server-action-audit 0.0.0-stage → 0.2.0

package/dist/chunk-RCEEE6TI.js

@@ -0,0 +1,677 @@
+// src/ast.ts
+var SKIP = /* @__PURE__ */ new Set(["parent", "loc", "range", "tokens", "comments", "typeAnnotation", "returnType", "typeParameters"]);
+function walk(root, visit) {
+  if (!root || typeof root.type !== "string") return;
+  if (visit(root) === false) return;
+  for (const key of Object.keys(root)) {
+    if (SKIP.has(key)) continue;
+    const value = root[key];
+    if (Array.isArray(value)) {
+      for (const child of value) if (child && typeof child.type === "string") walk(child, visit);
+    } else if (value && typeof value.type === "string") {
+      walk(value, visit);
+    }
+  }
+}
+function isFunction(node) {
+  return !!node && (node.type === "FunctionDeclaration" || node.type === "FunctionExpression" || node.type === "ArrowFunctionExpression");
+}
+function directives(body) {
+  const found = [];
+  for (const statement of body ?? []) {
+    if (statement.type !== "ExpressionStatement") break;
+    if (typeof statement.directive === "string") found.push(statement.directive);
+    else if (statement.expression?.type === "Literal" && typeof statement.expression.value === "string") found.push(statement.expression.value);
+    else break;
+  }
+  return found;
+}
+function functionDirectives(fn) {
+  return fn.body?.type === "BlockStatement" ? directives(fn.body.body) : [];
+}
+function unwrap(node) {
+  let current = node;
+  while (current.type === "ChainExpression" || current.type === "TSNonNullExpression" || current.type === "TSAsExpression" || current.type === "ParenthesizedExpression") {
+    current = current.expression;
+  }
+  return current;
+}
+function calleePath(callee) {
+  const node = unwrap(callee);
+  if (node.type === "Identifier") return node.name;
+  if (node.type === "MemberExpression") {
+    const property = !node.computed && node.property?.type === "Identifier" ? node.property.name : "*";
+    return `${calleePath(node.object)}.${property}`;
+  }
+  if (node.type === "Super") return "super";
+  if (node.type === "ThisExpression") return "this";
+  return "*";
+}
+function lastSegment(path) {
+  const index = path.lastIndexOf(".");
+  return index === -1 ? path : path.slice(index + 1);
+}
+function callsIn(root) {
+  const calls = [];
+  walk(root, (node) => {
+    if (node.type === "CallExpression") calls.push(node);
+  });
+  return calls;
+}
+function unconditionalCalls(fn, followReturned = false) {
+  const calls = [];
+  const expression = (node) => {
+    if (!node || typeof node.type !== "string" || isFunction(node)) return;
+    if (node.type === "CallExpression") calls.push(node);
+    for (const key of Object.keys(node)) {
+      if (SKIP.has(key)) continue;
+      const value = node[key];
+      if (Array.isArray(value)) value.forEach((child) => child && expression(child));
+      else if (value && typeof value.type === "string") expression(value);
+    }
+  };
+  const returned = (node) => {
+    if (followReturned && node && isFunction(node)) calls.push(...unconditionalCalls(node));
+    else expression(node);
+  };
+  const statement = (node) => {
+    if (!node) return;
+    switch (node.type) {
+      case "BlockStatement":
+        for (const child of node.body ?? []) statement(child);
+        break;
+      case "ExpressionStatement":
+        expression(node.expression);
+        break;
+      case "VariableDeclaration":
+        for (const declarator of node.declarations ?? []) expression(declarator.init);
+        break;
+      case "ReturnStatement":
+        returned(node.argument);
+        break;
+      case "ThrowStatement":
+        expression(node.argument);
+        break;
+      case "IfStatement":
+        expression(node.test);
+        break;
+      case "TryStatement":
+        statement(node.block);
+        break;
+      case "SwitchStatement":
+        expression(node.discriminant);
+        break;
+      case "DoWhileStatement":
+        statement(node.body);
+        break;
+      case "LabeledStatement":
+        statement(node.body);
+        break;
+    }
+  };
+  if (fn.body?.type === "BlockStatement") statement(fn.body);
+  else returned(fn.body);
+  return calls;
+}
+function callChain(call) {
+  const methods = [];
+  const functions = [];
+  const identifiers = [];
+  let current = unwrap(call);
+  for (; ; ) {
+    if (current.type === "CallExpression") {
+      for (const argument of current.arguments ?? []) {
+        if (isFunction(argument)) functions.unshift(argument);
+        else if (argument.type === "Identifier") identifiers.unshift(argument.name);
+      }
+      const callee = unwrap(current.callee);
+      if (callee.type === "MemberExpression") {
+        methods.unshift(!callee.computed && callee.property?.type === "Identifier" ? callee.property.name : "*");
+        current = unwrap(callee.object);
+        continue;
+      }
+      if (callee.type === "Identifier") return { root: callee.name, methods, functions, identifiers };
+      return { root: null, methods, functions, identifiers };
+    }
+    if (current.type === "MemberExpression") {
+      methods.unshift(!current.computed && current.property?.type === "Identifier" ? current.property.name : "*");
+      current = unwrap(current.object);
+      continue;
+    }
+    if (current.type === "AwaitExpression") {
+      current = unwrap(current.argument);
+      continue;
+    }
+    return { root: current.type === "Identifier" ? current.name : null, methods, functions, identifiers };
+  }
+}
+function position(node) {
+  return node.loc ? { line: node.loc.start.line, column: node.loc.start.column + 1 } : { line: 0, column: 0 };
+}
+
+// src/options.ts
+var EXACT_PATHS = ["auth"];
+var NAMES = [
+  "currentUser",
+  // Clerk
+  "getServerSession",
+  // NextAuth v4
+  "getKindeServerSession",
+  // Kinde
+  "validateRequest",
+  // Lucia
+  "getIronSession",
+  // iron-session
+  "withAuth",
+  // WorkOS AuthKit
+  "verifyIdToken",
+  // Firebase Admin
+  "verifySessionCookie",
+  // Firebase Admin
+  "jwtVerify",
+  // jose
+  "verifyToken",
+  "verifyJwt",
+  "verifyAccessToken",
+  "getSession",
+  "verifySession",
+  "getCurrentUser",
+  "getAuthUser",
+  "getAuthenticatedUser",
+  "getSessionUser",
+  "getUserOrThrow",
+  "requireAuth",
+  "requireUser",
+  "requireSession",
+  "requireAdmin",
+  "requireRole",
+  "requirePermission",
+  "checkAuth",
+  "ensureAuth",
+  "ensureUser",
+  "assertAuth",
+  "assertUser",
+  "isAuthenticated",
+  "authenticate",
+  "authorize"
+];
+var SUFFIXES = [
+  "auth.getUser",
+  // Supabase
+  "auth.getClaims",
+  // Supabase
+  "auth.getSession",
+  // Supabase
+  "auth.protect",
+  // Clerk
+  "api.getSession"
+  // Better Auth
+];
+var AUTH_NAME = /auth|protect|guard|session|user|admin|private|secure|logged/i;
+var HELPER_NAME = /auth|session|user|viewer|account|member|owner|admin|role|permission|access|identity|token|login|guard|protect|secure|private|require|ensure|assert|verify|check|current|^me$|^whoami$/i;
+var GUEST_GUARD = /(?:throw|redirect|fail|reject|error)If(?:Authenticated|Authed|LoggedIn|SignedIn|Session)|requireGuest|guestOnly|onlyGuests?|(?:require|ensure|assert)(?:Not|No)(?:Authenticated|LoggedIn|SignedIn|Session|User)|unauthenticated|anonymous/i;
+function resolveOptions(options = {}) {
+  const extra = options.authFunctions ?? [];
+  return {
+    exactPaths: new Set(EXACT_PATHS),
+    names: /* @__PURE__ */ new Set([...NAMES, ...extra.filter((name) => !name.includes("."))]),
+    suffixes: [...SUFFIXES, ...extra.filter((name) => name.includes("."))],
+    authWrappers: new Set(options.authWrappers ?? []),
+    authClients: new Set(options.authClients ?? []),
+    publicActions: new Set(options.publicActions ?? []),
+    ignore: options.ignore ?? []
+  };
+}
+function isAuthCall(path, options) {
+  if (options.exactPaths.has(path)) return true;
+  if (options.names.has(lastSegment(path))) return true;
+  return options.suffixes.some((suffix) => path === suffix || path.endsWith(`.${suffix}`));
+}
+var VALIDATION_METHODS = /* @__PURE__ */ new Set(["parse", "safeParse", "parseAsync", "safeParseAsync", "validate", "validateSync", "validateAsync", "assert"]);
+var NOT_VALIDATION = /* @__PURE__ */ new Set(["JSON", "Date", "Number", "URL", "path", "Math", "BigInt", "console", "assert"]);
+function isValidationCall(path) {
+  const method = lastSegment(path);
+  if (!VALIDATION_METHODS.has(method)) return false;
+  const owner = path.includes(".") ? path.slice(0, path.lastIndexOf(".")) : "";
+  return !NOT_VALIDATION.has(lastSegment(owner) || owner);
+}
+
+// src/analyze.ts
+var PUBLIC_MARKER = /@public-action\b/;
+var CLIENT_METHODS = /* @__PURE__ */ new Set(["action", "stateAction", "handler", "createServerAction", "createAction"]);
+var SCHEMA_METHODS = /* @__PURE__ */ new Set(["schema", "inputSchema", "input", "bindArgsSchemas"]);
+var MAX_DEPTH = 4;
+var ModuleScope = class {
+  constructor(ast, filename) {
+    this.ast = ast;
+    this.filename = filename;
+    for (const statement of ast.body ?? []) this.index(statement);
+  }
+  ast;
+  filename;
+  functions = /* @__PURE__ */ new Map();
+  imports = /* @__PURE__ */ new Map();
+  exports = /* @__PURE__ */ new Map();
+  /** Top-level declarations by name, with the statement that holds them (for comments). */
+  declarations = /* @__PURE__ */ new Map();
+  declare(name, init, statement) {
+    this.declarations.set(name, { init, statement });
+    if (isFunction(init)) this.functions.set(name, init);
+    else if (init.type === "CallExpression") {
+      const wrapped = (init.arguments ?? []).find((argument) => isFunction(argument));
+      if (wrapped) this.functions.set(name, wrapped);
+    }
+  }
+  index(statement) {
+    const declaration = statement.type === "ExportNamedDeclaration" ? statement.declaration : statement;
+    if (statement.type === "ImportDeclaration" && statement.importKind !== "type") {
+      for (const specifier of statement.specifiers ?? []) {
+        const imported = specifier.type === "ImportDefaultSpecifier" ? "default" : specifier.type === "ImportNamespaceSpecifier" ? "*" : specifier.imported?.name ?? specifier.imported?.value;
+        this.imports.set(specifier.local.name, { source: statement.source.value, imported });
+      }
+      return;
+    }
+    if (declaration?.type === "FunctionDeclaration" && declaration.id) {
+      this.declare(declaration.id.name, declaration, statement);
+      if (statement.type === "ExportNamedDeclaration") this.exports.set(declaration.id.name, declaration.id.name);
+    }
+    if (declaration?.type === "VariableDeclaration") {
+      for (const declarator of declaration.declarations ?? []) {
+        if (declarator.id?.type !== "Identifier" || !declarator.init) continue;
+        this.declare(declarator.id.name, declarator.init, statement);
+        if (statement.type === "ExportNamedDeclaration") this.exports.set(declarator.id.name, declarator.id.name);
+      }
+    }
+    if (statement.type === "ExportNamedDeclaration" && !statement.declaration) {
+      for (const specifier of statement.specifiers ?? []) {
+        const exported = specifier.exported?.name ?? specifier.exported?.value;
+        const local = specifier.local?.name ?? specifier.local?.value;
+        this.exports.set(exported, statement.source ? { source: statement.source.value, imported: local } : local);
+      }
+    }
+    if (statement.type === "ExportDefaultDeclaration") {
+      const value = statement.declaration;
+      if (value?.type === "Identifier") this.exports.set("default", value.name);
+      else if (value) {
+        this.declare("default", value, statement);
+        this.exports.set("default", "default");
+      }
+    }
+  }
+};
+function scopeOf(module, context) {
+  let scope = context.scopes.get(module.filename);
+  if (!scope) {
+    scope = new ModuleScope(module.ast, module.filename);
+    context.scopes.set(module.filename, scope);
+  }
+  return scope;
+}
+function resolveFunction(name, scope, context, depth) {
+  const local = scope.functions.get(name);
+  if (local) return { fn: local, scope };
+  const binding = scope.imports.get(name);
+  if (!binding || !context.resolver || depth > MAX_DEPTH) return null;
+  return exportedFunction(binding, scope, context, depth + 1);
+}
+function exportedFunction(binding, from, context, depth) {
+  if (depth > MAX_DEPTH || binding.imported === "*") return null;
+  const module = context.resolver?.(binding.source, from.filename);
+  if (!module) return null;
+  const scope = scopeOf(module, context);
+  const entry = scope.exports.get(binding.imported);
+  if (entry === void 0) return null;
+  if (typeof entry === "string") {
+    const fn = scope.functions.get(entry);
+    return fn ? { fn, scope } : resolveFunction(entry, scope, context, depth);
+  }
+  return exportedFunction(entry, scope, context, depth + 1);
+}
+function authEvidence(fn, scope, context, depth = 0, seen = /* @__PURE__ */ new Set(), followReturned = false) {
+  if (depth > MAX_DEPTH || seen.has(fn)) return null;
+  seen.add(fn);
+  const calls = unconditionalCalls(fn, followReturned);
+  for (const call of calls) {
+    const path = calleePath(call.callee);
+    if (isAuthCall(path, context.options)) return `${path}()`;
+  }
+  for (const call of calls) {
+    const path = calleePath(call.callee);
+    if (path.includes(".") || path === "*" || GUEST_GUARD.test(path) || !HELPER_NAME.test(path)) continue;
+    const helper = resolveFunction(path, scope, context, depth);
+    if (!helper) continue;
+    const evidence = authEvidence(helper.fn, helper.scope, context, depth + 1, seen);
+    if (evidence) return `${path}() \u2192 ${evidence}`;
+  }
+  return null;
+}
+function boundNames(pattern, names = []) {
+  if (!pattern) return names;
+  if (pattern.type === "Identifier") names.push(pattern.name);
+  else if (pattern.type === "ObjectPattern") for (const property of pattern.properties ?? []) boundNames(property.type === "RestElement" ? property.argument : property.value, names);
+  else if (pattern.type === "ArrayPattern") for (const element of pattern.elements ?? []) boundNames(element, names);
+  else if (pattern.type === "AssignmentPattern") boundNames(pattern.left, names);
+  else if (pattern.type === "RestElement") boundNames(pattern.argument, names);
+  return names;
+}
+function closureEvidence(action, enclosing, scope, context) {
+  if (enclosing.body?.type !== "BlockStatement") return null;
+  const fromAuth = /* @__PURE__ */ new Map();
+  for (const statement of enclosing.body.body ?? []) {
+    if (statement.type !== "VariableDeclaration") continue;
+    for (const declarator of statement.declarations ?? []) {
+      const evidence = authEvidence({ type: "ArrowFunctionExpression", params: [], body: declarator.init }, scope, context);
+      if (evidence) for (const name of boundNames(declarator.id)) fromAuth.set(name, evidence);
+    }
+  }
+  if (!fromAuth.size) return null;
+  let found = null;
+  walk(action.body, (node) => {
+    if (found) return false;
+    if (node.type === "Identifier" && fromAuth.has(node.name)) found = `${node.name} from ${fromAuth.get(node.name)} in the enclosing component`;
+  });
+  return found;
+}
+function declarationFrom(binding, from, context, depth) {
+  if (depth > MAX_DEPTH || binding.imported === "*" || !context.resolver) return null;
+  const module = context.resolver(binding.source, from.filename);
+  if (!module) return null;
+  const scope = scopeOf(module, context);
+  const entry = scope.exports.get(binding.imported);
+  if (typeof entry === "string") return resolveDeclaration(entry, scope, context, depth + 1);
+  return entry ? declarationFrom(entry, scope, context, depth + 1) : null;
+}
+function resolveDeclaration(name, scope, context, depth) {
+  const local = scope.declarations.get(name);
+  if (local) return { init: local.init, scope };
+  const binding = scope.imports.get(name);
+  return binding ? declarationFrom(binding, scope, context, depth) : null;
+}
+function definitionEvidence(name, scope, context, depth = 0) {
+  if (depth > MAX_DEPTH || GUEST_GUARD.test(name)) return null;
+  if (depth > 0 && (context.options.authClients.has(name) || context.options.authWrappers.has(name) || AUTH_NAME.test(name))) return name;
+  const definition = resolveFunction(name, scope, context, 0);
+  const evidence = definition && authEvidence(definition.fn, definition.scope, context, 1, /* @__PURE__ */ new Set(), true);
+  if (evidence) return `${name} \u2192 ${evidence}`;
+  const declaration = resolveDeclaration(name, scope, context, 0);
+  if (declaration?.init.type === "CallExpression") {
+    const chain = callChain(declaration.init);
+    for (const base of [chain.root, ...chain.identifiers]) {
+      if (!base || base === name) continue;
+      const inherited = definitionEvidence(base, declaration.scope, context, depth + 1);
+      if (inherited) return `${name} \u2192 ${inherited}`;
+    }
+  }
+  return null;
+}
+function validatesDirectly(fn) {
+  return callsIn(fn.body).some((call) => isValidationCall(calleePath(call.callee)));
+}
+function parameterCount(fn) {
+  return (fn.params ?? []).length;
+}
+function leadingComments(node, comments, text) {
+  const start = node.range?.[0];
+  if (start === void 0) return [];
+  const found = [];
+  let cursor = start;
+  for (const comment of [...comments].reverse()) {
+    const [from, to] = comment.range ?? [Infinity, Infinity];
+    if (to > cursor) continue;
+    if (text.slice(to, cursor).trim() !== "") break;
+    found.push(comment);
+    cursor = from;
+  }
+  return found;
+}
+function bodyHeadComments(fn, comments) {
+  if (fn.body?.type !== "BlockStatement" || !fn.body.range) return [];
+  const [bodyStart, bodyEnd] = fn.body.range;
+  const statements = fn.body.body ?? [];
+  const firstReal = statements.find((statement) => !(statement.type === "ExpressionStatement" && typeof statement.directive === "string"));
+  const limit = firstReal?.range?.[0] ?? bodyEnd;
+  return comments.filter((comment) => comment.range && comment.range[0] > bodyStart && comment.range[1] <= limit);
+}
+function moduleCandidates(scope) {
+  const candidates = [];
+  for (const [exported, entry] of scope.exports) {
+    if (typeof entry !== "string") continue;
+    const declaration = scope.declarations.get(entry);
+    if (!declaration) continue;
+    const { init, statement } = declaration;
+    const target = init.type === "AwaitExpression" ? init.argument : init;
+    if (!isFunction(target) && target.type !== "CallExpression") continue;
+    const name = exported === "default" && target.id?.type === "Identifier" ? target.id.name : exported;
+    candidates.push({ name, kind: "module", target, anchors: [statement, init] });
+  }
+  return candidates;
+}
+function inlineCandidates(ast, skip) {
+  const candidates = [];
+  const visit = (node, parent, grandparent, enclosing) => {
+    if (isFunction(node) && !skip.has(node) && functionDirectives(node).includes("use server")) {
+      let name = node.id?.name;
+      if (!name && parent?.type === "VariableDeclarator" && parent.id?.type === "Identifier") name = parent.id.name;
+      if (!name && (parent?.type === "Property" || parent?.type === "MethodDefinition") && parent.key?.type === "Identifier") name = parent.key.name;
+      if (!name && parent?.type === "JSXExpressionContainer" && grandparent?.type === "JSXAttribute") name = `(inline ${grandparent.name?.name ?? "action"})`;
+      candidates.push({ name: name ?? "(inline)", kind: "inline", target: node, anchors: [parent?.type === "VariableDeclarator" ? grandparent ?? node : node], enclosing });
+    }
+    const inner = isFunction(node) ? node : enclosing;
+    for (const key of Object.keys(node)) {
+      if (key === "parent" || key === "loc" || key === "range") continue;
+      const value = node[key];
+      if (Array.isArray(value)) {
+        for (const child of value) if (child && typeof child.type === "string") visit(child, node, parent, inner);
+      } else if (value && typeof value.type === "string") {
+        visit(value, node, parent, inner);
+      }
+    }
+  };
+  visit(ast, null, null, null);
+  return candidates;
+}
+function analyzeCandidate(candidate, scope, context, comments, text) {
+  const { target } = candidate;
+  let reason = null;
+  let validated = null;
+  let hint = null;
+  const handlers = [];
+  if (isFunction(target)) {
+    handlers.push(target);
+    reason = authEvidence(target, scope, context);
+    if (!reason && candidate.enclosing) reason = closureEvidence(target, candidate.enclosing, scope, context);
+    validated = parameterCount(target) === 0 ? null : validatesDirectly(target);
+  } else {
+    const chain = callChain(target);
+    handlers.push(...chain.functions);
+    const isClient = chain.methods.some((method) => CLIENT_METHODS.has(method));
+    const root = chain.root;
+    const trusted = root !== null && (context.options.authClients.has(root) || context.options.authWrappers.has(root) || AUTH_NAME.test(root) && !GUEST_GUARD.test(root));
+    if (trusted) reason = isClient ? `${root} client` : `${root}() wrapper`;
+    for (const handler of chain.functions) reason ??= authEvidence(handler, scope, context);
+    for (const name of [root, ...chain.identifiers]) {
+      if (!reason && name) reason = definitionEvidence(name, scope, context);
+    }
+    if (isClient) {
+      validated = chain.methods.some((method) => SCHEMA_METHODS.has(method)) ? true : null;
+    } else if (root && /valid|schema|zod|parse/i.test(root)) {
+      validated = true;
+    } else {
+      const handler = chain.functions[0];
+      validated = !handler || parameterCount(handler) === 0 ? null : validatesDirectly(handler);
+    }
+    if (!reason && root) {
+      hint = isClient ? `If "${root}" has auth middleware, add it to "authClients".` : `If ${root}() checks the session, add it to "authWrappers".`;
+    }
+  }
+  const markerComments = [
+    ...candidate.anchors.flatMap((anchor) => leadingComments(anchor, comments, text)),
+    ...handlers.flatMap((handler) => bodyHeadComments(handler, comments))
+  ];
+  const markedPublic = markerComments.some((comment) => PUBLIC_MARKER.test(comment.value));
+  const listedPublic = context.options.publicActions.has(candidate.name);
+  const status = reason ? "protected" : markedPublic || listedPublic ? "public" : "unprotected";
+  if (status === "public") {
+    reason = markedPublic ? "@public-action" : "publicActions";
+    hint = null;
+  }
+  const { line, column } = position(candidate.anchors[0] ?? target);
+  return { name: candidate.name, kind: candidate.kind, line, column, status, reason, validated, hint, node: candidate.anchors[0] ?? target };
+}
+function analyzeModule(input, options, resolver) {
+  if (!input.text.includes("use server")) return [];
+  const context = { options, resolver, scopes: /* @__PURE__ */ new Map() };
+  const scope = scopeOf({ ast: input.ast, filename: input.filename }, context);
+  const comments = input.comments ?? input.ast.comments ?? [];
+  const candidates = [];
+  if (directives(input.ast.body).includes("use server")) candidates.push(...moduleCandidates(scope));
+  const covered = new Set(candidates.map((candidate) => candidate.target));
+  candidates.push(...inlineCandidates(input.ast, covered));
+  return candidates.map((candidate) => analyzeCandidate(candidate, scope, context, comments, input.text)).sort((a, b) => a.line - b.line || a.column - b.column);
+}
+
+// src/resolve.ts
+import { existsSync, readFileSync, statSync } from "fs";
+import { dirname, join, resolve } from "path";
+import { parse } from "@typescript-eslint/typescript-estree";
+var EXTENSIONS = [".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs", ".mts", ".cts"];
+function parseModule(text, filename) {
+  return parse(text, {
+    jsx: !/\.[cm]?ts$/.test(filename),
+    loc: true,
+    range: true,
+    comment: true
+  });
+}
+function isFile(path) {
+  try {
+    return statSync(path).isFile();
+  } catch {
+    return false;
+  }
+}
+var TS_SOURCES = { ".js": [".ts", ".tsx"], ".jsx": [".tsx"], ".mjs": [".mts"], ".cjs": [".cts"] };
+function tryFile(base) {
+  if (isFile(base)) return base;
+  const jsExtension = base.match(/\.(js|jsx|mjs|cjs)$/)?.[0];
+  if (jsExtension) {
+    for (const extension of TS_SOURCES[jsExtension] ?? []) {
+      const candidate = base.slice(0, -jsExtension.length) + extension;
+      if (isFile(candidate)) return candidate;
+    }
+  }
+  for (const extension of EXTENSIONS) if (isFile(base + extension)) return base + extension;
+  for (const extension of EXTENSIONS) if (isFile(join(base, `index${extension}`))) return join(base, `index${extension}`);
+  return null;
+}
+function parseJsonc(text) {
+  let out = "";
+  let inString = false;
+  for (let i = 0; i < text.length; i++) {
+    const char = text[i];
+    if (inString) {
+      out += char;
+      if (char === "\\") out += text[++i] ?? "";
+      else if (char === '"') inString = false;
+    } else if (char === '"') {
+      inString = true;
+      out += char;
+    } else if (char === "/" && text[i + 1] === "/") {
+      while (i < text.length && text[i] !== "\n") i++;
+      out += "\n";
+    } else if (char === "/" && text[i + 1] === "*") {
+      i = text.indexOf("*/", i + 2);
+      if (i === -1) break;
+      i++;
+    } else {
+      out += char;
+    }
+  }
+  return JSON.parse(out.replace(/,(\s*[}\]])/g, "$1"));
+}
+var mappings = /* @__PURE__ */ new Map();
+function pathMapping(fromDir) {
+  if (mappings.has(fromDir)) return mappings.get(fromDir);
+  let mapping = null;
+  for (const name of ["tsconfig.json", "jsconfig.json"]) {
+    const file = join(fromDir, name);
+    if (!existsSync(file)) continue;
+    try {
+      const config = parseJsonc(readFileSync(file, "utf8"));
+      const options = config.compilerOptions ?? {};
+      if (options.paths) mapping = { base: resolve(fromDir, options.baseUrl ?? "."), paths: options.paths };
+    } catch {
+      mapping = null;
+    }
+    break;
+  }
+  if (!mapping) {
+    const parent = dirname(fromDir);
+    mapping = parent !== fromDir && !existsSync(join(fromDir, "package.json")) ? pathMapping(parent) : null;
+  }
+  mappings.set(fromDir, mapping);
+  return mapping;
+}
+function resolveAlias(specifier, fromFile) {
+  const mapping = pathMapping(dirname(fromFile));
+  if (!mapping) return null;
+  for (const [pattern, targets] of Object.entries(mapping.paths)) {
+    const star = pattern.indexOf("*");
+    let captured = null;
+    if (star === -1) captured = specifier === pattern ? "" : null;
+    else {
+      const prefix = pattern.slice(0, star);
+      const suffix = pattern.slice(star + 1);
+      if (specifier.startsWith(prefix) && specifier.endsWith(suffix) && specifier.length >= prefix.length + suffix.length) {
+        captured = specifier.slice(prefix.length, specifier.length - suffix.length);
+      }
+    }
+    if (captured === null) continue;
+    for (const target of targets) {
+      const file = tryFile(resolve(mapping.base, target.replace("*", captured)));
+      if (file) return file;
+    }
+  }
+  return null;
+}
+function resolveImportPath(specifier, fromFile) {
+  if (specifier.startsWith(".")) return tryFile(resolve(dirname(fromFile), specifier));
+  if (specifier.startsWith("/")) return tryFile(specifier);
+  return resolveAlias(specifier, fromFile);
+}
+function createNodeResolver() {
+  const cache = /* @__PURE__ */ new Map();
+  return (specifier, fromFile) => {
+    const file = resolveImportPath(specifier, fromFile);
+    if (!file) return null;
+    let mtime = 0;
+    try {
+      mtime = statSync(file).mtimeMs;
+    } catch {
+      return null;
+    }
+    const cached = cache.get(file);
+    if (cached && cached.mtime === mtime) return cached.module;
+    let module = null;
+    try {
+      module = { ast: parseModule(readFileSync(file, "utf8"), file), filename: file };
+    } catch {
+      module = null;
+    }
+    cache.set(file, { mtime, module });
+    return module;
+  };
+}
+
+// src/version.ts
+var VERSION = "0.2.0";
+
+export {
+  resolveOptions,
+  analyzeModule,
+  parseModule,
+  resolveImportPath,
+  createNodeResolver,
+  VERSION
+};
+//# sourceMappingURL=chunk-RCEEE6TI.js.map