&&`&&!e.left.value||e.operator===`||`&&e.left.value)||S(e,`DoWhileStatement`)&&!(e.body===n&&S(e.test,`Literal`)&&!e.test.value)||S(e,`ForStatement`)||S(e,`ForInStatement`)||S(e,`ForOfStatement`)&&e.right!==n||S(e,`WhileStatement`)||S(e,`SwitchCase`)||S(e,`CatchClause`)||S(e,`TryStatement`)&&e.block===n||(S(e,`CallExpression`)||S(e,`MemberExpression`))&&e.optional)return!0;n=e}return!1},$u=(e,t)=>{let n=O(e);if(S(n,`Literal`))return!1;if(S(n,`Identifier`)){if(t.isGlobalReference(n)&&(n.name===`undefined`||n.name===`NaN`||n.name===`Infinity`))return!1;let e=t.symbolFor(n);return e?e.kind===`var`||e.kind===`function`||e.kind===`parameter`||e.kind===`import`?!1:J(e.declarationNode)>J(n):!0}if(S(n,`ArrayExpression`))return n.elements.some(e=>e?S(e,`SpreadElement`)?!0:$u(e,t):!1);if(S(n,`ObjectExpression`))return n.properties.length>0;if(S(n,`TemplateLiteral`))return n.expressions.length>0;if(S(n,`UnaryExpression`)){let e=O(n.argument);return n.operator===`typeof`&&S(e,`Identifier`)&&!t.symbolFor(e)?!1:$u(e,t)?!0:n.operator===`void`||n.operator===`typeof`||n.operator===`!`?!1:!(S(e,`Literal`)&&(typeof e.value==`number`||typeof e.value==`string`))}return!0},ed=(e,t,n)=>{let r=e;for(;r.parent&&r.parent!==t;)r=r.parent;let i=t.body.findIndex(e=>e===r);return r.parent!==t||i<=0?!1:t.body.slice(0,i).some(e=>S(e,`EmptyStatement`)?!1:S(e,`ExpressionStatement`)?$u(e.expression,n):S(e,`VariableDeclaration`)?e.declarations.some(e=>!S(e.id,`Identifier`)||!!(e.init&&$u(e.init,n))):!0)},td=(e,t)=>S(e,`AwaitExpression`)?$u(e.argument,t):!1,nd=(e,t,n)=>{let r=e;for(;r.parent&&r!==t;){let t=r.parent;if(S(t,`IfStatement`)&&(!S(t.test,`Literal`)||t.test.value===!0&&t.alternate===r||t.test.value===!1&&t.consequent===r)||S(t,`ConditionalExpression`)&&(!S(t.test,`Literal`)||t.test.value===!0&&t.alternate===r||t.test.value===!1&&t.consequent===r)||S(t,`LogicalExpression`)&&t.right===r&&(!S(t.left,`Literal`)||t.operator===`&&`&&!t.left.value||t.operator===`||`&&t.left.value)||S(t,`WhileStatement`)&&(!S(t.test,`Literal`)||!t.test.value)||S(t,`ForStatement`)&&t.test&&(!S(t.test,`Literal`)||!t.test.value)||S(t,`ForInStatement`)||S(t,`ForOfStatement`)||S(t,`SwitchCase`)||S(t,`CatchClause`)||S(t,`TryStatement`)&&t.block===r&&S(r,`BlockStatement`)&&(ed(e,r,n)||td(e,n))||(S(t,`CallExpression`)||S(t,`MemberExpression`))&&t.optional)return!0;r=t}return!1},rd=(e,t)=>{let n=e;for(;n;){if(n===t)return!0;n=n.parent}return!1},id=(e,t)=>{let n=e;for(;n.parent&&n!==t;){let e=n.parent;if(S(e,`IfStatement`)&&(!S(e.test,`Literal`)||e.test.value===!0&&e.alternate===n||e.test.value===!1&&e.consequent===n)||S(e,`ConditionalExpression`)&&(!S(e.test,`Literal`)||e.test.value===!0&&e.alternate===n||e.test.value===!1&&e.consequent===n)||S(e,`LogicalExpression`)&&e.right===n&&(!S(e.left,`Literal`)||e.operator===`&&`&&!e.left.value||e.operator===`||`&&e.left.value)||S(e,`ForStatement`)||S(e,`ForInStatement`)||S(e,`ForOfStatement`)||S(e,`WhileStatement`)||S(e,`SwitchCase`)||S(e,`CatchClause`)||S(e,`TryStatement`)&&e.block===n||(S(e,`CallExpression`)||S(e,`MemberExpression`))&&e.optional)return n;n=e}return null},ad=e=>S(e,`AwaitExpression`)||S(e,`YieldExpression`)?e.argument?zu(e.argument):zu(e):S(e,`ForOfStatement`)?zu(e.right):J(e),od=(e,t,n)=>{if(J(t)<ad(e))return!1;let r=id(e,n);return!!(r&&rd(t,r))},sd=e=>{let t=qu.get(e);if(t)return t;let n=(t,n,r)=>{let i=O(t);if(!S(i,`MemberExpression`))return!1;let a=O(i.object);return!!(S(a,`Identifier`)&&a.name===n&&e.isGlobalReference(a)&&r.has(M(i)??``))},r=e=>{let t=O(e);if(!S(t,`ObjectExpression`))return null;let n=new Set;for(let e of t.properties){if(!S(e,`Property`))return null;let t=N(e,{allowComputedString:!0});if(t===null)return null;n.add(t)}return n},i=e=>{let t=Ju(e),i=t.parent;if(i){if(S(i,`AssignmentExpression`)&&i.left===t||S(i,`UpdateExpression`)&&i.argument===t||S(i,`UnaryExpression`)&&i.operator===`delete`){if(!S(t,`MemberExpression`))return null;let e=M(t);return e===null?null:new Set([e])}if(!(!S(i,`CallExpression`)||i.arguments[0]!==t)){if(n(i.callee,`Object`,Gu)){let e=O(i.callee);if(!S(e,`MemberExpression`))return;let t=M(e);if(t===`assign`){let e=i.arguments.slice(1).map(r);return e.some(e=>e===null)?null:new Set(e.flatMap(e=>[...e??[]]))}if(t===`defineProperties`){let e=i.arguments[1];return e?r(e):null}let n=i.arguments[1];return n&&S(n,`Literal`)&&typeof n.value==`string`?new Set([n.value]):null}if(n(i.callee,`Reflect`,Ku)){let e=i.arguments[1];return e&&S(e,`Literal`)&&typeof e.value==`string`?new Set([e.value]):null}}}},a=e=>{let t=F(e),n=t.parent;if(S(n,`ForOfStatement`)&&n.right===t)return n.await||Z(n.body,!1);let r=n;if(!S(r,`MemberExpression`)||r.object!==t||M(r)!==`next`)return!1;let i=F(r);return!!(S(i.parent,`CallExpression`)&&i.parent.callee===i)},o=e=>{let t=F(e),n=t.parent;return S(n,`ForOfStatement`)&&!n.await&&n.right===t&&!Z(n.body,!1)?!0:!!(S(n,`SpreadElement`)&&n.parent&&!S(n.parent,`ObjectExpression`))},s=e=>{let t=F(e),n=t.parent;if(!S(n,`ForOfStatement`)||n.await||n.right!==t||Z(n.body,!1))return[];let r=X(n.body),i=new Set;return A(n.body,e=>{if(X(e)!==r||!S(e,`BreakStatement`))return;let a=e;if(e.label){for(;a?.parent;){let t=a.parent;if(S(t,`LabeledStatement`)&&t.label.name===e.label.name){rd(n,t.body)&&i.add(t);return}a=t}return}for(;a?.parent;){let e=a.parent;if(S(e,`ForStatement`)||S(e,`ForInStatement`)||S(e,`ForOfStatement`)||S(e,`WhileStatement`)||S(e,`DoWhileStatement`)||S(e,`SwitchStatement`)){S(e,`ForOfStatement`)&&e.right===t&&i.add(e);return}a=e}}),[...i]},c=t=>{let n=O(t.callee),r=null;if(x(n))r=n;else if(S(n,`Identifier`)){let t=P(n,e);if(t?.kind===`function`&&x(t.declarationNode))r=t.declarationNode;else if(t?.kind===`const`&&t.initializer){let e=O(t.initializer);x(e)&&(r=e)}}return r&&x(r)?r:null},l=e=>{let t=c(e);return!t||!x(t)?null:t.generator?a(e)||o(e)?t:null:t},u=[],d=new Map;A(e.rootScope.node,t=>{if(S(t,`CallExpression`)){let e=X(t),n=l(t);n&&!Zu(t,e)&&u.push({argumentCall:t,call:t,conditionalExitTargets:x(n)&&n.generator?s(t):[],owner:e,targetOwner:n,yieldCount:x(n)&&n.generator&&a(t)?1:null})}if(!S(t,`Identifier`))return;let n=i(t);if(n===void 0)return;let r=P(t,e);if(!r)return;let o=X(t);if(Zu(t,o))return;let c=d.get(r.id)??[];c.push({node:t,owner:o,propertyNames:n,symbolId:r.id}),d.set(r.id,c)});let f=t=>{let n=X(t),r=J(t),i=new Set,a=(e,t)=>{for(let n of u)n.owner!==e||J(n.call)>=t||i.has(n.targetOwner)||(i.add(n.targetOwner),a(n.targetOwner,1/0))};return a(n,r),S(n,`Program`)||a(e.rootScope.node,1/0),i},p=e=>{if(S(e,`Program`))return 1/0;let t=u.find(t=>S(t.owner,`Program`)&&t.targetOwner===e);return t?J(t.call):1/0},m=new Map;for(let e of u){let t=m.get(e.owner)??[];t.push(e),m.set(e.owner,t)}let h=new WeakMap,ee=(e,t)=>{let n=h.get(e)?.get(t);if(n!==void 0)return n;let r=[e],i=new Set,a=!1;for(;r.length>0;){let e=r.pop();if(!(!e||i.has(e))){if(e===t){a=!0;break}i.add(e);for(let t of m.get(e)??[])r.push(t.targetOwner)}}let o=h.get(e)??new WeakMap;return o.set(t,a),h.set(e,o),a},g=(e,t)=>{let n=new Set,r=e;for(;r?.parent&&r!==t;){let t=r.parent,i=S(t,`DoWhileStatement`)&&S(t.test,`Literal`)&&!t.test.value,a=S(t,`ForStatement`)||S(t,`ForInStatement`)||S(t,`ForOfStatement`)||S(t,`WhileStatement`)||S(t,`DoWhileStatement`)?t.body:null,o=e;for(;a&&S(a,`BlockStatement`)&&o&&o.parent!==a;)o=o.parent??null;let s=a&&S(a,`BlockStatement`)&&o?a.body.findIndex(e=>e===o):-1,c=!!(a&&S(a,`BlockStatement`)&&s>=0&&a.body.slice(s+1).some(e=>Z(e,!1)));a&&!i&&!c&&n.add(t),r=t}return n},_=(e,t,n)=>{let r=g(e,n);return r.size===0?!1:[...g(t,n)].some(e=>r.has(e))},v=new WeakMap,y=e=>{let t=v.get(e);if(t)return t;let n=new Map;for(let t of u){if(!ee(t.targetOwner,e))continue;let r=n.get(t.owner)??[];r.push(t),n.set(t.owner,r)}return v.set(e,n),n},te=(e,t)=>{let n=y(e),r=y(t);for(let[e,t]of n){let n=r.get(e);if(n){for(let r of t)for(let t of n)if(r!==t&&(J(r.call)<J(t.call)||x(e)||_(r.call,t.call,e)))return!0}}return!1},ne=e=>{let t=X(e);if(S(t,`Program`))return!1;let n=u.filter(e=>S(e.owner,`Program`)&&ee(e.targetOwner,t));return n.length===0?!1:n.length!==1||n[0]?.targetOwner!==t},re=e=>{let t=Ju(e.node),n=t.parent;return!!(S(t,`Identifier`)&&n&&(S(n,`AssignmentExpression`)&&n.left===t||S(n,`UpdateExpression`)&&n.argument===t))},ie=(t,n)=>{let r=O(t);if(S(r,`Identifier`)){let t=P(r,e);return t&&n.has(t.id)?n.get(t.id)??!1:null}if(S(r,`SequenceExpression`)){let e=r.expressions.at(-1);return e?ie(e,n):null}if(S(r,`ConditionalExpression`)){let e=ie(r.consequent,n),t=ie(r.alternate,n);return e===null&&t===null?null:e===null||t===null?!0:e||t}if(S(r,`LogicalExpression`)){let e=ie(r.left,n),t=ie(r.right,n);return e===null?t===null?null:!0:r.operator===`&&`?t:e}return null},ae=(e,t)=>{let n=Ju(e.node).parent;if(!n||!S(n,`AssignmentExpression`)){t.delete(e.symbolId);return}let r=t.get(e.symbolId)??!1,i=null;n.operator===`||=`||n.operator===`??=`?i=r:(n.operator===`=`||n.operator===`&&=`)&&(i=ie(n.right,t));let a=Qu(e.node,e.owner);i===null?a?t.set(e.symbolId,!0):t.delete(e.symbolId):t.set(e.symbolId,a&&r||i)},oe=(t,n)=>{if(!x(t.targetOwner))return n;let r=new Map(n);for(let[i,a]of t.targetOwner.params.entries()){let o=S(a,`AssignmentPattern`)?a.left:a;if(!S(o,`Identifier`))continue;let s=t.argumentCall.arguments[i],c=s&&!S(s,`SpreadElement`)?O(s):null,l=null;if(S(a,`AssignmentPattern`)&&(!c||S(c,`Identifier`)&&c.name===`undefined`&&e.isGlobalReference(c)||S(c,`UnaryExpression`)&&c.operator===`void`)&&S(a,`AssignmentPattern`)?l=O(a.right):c&&(l=c),!S(l,`Identifier`))continue;let u=P(l,e);if(!u||!n.has(u.id))continue;let d=e.symbolFor(o);d&&r.set(d.id,n.get(u.id)??!1)}return r},se=(t,n)=>{if(!x(t.targetOwner))return{conditionalSuspensions:[],conditionalStartIndex:1/0,cutoffIndex:1/0};let r=new Set;t.targetOwner.async&&(r.add(`AwaitExpression`),r.add(`ForOfStatement`));let i=t.conditionalExitTargets.some(e=>!n||!rd(n,e));(t.yieldCount!==null||i)&&r.add(`YieldExpression`);let a=[],o=1/0,s=1/0,c=0;return A(t.targetOwner.body,n=>{if(X(n)!==t.targetOwner||Zu(n,t.targetOwner)||!(r.has(n.type)&&(!S(n,`ForOfStatement`)||n.await)))return;let l=S(n,`YieldExpression`)&&n.argument?O(n.argument):null;if(S(n,`YieldExpression`)&&n.delegate&&l&&(S(l,`ArrayExpression`)&&l.elements.length===0||S(l,`Literal`)&&l.value===``))return;let u=ad(n);if(S(n,`YieldExpression`)){if(c+=1,i&&c>=1){o=Math.min(o,u);return}if(t.yieldCount===null||c>t.yieldCount)return}nd(n,t.targetOwner,e)?(a.push(n),o=Math.min(o,u)):s=Math.min(s,u)}),{conditionalSuspensions:a,conditionalStartIndex:Math.min(o,s),cutoffIndex:s}},ce=(e,t,n)=>{let r=(e,t,i)=>{if(t.has(e.targetOwner))return!1;let a=new Set(t);a.add(e.targetOwner);let o=new Map(oe(e,i)),s=se(e),c=[...[...o.keys()].flatMap(e=>d.get(e)??[]).filter(t=>t.owner===e.targetOwner).map(e=>({event:e,index:J(e.node)})),...u.filter(t=>t.owner===e.targetOwner).map(e=>({call:e,index:J(e.call)}))].sort((e,t)=>e.index-t.index);for(let t of c){if(t.index>=s.cutoffIndex)break;let i=`event`in t?t.event.node:t.call.call;if(!s.conditionalSuspensions.some(t=>od(t,i,e.targetOwner))){if(`event`in t){if(!o.has(t.event.symbolId))continue;if(re(t.event)){ae(t.event,o);continue}if(n===null||t.event.propertyNames===null||t.event.propertyNames.has(n))return!0;continue}if(r(t.call,a,o))return!0}}return!1};return r(e,new Set,t)},le={getEventsBefore:(t,n)=>{let r=[],i=(e,t,a,o,s,c,l)=>{if(s.has(e))return;let f=new Set(s);f.add(e);let p=new Map(l),m=[...[...p.keys()].flatMap(e=>d.get(e)??[]).filter(t=>t.owner===e).map(e=>({event:e,index:J(e.node)})),...u.filter(t=>t.owner===e).map(e=>({call:e,index:J(e.call)}))].sort((e,t)=>e.index-t.index);for(let s of m){if(s.index>=t)break;let l=`event`in s?s.event.node:s.call.call;if(o.some(t=>od(t,l,e)))continue;if(`event`in s){if(!p.has(s.event.symbolId))continue;let e=!!(c||p.get(s.event.symbolId)||Qu(s.event.node,s.event.owner)||s.index>a);if(re(s.event)){ae(s.event,p);continue}r.push({isConditional:e,node:s.event.node});continue}let u=se(s.call,n);i(s.call.targetOwner,u.cutoffIndex,u.conditionalStartIndex,u.conditionalSuspensions,f,c||Qu(s.call.call,s.call.owner)||s.index>a,oe(s.call,p))}},a=X(n),o=new Map([[t.id,!1]]);return S(a,`Program`)||i(e.rootScope.node,p(a),1/0,[],new Set,!1,o),i(a,J(n),1/0,[],new Set,!1,o),r},getOutermostTarget:Ju,isGlobalNamespaceMethod:n,isExecutionOrderAmbiguous:ne,isMutationOrderAmbiguous:(e,t,n)=>{let r=X(t),i=J(t);if((d.get(e.id)??[]).some(e=>n!==null&&e.propertyNames!==null&&!e.propertyNames.has(n)?!1:e.owner===r?J(e.node)>=i&&(x(r)||_(e.node,t,r)):S(e.owner,`Program`)?(y(r).get(e.owner)??[]).some(t=>_(e.node,t.call,e.owner)):ee(e.owner,r)||te(e.owner,r)))return!0;let a=new Map([[e.id,!1]]);return u.some(e=>e.owner===r&&J(e.call)>=i&&_(e.call,t,r)&&ce(e,a,n))},isMutatedBefore:(e,t,n)=>{let r=d.get(e.id);if(!r)return!1;let i=J(t),a=X(t),o=f(t);return r.some(e=>n!==null&&e.propertyNames!==null&&!e.propertyNames.has(n)?!1:e.owner===a?J(e.node)<i:S(e.owner,`Program`)&&!S(a,`Program`)?J(e.node)<p(a):o.has(e.owner))}};return qu.set(e,le),le},cd=(e,t)=>t===`katex`?e===`katex`||e.startsWith(`katex/`):e===t,ld=(e,t,n)=>{let r=O(e);if(!S(r,`CallExpression`))return!1;let i=O(r.callee),a=r.arguments[0];return!!(S(i,`Identifier`)&&i.name===`require`&&n.isGlobalReference(i)&&a&&S(a,`Literal`)&&typeof a.value==`string`&&cd(a.value,t))},ud=(e,t)=>{if(e.kind!==`ts-import-equals`)return!1;let n=e.declarationNode;if(!S(n,`TSImportEqualsDeclaration`))return!1;let r=n.moduleReference;return!!(S(r,`TSExternalModuleReference`)&&S(r.expression,`Literal`)&&typeof r.expression.value==`string`&&cd(r.expression.value,t))},dd=(e,t)=>{let n=O(e);return!!(S(n,`AwaitExpression`)&&S(n.argument,`ImportExpression`)&&S(n.argument.source,`Literal`)&&typeof n.argument.source.value==`string`&&cd(n.argument.source.value,t))},fd=(e,t,n,r,i)=>{let a=P(O(e),i),o=sd(i);if(!a||o.isExecutionOrderAmbiguous(r)||o.isMutationOrderAmbiguous(a,r,n)||o.isMutatedBefore(a,r,n))return null;let s=Vu(a);if(typeof s?.source.value==`string`&&cd(s.source.value,t))return S(a.declarationNode,`ImportDefaultSpecifier`)||S(a.declarationNode,`ImportNamespaceSpecifier`)||j(a.declarationNode)===`default`?a:null;if(ud(a,t))return a;if(a.kind!==`const`||!a.initializer)return null;let c=O(a.initializer);return ld(c,t,i)||S(c,`MemberExpression`)&&M(c)===`default`&&(ld(c.object,t,i)||dd(c.object,t))||dd(c,t)?a:null},pd=(e,t,n,r,i)=>{let a=P(O(e),i);if(!a)return null;let o=Vu(a),s=sd(i);return typeof o?.source.value!=`string`||!cd(o.source.value,t)||j(a.declarationNode)!==n||s.isExecutionOrderAmbiguous(r)||s.isMutationOrderAmbiguous(a,r,null)||s.isMutatedBefore(a,r,null)?null:a},md=(e,t,n)=>fd(e,`katex`,`renderToString`,t,n)!==null||ld(e,`katex`,n),hd=(e,t,n)=>{if(pd(e,`katex`,`renderToString`,t,n))return!0;let r=O(e);if(!S(r,`Identifier`))return!1;let i=n.referenceFor(r)?.resolvedSymbol;if(!i||i.kind!==`const`||!i.initializer||sd(n).isMutatedBefore(i,t,null))return!1;let a=O(i.initializer),o=i.bindingIdentifier.parent;return S(o,`Property`)&&N(o,{allowComputedString:!0})===`renderToString`?md(a,i.declarationNode,n):S(a,`MemberExpression`)&&M(a)===`renderToString`&&md(a.object,i.declarationNode,n)?!0:S(a,`Identifier`)?hd(a,i.declarationNode,n):!1},gd=(e,t)=>{let n=O(e);if(S(n,`Identifier`)){if(!/katex/i.test(n.name))return!1;let e=t.referenceFor(n)?.resolvedSymbol;return!!(e&&e.kind!==`parameter`&&e.kind!==`let`)}if(!S(n,`MemberExpression`)||M(n)!==`renderToString`)return!1;let r=O(n.object);if(!S(r,`Identifier`)||!/katex/i.test(r.name))return!1;let i=t.referenceFor(r)?.resolvedSymbol;if(!i)return!1;if(i.kind===`import`){if(!cd(String(Vu(i)?.source.value??``),`katex`))return!0;let e=sd(t);return e.isExecutionOrderAmbiguous(n)||e.isMutationOrderAmbiguous(i,n,`renderToString`)?!1:e.isMutatedBefore(i,n,`renderToString`)}if(i.kind===`parameter`||i.kind===`let`||i.kind===`var`)return!0;if(i.kind!==`const`||!i.initializer)return!1;let a=O(i.initializer);if(S(a,`ObjectExpression`))return!0;if(S(a,`CallExpression`)){let e=O(a.callee);return S(e,`Identifier`)&&e.name===`require`}return S(a,`AwaitExpression`)&&S(a.argument,`ImportExpression`)},_d=(e,t)=>{let n=O(e);if(!S(n,`ObjectExpression`))return null;let r;for(let e of n.properties){if(!S(e,`Property`)){r=null;continue}let n=N(e,{allowComputedString:!0});if(n===null){r=null;continue}n===t&&(r=e.kind===`init`?e.value:null)}return r},vd=e=>{let t=O(e);if(!S(t,`ObjectExpression`))return null;for(let e of t.properties){if(!S(e,`Property`))return null;let t=N(e,{allowComputedString:!0});if(t===null||t===`get`||t===`set`)return null}return _d(t,`value`)},yd=new WeakMap,bd=(e,t)=>{let n=O(e);return S(n,`Identifier`)?n.name===`undefined`&&t.isGlobalReference(n):S(n,`Literal`)&&!n.value},xd=(e,t,n)=>{let r=vd(t);return r===null?`trusted`:r===void 0?e:bd(r,n)?`untrusted`:`trusted`},Sd=(e,t)=>e===t?e:e===`trusted`||t===`trusted`?`trusted`:e===`unsupported`||t===`unsupported`?`unsupported`:`untrusted`,Cd=(e,t,n,r)=>{let i=sd(n),a=i.getOutermostTarget(t),o=a.parent;if(!o)return`unsupported`;if(S(o,`AssignmentExpression`)&&o.left===a){if(!S(a,`MemberExpression`))return`unsupported`;let t=M(a);return t===null?`trusted`:t===`trust`?bd(o.right,n)?`untrusted`:`trusted`:e}if(S(o,`UnaryExpression`)&&o.operator===`delete`){if(!S(a,`MemberExpression`))return`unsupported`;let t=M(a);return t===null?`trusted`:t===`trust`?`absent`:e}if(S(o,`UpdateExpression`)){if(!S(a,`MemberExpression`))return`unsupported`;let t=M(a);return t===`trust`||t===null?`trusted`:e}if(!S(o,`CallExpression`)||o.arguments[0]!==a)return`unsupported`;if(i.isGlobalNamespaceMethod(o.callee,`Object`,Gu)){let t=O(o.callee);if(!S(t,`MemberExpression`))return`unsupported`;let i=M(t);if(i===`assign`){let t=e;for(let e of o.arguments.slice(1)){let i=wd(e,e,n,new Set(r));i!==`absent`&&(t=i)}return t}if(i===`defineProperties`){let t=o.arguments[1];if(!t)return`unsupported`;let r=_d(t,`trust`);return r===null?`trusted`:r===void 0?e:xd(e,r,n)}let a=o.arguments[1];if(!a||!S(a,`Literal`)||typeof a.value!=`string`)return`trusted`;if(a.value!==`trust`)return e;let s=o.arguments[2];return s?xd(e,s,n):`unsupported`}if(i.isGlobalNamespaceMethod(o.callee,`Reflect`,Ku)){let t=O(o.callee);if(!S(t,`MemberExpression`))return`unsupported`;let r=M(t),i=o.arguments[1];if(!i||!S(i,`Literal`)||typeof i.value!=`string`)return`trusted`;if(i.value!==`trust`)return e;let a=o.arguments[2];return a?r===`defineProperty`?xd(e,a,n):bd(a,n)?`untrusted`:`trusted`:`unsupported`}return`unsupported`},wd=(e,t,n,r)=>{if(e===void 0)return`absent`;let i=O(e);if(S(i,`Identifier`)){if(i.name===`undefined`&&n.isGlobalReference(i))return`absent`;let e=P(i,n);if(!e||e.kind!==`const`||!e.initializer||r.has(e.id))return`unsupported`;let a=new Set(r);a.add(e.id);let o=sd(n);if(o.isMutationOrderAmbiguous(e,t,`trust`))return`unsupported`;let s=wd(e.initializer,t,n,a);for(let r of o.getEventsBefore(e,t)){let e=Cd(s,r.node,n,a);s=r.isConditional?Sd(s,e):e}return s}if(!S(i,`ObjectExpression`))return`unsupported`;let a=`absent`;for(let e of i.properties){if(S(e,`SpreadElement`)){let t=wd(e.argument,e.argument,n,new Set(r));t!==`absent`&&(a=t===`unsupported`?`trusted`:t);continue}if(!S(e,`Property`)){a=`trusted`;continue}let t=N(e,{allowComputedString:!0});if(t===null){a=`trusted`;continue}t===`trust`&&(a=bd(e.value,n)?`untrusted`:`trusted`)}return a},Td=(e,t,n)=>{let r=yd.get(e),i=new Map(r);for(let[e,n]of t)i.set(e,n);yd.set(e,i);try{return n()}finally{r?yd.set(e,r):yd.delete(e)}},Ed=(e,t,n,r)=>{let i=e?O(e):void 0;if(i&&S(i,`Identifier`)){let e=n.referenceFor(i)?.resolvedSymbol,t=e?yd.get(n)?.get(e.id):void 0;if(t)return t}let a=wd(e,t,n,r);return{isSafe:a===`absent`||a===`untrusted`}},Dd={containsKatex:!1,isConclusive:!0,isSafe:!0,isSafeInAttributeContext:!0},Od={containsKatex:!1,isConclusive:!0,isSafe:!0,isSafeInAttributeContext:!1},Q={containsKatex:!1,isConclusive:!1,isSafe:!1,isSafeInAttributeContext:!1},kd={containsKatex:!0,isConclusive:!1,isSafe:!1,isSafeInAttributeContext:!1},Ad={containsKatex:!0,isConclusive:!0,isSafe:!1,isSafeInAttributeContext:!1},jd=new WeakMap,Md=new WeakMap,Nd=(e,t,n)=>{jd.set(e,t),Md.set(e,n)},Pd=e=>({containsKatex:e.some(e=>e.containsKatex),isConclusive:e.every(e=>e.isSafe)?e.filter(e=>e.containsKatex).every(e=>e.isConclusive):e.some(e=>e.containsKatex&&e.isConclusive&&!e.isSafe)||e.some(e=>e.containsKatex&&e.isConclusive)&&e.some(e=>!e.containsKatex&&!e.isSafe),isSafe:e.every(e=>e.isSafe),isSafeInAttributeContext:e.every(e=>e.isSafeInAttributeContext)}),Fd=(e,t)=>{let n=O(e);if(!S(n,`ObjectExpression`))return{isKnown:!1,value:null};let r=!0,i=null;for(let e of n.properties){if(!S(e,`Property`)){r=!1,i=null;continue}let n=N(e,{allowComputedString:!0});n===null?(r=!1,i=null):n===t&&(r=!0,i=e.value)}return{isKnown:r,value:i}},Id=(e,t)=>{let n=O(e);if(S(n,`Identifier`)){let e=P(n,t);return!!(e&&e.kind===`import`&&Vu(e)?.source.value===`react`&&j(e.declarationNode)===`useMemo`)}if(!S(n,`MemberExpression`)||M(n)!==`useMemo`)return!1;let r=P(O(n.object),t);return!!(r&&r.kind===`import`&&Vu(r)?.source.value===`react`&&(S(r.declarationNode,`ImportDefaultSpecifier`)||S(r.declarationNode,`ImportNamespaceSpecifier`)||j(r.declarationNode)===`default`))},Ld=(e,t)=>{let n=O(e),r=!1;for(;S(n,`CallExpression`);){let e=O(n.callee);if(!S(e,`MemberExpression`))return!1;let t=M(e);if(t!==`replace`&&t!==`replaceAll`)return!1;let i=n.arguments[0],a=n.arguments[1];if(!i||!a||!S(a,`Literal`)||typeof a.value!=`string`||a.value.includes(`<`)||a.value.includes(`$`))return!1;if(S(i,`Literal`)){let e=`regex`in i?i.regex:void 0,n=t===`replaceAll`&&i.value===`<`,a=e?.pattern===`<`&&e.flags.includes(`g`);(n||a)&&(r=!0)}n=O(e.object)}return!r||!S(n,`Identifier`)?!1:t.referenceFor(n)?.resolvedSymbol?.kind===`parameter`},Rd=(e,t)=>{let n=O(e.callee);return S(n,`MemberExpression`)&&M(n)===`sanitize`&&(fd(n.object,`dompurify`,`sanitize`,e,t)||fd(n.object,`isomorphic-dompurify`,`sanitize`,e,t))?Od:S(n,`MemberExpression`)&&M(n)===`escape`&&fd(n.object,`html-escaper`,`escape`,e,t)||pd(n,`html-escaper`,`escape`,e,t)?Dd:pd(n,`dompurify`,`sanitize`,e,t)||pd(n,`isomorphic-dompurify`,`sanitize`,e,t)?Od:null},zd=(e,t)=>{if(!t.isSafe)return null;let n=O(e.callee);if(!S(n,`MemberExpression`))return null;let r=M(n);if((r===`trim`||r===`trimEnd`||r===`trimStart`)&&e.arguments.length===0)return t;if(r!==`replace`&&r!==`replaceAll`)return null;let i=e.arguments[1];return!i||!S(i,`Literal`)||typeof i.value!=`string`||i.value.includes(`<`)?null:{containsKatex:t.containsKatex,isConclusive:t.isConclusive,isSafe:!0,isSafeInAttributeContext:t.isSafeInAttributeContext&&!/[&>"']/.test(i.value)}},Bd=e=>{let t=e.toLowerCase();for(let e of[`script`,`style`,`textarea`,`title`])if(t.lastIndexOf(`<${e}`)>t.lastIndexOf(`</${e}`))return`raw-text`;let n=e.lastIndexOf(`<`);if(n<=e.lastIndexOf(`>`))return`text`;let r=e.slice(n+1),i=null;for(let e=0;e<r.length;e+=1){let t=r[e];(t===`"`||t===`'`)&&r[e-1]!==`\\`&&(i===t?i=null:i===null&&(i=t))}return i===null?`unsafe-tag`:`attribute`},Vd=(e,t,n,r)=>{let i=e.expressions.map(e=>$(e,t,new Set(n),r)),a=``,o=!0;for(let t=0;t<i.length;t+=1){a+=e.quasis[t]?.value.raw??``;let n=Bd(a),r=i[t]??Q;n===`text`?o&&=r.isSafe:n===`attribute`?o&&=r.isSafeInAttributeContext:o=!1}return{containsKatex:i.some(e=>e.containsKatex),isConclusive:o?i.filter(e=>e.containsKatex).every(e=>e.isConclusive):i.some(e=>e.containsKatex&&e.isConclusive&&!e.isSafe)||i.some(e=>e.containsKatex&&e.isConclusive)&&i.some(e=>!e.containsKatex&&!e.isSafe),isSafe:o,isSafeInAttributeContext:!1}},Hd=(e,t)=>{let n=e;for(;n.parent&&n!==t;){let e=n.parent;if(S(e,`BlockStatement`)){let t=e.body.findIndex(e=>e===n);if(t>0&&e.body.slice(0,t).some(e=>L(e)))return!0}if(S(e,`SwitchCase`)){let t=e.consequent.findIndex(e=>e===n);if(t>0&&e.consequent.slice(0,t).some(e=>L(e)))return!0}if(S(e,`IfStatement`)&&S(e.test,`Literal`)){let t=e.alternate,r=e.consequent,i=!!e.test.value;if(!i&&r===n||i&&t===n)return!0}if(S(e,`WhileStatement`)&&e.body===n){let t=e.test;if(S(t,`Literal`)&&!t.value)return!0}if(S(e,`ForStatement`)&&e.body===n){let t=e.test;if(t&&S(t,`Literal`)&&!t.value)return!0}n=e}return!1},Ud=(e,t,n,r=new Map)=>{if(!x(e))return Q;if(!S(e.body,`BlockStatement`))return $(e.body,t,n,r);let i=e.body,a=[];return A(i,e=>{if(e!==i&&x(e))return!1;if(S(e,`ReturnStatement`))return Hd(e,i)||a.push(e.argument?$(e.argument,t,new Set(n),r):Dd),!1}),a.length===0?Dd:Pd(a)},Wd=(e,t)=>{let n=O(e);if(!S(n,`Identifier`))return null;let r=P(n,t);if(!r||r.references.some(e=>e.flag!==`read`))return null;if(r.kind===`function`&&x(r.declarationNode))return{functionNode:r.declarationNode,symbol:r};if(r.kind!==`const`||!r.initializer)return null;let i=O(r.initializer);return x(i)?{functionNode:i,symbol:r}:null},Gd=(e,t,n,r)=>{let i=new Map;if(!x(e))return i;let a=(e,t)=>e===void 0||S(e,`Identifier`)&&e.name===`undefined`&&t.isGlobalReference(e)||S(e,`UnaryExpression`)&&e.operator===`void`,o=(e,t,n,a)=>a?Td(r,i,()=>Ed(e,t,n,new Set)):Ed(e,t,n,new Set);for(let[s,c]of e.params.entries()){let e=t.arguments[s],l=S(c,`AssignmentPattern`)&&a(e,n),u=l&&S(c,`AssignmentPattern`)?c.right:e,d=l?r:n,f=l?c:t,p=S(c,`AssignmentPattern`)?c.left:c;if(S(p,`Identifier`)){let e=r.symbolFor(p);if(!e||e.references.some(e=>e.flag!==`read`))continue;i.set(e.id,o(u,f,d,l));continue}if(!(!S(p,`ObjectPattern`)||!u))for(let e of p.properties){if(!S(e,`Property`))continue;let t=N(e,{allowComputedString:!0});if(t===null)continue;let n=Fd(u,t),s=S(e.value,`AssignmentPattern`)?e.value.left:e.value;if(!S(s,`Identifier`))continue;let c=r.symbolFor(s);if(!n.isKnown||!c||c.references.some(e=>e.flag!==`read`))continue;let l=S(e.value,`AssignmentPattern`)&&(n.value===null||a(n.value??void 0,d)),p=l&&S(e.value,`AssignmentPattern`)?e.value.right:n.value??void 0,m=l?r:d,h=l?e:f;i.set(c.id,o(p,h,m,l))}}return i},Kd=(e,t)=>{let n=O(e.callee);if(!S(n,`Identifier`))return null;let r=P(n,t);if(!r||r.kind!==`import`)return null;let i=Vu(r),a=j(r.declarationNode),o=jd.get(t),s=i?.source.value,c=Md.get(t)??0;if(!o||typeof s!=`string`||!a||c>=2)return null;let l=On(o,s,a);if(!l||!x(l.functionNode))return null;let u=Ne(l.programNode);return Nd(u,l.filePath,c+1),Td(u,Gd(l.functionNode,e,t,u),()=>Ud(l.functionNode,u,new Set))},qd=(e,t,n,r)=>{if(!S(e,`CallExpression`))return Q;let i=O(e.callee);if(S(i,`MemberExpression`)&&M(i)===`renderToString`&&md(i.object,e,t)||hd(i,e,t))return{containsKatex:!0,isConclusive:!0,isSafe:Ed(e.arguments[1],e,t,new Set).isSafe,isSafeInAttributeContext:!1};let a=Kd(e,t);if(a?.containsKatex)return a;let o=Wd(i,t);if(o&&!n.has(o.symbol.id)){let i=new Set(n);i.add(o.symbol.id);let a=e.arguments.map(e=>{let i=O(e);return x(i)?Ud(i,t,new Set(n),r):$(i,t,new Set(n),r)}),s=new Map,c=!1;if(x(o.functionNode))for(let[e,n]of o.functionNode.params.entries()){if(!S(n,`Identifier`))continue;let r=t.symbolFor(n),i=a[e],o=r?.references.every(e=>e.flag===`read`);r&&i&&o&&s.set(r.id,i),i?.containsKatex&&r&&!o&&(c=!0)}let l=Td(t,Gd(o.functionNode,e,t,t),()=>Ud(o.functionNode,t,i,s));return!a.some(e=>e.containsKatex)||l.containsKatex?l:c?kd:Ad}if(gd(i,t))return{containsKatex:!0,isConclusive:!0,isSafe:!1,isSafeInAttributeContext:!1};if(S(i,`MemberExpression`)){let a=$(i.object,t,new Set(n),r);if(a.containsKatex)return zd(e,a)||(a.isConclusive?{containsKatex:!0,isConclusive:!0,isSafe:!1,isSafeInAttributeContext:!1}:kd)}let s=Rd(e,t);if(s)return s;if(Ld(e,t))return Od;if(Id(i,t)){let i=e.arguments[0];if(!i)return Q;let a=O(i);if(x(a))return Ud(a,t,new Set(n),r);let o=Wd(a,t);if(!o||n.has(o.symbol.id))return Q;let s=new Set(n);return s.add(o.symbol.id),Ud(o.functionNode,t,s,r)}return e.arguments.some(e=>{let i=O(e);return(x(i)?Ud(i,t,new Set(n),r):$(i,t,new Set(n),r)).containsKatex})?kd:Q},Jd=(e,t)=>{let n=Bu(e);if(S(n,`Literal`))return!!n.value;if(S(n,`Identifier`)&&(n.name===`undefined`||n.name===`NaN`)&&t.isGlobalReference(n))return!1;if(S(n,`TemplateLiteral`)){let e=Sa(n);return e===null?null:!!e}if(S(n,`ArrayExpression`)||S(n,`ObjectExpression`)||S(n,`ArrowFunctionExpression`)||S(n,`FunctionExpression`)||S(n,`ClassExpression`)||S(n,`NewExpression`)||S(n,`JSXElement`)||S(n,`JSXFragment`))return!0;if(S(n,`UnaryExpression`)){if(n.operator===`void`)return!1;if(n.operator===`typeof`)return!0;if(n.operator===`!`){let e=Jd(n.argument,t);return e===null?null:!e}}return null},$=(e,t,n,r=new Map)=>{let i=O(e);if(S(i,`Literal`)||S(i,`UnaryExpression`)&&i.operator===`void`)return Dd;if(S(i,`Identifier`)){if((i.name===`undefined`||i.name===`NaN`)&&t.isGlobalReference(i))return Dd;let e=t.referenceFor(i)?.resolvedSymbol,a=e?r.get(e.id):void 0;if(a)return a;if(!e||e.kind!==`const`||!e.initializer||n.has(e.id))return Q;let o=new Set(n);return o.add(e.id),$(e.initializer,t,o,r)}if(S(i,`CallExpression`))return qd(i,t,n,r);if(S(i,`TemplateLiteral`))return Vd(i,t,n,r);if(S(i,`ConditionalExpression`)){let e=Jd(i.test,t);return e===null?Pd([$(i.consequent,t,new Set(n),r),$(i.alternate,t,new Set(n),r)]):$(e?i.consequent:i.alternate,t,new Set(n),r)}if(S(i,`LogicalExpression`)){let e=i.operator===`??`?null:Jd(i.left,t);if(e!==null)return $(i.operator===`&&`?e?i.right:i.left:e?i.left:i.right,t,new Set(n),r);let a=Wu(i);if(a.length===1)return $(a[0]??i,t,new Set(n),r);let o=[i.left,i.right].map(e=>$(e,t,new Set(n),r));return{...i.operator===`&&`?o[1]??Q:Pd(a.map(e=>$(e,t,new Set(n),r))),containsKatex:o.some(e=>e.containsKatex)}}if(S(i,`BinaryExpression`)&&i.operator===`+`)return Pd([$(i.left,t,new Set(n),r),$(i.right,t,new Set(n),r)]);if(S(i,`SequenceExpression`)){let e=i.expressions.at(-1);return e?$(e,t,n,r):Q}return Q},Yd=e=>{let t=null;if(S(e,`JSXAttribute`)&&S(e.name,`JSXIdentifier`)&&e.name.name===`dangerouslySetInnerHTML`&&S(e.value,`JSXExpressionContainer`)&&S(e.value.expression,`ObjectExpression`)&&(t=e.value.expression),S(e,`Property`)&&N(e,{allowComputedString:!0})===`dangerouslySetInnerHTML`&&S(O(e.value),`ObjectExpression`)&&(t=O(e.value)),!S(t,`ObjectExpression`))return null;let n=null;for(let e of t.properties){if(S(e,`SpreadElement`)){n=null;continue}if(!S(e,`Property`)){n=null;continue}let t=N(e,{allowComputedString:!0});if(t===null){n=null;continue}t===`__html`&&(n=e.value)}return n},Xd=(e,t)=>{let n=It({filename:t,sourceText:e});if(n===null)return[];let r=Ne(n);Nd(r,t,0);let i=[];return A(n,e=>{let t=Yd(e);if(t===null)return;let n=$(t,r,new Set);if(!n.containsKatex)return;let a=J(e),o=zu(e);a<0||o<0||i.push({endIndex:o,proof:n,startIndex:a})}),i},Zd=/dangerouslySetInnerHTML|(?:\.(?:inner|outer)HTML|\[\s*["'](?:inner|outer)HTML["']\s*\])\s*[+]?=(?!=)|\.insertAdjacentHTML\s*\(|\bdocument\.write(?:ln)?\s*\(|\.(?:createContextualFragment|setHTMLUnsafe)\s*\(/,Qd=/(?:__html\s*:|(?:\.(?:inner|outer)HTML|\[\s*["'](?:inner|outer)HTML["']\s*\])\s*[+]?=(?!=)|\.insertAdjacentHTML\s*\(\s*[^,]*,|\bdocument\.write(?:ln)?\s*\(|\.(?:createContextualFragment|setHTMLUnsafe)\s*\()\s*([\s\S]*)/,$d=/searchParams|query|params|request|req\.|response\.|result\.|data\.|await|fetch|props\.|children|content|html|body|text|message|markup|\blocation\b|document\.cookie|\breferrer\b|\blocalStorage\b|\bsessionStorage\b|URLSearchParams|window\.name/i,ef=/^(?:"(?:\\.|[^"\\\n])*"|'(?:\\.|[^'\\\n])*'|`[^`$]*`)\s*(?:\/\/[^\n]*)?\s*(?:[;,})\n]|$)/,tf=/^[A-Z][A-Z0-9_]*\s*(?:\/\/[^\n]*)?\s*(?:[;,})\n]|$)/,nf=/^[\w$]+(?:\??\.[\w$]+)*\??\.(?:inner|outer)HTML\b/,rf=/\b(?:DOMPurify|sanitize\w*|purify|(?:escape|encode)[A-Za-z]*(?:Html|HTML|Entit\w*)|insane|xss)\b|(?<!un)safe|(?<!un)saniti[sz]/i,af=/[:=]\s*[^\n;]*\b(?:DOMPurify\b|sanitize\w*\s*\(|purify\w*\s*\()/i,of=/=\s*[\w$.?[\]]*\.(?:inner|outer)HTML\s*(?:[;,)\n]|$)/,sf=/process\.env/,cf=/\b(?:t|i18n|translate|formatMessage|intl)\s*[.(]/,lf=/^(?:[\w$.]+\.)?(?:toHtml|render[A-Za-z]*(?:Html|HTML)|renderToString|renderToStaticMarkup|codeToHtml|codeToHast|highlight[A-Za-z]*)\s*\(/,uf=/\b(?:shiki|prism|hljs|highlightjs|getHighlighter|codeToHtml|codeToHast|refractor|lowlight|starry-night)\b|highlight\.js/i,df=/[:=]\s*[^\n;]*(?:\b(?:katex|shiki|hljs|prism|mermaid)\b|hast-util-to-html|renderHtmlFromRichText|(?:toHtml|render[A-Za-z]*(?:Html|HTML)|renderToString|renderToStaticMarkup|codeToHtml|codeToHast)\s*\()/i,ff=/\b(?:(?:katex|shiki|hljs|prism|mermaid|highlighter)[\w$]*\.(?:render\w*|highlight\w*|codeTo(?:Html|Hast))|(?:toHtml|render(?:Html|HTML)[A-Za-z]*|render[A-Za-z]*(?:Html|HTML)|renderToString|renderToStaticMarkup|codeToHtml|codeToHast|highlight[A-Za-z]*))\s*\(/i,pf=/^[\w$]+\s*(?:[;,})\n]|$)/,mf=/^[\w$]+\s*(?:\|\||\?\?)\s*(?:"[^"\n]*"|'[^'\n]*'|`[^`$]*`)\s*(?:[;,})\n]|$)/,hf=/^[\w$]+(?:\.[\w$]+|\[[^\]]*\])+\s*(?:[;,})\n]|$)/,gf=/<style\b[^<>]*$/,_f=/(?:^|\/)emails(?:\/|$)|email[-_.]templates?(?:\/|$)|RawHtml|[A-Za-z]*[Ee]mail[A-Za-z]*\.(?:t|j)sx?/i,vf=/(?:^|\/)\.[\w-]+\//,yf=/(?<!un)saniti[sz]e?d?[\w-]*\.[cm]?[jt]sx?$/i,bf=/(?:^|[^\w$.])([\w$]+(?:\.[\w$]+)*)(?:(?:\.(?:inner|outer)HTML|\[\s*["'](?:inner|outer)HTML["']\s*\])\s*[+]?=(?!=)|\.insertAdjacentHTML\s*\()/,xf=/\b(?:appendChild|append|prepend|before|after|replaceWith|replaceChild|replaceChildren|insertBefore|insertAdjacentElement)\s*\(/,Sf=5e3,Cf=e=>{if(!e.startsWith("`"))return null;let t=e.indexOf("`",1);if(t<0||t>Sf)return null;let n=e.slice(1,t).match(/\$\{[^}]*\}/g);return n===null?``:n.join(` `)},wf=(e,t,n)=>{let r=jf(e,t,n);return r===null?null:n.slice(r.initializerStartIndex,r.initializerStartIndex+Sf)},Tf=e=>{if(!/^["']/.test(e))return!1;let t=e.replace(/"(?:\\.|[^"\\\n])*"|'(?:\\.|[^'\\\n])*'/g,``),n=t.search(/[;,})\]]/),r=n>=0?t.slice(0,n):t;return/^[\s+]*$/.test(r)},Ef=(e,t)=>{let n=t.includes(`createElement`),r=t.includes(`createHTMLDocument`);if(!n&&!r)return!1;let i=q(e),a=q(e.split(`.`)[0]??e);if(RegExp(`\\b${a}\\s*=\\s*[^\\n;]*(?:getElementById|querySelector|getElementsBy|\\.current\\b|document\\.(?:body|head|documentElement))`).test(t))return!1;if(n&&(RegExp(`${i}\\s*=\\s*document\\.createElement\\(\\s*["'\`]template["'\`]`).test(t)||RegExp(`${a}\\s*=\\s*[^\\n;]*\\bcreateElement\\(\\s*["'\`](?:style|textarea)["'\`]`).test(t))||r&&RegExp(`${a}\\s*=\\s*[^\\n;]*\\bcreateHTMLDocument\\s*\\(`).test(t))return!0;if(!n||!RegExp(`${a}\\s*=\\s*[^\\n;]*\\bcreateElement\\s*\\(`).test(t))return!1;let o=RegExp(`${xf.source}[^)]*\\b${a}\\b`),s=RegExp(`\\breturn\\b[^\\n]*\\b${a}\\b(?!\\s*\\.\\s*(?:textContent|innerText|innerHTML|outerHTML))`);return o.test(t)||s.test(t)?!1:RegExp(`\\b${a}\\.(?:textContent|innerText|querySelector|querySelectorAll|children|childNodes)\\b`).test(t)},Df=e=>{let t=[],n=``,r=0,i=null;for(let a=0;a<e.length;a+=1){let o=e[a];if(i!==null){n+=o,o===i&&e[a-1]!==`\\`&&(i=null);continue}if(o===`"`||o===`'`||o==="`"){i=o,n+=o;continue}if(o===`(`||o===`[`||o===`{`?r+=1:(o===`)`||o===`]`||o===`}`)&&--r,o===`+`&&r===0&&e[a-1]!==`+`&&e[a+1]!==`+`){t.push(n),n=``;continue}n+=o}return t.push(n),t},Of=e=>{let t=e.replace(/[;}]\s*$/,``).trim();if(!t.includes(`+`))return!1;let n=Df(t).map(e=>e.trim()).filter(e=>e.length>0);return n.length<2?!1:n.every(e=>{let t=e.replace(/\(\s*([\w$]+(?:\??\.[\w$]+)*)\s+as\s+[^)]*\)/g,`$1`);return nf.test(t)?!$d.test(t.replace(nf,``)):!1})},kf=(e,t)=>{let n=0,r=null;for(let i=t;i<e.length;i+=1){let t=e[i];if(r!==null){t===r&&e[i-1]!==`\\`&&(r=null);continue}if(t===`"`||t===`'`||t==="`"){r=t;continue}if(t===`{`&&(n+=1),t===`}`&&(--n,n===0))return i}return e.length},Af=(e,t)=>{let n=[],r=null,i=!1,a=!1;for(let o=0;o<t;o+=1){let t=e[o],s=e[o+1];if(i){t===`
-`&&(i=!1);continue}if(a){t===`*`&&s===`/`&&(a=!1,o+=1);continue}if(r!==null){t===r&&e[o-1]!==`\\`&&(r=null);continue}if(t===`/`&&s===`/`){i=!0,o+=1;continue}if(t===`/`&&s===`*`){a=!0,o+=1;continue}if(t===`"`||t===`'`||t==="`"){r=t;continue}t===`{`&&n.push(o),t===`}`&&n.pop()}let o=n.at(-1);return o===void 0?e.length:kf(e,o)},jf=(e,t,n)=>{let r=RegExp(`(const|let|var)\\s+${q(e)}\\s*(?::[^=\\n]*)?=\\s*([^;\\n]+)`,`g`),i=null,a=-1;for(let e of n.matchAll(r)){let r=e.index;if(r===void 0||r>=t||r<=a||Af(n,r)<t)continue;a=r;let o=e[2];o!==void 0&&(i={declarationIndex:r,initializer:o,initializerStartIndex:r+e[0].length-o.length,isImmutable:e[1]===`const`})}return i},Mf=(e,t,n,r)=>{if(t.isImmutable)return!0;let i=r.slice(t.initializerStartIndex+t.initializer.length,n);return!RegExp(`(?:^|[^\\w$.])${q(e)}\\s*=(?!=)`).test(i)},Nf=(e,t,n)=>{if(!/highlight/i.test(e))return!1;let r=e.match(/^([\w$]+)/)?.[1];if(r===void 0)return!1;let i=jf(r,n,t);return i===null?/highlighted/i.test(e)||uf.test(t):Mf(r,i,n,t)&&ff.test(i.initializer)},Pf=(e,t,n,r=new Set)=>{let i=e.trim(),a=Df(i);if(a.length>1)return a.every(e=>Pf(e,t,n,r));let o=[...i.matchAll(/\$\{([^}]*)\}/g)].flatMap(e=>e[1]===void 0?[]:[e[1]]);if(o.length>1)return o.every(e=>Pf(e,t,n,r));let s=i.match(/^([\w$]+)(?:(?:\??\.[\w$]+)|(?:\[\s*(?:"[^"\n]*"|'[^'\n]*'|\d+)\s*\]))*$/)?.[1];if(s&&!r.has(s)){let e=jf(s,n,t);if(e&&Mf(s,e,n,t)){let n=new Set(r);return n.add(s),Pf(e.initializer,t,e.initializerStartIndex,n)}}return!!(ef.test(`${i};`)||tf.test(`${i};`)||rf.test(i)||sf.test(i)||cf.test(i)||lf.test(i)||Nf(i,t,n))},Ff=(e,t,n,r,i=new Set)=>{let a=e.trim().match(/^([\w$]+)$/)?.[1];if(!a)return!1;if(a===t)return!0;if(i.has(a))return!1;let o=jf(a,n,r);if(!o?.isImmutable)return!1;let s=new Set(i);return s.add(a),Ff(o.initializer,t,o.initializerStartIndex,r,s)},If=(e,t,n)=>{let r=[/function\s+([\w$]+)\s*\(([^)]*)\)\s*\{/g,/(?:const|let|var)\s+([\w$]+)\s*=\s*(?:async\s*)?\(([^)]*)\)\s*=>\s*\{/g],i=null,a=-1;for(let o of r)for(let r of n.matchAll(o)){let o=r.index;if(o===void 0||o>=t||o<a)continue;let s=kf(n,o+r[0].lastIndexOf(`{`));if(s<t)continue;let c=(r[2]??``).split(`,`).findIndex(t=>t.trim().match(/^(?:\.\.\.)?([\w$]+)/)?.[1]===e);if(c<0)continue;a=o;let l=r[1]??``;i={bodyEndIndex:s,declarationNameIndex:o+r[0].indexOf(l),functionName:l,parameterIndex:c}}return i},Lf=e=>{let t=[],n=0,r=0,i=null;for(let a=0;a<e.length;a+=1){let o=e[a];if(i!==null){o===i&&e[a-1]!==`\\`&&(i=null);continue}if(o===`"`||o===`'`||o==="`"){i=o;continue}(o===`(`||o===`[`||o===`{`)&&(r+=1),(o===`)`||o===`]`||o===`}`)&&--r,o===`,`&&r===0&&(t.push(e.slice(n,a).trim()),n=a+1)}return t.push(e.slice(n).trim()),t},Rf=(e,t,n,r=new Set)=>{let i=e.trim().match(/^([\w$]+)$/)?.[1];if(i===void 0||r.has(i))return!1;if(If(i,t,n)!==null)return!0;let a=jf(i,t,n);if(!a||!Mf(i,a,t,n))return!1;let o=new Set(r);return o.add(i),Rf(a.initializer,a.initializerStartIndex,n,o)},zf=(e,t,n,r,i)=>{let a=e.trim();if(Pf(a,t,n))return!1;let o=a.match(/^([\w$]+)(?:\.|\s*(?:[;,})\n]|$))/)?.[1];if(o===void 0)return $d.test(a);if(r.has(o))return!1;r.add(o);let s=jf(o,n,t),c=If(o,n,t);if(s!==null&&(c===null||s.declarationIndex>c.declarationNameIndex))return Mf(o,s,n,t)&&Pf(s.initializer,t,s.initializerStartIndex)?!1:!Mf(o,s,n,t)||zf(s.initializer,t,s.initializerStartIndex,r,i)?!0:Rf(s.initializer,s.initializerStartIndex,t)?!1:$d.test(a);if(c!==null&&c.functionName.length>0){let e=RegExp(`\\b${q(c.functionName)}\\s*\\(`,`g`),n=!1,s=!0;for(let a of t.matchAll(e)){if(a.index===c.declarationNameIndex||i.has(a.index))continue;let e=a.index+a[0].lastIndexOf(`(`),l=Ru(t,e);if(l<0)continue;let u=Lf(t.slice(e+1,l))[c.parameterIndex];if(u===void 0||a.index>=c.declarationNameIndex&&a.index<=c.bodyEndIndex&&Ff(u,o,a.index,t))continue;n=!0,s&&=Pf(u,t,a.index);let d=new Set(r);d.delete(o);let f=new Set(i);if(f.add(a.index),zf(u,t,a.index,d,f))return!0}return n?!s&&$d.test(a):$d.test(a)}return $d.test(a)},Bf=U({id:`dangerous-html-sink`,title:`HTML injection sink with dynamic content`,severity:`warn`,recommendation:`Prefer rendering structured React nodes. If HTML is required, sanitize with a well-reviewed sanitizer and keep the trust boundary close to the sink.`,scan:e=>{if(e.isGeneratedBundle||!G(e.relativePath)||_f.test(e.relativePath)||vf.test(e.relativePath)||yf.test(e.relativePath)||!Zd.test(e.content))return[];let t=Xd(e.content,e.absolutePath),n=[],r=e.content.split(`
-`);for(let i=0;i<r.length;i+=1){let a=r[i]??``;if(!Zd.test(a))continue;let o=a.slice(0,a.search(Zd)).replace(/"[^"]*"|'[^']*'|`[^`]*`/g,``);if(/(?:^|[^:])\/\//.test(o)||/^\s*[/*]/.test(a))continue;let s=r.slice(i,i+1+4).join(`
-`),c=Qd.exec(s);if(c===null)continue;let l=(c[1]??``).trimStart(),u=l.slice(0,300),d=u.search(/[;}]/),f=d>=0?u.slice(0,d+1):u,p=r.slice(0,i).join(`
-`).length+ +(i>0)+a.search(Zd),m=t.find(e=>p>=e.startIndex&&p<e.endIndex)?.proof;if(m?.isConclusive&&m.isSafe)continue;let h=m?.isConclusive===!0;if(ef.test(f)||tf.test(f))continue;if(nf.test(f)&&!f.includes(`+`)){let e=f.replace(nf,``);if(!$d.test(e))continue}if(Of(f))continue;let ee=Qd.exec(r.slice(i,i+1+60).join(`
-`))?.[1]?.trimStart(),g=Cf(ee??l),_=pf.test(f)||hf.test(f)||mf.test(f)?f.match(/^[\w$]+/)?.[0]:void 0;if(g===null&&_!==void 0&&pf.test(f)&&If(_,p,e.content)===null){let t=wf(_,p,e.content);if(t!==null){if(Tf(t))continue;g=Cf(t)}}if(g===``)continue;let v=g??f,y=Df(v).length>1||(g?.match(/\$\{/g)?.length??0)>1;if(!h&&!y&&rf.test(v)||!y&&sf.test(v)||!y&&cf.test(v)||!h&&!zf(v,e.content,p,new Set,new Set)||!h&&lf.test(f)||!h&&Nf(f,e.content,p))continue;if(_!==void 0){let t=q(_),n=jf(_,p,e.content),r=n?.initializer;if(!(r!==void 0&&(Df(r).length>1||(r.match(/\$\{/g)?.length??0)>1))){let i=RegExp(`\\b${t}\\b\\s*${df.source}`,`i`);if(!h&&(r===void 0?i.test(e.content):n!==null&&Mf(_,n,p,e.content)&&ff.test(r)))continue;let a=RegExp(`\\b${t}\\b\\s*${af.source}`,`i`);if(!h&&(r===void 0?a.test(e.content):n!==null&&Mf(_,n,p,e.content)&&af.test(`=${r}`)))continue}if(RegExp(`\\b${t}\\b\\s*${of.source}`).test(e.content)||RegExp(`highlight[\\w$]*\\s*\\.map\\(\\s*(?:async\\s+)?\\(?\\s*${t}\\b`,`i`).test(e.content)&&uf.test(e.content))continue}if(hf.test(f)){let t=f.match(/\.([\w$]+)\s*(?:[;,})\n]|$)/)?.[1];if(t!==void 0&&RegExp(`\\b${q(t)}\\s*:\\s*${cf.source}`).test(e.content))continue}let te=bf.exec(a),ne=te?.[1]??te?.[2];if(ne!==void 0&&Ef(ne,e.content))continue;let re=r.slice(Math.max(0,i-5),i+1).join(`
-`).slice(0,-a.length+a.search(Zd));gf.test(re)||n.push({message:`HTML is injected from a dynamic-looking source, which can become XSS if the value is user-controlled or unsanitized.`,line:i+1,column:a.search(/\S/)+1})}return n}}),Vf=e=>!(!G(e)||Rc.test(e)||Bc.test(e)),Hf=/firebase|firestore|supabase|\b(?:setDoc|addDoc)\s*\(/i,Uf=U({id:`firebase-client-owned-authz-field`,title:`Client writes authorization field`,severity:`error`,recommendation:`Derive authority fields on the server or enforce them in Firebase/Supabase rules; never trust client-provided owner, org, or role values.`,scan:K({shouldScan:e=>Vf(e.relativePath)&&(Hf.test(e.content)||Hf.test(e.relativePath)),pattern:/(?:\b(?:setDoc|updateDoc|addDoc)\s*\(|(?:\b(?:firebase|firestore|getFirestore)\b|\bcollection\s*\(|\.collection\s*\()[\s\S]{0,500}\.(?:set|update|add)\s*\()(?:[^;'"`]|'[^'\n]*'|"[^"\n]*"|`[^`]*`){0,700}\b(?:ownerId|ownerID|creatorId|creatorID|providerId|providerID|orgId|orgID|tenantId|tenantID|workspaceId|workspaceID|ghostOrg|role|roles|isAdmin)\b/i,message:`Client code writes an ownership, tenant, or role field that should be server-owned and immutable.`})}),Wf=U({id:`firebase-permissive-rules`,title:`Permissive Firebase security rule`,severity:`error`,recommendation:"Bind every read/write to `request.auth.uid`, immutable ownership, and tenant membership instead of treating sign-in as authorization.",scan:K({shouldScan:e=>il(e.relativePath),pattern:/allow\s+(?:read|write|create|update|delete|list|get|read,\s*write)\s*:\s*if\s+(?:true|request\.auth\s*!=\s*null)\s*;?/i,message:`Firebase rules grant broad access to everyone or to any signed-in user, which is the Chattr/Firewreck failure mode.`})}),Gf=U({id:`firebase-query-filter-as-auth`,title:`Firestore query filter used as authorization`,severity:`warn`,recommendation:"Make sure Firestore rules compare the requested document against `request.auth.uid` and trusted membership data.",scan:K({shouldScan:e=>Vf(e.relativePath),pattern:/\.where\s*\(\s*["'](?:uid|userId|userID|ownerId|ownerID|orgId|orgID|tenantId|tenantID|role)["']\s*,\s*["']==["']/i,message:`Firestore query code filters by an auth-shaped field; filtering is not authorization unless rules enforce the same boundary.`})}),Kf=/api\.github\.com|github\.com|gitlab\.com|bitbucket\.org/gi,qf=/\$\{([^}]*)\}/g,Jf=/\b(?:params|searchParams|query|req|request|input|payload)\s*[.[]|\buntrusted|\bdecodeURI\w*/,Yf=/encodeURIComponent\s*\(/,Xf=/^\s*[\w$]+\.toString\(\)\s*$/,Zf=U({id:`git-provider-url-injection-risk`,title:`Git provider URL built from interpolation`,severity:`warn`,recommendation:`Validate owner, repo, org, and branch identifiers against strict slugs and build URLs with URL/path encoders instead of raw interpolation.`,scan:e=>{if(!G(e.relativePath))return[];let t=[];for(let n of e.content.matchAll(Kf)){let r=e.content.slice(n.index,n.index+200),i=r.indexOf("`"),a=i>=0?r.slice(0,i):r;if(!Array.from(a.matchAll(qf)).some(e=>{let t=e[1]??``;return Jf.test(t)&&!Yf.test(t)&&!Xf.test(t)}))continue;let o=W(e.content,n.index);t.push({message:`GitHub/GitLab/Bitbucket URL construction interpolates path components that may be attacker-controlled.`,line:o.line,column:o.column});break}return t}}),Qf=/child_process|childProcess|execa|subprocess|Deno\.run/,$f=/(?:\b(?:eval|new\s+Function|vm\.runIn\w*)|(?<![.\w$])(?:exec(?:File)?(?:Sync)?|spawn(?:Sync)?)|\b(?:child_process|childProcess|cp)\.(?:exec|spawn)\w*)\s*\([^;]{0,200}(?<!["'])\b(?:exif|metadata|manifest|preset|plugin|upload|drop(?:ped|s)?\b|archive|zip|unzip|untar)(?!\w*["'])/,ep=/(?:\b(?:eval|new\s+Function|vm\.runIn\w*)|\b(?:child_process|childProcess|cp)\.(?:exec|spawn)\w*)\s*\([^;]{0,200}(?<!["'])\b(?:exif|metadata|manifest|preset|plugin|upload|drop(?:ped|s)?\b|archive|zip|unzip|untar)(?!\w*["'])/,tp=`Imported metadata, uploads, or plugin manifests appear to reach code execution.`,np=K({shouldScan:()=>!0,pattern:$f,ignoreStringLiterals:!0,message:tp}),rp=K({shouldScan:()=>!0,pattern:ep,ignoreStringLiterals:!0,message:tp}),ip=U({id:`import-metadata-execution-risk`,title:`Imported metadata reaches code execution`,severity:`error`,recommendation:`Parse imported metadata as data with strict schemas; do not evaluate EXIF, manifests, presets, dropped files, or archives.`,scan:e=>G(e.relativePath)?Qf.test(e.content)?np(e):rp(e):[]}),ap=/createHash\s*\(\s*["'](?:md5|sha1)["']|\bmd5\s*\(/gi,op=/\b(?:password|token|secret|signature|signing|auth|credential|session|cookie|csrf|api.?key)\b/i,sp=/(?<!cipher\.)\bcreate(?:Cipher|Decipher)\s*\(/,cp=/\bcreate(?:Cipher|Decipher)iv\s*\(\s*["'](?:des|des3|des-?ede3?|rc4|rc2|bf|blowfish)\b/i,lp=/\b(?:DES|RC4|Blowfish)\b/,up=/\b(?:cipher|decipher|encrypt|decrypt|crypto)\b/i,dp=/[A-Za-z_$][\w$.]{0,100}signature[\w$]*(?:\([^)]*\))?\s*(?:===?|!==?)\s*[A-Za-z_$][\w$.]*(?:\([^)]*\))?|[A-Za-z_$][\w$.]{0,100}(?:\([^)]*\))?\s*(?:===?|!==?)\s*[A-Za-z_$][\w$.]{0,100}signature[\w$]*(?:\([^)]*\))?/i,fp=/(?:===?|!==?)\s*[A-Z](?:[a-z]|[A-Z0-9_]*\b(?!\s*[.(]))|^[A-Z](?:[a-z]|[A-Z0-9_]*\b(?!\s*[.(]))[\w$.]*(?:\([^)]*\))?\s*(?:===?|!==?)/,pp=/signature(?:Method|Type|Status|Algorithm|Kind|Mode|Version)\b/i,mp=/(?:===?|!==?)\s*(?:true|false|null|undefined)\b/,hp=/\.(?:length|size|byteLength)\s*(?:===?|!==?)|\.(?:length|size|byteLength)\s*$/,gp=/\bcrypto\b|createH(?:mac|ash)|createSign|createVerify|\bsubtle\b|\bhmac\b|\bdigest\b|\bsha-?(?:1|256|384|512)\b|\bmd5\b|\bwebhook|x-(?:hub-)?signature/i,_p=/\.[cm]?[jt]sx$/i,vp=/timingSafeEqual|timing.?safe/i,yp=/gravatar|digest[-_ ]?auth|oauth[-_ ]?1|pkcs#?12|smime|\b_id\b|\betag\b|checksum|cache[-_ ]?key|fingerprint/i,bp=/token|secret|password|nonce|salt|csrf|credential|otp/i,xp=/(?:focus|render|refresh|remount|redraw|animation|layout|cache|update)[-_]?nonce/i,Sp=/Math\.random\s*\(/g,Cp=/createHash|md5|cipher|encrypt|decrypt|crypto|signature|Math\.random/i,wp=(e,t,n,r)=>{for(let i of e.matchAll(t)){let t=e.slice(Math.max(0,i.index-250),i.index+250);if(n.test(t)&&!r?.test(t))return i.index}return-1},Tp=(e,t,n,r)=>{for(let i of e.matchAll(t)){let t=e.lastIndexOf(`
+`);if(!bu.test(t)||Su.test(t)||!s&&!xu.test(t))continue;let n=Math.max(e.lines.findIndex(e=>bu.test(e)),0),r=e.lines[n].search(bu);return[{message:Cu,line:e.startLineIndex+n+1,column:(r===-1?0:r)+1}]}return[]},Eu=K({shouldScan:e=>Zc(e.relativePath)&&!e.relativePath.endsWith(`package.json`)&&!wu(e.relativePath),pattern:yu,message:Cu}),Du=U({id:`build-pipeline-secret-boundary`,title:`Build pipeline runs code near secrets`,severity:`warn`,recommendation:`Run dependency installs with scripts disabled before exposing secrets, isolate untrusted build code, and move signing/deploy authority into a narrow privileged step.`,scan:e=>wu(e.relativePath)?Tu(e.content):Eu(e)}),Ou=U({id:`clickjacking-redirect-risk`,title:`Redirect or frame boundary risk`,severity:`warn`,recommendation:"Allowlist redirect origins/paths, set `frame-ancestors` for privileged pages, and avoid URL-prefilled privileged dialogs.",scan:K({shouldScan:e=>G(e.relativePath)||Zc(e.relativePath),pattern:/\bredirect\s*\((?!\s*(?:await\s+)?[\w$]*(?:safe|valid|sanitiz|allowlist|whitelist)[\w$]*\s*\()[^)'"`\n]*\b(?:searchParams\.get|nextUrl\.searchParams|returnTo|callbackUrl|continue|next)\b|<iframe\b[\s\S]{0,700}(?:\b(?:next=|continue=|redirect=|redirect_uri|userstoinvite|sharingaction|\.\.)|[?&](?:amp;)?role=)|frame-ancestors\s+(?:\*|'self'\s+\*)|X-Frame-Options["']?\s*:\s*["']?ALLOW/i,message:`Redirect or framing configuration may let attacker-controlled URLs chain into privileged UI or clickjacking.`})}),ku=e=>/(?:^|\/)(?:tools?|scripts?)\/|(?:^|\/)management\/commands\/|(?:^|\/)(?:build|make|gulpfile|gruntfile)\.[cm]?[jt]s$/i.test(e),Au=e=>$c(e,Ic),ju=String.raw`(?:req\.|request\.|params\.|query\.|body\.|searchParams|\$_(?:GET|POST|REQUEST))`,Mu=String.raw`(?:(?<![.\w$])(?:exec(?:Sync)?|system|passthru|proc_open|shell_exec)|\b(?:os\.system|subprocess\.(?:run|Popen|call)|(?:child_process|childProcess|cp)\.exec\w*))`,Nu=String.raw`(?:(?<![.\w$])spawn(?:Sync)?|\b(?:child_process|childProcess|cp)\.spawn\w*)`,Pu=String.raw`['"](?:sh|bash|zsh|dash|ksh|cmd(?:\.exe)?|powershell(?:\.exe)?|pwsh)['"]`,Fu=String.raw`['"](?:-c|/c|-Command)['"]`,Iu=U({id:`command-execution-input-risk`,title:`Command execution uses caller-shaped input`,severity:`error`,recommendation:`Avoid shell execution for caller-controlled values. Use fixed commands, argument arrays, strict allowlists, and no shell interpolation.`,scan:K({shouldScan:e=>Au(e.relativePath)&&!ku(e.relativePath),pattern:[new RegExp(String.raw`${Mu}\s*\([^)]{0,220}(?:${ju}|shell\s*=\s*true|f['"\`][^'"\`]*\{)`,`i`),new RegExp(String.raw`${Nu}\s*\((?:[^,)]{0,120}?${ju}|\s*${Pu}\s*,\s*\[\s*${Fu}\s*,[^\]]{0,220}${ju}|(?=[^)]{0,220}shell\s*[:=]\s*true)[^)]{0,220}${ju})`,`i`)],message:`Command execution appears to include request, query, body, or shell-interpolated input.`})}),Lu=U({id:`cors-cookie-trust-risk`,title:`Broad cookie or credentialed CORS trust`,severity:`warn`,recommendation:`Keep auth cookies host-only and HttpOnly, avoid credentialed CORS for less-trusted docs/vendor origins, and isolate documentation domains from app sessions.`,scan:K({shouldScan:e=>G(e.relativePath)||Zc(e.relativePath),pattern:/Access-Control-Allow-Credentials["']?\s*[:,]\s*["']?true[\s\S]{0,700}Access-Control-Allow-Origin["']?\s*[:,]\s*["']?(?:\*|https:\/\/docs\.|https:\/\/.*mintlify)|\b(?:session|auth|token|jwt)[^=\n]{0,80}(?:=[^;\n]{0,120};[^=\n]{0,80})?\bDomain=\./i,message:`Credentialed CORS or broad auth-cookie scope can make a docs/custom-domain XSS become account compromise.`})}),Ru=(e,t)=>{let n=e[t],r=n===`(`?`)`:n===`{`?`}`:n===`[`?`]`:``;if(r===``)return-1;let i=0,a=null;for(let o=t;o<e.length;o+=1){let t=e[o];if(a!==null){t===`\\`?o+=1:t===a&&(a=null);continue}if(t===`"`||t===`'`||t==="`")a=t;else if(t===n)i+=1;else if(t===r&&(--i,i===0))return o}return-1},zu=e=>`end`in e&&typeof e.end==`number`?e.end:-1,J=e=>`start`in e&&typeof e.start==`number`?e.start:-1,Bu=e=>{let t=O(e);for(;S(t,`SequenceExpression`);){let e=t.expressions.at(-1);if(!e)break;t=O(e)}return t},Vu=e=>{if(e.kind!==`import`)return null;let t=e.declarationNode.parent;return S(t,`ImportDeclaration`)?t:null},Hu=e=>{let t=[],n=new Map;for(let r of e){let e=`${r.truthiness}:${r.nullishness}`,i=n.get(r.expression);i?.has(e)||(i?i.add(e):n.set(r.expression,new Set([e])),t.push(r))}return t},Uu=e=>S(e,`JSXElement`)||S(e,`JSXFragment`)||S(e,`ArrayExpression`)||S(e,`ObjectExpression`)||S(e,`ArrowFunctionExpression`)||S(e,`FunctionExpression`)||S(e,`ClassExpression`)||S(e,`NewExpression`)?{expression:e,truthiness:`truthy`,nullishness:`non-nullish`}:S(e,`Literal`)?e.value===null?{expression:e,truthiness:`falsy`,nullishness:`nullish`}:{expression:e,truthiness:e.value?`truthy`:`falsy`,nullishness:`non-nullish`}:S(e,`UnaryExpression`)&&e.operator===`void`?{expression:e,truthiness:`falsy`,nullishness:`nullish`}:{expression:e,truthiness:`unknown`,nullishness:`unknown`},Y=e=>{let t=Bu(e);if(S(t,`ConditionalExpression`)){let e=Y(t.test);return e.every(e=>e.truthiness===`truthy`)?Y(t.consequent):e.every(e=>e.truthiness===`falsy`)?Y(t.alternate):Hu([...Y(t.consequent),...Y(t.alternate)])}if(!S(t,`LogicalExpression`))return[Uu(t)];let n=Y(t.left),r=Y(t.right),i=[];for(let e of n){if(t.operator===`&&`){e.truthiness!==`truthy`&&i.push(e.truthiness===`falsy`?e:{...e,truthiness:`falsy`}),e.truthiness!==`falsy`&&i.push(...r);continue}if(t.operator===`||`){e.truthiness!==`falsy`&&i.push(e.truthiness===`truthy`?e:{...e,truthiness:`truthy`,nullishness:`non-nullish`}),e.truthiness!==`truthy`&&i.push(...r);continue}e.nullishness!==`nullish`&&i.push(e.nullishness===`non-nullish`?e:{...e,nullishness:`non-nullish`}),e.nullishness!==`non-nullish`&&i.push(...r)}return Hu(i)},Wu=e=>{let t=[],n=new Set;for(let r of Y(e))n.has(r.expression)||(n.add(r.expression),t.push(r.expression));return t},Gu=new Set([`assign`,`defineProperties`,`defineProperty`]),Ku=new Set([`defineProperty`,`set`]),qu=new WeakMap,Ju=e=>{let t=F(e);for(;t.parent;){let e=t.parent;if(!S(e,`MemberExpression`)||e.object!==t)break;t=F(e)}return t},X=e=>{let t=e;for(;t;){if(x(t)||S(t,`Program`))return t;t=t.parent}return e},Z=(e,t)=>{if(S(e,`ReturnStatement`)||S(e,`ThrowStatement`)||S(e,`BreakStatement`)||t&&S(e,`ContinueStatement`))return!0;if(S(e,`BlockStatement`))return e.body.some(e=>Z(e,t));if(!S(e,`IfStatement`))return!1;if(S(e.test,`Literal`)){let n=e.test.value?e.consequent:e.alternate;return n?Z(n,t):!1}return!!(e.alternate&&Z(e.consequent,t)&&Z(e.alternate,t))},Yu=e=>Z(e,!0),Xu=(e,t)=>{let n=t.indexOf(e);return n>0&&t.slice(0,n).some(Yu)},Zu=(e,t)=>{let n=e;for(;n.parent&&n!==t;){let e=n.parent;if((S(e,`BlockStatement`)||S(e,`Program`))&&Xu(n,e.body)||(S(e,`WhileStatement`)&&S(e.test,`Literal`)&&!e.test.value||S(e,`ForStatement`)&&e.test&&S(e.test,`Literal`)&&!e.test.value)&&e.body===n||S(e,`SwitchCase`)&&Xu(n,e.consequent)||S(e,`IfStatement`)&&S(e.test,`Literal`)&&(e.test.value===!1&&e.consequent===n||e.test.value===!0&&e.alternate===n)||S(e,`ConditionalExpression`)&&S(e.test,`Literal`)&&(e.test.value===!1&&e.consequent===n||e.test.value===!0&&e.alternate===n)||S(e,`LogicalExpression`)&&e.right===n&&S(e.left,`Literal`)&&(e.operator===`&&`&&!e.left.value||e.operator===`||`&&e.left.value))return!0;n=e}return!1},Qu=(e,t)=>{let n=e;for(;n.parent&&n!==t;){let e=n.parent;if(S(e,`IfStatement`)&&(!S(e.test,`Literal`)||e.test.value===!0&&e.alternate===n||e.test.value===!1&&e.consequent===n)||S(e,`ConditionalExpression`)&&(!S(e.test,`Literal`)||e.test.value===!0&&e.alternate===n||e.test.value===!1&&e.consequent===n)||S(e,`LogicalExpression`)&&e.right===n&&(!S(e.left,`Literal`)||e.operator===`&&`&&!e.left.value||e.operator===`||`&&e.left.value)||S(e,`DoWhileStatement`)&&!(e.body===n&&S(e.test,`Literal`)&&!e.test.value)||S(e,`ForStatement`)||S(e,`ForInStatement`)||S(e,`ForOfStatement`)&&e.right!==n||S(e,`WhileStatement`)||S(e,`SwitchCase`)||S(e,`CatchClause`)||S(e,`TryStatement`)&&e.block===n||(S(e,`CallExpression`)||S(e,`MemberExpression`))&&e.optional)return!0;n=e}return!1},$u=(e,t)=>{let n=O(e);if(S(n,`Literal`))return!1;if(S(n,`Identifier`)){if(t.isGlobalReference(n)&&(n.name===`undefined`||n.name===`NaN`||n.name===`Infinity`))return!1;let e=t.symbolFor(n);return e?e.kind===`var`||e.kind===`function`||e.kind===`parameter`||e.kind===`import`?!1:J(e.declarationNode)>J(n):!0}if(S(n,`ArrayExpression`))return n.elements.some(e=>e?S(e,`SpreadElement`)?!0:$u(e,t):!1);if(S(n,`ObjectExpression`))return n.properties.length>0;if(S(n,`TemplateLiteral`))return n.expressions.length>0;if(S(n,`UnaryExpression`)){let e=O(n.argument);return n.operator===`typeof`&&S(e,`Identifier`)&&!t.symbolFor(e)?!1:$u(e,t)?!0:n.operator===`void`||n.operator===`typeof`||n.operator===`!`?!1:!(S(e,`Literal`)&&(typeof e.value==`number`||typeof e.value==`string`))}return!0},ed=(e,t,n)=>{let r=e;for(;r.parent&&r.parent!==t;)r=r.parent;let i=t.body.findIndex(e=>e===r);return r.parent!==t||i<=0?!1:t.body.slice(0,i).some(e=>S(e,`EmptyStatement`)?!1:S(e,`ExpressionStatement`)?$u(e.expression,n):S(e,`VariableDeclaration`)?e.declarations.some(e=>!S(e.id,`Identifier`)||!!(e.init&&$u(e.init,n))):!0)},td=(e,t)=>S(e,`AwaitExpression`)?$u(e.argument,t):!1,nd=(e,t,n)=>{let r=e;for(;r.parent&&r!==t;){let t=r.parent;if(S(t,`IfStatement`)&&(!S(t.test,`Literal`)||t.test.value===!0&&t.alternate===r||t.test.value===!1&&t.consequent===r)||S(t,`ConditionalExpression`)&&(!S(t.test,`Literal`)||t.test.value===!0&&t.alternate===r||t.test.value===!1&&t.consequent===r)||S(t,`LogicalExpression`)&&t.right===r&&(!S(t.left,`Literal`)||t.operator===`&&`&&!t.left.value||t.operator===`||`&&t.left.value)||S(t,`WhileStatement`)&&(!S(t.test,`Literal`)||!t.test.value)||S(t,`ForStatement`)&&t.test&&(!S(t.test,`Literal`)||!t.test.value)||S(t,`ForInStatement`)||S(t,`ForOfStatement`)||S(t,`SwitchCase`)||S(t,`CatchClause`)||S(t,`TryStatement`)&&t.block===r&&S(r,`BlockStatement`)&&(ed(e,r,n)||td(e,n))||(S(t,`CallExpression`)||S(t,`MemberExpression`))&&t.optional)return!0;r=t}return!1},rd=(e,t)=>{let n=e;for(;n;){if(n===t)return!0;n=n.parent}return!1},id=(e,t)=>{let n=e;for(;n.parent&&n!==t;){let e=n.parent;if(S(e,`IfStatement`)&&(!S(e.test,`Literal`)||e.test.value===!0&&e.alternate===n||e.test.value===!1&&e.consequent===n)||S(e,`ConditionalExpression`)&&(!S(e.test,`Literal`)||e.test.value===!0&&e.alternate===n||e.test.value===!1&&e.consequent===n)||S(e,`LogicalExpression`)&&e.right===n&&(!S(e.left,`Literal`)||e.operator===`&&`&&!e.left.value||e.operator===`||`&&e.left.value)||S(e,`ForStatement`)||S(e,`ForInStatement`)||S(e,`ForOfStatement`)||S(e,`WhileStatement`)||S(e,`SwitchCase`)||S(e,`CatchClause`)||S(e,`TryStatement`)&&e.block===n||(S(e,`CallExpression`)||S(e,`MemberExpression`))&&e.optional)return n;n=e}return null},ad=e=>S(e,`AwaitExpression`)||S(e,`YieldExpression`)?e.argument?zu(e.argument):zu(e):S(e,`ForOfStatement`)?zu(e.right):J(e),od=(e,t,n)=>{if(J(t)<ad(e))return!1;let r=id(e,n);return!!(r&&rd(t,r))},sd=e=>{let t=qu.get(e);if(t)return t;let n=(t,n,r)=>{let i=O(t);if(!S(i,`MemberExpression`))return!1;let a=O(i.object);return!!(S(a,`Identifier`)&&a.name===n&&e.isGlobalReference(a)&&r.has(M(i)??``))},r=e=>{let t=O(e);if(!S(t,`ObjectExpression`))return null;let n=new Set;for(let e of t.properties){if(!S(e,`Property`))return null;let t=N(e,{allowComputedString:!0});if(t===null)return null;n.add(t)}return n},i=e=>{let t=Ju(e),i=t.parent;if(i){if(S(i,`AssignmentExpression`)&&i.left===t||S(i,`UpdateExpression`)&&i.argument===t||S(i,`UnaryExpression`)&&i.operator===`delete`){if(!S(t,`MemberExpression`))return null;let e=M(t);return e===null?null:new Set([e])}if(!(!S(i,`CallExpression`)||i.arguments[0]!==t)){if(n(i.callee,`Object`,Gu)){let e=O(i.callee);if(!S(e,`MemberExpression`))return;let t=M(e);if(t===`assign`){let e=i.arguments.slice(1).map(r);return e.some(e=>e===null)?null:new Set(e.flatMap(e=>[...e??[]]))}if(t===`defineProperties`){let e=i.arguments[1];return e?r(e):null}let n=i.arguments[1];return n&&S(n,`Literal`)&&typeof n.value==`string`?new Set([n.value]):null}if(n(i.callee,`Reflect`,Ku)){let e=i.arguments[1];return e&&S(e,`Literal`)&&typeof e.value==`string`?new Set([e.value]):null}}}},a=e=>{let t=F(e),n=t.parent;if(S(n,`ForOfStatement`)&&n.right===t)return n.await||Z(n.body,!1);let r=n;if(!S(r,`MemberExpression`)||r.object!==t||M(r)!==`next`)return!1;let i=F(r);return!!(S(i.parent,`CallExpression`)&&i.parent.callee===i)},o=e=>{let t=F(e),n=t.parent;return S(n,`ForOfStatement`)&&!n.await&&n.right===t&&!Z(n.body,!1)?!0:!!(S(n,`SpreadElement`)&&n.parent&&!S(n.parent,`ObjectExpression`))},s=e=>{let t=F(e),n=t.parent;if(!S(n,`ForOfStatement`)||n.await||n.right!==t||Z(n.body,!1))return[];let r=X(n.body),i=new Set;return A(n.body,e=>{if(X(e)!==r||!S(e,`BreakStatement`))return;let a=e;if(e.label){for(;a?.parent;){let t=a.parent;if(S(t,`LabeledStatement`)&&t.label.name===e.label.name){rd(n,t.body)&&i.add(t);return}a=t}return}for(;a?.parent;){let e=a.parent;if(S(e,`ForStatement`)||S(e,`ForInStatement`)||S(e,`ForOfStatement`)||S(e,`WhileStatement`)||S(e,`DoWhileStatement`)||S(e,`SwitchStatement`)){S(e,`ForOfStatement`)&&e.right===t&&i.add(e);return}a=e}}),[...i]},c=t=>{let n=O(t.callee),r=null;if(x(n))r=n;else if(S(n,`Identifier`)){let t=P(n,e);if(t?.kind===`function`&&x(t.declarationNode))r=t.declarationNode;else if(t?.kind===`const`&&t.initializer){let e=O(t.initializer);x(e)&&(r=e)}}return r&&x(r)?r:null},l=e=>{let t=c(e);return!t||!x(t)?null:t.generator?a(e)||o(e)?t:null:t},u=[],d=new Map;A(e.rootScope.node,t=>{if(S(t,`CallExpression`)){let e=X(t),n=l(t);n&&!Zu(t,e)&&u.push({argumentCall:t,call:t,conditionalExitTargets:x(n)&&n.generator?s(t):[],owner:e,targetOwner:n,yieldCount:x(n)&&n.generator&&a(t)?1:null})}if(!S(t,`Identifier`))return;let n=i(t);if(n===void 0)return;let r=P(t,e);if(!r)return;let o=X(t);if(Zu(t,o))return;let c=d.get(r.id)??[];c.push({node:t,owner:o,propertyNames:n,symbolId:r.id}),d.set(r.id,c)});let f=t=>{let n=X(t),r=J(t),i=new Set,a=(e,t)=>{for(let n of u)n.owner!==e||J(n.call)>=t||i.has(n.targetOwner)||(i.add(n.targetOwner),a(n.targetOwner,1/0))};return a(n,r),S(n,`Program`)||a(e.rootScope.node,1/0),i},p=e=>{if(S(e,`Program`))return 1/0;let t=u.find(t=>S(t.owner,`Program`)&&t.targetOwner===e);return t?J(t.call):1/0},m=new Map;for(let e of u){let t=m.get(e.owner)??[];t.push(e),m.set(e.owner,t)}let h=new WeakMap,ee=(e,t)=>{let n=h.get(e)?.get(t);if(n!==void 0)return n;let r=[e],i=new Set,a=!1;for(;r.length>0;){let e=r.pop();if(!(!e||i.has(e))){if(e===t){a=!0;break}i.add(e);for(let t of m.get(e)??[])r.push(t.targetOwner)}}let o=h.get(e)??new WeakMap;return o.set(t,a),h.set(e,o),a},g=(e,t)=>{let n=new Set,r=e;for(;r?.parent&&r!==t;){let t=r.parent,i=S(t,`DoWhileStatement`)&&S(t.test,`Literal`)&&!t.test.value,a=S(t,`ForStatement`)||S(t,`ForInStatement`)||S(t,`ForOfStatement`)||S(t,`WhileStatement`)||S(t,`DoWhileStatement`)?t.body:null,o=e;for(;a&&S(a,`BlockStatement`)&&o&&o.parent!==a;)o=o.parent??null;let s=a&&S(a,`BlockStatement`)&&o?a.body.findIndex(e=>e===o):-1,c=!!(a&&S(a,`BlockStatement`)&&s>=0&&a.body.slice(s+1).some(e=>Z(e,!1)));a&&!i&&!c&&n.add(t),r=t}return n},_=(e,t,n)=>{let r=g(e,n);return r.size===0?!1:[...g(t,n)].some(e=>r.has(e))},v=new WeakMap,y=e=>{let t=v.get(e);if(t)return t;let n=new Map;for(let t of u){if(!ee(t.targetOwner,e))continue;let r=n.get(t.owner)??[];r.push(t),n.set(t.owner,r)}return v.set(e,n),n},te=(e,t)=>{let n=y(e),r=y(t);for(let[e,t]of n){let n=r.get(e);if(n){for(let r of t)for(let t of n)if(r!==t&&(J(r.call)<J(t.call)||x(e)||_(r.call,t.call,e)))return!0}}return!1},ne=e=>{let t=X(e);if(S(t,`Program`))return!1;let n=u.filter(e=>S(e.owner,`Program`)&&ee(e.targetOwner,t));return n.length===0?!1:n.length!==1||n[0]?.targetOwner!==t},re=e=>{let t=Ju(e.node),n=t.parent;return!!(S(t,`Identifier`)&&n&&(S(n,`AssignmentExpression`)&&n.left===t||S(n,`UpdateExpression`)&&n.argument===t))},ie=(t,n)=>{let r=O(t);if(S(r,`Identifier`)){let t=P(r,e);return t&&n.has(t.id)?n.get(t.id)??!1:null}if(S(r,`SequenceExpression`)){let e=r.expressions.at(-1);return e?ie(e,n):null}if(S(r,`ConditionalExpression`)){let e=ie(r.consequent,n),t=ie(r.alternate,n);return e===null&&t===null?null:e===null||t===null?!0:e||t}if(S(r,`LogicalExpression`)){let e=ie(r.left,n),t=ie(r.right,n);return e===null?t===null?null:!0:r.operator===`&&`?t:e}return null},ae=(e,t)=>{let n=Ju(e.node).parent;if(!n||!S(n,`AssignmentExpression`)){t.delete(e.symbolId);return}let r=t.get(e.symbolId)??!1,i=null;n.operator===`||=`||n.operator===`??=`?i=r:(n.operator===`=`||n.operator===`&&=`)&&(i=ie(n.right,t));let a=Qu(e.node,e.owner);i===null?a?t.set(e.symbolId,!0):t.delete(e.symbolId):t.set(e.symbolId,a&&r||i)},oe=(t,n)=>{if(!x(t.targetOwner))return n;let r=new Map(n);for(let[i,a]of t.targetOwner.params.entries()){let o=S(a,`AssignmentPattern`)?a.left:a;if(!S(o,`Identifier`))continue;let s=t.argumentCall.arguments[i],c=s&&!S(s,`SpreadElement`)?O(s):null,l=null;if(S(a,`AssignmentPattern`)&&(!c||S(c,`Identifier`)&&c.name===`undefined`&&e.isGlobalReference(c)||S(c,`UnaryExpression`)&&c.operator===`void`)&&S(a,`AssignmentPattern`)?l=O(a.right):c&&(l=c),!S(l,`Identifier`))continue;let u=P(l,e);if(!u||!n.has(u.id))continue;let d=e.symbolFor(o);d&&r.set(d.id,n.get(u.id)??!1)}return r},se=(t,n)=>{if(!x(t.targetOwner))return{conditionalSuspensions:[],conditionalStartIndex:1/0,cutoffIndex:1/0};let r=new Set;t.targetOwner.async&&(r.add(`AwaitExpression`),r.add(`ForOfStatement`));let i=t.conditionalExitTargets.some(e=>!n||!rd(n,e));(t.yieldCount!==null||i)&&r.add(`YieldExpression`);let a=[],o=1/0,s=1/0,c=0;return A(t.targetOwner.body,n=>{if(X(n)!==t.targetOwner||Zu(n,t.targetOwner)||!(r.has(n.type)&&(!S(n,`ForOfStatement`)||n.await)))return;let l=S(n,`YieldExpression`)&&n.argument?O(n.argument):null;if(S(n,`YieldExpression`)&&n.delegate&&l&&(S(l,`ArrayExpression`)&&l.elements.length===0||S(l,`Literal`)&&l.value===``))return;let u=ad(n);if(S(n,`YieldExpression`)){if(c+=1,i&&c>=1){o=Math.min(o,u);return}if(t.yieldCount===null||c>t.yieldCount)return}nd(n,t.targetOwner,e)?(a.push(n),o=Math.min(o,u)):s=Math.min(s,u)}),{conditionalSuspensions:a,conditionalStartIndex:Math.min(o,s),cutoffIndex:s}},ce=(e,t,n)=>{let r=(e,t,i)=>{if(t.has(e.targetOwner))return!1;let a=new Set(t);a.add(e.targetOwner);let o=new Map(oe(e,i)),s=se(e),c=[...[...o.keys()].flatMap(e=>d.get(e)??[]).filter(t=>t.owner===e.targetOwner).map(e=>({event:e,index:J(e.node)})),...u.filter(t=>t.owner===e.targetOwner).map(e=>({call:e,index:J(e.call)}))].sort((e,t)=>e.index-t.index);for(let t of c){if(t.index>=s.cutoffIndex)break;let i=`event`in t?t.event.node:t.call.call;if(!s.conditionalSuspensions.some(t=>od(t,i,e.targetOwner))){if(`event`in t){if(!o.has(t.event.symbolId))continue;if(re(t.event)){ae(t.event,o);continue}if(n===null||t.event.propertyNames===null||t.event.propertyNames.has(n))return!0;continue}if(r(t.call,a,o))return!0}}return!1};return r(e,new Set,t)},le={getEventsBefore:(t,n)=>{let r=[],i=(e,t,a,o,s,c,l)=>{if(s.has(e))return;let f=new Set(s);f.add(e);let p=new Map(l),m=[...[...p.keys()].flatMap(e=>d.get(e)??[]).filter(t=>t.owner===e).map(e=>({event:e,index:J(e.node)})),...u.filter(t=>t.owner===e).map(e=>({call:e,index:J(e.call)}))].sort((e,t)=>e.index-t.index);for(let s of m){if(s.index>=t)break;let l=`event`in s?s.event.node:s.call.call;if(o.some(t=>od(t,l,e)))continue;if(`event`in s){if(!p.has(s.event.symbolId))continue;let e=!!(c||p.get(s.event.symbolId)||Qu(s.event.node,s.event.owner)||s.index>a);if(re(s.event)){ae(s.event,p);continue}r.push({isConditional:e,node:s.event.node});continue}let u=se(s.call,n);i(s.call.targetOwner,u.cutoffIndex,u.conditionalStartIndex,u.conditionalSuspensions,f,c||Qu(s.call.call,s.call.owner)||s.index>a,oe(s.call,p))}},a=X(n),o=new Map([[t.id,!1]]);return S(a,`Program`)||i(e.rootScope.node,p(a),1/0,[],new Set,!1,o),i(a,J(n),1/0,[],new Set,!1,o),r},getOutermostTarget:Ju,isGlobalNamespaceMethod:n,isExecutionOrderAmbiguous:ne,isMutationOrderAmbiguous:(e,t,n)=>{let r=X(t),i=J(t);if((d.get(e.id)??[]).some(e=>n!==null&&e.propertyNames!==null&&!e.propertyNames.has(n)?!1:e.owner===r?J(e.node)>=i&&(x(r)||_(e.node,t,r)):S(e.owner,`Program`)?(y(r).get(e.owner)??[]).some(t=>_(e.node,t.call,e.owner)):ee(e.owner,r)||te(e.owner,r)))return!0;let a=new Map([[e.id,!1]]);return u.some(e=>e.owner===r&&J(e.call)>=i&&_(e.call,t,r)&&ce(e,a,n))},isMutatedBefore:(e,t,n)=>{let r=d.get(e.id);if(!r)return!1;let i=J(t),a=X(t),o=f(t);return r.some(e=>n!==null&&e.propertyNames!==null&&!e.propertyNames.has(n)?!1:e.owner===a?J(e.node)<i:S(e.owner,`Program`)&&!S(a,`Program`)?J(e.node)<p(a):o.has(e.owner))}};return qu.set(e,le),le},cd=(e,t)=>t===`katex`?e===`katex`||e.startsWith(`katex/`):e===t,ld=(e,t,n)=>{let r=O(e);if(!S(r,`CallExpression`))return!1;let i=O(r.callee),a=r.arguments[0];return!!(S(i,`Identifier`)&&i.name===`require`&&n.isGlobalReference(i)&&a&&S(a,`Literal`)&&typeof a.value==`string`&&cd(a.value,t))},ud=(e,t)=>{if(e.kind!==`ts-import-equals`)return!1;let n=e.declarationNode;if(!S(n,`TSImportEqualsDeclaration`))return!1;let r=n.moduleReference;return!!(S(r,`TSExternalModuleReference`)&&S(r.expression,`Literal`)&&typeof r.expression.value==`string`&&cd(r.expression.value,t))},dd=(e,t)=>{let n=O(e);return!!(S(n,`AwaitExpression`)&&S(n.argument,`ImportExpression`)&&S(n.argument.source,`Literal`)&&typeof n.argument.source.value==`string`&&cd(n.argument.source.value,t))},fd=(e,t,n,r,i)=>{let a=P(O(e),i),o=sd(i);if(!a||o.isExecutionOrderAmbiguous(r)||o.isMutationOrderAmbiguous(a,r,n)||o.isMutatedBefore(a,r,n))return null;let s=Vu(a);if(typeof s?.source.value==`string`&&cd(s.source.value,t))return S(a.declarationNode,`ImportDefaultSpecifier`)||S(a.declarationNode,`ImportNamespaceSpecifier`)||j(a.declarationNode)===`default`?a:null;if(ud(a,t))return a;if(a.kind!==`const`||!a.initializer)return null;let c=O(a.initializer);return ld(c,t,i)||S(c,`MemberExpression`)&&M(c)===`default`&&(ld(c.object,t,i)||dd(c.object,t))||dd(c,t)?a:null},pd=(e,t,n,r,i)=>{let a=P(O(e),i);if(!a)return null;let o=Vu(a),s=sd(i);return typeof o?.source.value!=`string`||!cd(o.source.value,t)||j(a.declarationNode)!==n||s.isExecutionOrderAmbiguous(r)||s.isMutationOrderAmbiguous(a,r,null)||s.isMutatedBefore(a,r,null)?null:a},md=(e,t,n)=>fd(e,`katex`,`renderToString`,t,n)!==null||ld(e,`katex`,n),hd=(e,t,n)=>{if(pd(e,`katex`,`renderToString`,t,n))return!0;let r=O(e);if(!S(r,`Identifier`))return!1;let i=n.referenceFor(r)?.resolvedSymbol;if(!i||i.kind!==`const`||!i.initializer||sd(n).isMutatedBefore(i,t,null))return!1;let a=O(i.initializer),o=i.bindingIdentifier.parent;return S(o,`Property`)&&N(o,{allowComputedString:!0})===`renderToString`?md(a,i.declarationNode,n):S(a,`MemberExpression`)&&M(a)===`renderToString`&&md(a.object,i.declarationNode,n)?!0:S(a,`Identifier`)?hd(a,i.declarationNode,n):!1},gd=(e,t)=>{let n=O(e);if(S(n,`Identifier`)){if(!/katex/i.test(n.name))return!1;let e=t.referenceFor(n)?.resolvedSymbol;return!!(e&&e.kind!==`parameter`&&e.kind!==`let`)}if(!S(n,`MemberExpression`)||M(n)!==`renderToString`)return!1;let r=O(n.object);if(!S(r,`Identifier`)||!/katex/i.test(r.name))return!1;let i=t.referenceFor(r)?.resolvedSymbol;if(!i)return!1;if(i.kind===`import`){if(!cd(String(Vu(i)?.source.value??``),`katex`))return!0;let e=sd(t);return e.isExecutionOrderAmbiguous(n)||e.isMutationOrderAmbiguous(i,n,`renderToString`)?!1:e.isMutatedBefore(i,n,`renderToString`)}if(i.kind===`parameter`||i.kind===`let`||i.kind===`var`)return!0;if(i.kind!==`const`||!i.initializer)return!1;let a=O(i.initializer);if(S(a,`ObjectExpression`))return!0;if(S(a,`CallExpression`)){let e=O(a.callee);return S(e,`Identifier`)&&e.name===`require`}return S(a,`AwaitExpression`)&&S(a.argument,`ImportExpression`)},_d=(e,t)=>{let n=O(e);if(!S(n,`ObjectExpression`))return null;let r;for(let e of n.properties){if(!S(e,`Property`)){r=null;continue}let n=N(e,{allowComputedString:!0});if(n===null){r=null;continue}n===t&&(r=e.kind===`init`?e.value:null)}return r},vd=e=>{let t=O(e);if(!S(t,`ObjectExpression`))return null;for(let e of t.properties){if(!S(e,`Property`))return null;let t=N(e,{allowComputedString:!0});if(t===null||t===`get`||t===`set`)return null}return _d(t,`value`)},yd=new WeakMap,bd=(e,t)=>{let n=O(e);return S(n,`Identifier`)?n.name===`undefined`&&t.isGlobalReference(n):S(n,`Literal`)&&!n.value},xd=(e,t,n)=>{let r=vd(t);return r===null?`trusted`:r===void 0?e:bd(r,n)?`untrusted`:`trusted`},Sd=(e,t)=>e===t?e:e===`trusted`||t===`trusted`?`trusted`:e===`unsupported`||t===`unsupported`?`unsupported`:`untrusted`,Cd=(e,t,n,r)=>{let i=sd(n),a=i.getOutermostTarget(t),o=a.parent;if(!o)return`unsupported`;if(S(o,`AssignmentExpression`)&&o.left===a){if(!S(a,`MemberExpression`))return`unsupported`;let t=M(a);return t===null?`trusted`:t===`trust`?bd(o.right,n)?`untrusted`:`trusted`:e}if(S(o,`UnaryExpression`)&&o.operator===`delete`){if(!S(a,`MemberExpression`))return`unsupported`;let t=M(a);return t===null?`trusted`:t===`trust`?`absent`:e}if(S(o,`UpdateExpression`)){if(!S(a,`MemberExpression`))return`unsupported`;let t=M(a);return t===`trust`||t===null?`trusted`:e}if(!S(o,`CallExpression`)||o.arguments[0]!==a)return`unsupported`;if(i.isGlobalNamespaceMethod(o.callee,`Object`,Gu)){let t=O(o.callee);if(!S(t,`MemberExpression`))return`unsupported`;let i=M(t);if(i===`assign`){let t=e;for(let e of o.arguments.slice(1)){let i=wd(e,e,n,new Set(r));i!==`absent`&&(t=i)}return t}if(i===`defineProperties`){let t=o.arguments[1];if(!t)return`unsupported`;let r=_d(t,`trust`);return r===null?`trusted`:r===void 0?e:xd(e,r,n)}let a=o.arguments[1];if(!a||!S(a,`Literal`)||typeof a.value!=`string`)return`trusted`;if(a.value!==`trust`)return e;let s=o.arguments[2];return s?xd(e,s,n):`unsupported`}if(i.isGlobalNamespaceMethod(o.callee,`Reflect`,Ku)){let t=O(o.callee);if(!S(t,`MemberExpression`))return`unsupported`;let r=M(t),i=o.arguments[1];if(!i||!S(i,`Literal`)||typeof i.value!=`string`)return`trusted`;if(i.value!==`trust`)return e;let a=o.arguments[2];return a?r===`defineProperty`?xd(e,a,n):bd(a,n)?`untrusted`:`trusted`:`unsupported`}return`unsupported`},wd=(e,t,n,r)=>{if(e===void 0)return`absent`;let i=O(e);if(S(i,`Identifier`)){if(i.name===`undefined`&&n.isGlobalReference(i))return`absent`;let e=P(i,n);if(!e||e.kind!==`const`||!e.initializer||r.has(e.id))return`unsupported`;let a=new Set(r);a.add(e.id);let o=sd(n);if(o.isMutationOrderAmbiguous(e,t,`trust`))return`unsupported`;let s=wd(e.initializer,t,n,a);for(let r of o.getEventsBefore(e,t)){let e=Cd(s,r.node,n,a);s=r.isConditional?Sd(s,e):e}return s}if(!S(i,`ObjectExpression`))return`unsupported`;let a=`absent`;for(let e of i.properties){if(S(e,`SpreadElement`)){let t=wd(e.argument,e.argument,n,new Set(r));t!==`absent`&&(a=t===`unsupported`?`trusted`:t);continue}if(!S(e,`Property`)){a=`trusted`;continue}let t=N(e,{allowComputedString:!0});if(t===null){a=`trusted`;continue}t===`trust`&&(a=bd(e.value,n)?`untrusted`:`trusted`)}return a},Td=(e,t,n)=>{let r=yd.get(e),i=new Map(r);for(let[e,n]of t)i.set(e,n);yd.set(e,i);try{return n()}finally{r?yd.set(e,r):yd.delete(e)}},Ed=(e,t,n,r)=>{let i=e?O(e):void 0;if(i&&S(i,`Identifier`)){let e=n.referenceFor(i)?.resolvedSymbol,t=e?yd.get(n)?.get(e.id):void 0;if(t)return t}let a=wd(e,t,n,r);return{isSafe:a===`absent`||a===`untrusted`}},Dd={containsKatex:!1,isConclusive:!0,isSafe:!0,isSafeInAttributeContext:!0},Od={containsKatex:!1,isConclusive:!0,isSafe:!0,isSafeInAttributeContext:!1},Q={containsKatex:!1,isConclusive:!1,isSafe:!1,isSafeInAttributeContext:!1},kd={containsKatex:!0,isConclusive:!1,isSafe:!1,isSafeInAttributeContext:!1},Ad={containsKatex:!0,isConclusive:!0,isSafe:!1,isSafeInAttributeContext:!1},jd=new WeakMap,Md=new WeakMap,Nd=(e,t,n)=>{jd.set(e,t),Md.set(e,n)},Pd=e=>({containsKatex:e.some(e=>e.containsKatex),isConclusive:e.every(e=>e.isSafe)?e.filter(e=>e.containsKatex).every(e=>e.isConclusive):e.some(e=>e.containsKatex&&e.isConclusive&&!e.isSafe)||e.some(e=>e.containsKatex&&e.isConclusive)&&e.some(e=>!e.containsKatex&&!e.isSafe),isSafe:e.every(e=>e.isSafe),isSafeInAttributeContext:e.every(e=>e.isSafeInAttributeContext)}),Fd=(e,t)=>{let n=O(e);if(!S(n,`ObjectExpression`))return{isKnown:!1,value:null};let r=!0,i=null;for(let e of n.properties){if(!S(e,`Property`)){r=!1,i=null;continue}let n=N(e,{allowComputedString:!0});n===null?(r=!1,i=null):n===t&&(r=!0,i=e.value)}return{isKnown:r,value:i}},Id=(e,t)=>{let n=O(e);if(S(n,`Identifier`)){let e=P(n,t);return!!(e&&e.kind===`import`&&Vu(e)?.source.value===`react`&&j(e.declarationNode)===`useMemo`)}if(!S(n,`MemberExpression`)||M(n)!==`useMemo`)return!1;let r=P(O(n.object),t);return!!(r&&r.kind===`import`&&Vu(r)?.source.value===`react`&&(S(r.declarationNode,`ImportDefaultSpecifier`)||S(r.declarationNode,`ImportNamespaceSpecifier`)||j(r.declarationNode)===`default`))},Ld=(e,t)=>{let n=O(e),r=!1;for(;S(n,`CallExpression`);){let e=O(n.callee);if(!S(e,`MemberExpression`))return!1;let t=M(e);if(t!==`replace`&&t!==`replaceAll`)return!1;let i=n.arguments[0],a=n.arguments[1];if(!i||!a||!S(a,`Literal`)||typeof a.value!=`string`||a.value.includes(`<`)||a.value.includes(`$`))return!1;if(S(i,`Literal`)){let e=`regex`in i?i.regex:void 0,n=t===`replaceAll`&&i.value===`<`,a=e?.pattern===`<`&&e.flags.includes(`g`);(n||a)&&(r=!0)}n=O(e.object)}return!r||!S(n,`Identifier`)?!1:t.referenceFor(n)?.resolvedSymbol?.kind===`parameter`},Rd=(e,t)=>{let n=O(e.callee);return S(n,`MemberExpression`)&&M(n)===`sanitize`&&(fd(n.object,`dompurify`,`sanitize`,e,t)||fd(n.object,`isomorphic-dompurify`,`sanitize`,e,t))?Od:S(n,`MemberExpression`)&&M(n)===`escape`&&fd(n.object,`html-escaper`,`escape`,e,t)||pd(n,`html-escaper`,`escape`,e,t)?Dd:pd(n,`dompurify`,`sanitize`,e,t)||pd(n,`isomorphic-dompurify`,`sanitize`,e,t)?Od:null},zd=(e,t)=>{if(!t.isSafe)return null;let n=O(e.callee);if(!S(n,`MemberExpression`))return null;let r=M(n);if((r===`trim`||r===`trimEnd`||r===`trimStart`)&&e.arguments.length===0)return t;if(r!==`replace`&&r!==`replaceAll`)return null;let i=e.arguments[1];return!i||!S(i,`Literal`)||typeof i.value!=`string`||i.value.includes(`<`)?null:{containsKatex:t.containsKatex,isConclusive:t.isConclusive,isSafe:!0,isSafeInAttributeContext:t.isSafeInAttributeContext&&!/[&>"']/.test(i.value)}},Bd=e=>{let t=e.toLowerCase();for(let e of[`script`,`style`,`textarea`,`title`])if(t.lastIndexOf(`<${e}`)>t.lastIndexOf(`</${e}`))return`raw-text`;let n=e.lastIndexOf(`<`);if(n<=e.lastIndexOf(`>`))return`text`;let r=e.slice(n+1),i=null;for(let e=0;e<r.length;e+=1){let t=r[e];(t===`"`||t===`'`)&&r[e-1]!==`\\`&&(i===t?i=null:i===null&&(i=t))}return i===null?`unsafe-tag`:`attribute`},Vd=(e,t,n,r)=>{let i=e.expressions.map(e=>$(e,t,new Set(n),r)),a=``,o=!0;for(let t=0;t<i.length;t+=1){a+=e.quasis[t]?.value.raw??``;let n=Bd(a),r=i[t]??Q;n===`text`?o&&=r.isSafe:n===`attribute`?o&&=r.isSafeInAttributeContext:o=!1}return{containsKatex:i.some(e=>e.containsKatex),isConclusive:o?i.filter(e=>e.containsKatex).every(e=>e.isConclusive):i.some(e=>e.containsKatex&&e.isConclusive&&!e.isSafe)||i.some(e=>e.containsKatex&&e.isConclusive)&&i.some(e=>!e.containsKatex&&!e.isSafe),isSafe:o,isSafeInAttributeContext:!1}},Hd=(e,t)=>{let n=e;for(;n.parent&&n!==t;){let e=n.parent;if(S(e,`BlockStatement`)){let t=e.body.findIndex(e=>e===n);if(t>0&&e.body.slice(0,t).some(e=>L(e)))return!0}if(S(e,`SwitchCase`)){let t=e.consequent.findIndex(e=>e===n);if(t>0&&e.consequent.slice(0,t).some(e=>L(e)))return!0}if(S(e,`IfStatement`)&&S(e.test,`Literal`)){let t=e.alternate,r=e.consequent,i=!!e.test.value;if(!i&&r===n||i&&t===n)return!0}if(S(e,`WhileStatement`)&&e.body===n){let t=e.test;if(S(t,`Literal`)&&!t.value)return!0}if(S(e,`ForStatement`)&&e.body===n){let t=e.test;if(t&&S(t,`Literal`)&&!t.value)return!0}n=e}return!1},Ud=(e,t,n,r=new Map)=>{if(!x(e))return Q;if(!S(e.body,`BlockStatement`))return $(e.body,t,n,r);let i=e.body,a=[];return A(i,e=>{if(e!==i&&x(e))return!1;if(S(e,`ReturnStatement`))return Hd(e,i)||a.push(e.argument?$(e.argument,t,new Set(n),r):Dd),!1}),a.length===0?Dd:Pd(a)},Wd=(e,t,n,r,i=new Map)=>{if(!x(e))return Q;let a=[];if(!S(e.body,`BlockStatement`))a.push(e.body);else{let t=e.body;A(t,e=>{if(e!==t&&x(e))return!1;S(e,`ReturnStatement`)&&e.argument&&!Hd(e,t)&&a.push(e.argument)})}return a.length===0?Q:Pd(a.map(e=>{let a=Fd(e,t);return!a.isKnown||a.value===null?Q:$(a.value,n,new Set(r),i)}))},Gd=(e,t)=>{let n=O(e);if(!S(n,`Identifier`))return null;let r=P(n,t);if(!r||r.references.some(e=>e.flag!==`read`))return null;if(r.kind===`function`&&x(r.declarationNode))return{functionNode:r.declarationNode,symbol:r};if(r.kind!==`const`||!r.initializer)return null;let i=O(r.initializer);return x(i)?{functionNode:i,symbol:r}:null},Kd=(e,t,n,r)=>{let i=new Map;if(!x(e))return i;let a=(e,t)=>e===void 0||S(e,`Identifier`)&&e.name===`undefined`&&t.isGlobalReference(e)||S(e,`UnaryExpression`)&&e.operator===`void`,o=(e,t,n,a)=>a?Td(r,i,()=>Ed(e,t,n,new Set)):Ed(e,t,n,new Set);for(let[s,c]of e.params.entries()){let e=t.arguments[s],l=S(c,`AssignmentPattern`)&&a(e,n),u=l&&S(c,`AssignmentPattern`)?c.right:e,d=l?r:n,f=l?c:t,p=S(c,`AssignmentPattern`)?c.left:c;if(S(p,`Identifier`)){let e=r.symbolFor(p);if(!e||e.references.some(e=>e.flag!==`read`))continue;i.set(e.id,o(u,f,d,l));continue}if(!(!S(p,`ObjectPattern`)||!u))for(let e of p.properties){if(!S(e,`Property`))continue;let t=N(e,{allowComputedString:!0});if(t===null)continue;let n=Fd(u,t),s=S(e.value,`AssignmentPattern`)?e.value.left:e.value;if(!S(s,`Identifier`))continue;let c=r.symbolFor(s);if(!n.isKnown||!c||c.references.some(e=>e.flag!==`read`))continue;let l=S(e.value,`AssignmentPattern`)&&(n.value===null||a(n.value??void 0,d)),p=l&&S(e.value,`AssignmentPattern`)?e.value.right:n.value??void 0,m=l?r:d,h=l?e:f;i.set(c.id,o(p,h,m,l))}}return i},qd=(e,t,n)=>{let r=O(e.callee);if(!S(r,`Identifier`))return null;let i=P(r,t);if(!i||i.kind!==`import`)return null;let a=Vu(i),o=j(i.declarationNode),s=jd.get(t),c=a?.source.value,l=Md.get(t)??0;if(!s||typeof c!=`string`||!o||l>=2)return null;let u=On(s,c,o);if(!u||!x(u.functionNode))return null;let d=Ne(u.programNode);return Nd(d,u.filePath,l+1),Td(d,Kd(u.functionNode,e,t,d),()=>n?Wd(u.functionNode,n,d,new Set):Ud(u.functionNode,d,new Set))},Jd=(e,t,n,r)=>{if(!S(e,`CallExpression`))return Q;let i=O(e.callee);if(S(i,`MemberExpression`)&&M(i)===`renderToString`&&md(i.object,e,t)||hd(i,e,t))return{containsKatex:!0,isConclusive:!0,isSafe:Ed(e.arguments[1],e,t,new Set).isSafe,isSafeInAttributeContext:!1};let a=qd(e,t);if(a?.containsKatex)return a;let o=Gd(i,t);if(o&&!n.has(o.symbol.id)){let i=new Set(n);i.add(o.symbol.id);let a=e.arguments.map(e=>{let i=O(e);return x(i)?Ud(i,t,new Set(n),r):$(i,t,new Set(n),r)}),s=new Map,c=!1;if(x(o.functionNode))for(let[e,n]of o.functionNode.params.entries()){if(!S(n,`Identifier`))continue;let r=t.symbolFor(n),i=a[e],o=r?.references.every(e=>e.flag===`read`);r&&i&&o&&s.set(r.id,i),i?.containsKatex&&r&&!o&&(c=!0)}let l=Td(t,Kd(o.functionNode,e,t,t),()=>Ud(o.functionNode,t,i,s));return!a.some(e=>e.containsKatex)||l.containsKatex?l:c?kd:Ad}if(gd(i,t))return{containsKatex:!0,isConclusive:!0,isSafe:!1,isSafeInAttributeContext:!1};if(S(i,`MemberExpression`)){let a=$(i.object,t,new Set(n),r);if(a.containsKatex)return zd(e,a)||(a.isConclusive?{containsKatex:!0,isConclusive:!0,isSafe:!1,isSafeInAttributeContext:!1}:kd)}let s=Rd(e,t);if(s)return s;if(Ld(e,t))return Od;if(Id(i,t)){let i=e.arguments[0];if(!i)return Q;let a=O(i);if(x(a))return Ud(a,t,new Set(n),r);let o=Gd(a,t);if(!o||n.has(o.symbol.id))return Q;let s=new Set(n);return s.add(o.symbol.id),Ud(o.functionNode,t,s,r)}return e.arguments.some(e=>{let i=O(e);return(x(i)?Ud(i,t,new Set(n),r):$(i,t,new Set(n),r)).containsKatex})?kd:Q},Yd=(e,t)=>{let n=Bu(e);if(S(n,`Literal`))return!!n.value;if(S(n,`Identifier`)&&(n.name===`undefined`||n.name===`NaN`)&&t.isGlobalReference(n))return!1;if(S(n,`TemplateLiteral`)){let e=Sa(n);return e===null?null:!!e}if(S(n,`ArrayExpression`)||S(n,`ObjectExpression`)||S(n,`ArrowFunctionExpression`)||S(n,`FunctionExpression`)||S(n,`ClassExpression`)||S(n,`NewExpression`)||S(n,`JSXElement`)||S(n,`JSXFragment`))return!0;if(S(n,`UnaryExpression`)){if(n.operator===`void`)return!1;if(n.operator===`typeof`)return!0;if(n.operator===`!`){let e=Yd(n.argument,t);return e===null?null:!e}}return null},$=(e,t,n,r=new Map)=>{let i=O(e);if(S(i,`Literal`)||S(i,`UnaryExpression`)&&i.operator===`void`)return Dd;if(S(i,`Identifier`)){if((i.name===`undefined`||i.name===`NaN`)&&t.isGlobalReference(i))return Dd;let e=t.referenceFor(i)?.resolvedSymbol,a=e?r.get(e.id):void 0;if(a)return a;if(!e||e.kind!==`const`||!e.initializer||n.has(e.id))return Q;let o=new Set(n);return o.add(e.id),$(e.initializer,t,o,r)}if(S(i,`CallExpression`))return Jd(i,t,n,r);if(S(i,`MemberExpression`)){let e=M(i),n=O(i.object);if(e&&S(n,`Identifier`)){let r=t.referenceFor(n)?.resolvedSymbol,i=r?.initializer?O(r.initializer):null;if(r?.kind===`const`&&i&&S(i,`CallExpression`)){let n=qd(i,t,e);if(n?.containsKatex)return n}}return Q}if(S(i,`TemplateLiteral`))return Vd(i,t,n,r);if(S(i,`ConditionalExpression`)){let e=Yd(i.test,t);return e===null?Pd([$(i.consequent,t,new Set(n),r),$(i.alternate,t,new Set(n),r)]):$(e?i.consequent:i.alternate,t,new Set(n),r)}if(S(i,`LogicalExpression`)){let e=i.operator===`??`?null:Yd(i.left,t);if(e!==null)return $(i.operator===`&&`?e?i.right:i.left:e?i.left:i.right,t,new Set(n),r);let a=Wu(i);if(a.length===1)return $(a[0]??i,t,new Set(n),r);let o=[i.left,i.right].map(e=>$(e,t,new Set(n),r));return{...i.operator===`&&`?o[1]??Q:Pd(a.map(e=>$(e,t,new Set(n),r))),containsKatex:o.some(e=>e.containsKatex)}}if(S(i,`BinaryExpression`)&&i.operator===`+`)return Pd([$(i.left,t,new Set(n),r),$(i.right,t,new Set(n),r)]);if(S(i,`SequenceExpression`)){let e=i.expressions.at(-1);return e?$(e,t,n,r):Q}return Q},Xd=e=>{let t=null;if(S(e,`JSXAttribute`)&&S(e.name,`JSXIdentifier`)&&e.name.name===`dangerouslySetInnerHTML`&&S(e.value,`JSXExpressionContainer`)&&S(e.value.expression,`ObjectExpression`)&&(t=e.value.expression),S(e,`Property`)&&N(e,{allowComputedString:!0})===`dangerouslySetInnerHTML`&&S(O(e.value),`ObjectExpression`)&&(t=O(e.value)),!S(t,`ObjectExpression`))return null;let n=null;for(let e of t.properties){if(S(e,`SpreadElement`)){n=null;continue}if(!S(e,`Property`)){n=null;continue}let t=N(e,{allowComputedString:!0});if(t===null){n=null;continue}t===`__html`&&(n=e.value)}return n},Zd=(e,t)=>{let n=It({filename:t,sourceText:e});if(n===null)return[];let r=Ne(n);Nd(r,t,0);let i=[];return A(n,e=>{let t=Xd(e);if(t===null)return;let n=$(t,r,new Set);if(!n.containsKatex)return;let a=J(e),o=zu(e);a<0||o<0||i.push({endIndex:o,proof:n,startIndex:a})}),i},Qd=/dangerouslySetInnerHTML|(?:\.(?:inner|outer)HTML|\[\s*["'](?:inner|outer)HTML["']\s*\])\s*[+]?=(?!=)|\.insertAdjacentHTML\s*\(|\bdocument\.write(?:ln)?\s*\(|\.(?:createContextualFragment|setHTMLUnsafe)\s*\(/,$d=/(?:__html\s*:|(?:\.(?:inner|outer)HTML|\[\s*["'](?:inner|outer)HTML["']\s*\])\s*[+]?=(?!=)|\.insertAdjacentHTML\s*\(\s*[^,]*,|\bdocument\.write(?:ln)?\s*\(|\.(?:createContextualFragment|setHTMLUnsafe)\s*\()\s*([\s\S]*)/,ef=/searchParams|query|params|request|req\.|response\.|result\.|data\.|await|fetch|props\.|children|content|html|body|text|message|markup|\blocation\b|document\.cookie|\breferrer\b|\blocalStorage\b|\bsessionStorage\b|URLSearchParams|window\.name/i,tf=/^(?:"(?:\\.|[^"\\\n])*"|'(?:\\.|[^'\\\n])*'|`[^`$]*`)\s*(?:\/\/[^\n]*)?\s*(?:[;,})\n]|$)/,nf=/^[A-Z][A-Z0-9_]*\s*(?:\/\/[^\n]*)?\s*(?:[;,})\n]|$)/,rf=/^[\w$]+(?:\??\.[\w$]+)*\??\.(?:inner|outer)HTML\b/,af=/\b(?:DOMPurify|sanitize\w*|purify|(?:escape|encode)[A-Za-z]*(?:Html|HTML|Entit\w*)|insane|xss)\b|(?<!un)safe|(?<!un)saniti[sz]/i,of=/[:=]\s*[^\n;]*\b(?:DOMPurify\b|sanitize\w*\s*\(|purify\w*\s*\()/i,sf=/=\s*[\w$.?[\]]*\.(?:inner|outer)HTML\s*(?:[;,)\n]|$)/,cf=/process\.env/,lf=/\b(?:t|i18n|translate|formatMessage|intl)\s*[.(]/,uf=/^(?:[\w$.]+\.)?(?:toHtml|render[A-Za-z]*(?:Html|HTML)|renderToString|renderToStaticMarkup|codeToHtml|codeToHast|highlight[A-Za-z]*)\s*\(/,df=/\b(?:shiki|prism|hljs|highlightjs|getHighlighter|codeToHtml|codeToHast|refractor|lowlight|starry-night)\b|highlight\.js/i,ff=/[:=]\s*[^\n;]*(?:\b(?:katex|shiki|hljs|prism|mermaid)\b|hast-util-to-html|renderHtmlFromRichText|(?:toHtml|render[A-Za-z]*(?:Html|HTML)|renderToString|renderToStaticMarkup|codeToHtml|codeToHast)\s*\()/i,pf=/\b(?:(?:katex|shiki|hljs|prism|mermaid|highlighter)[\w$]*\.(?:render\w*|highlight\w*|codeTo(?:Html|Hast))|(?:toHtml|render(?:Html|HTML)[A-Za-z]*|render[A-Za-z]*(?:Html|HTML)|renderToString|renderToStaticMarkup|codeToHtml|codeToHast|highlight[A-Za-z]*))\s*\(/i,mf=/^[\w$]+\s*(?:[;,})\n]|$)/,hf=/^[\w$]+\s*(?:\|\||\?\?)\s*(?:"[^"\n]*"|'[^'\n]*'|`[^`$]*`)\s*(?:[;,})\n]|$)/,gf=/^[\w$]+(?:\.[\w$]+|\[[^\]]*\])+\s*(?:[;,})\n]|$)/,_f=/<style\b[^<>]*$/,vf=/(?:^|\/)emails(?:\/|$)|email[-_.]templates?(?:\/|$)|RawHtml|[A-Za-z]*[Ee]mail[A-Za-z]*\.(?:t|j)sx?/i,yf=/(?:^|\/)\.[\w-]+\//,bf=/(?<!un)saniti[sz]e?d?[\w-]*\.[cm]?[jt]sx?$/i,xf=/(?:^|[^\w$.])([\w$]+(?:\.[\w$]+)*)(?:(?:\.(?:inner|outer)HTML|\[\s*["'](?:inner|outer)HTML["']\s*\])\s*[+]?=(?!=)|\.insertAdjacentHTML\s*\()/,Sf=/\b(?:appendChild|append|prepend|before|after|replaceWith|replaceChild|replaceChildren|insertBefore|insertAdjacentElement)\s*\(/,Cf=5e3,wf=e=>{if(!e.startsWith("`"))return null;let t=e.indexOf("`",1);if(t<0||t>Cf)return null;let n=e.slice(1,t).match(/\$\{[^}]*\}/g);return n===null?``:n.join(` `)},Tf=(e,t,n)=>{let r=Mf(e,t,n);return r===null?null:n.slice(r.initializerStartIndex,r.initializerStartIndex+Cf)},Ef=e=>{if(!/^["']/.test(e))return!1;let t=e.replace(/"(?:\\.|[^"\\\n])*"|'(?:\\.|[^'\\\n])*'/g,``),n=t.search(/[;,})\]]/),r=n>=0?t.slice(0,n):t;return/^[\s+]*$/.test(r)},Df=(e,t)=>{let n=t.includes(`createElement`),r=t.includes(`createHTMLDocument`);if(!n&&!r)return!1;let i=q(e),a=q(e.split(`.`)[0]??e);if(RegExp(`\\b${a}\\s*=\\s*[^\\n;]*(?:getElementById|querySelector|getElementsBy|\\.current\\b|document\\.(?:body|head|documentElement))`).test(t))return!1;if(n&&(RegExp(`${i}\\s*=\\s*document\\.createElement\\(\\s*["'\`]template["'\`]`).test(t)||RegExp(`${a}\\s*=\\s*[^\\n;]*\\bcreateElement\\(\\s*["'\`](?:style|textarea)["'\`]`).test(t))||r&&RegExp(`${a}\\s*=\\s*[^\\n;]*\\bcreateHTMLDocument\\s*\\(`).test(t))return!0;if(!n||!RegExp(`${a}\\s*=\\s*[^\\n;]*\\bcreateElement\\s*\\(`).test(t))return!1;let o=RegExp(`${Sf.source}[^)]*\\b${a}\\b`),s=RegExp(`\\breturn\\b[^\\n]*\\b${a}\\b(?!\\s*\\.\\s*(?:textContent|innerText|innerHTML|outerHTML))`);return o.test(t)||s.test(t)?!1:RegExp(`\\b${a}\\.(?:textContent|innerText|querySelector|querySelectorAll|children|childNodes)\\b`).test(t)},Of=e=>{let t=[],n=``,r=0,i=null;for(let a=0;a<e.length;a+=1){let o=e[a];if(i!==null){n+=o,o===i&&e[a-1]!==`\\`&&(i=null);continue}if(o===`"`||o===`'`||o==="`"){i=o,n+=o;continue}if(o===`(`||o===`[`||o===`{`?r+=1:(o===`)`||o===`]`||o===`}`)&&--r,o===`+`&&r===0&&e[a-1]!==`+`&&e[a+1]!==`+`){t.push(n),n=``;continue}n+=o}return t.push(n),t},kf=e=>{let t=e.replace(/[;}]\s*$/,``).trim();if(!t.includes(`+`))return!1;let n=Of(t).map(e=>e.trim()).filter(e=>e.length>0);return n.length<2?!1:n.every(e=>{let t=e.replace(/\(\s*([\w$]+(?:\??\.[\w$]+)*)\s+as\s+[^)]*\)/g,`$1`);return rf.test(t)?!ef.test(t.replace(rf,``)):!1})},Af=(e,t)=>{let n=0,r=null;for(let i=t;i<e.length;i+=1){let t=e[i];if(r!==null){t===r&&e[i-1]!==`\\`&&(r=null);continue}if(t===`"`||t===`'`||t==="`"){r=t;continue}if(t===`{`&&(n+=1),t===`}`&&(--n,n===0))return i}return e.length},jf=(e,t)=>{let n=[],r=null,i=!1,a=!1;for(let o=0;o<t;o+=1){let t=e[o],s=e[o+1];if(i){t===`
+`&&(i=!1);continue}if(a){t===`*`&&s===`/`&&(a=!1,o+=1);continue}if(r!==null){t===r&&e[o-1]!==`\\`&&(r=null);continue}if(t===`/`&&s===`/`){i=!0,o+=1;continue}if(t===`/`&&s===`*`){a=!0,o+=1;continue}if(t===`"`||t===`'`||t==="`"){r=t;continue}t===`{`&&n.push(o),t===`}`&&n.pop()}let o=n.at(-1);return o===void 0?e.length:Af(e,o)},Mf=(e,t,n)=>{let r=RegExp(`(const|let|var)\\s+${q(e)}\\s*(?::[^=\\n]*)?=\\s*([^;\\n]+)`,`g`),i=null,a=-1;for(let e of n.matchAll(r)){let r=e.index;if(r===void 0||r>=t||r<=a||jf(n,r)<t)continue;a=r;let o=e[2];o!==void 0&&(i={declarationIndex:r,initializer:o,initializerStartIndex:r+e[0].length-o.length,isImmutable:e[1]===`const`})}return i},Nf=(e,t,n,r)=>{if(t.isImmutable)return!0;let i=r.slice(t.initializerStartIndex+t.initializer.length,n);return!RegExp(`(?:^|[^\\w$.])${q(e)}\\s*=(?!=)`).test(i)},Pf=(e,t,n)=>{if(!/highlight/i.test(e))return!1;let r=e.match(/^([\w$]+)/)?.[1];if(r===void 0)return!1;let i=Mf(r,n,t);return i===null?/highlighted/i.test(e)||df.test(t):Nf(r,i,n,t)&&pf.test(i.initializer)},Ff=(e,t,n,r=new Set)=>{let i=e.trim(),a=Of(i);if(a.length>1)return a.every(e=>Ff(e,t,n,r));let o=[...i.matchAll(/\$\{([^}]*)\}/g)].flatMap(e=>e[1]===void 0?[]:[e[1]]);if(o.length>1)return o.every(e=>Ff(e,t,n,r));let s=i.match(/^([\w$]+)(?:(?:\??\.[\w$]+)|(?:\[\s*(?:"[^"\n]*"|'[^'\n]*'|\d+)\s*\]))*$/)?.[1];if(s&&!r.has(s)){let e=Mf(s,n,t);if(e&&Nf(s,e,n,t)){let n=new Set(r);return n.add(s),Ff(e.initializer,t,e.initializerStartIndex,n)}}return!!(tf.test(`${i};`)||nf.test(`${i};`)||af.test(i)||cf.test(i)||lf.test(i)||uf.test(i)||Pf(i,t,n))},If=(e,t,n,r,i=new Set)=>{let a=e.trim().match(/^([\w$]+)$/)?.[1];if(!a)return!1;if(a===t)return!0;if(i.has(a))return!1;let o=Mf(a,n,r);if(!o?.isImmutable)return!1;let s=new Set(i);return s.add(a),If(o.initializer,t,o.initializerStartIndex,r,s)},Lf=(e,t,n)=>{let r=[/function\s+([\w$]+)\s*\(([^)]*)\)\s*\{/g,/(?:const|let|var)\s+([\w$]+)\s*=\s*(?:async\s*)?\(([^)]*)\)\s*=>\s*\{/g],i=null,a=-1;for(let o of r)for(let r of n.matchAll(o)){let o=r.index;if(o===void 0||o>=t||o<a)continue;let s=Af(n,o+r[0].lastIndexOf(`{`));if(s<t)continue;let c=(r[2]??``).split(`,`).findIndex(t=>t.trim().match(/^(?:\.\.\.)?([\w$]+)/)?.[1]===e);if(c<0)continue;a=o;let l=r[1]??``;i={bodyEndIndex:s,declarationNameIndex:o+r[0].indexOf(l),functionName:l,parameterIndex:c}}return i},Rf=e=>{let t=[],n=0,r=0,i=null;for(let a=0;a<e.length;a+=1){let o=e[a];if(i!==null){o===i&&e[a-1]!==`\\`&&(i=null);continue}if(o===`"`||o===`'`||o==="`"){i=o;continue}(o===`(`||o===`[`||o===`{`)&&(r+=1),(o===`)`||o===`]`||o===`}`)&&--r,o===`,`&&r===0&&(t.push(e.slice(n,a).trim()),n=a+1)}return t.push(e.slice(n).trim()),t},zf=(e,t,n,r=new Set)=>{let i=e.trim().match(/^([\w$]+)$/)?.[1];if(i===void 0||r.has(i))return!1;if(Lf(i,t,n)!==null)return!0;let a=Mf(i,t,n);if(!a||!Nf(i,a,t,n))return!1;let o=new Set(r);return o.add(i),zf(a.initializer,a.initializerStartIndex,n,o)},Bf=(e,t,n,r,i)=>{let a=e.trim();if(Ff(a,t,n))return!1;let o=a.match(/^([\w$]+)(?:\.|\s*(?:[;,})\n]|$))/)?.[1];if(o===void 0)return ef.test(a);if(r.has(o))return!1;r.add(o);let s=Mf(o,n,t),c=Lf(o,n,t);if(s!==null&&(c===null||s.declarationIndex>c.declarationNameIndex))return Nf(o,s,n,t)&&Ff(s.initializer,t,s.initializerStartIndex)?!1:!Nf(o,s,n,t)||Bf(s.initializer,t,s.initializerStartIndex,r,i)?!0:zf(s.initializer,s.initializerStartIndex,t)?!1:ef.test(a);if(c!==null&&c.functionName.length>0){let e=RegExp(`\\b${q(c.functionName)}\\s*\\(`,`g`),n=!1,s=!0;for(let a of t.matchAll(e)){if(a.index===c.declarationNameIndex||i.has(a.index))continue;let e=a.index+a[0].lastIndexOf(`(`),l=Ru(t,e);if(l<0)continue;let u=Rf(t.slice(e+1,l))[c.parameterIndex];if(u===void 0||a.index>=c.declarationNameIndex&&a.index<=c.bodyEndIndex&&If(u,o,a.index,t))continue;n=!0,s&&=Ff(u,t,a.index);let d=new Set(r);d.delete(o);let f=new Set(i);if(f.add(a.index),Bf(u,t,a.index,d,f))return!0}return n?!s&&ef.test(a):ef.test(a)}return ef.test(a)},Vf=U({id:`dangerous-html-sink`,title:`HTML injection sink with dynamic content`,severity:`warn`,recommendation:`Prefer rendering structured React nodes. If HTML is required, sanitize with a well-reviewed sanitizer and keep the trust boundary close to the sink.`,scan:e=>{if(e.isGeneratedBundle||!G(e.relativePath)||vf.test(e.relativePath)||yf.test(e.relativePath)||bf.test(e.relativePath)||!Qd.test(e.content))return[];let t=Zd(e.content,e.absolutePath),n=[],r=e.content.split(`
+`);for(let i=0;i<r.length;i+=1){let a=r[i]??``;if(!Qd.test(a))continue;let o=a.slice(0,a.search(Qd)).replace(/"[^"]*"|'[^']*'|`[^`]*`/g,``);if(/(?:^|[^:])\/\//.test(o)||/^\s*[/*]/.test(a))continue;let s=r.slice(i,i+1+4).join(`
+`),c=$d.exec(s);if(c===null)continue;let l=(c[1]??``).trimStart(),u=l.slice(0,300),d=u.search(/[;}]/),f=d>=0?u.slice(0,d+1):u,p=r.slice(0,i).join(`
+`).length+ +(i>0)+a.search(Qd),m=t.find(e=>p>=e.startIndex&&p<e.endIndex)?.proof;if(m?.isConclusive&&m.isSafe)continue;let h=m?.isConclusive===!0;if(tf.test(f)||nf.test(f))continue;if(rf.test(f)&&!f.includes(`+`)){let e=f.replace(rf,``);if(!ef.test(e))continue}if(kf(f))continue;let ee=$d.exec(r.slice(i,i+1+60).join(`
+`))?.[1]?.trimStart(),g=wf(ee??l),_=mf.test(f)||gf.test(f)||hf.test(f)?f.match(/^[\w$]+/)?.[0]:void 0;if(g===null&&_!==void 0&&mf.test(f)&&Lf(_,p,e.content)===null){let t=Tf(_,p,e.content);if(t!==null){if(Ef(t))continue;g=wf(t)}}if(g===``)continue;let v=g??f,y=Of(v).length>1||(g?.match(/\$\{/g)?.length??0)>1;if(!h&&!y&&af.test(v)||!y&&cf.test(v)||!y&&lf.test(v)||!h&&!Bf(v,e.content,p,new Set,new Set)||!h&&uf.test(f)||!h&&Pf(f,e.content,p))continue;if(_!==void 0){let t=q(_),n=Mf(_,p,e.content),r=n?.initializer;if(!(r!==void 0&&(Of(r).length>1||(r.match(/\$\{/g)?.length??0)>1))){let i=RegExp(`\\b${t}\\b\\s*${ff.source}`,`i`);if(!h&&(r===void 0?i.test(e.content):n!==null&&Nf(_,n,p,e.content)&&pf.test(r)))continue;let a=RegExp(`\\b${t}\\b\\s*${of.source}`,`i`);if(!h&&(r===void 0?a.test(e.content):n!==null&&Nf(_,n,p,e.content)&&of.test(`=${r}`)))continue}if(RegExp(`\\b${t}\\b\\s*${sf.source}`).test(e.content)||RegExp(`highlight[\\w$]*\\s*\\.map\\(\\s*(?:async\\s+)?\\(?\\s*${t}\\b`,`i`).test(e.content)&&df.test(e.content))continue}if(gf.test(f)){let t=f.match(/\.([\w$]+)\s*(?:[;,})\n]|$)/)?.[1];if(t!==void 0&&RegExp(`\\b${q(t)}\\s*:\\s*${lf.source}`).test(e.content))continue}let te=xf.exec(a),ne=te?.[1]??te?.[2];if(ne!==void 0&&Df(ne,e.content))continue;let re=r.slice(Math.max(0,i-5),i+1).join(`
+`).slice(0,-a.length+a.search(Qd));_f.test(re)||n.push({message:`HTML is injected from a dynamic-looking source, which can become XSS if the value is user-controlled or unsanitized.`,line:i+1,column:a.search(/\S/)+1})}return n}}),Hf=e=>!(!G(e)||Rc.test(e)||Bc.test(e)),Uf=/firebase|firestore|supabase|\b(?:setDoc|addDoc)\s*\(/i,Wf=U({id:`firebase-client-owned-authz-field`,title:`Client writes authorization field`,severity:`error`,recommendation:`Derive authority fields on the server or enforce them in Firebase/Supabase rules; never trust client-provided owner, org, or role values.`,scan:K({shouldScan:e=>Hf(e.relativePath)&&(Uf.test(e.content)||Uf.test(e.relativePath)),pattern:/(?:\b(?:setDoc|updateDoc|addDoc)\s*\(|(?:\b(?:firebase|firestore|getFirestore)\b|\bcollection\s*\(|\.collection\s*\()[\s\S]{0,500}\.(?:set|update|add)\s*\()(?:[^;'"`]|'[^'\n]*'|"[^"\n]*"|`[^`]*`){0,700}\b(?:ownerId|ownerID|creatorId|creatorID|providerId|providerID|orgId|orgID|tenantId|tenantID|workspaceId|workspaceID|ghostOrg|role|roles|isAdmin)\b/i,message:`Client code writes an ownership, tenant, or role field that should be server-owned and immutable.`})}),Gf=U({id:`firebase-permissive-rules`,title:`Permissive Firebase security rule`,severity:`error`,recommendation:"Bind every read/write to `request.auth.uid`, immutable ownership, and tenant membership instead of treating sign-in as authorization.",scan:K({shouldScan:e=>il(e.relativePath),pattern:/allow\s+(?:read|write|create|update|delete|list|get|read,\s*write)\s*:\s*if\s+(?:true|request\.auth\s*!=\s*null)\s*;?/i,message:`Firebase rules grant broad access to everyone or to any signed-in user, which is the Chattr/Firewreck failure mode.`})}),Kf=U({id:`firebase-query-filter-as-auth`,title:`Firestore query filter used as authorization`,severity:`warn`,recommendation:"Make sure Firestore rules compare the requested document against `request.auth.uid` and trusted membership data.",scan:K({shouldScan:e=>Hf(e.relativePath),pattern:/\.where\s*\(\s*["'](?:uid|userId|userID|ownerId|ownerID|orgId|orgID|tenantId|tenantID|role)["']\s*,\s*["']==["']/i,message:`Firestore query code filters by an auth-shaped field; filtering is not authorization unless rules enforce the same boundary.`})}),qf=/api\.github\.com|github\.com|gitlab\.com|bitbucket\.org/gi,Jf=/\$\{([^}]*)\}/g,Yf=/\b(?:params|searchParams|query|req|request|input|payload)\s*[.[]|\buntrusted|\bdecodeURI\w*/,Xf=/encodeURIComponent\s*\(/,Zf=/^\s*[\w$]+\.toString\(\)\s*$/,Qf=U({id:`git-provider-url-injection-risk`,title:`Git provider URL built from interpolation`,severity:`warn`,recommendation:`Validate owner, repo, org, and branch identifiers against strict slugs and build URLs with URL/path encoders instead of raw interpolation.`,scan:e=>{if(!G(e.relativePath))return[];let t=[];for(let n of e.content.matchAll(qf)){let r=e.content.slice(n.index,n.index+200),i=r.indexOf("`"),a=i>=0?r.slice(0,i):r;if(!Array.from(a.matchAll(Jf)).some(e=>{let t=e[1]??``;return Yf.test(t)&&!Xf.test(t)&&!Zf.test(t)}))continue;let o=W(e.content,n.index);t.push({message:`GitHub/GitLab/Bitbucket URL construction interpolates path components that may be attacker-controlled.`,line:o.line,column:o.column});break}return t}}),$f=/child_process|childProcess|execa|subprocess|Deno\.run/,ep=/(?:\b(?:eval|new\s+Function|vm\.runIn\w*)|(?<![.\w$])(?:exec(?:File)?(?:Sync)?|spawn(?:Sync)?)|\b(?:child_process|childProcess|cp)\.(?:exec|spawn)\w*)\s*\([^;]{0,200}(?<!["'])\b(?:exif|metadata|manifest|preset|plugin|upload|drop(?:ped|s)?\b|archive|zip|unzip|untar)(?!\w*["'])/,tp=/(?:\b(?:eval|new\s+Function|vm\.runIn\w*)|\b(?:child_process|childProcess|cp)\.(?:exec|spawn)\w*)\s*\([^;]{0,200}(?<!["'])\b(?:exif|metadata|manifest|preset|plugin|upload|drop(?:ped|s)?\b|archive|zip|unzip|untar)(?!\w*["'])/,np=`Imported metadata, uploads, or plugin manifests appear to reach code execution.`,rp=K({shouldScan:()=>!0,pattern:ep,ignoreStringLiterals:!0,message:np}),ip=K({shouldScan:()=>!0,pattern:tp,ignoreStringLiterals:!0,message:np}),ap=U({id:`import-metadata-execution-risk`,title:`Imported metadata reaches code execution`,severity:`error`,recommendation:`Parse imported metadata as data with strict schemas; do not evaluate EXIF, manifests, presets, dropped files, or archives.`,scan:e=>G(e.relativePath)?$f.test(e.content)?rp(e):ip(e):[]}),op=/createHash\s*\(\s*["'](?:md5|sha1)["']|\bmd5\s*\(/gi,sp=/\b(?:password|token|secret|signature|signing|auth|credential|session|cookie|csrf|api.?key)\b/i,cp=/(?<!cipher\.)\bcreate(?:Cipher|Decipher)\s*\(/,lp=/\bcreate(?:Cipher|Decipher)iv\s*\(\s*["'](?:des|des3|des-?ede3?|rc4|rc2|bf|blowfish)\b/i,up=/\b(?:DES|RC4|Blowfish)\b/,dp=/\b(?:cipher|decipher|encrypt|decrypt|crypto)\b/i,fp=/[A-Za-z_$][\w$.]{0,100}signature[\w$]*(?:\([^)]*\))?\s*(?:===?|!==?)\s*[A-Za-z_$][\w$.]*(?:\([^)]*\))?|[A-Za-z_$][\w$.]{0,100}(?:\([^)]*\))?\s*(?:===?|!==?)\s*[A-Za-z_$][\w$.]{0,100}signature[\w$]*(?:\([^)]*\))?/i,pp=/(?:===?|!==?)\s*[A-Z](?:[a-z]|[A-Z0-9_]*\b(?!\s*[.(]))|^[A-Z](?:[a-z]|[A-Z0-9_]*\b(?!\s*[.(]))[\w$.]*(?:\([^)]*\))?\s*(?:===?|!==?)/,mp=/signature(?:Method|Type|Status|Algorithm|Kind|Mode|Version)\b/i,hp=/(?:===?|!==?)\s*(?:true|false|null|undefined)\b/,gp=/\.(?:length|size|byteLength)\s*(?:===?|!==?)|\.(?:length|size|byteLength)\s*$/,_p=/\bcrypto\b|createH(?:mac|ash)|createSign|createVerify|\bsubtle\b|\bhmac\b|\bdigest\b|\bsha-?(?:1|256|384|512)\b|\bmd5\b|\bwebhook|x-(?:hub-)?signature/i,vp=/\.[cm]?[jt]sx$/i,yp=/timingSafeEqual|timing.?safe/i,bp=/gravatar|digest[-_ ]?auth|oauth[-_ ]?1|pkcs#?12|smime|\b_id\b|\betag\b|checksum|cache[-_ ]?key|fingerprint/i,xp=/token|secret|password|nonce|salt|csrf|credential|otp/i,Sp=/(?:focus|render|refresh|remount|redraw|animation|layout|cache|update)[-_]?nonce/i,Cp=/Math\.random\s*\(/g,wp=/createHash|md5|cipher|encrypt|decrypt|crypto|signature|Math\.random/i,Tp=(e,t,n,r)=>{for(let i of e.matchAll(t)){let t=e.slice(Math.max(0,i.index-250),i.index+250);if(n.test(t)&&!r?.test(t))return i.index}return-1},Ep=(e,t,n,r)=>{for(let i of e.matchAll(t)){let t=e.lastIndexOf(`
 `,i.index)+1,a=e.indexOf(`
-`,i.index),o=a<0?e.length:a,s=e.slice(t,o);if(!r.test(s)&&n.test(s))return i.index}return-1},Ep=U({id:`insecure-crypto-risk`,title:`Weak cryptography in security context`,severity:`warn`,recommendation:"Use modern primitives, `crypto.randomBytes` / Web Crypto randomness, and timing-safe comparisons for signatures, digests, tokens, and auth material.",scan:e=>{if(!G(e.relativePath)||Hc.test(e.relativePath)||yp.test(e.relativePath)||!Cp.test(e.content))return[];let t=gl(e),n=wp(t,ap,op,yp);if(n<0&&(n=t.search(cp)),n<0&&(n=t.search(sp)),n<0&&up.test(t)&&(n=t.search(lp)),n<0&&!vp.test(t)&&!_p.test(e.relativePath)&&gp.test(t)){let e=dp.exec(t);e!==null&&!fp.test(e[0])&&!pp.test(e[0])&&!mp.test(e[0])&&!hp.test(e[0])&&(n=e.index)}if(n<0&&(n=Tp(t,Sp,bp,xp)),n<0)return[];let r=W(t,n);return[{message:`Code uses weak hashes, deprecated ciphers, timing-unsafe comparisons, or Math.random in a security-shaped context.`,line:r.line,column:r.column}]}}),Dp=`(?<![A-Za-z0-9])(?:session|sess|sid|connect\\.sid|auth|jwt|access[_-]?token|refresh[_-]?token|id[_-]?token)(?![A-Za-z0-9])`,Op=`[\`"'][^\`"']*?${Dp}[^\`"']*[\`"']`,kp=RegExp(`(?:\\.cookies\\.set|cookies\\(\\s*\\)\\.set|\\.cookie)\\s*\\(\\s*${Op}`,`gi`),Ap=/httpOnly\s*:\s*false\b/i,jp=/"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'|`(?:[^`\\]|\\.)*`/g,Mp=e=>{let t=e.split(``),n=0,r=null;for(;n<e.length;){let i=e[n];if(r!==null){if(i===`\\`){n+=2;continue}i===r?r=null:i!==`
-`&&(t[n]=` `),n+=1;continue}(i===`"`||i===`'`||i==="`")&&(r=i),n+=1}return t.join(``)},Np=/cookie\s*:\s*\{/gi,Pp=RegExp(`document\\.cookie\\s*=\\s*[\`"'][^\`"'=;]*?${Dp}[^\`"'=;]*=`,`gi`),Fp=e=>{if(e.trim().length===0)return 0;let t=0,n=null,r=1;for(let i=0;i<e.length;i+=1){let a=e[i];if(n!==null){a===`\\`?i+=1:a===n&&(n=null);continue}a===`"`||a===`'`||a==="`"?n=a:a===`(`||a===`[`||a===`{`?t+=1:a===`)`||a===`]`||a===`}`?--t:a===`,`&&t===0&&(r+=1)}return r},Ip=(e,t,n,r,i)=>{t.lastIndex=0;for(let a=t.exec(e);a!==null;a=t.exec(e)){if(!r(a.index,a[0]))continue;let t=W(e,a.index);i.push({message:n,line:t.line,column:t.column})}},Lp=U({id:`insecure-session-cookie`,title:`Auth cookie missing HttpOnly protection`,severity:`warn`,recommendation:"Set auth/session cookies server-side with `httpOnly: true`, `secure: true`, and `sameSite`. Cookies set via `document.cookie` or with `httpOnly: false` are readable by any XSS payload and can be stolen.",scan:e=>{if(!G(e.relativePath))return[];let t=gl(e);if(!/cookie/i.test(t))return[];let n=[],r=`An auth/session cookie is exposed to JavaScript (set via document.cookie, with httpOnly: false, or without cookie options), letting an XSS payload steal it.`;kp.lastIndex=0;for(let e=kp.exec(t);e!==null;e=kp.exec(t)){let i=e.index+e[0].lastIndexOf(`(`),a=Ru(t,i);if(a<0)continue;let o=t.slice(i+1,a),s=Fp(o)<3,c=o.replace(jp,``);if(!s&&!Ap.test(c))continue;let l=W(t,e.index);n.push({message:r,line:l.line,column:l.column})}let i=Mp(t);Np.lastIndex=0;for(let e=Np.exec(i);e!==null;e=Np.exec(i)){let t=e.index+e[0].length-1,a=Ru(i,t),o=a>=0?i.slice(t,a):i.slice(t,t+400);if(!Ap.test(o))continue;let s=W(i,e.index);n.push({message:r,line:s.line,column:s.column})}return Ip(t,Pp,r,()=>!0,n),n}}),Rp=/\b(?:alg|algorithms?)\s*:\s*\[?\s*["'`]none["'`]/gi,zp=(e,t)=>{let n=null,r=[];for(let i=0;i<t;i+=1){let t=e[i];if(n==="`"){t===`\\`?i+=1:t==="`"?n=null:t===`$`&&e[i+1]===`{`&&(r.push(0),n=null,i+=1);continue}if(n!==null){t===`\\`?i+=1:t===n&&(n=null);continue}if(t===`"`||t===`'`||t==="`")n=t;else if(r.length>0){let e=r.length-1;t===`{`?r[e]+=1:t===`}`&&(r[e]===0?(r.pop(),n="`"):--r[e])}}return n!==null},Bp=U({id:`jwt-insecure-verification`,title:`JWT verified with the 'none' algorithm`,severity:`error`,recommendation:"Never accept the `none` algorithm; it disables signature verification and lets any forged token through. Pin the real algorithm(s) explicitly (`jwt.verify(token, key, { algorithms: ['RS256'] })`).",scan:e=>{if(!G(e.relativePath))return[];let t=gl(e);if(!/\bjwt\b|jsonwebtoken|\bjose\b/i.test(t))return[];let n=[];Rp.lastIndex=0;for(let e=Rp.exec(t);e!==null;e=Rp.exec(t)){if(zp(t,e.index))continue;let r=W(t,e.index);n.push({message:`JWT is configured with the 'none' algorithm, which disables signature verification, so any forged token is accepted.`,line:r.line,column:r.column})}return n}}),Vp=/PRIVATE KEY|SSH_PRIVATE_KEY|GPG_PRIVATE_KEY|DEPLOY_KEY|SIGNING_KEY/i,Hp=U({id:`key-lifecycle-risk`,title:`Long-lived key material in repository`,severity:`error`,committedFilesOnly:!0,recommendation:`Remove private keys from source, rotate exposed credentials, prefer short-lived deploy credentials, and document revocation/expiry for release keys.`,scan:K({shouldScan:e=>!zc.test(e.relativePath)&&!Uc.test(e.relativePath)&&Vp.test(e.content),pattern:/(?<!(?:placeholder|example|sample|dummy|fake)[\s\S]{0,40})-----BEGIN (?:RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----(?:\s|\\r|\\n)*[A-Za-z0-9+/=][A-Za-z0-9+/=\s]{38,}(?![^-]{0,160}\.\.\.)|\b(?:SSH_PRIVATE_KEY|GPG_PRIVATE_KEY|DEPLOY_KEY|SIGNING_KEY)\b\s*[:=]\s*["'][^"'\n]{16,}["']/i,message:`Private or long-lived release key material appears in the repository.`})}),Up=U({id:`local-rpc-native-bridge-risk`,title:`Weak localhost native bridge boundary`,severity:`warn`,recommendation:`Use exact origin allowlists after URL parsing, per-request nonces, narrow methods, and never expose install/update commands to arbitrary web pages.`,scan:K({shouldScan:e=>G(e.relativePath),pattern:/\b(?:127\.0\.0\.1|localhost|Access-Control-Allow-Origin|websocket|WebSocket)\b[\s\S]{0,700}(?:\b(?:UpdateApp|InstallApp|child_process)\b|(?<![.\w$])(?:exec(?:File)?(?:Sync)?|spawn(?:Sync)?)\s*\()/i,message:`Code appears to bridge browser code to localhost/native capabilities with weak origin or update/install checks.`})}),Wp=/\bfrom\s+["']@modelcontextprotocol\/sdk[^"']*["']|\bMcpServer\b|\bMcpAgent\b/,Gp=/@modelcontextprotocol\/sdk|\bMcpServer\b|\bMcpAgent\b/,Kp=/\bserver\.\s*tool\s*\(|\bregisterTool\s*\(|\bsetRequestHandler\s*\(\s*CallToolRequestSchema/,qp=/\b(?:tool|registerTool|setRequestHandler)\b/,Jp=U({id:`mcp-tool-capability-risk`,title:`MCP tool exposes dangerous capability`,severity:`warn`,recommendation:`MCP tool calls run with the connecting client's authority. Validate inputs, enforce per-tool authorization, and avoid raw filesystem/shell/network access where possible.`,scan:K({shouldScan:e=>G(e.relativePath)&&Gp.test(e.content)&&qp.test(e.content)&&qc.test(e.content),pattern:Kp,requireAll:[Wp,qc],ignoreStringLiterals:!0,message:`An MCP tool/resource/prompt handler appears to expose file, shell, network, or code-execution capability.`})}),Yp=U({id:`mdx-ssr-execution-risk`,title:`Server-rendered MDX can execute code`,severity:`warn`,recommendation:`Use a constrained compiler for untrusted content, disable expressions/raw HTML, sandbox renderers, and avoid caching attacker-controlled output across tenants.`,scan:K({shouldScan:e=>G(e.relativePath),pattern:/(?:@mdx-js\/mdx|next-mdx-remote|\b(?:MDXRemote|compileMDX|evaluateMdx)\b)[\s\S]{0,700}\b(?:repo\b|customer|tenant|user[-_]?(?:content|markdown|mdx|input|provided|generated|submitted)|untrusted|searchParams|req\.|request\.|fetch\s*\(|prisma\.|db\.|database|rehypeRaw|allowDangerousHtml)/i,message:`MDX/markdown rendering code may evaluate user or repository content during SSR or static generation.`})}),Xp=U({id:`nosql-injection-risk`,title:`NoSQL query accepts operator-shaped input`,severity:`warn`,recommendation:"Coerce scalar fields before querying, reject operator keys from client input, and avoid `$where` or request-derived regexes.",scan:K({shouldScan:e=>$c(e.relativePath,Lc),pattern:/\$where\s*['"]?\s*:\s*(?:f?['"`][^'"`]{0,200}\$\{|function|f['"])|\.find\s*\(\s*JSON\.parse\s*\(\s*(?:req|request)\.|\.aggregate\s*\(\s*\[?\s*\{[^}]{0,400}\$where|\bnew\s+RegExp\s*\(\s*(?:req|request)\.|\$regex['"]?\s*:\s*(?:req|request)\./i,message:"Code appears to pass raw JSON, regex, or `$where` style input into a NoSQL query."})}),Zp=[...Nl.filter(e=>!e.test(`service_role`)),Pl],Qp=U({id:`package-metadata-secret`,title:`Secret-like package metadata`,severity:`warn`,recommendation:`Keep secrets out of package metadata and generated reports; they are often published to registries, logs, or browser artifacts.`,scan:e=>{if(!e.relativePath.endsWith(`package.json`))return[];let t=su(e.content)??Zp.find(t=>t.test(e.content));if(t===void 0)return[];let n=Mc(e.content,t);return[{message:`Package metadata contains secret-like values or public env secret names.`,line:n.line,column:n.column}]}}),$p=U({id:`path-traversal-risk`,title:`Filesystem path uses caller input`,severity:`warn`,recommendation:`Resolve paths against a fixed base directory, reject traversal after normalization, and map user-visible identifiers to server-owned paths.`,scan:K({shouldScan:e=>G(e.relativePath)&&!ku(e.relativePath),pattern:/\b(?:readFile|readFileSync|writeFile|writeFileSync)\s*\(\s*(?:req\.|request\.|params\.|query\.|body\.|parsed\.|`[^`]*(?<![-./\w$'"`])(?:req\.|request\.|params\.|query\.|body\.))|\bpath\.(?:join|resolve)\s*\([^)]*(?<![-./\w$'"`])(?<!basename\(\s{0,4})(?:req\.|request\.|params\.|query\.|body\.|parsed\.)/,message:`Filesystem access appears to use request, query, params, or body data as part of the path.`})}),em=/\b(?:repoUrl|updateUrl|UpdateApp|InstallApp|auto.?updater?|installer|curl(?!\s+(?:-T\b|--upload-file\b))|wget)\b[\s\S]{0,250}(?:\.(?:zip|exe|dmg|appimage|msi|deb|rpm)\b|\.tar\.gz\b|\|\s*(?:bash|sh)\b)/i,tm=/sha(?:256|512|1)sum|--checksum|checksum=|EXPECTED_SHA|gpg\s+--verify|\.sha(?:256|512)\b/i,nm=/\b(?:child_process|childProcess|execa|os\.system|subprocess\.|Deno\.run|autoUpdater|electron-updater)\b|\b(?:exec(?:File)?(?:Sync)?|spawn(?:Sync)?)\s*\(/,rm=/.\/\.github\/workflows\//i,im=/(?:^|\/)[\w-]+[.@-]\d+\.\d+\.\d+(?:[-.][\w.]+)?\//,am=e=>Zc(e)&&!rm.test(e)&&!im.test(e)&&!Hc.test(e),om=U({id:`plugin-update-trust-risk`,title:`Plugin or updater trust boundary risk`,severity:`warn`,recommendation:`Require signed updates/plugins, pin trusted repositories, verify hashes before execution, and keep custom repository installs behind explicit warnings.`,scan:e=>{if(!G(e.relativePath)&&!am(e.relativePath))return[];let t=gl(e);if(!em.test(t)||tm.test(t)||Fc.test(e.relativePath)&&!nm.test(t))return[];let n=Mc(t,em);return[{message:`Code appears to download, install, update, or execute plugin/updater content across a trust boundary.`,line:n.line,column:n.column}]}}),sm=/origin(?!al)|\.source\s*[!=]==?/i,cm=/\b(?:event|e|evt|msg|message)\.data\b/,lm=/\b(?:const|let|var)\s+[^;=]*=\s*$/,um=/port\d?\b|worker|channel|broadcast|socket|\bws\b|\bsse\b|eventsource|^_?self\.|^source\./i,dm=String.raw`=\s*new\s+(?:EventSource|WebSocket|Worker|SharedWorker|BroadcastChannel|MessageChannel)\b`,fm=(e,t)=>{let n=/^[\w$]+/.exec(e)?.[0];return n===void 0?!1:RegExp(`(?<![\\w$.])${q(n)}\\s*${dm}`).test(t)},pm=/worker/i,mm=(e,t)=>{let n=J(t),r=zu(t);return n<0||r<0?``:e.slice(n,r)},hm=(e,t)=>{if(t.type===`CallExpression`){let n=b(t.callee)?mm(e,t.callee):``;if(!n.endsWith(`addEventListener`))return null;let r=t.arguments[0];return b(r)&&r.type===`Literal`&&r.value===`message`?n:null}if(t.type===`AssignmentExpression`&&b(t.left)){let n=mm(e,t.left);return n.endsWith(`.onmessage`)?n:null}return null},gm=U({id:`postmessage-origin-risk`,title:`postMessage handler without origin check`,severity:`warn`,recommendation:"Validate `event.origin` against an exact allowlist before using `event.data`, especially when an iframe or parent window can be attacker-controlled.",scan:e=>{if(!G(e.relativePath)||pm.test(e.relativePath))return[];let t=e.content.includes(`onmessage`),n=e.content.includes(`addEventListener`)&&(e.content.includes(`message`)||e.content.includes(`\\`));if(!t&&!n)return[];let r=It({filename:e.absolutePath,sourceText:e.content,shouldAttachParentReferences:!1});if(r===null)return[];let i=[];return A(r,t=>{let n=hm(e.content,t);if(n===null||um.test(n)||fm(n,e.content))return;let r=mm(e.content,t),a=r.search(cm);if(a<0)return;let o=r.search(sm);if(o>=0&&(lm.test(r.slice(0,a))||o<a))return;let s=W(e.content,J(t));i.push({message:`A message event handler reads cross-window messages without an obvious origin check.`,line:s.line,column:s.column})}),i}}),_m=/(?:^|\/)(?:locales?|i18n|lang|langs|translations?)\//i,vm=/(?:^|\/)(?:\.env(?:\.[^/]*)?|(?:debug|crash|trace|stack[-_]?trace|report|dump|phpinfo)(?:[-_.][^/]*)?\.(?:txt|log|json|html?)|[^/]+\.log)$/i,ym=e=>Xc(e,Gc.test(e))&&!_m.test(e)&&vm.test(e),bm=U({id:`public-debug-artifact`,title:`Public debug artifact`,severity:`warn`,recommendation:`Remove debug artifacts from public output; logs and dumps often reveal source paths, internal routes, tokens, or environment snapshots.`,scan:e=>{if(!ym(e.relativePath))return[];let t={message:`A browser-reachable debug, log, dump, report, or env artifact is present.`,line:1,column:1};return[Nl.some(t=>t.test(e.content))?{...t,severity:`error`}:t]}}),xm=/(?:^|\/)docs?\//i,Sm=U({id:`public-env-secret-name`,title:`Secret-like public env variable`,severity:`warn`,recommendation:`Public env prefixes are inlined into browser bundles. Rename public values to non-secret names, and keep tokens, passwords, private keys, and service-role credentials server-only.`,scan:e=>{if(!Vf(e.relativePath)||xm.test(e.relativePath))return[];let t=su(e.content);if(t===void 0)return[];let n=Mc(e.content,t);return[{message:`Client code references a public env variable whose name looks like a secret or privileged credential.`,line:n.line,column:n.column}]}}),Cm=`(?:"[^"\\n]{0,200}"|'[^'\\n]{0,200}'|\`[^\`$]{0,200}\`)`,wm=`\\s*\\(?\\s*(?:${Cm}|(?:[\\w\$]+(?:\\.[\\w\$]+)*\\.escape(?:Id|Literal|Identifier)|(?:[\\w\$]+\\.)*(?:connection|conn|client|pool|db|mysql|sqlstring|knex)\\.escape)\\s*\\([^()]{0,200}\\))\\s*\\)?`,Tm=U({id:`raw-sql-injection-risk`,title:`Raw SQL built outside parameter binding`,severity:`warn`,recommendation:`Keep user input in driver parameters or ORM bind variables. Avoid unsafe/raw SQL helpers and string interpolation for queries.`,scan:K({shouldScan:e=>Au(e.relativePath),pattern:[/\$queryRawUnsafe\s*\(/,/\$executeRawUnsafe\s*\(/,/\bPrisma\.raw\s*\((?!\s*(?:["'][^"'\n]*["']\s*[,)]|`[^`$]*`))/,/\bsql\.\s*(?:raw|unsafe)\s*\((?!\s*(?:["'][^"'\n]*["']\s*[,)]|`[^`$]*`))/,/\b(?:client|pool|conn)\.query\s*\(\s*['"`]\s*(?:SELECT|INSERT|UPDATE|DELETE)\b[^)]{0,400}\$\{(?!\s*[\w$.]*(?:sanitiz|escape|quote)[\w$]*\s*\()/i,RegExp(`\\.query\\s*\\(\\s*${Cm}(?:\\s*\\+${wm})*\\s*\\+(?!${wm})`,`i`),/\.(?:where|orderBy|having)Raw\s*\((?!\s*(?:["'][^"'\n]*["']\s*[,)]|`[^`$]*`))/,/\bcursor\.execute\s*\(\s*f['"]/,/\bcursor\.execute\s*\(\s*(?:"[^"]{0,400}"|'[^']{0,400}')\s*(?:%|\.format\s*\(|\+)/,/\b(?:engine|session)\.execute\s*\(\s*(?:text\s*\(\s*)?f['"]/,/\$[\w]+->(?:query|exec|prepare|executeQuery|executeStatement|createQuery|createNativeQuery)\s*\(\s*(?:"[^"]{0,400}"|'[^']{0,400}')\s*\.\s*\$/,/mysqli_query\s*\(\s*[^,]+,\s*(?:"[^"]{0,400}"|'[^']{0,400}')\s*\.\s*\$/],message:`Code uses a raw SQL escape hatch or string-built query shape that can bypass parameter binding.`})}),Em=e=>Pc.test(e)||/(?:^|\/)\.npmrc$/.test(e)||/(?:^|\/)[^/]*(?:credential|credentials|service-account|serviceAccount|firebase-admin|google-service-account|gcp-service-account)[^/]*\.(?:json|env|pem|key)$/i.test(e),Dm=e=>/(?:^|\/)\.env(?:\.[^./]+)*\.(?:example|sample|template|dist|defaults?)$|(?:^|\/)[^/]*(?:example|sample|template)[^/]*\.(?:env|json|pem|key)$/i.test(e),Om=U({id:`repository-secret-file`,title:`Secret file checked into repository`,severity:`error`,committedFilesOnly:!0,recommendation:`Remove committed env files, service-account credentials, npm auth tokens, and webhook URLs; rotate exposed values and keep only redacted examples in source.`,scan:e=>{if(!Em(e.relativePath)||Dm(e.relativePath)||zc.test(e.relativePath))return[];let t=Nl.find(t=>t.test(e.content))??su(e.content);if(t===void 0)return[];let n=Mc(e.content,t);return[{message:`A repository credential/config file contains secret-looking values.`,line:n.line,column:n.column}]}}),km=`(?:req|request|ctx\\.req|ctx\\.request)\\.(?:body|query|params)|await\\s+(?:req|request)\\.json\\(\\s*\\)`,Am=U({id:`request-body-mass-assignment`,title:`Request input spread without field allowlist`,severity:`warn`,recommendation:"Assign explicit, allowlisted fields (or validate with a strict schema and no `.passthrough()`) instead of spreading/merging request input. Otherwise the client can set ownership, role, or price columns (mass assignment) or pollute the prototype.",scan:K({shouldScan:e=>G(e.relativePath),pattern:[RegExp(`\\.\\.\\.\\s*(?:${km})`,`i`),RegExp(`(?:Object\\.assign\\s*\\(|_\\.(?:merge|mergeWith|defaultsDeep)\\s*\\(|(?:^|[^.\\w])(?:merge|defaultsDeep)\\s*\\()[\\s\\S]{0,80}?(?:${km})`,`i`)],message:`Request input is spread or merged into an object without a field allowlist, enabling mass assignment (client-set owner/role/price fields) or prototype pollution.`})}),jm=U({id:`secret-in-fallback`,title:`Hardcoded secret fallback for env var`,severity:`error`,recommendation:"Remove the literal fallback and fail closed (throw when the variable is unset). The hardcoded value is a committed secret, and the `??`/`||` default makes the app run with it in any environment that forgot to set the var.",scan:K({shouldScan:e=>G(e.relativePath),pattern:/\bprocess\.env\.(?!(?:(?:(?:NEXT|EXPO|GATSBY|NUXT|REACT_APP|VITE)_)?PUBLIC_[A-Z0-9_]*(?<!_SECRET)(?<!_PRIVATE_KEY)(?<!_PASSWORD)(?<!_PASSWD)|[A-Z0-9_]*(?:PUBLISHABLE|ANON)_KEY)(?![A-Z0-9_]))[A-Z][A-Z0-9_]*(?:SECRET|TOKEN|PASSWORD|PASSWD|PRIVATE_KEY|API_?KEY|APIKEY|ACCESS_KEY|CLIENT_SECRET|CREDENTIAL|SIGNING_KEY|ENCRYPTION_KEY|WEBHOOK_SECRET|SERVICE_ROLE)[A-Z0-9_]*(?<!_(?:NAME|HEADER|ENDPOINT|URL|URI|ID|PREFIX|SUFFIX|PARAM|PARAMS|FIELD|ISSUER|AUDIENCE|ALGORITHM|ALG|REGION|BUCKET|HOST|HOSTNAME|PORT|PATH|VERSION|SCOPE|TYPE|FORMAT|EXPIRY|TTL))\s*(?:\?\?|\|\|)\s*(["'`])(?![0-9]+["'`])(?![a-z][a-z0-9]*(?:[_-][a-z0-9]+)*[_-](?:token|secret|key|password|passwd|credential)s?["'`])(?![\w-]{0,12}0{8,}["'`])(?!test test test test test test test test test test test junk["'`])(?!(?:changeme|change[_-]?me|placeholder|your[_-]|example|sample|dummy|development|local|todo|replace[_-]?me|https?:\/\/|x{3,}|\*{3,}))[^"'`\n]{8,}\1/i,message:`A secret env var has a hardcoded string fallback: the literal is a committed secret and the app fails open (uses it) when the variable is unset.`})}),Mm=(e,t)=>{if(!S(e,`Program`))return!1;for(let n of e.body){if(!S(n,`ExpressionStatement`)||n.directive===void 0)return!1;if(n.directive===t)return!0}return!1},Nm=(e,t=`source.tsx`)=>{let n=It({filename:t,sourceText:e,shouldAttachParentReferences:!1});return n===null?!1:Mm(n,`use server`)},Pm=K({shouldScan:e=>Vf(e.relativePath),pattern:/\b(?:ownerId|ownerID|creatorId|creatorID|userId|userID|uid|providerId|providerID|orgId|orgID|tenantId|tenantID|teamId|teamID|workspaceId|workspaceID|ghostOrg|role|roles|isAdmin|admin)\b/,requireAll:[/\b(?:supabase\b|\.from\s*\(\s*["'][^"']+["']\s*\))[\s\S]{0,700}\b(?:insert|upsert|update)\s*\(\s*(?:\{|\[?\s*\{)[\s\S]{0,700}\b(?:ownerId|creatorId|userId|orgId|tenantId|role|isAdmin)\b/i],message:`Client Supabase code appears to write user, tenant, owner, or role fields that should be enforced by RLS.`}),Fm=U({id:`supabase-client-owned-authz-field`,title:`Client writes Supabase authorization field`,severity:`error`,recommendation:"Use RLS policies based on `auth.uid()` and server-owned membership rows; do not trust client-provided owner, org, or role columns.",scan:e=>{let t=Pm(e);return t.length===0?t:Nm(e.content,e.relativePath)?[]:t}}),Im=e=>/(?:^|\/)supabase\/(?:migrations|schemas)\//.test(e),Lm=e=>e.endsWith(`.sql`)||Im(e),Rm=/^\$[A-Za-z_]?\w*\$/,zm=new Set([`do`,`plpgsql`,`sql`,`plpython3u`,`plpythonu`,`plperl`,`plperlu`,`plv8`]),Bm=(e,t)=>{let n=t-1;for(;n>=0&&/\s/.test(e[n]??``);)--n;let r=n;for(;r>=0&&/[A-Za-z0-9_]/.test(e[r]??``);)--r;return e.slice(r+1,n+1).toLowerCase()},Vm=(e,t,n,r)=>{let i=n,a=!1;for(;i<r;){let n=e[i];if(n===`;`){a=!1,i+=1;continue}if(/[A-Za-z_]/.test(n)){let t=i;for(;t<r&&/[A-Za-z0-9_]/.test(e[t]??``);)t+=1;e.slice(i,t).toLowerCase()===`execute`&&(a=!0),i=t;continue}if(n===`'`){let n=a;for(n||(t[i]=` `),i+=1;i<r;){if(e[i]===`'`){if(e[i+1]===`'`){n||(t[i]=` `,t[i+1]=` `),i+=2;continue}n||(t[i]=` `),i+=1;break}!n&&e[i]!==`
+`,i.index),o=a<0?e.length:a,s=e.slice(t,o);if(!r.test(s)&&n.test(s))return i.index}return-1},Dp=U({id:`insecure-crypto-risk`,title:`Weak cryptography in security context`,severity:`warn`,recommendation:"Use modern primitives, `crypto.randomBytes` / Web Crypto randomness, and timing-safe comparisons for signatures, digests, tokens, and auth material.",scan:e=>{if(!G(e.relativePath)||Hc.test(e.relativePath)||bp.test(e.relativePath)||!wp.test(e.content))return[];let t=gl(e),n=Tp(t,op,sp,bp);if(n<0&&(n=t.search(lp)),n<0&&(n=t.search(cp)),n<0&&dp.test(t)&&(n=t.search(up)),n<0&&!yp.test(t)&&!vp.test(e.relativePath)&&_p.test(t)){let e=fp.exec(t);e!==null&&!pp.test(e[0])&&!mp.test(e[0])&&!hp.test(e[0])&&!gp.test(e[0])&&(n=e.index)}if(n<0&&(n=Ep(t,Cp,xp,Sp)),n<0)return[];let r=W(t,n);return[{message:`Code uses weak hashes, deprecated ciphers, timing-unsafe comparisons, or Math.random in a security-shaped context.`,line:r.line,column:r.column}]}}),Op=`(?<![A-Za-z0-9])(?:session|sess|sid|connect\\.sid|auth|jwt|access[_-]?token|refresh[_-]?token|id[_-]?token)(?![A-Za-z0-9])`,kp=`[\`"'][^\`"']*?${Op}[^\`"']*[\`"']`,Ap=RegExp(`(?:\\.cookies\\.set|cookies\\(\\s*\\)\\.set|\\.cookie)\\s*\\(\\s*${kp}`,`gi`),jp=/httpOnly\s*:\s*false\b/i,Mp=/"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'|`(?:[^`\\]|\\.)*`/g,Np=e=>{let t=e.split(``),n=0,r=null;for(;n<e.length;){let i=e[n];if(r!==null){if(i===`\\`){n+=2;continue}i===r?r=null:i!==`
+`&&(t[n]=` `),n+=1;continue}(i===`"`||i===`'`||i==="`")&&(r=i),n+=1}return t.join(``)},Pp=/cookie\s*:\s*\{/gi,Fp=RegExp(`document\\.cookie\\s*=\\s*[\`"'][^\`"'=;]*?${Op}[^\`"'=;]*=`,`gi`),Ip=e=>{if(e.trim().length===0)return 0;let t=0,n=null,r=1;for(let i=0;i<e.length;i+=1){let a=e[i];if(n!==null){a===`\\`?i+=1:a===n&&(n=null);continue}a===`"`||a===`'`||a==="`"?n=a:a===`(`||a===`[`||a===`{`?t+=1:a===`)`||a===`]`||a===`}`?--t:a===`,`&&t===0&&(r+=1)}return r},Lp=(e,t,n,r,i)=>{t.lastIndex=0;for(let a=t.exec(e);a!==null;a=t.exec(e)){if(!r(a.index,a[0]))continue;let t=W(e,a.index);i.push({message:n,line:t.line,column:t.column})}},Rp=U({id:`insecure-session-cookie`,title:`Auth cookie missing HttpOnly protection`,severity:`warn`,recommendation:"Set auth/session cookies server-side with `httpOnly: true`, `secure: true`, and `sameSite`. Cookies set via `document.cookie` or with `httpOnly: false` are readable by any XSS payload and can be stolen.",scan:e=>{if(!G(e.relativePath))return[];let t=gl(e);if(!/cookie/i.test(t))return[];let n=[],r=`An auth/session cookie is exposed to JavaScript (set via document.cookie, with httpOnly: false, or without cookie options), letting an XSS payload steal it.`;Ap.lastIndex=0;for(let e=Ap.exec(t);e!==null;e=Ap.exec(t)){let i=e.index+e[0].lastIndexOf(`(`),a=Ru(t,i);if(a<0)continue;let o=t.slice(i+1,a),s=Ip(o)<3,c=o.replace(Mp,``);if(!s&&!jp.test(c))continue;let l=W(t,e.index);n.push({message:r,line:l.line,column:l.column})}let i=Np(t);Pp.lastIndex=0;for(let e=Pp.exec(i);e!==null;e=Pp.exec(i)){let t=e.index+e[0].length-1,a=Ru(i,t),o=a>=0?i.slice(t,a):i.slice(t,t+400);if(!jp.test(o))continue;let s=W(i,e.index);n.push({message:r,line:s.line,column:s.column})}return Lp(t,Fp,r,()=>!0,n),n}}),zp=/\b(?:alg|algorithms?)\s*:\s*\[?\s*["'`]none["'`]/gi,Bp=(e,t)=>{let n=null,r=[];for(let i=0;i<t;i+=1){let t=e[i];if(n==="`"){t===`\\`?i+=1:t==="`"?n=null:t===`$`&&e[i+1]===`{`&&(r.push(0),n=null,i+=1);continue}if(n!==null){t===`\\`?i+=1:t===n&&(n=null);continue}if(t===`"`||t===`'`||t==="`")n=t;else if(r.length>0){let e=r.length-1;t===`{`?r[e]+=1:t===`}`&&(r[e]===0?(r.pop(),n="`"):--r[e])}}return n!==null},Vp=U({id:`jwt-insecure-verification`,title:`JWT verified with the 'none' algorithm`,severity:`error`,recommendation:"Never accept the `none` algorithm; it disables signature verification and lets any forged token through. Pin the real algorithm(s) explicitly (`jwt.verify(token, key, { algorithms: ['RS256'] })`).",scan:e=>{if(!G(e.relativePath))return[];let t=gl(e);if(!/\bjwt\b|jsonwebtoken|\bjose\b/i.test(t))return[];let n=[];zp.lastIndex=0;for(let e=zp.exec(t);e!==null;e=zp.exec(t)){if(Bp(t,e.index))continue;let r=W(t,e.index);n.push({message:`JWT is configured with the 'none' algorithm, which disables signature verification, so any forged token is accepted.`,line:r.line,column:r.column})}return n}}),Hp=/PRIVATE KEY|SSH_PRIVATE_KEY|GPG_PRIVATE_KEY|DEPLOY_KEY|SIGNING_KEY/i,Up=U({id:`key-lifecycle-risk`,title:`Long-lived key material in repository`,severity:`error`,committedFilesOnly:!0,recommendation:`Remove private keys from source, rotate exposed credentials, prefer short-lived deploy credentials, and document revocation/expiry for release keys.`,scan:K({shouldScan:e=>!zc.test(e.relativePath)&&!Uc.test(e.relativePath)&&Hp.test(e.content),pattern:/(?<!(?:placeholder|example|sample|dummy|fake)[\s\S]{0,40})-----BEGIN (?:RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----(?:\s|\\r|\\n)*[A-Za-z0-9+/=][A-Za-z0-9+/=\s]{38,}(?![^-]{0,160}\.\.\.)|\b(?:SSH_PRIVATE_KEY|GPG_PRIVATE_KEY|DEPLOY_KEY|SIGNING_KEY)\b\s*[:=]\s*["'][^"'\n]{16,}["']/i,message:`Private or long-lived release key material appears in the repository.`})}),Wp=U({id:`local-rpc-native-bridge-risk`,title:`Weak localhost native bridge boundary`,severity:`warn`,recommendation:`Use exact origin allowlists after URL parsing, per-request nonces, narrow methods, and never expose install/update commands to arbitrary web pages.`,scan:K({shouldScan:e=>G(e.relativePath),pattern:/\b(?:127\.0\.0\.1|localhost|Access-Control-Allow-Origin|websocket|WebSocket)\b[\s\S]{0,700}(?:\b(?:UpdateApp|InstallApp|child_process)\b|(?<![.\w$])(?:exec(?:File)?(?:Sync)?|spawn(?:Sync)?)\s*\()/i,message:`Code appears to bridge browser code to localhost/native capabilities with weak origin or update/install checks.`})}),Gp=/\bfrom\s+["']@modelcontextprotocol\/sdk[^"']*["']|\bMcpServer\b|\bMcpAgent\b/,Kp=/@modelcontextprotocol\/sdk|\bMcpServer\b|\bMcpAgent\b/,qp=/\bserver\.\s*tool\s*\(|\bregisterTool\s*\(|\bsetRequestHandler\s*\(\s*CallToolRequestSchema/,Jp=/\b(?:tool|registerTool|setRequestHandler)\b/,Yp=U({id:`mcp-tool-capability-risk`,title:`MCP tool exposes dangerous capability`,severity:`warn`,recommendation:`MCP tool calls run with the connecting client's authority. Validate inputs, enforce per-tool authorization, and avoid raw filesystem/shell/network access where possible.`,scan:K({shouldScan:e=>G(e.relativePath)&&Kp.test(e.content)&&Jp.test(e.content)&&qc.test(e.content),pattern:qp,requireAll:[Gp,qc],ignoreStringLiterals:!0,message:`An MCP tool/resource/prompt handler appears to expose file, shell, network, or code-execution capability.`})}),Xp=U({id:`mdx-ssr-execution-risk`,title:`Server-rendered MDX can execute code`,severity:`warn`,recommendation:`Use a constrained compiler for untrusted content, disable expressions/raw HTML, sandbox renderers, and avoid caching attacker-controlled output across tenants.`,scan:K({shouldScan:e=>G(e.relativePath),pattern:/(?:@mdx-js\/mdx|next-mdx-remote|\b(?:MDXRemote|compileMDX|evaluateMdx)\b)[\s\S]{0,700}\b(?:repo\b|customer|tenant|user[-_]?(?:content|markdown|mdx|input|provided|generated|submitted)|untrusted|searchParams|req\.|request\.|fetch\s*\(|prisma\.|db\.|database|rehypeRaw|allowDangerousHtml)/i,message:`MDX/markdown rendering code may evaluate user or repository content during SSR or static generation.`})}),Zp=U({id:`nosql-injection-risk`,title:`NoSQL query accepts operator-shaped input`,severity:`warn`,recommendation:"Coerce scalar fields before querying, reject operator keys from client input, and avoid `$where` or request-derived regexes.",scan:K({shouldScan:e=>$c(e.relativePath,Lc),pattern:/\$where\s*['"]?\s*:\s*(?:f?['"`][^'"`]{0,200}\$\{|function|f['"])|\.find\s*\(\s*JSON\.parse\s*\(\s*(?:req|request)\.|\.aggregate\s*\(\s*\[?\s*\{[^}]{0,400}\$where|\bnew\s+RegExp\s*\(\s*(?:req|request)\.|\$regex['"]?\s*:\s*(?:req|request)\./i,message:"Code appears to pass raw JSON, regex, or `$where` style input into a NoSQL query."})}),Qp=[...Nl.filter(e=>!e.test(`service_role`)),Pl],$p=U({id:`package-metadata-secret`,title:`Secret-like package metadata`,severity:`warn`,recommendation:`Keep secrets out of package metadata and generated reports; they are often published to registries, logs, or browser artifacts.`,scan:e=>{if(!e.relativePath.endsWith(`package.json`))return[];let t=su(e.content)??Qp.find(t=>t.test(e.content));if(t===void 0)return[];let n=Mc(e.content,t);return[{message:`Package metadata contains secret-like values or public env secret names.`,line:n.line,column:n.column}]}}),em=U({id:`path-traversal-risk`,title:`Filesystem path uses caller input`,severity:`warn`,recommendation:`Resolve paths against a fixed base directory, reject traversal after normalization, and map user-visible identifiers to server-owned paths.`,scan:K({shouldScan:e=>G(e.relativePath)&&!ku(e.relativePath),pattern:/\b(?:readFile|readFileSync|writeFile|writeFileSync)\s*\(\s*(?:req\.|request\.|params\.|query\.|body\.|parsed\.|`[^`]*(?<![-./\w$'"`])(?:req\.|request\.|params\.|query\.|body\.))|\bpath\.(?:join|resolve)\s*\([^)]*(?<![-./\w$'"`])(?<!basename\(\s{0,4})(?:req\.|request\.|params\.|query\.|body\.|parsed\.)/,message:`Filesystem access appears to use request, query, params, or body data as part of the path.`})}),tm=/\b(?:repoUrl|updateUrl|UpdateApp|InstallApp|auto.?updater?|installer|curl(?!\s+(?:-T\b|--upload-file\b))|wget)\b[\s\S]{0,250}(?:\.(?:zip|exe|dmg|appimage|msi|deb|rpm)\b|\.tar\.gz\b|\|\s*(?:bash|sh)\b)/i,nm=/sha(?:256|512|1)sum|--checksum|checksum=|EXPECTED_SHA|gpg\s+--verify|\.sha(?:256|512)\b/i,rm=/\b(?:child_process|childProcess|execa|os\.system|subprocess\.|Deno\.run|autoUpdater|electron-updater)\b|\b(?:exec(?:File)?(?:Sync)?|spawn(?:Sync)?)\s*\(/,im=/.\/\.github\/workflows\//i,am=/(?:^|\/)[\w-]+[.@-]\d+\.\d+\.\d+(?:[-.][\w.]+)?\//,om=e=>Zc(e)&&!im.test(e)&&!am.test(e)&&!Hc.test(e),sm=U({id:`plugin-update-trust-risk`,title:`Plugin or updater trust boundary risk`,severity:`warn`,recommendation:`Require signed updates/plugins, pin trusted repositories, verify hashes before execution, and keep custom repository installs behind explicit warnings.`,scan:e=>{if(!G(e.relativePath)&&!om(e.relativePath))return[];let t=gl(e);if(!tm.test(t)||nm.test(t)||Fc.test(e.relativePath)&&!rm.test(t))return[];let n=Mc(t,tm);return[{message:`Code appears to download, install, update, or execute plugin/updater content across a trust boundary.`,line:n.line,column:n.column}]}}),cm=/origin(?!al)|\.source\s*[!=]==?/i,lm=/\b(?:event|e|evt|msg|message)\.data\b/,um=/\b(?:const|let|var)\s+[^;=]*=\s*$/,dm=/port\d?\b|worker|channel|broadcast|socket|\bws\b|\bsse\b|eventsource|^_?self\.|^source\./i,fm=String.raw`=\s*new\s+(?:EventSource|WebSocket|Worker|SharedWorker|BroadcastChannel|MessageChannel)\b`,pm=(e,t)=>{let n=/^[\w$]+/.exec(e)?.[0];return n===void 0?!1:RegExp(`(?<![\\w$.])${q(n)}\\s*${fm}`).test(t)},mm=/worker/i,hm=(e,t)=>{let n=J(t),r=zu(t);return n<0||r<0?``:e.slice(n,r)},gm=(e,t)=>{if(t.type===`CallExpression`){let n=b(t.callee)?hm(e,t.callee):``;if(!n.endsWith(`addEventListener`))return null;let r=t.arguments[0];return b(r)&&r.type===`Literal`&&r.value===`message`?n:null}if(t.type===`AssignmentExpression`&&b(t.left)){let n=hm(e,t.left);return n.endsWith(`.onmessage`)?n:null}return null},_m=U({id:`postmessage-origin-risk`,title:`postMessage handler without origin check`,severity:`warn`,recommendation:"Validate `event.origin` against an exact allowlist before using `event.data`, especially when an iframe or parent window can be attacker-controlled.",scan:e=>{if(!G(e.relativePath)||mm.test(e.relativePath))return[];let t=e.content.includes(`onmessage`),n=e.content.includes(`addEventListener`)&&(e.content.includes(`message`)||e.content.includes(`\\`));if(!t&&!n)return[];let r=It({filename:e.absolutePath,sourceText:e.content,shouldAttachParentReferences:!1});if(r===null)return[];let i=[];return A(r,t=>{let n=gm(e.content,t);if(n===null||dm.test(n)||pm(n,e.content))return;let r=hm(e.content,t),a=r.search(lm);if(a<0)return;let o=r.search(cm);if(o>=0&&(um.test(r.slice(0,a))||o<a))return;let s=W(e.content,J(t));i.push({message:`A message event handler reads cross-window messages without an obvious origin check.`,line:s.line,column:s.column})}),i}}),vm=/(?:^|\/)(?:locales?|i18n|lang|langs|translations?)\//i,ym=/(?:^|\/)(?:\.env(?:\.[^/]*)?|(?:debug|crash|trace|stack[-_]?trace|report|dump|phpinfo)(?:[-_.][^/]*)?\.(?:txt|log|json|html?)|[^/]+\.log)$/i,bm=e=>Xc(e,Gc.test(e))&&!vm.test(e)&&ym.test(e),xm=U({id:`public-debug-artifact`,title:`Public debug artifact`,severity:`warn`,recommendation:`Remove debug artifacts from public output; logs and dumps often reveal source paths, internal routes, tokens, or environment snapshots.`,scan:e=>{if(!bm(e.relativePath))return[];let t={message:`A browser-reachable debug, log, dump, report, or env artifact is present.`,line:1,column:1};return[Nl.some(t=>t.test(e.content))?{...t,severity:`error`}:t]}}),Sm=/(?:^|\/)docs?\//i,Cm=U({id:`public-env-secret-name`,title:`Secret-like public env variable`,severity:`warn`,recommendation:`Public env prefixes are inlined into browser bundles. Rename public values to non-secret names, and keep tokens, passwords, private keys, and service-role credentials server-only.`,scan:e=>{if(!Hf(e.relativePath)||Sm.test(e.relativePath))return[];let t=su(e.content);if(t===void 0)return[];let n=Mc(e.content,t);return[{message:`Client code references a public env variable whose name looks like a secret or privileged credential.`,line:n.line,column:n.column}]}}),wm=`(?:"[^"\\n]{0,200}"|'[^'\\n]{0,200}'|\`[^\`$]{0,200}\`)`,Tm=`\\s*\\(?\\s*(?:${wm}|(?:[\\w\$]+(?:\\.[\\w\$]+)*\\.escape(?:Id|Literal|Identifier)|(?:[\\w\$]+\\.)*(?:connection|conn|client|pool|db|mysql|sqlstring|knex)\\.escape)\\s*\\([^()]{0,200}\\))\\s*\\)?`,Em=U({id:`raw-sql-injection-risk`,title:`Raw SQL built outside parameter binding`,severity:`warn`,recommendation:`Keep user input in driver parameters or ORM bind variables. Avoid unsafe/raw SQL helpers and string interpolation for queries.`,scan:K({shouldScan:e=>Au(e.relativePath),pattern:[/\$queryRawUnsafe\s*\(/,/\$executeRawUnsafe\s*\(/,/\bPrisma\.raw\s*\((?!\s*(?:["'][^"'\n]*["']\s*[,)]|`[^`$]*`))/,/\bsql\.\s*(?:raw|unsafe)\s*\((?!\s*(?:["'][^"'\n]*["']\s*[,)]|`[^`$]*`))/,/\b(?:client|pool|conn)\.query\s*\(\s*['"`]\s*(?:SELECT|INSERT|UPDATE|DELETE)\b[^)]{0,400}\$\{(?!\s*[\w$.]*(?:sanitiz|escape|quote)[\w$]*\s*\()/i,RegExp(`\\.query\\s*\\(\\s*${wm}(?:\\s*\\+${Tm})*\\s*\\+(?!${Tm})`,`i`),/\.(?:where|orderBy|having)Raw\s*\((?!\s*(?:["'][^"'\n]*["']\s*[,)]|`[^`$]*`))/,/\bcursor\.execute\s*\(\s*f['"]/,/\bcursor\.execute\s*\(\s*(?:"[^"]{0,400}"|'[^']{0,400}')\s*(?:%|\.format\s*\(|\+)/,/\b(?:engine|session)\.execute\s*\(\s*(?:text\s*\(\s*)?f['"]/,/\$[\w]+->(?:query|exec|prepare|executeQuery|executeStatement|createQuery|createNativeQuery)\s*\(\s*(?:"[^"]{0,400}"|'[^']{0,400}')\s*\.\s*\$/,/mysqli_query\s*\(\s*[^,]+,\s*(?:"[^"]{0,400}"|'[^']{0,400}')\s*\.\s*\$/],message:`Code uses a raw SQL escape hatch or string-built query shape that can bypass parameter binding.`})}),Dm=e=>Pc.test(e)||/(?:^|\/)\.npmrc$/.test(e)||/(?:^|\/)[^/]*(?:credential|credentials|service-account|serviceAccount|firebase-admin|google-service-account|gcp-service-account)[^/]*\.(?:json|env|pem|key)$/i.test(e),Om=e=>/(?:^|\/)\.env(?:\.[^./]+)*\.(?:example|sample|template|dist|defaults?)$|(?:^|\/)[^/]*(?:example|sample|template)[^/]*\.(?:env|json|pem|key)$/i.test(e),km=U({id:`repository-secret-file`,title:`Secret file checked into repository`,severity:`error`,committedFilesOnly:!0,recommendation:`Remove committed env files, service-account credentials, npm auth tokens, and webhook URLs; rotate exposed values and keep only redacted examples in source.`,scan:e=>{if(!Dm(e.relativePath)||Om(e.relativePath)||zc.test(e.relativePath))return[];let t=Nl.find(t=>t.test(e.content))??su(e.content);if(t===void 0)return[];let n=Mc(e.content,t);return[{message:`A repository credential/config file contains secret-looking values.`,line:n.line,column:n.column}]}}),Am=`(?:req|request|ctx\\.req|ctx\\.request)\\.(?:body|query|params)|await\\s+(?:req|request)\\.json\\(\\s*\\)`,jm=U({id:`request-body-mass-assignment`,title:`Request input spread without field allowlist`,severity:`warn`,recommendation:"Assign explicit, allowlisted fields (or validate with a strict schema and no `.passthrough()`) instead of spreading/merging request input. Otherwise the client can set ownership, role, or price columns (mass assignment) or pollute the prototype.",scan:K({shouldScan:e=>G(e.relativePath),pattern:[RegExp(`\\.\\.\\.\\s*(?:${Am})`,`i`),RegExp(`(?:Object\\.assign\\s*\\(|_\\.(?:merge|mergeWith|defaultsDeep)\\s*\\(|(?:^|[^.\\w])(?:merge|defaultsDeep)\\s*\\()[\\s\\S]{0,80}?(?:${Am})`,`i`)],message:`Request input is spread or merged into an object without a field allowlist, enabling mass assignment (client-set owner/role/price fields) or prototype pollution.`})}),Mm=U({id:`secret-in-fallback`,title:`Hardcoded secret fallback for env var`,severity:`error`,recommendation:"Remove the literal fallback and fail closed (throw when the variable is unset). The hardcoded value is a committed secret, and the `??`/`||` default makes the app run with it in any environment that forgot to set the var.",scan:K({shouldScan:e=>G(e.relativePath),pattern:/\bprocess\.env\.(?!(?:(?:(?:NEXT|EXPO|GATSBY|NUXT|REACT_APP|VITE)_)?PUBLIC_[A-Z0-9_]*(?<!_SECRET)(?<!_PRIVATE_KEY)(?<!_PASSWORD)(?<!_PASSWD)|[A-Z0-9_]*(?:PUBLISHABLE|ANON)_KEY)(?![A-Z0-9_]))[A-Z][A-Z0-9_]*(?:SECRET|TOKEN|PASSWORD|PASSWD|PRIVATE_KEY|API_?KEY|APIKEY|ACCESS_KEY|CLIENT_SECRET|CREDENTIAL|SIGNING_KEY|ENCRYPTION_KEY|WEBHOOK_SECRET|SERVICE_ROLE)[A-Z0-9_]*(?<!_(?:NAME|HEADER|ENDPOINT|URL|URI|ID|PREFIX|SUFFIX|PARAM|PARAMS|FIELD|ISSUER|AUDIENCE|ALGORITHM|ALG|REGION|BUCKET|HOST|HOSTNAME|PORT|PATH|VERSION|SCOPE|TYPE|FORMAT|EXPIRY|TTL))\s*(?:\?\?|\|\|)\s*(["'`])(?![0-9]+["'`])(?![a-z][a-z0-9]*(?:[_-][a-z0-9]+)*[_-](?:token|secret|key|password|passwd|credential)s?["'`])(?![\w-]{0,12}0{8,}["'`])(?!test test test test test test test test test test test junk["'`])(?!(?:changeme|change[_-]?me|placeholder|your[_-]|example|sample|dummy|development|local|todo|replace[_-]?me|https?:\/\/|x{3,}|\*{3,}))[^"'`\n]{8,}\1/i,message:`A secret env var has a hardcoded string fallback: the literal is a committed secret and the app fails open (uses it) when the variable is unset.`})}),Nm=(e,t)=>{if(!S(e,`Program`))return!1;for(let n of e.body){if(!S(n,`ExpressionStatement`)||n.directive===void 0)return!1;if(n.directive===t)return!0}return!1},Pm=(e,t=`source.tsx`)=>{let n=It({filename:t,sourceText:e,shouldAttachParentReferences:!1});return n===null?!1:Nm(n,`use server`)},Fm=K({shouldScan:e=>Hf(e.relativePath),pattern:/\b(?:ownerId|ownerID|creatorId|creatorID|userId|userID|uid|providerId|providerID|orgId|orgID|tenantId|tenantID|teamId|teamID|workspaceId|workspaceID|ghostOrg|role|roles|isAdmin|admin)\b/,requireAll:[/\b(?:supabase\b|\.from\s*\(\s*["'][^"']+["']\s*\))[\s\S]{0,700}\b(?:insert|upsert|update)\s*\(\s*(?:\{|\[?\s*\{)[\s\S]{0,700}\b(?:ownerId|creatorId|userId|orgId|tenantId|role|isAdmin)\b/i],message:`Client Supabase code appears to write user, tenant, owner, or role fields that should be enforced by RLS.`}),Im=U({id:`supabase-client-owned-authz-field`,title:`Client writes Supabase authorization field`,severity:`error`,recommendation:"Use RLS policies based on `auth.uid()` and server-owned membership rows; do not trust client-provided owner, org, or role columns.",scan:e=>{let t=Fm(e);return t.length===0?t:Pm(e.content,e.relativePath)?[]:t}}),Lm=e=>/(?:^|\/)supabase\/(?:migrations|schemas)\//.test(e),Rm=e=>e.endsWith(`.sql`)||Lm(e),zm=/^\$[A-Za-z_]?\w*\$/,Bm=new Set([`do`,`plpgsql`,`sql`,`plpython3u`,`plpythonu`,`plperl`,`plperlu`,`plv8`]),Vm=(e,t)=>{let n=t-1;for(;n>=0&&/\s/.test(e[n]??``);)--n;let r=n;for(;r>=0&&/[A-Za-z0-9_]/.test(e[r]??``);)--r;return e.slice(r+1,n+1).toLowerCase()},Hm=(e,t,n,r)=>{let i=n,a=!1;for(;i<r;){let n=e[i];if(n===`;`){a=!1,i+=1;continue}if(/[A-Za-z_]/.test(n)){let t=i;for(;t<r&&/[A-Za-z0-9_]/.test(e[t]??``);)t+=1;e.slice(i,t).toLowerCase()===`execute`&&(a=!0),i=t;continue}if(n===`'`){let n=a;for(n||(t[i]=` `),i+=1;i<r;){if(e[i]===`'`){if(e[i+1]===`'`){n||(t[i]=` `,t[i+1]=` `),i+=2;continue}n||(t[i]=` `),i+=1;break}!n&&e[i]!==`
 `&&(t[i]=` `),i+=1}continue}if(n===`"`){for(i+=1;i<r;){if(e[i]===`"`){if(e[i+1]===`"`){i+=2;continue}i+=1;break}i+=1}continue}if(n===`-`&&e[i+1]===`-`){for(;i<r&&e[i]!==`
 `;)t[i]=` `,i+=1;continue}if(n===`/`&&e[i+1]===`*`){for(;i<r;){if(e[i]===`*`&&e[i+1]===`/`){t[i]=` `,t[i+1]=` `,i+=2;break}e[i]!==`
-`&&(t[i]=` `),i+=1}continue}i+=1}},Hm=e=>{let t=e.split(``),n=0;for(;n<e.length;){let r=e[n];if(r===`-`&&e[n+1]===`-`){for(;n<e.length&&e[n]!==`
+`&&(t[i]=` `),i+=1}continue}i+=1}},Um=e=>{let t=e.split(``),n=0;for(;n<e.length;){let r=e[n];if(r===`-`&&e[n+1]===`-`){for(;n<e.length&&e[n]!==`
 `;)t[n]=` `,n+=1;continue}if(r===`/`&&e[n+1]===`*`){for(;n<e.length;){if(e[n]===`*`&&e[n+1]===`/`){t[n]=` `,t[n+1]=` `,n+=2;break}e[n]!==`
 `&&(t[n]=` `),n+=1}continue}if(r===`'`){for(t[n]=` `,n+=1;n<e.length;){if(e[n]===`'`){if(e[n+1]===`'`){t[n]=` `,t[n+1]=` `,n+=2;continue}t[n]=` `,n+=1;break}e[n]!==`
-`&&(t[n]=` `),n+=1}continue}if(r===`$`){let r=Rm.exec(e.slice(n));if(r!==null){let i=r[0],a=e.indexOf(i,n+i.length),o=a<0?e.length:a+i.length,s=Bm(e,n);if(zm.has(s))Vm(e,t,n+i.length,o);else for(let r=n;r<o;r+=1)e[r]!==`
-`&&(t[r]=` `);n=o;continue}}if(r===`"`){for(n+=1;n<e.length;){if(e[n]===`"`){if(e[n+1]===`"`){n+=2;continue}n+=1;break}n+=1}continue}n+=1}return t.join(``)},Um=/disable\s+row\s+level\s+security/i,Wm=/auth\.role\(\)\s*=\s*["']service_role["']/i,Gm=/create\s+policy/gi,Km=/;|create\s+policy/i,qm=/\b(?:using|with\s+check)\s*\(\s*true\s*\)/i,Jm=/\bfor\s+select\b/i,Ym=/\bto\s+([\s\S]+?)(?=\s+(?:using|with\s+check|as|for)\b|;|$)/i,Xm=new Set([`service_role`,`postgres`,`supabase_admin`]),Zm=e=>{let t=Ym.exec(e);if(t===null)return!1;let n=t[1].split(`,`).map(e=>e.trim().replace(/["'`]/g,``).toLowerCase()).filter(Boolean);return n.length>0&&n.every(e=>Xm.has(e))},Qm=(e,t)=>Wm.test(t)?!0:!qm.test(e)||Jm.test(e)?!1:!Zm(e),$m=U({id:`supabase-rls-policy-risk`,title:`Permissive Supabase RLS policy`,severity:`error`,recommendation:"Keep public-read policies explicit, but gate inserts, updates, deletes, and service-role bypasses behind `auth.uid()` plus trusted tenant membership.",scan:e=>{if(!Lm(e.relativePath))return[];let t=Hm(e.content),n=t.search(Um);Gm.lastIndex=0;for(let r=Gm.exec(t);r!==null;r=Gm.exec(t)){let i=r.index+r[0].length,a=t.slice(i).search(Km),o=a<0?t.length:i+a;if(Qm(t.slice(r.index,o),e.content.slice(r.index,o))){(n<0||r.index<n)&&(n=r.index);break}}if(n<0)return[];let{line:r,column:i}=W(t,n);return[{message:`Supabase policy SQL disables RLS, permits writes broadly, or references a service-role bypass.`,line:r,column:i}]}}),eh=/create\s+(?:unlogged\s+)?table\s+(?:if\s+not\s+exists\s+)?(?!["`]?(?:auth|storage|realtime|vault|extensions|graphql|graphql_public|pgbouncer|net|supabase_functions|supabase_migrations|cron|pgsodium|pgmq|information_schema|pg_catalog|pg_temp|private|internal)["`]?\s*\.)(?:["`]?public["`]?\s*\.\s*)?["`]?([A-Za-z_][\w$]*)["`]?(?:\s*\(|\s+as\b)/gi,th=/alter\s+table\s+(?:if\s+exists\s+)?(?:only\s+)?(?:["`]?public["`]?\s*\.\s*)?["`]?([A-Za-z_][\w$]*)["`]?\s+(?:force\s+)?enable\s+row\s+level\s+security/gi,nh=/\benable\s+row\s+level\s+security\b/gi,rh=e=>{let t=new Map,n=0;for(let r of e.matchAll(th)){let e=r[1];e!==void 0&&(n+=1,t.set(e.toLowerCase(),r.index))}return{lastEnableIndexByTable:t,staticEnableCount:n}},ih=(e,t)=>(e.match(nh)?.length??0)>t,ah=U({id:`supabase-table-missing-rls`,title:`Supabase table created without Row Level Security`,severity:`error`,recommendation:"Enable RLS in the same migration (`alter table <name> enable row level security;`) and add `auth.uid()`-scoped policies for select/insert/update/delete. A public table without RLS is fully readable and writable with the public anon key.",scan:e=>{if(!Im(e.relativePath))return[];let t=Hm(e.content);if(!/create\s+(?:unlogged\s+)?table/i.test(t))return[];let n=[],{lastEnableIndexByTable:r,staticEnableCount:i}=rh(t);if(ih(t,i))return[];eh.lastIndex=0;for(let e=eh.exec(t);e!==null;e=eh.exec(t)){let i=e[1];if(i===void 0)continue;let a=r.get(i.toLowerCase());if(a!==void 0&&a>=e.index)continue;let o=W(t,e.index);n.push({message:`Supabase migration creates a public table but never enables Row Level Security, leaving every row exposed to the anon key.`,line:o.line,column:o.column})}return n}}),oh=U({id:`svg-filter-clickjacking-risk`,title:`SVG-filtered iframe clickjacking primitive`,severity:`warn`,recommendation:"Avoid filtering cross-origin iframes. Use `frame-ancestors` on sensitive pages and keep SVG filters away from embedded privileged UI.",scan:K({shouldScan:e=>G(e.relativePath),pattern:/<iframe\b(?:=>|[^>]){0,300}\bfilter\s*:\s*["']?url\(#|filter\s*:\s*url\(#[\s\S]{0,700}<iframe\b|<fe(?:DisplacementMap|ColorMatrix|Composite|Tile|Morphology)\b[\s\S]{0,700}<iframe\b/i,message:`An iframe is rendered through an SVG/CSS filter, which can support advanced clickjacking or visual exfiltration tricks.`})}),sh=e=>G(e)?Rc.test(e)?!0:/(?:^|\/)(?:middleware|route)\.[cm]?[jt]sx?$/.test(e):!1,ch=U({id:`tenant-static-proxy-risk`,title:`Tenant-controlled static asset proxy`,severity:`warn`,recommendation:`Bind tenant identity to the trusted host or authenticated org, canonicalize after decoding, reject traversal, and never let one tenant choose another tenant's asset prefix.`,scan:K({shouldScan:e=>sh(e.relativePath),pattern:/\b(?:fetch|path\.join|getObject\w*|GetObjectCommand|getSignedUrl|createReadStream)\s*\([^;]{0,200}(?:\$\{[^}]{0,100}\b(?:tenant|subdomain|workspace|hostPattern|(?<!\.)organization(?:Id|Slug)?)\b|\b(?:tenant|subdomain|workspace)(?:Id|Slug|Name)?\b\s*[,)+\].])/i,message:`Route code appears to compose tenant or subdomain input into a static/CDN/object-store fetch path.`})}),lh=[/dangerouslySetInnerHTML\s*=\s*\{\{\s*__html\s*:[\s\S]{0,300}?\bJSON\.stringify\s*\(/gi,/<script\b[^>]*>(?:(?!<\/script>)[\s\S]){0,300}?\bJSON\.stringify\s*\(/gi],uh=/\$\{|["'`]\s*\+\s*$/,dh=/^\s*\{(?!\{)/,fh=/"(?:[^"\\\n]|\\.)*"|'(?:[^'\\\n]|\\.)*'/g,ph=/\b(?:true|false|null)\b|[\d.]+(?:e[+-]?\d+)?/gi,mh=e=>{if(e.includes("`")||e.includes("${"))return!1;let t=e.replace(fh,``).replace(ph,``);return!/[A-Za-z_$]/.test(t)},hh=/^[\s)]*\.replace\s*\([^)]*(?:\\u003[cC]|&lt;|<)/,gh=/(?:\b(?:escapeHtml|escapeJSON|escapeJson|htmlEscape|jsesc)|(?<![.\w])(?:serialize|serializeJavascript|devalue|uneval|superjson))\s*\(\s*$/i,_h=/\bJSON\.stringify\s*\($/i,vh=U({id:`unsafe-json-in-html`,title:`Unescaped JSON in HTML or script sink`,severity:`warn`,recommendation:'JSON.stringify does not HTML-escape, so a `<\/script>` (or `<`) in the data breaks out and becomes XSS. Use an HTML-safe serializer (serialize-javascript, devalue) or escape `<`, `>`, and `&`, or pass data via a JSON `<script type="application/json">` read with JSON.parse.',scan:e=>{if(!G(e.relativePath))return[];let t=gl(e);if(!t.includes(`JSON.stringify`))return[];let n=[],r=new Set;for(let[e,i]of lh.entries()){i.lastIndex=0;for(let a=i.exec(t);a!==null;a=i.exec(t)){let i=a[0].replace(_h,``);if(gh.test(i))continue;if(e===1){let e=t.indexOf(`>`,a.index),n=a[0].search(/\bJSON\.stringify\s*\($/i);if(e>=0&&n>=0){let r=t.slice(e+1,a.index+n);if(!uh.test(r)||dh.test(r))continue}}let o=a.index+a[0].length-1,s=Ru(t,o);if(s>=0){let e=t.slice(s+1,s+1+160);if(hh.test(e)||mh(t.slice(o+1,s)))continue}if(r.has(a.index))continue;r.add(a.index);let c=W(t,a.index);n.push({message:"JSON.stringify is embedded in HTML/script markup without HTML-escaping; data containing `<\/script>` or `<` breaks out and becomes XSS.",line:c.line,column:c.column})}}return n}}),yh=/(?:(?<![.\w$])fetch|\baxios\.\s*(?:get|post|put|delete|head)|\bgot|\bgot\.\s*(?:get|post))\s*\(\s*([^,)]+)/,bh=/\b(?:url|targetUrl|callbackUrl|redirectUrl|webhookUrl|companyUrl|websiteUrl|domainUrl|imageUrl|fetchUrl|next|return_to|returnTo|destination|location)\b/i,xh=/\breq\.|\brequest\.(?:query|body|params|nextUrl)|\bsearchParams\b|\bparams\.|\bbody\.|\bquery\./,Sh=/\bredirect\s*:\s*["'](?:manual|error)["']/,Ch=/\b(params|body|query)\./g,wh=(e,t)=>RegExp(`(?:const|let|var)\\s+${e}\\s*(?::[^=;\\n]{0,80})?=\\s*new\\s+URLSearchParams\\b`).test(t),Th=(e,t)=>{let n=e.replace(Ch,(e,n)=>wh(n,t)?``:e);return xh.test(n)},Eh=(e,t)=>{if(Th(e,t))return!0;let n=/^[\w$]+$/.exec(e.trim());if(n===null)return!1;let r=RegExp(`(?:const|let|var)[^=;\\n]{0,80}\\b${n[0]}\\b[^=;\\n]{0,80}=([^;\\n]*)`,`g`);for(let e of t.matchAll(r)){let n=e[1]??``;if(/\breq\.|\brequest\.|\bsearchParams\b|\$_(?:GET|POST|REQUEST)/.test(n)||Th(n,t))return!0}return!1},Dh=U({id:`untrusted-redirect-following`,title:`Server fetch follows redirects for caller-shaped URL`,severity:`warn`,recommendation:'Use `redirect: "manual"` or equivalent and re-validate every redirect target before following it to avoid SSRF redirect bypasses.',scan:e=>{if(!sh(e.relativePath)||!yh.test(e.content))return[];let t=[],n=e.content.split(`
-`);for(let r=0;r<n.length;r+=1){let i=n[r]??``,a=i.match(yh),o=a?.[1]??``;if(!a||!bh.test(o)||!Eh(o,e.content))continue;let s=n.slice(r,r+5).join(`
-`);Sh.test(s)||t.push({message:`Server-side fetch code appears to follow redirects for a URL shaped like caller-controlled input.`,line:r+1,column:i.search(/\S/)+1})}return t}}),Oh=U({id:`url-prefilled-privileged-action`,title:`URL pre-fills a privileged action`,severity:`warn`,recommendation:`Require server-side validation and explicit confirmation for URL-sourced invite, role, permission, redirect, or sharing parameters.`,scan:K({shouldScan:e=>Vf(e.relativePath),pattern:/(?<!(?:safe|valid|sanitiz|relativ|allowlist|whitelist|parse|normaliz)[\w$]*\(\s*(?:new\s+)?(?:[\w$]+\s*\.\s*){0,4})\b(?:searchParams|useSearchParams\s*\(\s*\)|URLSearchParams\s*\([^)]{0,120}\))(?:[?!])?\.get(?:All)?\s*\(\s*["'](?:userstoinvite|role|permission|sharingaction|invite|admin|next|continue|returnTo|redirect_uri|callbackUrl)["']|\bsearchParams\.(?:userstoinvite|role|permission|sharingaction|invite|admin|returnTo|redirect_uri|callbackUrl)\b/i,message:`Client code reads sensitive action state from the URL, which can pre-fill invites, roles, redirects, or sharing flows with attacker values.`})}),kh=/(?:^|\/)[^/]*webhook[^/]*\/|(?:^|\/)[^/]*webhook[^/]*\.[cm]?[jt]s$|\bwebhook\b/i,Ah=/\b(?:export\s+(?:async\s+)?function\s+POST|export\s+const\s+(?:POST|handler|webhook)|webhookHandler|webhookRoute)\b/i,jh=RegExp(`verifySignature|verify.*signature|verify\\w*(?:Webhook|Auth)|constructEvent|createHmac|timingSafeEqual|svix|webhookSecret|stripe\\.webhooks|["'][\\w-]*signature["']|\\b[A-Za-z]{0,40}(?:verif|valid|check|assert|authenticat|compare|guard)[A-Za-z]{0,40}(?:secret|signature|hmac|webhook|digest)[A-Za-z]{0,40}\\s*\\(`,`i`),Mh=/webhook[\s_-]?ur[il]\w*/gi,Nh=/process\.env\.\w*WEBHOOK_URL|\b(?:send|post|dispatch|publish|notify)\w*Webhook/,Ph=/\b(?:req|request)\b/,Fh=/\/\/[^\n]*|\/\*[\s\S]*?\*\/|"(?:\\.|[^"\\\n])*"|'(?:\\.|[^'\\\n])*'|`(?:\\.|[^`\\])*`/g,Ih=U({id:`webhook-signature-risk`,title:`Webhook handler lacks signature verification`,severity:`warn`,recommendation:`Verify provider signatures before parsing or acting on webhook bodies. Use provider SDK helpers or HMAC verification with timing-safe comparison.`,scan:K({shouldScan:e=>{if(!G(e.relativePath)||Nh.test(e.content))return!1;let t=e.content.replace(Fh,``).replace(Mh,``);return kh.test(e.relativePath)||kh.test(t)},pattern:Ah,requireAll:[Ph],suppressWhen:jh,message:`Webhook handler code does not show an obvious signature verification step.`})}),Lh=/\.[cm]?[jt]sx?$/i,Rh=/\.d\.[cm]?[jt]s$/i,zh=/\.mdx$/i,Bh=/\.html?$/i,Vh=new Set([`.angular`,`.astro`,`.cache`,`.contentlayer`,`.docusaurus`,`.expo`,`.git`,`.next`,`.nuxt`,`.output`,`.svelte-kit`,`.turbo`,`.vercel`,`build`,`coverage`,`dist`,`node_modules`,`out`,`storybook-static`]),Hh=new WeakMap,Uh=e=>{let t=Hh.get(e);if(t)return t;let n=Ne(e);return Hh.set(e,n),n},Wh=e=>{let t=[],n=[],a=[e],o=!1;for(;a.length>0;){let e=a.pop();if(!e)continue;let s;try{s=r.readdirSync(e,{withFileTypes:!0})}catch{return null}for(let r of s){let s=i.join(e,r.name),c=Vh.has(r.name)||r.name.startsWith(`.`)&&r.name!==`.dumi`&&r.name!==`.storybook`;if(!(r.isSymbolicLink()&&c)){if(r.isSymbolicLink())return null;if(r.isDirectory()){if(c)continue;a.push(s);continue}if(!(!r.isFile()||wc(s))){if(zh.test(r.name)){o=!0;continue}if(Bh.test(r.name)){n.push(Li(s));continue}Lh.test(r.name)&&(Rh.test(r.name)||t.push(Li(s)))}}}}return{sourceFilePaths:t,htmlFilePaths:n,hasOpaqueMdxConsumerSurface:o}},Gh=(e,t)=>{for(let n of e){let e;try{e=r.readFileSync(n,`utf8`)}catch{return!0}for(let n of t)if(e.includes(`"${n}"`)||e.includes(`'${n}'`))return!0}return!1},Kh=e=>{if(S(e,`ImportDeclaration`))return oc(e)?null:typeof e.source.value==`string`?e.source.value:null;if(S(e,`ExportNamedDeclaration`))return e.exportKind===`type`||ac(e.specifiers,`ExportSpecifier`,`exportKind`)?null:e.source&&typeof e.source.value==`string`?e.source.value:null;if(S(e,`ExportAllDeclaration`))return e.exportKind===`type`?null:typeof e.source.value==`string`?e.source.value:null;if(S(e,`ImportExpression`))return S(e.source,`Literal`)&&typeof e.source.value==`string`?e.source.value:null;if(S(e,`CallExpression`)&&S(e.callee,`Identifier`)&&e.callee.name===`require`&&e.arguments.length===1){let t=e.arguments[0];return t&&S(t,`Literal`)&&typeof t.value==`string`?t.value:null}return null},qh=(e,t,n,r)=>{A(e.programNode,i=>{let a=Kh(i);if(!a)return;let o=Cn(e.filePath,a);if(!o){r.add(a);return}let s=Li(o);n.set(i,s);let c=t.get(s)??new Set;c.add(e),t.set(s,c)})},Jh=({rootDirectory:e,currentFilePath:t,currentProgramNode:n,currentScopes:r,requiredModuleSources:i=[],knownModuleSources:a})=>{if(i.length>0&&a!==void 0&&!i.some(e=>a.includes(e)))return null;let o=Wh(e);if(!o||i.length>0&&a===void 0&&!Gh(o.sourceFilePaths,i))return null;let s=new Map;for(let e of o.sourceFilePaths){if(e===t){s.set(e,{filePath:e,programNode:n,scopes:r});continue}let i=Rt(e);if(!i||!S(i,`Program`))return null;s.set(e,{filePath:e,programNode:i,scopes:Uh(i)})}let c=new Map,l=new WeakMap,u=new Set;for(let e of s.values())qh(e,c,l,u);return{modulesByFilePath:s,htmlFilePaths:o.htmlFilePaths,consumerModulesByFilePath:c,resolvedSourcePathByNode:l,unresolvedRuntimeSources:u,hasOpaqueMdxConsumerSurface:o.hasOpaqueMdxConsumerSurface}},Yh=e=>{if(!e)return null;let t=O(e);return!S(t,`Literal`)||typeof t.value!=`boolean`?null:t.value},Xh=(e,t,n={})=>{let r=n.maximumConstAliases===void 0?4:n.maximumConstAliases,i=n.shouldFoldStaticConditions??!1,a=n.shouldKeepKnownValues??!1,o=[],s=[{expression:e,remainingConstAliases:r,resolvingSymbols:new Set}];for(;s.length>0;){let e=s.pop();if(!e)continue;let n=O(e.expression);if(S(n,`Literal`)){if(typeof n.value!=`string`){if(a)continue;return null}o.push(n.value);continue}if(S(n,`TemplateLiteral`)){let e=Sa(n);if(e===null){if(a)continue;return null}o.push(e);continue}if(S(n,`ConditionalExpression`)){let t=i?Yh(n.test):null;if(t!==null){s.push({expression:t?n.consequent:n.alternate,remainingConstAliases:e.remainingConstAliases,resolvingSymbols:e.resolvingSymbols});continue}s.push({expression:n.alternate,remainingConstAliases:e.remainingConstAliases,resolvingSymbols:new Set(e.resolvingSymbols)}),s.push({expression:n.consequent,remainingConstAliases:e.remainingConstAliases,resolvingSymbols:new Set(e.resolvingSymbols)});continue}if(a&&S(n,`LogicalExpression`)&&(n.operator===`??`||n.operator===`||`)){s.push({expression:n.right,remainingConstAliases:e.remainingConstAliases,resolvingSymbols:new Set(e.resolvingSymbols)}),s.push({expression:n.left,remainingConstAliases:e.remainingConstAliases,resolvingSymbols:new Set(e.resolvingSymbols)});continue}if(S(n,`Identifier`)){let r=t.referenceFor(n)?.resolvedSymbol;if(!r||r.kind!==`const`||!r.initializer||!S(r.declarationNode,`VariableDeclarator`)||r.declarationNode.id!==r.bindingIdentifier||e.remainingConstAliases===0||e.resolvingSymbols.has(r)){if(a)continue;return null}e.resolvingSymbols.add(r),s.push({expression:r.initializer,remainingConstAliases:e.remainingConstAliases===null?null:e.remainingConstAliases-1,resolvingSymbols:e.resolvingSymbols});continue}if(!a)return null}return o.length>0?o:null},Zh=(e,t,n={})=>Xh(e,t,n),Qh=(e,t)=>Xh(e,t,{shouldKeepKnownValues:!0}),$h=(e,t,n,r,i=!1)=>{let a=e.value;return a?S(a,`Literal`)?typeof a.value==`string`?[a.value]:null:S(a,`JSXExpressionContainer`)?Zh(a.expression,t,{maximumConstAliases:n,shouldFoldStaticConditions:r,shouldKeepKnownValues:i}):null:null},eg=(e,t)=>$h(e,t,4,!1),tg=(e,t)=>$h(e,t,null,!0),ng=(e,t)=>$h(e,t,4,!1,!0),rg=(e,t)=>{let n=i.relative(t,e);return n===``||!n.startsWith(`..${i.sep}`)&&n!==`..`&&!i.isAbsolute(n)},ig={attribute:null,expression:null,isPresent:!1,isUnknown:!1},ag={attribute:null,expression:null,isPresent:!1,isUnknown:!0},og=(e,t,n)=>{for(let r=e.properties.length-1;r>=0;--r){let i=e.properties[r];if(!i)return ag;if(S(i,`SpreadElement`)){if(!S(i.argument,`ObjectExpression`))return ag;let e=og(i.argument,t,n);if(e.isPresent||e.isUnknown)return e;continue}if(!S(i,`Property`))return ag;let a=N(i,{allowComputedString:!0});if(!a)return ag;if((n?a:a.toLowerCase())===t)return{attribute:null,expression:i.value,isPresent:!0,isUnknown:!1}}return ig},sg=(e,t,n=!0)=>{let r=n?t:t.toLowerCase();for(let t=e.length-1;t>=0;--t){let i=e[t];if(!i)return ag;if(S(i,`JSXSpreadAttribute`)){if(!S(i.argument,`ObjectExpression`))return ag;let e=og(i.argument,r,n);if(e.isPresent||e.isUnknown)return e;continue}if(!S(i,`JSXAttribute`))continue;let a=ko(i.name);if((n?a:a?.toLowerCase())===r)return{attribute:i,expression:null,isPresent:!0,isUnknown:!1}}return ig},cg=/(?<attributeName>[^\s"'<>/=]+)(?:\s*=\s*(?:"(?<doubleQuoted>[^"]*)"|'(?<singleQuoted>[^']*)'|(?<unquoted>[^\s"'=<>`]+)))?/g,lg=/<!--[\s\S]*?-->|(?<skippedContentOpeningTag><(?<skippedContentTag>script|style|textarea|title|xmp|iframe|noembed|noframes|plaintext|template)\b(?:"[^"]*"|'[^']*'|[^'"<>])*?>)[\s\S]*?(?:<\/\k<skippedContentTag>\s*>|$)|(?<openingTag><[A-Za-z][\w:-]*(?:"[^"]*"|'[^']*'|[^'"<>])*>)/gi,ug=new Map,dg=(e,t,n)=>{if(!e.isPresent)return;let r=e.attribute?ng(e.attribute,t):e.expression?Qh(e.expression,t):null;for(let e of r??[]){let t=e?.trim();t&&n.add(t)}},fg=(e,t,n)=>{for(let r of e.properties){if(S(r,`SpreadElement`)){S(r.argument,`ObjectExpression`)&&fg(r.argument,t,n);continue}if(S(r,`Property`)&&N(r,{allowComputedString:!0})?.toLowerCase()===`id`)for(let e of Qh(r.value,t)??[]){let t=e.trim();t&&n.add(t)}}},pg=e=>{let t=e.parent;for(S(t,`JSXElement`)&&t.openingElement===e&&(t=t.parent);t;){if(S(t,`JSXElement`)&&Ko(t.openingElement)===`template`)return!0;t=t.parent}return!1},mg=(e,t,n)=>{A(e,e=>{if(!S(e,`JSXOpeningElement`)||pg(e))return;let r=sg(e.attributes,`id`,!1);if(r.isUnknown){for(let r of e.attributes)dg(sg([r],`id`,!1),t,n),S(r,`JSXSpreadAttribute`)&&S(r.argument,`ObjectExpression`)&&fg(r.argument,t,n);return}dg(r,t,n)})},hg=(e,t)=>{for(let n of e.matchAll(lg)){let e=n.groups?.skippedContentOpeningTag??n.groups?.openingTag;if(e)for(let n of e.matchAll(cg)){if(n.groups?.attributeName?.toLowerCase()!==`id`)continue;let e=n.groups?.doubleQuoted??n.groups?.singleQuoted??n.groups?.unquoted??``;e.trim()&&t.add(e.trim())}}},gg=e=>{if(!i.isAbsolute(e.currentFilePath))return null;let t=e.configuredRootDirectory?Li(e.configuredRootDirectory):null;return!t||!rg(e.currentFilePath,t)?null:t},_g=()=>{ug.clear()},vg=e=>{let t=new Set;mg(e.currentProgramNode,e.currentScopes,t);let n=gg(e);if(!n)return t;if(ug.has(n)){let e=ug.get(n);return e?new Set([...e,...t]):null}let i=Jh({rootDirectory:n,currentFilePath:Li(e.currentFilePath),currentProgramNode:e.currentProgramNode,currentScopes:e.currentScopes});if(!i)return ug.set(n,null),null;let a=new Set;for(let e of i.modulesByFilePath.values())mg(e.programNode,e.scopes,a);try{for(let e of i.htmlFilePaths)hg(r.readFileSync(e,`utf8`),a)}catch{return ug.set(n,null),null}return ug.set(n,a),new Set([...a,...t])},yg=()=>{Tn(),ht(),sn(),_g(),Sn()},bg=e=>Nc.test(e)||Pc.test(e),xg=e=>{let t=Gc.test(e);return Em(e)||Lm(e)||il(e)||Zc(e)?{bucket:`priority`,isGeneratedBundleByName:t}:Xc(e,t)?{bucket:`artifact`,isGeneratedBundleByName:t}:bg(e)?{bucket:`other`,isGeneratedBundleByName:t}:null},Sg=(e,t)=>t||bg(e)||Zc(e)||Em(e),Cg=[`nextjs`,`astro`,`vite`,`cra`,`remix`,`gatsby`,`expo`,`react-native`,`tanstack-start`,`preact`,`unknown`];export{Bu as $,b as $i,vi as $n,Kn as $r,$o as $t,$p as A,tt as Ai,la as An,Kr as Ar,eu as At,ip as B,Ve as Bi,Ui as Bn,Mr as Br,rl as Bt,Am as C,o as Ca,lt as Ci,R as Cn,ni as Cr,Xl as Ct,bm as D,et as Di,ga as Dn,ii as Dr,$l as Dt,Sm as E,st as Ei,ha as En,ti as Er,au as Et,Up as F,Ze as Fi,Zi as Fn,Jr as Fr,Kl as Ft,Bf as G,We as Gi,Li as Gn,Ir as Gr,mc as Gt,Gf as H,Qe as Hi,F as Hn,Pr as Hr,Dc as Ht,Hp as I,Ue as Ii,qi as In,Vr as Ir,Vl as It,sd as J,Ne as Ji,Mi as Jn,Sr as Jr,ic as Jt,vd as K,Ge as Ki,Ai as Kn,Fr as Kr,ac as Kt,Bp as L,Be as Li,Xi as Ln,Hr as Lr,Wl as Lt,Xp as M,Ke as Mi,ea as Mn,Rr as Mr,ql as Mt,Yp as N,Je as Ni,$i as Nn,zr as Nr,nu as Nt,gm as O,nt as Oi,L as On,Br as Or,Yl as Ot,Jp as P,Ye as Pi,Qi as Pn,Wr as Pr,Gl as Pt,Vu as Q,x as Qi,ui as Qn,qn as Qr,Fs as Qt,Lp as R,ze as Ri,Ji as Rn,Ur as Rr,xl as Rt,jm as S,s as Sa,D as Si,wa as Sn,ri as Sr,iu as St,Tm as T,at as Ti,_a as Tn,mi as Tr,Ul as Tt,Wf as U,Ie as Ui,Vi as Un,Nr as Ur,wc as Ut,Zf as V,Fe as Vi,I as Vn,Ar as Vr,U as Vt,Uf as W,Le as Wi,Bi as Wn,Lr as Wr,Tc as Wt,Ku as X,fe as Xi,N as Xn,M as Xr,nc as Xt,Gu as Y,Pe as Yi,P as Yn,cr as Yr,tc as Yt,Wu as Z,S as Zi,_i as Zn,Jn as Zr,rc as Zt,oh as _,u as _a,Tt as _i,so as _n,Ti as _r,Bl as _t,vg as a,v as aa,Dn as ai,Ho as an,Ci as ar,vu as at,Fm as b,c as ba,_t as bi,lo as bn,di as br,ru as bt,tg as c,ae as ca,Cn as ci,Oo as cn,yi as cr,Sl as ct,Jh as d,ce as da,Mt as di,uo as dn,si as dr,Dl as dt,de as ea,j as ei,Yo as en,hi as er,J as et,Ih as f,g as fa,jt as fi,B as fn,li as fr,wl as ft,ch as g,d as ga,Ot as gi,oo as gn,fi as gr,Al as gt,vh as h,ee as ha,O as hi,co as hn,Qr as hr,kl as ht,yg as i,oe as ia,kn as ii,Uo as in,Si as ir,Du as it,Qp as j,He as ji,ta as jn,Gr as jr,tu as jt,om as k,$e as ki,ua as kn,qr as kr,Jl as kt,eg as l,ne as la,on as li,To as ln,ei as lr,El as lt,Dh as m,p as ma,kt as mi,io as mn,Yr as mr,Cl as mt,xg as n,le as na,An as ni,qo as nn,ci as nr,Iu as nt,sg as o,se as oa,On as oi,Mo as on,bi as or,_u as ot,Oh as p,m as pa,At as pi,fo as pn,oi as pr,Ol as pt,_d as q,Xe as qi,Fi as qn,kr as qr,oc as qt,Sg as r,ie as ra,A as ri,Ko as rn,wi as rr,Ou as rt,rg as s,te as sa,k as si,ko as sn,xi as sr,Tl as st,Cg as t,ue as ta,Wn as ti,Jo as tn,pi as tr,Lu as tt,Yh as u,re as ua,Rt as ui,po as un,gi as ur,jl as ut,ah as v,f as va,Et as vi,ro as vn,Zr as vr,Ql as vt,Om as w,it as wi,Sa as wn,$r as wr,Ml as wt,Mm as x,l as xa,vt as xi,Ia as xn,Xr as xr,Hl as xt,$m as y,h as ya,gt as yi,ao as yn,ai as yr,Zl as yt,Ep as z,qe as zi,Yi as zn,jr as zr,bl as zt};
-//# sourceMappingURL=capability-DSccjvGM.js.map
+`&&(t[n]=` `),n+=1}continue}if(r===`$`){let r=zm.exec(e.slice(n));if(r!==null){let i=r[0],a=e.indexOf(i,n+i.length),o=a<0?e.length:a+i.length,s=Vm(e,n);if(Bm.has(s))Hm(e,t,n+i.length,o);else for(let r=n;r<o;r+=1)e[r]!==`
+`&&(t[r]=` `);n=o;continue}}if(r===`"`){for(n+=1;n<e.length;){if(e[n]===`"`){if(e[n+1]===`"`){n+=2;continue}n+=1;break}n+=1}continue}n+=1}return t.join(``)},Wm=/disable\s+row\s+level\s+security/i,Gm=/auth\.role\(\)\s*=\s*["']service_role["']/i,Km=/create\s+policy/gi,qm=/;|create\s+policy/i,Jm=/\b(?:using|with\s+check)\s*\(\s*true\s*\)/i,Ym=/\bfor\s+select\b/i,Xm=/\bto\s+([\s\S]+?)(?=\s+(?:using|with\s+check|as|for)\b|;|$)/i,Zm=new Set([`service_role`,`postgres`,`supabase_admin`]),Qm=e=>{let t=Xm.exec(e);if(t===null)return!1;let n=t[1].split(`,`).map(e=>e.trim().replace(/["'`]/g,``).toLowerCase()).filter(Boolean);return n.length>0&&n.every(e=>Zm.has(e))},$m=(e,t)=>Gm.test(t)?!0:!Jm.test(e)||Ym.test(e)?!1:!Qm(e),eh=U({id:`supabase-rls-policy-risk`,title:`Permissive Supabase RLS policy`,severity:`error`,recommendation:"Keep public-read policies explicit, but gate inserts, updates, deletes, and service-role bypasses behind `auth.uid()` plus trusted tenant membership.",scan:e=>{if(!Rm(e.relativePath))return[];let t=Um(e.content),n=t.search(Wm);Km.lastIndex=0;for(let r=Km.exec(t);r!==null;r=Km.exec(t)){let i=r.index+r[0].length,a=t.slice(i).search(qm),o=a<0?t.length:i+a;if($m(t.slice(r.index,o),e.content.slice(r.index,o))){(n<0||r.index<n)&&(n=r.index);break}}if(n<0)return[];let{line:r,column:i}=W(t,n);return[{message:`Supabase policy SQL disables RLS, permits writes broadly, or references a service-role bypass.`,line:r,column:i}]}}),th=/create\s+(?:unlogged\s+)?table\s+(?:if\s+not\s+exists\s+)?(?!["`]?(?:auth|storage|realtime|vault|extensions|graphql|graphql_public|pgbouncer|net|supabase_functions|supabase_migrations|cron|pgsodium|pgmq|information_schema|pg_catalog|pg_temp|private|internal)["`]?\s*\.)(?:["`]?public["`]?\s*\.\s*)?["`]?([A-Za-z_][\w$]*)["`]?(?:\s*\(|\s+as\b)/gi,nh=/alter\s+table\s+(?:if\s+exists\s+)?(?:only\s+)?(?:["`]?public["`]?\s*\.\s*)?["`]?([A-Za-z_][\w$]*)["`]?\s+(?:force\s+)?enable\s+row\s+level\s+security/gi,rh=/\benable\s+row\s+level\s+security\b/gi,ih=e=>{let t=new Map,n=0;for(let r of e.matchAll(nh)){let e=r[1];e!==void 0&&(n+=1,t.set(e.toLowerCase(),r.index))}return{lastEnableIndexByTable:t,staticEnableCount:n}},ah=(e,t)=>(e.match(rh)?.length??0)>t,oh=U({id:`supabase-table-missing-rls`,title:`Supabase table created without Row Level Security`,severity:`error`,recommendation:"Enable RLS in the same migration (`alter table <name> enable row level security;`) and add `auth.uid()`-scoped policies for select/insert/update/delete. A public table without RLS is fully readable and writable with the public anon key.",scan:e=>{if(!Lm(e.relativePath))return[];let t=Um(e.content);if(!/create\s+(?:unlogged\s+)?table/i.test(t))return[];let n=[],{lastEnableIndexByTable:r,staticEnableCount:i}=ih(t);if(ah(t,i))return[];th.lastIndex=0;for(let e=th.exec(t);e!==null;e=th.exec(t)){let i=e[1];if(i===void 0)continue;let a=r.get(i.toLowerCase());if(a!==void 0&&a>=e.index)continue;let o=W(t,e.index);n.push({message:`Supabase migration creates a public table but never enables Row Level Security, leaving every row exposed to the anon key.`,line:o.line,column:o.column})}return n}}),sh=U({id:`svg-filter-clickjacking-risk`,title:`SVG-filtered iframe clickjacking primitive`,severity:`warn`,recommendation:"Avoid filtering cross-origin iframes. Use `frame-ancestors` on sensitive pages and keep SVG filters away from embedded privileged UI.",scan:K({shouldScan:e=>G(e.relativePath),pattern:/<iframe\b(?:=>|[^>]){0,300}\bfilter\s*:\s*["']?url\(#|filter\s*:\s*url\(#[\s\S]{0,700}<iframe\b|<fe(?:DisplacementMap|ColorMatrix|Composite|Tile|Morphology)\b[\s\S]{0,700}<iframe\b/i,message:`An iframe is rendered through an SVG/CSS filter, which can support advanced clickjacking or visual exfiltration tricks.`})}),ch=e=>G(e)?Rc.test(e)?!0:/(?:^|\/)(?:middleware|route)\.[cm]?[jt]sx?$/.test(e):!1,lh=U({id:`tenant-static-proxy-risk`,title:`Tenant-controlled static asset proxy`,severity:`warn`,recommendation:`Bind tenant identity to the trusted host or authenticated org, canonicalize after decoding, reject traversal, and never let one tenant choose another tenant's asset prefix.`,scan:K({shouldScan:e=>ch(e.relativePath),pattern:/\b(?:fetch|path\.join|getObject\w*|GetObjectCommand|getSignedUrl|createReadStream)\s*\([^;]{0,200}(?:\$\{[^}]{0,100}\b(?:tenant|subdomain|workspace|hostPattern|(?<!\.)organization(?:Id|Slug)?)\b|\b(?:tenant|subdomain|workspace)(?:Id|Slug|Name)?\b\s*[,)+\].])/i,message:`Route code appears to compose tenant or subdomain input into a static/CDN/object-store fetch path.`})}),uh=[/dangerouslySetInnerHTML\s*=\s*\{\{\s*__html\s*:[\s\S]{0,300}?\bJSON\.stringify\s*\(/gi,/<script\b[^>]*>(?:(?!<\/script>)[\s\S]){0,300}?\bJSON\.stringify\s*\(/gi],dh=/\$\{|["'`]\s*\+\s*$/,fh=/^\s*\{(?!\{)/,ph=/"(?:[^"\\\n]|\\.)*"|'(?:[^'\\\n]|\\.)*'/g,mh=/\b(?:true|false|null)\b|[\d.]+(?:e[+-]?\d+)?/gi,hh=e=>{if(e.includes("`")||e.includes("${"))return!1;let t=e.replace(ph,``).replace(mh,``);return!/[A-Za-z_$]/.test(t)},gh=/^[\s)]*\.replace\s*\([^)]*(?:\\u003[cC]|&lt;|<)/,_h=/(?:\b(?:escapeHtml|escapeJSON|escapeJson|htmlEscape|jsesc)|(?<![.\w])(?:serialize|serializeJavascript|devalue|uneval|superjson))\s*\(\s*$/i,vh=/\bJSON\.stringify\s*\($/i,yh=U({id:`unsafe-json-in-html`,title:`Unescaped JSON in HTML or script sink`,severity:`warn`,recommendation:'JSON.stringify does not HTML-escape, so a `<\/script>` (or `<`) in the data breaks out and becomes XSS. Use an HTML-safe serializer (serialize-javascript, devalue) or escape `<`, `>`, and `&`, or pass data via a JSON `<script type="application/json">` read with JSON.parse.',scan:e=>{if(!G(e.relativePath))return[];let t=gl(e);if(!t.includes(`JSON.stringify`))return[];let n=[],r=new Set;for(let[e,i]of uh.entries()){i.lastIndex=0;for(let a=i.exec(t);a!==null;a=i.exec(t)){let i=a[0].replace(vh,``);if(_h.test(i))continue;if(e===1){let e=t.indexOf(`>`,a.index),n=a[0].search(/\bJSON\.stringify\s*\($/i);if(e>=0&&n>=0){let r=t.slice(e+1,a.index+n);if(!dh.test(r)||fh.test(r))continue}}let o=a.index+a[0].length-1,s=Ru(t,o);if(s>=0){let e=t.slice(s+1,s+1+160);if(gh.test(e)||hh(t.slice(o+1,s)))continue}if(r.has(a.index))continue;r.add(a.index);let c=W(t,a.index);n.push({message:"JSON.stringify is embedded in HTML/script markup without HTML-escaping; data containing `<\/script>` or `<` breaks out and becomes XSS.",line:c.line,column:c.column})}}return n}}),bh=/(?:(?<![.\w$])fetch|\baxios\.\s*(?:get|post|put|delete|head)|\bgot|\bgot\.\s*(?:get|post))\s*\(\s*([^,)]+)/,xh=/\b(?:url|targetUrl|callbackUrl|redirectUrl|webhookUrl|companyUrl|websiteUrl|domainUrl|imageUrl|fetchUrl|next|return_to|returnTo|destination|location)\b/i,Sh=/\breq\.|\brequest\.(?:query|body|params|nextUrl)|\bsearchParams\b|\bparams\.|\bbody\.|\bquery\./,Ch=/\bredirect\s*:\s*["'](?:manual|error)["']/,wh=/\b(params|body|query)\./g,Th=(e,t)=>RegExp(`(?:const|let|var)\\s+${e}\\s*(?::[^=;\\n]{0,80})?=\\s*new\\s+URLSearchParams\\b`).test(t),Eh=(e,t)=>{let n=e.replace(wh,(e,n)=>Th(n,t)?``:e);return Sh.test(n)},Dh=(e,t)=>{if(Eh(e,t))return!0;let n=/^[\w$]+$/.exec(e.trim());if(n===null)return!1;let r=RegExp(`(?:const|let|var)[^=;\\n]{0,80}\\b${n[0]}\\b[^=;\\n]{0,80}=([^;\\n]*)`,`g`);for(let e of t.matchAll(r)){let n=e[1]??``;if(/\breq\.|\brequest\.|\bsearchParams\b|\$_(?:GET|POST|REQUEST)/.test(n)||Eh(n,t))return!0}return!1},Oh=U({id:`untrusted-redirect-following`,title:`Server fetch follows redirects for caller-shaped URL`,severity:`warn`,recommendation:'Use `redirect: "manual"` or equivalent and re-validate every redirect target before following it to avoid SSRF redirect bypasses.',scan:e=>{if(!ch(e.relativePath)||!bh.test(e.content))return[];let t=[],n=e.content.split(`
+`);for(let r=0;r<n.length;r+=1){let i=n[r]??``,a=i.match(bh),o=a?.[1]??``;if(!a||!xh.test(o)||!Dh(o,e.content))continue;let s=n.slice(r,r+5).join(`
+`);Ch.test(s)||t.push({message:`Server-side fetch code appears to follow redirects for a URL shaped like caller-controlled input.`,line:r+1,column:i.search(/\S/)+1})}return t}}),kh=U({id:`url-prefilled-privileged-action`,title:`URL pre-fills a privileged action`,severity:`warn`,recommendation:`Require server-side validation and explicit confirmation for URL-sourced invite, role, permission, redirect, or sharing parameters.`,scan:K({shouldScan:e=>Hf(e.relativePath),pattern:/(?<!(?:safe|valid|sanitiz|relativ|allowlist|whitelist|parse|normaliz)[\w$]*\(\s*(?:new\s+)?(?:[\w$]+\s*\.\s*){0,4})\b(?:searchParams|useSearchParams\s*\(\s*\)|URLSearchParams\s*\([^)]{0,120}\))(?:[?!])?\.get(?:All)?\s*\(\s*["'](?:userstoinvite|role|permission|sharingaction|invite|admin|next|continue|returnTo|redirect_uri|callbackUrl)["']|\bsearchParams\.(?:userstoinvite|role|permission|sharingaction|invite|admin|returnTo|redirect_uri|callbackUrl)\b/i,message:`Client code reads sensitive action state from the URL, which can pre-fill invites, roles, redirects, or sharing flows with attacker values.`})}),Ah=/(?:^|\/)[^/]*webhook[^/]*\/|(?:^|\/)[^/]*webhook[^/]*\.[cm]?[jt]s$|\bwebhook\b/i,jh=/\b(?:export\s+(?:async\s+)?function\s+POST|export\s+const\s+(?:POST|handler|webhook)|webhookHandler|webhookRoute)\b/i,Mh=RegExp(`verifySignature|verify.*signature|verify\\w*(?:Webhook|Auth)|constructEvent|createHmac|timingSafeEqual|svix|webhookSecret|stripe\\.webhooks|["'][\\w-]*signature["']|\\b[A-Za-z]{0,40}(?:verif|valid|check|assert|authenticat|compare|guard)[A-Za-z]{0,40}(?:secret|signature|hmac|webhook|digest)[A-Za-z]{0,40}\\s*\\(`,`i`),Nh=/webhook[\s_-]?ur[il]\w*/gi,Ph=/process\.env\.\w*WEBHOOK_URL|\b(?:send|post|dispatch|publish|notify)\w*Webhook/,Fh=/\b(?:req|request)\b/,Ih=/\/\/[^\n]*|\/\*[\s\S]*?\*\/|"(?:\\.|[^"\\\n])*"|'(?:\\.|[^'\\\n])*'|`(?:\\.|[^`\\])*`/g,Lh=U({id:`webhook-signature-risk`,title:`Webhook handler lacks signature verification`,severity:`warn`,recommendation:`Verify provider signatures before parsing or acting on webhook bodies. Use provider SDK helpers or HMAC verification with timing-safe comparison.`,scan:K({shouldScan:e=>{if(!G(e.relativePath)||Ph.test(e.content))return!1;let t=e.content.replace(Ih,``).replace(Nh,``);return Ah.test(e.relativePath)||Ah.test(t)},pattern:jh,requireAll:[Fh],suppressWhen:Mh,message:`Webhook handler code does not show an obvious signature verification step.`})}),Rh=/\.[cm]?[jt]sx?$/i,zh=/\.d\.[cm]?[jt]s$/i,Bh=/\.mdx$/i,Vh=/\.html?$/i,Hh=new Set([`.angular`,`.astro`,`.cache`,`.contentlayer`,`.docusaurus`,`.expo`,`.git`,`.next`,`.nuxt`,`.output`,`.svelte-kit`,`.turbo`,`.vercel`,`build`,`coverage`,`dist`,`node_modules`,`out`,`storybook-static`]),Uh=new WeakMap,Wh=e=>{let t=Uh.get(e);if(t)return t;let n=Ne(e);return Uh.set(e,n),n},Gh=e=>{let t=[],n=[],a=[e],o=!1;for(;a.length>0;){let e=a.pop();if(!e)continue;let s;try{s=r.readdirSync(e,{withFileTypes:!0})}catch{return null}for(let r of s){let s=i.join(e,r.name),c=Hh.has(r.name)||r.name.startsWith(`.`)&&r.name!==`.dumi`&&r.name!==`.storybook`;if(!(r.isSymbolicLink()&&c)){if(r.isSymbolicLink())return null;if(r.isDirectory()){if(c)continue;a.push(s);continue}if(!(!r.isFile()||wc(s))){if(Bh.test(r.name)){o=!0;continue}if(Vh.test(r.name)){n.push(Li(s));continue}Rh.test(r.name)&&(zh.test(r.name)||t.push(Li(s)))}}}}return{sourceFilePaths:t,htmlFilePaths:n,hasOpaqueMdxConsumerSurface:o}},Kh=(e,t)=>{for(let n of e){let e;try{e=r.readFileSync(n,`utf8`)}catch{return!0}for(let n of t)if(e.includes(`"${n}"`)||e.includes(`'${n}'`))return!0}return!1},qh=e=>{if(S(e,`ImportDeclaration`))return oc(e)?null:typeof e.source.value==`string`?e.source.value:null;if(S(e,`ExportNamedDeclaration`))return e.exportKind===`type`||ac(e.specifiers,`ExportSpecifier`,`exportKind`)?null:e.source&&typeof e.source.value==`string`?e.source.value:null;if(S(e,`ExportAllDeclaration`))return e.exportKind===`type`?null:typeof e.source.value==`string`?e.source.value:null;if(S(e,`ImportExpression`))return S(e.source,`Literal`)&&typeof e.source.value==`string`?e.source.value:null;if(S(e,`CallExpression`)&&S(e.callee,`Identifier`)&&e.callee.name===`require`&&e.arguments.length===1){let t=e.arguments[0];return t&&S(t,`Literal`)&&typeof t.value==`string`?t.value:null}return null},Jh=(e,t,n,r)=>{A(e.programNode,i=>{let a=qh(i);if(!a)return;let o=Cn(e.filePath,a);if(!o){r.add(a);return}let s=Li(o);n.set(i,s);let c=t.get(s)??new Set;c.add(e),t.set(s,c)})},Yh=({rootDirectory:e,currentFilePath:t,currentProgramNode:n,currentScopes:r,requiredModuleSources:i=[],knownModuleSources:a})=>{if(i.length>0&&a!==void 0&&!i.some(e=>a.includes(e)))return null;let o=Gh(e);if(!o||i.length>0&&a===void 0&&!Kh(o.sourceFilePaths,i))return null;let s=new Map;for(let e of o.sourceFilePaths){if(e===t){s.set(e,{filePath:e,programNode:n,scopes:r});continue}let i=Rt(e);if(!i||!S(i,`Program`))return null;s.set(e,{filePath:e,programNode:i,scopes:Wh(i)})}let c=new Map,l=new WeakMap,u=new Set;for(let e of s.values())Jh(e,c,l,u);return{modulesByFilePath:s,htmlFilePaths:o.htmlFilePaths,consumerModulesByFilePath:c,resolvedSourcePathByNode:l,unresolvedRuntimeSources:u,hasOpaqueMdxConsumerSurface:o.hasOpaqueMdxConsumerSurface}},Xh=e=>{if(!e)return null;let t=O(e);return!S(t,`Literal`)||typeof t.value!=`boolean`?null:t.value},Zh=(e,t,n={})=>{let r=n.maximumConstAliases===void 0?4:n.maximumConstAliases,i=n.shouldFoldStaticConditions??!1,a=n.shouldKeepKnownValues??!1,o=[],s=[{expression:e,remainingConstAliases:r,resolvingSymbols:new Set}];for(;s.length>0;){let e=s.pop();if(!e)continue;let n=O(e.expression);if(S(n,`Literal`)){if(typeof n.value!=`string`){if(a)continue;return null}o.push(n.value);continue}if(S(n,`TemplateLiteral`)){let e=Sa(n);if(e===null){if(a)continue;return null}o.push(e);continue}if(S(n,`ConditionalExpression`)){let t=i?Xh(n.test):null;if(t!==null){s.push({expression:t?n.consequent:n.alternate,remainingConstAliases:e.remainingConstAliases,resolvingSymbols:e.resolvingSymbols});continue}s.push({expression:n.alternate,remainingConstAliases:e.remainingConstAliases,resolvingSymbols:new Set(e.resolvingSymbols)}),s.push({expression:n.consequent,remainingConstAliases:e.remainingConstAliases,resolvingSymbols:new Set(e.resolvingSymbols)});continue}if(a&&S(n,`LogicalExpression`)&&(n.operator===`??`||n.operator===`||`)){s.push({expression:n.right,remainingConstAliases:e.remainingConstAliases,resolvingSymbols:new Set(e.resolvingSymbols)}),s.push({expression:n.left,remainingConstAliases:e.remainingConstAliases,resolvingSymbols:new Set(e.resolvingSymbols)});continue}if(S(n,`Identifier`)){let r=t.referenceFor(n)?.resolvedSymbol;if(!r||r.kind!==`const`||!r.initializer||!S(r.declarationNode,`VariableDeclarator`)||r.declarationNode.id!==r.bindingIdentifier||e.remainingConstAliases===0||e.resolvingSymbols.has(r)){if(a)continue;return null}e.resolvingSymbols.add(r),s.push({expression:r.initializer,remainingConstAliases:e.remainingConstAliases===null?null:e.remainingConstAliases-1,resolvingSymbols:e.resolvingSymbols});continue}if(!a)return null}return o.length>0?o:null},Qh=(e,t,n={})=>Zh(e,t,n),$h=(e,t)=>Zh(e,t,{shouldKeepKnownValues:!0}),eg=(e,t,n,r,i=!1)=>{let a=e.value;return a?S(a,`Literal`)?typeof a.value==`string`?[a.value]:null:S(a,`JSXExpressionContainer`)?Qh(a.expression,t,{maximumConstAliases:n,shouldFoldStaticConditions:r,shouldKeepKnownValues:i}):null:null},tg=(e,t)=>eg(e,t,4,!1),ng=(e,t)=>eg(e,t,null,!0),rg=(e,t)=>eg(e,t,4,!1,!0),ig=(e,t)=>{let n=i.relative(t,e);return n===``||!n.startsWith(`..${i.sep}`)&&n!==`..`&&!i.isAbsolute(n)},ag={attribute:null,expression:null,isPresent:!1,isUnknown:!1},og={attribute:null,expression:null,isPresent:!1,isUnknown:!0},sg=(e,t,n)=>{for(let r=e.properties.length-1;r>=0;--r){let i=e.properties[r];if(!i)return og;if(S(i,`SpreadElement`)){if(!S(i.argument,`ObjectExpression`))return og;let e=sg(i.argument,t,n);if(e.isPresent||e.isUnknown)return e;continue}if(!S(i,`Property`))return og;let a=N(i,{allowComputedString:!0});if(!a)return og;if((n?a:a.toLowerCase())===t)return{attribute:null,expression:i.value,isPresent:!0,isUnknown:!1}}return ag},cg=(e,t,n=!0)=>{let r=n?t:t.toLowerCase();for(let t=e.length-1;t>=0;--t){let i=e[t];if(!i)return og;if(S(i,`JSXSpreadAttribute`)){if(!S(i.argument,`ObjectExpression`))return og;let e=sg(i.argument,r,n);if(e.isPresent||e.isUnknown)return e;continue}if(!S(i,`JSXAttribute`))continue;let a=ko(i.name);if((n?a:a?.toLowerCase())===r)return{attribute:i,expression:null,isPresent:!0,isUnknown:!1}}return ag},lg=/(?<attributeName>[^\s"'<>/=]+)(?:\s*=\s*(?:"(?<doubleQuoted>[^"]*)"|'(?<singleQuoted>[^']*)'|(?<unquoted>[^\s"'=<>`]+)))?/g,ug=/<!--[\s\S]*?-->|(?<skippedContentOpeningTag><(?<skippedContentTag>script|style|textarea|title|xmp|iframe|noembed|noframes|plaintext|template)\b(?:"[^"]*"|'[^']*'|[^'"<>])*?>)[\s\S]*?(?:<\/\k<skippedContentTag>\s*>|$)|(?<openingTag><[A-Za-z][\w:-]*(?:"[^"]*"|'[^']*'|[^'"<>])*>)/gi,dg=new Map,fg=(e,t,n)=>{if(!e.isPresent)return;let r=e.attribute?rg(e.attribute,t):e.expression?$h(e.expression,t):null;for(let e of r??[]){let t=e?.trim();t&&n.add(t)}},pg=(e,t,n)=>{for(let r of e.properties){if(S(r,`SpreadElement`)){S(r.argument,`ObjectExpression`)&&pg(r.argument,t,n);continue}if(S(r,`Property`)&&N(r,{allowComputedString:!0})?.toLowerCase()===`id`)for(let e of $h(r.value,t)??[]){let t=e.trim();t&&n.add(t)}}},mg=e=>{let t=e.parent;for(S(t,`JSXElement`)&&t.openingElement===e&&(t=t.parent);t;){if(S(t,`JSXElement`)&&Ko(t.openingElement)===`template`)return!0;t=t.parent}return!1},hg=(e,t,n)=>{A(e,e=>{if(!S(e,`JSXOpeningElement`)||mg(e))return;let r=cg(e.attributes,`id`,!1);if(r.isUnknown){for(let r of e.attributes)fg(cg([r],`id`,!1),t,n),S(r,`JSXSpreadAttribute`)&&S(r.argument,`ObjectExpression`)&&pg(r.argument,t,n);return}fg(r,t,n)})},gg=(e,t)=>{for(let n of e.matchAll(ug)){let e=n.groups?.skippedContentOpeningTag??n.groups?.openingTag;if(e)for(let n of e.matchAll(lg)){if(n.groups?.attributeName?.toLowerCase()!==`id`)continue;let e=n.groups?.doubleQuoted??n.groups?.singleQuoted??n.groups?.unquoted??``;e.trim()&&t.add(e.trim())}}},_g=e=>{if(!i.isAbsolute(e.currentFilePath))return null;let t=e.configuredRootDirectory?Li(e.configuredRootDirectory):null;return!t||!ig(e.currentFilePath,t)?null:t},vg=()=>{dg.clear()},yg=e=>{let t=new Set;hg(e.currentProgramNode,e.currentScopes,t);let n=_g(e);if(!n)return t;if(dg.has(n)){let e=dg.get(n);return e?new Set([...e,...t]):null}let i=Yh({rootDirectory:n,currentFilePath:Li(e.currentFilePath),currentProgramNode:e.currentProgramNode,currentScopes:e.currentScopes});if(!i)return dg.set(n,null),null;let a=new Set;for(let e of i.modulesByFilePath.values())hg(e.programNode,e.scopes,a);try{for(let e of i.htmlFilePaths)gg(r.readFileSync(e,`utf8`),a)}catch{return dg.set(n,null),null}return dg.set(n,a),new Set([...a,...t])},bg=()=>{Tn(),ht(),sn(),vg(),Sn()},xg=e=>Nc.test(e)||Pc.test(e),Sg=e=>{let t=Gc.test(e);return Dm(e)||Rm(e)||il(e)||Zc(e)?{bucket:`priority`,isGeneratedBundleByName:t}:Xc(e,t)?{bucket:`artifact`,isGeneratedBundleByName:t}:xg(e)?{bucket:`other`,isGeneratedBundleByName:t}:null},Cg=(e,t)=>t||xg(e)||Zc(e)||Dm(e),wg=[`nextjs`,`astro`,`vite`,`cra`,`remix`,`gatsby`,`expo`,`react-native`,`tanstack-start`,`preact`,`unknown`];export{Bu as $,b as $i,vi as $n,Kn as $r,$o as $t,em as A,tt as Ai,la as An,Kr as Ar,eu as At,ap as B,Ve as Bi,Ui as Bn,Mr as Br,rl as Bt,jm as C,o as Ca,lt as Ci,R as Cn,ni as Cr,Xl as Ct,xm as D,et as Di,ga as Dn,ii as Dr,$l as Dt,Cm as E,st as Ei,ha as En,ti as Er,au as Et,Wp as F,Ze as Fi,Zi as Fn,Jr as Fr,Kl as Ft,Vf as G,We as Gi,Li as Gn,Ir as Gr,mc as Gt,Kf as H,Qe as Hi,F as Hn,Pr as Hr,Dc as Ht,Up as I,Ue as Ii,qi as In,Vr as Ir,Vl as It,sd as J,Ne as Ji,Mi as Jn,Sr as Jr,ic as Jt,vd as K,Ge as Ki,Ai as Kn,Fr as Kr,ac as Kt,Vp as L,Be as Li,Xi as Ln,Hr as Lr,Wl as Lt,Zp as M,Ke as Mi,ea as Mn,Rr as Mr,ql as Mt,Xp as N,Je as Ni,$i as Nn,zr as Nr,nu as Nt,_m as O,nt as Oi,L as On,Br as Or,Yl as Ot,Yp as P,Ye as Pi,Qi as Pn,Wr as Pr,Gl as Pt,Vu as Q,x as Qi,ui as Qn,qn as Qr,Fs as Qt,Rp as R,ze as Ri,Ji as Rn,Ur as Rr,xl as Rt,Mm as S,s as Sa,D as Si,wa as Sn,ri as Sr,iu as St,Em as T,at as Ti,_a as Tn,mi as Tr,Ul as Tt,Gf as U,Ie as Ui,Vi as Un,Nr as Ur,wc as Ut,Qf as V,Fe as Vi,I as Vn,Ar as Vr,U as Vt,Wf as W,Le as Wi,Bi as Wn,Lr as Wr,Tc as Wt,Ku as X,fe as Xi,N as Xn,M as Xr,nc as Xt,Gu as Y,Pe as Yi,P as Yn,cr as Yr,tc as Yt,Wu as Z,S as Zi,_i as Zn,Jn as Zr,rc as Zt,sh as _,u as _a,Tt as _i,so as _n,Ti as _r,Bl as _t,yg as a,v as aa,Dn as ai,Ho as an,Ci as ar,vu as at,Im as b,c as ba,_t as bi,lo as bn,di as br,ru as bt,ng as c,ae as ca,Cn as ci,Oo as cn,yi as cr,Sl as ct,Yh as d,ce as da,Mt as di,uo as dn,si as dr,Dl as dt,de as ea,j as ei,Yo as en,hi as er,J as et,Lh as f,g as fa,jt as fi,B as fn,li as fr,wl as ft,lh as g,d as ga,Ot as gi,oo as gn,fi as gr,Al as gt,yh as h,ee as ha,O as hi,co as hn,Qr as hr,kl as ht,bg as i,oe as ia,kn as ii,Uo as in,Si as ir,Du as it,$p as j,He as ji,ta as jn,Gr as jr,tu as jt,sm as k,$e as ki,ua as kn,qr as kr,Jl as kt,tg as l,ne as la,on as li,To as ln,ei as lr,El as lt,Oh as m,p as ma,kt as mi,io as mn,Yr as mr,Cl as mt,Sg as n,le as na,An as ni,qo as nn,ci as nr,Iu as nt,cg as o,se as oa,On as oi,Mo as on,bi as or,_u as ot,kh as p,m as pa,At as pi,fo as pn,oi as pr,Ol as pt,_d as q,Xe as qi,Fi as qn,kr as qr,oc as qt,Cg as r,ie as ra,A as ri,Ko as rn,wi as rr,Ou as rt,ig as s,te as sa,k as si,ko as sn,xi as sr,Tl as st,wg as t,ue as ta,Wn as ti,Jo as tn,pi as tr,Lu as tt,Xh as u,re as ua,Rt as ui,po as un,gi as ur,jl as ut,oh as v,f as va,Et as vi,ro as vn,Zr as vr,Ql as vt,km as w,it as wi,Sa as wn,$r as wr,Ml as wt,Nm as x,l as xa,vt as xi,Ia as xn,Xr as xr,Hl as xt,eh as y,h as ya,gt as yi,ao as yn,ai as yr,Zl as yt,Dp as z,qe as zi,Yi as zn,jr as zr,bl as zt};
+//# sourceMappingURL=capability-BN46vnIK.js.map