@groma/scanner-javascript 0.1.0

package/dist/index.js

@@ -0,0 +1,2509 @@
+// @bun
+// plugins/scanners/javascript/src/index.ts
+import path4 from "path";
+
+// packages/scanner/src/values.ts
+function object(value, label) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`${label} must be an object`);
+  }
+  return value;
+}
+function string(value, label) {
+  if (typeof value !== "string")
+    throw new Error(`${label} must be a string`);
+  return value;
+}
+function array(value, label) {
+  if (!Array.isArray(value))
+    throw new Error(`${label} must be an array`);
+  return value;
+}
+
+// packages/scanner/src/http.ts
+var pathText = /^[A-Za-z0-9\-._~!$&'()*+,;=:@%]+$/;
+var methodToken = /^[A-Z][A-Z-]*$/;
+function fail(message) {
+  throw new Error(message);
+}
+function text(value, label) {
+  if (typeof value !== "string" || !pathText.test(value))
+    fail(`${label} must be nonempty URL path characters`);
+  return value;
+}
+function method(value, label, anyMethod) {
+  if (typeof value !== "string" || !(methodToken.test(value) || anyMethod && value === "*")) {
+    fail(`${label} must be an uppercase HTTP method${anyMethod ? " or *" : ""}`);
+  }
+  return value;
+}
+function operation(value, operations) {
+  if (typeof value !== "string" || !operations.has(value))
+    fail("HTTP fact references unknown operation");
+  return value;
+}
+function endpointSegment(value, last) {
+  const segment = object(value, "HTTP endpoint segment");
+  if (segment.kind === "literal")
+    return { kind: "literal", value: text(segment.value, "HTTP literal segment") };
+  if (segment.kind !== "parameter" && segment.kind !== "catch-all")
+    fail(`unknown HTTP endpoint segment kind: ${String(segment.kind)}`);
+  if (segment.kind === "catch-all" && !last)
+    fail("an HTTP catch-all segment must be last");
+  for (const flag of ["optional", "constrained"]) {
+    if (segment[flag] !== undefined && typeof segment[flag] !== "boolean")
+      fail(`HTTP segment ${flag} must be a boolean`);
+  }
+  return {
+    kind: segment.kind,
+    name: text(segment.name, "HTTP segment name"),
+    ...segment.optional ? { optional: true } : {},
+    ...segment.constrained ? { constrained: true } : {}
+  };
+}
+function requestSegment(value) {
+  const segment = object(value, "HTTP request segment");
+  if (segment.kind === "literal")
+    return { kind: "literal", value: text(segment.value, "HTTP literal segment") };
+  if (segment.kind === "dynamic" || segment.kind === "unknown")
+    return { kind: segment.kind };
+  return fail(`unknown HTTP request segment kind: ${String(segment.kind)}`);
+}
+function order(value) {
+  const fact = object(value, "HTTP endpoint order");
+  const application = string(fact.application, "HTTP endpoint order application");
+  if (application === "")
+    fail("HTTP endpoint order application must be nonempty");
+  const position = fact.position;
+  if (typeof position !== "number" || !Number.isInteger(position) || position < 0) {
+    fail("HTTP endpoint order position must be a nonnegative integer");
+  }
+  return { application, position };
+}
+function endpoint(value, operations) {
+  const fact = object(value, "HTTP endpoint");
+  const path = array(fact.path, "HTTP endpoint path");
+  return {
+    operation: operation(fact.operation, operations),
+    method: method(fact.method, "HTTP endpoint method", true),
+    path: path.map((segment, index) => endpointSegment(segment, index === path.length - 1)),
+    ...fact.order === undefined ? {} : { order: order(fact.order) }
+  };
+}
+function request(value, operations) {
+  const fact = object(value, "HTTP request");
+  if (fact.configured !== undefined && typeof fact.configured !== "boolean")
+    fail("HTTP request configured must be a boolean");
+  return {
+    operation: operation(fact.operation, operations),
+    ...fact.method === undefined ? {} : { method: method(fact.method, "HTTP request method", false) },
+    ...fact.configured ? { configured: true } : {},
+    path: array(fact.path, "HTTP request path").map(requestSegment)
+  };
+}
+function httpEvidence(endpoints, requests, operations) {
+  if (endpoints === undefined && requests === undefined)
+    return {};
+  if (operations === undefined)
+    fail("HTTP facts require operation declarations");
+  return {
+    ...endpoints === undefined ? {} : { httpEndpoints: array(endpoints, "httpEndpoints").map((fact) => endpoint(fact, operations)) },
+    ...requests === undefined ? {} : { httpRequests: array(requests, "httpRequests").map((fact) => request(fact, operations)) }
+  };
+}
+
+// packages/scanner/src/index.ts
+function compare(...values) {
+  return values.join("\x00");
+}
+function uniqueBy(values, key, label) {
+  const seen = new Set;
+  for (const value of values) {
+    const id = key(value);
+    if (seen.has(id))
+      throw new Error(`duplicate ${label}: ${id}`);
+    seen.add(id);
+  }
+  return [...values].sort((left, right) => key(left).localeCompare(key(right)));
+}
+function createScanObservation(input) {
+  const roots = validateRoots(input.roots);
+  const rootIds = new Set(roots.map((root) => root.id));
+  const files = uniqueBy(input.files.map((file) => ({
+    ...file,
+    roots: [...new Set(file.roots)].sort(),
+    symbols: [...new Map(file.symbols.map((symbol) => [
+      compare(symbol.id, symbol.kind),
+      symbol
+    ])).values()].sort((left, right) => {
+      return compare(left.id, left.kind).localeCompare(compare(right.id, right.kind));
+    })
+  })), (file) => file.file, "file path");
+  const filePaths = new Set(files.map((file) => file.file));
+  for (const file of files) {
+    if (file.roots.length === 0)
+      throw new Error(`file has no root: ${file.file}`);
+    for (const root of file.roots) {
+      if (!rootIds.has(root))
+        throw new Error(`file references unknown root: ${root}`);
+    }
+  }
+  for (const diagnostic of input.diagnostics)
+    diagnosticLocation(diagnostic);
+  return {
+    schemaVersion: 1,
+    scanner: input.scanner,
+    roots,
+    files,
+    ...sourceUnits(input.sourceUnits, filePaths),
+    ...operationEvidence(input, filePaths),
+    ...httpEvidence(input.httpEndpoints, input.httpRequests, input.operations && new Set(input.operations.map((operation) => operation.id))),
+    diagnostics: [...new Map(input.diagnostics.map((diagnostic) => [
+      diagnosticKey(diagnostic),
+      diagnostic
+    ])).values()].sort((left, right) => {
+      return diagnosticKey(left).localeCompare(diagnosticKey(right));
+    })
+  };
+}
+function sourceUnits(input, paths) {
+  if (input === undefined)
+    return {};
+  const units = array(input, "sourceUnits").map((entry) => {
+    const unit = object(entry, "source unit");
+    const primary = string(unit.primary, "source unit.primary");
+    const files = [...new Set(array(unit.files, "source unit.files").map((file) => string(file, "source unit.file")))].sort();
+    if (!files.includes(primary))
+      throw new Error(`source unit omits primary file: ${primary}`);
+    for (const file of files) {
+      if (!paths.has(file))
+        throw new Error(`source unit references unknown file: ${file}`);
+    }
+    return { primary, files };
+  });
+  return { sourceUnits: [...new Map(units.map((unit) => [compare(unit.primary, ...unit.files), unit])).values()].sort((a, b) => compare(a.primary, ...a.files).localeCompare(compare(b.primary, ...b.files))) };
+}
+function validateRoots(input) {
+  const roots = uniqueBy(input, (root) => root.id, "root id");
+  const byId = new Map(roots.map((root) => [root.id, root]));
+  for (const root of roots) {
+    const visited = new Set([root.id]);
+    let parent = root.parent;
+    while (parent !== undefined) {
+      if (visited.has(parent))
+        throw new Error(`root hierarchy contains a cycle: ${parent}`);
+      visited.add(parent);
+      const ancestor = byId.get(parent);
+      if (ancestor === undefined)
+        throw new Error(`root references unknown parent: ${parent}`);
+      parent = ancestor.parent;
+    }
+  }
+  return roots;
+}
+function diagnosticKey(diagnostic) {
+  return compare(diagnostic.severity, diagnostic.code, diagnostic.message, diagnostic.file ?? "", String(diagnostic.line ?? ""));
+}
+function diagnosticLocation(value) {
+  if (value.line !== undefined && (!Number.isInteger(value.line) || Number(value.line) < 1)) {
+    throw new Error("diagnostic.line must be a positive integer");
+  }
+  return {
+    ...value.file === undefined ? {} : { file: string(value.file, "diagnostic.file") },
+    ...value.line === undefined ? {} : { line: Number(value.line) }
+  };
+}
+function operationEvidence(input, files) {
+  if (input.operations === undefined && input.invocations !== undefined)
+    throw new Error("invocations require operation declarations");
+  if (input.operations === undefined)
+    return {};
+  const operations = uniqueBy(input.operations, (operation) => operation.id, "operation id");
+  const ids = new Set(operations.map((operation) => operation.id));
+  for (const operation of operations) {
+    if (!files.has(operation.file))
+      throw new Error(`operation references unknown file: ${operation.file}`);
+    sourcePosition(operation.position);
+    validateOperationTokens(operation);
+  }
+  const invocations = input.invocations ?? [];
+  for (const invocation of invocations)
+    validateInvocation(invocation, ids, files);
+  return { operations, invocations };
+}
+function operationTokens(operation) {
+  if (operation.tokens === undefined) {
+    if (operation.startLine !== undefined || operation.endLine !== undefined) {
+      throw new Error("operation range requires tokens");
+    }
+    return {};
+  }
+  if (operation.startLine === undefined || operation.endLine === undefined) {
+    throw new Error("operation tokens require a source range");
+  }
+  if (!Number.isInteger(operation.startLine) || Number(operation.startLine) < 1) {
+    throw new Error("operation.startLine must be a positive integer");
+  }
+  if (!Number.isInteger(operation.endLine) || Number(operation.endLine) < 1) {
+    throw new Error("operation.endLine must be a positive integer");
+  }
+  const startLine = Number(operation.startLine);
+  const endLine = Number(operation.endLine);
+  if (endLine < startLine)
+    throw new Error("operation.endLine must be at or after startLine");
+  return {
+    startLine,
+    endLine,
+    tokens: array(operation.tokens, "operation.tokens").map((token) => string(token, "operation.token"))
+  };
+}
+function validateOperationTokens(operation) {
+  operationTokens({
+    tokens: operation.tokens,
+    startLine: operation.startLine,
+    endLine: operation.endLine
+  });
+}
+function validateInvocation(invocation, ids, files) {
+  sourcePosition(invocation.position);
+  sourcePosition(invocation.binding?.position);
+  if (!invocation.targets.length && !invocation.unresolved)
+    throw new Error("an empty target set must be unresolved");
+  if (!ids.has(invocation.source) || invocation.targets.some((target) => !ids.has(target))) {
+    throw new Error("invocation references unknown operation");
+  }
+  if (invocation.binding && !files.has(invocation.binding.file))
+    throw new Error("invocation binding references unknown file");
+}
+function sourcePosition(position) {
+  if (position === undefined)
+    return {};
+  if (!Number.isInteger(position) || Number(position) < 0)
+    throw new Error("source position must be a non-negative integer");
+  return { position: Number(position) };
+}
+
+// plugins/scanners/javascript/src/index.ts
+import ts6 from "./typescript.cjs";
+
+// plugins/scanners/javascript/src/evidence.ts
+import ts2 from "./typescript.cjs";
+
+// plugins/scanners/typescript-operations.ts
+function is(node, kind) {
+  return node !== undefined && node.kind === kind;
+}
+function vocabularyOf(k) {
+  return {
+    leading: new Map([
+      [k.TrueKeyword, "true"],
+      [k.FalseKeyword, "false"],
+      [k.NullKeyword, "null"],
+      [k.ThisKeyword, "this"],
+      [k.SuperKeyword, "super"],
+      [k.QuestionDotToken, "?."],
+      [k.SpreadElement, "..."],
+      [k.SpreadAssignment, "..."],
+      [k.ElementAccessExpression, "index"],
+      [k.ReturnStatement, "return"],
+      [k.ForStatement, "for"],
+      [k.ForInStatement, "for"],
+      [k.ForOfStatement, "for"],
+      [k.WhileStatement, "while"],
+      [k.DoStatement, "do"],
+      [k.SwitchStatement, "switch"],
+      [k.CaseClause, "case"],
+      [k.DefaultClause, "default"],
+      [k.BreakStatement, "break"],
+      [k.ContinueStatement, "continue"],
+      [k.ThrowStatement, "throw"],
+      [k.CatchClause, "catch"],
+      [k.AwaitKeyword, "await"],
+      [k.AwaitExpression, "await"],
+      [k.YieldExpression, "yield"],
+      [k.TypeOfExpression, "typeof"],
+      [k.VoidExpression, "void"],
+      [k.DeleteExpression, "delete"]
+    ]),
+    quoted: new Set([k.StringLiteral, k.NoSubstitutionTemplateLiteral, k.TemplateHead, k.TemplateMiddle, k.TemplateTail]),
+    verbatim: new Set([k.NumericLiteral, k.BigIntLiteral, k.RegularExpressionLiteral]),
+    unary: new Map([
+      [k.ExclamationToken, "!"],
+      [k.MinusToken, "-"],
+      [k.PlusToken, "+"],
+      [k.TildeToken, "~"],
+      [k.PlusPlusToken, "++"],
+      [k.MinusMinusToken, "--"]
+    ]),
+    operators: new Set([
+      k.BinaryExpression,
+      k.ConditionalExpression,
+      k.PrefixUnaryExpression,
+      k.PostfixUnaryExpression,
+      k.TypeOfExpression,
+      k.VoidExpression,
+      k.DeleteExpression,
+      k.AwaitExpression,
+      k.YieldExpression
+    ]),
+    types: new Set([
+      k.TypeParameter,
+      k.ArrayType,
+      k.FunctionType,
+      k.LiteralType,
+      k.TypeLiteral,
+      k.ExpressionWithTypeArguments,
+      k.TypeReference,
+      k.ConditionalType
+    ]),
+    assertions: new Set([k.AsExpression, k.SatisfiesExpression, k.NonNullExpression]),
+    functions: new Set([
+      k.ArrowFunction,
+      k.FunctionExpression,
+      k.FunctionDeclaration,
+      k.MethodDeclaration,
+      k.Constructor,
+      k.GetAccessor,
+      k.SetAccessor
+    ])
+  };
+}
+function typeScriptOperations(ts) {
+  const k = ts.SyntaxKind;
+  const words = vocabularyOf(k);
+  function executable(node) {
+    if (node.kind === k.ArrowFunction || node.kind === k.FunctionExpression)
+      return true;
+    const declared = node.kind === k.FunctionDeclaration || node.kind === k.MethodDeclaration || node.kind === k.Constructor;
+    return declared && node.body !== undefined;
+  }
+  function callArgumentProperty(node) {
+    const property = is(node.parent, k.PropertyAssignment) ? node.parent : node;
+    if (property.kind !== k.PropertyAssignment && property.kind !== k.MethodDeclaration)
+      return false;
+    if (!is(property.parent, k.ObjectLiteralExpression))
+      return false;
+    let holder = property.parent.parent;
+    while (holder !== undefined && (holder.kind === k.ParenthesizedExpression || words.assertions.has(holder.kind))) {
+      holder = holder.parent;
+    }
+    return is(holder, k.CallExpression) || is(holder, k.NewExpression);
+  }
+  function comparableName(node) {
+    if (!executable(node) || callArgumentProperty(node))
+      return;
+    if (node.kind === k.Constructor)
+      return "constructor";
+    const name = node.name;
+    if (is(name, k.Identifier))
+      return name.text;
+    const parent = node.parent;
+    if (is(parent, k.PropertyAssignment) || is(parent, k.VariableDeclaration))
+      return parent.name.getText();
+    return;
+  }
+  function operationFields(node) {
+    const name = comparableName(node);
+    if (name === undefined)
+      return { name: "(anonymous)" };
+    const source = node.getSourceFile();
+    const line = (position) => source.getLineAndCharacterOfPosition(position).line + 1;
+    return { name, startLine: line(node.getStart()), endLine: line(node.end), tokens: tokenize(k, words, node) };
+  }
+  return { executable, operationFields };
+}
+function lookup(scope, name) {
+  return scope.slots.get(name) ?? (scope.parent === undefined ? undefined : lookup(scope.parent, name));
+}
+function tokenize(k, words, operation) {
+  const tokens = [];
+  let next = 0;
+  let scope = { slots: new Map };
+  function bindPattern(part) {
+    if (part === undefined)
+      return;
+    if (is(part, k.Identifier)) {
+      scope.slots.set(part.text, next++);
+      return;
+    }
+    if (is(part, k.BindingElement))
+      bindElement(part);
+    else
+      part.forEachChild((child) => bindPattern(child));
+  }
+  function bindElement(element) {
+    const key = element.propertyName ?? (is(element.parent, k.ObjectBindingPattern) ? element.name : undefined);
+    if (is(key, k.Identifier) || is(key, k.StringLiteral) || is(key, k.NumericLiteral))
+      tokens.push(`k.${key.text}`);
+    else
+      walk(key);
+    bindPattern(element.name);
+    walk(element.initializer);
+  }
+  function inScope(run) {
+    const previous = scope;
+    scope = { parent: previous, slots: new Map };
+    run();
+    scope = previous;
+  }
+  function declare(node) {
+    bindPattern(node.name);
+    walk(node.initializer);
+  }
+  function declareParameters(node) {
+    for (const parameter of node.parameters)
+      if (is(parameter, k.Parameter))
+        declare(parameter);
+  }
+  function identifierToken(node) {
+    const parent = node.parent;
+    if (is(parent, k.PropertyAccessExpression) && parent.name === node)
+      return `.${node.text}`;
+    const key = is(parent, k.PropertyAssignment) || is(parent, k.ShorthandPropertyAssignment);
+    if (key && parent.name === node)
+      return `k.${node.text}`;
+    const slot = lookup(scope, node.text);
+    return slot === undefined ? node.text : `$${slot}`;
+  }
+  function groupsOperator(expression) {
+    let node = expression;
+    while (words.assertions.has(node.kind))
+      node = node.expression;
+    return words.operators.has(node.kind);
+  }
+  function emitText(node) {
+    if (words.quoted.has(node.kind))
+      tokens.push(JSON.stringify(node.text));
+    else if (words.verbatim.has(node.kind))
+      tokens.push(node.text);
+    else
+      return false;
+    return true;
+  }
+  function emitCall(node) {
+    if (!is(node, k.CallExpression) && !is(node, k.NewExpression))
+      return false;
+    if (node.kind === k.NewExpression)
+      tokens.push("new");
+    walk(node.expression);
+    walk(node.questionDotToken);
+    tokens.push("call");
+    for (const argument of node.arguments ?? [])
+      walk(argument);
+    return true;
+  }
+  function emitOperator(node) {
+    if (is(node, k.BinaryExpression)) {
+      walk(node.left);
+      tokens.push(node.operatorToken.getText());
+      walk(node.right);
+    } else if (is(node, k.PrefixUnaryExpression)) {
+      tokens.push(words.unary.get(node.operator));
+      walk(node.operand);
+    } else if (is(node, k.PostfixUnaryExpression)) {
+      walk(node.operand);
+      tokens.push(words.unary.get(node.operator));
+    } else if (is(node, k.ConditionalExpression)) {
+      walk(node.condition);
+      tokens.push("?");
+      walk(node.whenTrue);
+      tokens.push(":");
+      walk(node.whenFalse);
+    } else if (is(node, k.ParenthesizedExpression) && groupsOperator(node.expression)) {
+      tokens.push("(");
+      walk(node.expression);
+      tokens.push(")");
+    } else
+      return false;
+    return true;
+  }
+  function emitBranches(node) {
+    if (is(node, k.IfStatement)) {
+      tokens.push("if");
+      walk(node.expression);
+      walk(node.thenStatement);
+      branch("else", node.elseStatement);
+    } else if (is(node, k.TryStatement)) {
+      tokens.push("try");
+      walk(node.tryBlock);
+      walk(node.catchClause);
+      branch("finally", node.finallyBlock);
+    } else
+      return false;
+    return true;
+  }
+  function branch(keyword, statement) {
+    if (statement === undefined)
+      return;
+    tokens.push(keyword);
+    walk(statement);
+  }
+  function emitStructure(node) {
+    if (node.kind === k.Block)
+      inScope(() => node.forEachChild((child) => walk(child)));
+    else if (is(node, k.VariableDeclaration) || is(node, k.Parameter))
+      declare(node);
+    else if (words.functions.has(node.kind)) {
+      tokens.push("fn");
+      inScope(() => {
+        declareParameters(node);
+        walk(node.body);
+      });
+    } else
+      return false;
+    return true;
+  }
+  function walk(node) {
+    if (node === undefined || words.types.has(node.kind) || emitStructure(node))
+      return;
+    if (is(node, k.Identifier) || is(node, k.PrivateIdentifier)) {
+      tokens.push(identifierToken(node));
+      return;
+    }
+    if (emitText(node) || emitCall(node) || emitOperator(node) || emitBranches(node))
+      return;
+    const leading = words.leading.get(node.kind);
+    if (leading !== undefined)
+      tokens.push(leading);
+    node.forEachChild((child) => walk(child));
+  }
+  declareParameters(operation);
+  walk(operation.body);
+  return tokens;
+}
+
+// plugins/scanners/javascript/src/declarations.ts
+import ts from "./typescript.cjs";
+function isFunctionValue(node) {
+  return node !== undefined && (ts.isArrowFunction(node) || ts.isFunctionExpression(node));
+}
+function topLevelDeclarations(source) {
+  return source.statements.flatMap((statement) => {
+    if (ts.isFunctionDeclaration(statement))
+      return statement.name ? [{ name: statement.name.text, kind: "function" }] : [];
+    if (ts.isClassDeclaration(statement))
+      return statement.name ? [{ name: statement.name.text, kind: "class" }] : [];
+    if (!ts.isVariableStatement(statement))
+      return [];
+    return statement.declarationList.declarations.flatMap((declaration) => ts.isIdentifier(declaration.name) && isFunctionValue(declaration.initializer) ? [{ name: declaration.name.text, kind: "function" }] : []);
+  });
+}
+
+// plugins/scanners/javascript/src/evidence.ts
+var { executable, operationFields } = typeScriptOperations(ts2);
+function javaScriptEvidence(file, source) {
+  const operations = [];
+  const invocations = [];
+  const calls = [];
+  const owners = new Map;
+  const lineOf = (position) => source.getLineAndCharacterOfPosition(position).line + 1;
+  let moduleCode;
+  function operation(node) {
+    const position = node.getStart(source);
+    const recorded = { id: `${file}#${position}`, file, position, ...operationFields(node) };
+    operations.push(recorded);
+    owners.set(node, recorded.id);
+    return recorded;
+  }
+  function moduleOperation() {
+    if (moduleCode === undefined) {
+      moduleCode = { id: `${file}#module`, file, name: "(anonymous)", position: source.getStart(source) };
+      operations.push(moduleCode);
+    }
+    return moduleCode;
+  }
+  function invocation(node, owner) {
+    const position = node.getStart(source);
+    invocations.push({
+      source: owner.id,
+      targets: [],
+      unresolved: true,
+      line: lineOf(position),
+      position,
+      ...ts2.isPropertyAccessExpression(node.expression) ? { member: node.expression.name.text } : {}
+    });
+  }
+  function visit(node, owner) {
+    const inside = executable(node) ? operation(node) : owner;
+    if (ts2.isCallExpression(node)) {
+      calls.push(node);
+      invocation(node, inside ?? moduleOperation());
+    }
+    node.forEachChild((child) => visit(child, inside));
+  }
+  function operationAt(node) {
+    for (let current = node;current; current = current.parent) {
+      const id = owners.get(current);
+      if (id !== undefined)
+        return id;
+    }
+    return moduleOperation().id;
+  }
+  source.forEachChild((child) => visit(child, undefined));
+  const symbols = new Map(topLevelDeclarations(source).map((declaration) => [`${file}#${declaration.name}`, { id: `${file}#${declaration.name}`, ...declaration }]));
+  return { symbols: [...symbols.values()], operations, invocations, calls, operationAt };
+}
+
+// plugins/scanners/javascript/src/http.ts
+import ts4 from "./typescript.cjs";
+
+// plugins/scanners/http-checker.ts
+function primitive(ts, type) {
+  if (type.isUnion())
+    return (type.types ?? []).every((member) => primitive(ts, member));
+  const flags = ts.TypeFlags;
+  const mask = flags.StringLike | flags.NumberLike | flags.BigIntLike | flags.BooleanLike | flags.EnumLike | flags.ESSymbolLike | flags.VoidLike | flags.Null;
+  return (type.flags & mask) !== 0;
+}
+function classicChecker(ts, checker) {
+  const symbol = (handle) => handle;
+  return {
+    symbolsAt: async (nodes) => nodes.map((node) => checker.getSymbolAtLocation(node)),
+    shorthandValue: async (property) => checker.getShorthandAssignmentValueSymbol(property),
+    aliased: async (handle) => symbol(handle).flags & ts.SymbolFlags.Alias ? checker.getAliasedSymbol(symbol(handle)) : handle,
+    module: (handle) => (symbol(handle).flags & ts.SymbolFlags.ValueModule) !== 0,
+    declaration: async (handle) => symbol(handle).valueDeclaration ?? symbol(handle).declarations?.[0],
+    declarationCount: (handle) => symbol(handle).declarations?.length ?? 0,
+    exportsOf: async (handle) => checker.getExportsOfModule(symbol(handle)),
+    primitiveAt: async (node) => primitive(ts, checker.getTypeAtLocation(node)),
+    same: (left, right) => left === right
+  };
+}
+
+// plugins/scanners/http-order.ts
+function below(placement, prefix, ...indices) {
+  const known = placement.known && indices.every((index) => index !== undefined);
+  return {
+    ...placement,
+    prefix: `${placement.prefix}/${prefix}`,
+    rank: known ? [...placement.rank, ...indices] : placement.rank,
+    known
+  };
+}
+function compare2(left, right) {
+  for (let index = 0;index < Math.min(left.length, right.length); index++) {
+    if (left[index] !== right[index])
+      return left[index] - right[index];
+  }
+  return 0;
+}
+function begins(rank, start) {
+  return start.every((index, at) => rank[at] === index);
+}
+function cut(rank, ranks) {
+  return ranks.reduce((shortest, other) => other.length < shortest.length && begins(rank, other) ? other : shortest, rank);
+}
+function withOrder(placed) {
+  const ranks = new Map;
+  for (const { placement } of placed) {
+    if (!placement.ordered)
+      continue;
+    const list = ranks.get(placement.application) ?? [];
+    list.push(placement.rank);
+    ranks.set(placement.application, list);
+  }
+  const positions = new Map([...ranks].map(([application, list]) => {
+    const distinct = new Map(list.map((rank) => cut(rank, list)).map((rank) => [rank.join("."), rank]));
+    return [application, [...distinct.values()].sort(compare2).map((rank) => rank.join("."))];
+  }));
+  return placed.map(({ endpoint, placement }) => {
+    const list = ranks.get(placement.application);
+    if (!placement.ordered || list === undefined)
+      return endpoint;
+    const position = positions.get(placement.application).indexOf(cut(placement.rank, list).join("."));
+    return { ...endpoint, order: { application: placement.application, position } };
+  });
+}
+
+// plugins/scanners/http-url.ts
+var pathText2 = /^[A-Za-z0-9\-._~!$&'()*+,;=:@%]+$/;
+var absolute = /^([A-Za-z][A-Za-z\d+.-]*:)?\/\//;
+var HOLE = "\x00";
+var computedPart = { kind: "hole", configured: false };
+var configuredPart = { kind: "hole", configured: true };
+var methodToken2 = /^[A-Z][A-Z-]*$/;
+function methodText(text) {
+  const method = text?.toUpperCase();
+  return method !== undefined && methodToken2.test(method) ? method : undefined;
+}
+function requestSegment2(part) {
+  if (part === HOLE)
+    return { kind: "dynamic" };
+  if (part.includes(HOLE) || !pathText2.test(part))
+    return { kind: "unknown" };
+  return { kind: "literal", value: part };
+}
+function segmentsOf(parts) {
+  const url = parts.map((part) => part.kind === "text" ? part.text : HOLE).join("");
+  const end = Math.min(...["?", "#"].map((mark) => url.includes(mark) ? url.indexOf(mark) : url.length));
+  return url.slice(0, end).split("/").filter((part) => part !== "").map(requestSegment2);
+}
+function afterAuthority(text) {
+  const slash = text.indexOf("/", text.indexOf("//") + 2);
+  return slash < 0 ? "" : text.slice(slash);
+}
+function joinedText(input) {
+  const parts = [];
+  for (const part of input) {
+    const last = parts.at(-1);
+    if (part.kind === "text" && last?.kind === "text")
+      parts[parts.length - 1] = { kind: "text", text: last.text + part.text };
+    else if (part.kind === "hole" || part.text !== "")
+      parts.push(part);
+  }
+  return parts;
+}
+function requestUrl(input) {
+  const parts = joinedText(input);
+  const [first, ...rest] = parts;
+  if (first === undefined)
+    return { path: [{ kind: "unknown" }] };
+  if (first.kind === "hole") {
+    const path = segmentsOf(rest);
+    const next = rest[0];
+    const separated = next === undefined || next.kind === "text" && next.text.startsWith("/");
+    return first.configured && separated ? { configured: true, path } : { path: [{ kind: "unknown" }, ...path] };
+  }
+  if (absolute.test(first.text)) {
+    return { path: [{ kind: "unknown" }, ...segmentsOf([{ kind: "text", text: afterAuthority(first.text) }, ...rest])] };
+  }
+  if (!first.text.startsWith("/"))
+    return { path: [{ kind: "unknown" }, ...segmentsOf(parts)] };
+  return { path: segmentsOf(parts) };
+}
+function joinBase(base, url) {
+  const stated = joinedText(base);
+  const path = joinedText(url);
+  const [first] = path;
+  if (stated.length === 0)
+    return path;
+  if (first === undefined)
+    return stated;
+  if (first.kind === "hole")
+    return [computedPart, ...path.slice(1)];
+  return absolute.test(first.text) ? path : [...stated, { kind: "text", text: "/" }, ...path];
+}
+function withBase(base, url) {
+  const stated = joinedText(base);
+  const path = joinedText(url);
+  const [only] = stated;
+  const [first, ...rest] = path;
+  if (stated.length !== 1 || only?.kind !== "text" || first?.kind !== "text" || absolute.test(first.text)) {
+    return joinBase(stated, path);
+  }
+  const prefix = only.text.replace(/\/$/, "");
+  if (first.text.startsWith(prefix)) {
+    const next = first.text[prefix.length];
+    if (next === undefined)
+      return rest.length === 0 ? path : [computedPart, ...rest];
+    return next === "/" || next === "?" ? path : joinBase(stated, path);
+  }
+  return prefix.startsWith(first.text) && rest.length > 0 ? [computedPart, ...rest] : joinBase(stated, path);
+}
+
+// plugins/scanners/http-paths.ts
+var PLACEHOLDER = /^:([A-Za-z_]\w*)(?:\((.*)\)|\{(.*)\})?(\?)?$/;
+var FIRST_PLACEHOLDER = /:([A-Za-z_]\w*)/;
+var WILDCARD = /^\*([A-Za-z_]\w*)?$/;
+var OPTIONAL_GROUP = /\{\/:([A-Za-z_]\w*)\}$/;
+var SYNTAX = /[:*(){}?+]/;
+var ONE_SEGMENT = /^(?:\^|\$|\\[dw]|[A-Za-z0-9_-]|\[(?:\\[dw]|[A-Za-z0-9_]-[A-Za-z0-9_]|[A-Za-z0-9_-])+\]|[+*?|]|\{\d+(?:,\d*)?\}|\(\?:|[()])+$/;
+var REMAINDER = new Set([".*", ".+"]);
+function remainder(name = "*") {
+  return { kind: "catch-all", name, optional: true, constrained: true };
+}
+function placeholder(match, last) {
+  const [, name, round, curly, optional] = match;
+  const pattern = round ?? curly;
+  if (pattern === undefined)
+    return { kind: "parameter", name, ...optional ? { optional: true } : {} };
+  if (REMAINDER.has(pattern))
+    return last ? { kind: "catch-all", name } : undefined;
+  if (!ONE_SEGMENT.test(pattern))
+    return;
+  return { kind: "parameter", name, ...optional ? { optional: true } : {}, constrained: true };
+}
+function segment(part, last, bareWildcard) {
+  if (!SYNTAX.test(part))
+    return pathText2.test(part) ? { kind: "literal", value: part } : undefined;
+  const wildcard = WILDCARD.exec(part);
+  if (wildcard || part === "(.*)") {
+    const optional = bareWildcard && wildcard !== null ? { optional: true } : {};
+    return last ? { kind: "catch-all", name: wildcard?.[1] ?? "*", ...optional } : undefined;
+  }
+  const alone = PLACEHOLDER.exec(part);
+  if (alone)
+    return placeholder(alone, last);
+  const first = FIRST_PLACEHOLDER.exec(part);
+  if (first === null || /[*(){}?+]/.test(part) || !pathText2.test(part))
+    return;
+  return { kind: "parameter", name: first[1], constrained: true };
+}
+function endpointPath(pattern, bareWildcard = false) {
+  const group = OPTIONAL_GROUP.exec(pattern);
+  if (group !== null) {
+    const path = endpointPath(pattern.slice(0, group.index), bareWildcard);
+    return path.at(-1)?.kind === "catch-all" ? path : [...path, { kind: "parameter", name: group[1], optional: true }];
+  }
+  const pieces = pattern.split("/").filter((part) => part !== "");
+  const path = [];
+  for (const [index, part] of pieces.entries()) {
+    const stated = segment(part, index === pieces.length - 1, bareWildcard);
+    if (stated === undefined)
+      return [...path, remainder(FIRST_PLACEHOLDER.exec(part)?.[1])];
+    path.push(stated);
+  }
+  return path;
+}
+function blockedPath(prefix) {
+  const path = endpointPath(prefix);
+  return [...path.at(-1)?.kind === "catch-all" ? path.slice(0, -1) : path, remainder()];
+}
+function readablePrefix(parts) {
+  const [first, second] = parts;
+  if (first?.kind !== "text")
+    return "";
+  if (second === undefined)
+    return first.text;
+  return first.text.slice(0, first.text.lastIndexOf("/") + 1);
+}
+
+// plugins/scanners/http-syntax.ts
+function wrapper(ts, node) {
+  return ts.isParenthesizedExpression(node) || ts.isAsExpression(node) || ts.isSatisfiesExpression(node) || ts.isNonNullExpression(node) || ts.isTypeAssertionExpression(node);
+}
+function unwrapped(ts, node) {
+  let current = node;
+  while (wrapper(ts, current))
+    current = current.expression;
+  return current;
+}
+function propertyKey(ts, property) {
+  const name = property.name;
+  if (name === undefined)
+    return;
+  return ts.isIdentifier(name) || ts.isStringLiteral(name) || ts.isNumericLiteral(name) ? name.text : undefined;
+}
+function ownProperty(ts, object, name) {
+  let found = "absent";
+  for (const property of object.properties) {
+    const key = propertyKey(ts, property);
+    if (key === undefined || ts.isGetAccessorDeclaration(property) || ts.isSetAccessorDeclaration(property))
+      return "unknown";
+    if (key === name)
+      found = ts.isPropertyAssignment(property) ? { node: property.initializer } : "unknown";
+  }
+  return found;
+}
+function holderOf(ts, node) {
+  let current = node;
+  while (wrapper(ts, current.parent))
+    current = current.parent;
+  return ts.isVariableDeclaration(current.parent) ? current.parent : undefined;
+}
+function urlText(ts, node) {
+  if (ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node) || ts.isTemplateExpression(node))
+    return true;
+  return ts.isBinaryExpression(node) && node.operatorToken.kind === ts.SyntaxKind.PlusToken;
+}
+
+// plugins/scanners/http-uses.ts
+function patternPart(ts, parent, target) {
+  if (ts.isPropertyAssignment(parent))
+    return parent.initializer === target;
+  return ts.isArrayLiteralExpression(parent) || ts.isObjectLiteralExpression(parent) || ts.isSpreadElement(parent) || ts.isSpreadAssignment(parent) || ts.isShorthandPropertyAssignment(parent) || wrapper(ts, parent);
+}
+function assignment(ts, parent, direct) {
+  const operator = parent.operatorToken.kind;
+  if (operator < ts.SyntaxKind.FirstAssignment || operator > ts.SyntaxKind.LastAssignment)
+    return;
+  return operator === ts.SyntaxKind.EqualsToken && direct ? { assigned: parent.right } : {};
+}
+function counted(ts, parent) {
+  return (ts.isPrefixUnaryExpression(parent) || ts.isPostfixUnaryExpression(parent)) && (parent.operator === ts.SyntaxKind.PlusPlusToken || parent.operator === ts.SyntaxKind.MinusMinusToken);
+}
+function writeOf(ts, node) {
+  let target = node;
+  while (patternPart(ts, target.parent, target))
+    target = target.parent;
+  const parent = target.parent;
+  const direct = target === node || wrapper(ts, target);
+  if (ts.isBinaryExpression(parent) && parent.left === target)
+    return assignment(ts, parent, direct);
+  if ((ts.isForInStatement(parent) || ts.isForOfStatement(parent)) && parent.initializer === target)
+    return {};
+  return direct && (counted(ts, parent) || ts.isDeleteExpression(parent)) ? {} : undefined;
+}
+function literalKey(ts, node) {
+  return ts.isStringLiteral(node) || ts.isNumericLiteral(node) ? node.text : undefined;
+}
+function calledThrough(ts, node) {
+  const parent = node.parent;
+  if (ts.isCallExpression(parent) || ts.isNewExpression(parent))
+    return parent.expression === node;
+  return ts.isTaggedTemplateExpression(parent) && parent.tag === node;
+}
+function accessKey(ts, parent, object) {
+  if (ts.isPropertyAccessExpression(parent)) {
+    return parent.expression === object && ts.isIdentifier(parent.name) ? parent.name.text : undefined;
+  }
+  if (!ts.isElementAccessExpression(parent) || parent.expression !== object)
+    return;
+  return literalKey(ts, parent.argumentExpression);
+}
+function useOf(ts, reference) {
+  let chain = reference;
+  let receiver;
+  const path = [];
+  for (;; ) {
+    const parent = chain.parent;
+    if (wrapper(ts, parent)) {
+      chain = parent;
+      continue;
+    }
+    const key = accessKey(ts, parent, chain);
+    if (key === undefined)
+      break;
+    receiver = chain;
+    path.push(key);
+    chain = parent;
+  }
+  const write = writeOf(ts, chain);
+  if (write !== undefined)
+    return { kind: "write", path, reference, value: chain, ...write };
+  if (receiver !== undefined && calledThrough(ts, chain)) {
+    return { kind: path.length > 1 ? "read" : "escape", path: path.slice(0, -1), reference, value: receiver };
+  }
+  return { kind: path.length > 0 ? "read" : "escape", path, reference, value: chain };
+}
+function importedName(ts, node) {
+  const parent = node.parent;
+  if (ts.isImportClause(parent))
+    return parent.name === node;
+  return (ts.isImportSpecifier(parent) || ts.isNamespaceImport(parent) || ts.isImportEqualsDeclaration(parent)) && parent.name === node;
+}
+function typePosition(ts, node) {
+  let current = node;
+  while (ts.isQualifiedName(current.parent))
+    current = current.parent;
+  return ts.isTypeQueryNode(current.parent);
+}
+function exportStatement(ts, node) {
+  const parent = node.parent;
+  return ts.isExportSpecifier(parent) || ts.isExportAssignment(parent) && parent.expression === node;
+}
+function exported(ts, declaration) {
+  const statement = declaration.parent.parent;
+  return statement?.modifiers?.some((modifier) => modifier.kind === ts.SyntaxKind.ExportKeyword) === true;
+}
+function topLevel(ts, declaration) {
+  const statement = declaration.parent?.parent;
+  return statement?.parent !== undefined && ts.isSourceFile(statement.parent);
+}
+function scriptFile(ts, source, names) {
+  if (ts.isExternalModule(source) || /\.[cm]js$/.test(source.fileName))
+    return false;
+  const required = (names.get("require") ?? []).some((node) => ts.isCallExpression(node.parent) && node.parent.expression === node);
+  const exporting = ["module", "exports"].some((name) => (names.get(name) ?? []).some((node) => ts.isPropertyAccessExpression(node.parent) && node.parent.expression === node));
+  return !required && !exporting;
+}
+function dynamicBinding(ts, call) {
+  let holder = call;
+  let awaited = false;
+  while (ts.isAwaitExpression(holder.parent) || ts.isParenthesizedExpression(holder.parent)) {
+    awaited ||= ts.isAwaitExpression(holder.parent);
+    holder = holder.parent;
+  }
+  const parent = holder.parent;
+  if (ts.isVariableDeclaration(parent))
+    return awaited && ts.isIdentifier(parent.name) ? parent.name : undefined;
+  const then = ts.isPropertyAccessExpression(parent) && parent.expression === holder && !awaited ? parent.parent : undefined;
+  const callback = then !== undefined && ts.isCallExpression(then) ? then.arguments[0] : undefined;
+  if (callback === undefined || !ts.isArrowFunction(callback) && !ts.isFunctionExpression(callback))
+    return;
+  const [first] = callback.parameters;
+  return first !== undefined && ts.isIdentifier(first.name) ? first.name : undefined;
+}
+function requiredModule(ts, node) {
+  if (node !== undefined && ts.isExternalModuleReference(node))
+    return ts.isStringLiteral(node.expression) ? node.expression.text : undefined;
+  if (node === undefined || !ts.isCallExpression(node) || !ts.isIdentifier(node.expression) || node.expression.text !== "require")
+    return;
+  const [specifier] = node.arguments;
+  return specifier !== undefined && ts.isStringLiteral(specifier) ? specifier.text : undefined;
+}
+function importModule(ts, statement, name) {
+  return ts.isImportDeclaration(statement) && ts.isStringLiteral(statement.moduleSpecifier) ? { module: statement.moduleSpecifier.text, name } : undefined;
+}
+function requiredValue(ts, initializer) {
+  const value = initializer === undefined ? undefined : unwrapped(ts, initializer);
+  const direct = requiredModule(ts, value);
+  if (direct !== undefined)
+    return { module: direct, name: "default" };
+  if (value === undefined || !ts.isPropertyAccessExpression(value) || !ts.isIdentifier(value.name))
+    return;
+  const module = requiredModule(ts, unwrapped(ts, value.expression));
+  return module === undefined ? undefined : { module, name: value.name.text };
+}
+function boundExport(ts, declaration) {
+  if (ts.isImportClause(declaration))
+    return importModule(ts, declaration.parent, "default");
+  if (ts.isNamespaceImport(declaration))
+    return importModule(ts, declaration.parent.parent, "*");
+  if (ts.isImportSpecifier(declaration)) {
+    return importModule(ts, declaration.parent.parent.parent, (declaration.propertyName ?? declaration.name).text);
+  }
+  if (ts.isImportEqualsDeclaration(declaration))
+    return requiredValue(ts, declaration.moduleReference);
+  if (ts.isVariableDeclaration(declaration))
+    return requiredValue(ts, declaration.initializer);
+  if (!ts.isBindingElement(declaration))
+    return;
+  const variable = declaration.parent.parent;
+  const module = ts.isVariableDeclaration(variable) ? requiredModule(ts, variable.initializer) : undefined;
+  const key = declaration.propertyName ?? declaration.name;
+  return module !== undefined && key !== undefined && ts.isIdentifier(key) ? { module, name: key.text } : undefined;
+}
+function defaultImport(ts, name) {
+  const declaration = name.parent;
+  const origin = declaration.name === name ? boundExport(ts, declaration) : undefined;
+  return origin?.name === "default" ? { declaration, module: origin.module } : undefined;
+}
+function indexName(ts, index, node) {
+  const same = index.names.get(node.text);
+  if (same === undefined)
+    index.names.set(node.text, [node]);
+  else
+    same.push(node);
+  if (importedName(ts, node))
+    index.imported.add(node.text);
+  const imported = defaultImport(ts, node);
+  if (imported !== undefined)
+    index.defaults.set(imported.module, [...index.defaults.get(imported.module) ?? [], imported.declaration]);
+}
+function indexSources(ts, sources) {
+  const index = { names: new Map, imported: new Set, dynamic: [], defaults: new Map };
+  const visit = (node) => {
+    if (ts.isIdentifier(node))
+      indexName(ts, index, node);
+    if (ts.isCallExpression(node) && node.expression.kind === ts.SyntaxKind.ImportKeyword) {
+      const binding = dynamicBinding(ts, node);
+      index.dynamic.push({ call: node, ...binding === undefined ? {} : { binding } });
+    }
+    ts.forEachChild(node, visit);
+  };
+  for (const source of sources)
+    visit(source);
+  return index;
+}
+function startsWith(path, prefix) {
+  return prefix.length <= path.length && prefix.every((name, index) => path[index] === name);
+}
+function useAt(ts, node) {
+  const parent = node.parent;
+  if (ts.isVariableDeclaration(parent) && parent.name === node)
+    return { kind: "write", path: [], reference: node, value: node };
+  if (exportStatement(ts, node))
+    return { kind: "export", path: [], reference: node, value: node };
+  const accessed = ts.isPropertyAccessExpression(parent) && parent.name === node;
+  return useOf(ts, accessed ? parent : node);
+}
+function objectUse(ts, node) {
+  const parent = node.parent;
+  const named = ts.isPropertyAccessExpression(parent) && parent.expression === node && ts.isIdentifier(parent.name);
+  const declaring = (ts.isVariableDeclaration(parent) || ts.isParameter(parent)) && parent.name === node;
+  return !named && !declaring && !importedName(ts, node) && !typePosition(ts, node);
+}
+function settingEffect(use, path, keys) {
+  if (use.path.length === 0 || use.kind === "export")
+    return { kind: "none" };
+  if (startsWith(path, use.path))
+    return { kind: "changes" };
+  const key = startsWith(use.path, path) ? use.path[path.length] : undefined;
+  if (key === undefined || !keys.includes(key))
+    return { kind: "none" };
+  if (use.assigned !== undefined && use.path.length === path.length + 1)
+    return { kind: "assigns", key, value: use.assigned };
+  return { kind: "changes" };
+}
+
+// plugins/scanners/http-bindings.ts
+function bindingUses(ts, checker, sources, options) {
+  let index;
+  const indexed = () => {
+    index ??= indexSources(ts, sources);
+    return index;
+  };
+  const uses = new Map;
+  const symbols = new Map;
+  const shorthand = (node) => ts.isShorthandPropertyAssignment(node.parent) && node.parent.name === node;
+  const resolveAll = (names) => {
+    const pending = names.filter((node) => !symbols.has(node) && !shorthand(node));
+    const batch = pending.length === 0 ? Promise.resolve([]) : checker.symbolsAt(pending);
+    for (const [position, node] of pending.entries())
+      symbols.set(node, batch.then((found) => found[position]));
+  };
+  const symbolOf = (node) => {
+    let found = symbols.get(node);
+    if (found === undefined) {
+      found = shorthand(node) ? checker.shorthandValue(node.parent) : checker.symbolsAt([node]).then(([symbol]) => symbol);
+      symbols.set(node, found);
+    }
+    return found;
+  };
+  const refersTo = async (node, declaration) => {
+    const symbol = await symbolOf(node);
+    if (symbol === undefined || node.parent === declaration)
+      return false;
+    if (await checker.declaration(symbol) === declaration)
+      return true;
+    if (importedName(ts, node))
+      return false;
+    return await checker.declaration(await checker.aliased(symbol)) === declaration;
+  };
+  const usesOf = (declaration) => {
+    let found = uses.get(declaration);
+    if (found !== undefined)
+      return found;
+    found = (async () => {
+      const { names, imported } = indexed();
+      const name = declaration.name !== undefined && ts.isIdentifier(declaration.name) ? declaration.name.text : undefined;
+      const texts = name === undefined ? [] : [name, "default", ...imported];
+      const candidates = [...new Set(texts.flatMap((text) => names.get(text) ?? []))].filter((node) => !typePosition(ts, node));
+      resolveAll(candidates);
+      const referring = await Promise.all(candidates.map((node) => refersTo(node, declaration)));
+      return candidates.filter((_, position) => referring[position]).map((node) => useAt(ts, node));
+    })();
+    uses.set(declaration, found);
+    return found;
+  };
+  const dynamicEscapes = async ({ binding }) => {
+    if (binding === undefined)
+      return true;
+    const bound = await symbolOf(binding);
+    const references = indexed().names.get(binding.text) ?? [];
+    resolveAll(references);
+    for (const node of references) {
+      const symbol = await symbolOf(node);
+      if (bound !== undefined && symbol !== undefined && checker.same(symbol, bound) && objectUse(ts, node))
+        return true;
+    }
+    return false;
+  };
+  const moduleOf = async (node) => {
+    const symbol = await symbolOf(node);
+    const module = symbol === undefined ? undefined : await checker.aliased(symbol);
+    return module !== undefined && checker.module(module) ? module : undefined;
+  };
+  const loadedModule = async (entry) => {
+    const [argument] = entry.call.arguments;
+    const [module] = argument === undefined ? [] : await checker.symbolsAt([argument]);
+    return module !== undefined && await dynamicEscapes(entry) ? module : undefined;
+  };
+  const escapedModules = async () => {
+    const { names, imported, dynamic } = indexed();
+    const importedNames = [...imported].flatMap((text) => names.get(text) ?? []).filter((node) => objectUse(ts, node));
+    resolveAll(importedNames);
+    const found = await Promise.all([...importedNames.map(moduleOf), ...dynamic.map(loadedModule)]);
+    const modules = [];
+    for (const module of found) {
+      if (module !== undefined && !modules.some((known) => checker.same(known, module)))
+        modules.push(module);
+    }
+    return modules;
+  };
+  let reachable;
+  const escapedExports = () => {
+    reachable ??= (async () => {
+      const exports = (await Promise.all((await escapedModules()).map((module) => checker.exportsOf(module)))).flat();
+      const declarations = await Promise.all(exports.map(async (symbol) => checker.declaration(await checker.aliased(symbol))));
+      return new Set(declarations.filter((declaration) => declaration !== undefined));
+    })();
+    return reachable;
+  };
+  const script = () => options.fileAlone && sources.some((source) => scriptFile(ts, source, indexed().names));
+  const leaves = async (declaration) => {
+    if (!options.fileAlone)
+      return (await escapedExports()).has(declaration);
+    return exported(ts, declaration) || topLevel(ts, declaration) && script();
+  };
+  const readChanges = async (use) => use.kind !== "read" || !await checker.primitiveAt(use.value);
+  const changes = async (use, path, reference) => {
+    if (use.reference === reference || !startsWith(path, use.path))
+      return false;
+    return use.kind === "export" ? options.fileAlone : readChanges(use);
+  };
+  const settingAt = async (settings, use, path, keys) => {
+    const effect = settingEffect(use, path, keys);
+    if (effect.kind === "assigns")
+      settings.assigned.set(effect.key, [...settings.assigned.get(effect.key) ?? [], effect.value]);
+    else if (effect.kind === "changes")
+      settings.changed ||= await readChanges(use);
+  };
+  return {
+    async unchanged(declaration, path, reference) {
+      if (await leaves(declaration))
+        return false;
+      for (const use of await usesOf(declaration))
+        if (await changes(use, path, reference))
+          return false;
+      return true;
+    },
+    async reassigned(declaration) {
+      if (options.fileAlone && topLevel(ts, declaration) && script())
+        return true;
+      return (await usesOf(declaration)).some((use) => use.kind === "write" && use.path.length === 0);
+    },
+    async settings(declaration, path, keys) {
+      const settings = { assigned: new Map, changed: await leaves(declaration) };
+      for (const use of await usesOf(declaration))
+        await settingAt(settings, use, path, keys);
+      return settings;
+    },
+    defaultImports: (module) => indexed().defaults.get(module) ?? [],
+    references: async (declaration) => (await usesOf(declaration)).map((use) => use.reference),
+    named: (text) => indexed().names.get(text) ?? [],
+    fileAlone: options.fileAlone
+  };
+}
+
+// plugins/scanners/http-values.ts
+function urlContext(ts, checker, sources, fileAlone = false) {
+  return { ts, checker, bindings: bindingUses(ts, checker, sources, { fileAlone }) };
+}
+var MAX_DEPTH = 8;
+function declarationFile(node) {
+  return /\.d\.[cm]?ts$/.test(node.getSourceFile().fileName);
+}
+async function declarationOf(context, node) {
+  const { checker } = context;
+  const [symbol] = await checker.symbolsAt([node]);
+  return symbol === undefined ? undefined : checker.declaration(await checker.aliased(symbol));
+}
+var moduleNamesByFile = new WeakMap;
+function moduleNames(ts, source) {
+  let names = moduleNamesByFile.get(source);
+  if (names !== undefined)
+    return names;
+  const found = new Set;
+  const visit = (node) => {
+    const name = node.name;
+    if (name !== undefined && ts.isIdentifier(name) && boundExport(ts, node) !== undefined)
+      found.add(name.text);
+    ts.forEachChild(node, visit);
+  };
+  visit(source);
+  names = found;
+  moduleNamesByFile.set(source, names);
+  return names;
+}
+async function importOrigin(context, node) {
+  const { ts, checker } = context;
+  const required = requiredModule(ts, node);
+  if (required !== undefined)
+    return { module: required, name: "default" };
+  if (!ts.isIdentifier(node) || !moduleNames(ts, node.getSourceFile()).has(node.text))
+    return;
+  const [symbol] = await checker.symbolsAt([node]);
+  const declaration = symbol === undefined ? undefined : await checker.declaration(symbol);
+  const origin = declaration === undefined ? undefined : boundExport(ts, declaration);
+  if (origin === undefined || !ts.isVariableDeclaration(declaration) && !ts.isBindingElement(declaration))
+    return origin;
+  return await unassigned(context, declaration) ? origin : undefined;
+}
+async function runtimeGlobal(context, node) {
+  if (await importOrigin(context, node) !== undefined)
+    return false;
+  const declaration = await declarationOf(context, node);
+  return declaration === undefined || declarationFile(declaration);
+}
+function ambient(ts, declaration) {
+  const flag = ts.NodeFlags.Ambient ?? 0;
+  return ((declaration.flags ?? 0) & flag) !== 0;
+}
+async function unassigned(context, declaration) {
+  const { ts, checker } = context;
+  const list = ts.isVariableDeclaration(declaration) ? declaration.parent : declaration.parent.parent.parent;
+  if (((list.flags ?? 0) & ts.NodeFlags.Const) !== 0)
+    return true;
+  if (declaration.name === undefined)
+    return false;
+  const [symbol] = await checker.symbolsAt([declaration.name]);
+  return symbol !== undefined && checker.declarationCount(symbol) === 1 && !await context.bindings.reassigned(declaration);
+}
+async function variableHeld(context, name, path, depth) {
+  const { ts } = context;
+  const declaration = await declarationOf(context, name);
+  if (declaration === undefined || declarationFile(declaration) || ambient(ts, declaration))
+    return "unseen";
+  if (path.length === 0 && ts.isFunctionDeclaration(declaration))
+    return { node: declaration };
+  if (!ts.isVariableDeclaration(declaration) || declaration.initializer === undefined)
+    return "unknown";
+  if (!ts.isIdentifier(declaration.name) || !await unassigned(context, declaration))
+    return "unknown";
+  if (path.length > 0 && !await context.bindings.unchanged(declaration, path, name))
+    return "unknown";
+  return held(context, declaration.initializer, path, depth + 1);
+}
+async function extendsClass(context, klass, base, depth = 0) {
+  const { ts } = context;
+  if (!ts.isClassLike(klass) || depth > MAX_DEPTH)
+    return false;
+  const clauses = klass.heritageClauses ?? [];
+  const clause = Array.from(clauses).find((entry) => entry.token === ts.SyntaxKind.ExtendsKeyword);
+  const parent = clause?.types[0];
+  const declaration = parent === undefined ? undefined : await declarationOf(context, parent.expression);
+  return declaration !== undefined && (declaration === base || extendsClass(context, declaration, base, depth + 1));
+}
+async function assignmentAt(context, node, same, declaration) {
+  const { ts } = context;
+  const parent = node.parent;
+  if (ts.isPropertyAccessExpression(parent) && parent.name === node) {
+    const use = same ? useAt(ts, node) : undefined;
+    return use?.kind === "write" ? { value: use.path.length === 0 ? use.assigned : undefined } : undefined;
+  }
+  if (!ts.isPropertyDeclaration(parent) || parent.name !== node || declaration === undefined || parent === declaration)
+    return;
+  return await extendsClass(context, parent.parent, declaration.parent) ? { value: parent.initializer } : undefined;
+}
+async function fieldAssignments(context, name, declaration) {
+  const { ts, checker } = context;
+  const [symbol] = await checker.symbolsAt([name]);
+  const initialized = declaration !== undefined && (ts.isPropertyDeclaration(declaration) || ts.isPropertyAssignment(declaration)) ? declaration.initializer : undefined;
+  const assignments = initialized === undefined ? [] : [initialized];
+  const others = context.bindings.named(name.text).filter((node) => node !== name);
+  const symbols = await checker.symbolsAt(others);
+  for (const [position, node] of others.entries()) {
+    const found = symbols[position];
+    const same = found !== undefined && symbol !== undefined && checker.same(found, symbol);
+    const assignment = await assignmentAt(context, node, same, declaration);
+    if (assignment !== undefined)
+      assignments.push(assignment.value);
+  }
+  return assignments;
+}
+async function fieldHeld(context, access, path, depth) {
+  const { ts, checker } = context;
+  const [symbol] = await checker.symbolsAt([access.name]);
+  const declaration = symbol === undefined ? undefined : await checker.declaration(symbol);
+  const assignments = await fieldAssignments(context, access.name, declaration);
+  const injected = declaration !== undefined && ts.isParameter(declaration);
+  if (assignments.length === 0)
+    return "unseen";
+  const [only] = assignments;
+  if (injected || assignments.length > 1 || only === undefined || path.length > 0 || context.bindings.fileAlone)
+    return "unknown";
+  return held(context, only, path, depth + 1);
+}
+async function held(context, node, path, depth) {
+  const { ts } = context;
+  if (depth > MAX_DEPTH)
+    return "unknown";
+  const value = unwrapped(ts, node);
+  const [name, ...rest] = path;
+  if (ts.isObjectLiteralExpression(value) && name !== undefined) {
+    const property = ownProperty(ts, value, name);
+    if (typeof property !== "string")
+      return held(context, property.node, rest, depth + 1);
+    return property === "absent" && rest.length === 0 ? "absent" : "unknown";
+  }
+  if (ts.isPropertyAccessExpression(value) && ts.isIdentifier(value.name)) {
+    if (value.expression.kind === ts.SyntaxKind.ThisKeyword)
+      return fieldHeld(context, value, path, depth);
+    return held(context, value.expression, [value.name.text, ...path], depth + 1);
+  }
+  if (ts.isIdentifier(value))
+    return variableHeld(context, value, path, depth);
+  if (name === undefined)
+    return { node: value };
+  return ts.isMetaProperty(value) ? "unseen" : "unknown";
+}
+function heldAt(context, node, ...path) {
+  return held(context, node, path, 0);
+}
+async function heldParts(context, value) {
+  if (value === "unseen")
+    return [configuredPart];
+  return typeof value === "string" ? [computedPart] : urlParts(context, value.node);
+}
+async function urlParts(context, node, depth = 0) {
+  const { ts } = context;
+  if (depth > MAX_DEPTH)
+    return [computedPart];
+  const value = unwrapped(ts, node);
+  if (ts.isStringLiteral(value) || ts.isNoSubstitutionTemplateLiteral(value))
+    return [{ kind: "text", text: value.text }];
+  if (ts.isTemplateExpression(value)) {
+    const parts = [{ kind: "text", text: value.head.text }];
+    for (const span of value.templateSpans) {
+      parts.push(...await urlParts(context, span.expression, depth + 1), { kind: "text", text: span.literal.text });
+    }
+    return parts;
+  }
+  if (ts.isBinaryExpression(value) && value.operatorToken.kind === ts.SyntaxKind.PlusToken) {
+    return [...await urlParts(context, value.left, depth + 1), ...await urlParts(context, value.right, depth + 1)];
+  }
+  if (!ts.isIdentifier(value) && !ts.isPropertyAccessExpression(value))
+    return [computedPart];
+  const resolved = await held(context, value, [], depth + 1);
+  return typeof resolved === "string" ? heldParts(context, resolved) : urlParts(context, resolved.node, depth + 1);
+}
+async function literalText(context, node) {
+  if (node === undefined)
+    return;
+  const [first, ...rest] = await urlParts(context, node);
+  return rest.length === 0 && first?.kind === "text" ? first.text : undefined;
+}
+async function methodName(context, node) {
+  return methodText(await literalText(context, node));
+}
+async function objectEntries(context, node) {
+  const { ts } = context;
+  const value = node === undefined ? undefined : await heldAt(context, node);
+  if (typeof value !== "object" || !ts.isObjectLiteralExpression(value.node))
+    return;
+  const entries = new Map;
+  for (const property of value.node.properties) {
+    const key = propertyKey(ts, property);
+    if (key === undefined || ts.isGetAccessorDeclaration(property) || ts.isSetAccessorDeclaration(property))
+      return;
+    if (ts.isPropertyAssignment(property))
+      entries.set(key, property.initializer);
+    else
+      entries.delete(key);
+  }
+  return entries;
+}
+
+// plugins/scanners/http-routers.ts
+var routeMembers = new Map([
+  ["get", "GET"],
+  ["post", "POST"],
+  ["put", "PUT"],
+  ["patch", "PATCH"],
+  ["delete", "DELETE"],
+  ["head", "HEAD"],
+  ["options", "OPTIONS"],
+  ["all", "*"]
+]);
+var koaMembers = new Map([["del", "DELETE"], ["redirect", "*"]]);
+function routeMethod(member, framework) {
+  return routeMembers.get(member) ?? (framework === "koa" ? koaMembers.get(member) : undefined);
+}
+var unreadHonoMembers = new Set(["on", "basePath", "mount"]);
+var expressSettings = new Set(["set", "enable", "disable", "engine"]);
+var orderedFrameworks = new Set(["express", "hono", "koa"]);
+var expressApp = { kind: "app", framework: "express" };
+var fastifyApp = { kind: "app", framework: "fastify" };
+var koaApp = { kind: "app", framework: "koa" };
+var koaRouter = { kind: "router", framework: "koa" };
+var constructors = new Map([
+  ["express", { default: expressApp, "*": expressApp, Router: { kind: "router", framework: "express" } }],
+  ["fastify", { default: fastifyApp, "*": fastifyApp, fastify: fastifyApp }],
+  ["hono", { Hono: { kind: "app", framework: "hono" } }],
+  ["koa", { default: koaApp, "*": koaApp }],
+  ["@koa/router", { default: koaRouter, "*": koaRouter }],
+  ["koa-router", { default: koaRouter, "*": koaRouter }]
+]);
+async function routerPrefix(context, initializer) {
+  const [options] = initializer.arguments ?? [];
+  if (options === undefined)
+    return "";
+  const prefix = await heldAt(context, options, "prefix");
+  if (prefix === "absent")
+    return "";
+  return typeof prefix === "object" ? literalText(context, prefix.node) : undefined;
+}
+async function built(context, found, initializer, variable) {
+  if (found === undefined || !context.frameworks.has(found.framework))
+    return;
+  return { ...found, variable, prefix: found === koaRouter ? await routerPrefix(context, initializer) : "" };
+}
+async function registrarOf(context, initializer, variable) {
+  const { ts } = context;
+  if (!ts.isCallExpression(initializer) && !ts.isNewExpression(initializer))
+    return;
+  const callee = initializer.expression;
+  if (ts.isPropertyAccessExpression(callee)) {
+    const holder = await importOrigin(context, callee.expression);
+    const router = holder?.module === "express" && callee.name.text === "Router";
+    return built(context, router ? constructors.get("express").Router : undefined, initializer, variable);
+  }
+  const origin = await importOrigin(context, callee);
+  return built(context, origin === undefined ? undefined : constructors.get(origin.module)?.[origin.name], initializer, variable);
+}
+function walk(ts, node, visitor) {
+  visitor(node);
+  ts.forEachChild(node, (child) => walk(ts, child, visitor));
+}
+async function collectRegistrars(context, sources) {
+  const { ts } = context;
+  const declarations = [];
+  for (const source of sources) {
+    walk(ts, source, (node) => {
+      if (ts.isVariableDeclaration(node) && node.initializer !== undefined && ts.isIdentifier(node.name)) {
+        declarations.push(node);
+      }
+    });
+  }
+  const registrars = new Map;
+  for (const declaration of declarations) {
+    const registrar = await registrarOf(context, declaration.initializer, declaration.name.text);
+    if (registrar !== undefined && await unassigned(context, declaration))
+      registrars.set(declaration, registrar);
+  }
+  return registrars;
+}
+function candidate(member) {
+  return ["hono", "koa", "fastify"].some((framework) => registers(member, framework));
+}
+function memberOf(ts, call) {
+  return ts.isPropertyAccessExpression(call.expression) ? call.expression.name.text : undefined;
+}
+function registers(member, framework) {
+  if (unreadHonoMembers.has(member))
+    return framework === "hono";
+  if (koaMembers.has(member))
+    return framework === "koa";
+  if (member === "register")
+    return framework === "fastify";
+  if (member === "route")
+    return framework !== "koa";
+  return routeMembers.has(member) || member === "use";
+}
+function returnsRegistrar(member, framework) {
+  if (framework === "express" && expressSettings.has(member))
+    return true;
+  if (framework === "koa" && member === "prefix")
+    return true;
+  const builder = member === "route" && framework === "express" || member === "basePath";
+  return registers(member, framework) && !builder;
+}
+async function receiverDeclaration(context, call, registrars) {
+  const { ts } = context;
+  const receiver = ts.isPropertyAccessExpression(call.expression) ? call.expression.expression : undefined;
+  if (receiver !== undefined && ts.isCallExpression(receiver)) {
+    const member = memberOf(ts, receiver);
+    const declaration = member === undefined ? undefined : await receiverDeclaration(context, receiver, registrars);
+    if (member === undefined || declaration === undefined)
+      return;
+    return returnsRegistrar(member, registrars.get(declaration).framework) ? declaration : undefined;
+  }
+  if (receiver === undefined || !ts.isIdentifier(receiver))
+    return;
+  const declaration = await declarationOf(context, receiver);
+  return declaration !== undefined && registrars.has(declaration) ? declaration : undefined;
+}
+async function collectRegistrations(context, calls, registrars) {
+  const registrations = [];
+  for (const call of calls) {
+    const member = memberOf(context.ts, call);
+    if (member === undefined || !candidate(member))
+      continue;
+    const declaration = await receiverDeclaration(context, call, registrars);
+    if (declaration !== undefined && registers(member, registrars.get(declaration).framework)) {
+      registrations.push({ call, declaration, member });
+    }
+  }
+  return registrations;
+}
+async function applyPrefixes(context, calls, registrars) {
+  for (const call of calls) {
+    if (memberOf(context.ts, call) !== "prefix")
+      continue;
+    const declaration = await receiverDeclaration(context, call, registrars);
+    const registrar = declaration === undefined ? undefined : registrars.get(declaration);
+    if (registrar?.framework !== "koa" || registrar.kind !== "router")
+      continue;
+    const stated = await literalText(context, call.arguments[0]);
+    registrars.set(declaration, { ...registrar, prefix: registrar.prefix === "" ? stated : undefined });
+  }
+}
+function mounting(registration) {
+  return registration.member === "use" || registration.member === "route" && registration.call.arguments.length > 1;
+}
+function atTopLevel(ts, node) {
+  let current = node;
+  while (!ts.isSourceFile(current.parent)) {
+    current = current.parent;
+    if (ts.isFunctionLike(current) || ts.isClassLike(current))
+      return false;
+  }
+  return ts.isExpressionStatement(current) || ts.isVariableStatement(current);
+}
+function handedOn(ts, reference, mounts) {
+  const parent = reference.parent;
+  if (ts.isPropertyAccessExpression(parent) && parent.expression === reference)
+    return false;
+  return !mounts.has(parent);
+}
+function exportOf(ts, reference) {
+  const parent = reference.parent;
+  if (ts.isExportAssignment(parent) || ts.isExportSpecifier(parent))
+    return "last";
+  const assigned = ts.isBinaryExpression(parent) && parent.right === reference && parent.operatorToken.kind === ts.SyntaxKind.EqualsToken && commonJsExport(ts, parent.left);
+  if (!assigned)
+    return;
+  return atTopLevel(ts, parent) ? "last" : "anywhere";
+}
+function exportedDeclaration(ts, declaration) {
+  if (!ts.isVariableDeclaration(declaration))
+    return false;
+  return declaration.parent.parent.modifiers?.some((modifier) => modifier.kind === ts.SyntaxKind.ExportKeyword) === true;
+}
+var httpModules = new Set(["http", "https", "node:http", "node:https"]);
+function commonJsExport(ts, node) {
+  if (!ts.isPropertyAccessExpression(node))
+    return false;
+  const root = node.expression;
+  if (!ts.isIdentifier(root))
+    return commonJsExport(ts, root);
+  return root.text === "exports" || root.text === "module" && node.name.text === "exports";
+}
+async function serving(context, reference) {
+  const { ts } = context;
+  const parent = reference.parent;
+  if (!ts.isCallExpression(parent) || !parent.arguments.some((argument) => argument === reference))
+    return false;
+  const callee = parent.expression;
+  if (ts.isPropertyAccessExpression(callee)) {
+    const holder = await importOrigin(context, callee.expression);
+    return callee.name.text === "createServer" && httpModules.has(holder?.module ?? "");
+  }
+  const origin = await importOrigin(context, callee);
+  if (origin === undefined)
+    return false;
+  return origin.name === "serve" || origin.name === "createServer" && httpModules.has(origin.module);
+}
+function registeringFiles(declaration, registrations) {
+  const files = new Set([declaration.getSourceFile()]);
+  for (const registration of registrations) {
+    if (registration.declaration === declaration)
+      files.add(registration.call.getSourceFile());
+  }
+  return files;
+}
+async function handOffAt(context, reference, declaration, mounts) {
+  const { ts } = context;
+  const exported = exportOf(ts, reference);
+  if (exported !== undefined)
+    return context.exportsHandOff ? { reference, declaration, last: exported === "last" } : undefined;
+  if (!handedOn(ts, reference, mounts) || await serving(context, reference))
+    return;
+  return { reference, declaration, last: false };
+}
+async function collectHandOffs(context, registrars, registrations) {
+  const mounts = new Set(registrations.filter(mounting).map(({ call }) => call));
+  const handOffs = [];
+  for (const declaration of registrars.keys()) {
+    if (context.exportsHandOff && exportedDeclaration(context.ts, declaration))
+      handOffs.push({ reference: declaration, declaration, last: true });
+    const files = registeringFiles(declaration, registrations);
+    for (const reference of await context.bindings.references(declaration)) {
+      const found = files.has(reference.getSourceFile()) ? await handOffAt(context, reference, declaration, mounts) : undefined;
+      if (found !== undefined)
+        handOffs.push(found);
+    }
+  }
+  return handOffs;
+}
+function entryStart(ts, node) {
+  return ts.isCallExpression(node) && ts.isPropertyAccessExpression(node.expression) ? node.expression.name.getStart() : node.getStart();
+}
+function orderIndices(ts, registrations, handOffs) {
+  const entries = [
+    ...registrations.map(({ call, declaration }) => ({ node: call, declaration, start: entryStart(ts, call), last: false })),
+    ...handOffs.map(({ reference, declaration, last }) => ({
+      node: reference,
+      declaration,
+      start: last ? Number.POSITIVE_INFINITY : reference.getStart(),
+      last
+    }))
+  ];
+  const byRegistrar = new Map;
+  for (const entry of entries)
+    byRegistrar.set(entry.declaration, [...byRegistrar.get(entry.declaration) ?? [], entry]);
+  const indices = new Map;
+  for (const list of byRegistrar.values()) {
+    const files = new Set(list.map(({ node }) => node.getSourceFile()));
+    if (files.size !== 1 || !list.every(({ node, last }) => last || atTopLevel(ts, node)))
+      continue;
+    const sorted = [...list].sort((left, right) => left.start - right.start);
+    for (const [index, { node }] of sorted.entries())
+      indices.set(node, index);
+  }
+  return indices;
+}
+async function routerRegistrations(context, sources, calls) {
+  const registrars = await collectRegistrars(context, sources);
+  await applyPrefixes(context, calls, registrars);
+  const registrations = await collectRegistrations(context, calls, registrars);
+  const handOffs = await collectHandOffs(context, registrars, registrations);
+  return { registrars, registrations, handOffs, indices: orderIndices(context.ts, registrations, handOffs) };
+}
+
+// plugins/scanners/http-routes.ts
+async function registrarArgument(reading, argument) {
+  const { ts } = reading.context;
+  const named = ts.isCallExpression(argument) && ts.isPropertyAccessExpression(argument.expression) && argument.expression.name.text === "routes" ? argument.expression.expression : argument;
+  if (!ts.isIdentifier(named))
+    return;
+  const declaration = await declarationOf(reading.context, named);
+  return declaration !== undefined && reading.registrars.has(declaration) ? declaration : undefined;
+}
+async function foreignRouter(reading, argument) {
+  const { context } = reading;
+  const { ts } = context;
+  if (await registrarArgument(reading, argument) !== undefined)
+    return false;
+  if (ts.isCallExpression(argument) && ts.isPropertyAccessExpression(argument.expression)) {
+    return argument.expression.name.text === "routes";
+  }
+  const origin = await importOrigin(context, argument);
+  if (origin?.module.startsWith(".") !== true)
+    return false;
+  const held = await heldAt(context, argument);
+  return typeof held !== "object" || !ts.isFunctionLike(held.node);
+}
+async function middleware(context, argument) {
+  const { ts } = context;
+  const held = await heldAt(context, argument);
+  if (typeof held === "object" && ts.isFunctionLike(held.node))
+    return true;
+  const callee = ts.isCallExpression(argument) ? argument.expression : argument;
+  const holder = ts.isPropertyAccessExpression(callee) ? callee.expression : callee;
+  const origin = await importOrigin(context, holder);
+  return origin !== undefined && !origin.module.startsWith(".");
+}
+async function readMount(reading, registration) {
+  const [first, ...rest] = registration.call.arguments;
+  if (first === undefined)
+    return { children: [], prefix: "", pathless: true, foreign: false };
+  const leading = await registrarArgument(reading, first);
+  const pathless = leading !== undefined || await foreignRouter(reading, first) || await middleware(reading.context, first);
+  const children = leading === undefined ? [] : [leading];
+  for (const argument of rest) {
+    const child = await registrarArgument(reading, argument);
+    if (child !== undefined)
+      children.push(child);
+  }
+  const prefix = pathless ? "" : await literalText(reading.context, first);
+  const foreign = children.length === 0 && (await Promise.all(registration.call.arguments.map((argument) => foreignRouter(reading, argument)))).some(Boolean);
+  return { children, pathless, foreign, ...prefix === undefined ? {} : { prefix } };
+}
+async function collectMounts(reading) {
+  const mounts = new Map;
+  const calls = new Map;
+  for (const registration of reading.registrations) {
+    if (!mounting(registration))
+      continue;
+    const mount = await readMount(reading, registration);
+    calls.set(registration, mount);
+    for (const [position, child] of mount.children.entries()) {
+      const entry = { registration, position, ...mount.prefix === undefined ? {} : { prefix: mount.prefix } };
+      mounts.set(child, [...mounts.get(child) ?? [], entry]);
+    }
+  }
+  return { mounts, calls };
+}
+function withPrefix(placement, registrar) {
+  return registrar.prefix === "" ? placement : { ...placement, prefix: `${placement.prefix}/${registrar.prefix}` };
+}
+function underMount(routing, mount, entry) {
+  const { ts } = routing.context;
+  const parent = routing.registrars.get(mount.declaration);
+  const copies = parent.framework === "hono" && mount.member === "route" || parent.framework === "koa" && parent.kind === "router" && mount.member === "use";
+  if (!copies)
+    return "yes";
+  const ordered = mount.call.getSourceFile() === entry.getSourceFile() && atTopLevel(ts, mount.call) && atTopLevel(ts, entry);
+  if (!ordered)
+    return "unknown";
+  return entryStart(ts, entry) < entryStart(ts, mount.call) ? "yes" : "no";
+}
+function placements(routing, declaration, entry, seen = new Set) {
+  const registrar = routing.registrars.get(declaration);
+  if (seen.has(declaration) || registrar.prefix === undefined)
+    return [];
+  const entries = routing.mounts.get(declaration) ?? [];
+  if (entries.length === 0) {
+    if (registrar.kind === "router")
+      return [];
+    const application = `${routing.context.file(declaration)}#${registrar.variable}`;
+    const ordered = orderedFrameworks.has(registrar.framework);
+    return [withPrefix({ prefix: "", application, rank: [], known: true, ordered, certain: true }, registrar)];
+  }
+  return entries.flatMap(({ registration, prefix, position }) => {
+    const under = prefix === undefined ? "no" : underMount(routing, registration, entry);
+    if (under === "no")
+      return [];
+    return placements(routing, registration.declaration, registration.call, new Set([...seen, declaration])).map((parent) => {
+      const at = below(parent, prefix, routing.indices.get(registration.call), position);
+      return { ...withPrefix(at, registrar), certain: parent.certain && under === "yes" };
+    });
+  });
+}
+async function methodList(context, node) {
+  if (node === undefined)
+    return [];
+  const values = context.ts.isArrayLiteralExpression(node) ? [...node.elements] : [node];
+  const methods = await Promise.all(values.map(async (value) => methodText(await literalText(context, value))));
+  return methods.every((method) => method !== undefined) ? methods : [];
+}
+function blocked(routing, placement, prefix, method, entry) {
+  if (!placement.ordered)
+    return [];
+  const at = below(placement, prefix, routing.indices.get(entry));
+  const operation = routing.context.callerOperation(entry);
+  return [{ endpoint: { operation, method, path: blockedPath(at.prefix) }, placement: at }];
+}
+function served(routing, placement, route, methods, operation, registration) {
+  if (!placement.certain)
+    return methods.flatMap((method) => blocked(routing, placement, route, method, registration.call));
+  const at = below(placement, route, routing.indices.get(registration.call));
+  const path = endpointPath(at.prefix, routing.registrars.get(registration.declaration).framework === "hono");
+  return methods.map((method) => ({ endpoint: { operation, method, path }, placement: at }));
+}
+async function option(context, options, name) {
+  const value = await heldAt(context, options, name);
+  return typeof value === "object" ? value.node : undefined;
+}
+async function routeOptions(routing, registration, placement) {
+  const { context } = routing;
+  const { call } = registration;
+  const argument = call.arguments[0];
+  const options = await heldAt(context, argument);
+  if (typeof options !== "object" || !context.ts.isObjectLiteralExpression(options.node)) {
+    return blocked(routing, placement, readablePrefix(await urlParts(context, argument)), "*", call);
+  }
+  const url = await literalText(context, await option(context, argument, "url"));
+  const methods = await methodList(context, await option(context, argument, "method"));
+  if (url === undefined || methods.length === 0)
+    return blocked(routing, placement, url ?? "", "*", call);
+  const operation = await context.handlerOperation(await option(context, argument, "handler"), call);
+  return served(routing, placement, url, methods, operation, registration);
+}
+async function unreadCall(routing, registration, placement) {
+  const { call, member } = registration;
+  const { context } = routing;
+  const [first, second] = call.arguments;
+  const path = member === "on" ? second : first;
+  const prefix = path === undefined ? "" : readablePrefix(await urlParts(context, path));
+  const method = member === "on" ? methodText(await literalText(context, first)) : undefined;
+  return blocked(routing, placement, prefix, method ?? "*", call);
+}
+async function registerCall(routing, registration, placement) {
+  const { call } = registration;
+  const options = call.arguments[1];
+  const prefix = options === undefined ? "absent" : await heldAt(routing.context, options, "prefix");
+  const readable = typeof prefix === "object" ? readablePrefix(await urlParts(routing.context, prefix.node)) : "";
+  const at = below(placement, readable);
+  return [{ endpoint: { operation: routing.context.callerOperation(call), method: "*", path: blockedPath(at.prefix) }, placement: at }];
+}
+async function pathArgument(routing, registration) {
+  const [first, second] = registration.call.arguments;
+  const named = registration.member !== "redirect" && registration.call.arguments.length > 2 && routing.registrars.get(registration.declaration).framework === "koa";
+  const name = named ? await literalText(routing.context, first) : undefined;
+  return name !== undefined && !name.startsWith("/") ? second : first;
+}
+async function routeCall(routing, registration, placement) {
+  const { call, member } = registration;
+  const framework = routing.registrars.get(registration.declaration).framework;
+  if (unreadHonoMembers.has(member))
+    return unreadCall(routing, registration, placement);
+  if (member === "register")
+    return registerCall(routing, registration, placement);
+  if (member === "route" && call.arguments.length === 1)
+    return routeOptions(routing, registration, placement);
+  const method = routeMethod(member, framework);
+  if (method === undefined || call.arguments.length < 2)
+    return [];
+  const parts = await urlParts(routing.context, await pathArgument(routing, registration));
+  const route = parts.length === 1 && parts[0].kind === "text" ? parts[0].text : undefined;
+  if (route === undefined || member === "redirect" && !route.startsWith("/")) {
+    return blocked(routing, placement, route === undefined ? readablePrefix(parts) : "", method, call);
+  }
+  const handler = member === "redirect" ? undefined : call.arguments[call.arguments.length - 1];
+  return served(routing, placement, route, [method], await routing.context.handlerOperation(handler, call), registration);
+}
+async function mountCall(routing, registration, placement) {
+  const { call } = registration;
+  const mount = routing.calls.get(registration);
+  const hidden = mount.children.some((child) => routing.registrars.get(child).prefix === undefined);
+  const unfollowed = mount.prefix === undefined ? mount.children.length > 0 : !mount.pathless && mount.children.length === 0 && call.arguments.length > 1;
+  if (!hidden && !mount.foreign && !unfollowed)
+    return [];
+  const parts = await urlParts(routing.context, call.arguments[0]);
+  return blocked(routing, placement, mount.prefix ?? readablePrefix(parts), "*", call);
+}
+async function registrationEndpoints(routing, registration) {
+  const placed = [];
+  for (const placement of placements(routing, registration.declaration, registration.call)) {
+    placed.push(...await (mounting(registration) ? mountCall : routeCall)(routing, registration, placement));
+  }
+  return placed;
+}
+async function routerEndpoints(context, sources, calls) {
+  const reading = { ...await routerRegistrations(context, sources, calls), context };
+  const routing = { ...reading, ...await collectMounts(reading) };
+  const placed = routing.handOffs.flatMap(({ reference, declaration }) => placements(routing, declaration, reference).flatMap((placement) => blocked(routing, placement, "", "*", reference)));
+  for (const registration of routing.registrations)
+    placed.push(...await registrationEndpoints(routing, registration));
+  return placed;
+}
+async function bunServe(context, call) {
+  const { ts } = context;
+  const callee = call.expression;
+  if (ts.isPropertyAccessExpression(callee)) {
+    const receiver = callee.expression;
+    return ts.isIdentifier(receiver) && receiver.text === "Bun" && callee.name.text === "serve" && await runtimeGlobal(context, receiver);
+  }
+  const origin = await importOrigin(context, callee);
+  return origin?.module === "bun" && origin.name === "serve";
+}
+function serveMethod(key) {
+  const method = methodText(key);
+  return method !== undefined && [...routeMembers.values()].includes(method) ? method : undefined;
+}
+async function serveRoute(context, route, value, call) {
+  const path = endpointPath(route);
+  const byMethod = await objectEntries(context, value);
+  if (byMethod === undefined) {
+    const held = await heldAt(context, value);
+    const handler = typeof held === "object" && context.ts.isFunctionLike(held.node);
+    return handler ? [{ operation: await context.handlerOperation(value, call), method: "*", path }] : [];
+  }
+  const endpoints = [];
+  for (const [key, handler] of byMethod) {
+    const method = serveMethod(key);
+    if (method !== undefined)
+      endpoints.push({ operation: await context.handlerOperation(handler, call), method, path });
+  }
+  return endpoints;
+}
+async function serveEndpoints(context, calls) {
+  const endpoints = [];
+  for (const call of calls) {
+    const [options] = call.arguments;
+    if (options === undefined || !await bunServe(context, call))
+      continue;
+    const routes = await heldAt(context, options, "routes");
+    const entries = typeof routes === "object" ? await objectEntries(context, routes.node) : undefined;
+    for (const [route, value] of entries ?? [])
+      endpoints.push(...await serveRoute(context, route, value, call));
+  }
+  return endpoints;
+}
+
+// plugins/scanners/javascript/src/http-requests.ts
+import ts3 from "./typescript.cjs";
+
+// plugins/scanners/http-clients.ts
+async function declaredMethod(context, options, fallback) {
+  if (options === undefined)
+    return fallback;
+  const declared = await heldAt(context, options, "method");
+  if (declared === "absent")
+    return fallback;
+  return typeof declared === "string" ? undefined : methodName(context, declared.node);
+}
+async function optionsBase(context, config, fallback) {
+  if (config === undefined)
+    return fallback;
+  const base = await heldAt(context, config, "baseURL");
+  return base === "absent" ? fallback : heldParts(context, base);
+}
+async function runtimeFetch(context, callee) {
+  if (!context.ts.isIdentifier(callee) || callee.text !== "fetch")
+    return;
+  const origin = await importOrigin(context, callee);
+  const fetch = origin === undefined ? await runtimeGlobal(context, callee) : origin.module === "node-fetch" && origin.name === "default";
+  return fetch ? "fetch" : undefined;
+}
+async function fetchRequest(context, call, client) {
+  const [url, options] = call.arguments;
+  const kind = url === undefined ? undefined : await client(call.expression);
+  if (url === undefined || kind === undefined)
+    return;
+  const input = await heldAt(context, url);
+  const method = input === "unseen" || typeof input === "object" && urlText(context.ts, input.node) ? await declaredMethod(context, options, "GET") : undefined;
+  const parts = await urlParts(context, url);
+  const target = kind === "ofetch" ? withBase(await optionsBase(context, options, []), parts) : parts;
+  return { ...method === undefined ? {} : { method }, ...requestUrl(target) };
+}
+async function withDefaults(context, client, holders) {
+  const found = await Promise.all(holders.map((holder) => context.bindings.settings(holder, ["defaults"], ["baseURL", "method"])));
+  const bases = found.flatMap((settings) => settings.assigned.get("baseURL") ?? []);
+  const methods = found.flatMap((settings) => settings.assigned.get("method") ?? []);
+  if (found.some((settings) => settings.changed) || bases.length > 1 || methods.length > 1)
+    return { base: [computedPart], method: undefined };
+  return {
+    base: bases[0] === undefined ? client.base : await urlParts(context, bases[0]),
+    method: methods[0] === undefined ? client.method : methodText(await literalText(context, methods[0]))
+  };
+}
+function defaultClient(context) {
+  return withDefaults(context, { base: [], method: "GET" }, context.bindings.defaultImports("axios"));
+}
+async function sent(context, client, url, method, config) {
+  const effective = method ?? await declaredMethod(context, config, client.method);
+  const base = await optionsBase(context, config, client.base);
+  return { ...effective === undefined ? {} : { method: effective }, ...requestUrl(joinBase(base, url)) };
+}
+async function configRequest(context, client, config) {
+  const url = config === undefined ? "absent" : await heldAt(context, config, "url");
+  return url === "absent" ? undefined : sent(context, client, await heldParts(context, url), undefined, config);
+}
+async function holdsObject(context, node) {
+  const value = await heldAt(context, node);
+  return typeof value === "object" && context.ts.isObjectLiteralExpression(value.node);
+}
+var SHORTHAND = new Map([
+  ["get", "GET"],
+  ["post", "POST"],
+  ["put", "PUT"],
+  ["patch", "PATCH"],
+  ["delete", "DELETE"],
+  ["head", "HEAD"],
+  ["options", "OPTIONS"]
+]);
+var WITH_BODY = new Set(["post", "put", "patch"]);
+async function isAxios(context, node) {
+  const origin = await importOrigin(context, node);
+  return origin?.module === "axios" && origin.name === "default";
+}
+async function createdClient(context, node) {
+  const { ts } = context;
+  const created = await heldAt(context, node);
+  const call = typeof created === "object" && ts.isCallExpression(created.node) ? created.node : undefined;
+  const callee = call?.expression;
+  if (call === undefined || callee === undefined || !ts.isPropertyAccessExpression(callee) || !ts.isIdentifier(callee.name))
+    return;
+  if (callee.name.text !== "create" || !await isAxios(context, callee.expression))
+    return;
+  const parent = await defaultClient(context);
+  const inherited = { base: parent.base.length === 0 ? [] : [computedPart], method: parent.method === "GET" ? "GET" : undefined };
+  const [config] = call.arguments;
+  const client = { base: await optionsBase(context, config, inherited.base), method: await declaredMethod(context, config, inherited.method) };
+  const holders = [await declarationOf(context, node), holderOf(ts, call)].filter((holder) => holder !== undefined);
+  return withDefaults(context, client, [...new Set(holders)]);
+}
+async function axiosClient(context, node) {
+  if (!context.ts.isIdentifier(node))
+    return;
+  return await isAxios(context, node) ? defaultClient(context) : createdClient(context, node);
+}
+async function axiosRequest(context, call) {
+  const { ts } = context;
+  const callee = call.expression;
+  const [first, second, third] = call.arguments;
+  if (ts.isPropertyAccessExpression(callee) && ts.isIdentifier(callee.name)) {
+    const client = await axiosClient(context, callee.expression);
+    if (client === undefined)
+      return;
+    const member = callee.name.text;
+    const method = SHORTHAND.get(member);
+    if (method !== undefined && first !== undefined) {
+      return sent(context, client, await urlParts(context, first), method, WITH_BODY.has(member) ? third : second);
+    }
+    return member === "request" ? configRequest(context, client, first) : undefined;
+  }
+  const client = await axiosClient(context, callee);
+  if (client === undefined || first === undefined)
+    return;
+  if (await holdsObject(context, first))
+    return configRequest(context, client, first);
+  return sent(context, client, await urlParts(context, first), undefined, second);
+}
+
+// plugins/scanners/javascript/src/http-requests.ts
+var jqueryHelpers = new Map([
+  ["get", "GET"],
+  ["getJSON", "GET"],
+  ["getScript", "GET"],
+  ["post", "POST"]
+]);
+async function isJQuery(context, node) {
+  if (!ts3.isIdentifier(node) || node.text !== "$" && node.text !== "jQuery")
+    return false;
+  const origin = await importOrigin(context, node);
+  return origin === undefined ? runtimeGlobal(context, node) : origin.module === "jquery";
+}
+async function ajaxMethod(context, settings) {
+  if (settings === undefined)
+    return { method: "GET" };
+  for (const key of ["method", "type"]) {
+    const value = await heldAt(context, settings, key);
+    if (value === "absent")
+      continue;
+    const method = typeof value === "object" ? await methodName(context, value.node) : undefined;
+    return method === undefined ? {} : { method };
+  }
+  return { method: "GET" };
+}
+async function ajaxRequest(context, call) {
+  const [first, second] = call.arguments;
+  if (first === undefined)
+    return;
+  if (second !== undefined)
+    return { ...await ajaxMethod(context, second), ...requestUrl(await urlParts(context, first)) };
+  const url = await heldAt(context, first, "url");
+  return url === "absent" ? undefined : { ...await ajaxMethod(context, first), ...requestUrl(await heldParts(context, url)) };
+}
+async function jqueryRequest(context, call) {
+  const callee = call.expression;
+  if (!ts3.isPropertyAccessExpression(callee) || !await isJQuery(context, callee.expression))
+    return;
+  const member = callee.name.text;
+  const method = jqueryHelpers.get(member);
+  const [url] = call.arguments;
+  if (method !== undefined)
+    return url === undefined ? undefined : { method, ...requestUrl(await urlParts(context, url)) };
+  return member === "ajax" ? ajaxRequest(context, call) : undefined;
+}
+async function httpRequest(context, call) {
+  return await fetchRequest(context, call, (callee) => runtimeFetch(context, callee)) ?? await axiosRequest(context, call) ?? jqueryRequest(context, call);
+}
+
+// plugins/scanners/javascript/src/http.ts
+function fileChecker(source) {
+  const options = { allowJs: true, noLib: true, noResolve: true, types: [], noEmit: true };
+  const host = {
+    getSourceFile: (name) => name === source.fileName ? source : undefined,
+    getDefaultLibFileName: () => "lib.d.ts",
+    writeFile: () => {
+      return;
+    },
+    getCurrentDirectory: () => "",
+    getCanonicalFileName: (name) => name,
+    useCaseSensitiveFileNames: () => true,
+    getNewLine: () => `
+`,
+    fileExists: (name) => name === source.fileName,
+    readFile: () => {
+      return;
+    }
+  };
+  return ts4.createProgram([source.fileName], options, host).getTypeChecker();
+}
+function classic(node) {
+  return node;
+}
+function fileContext(source, evidence) {
+  const context = urlContext(ts4, classicChecker(ts4, fileChecker(source)), [source], true);
+  const operationAt = (node) => evidence.operationAt(classic(node));
+  return {
+    ...context,
+    frameworks: new Set(["express", "fastify", "hono", "koa"]),
+    exportsHandOff: true,
+    async handlerOperation(handler, registration) {
+      const held = handler === undefined ? undefined : await heldAt(context, handler);
+      return typeof held === "object" && ts4.isFunctionLike(classic(held.node)) ? operationAt(held.node) : operationAt(registration);
+    },
+    callerOperation: operationAt,
+    file: (node) => node.getSourceFile().fileName
+  };
+}
+async function javaScriptHttpFacts(source, evidence) {
+  const context = fileContext(source, evidence);
+  const httpRequests = [];
+  for (const call of evidence.calls) {
+    const request = await httpRequest(context, call);
+    if (request !== undefined)
+      httpRequests.push({ operation: evidence.operationAt(call), ...request });
+  }
+  const placed = await routerEndpoints(context, [source], evidence.calls);
+  return { httpEndpoints: [...withOrder(placed), ...await serveEndpoints(context, evidence.calls)], httpRequests };
+}
+
+// plugins/scanners/javascript/src/outline.ts
+import { readFile } from "fs/promises";
+import path from "path";
+import ts5 from "./typescript.cjs";
+
+// plugins/scanners/typescript-outline.ts
+function is2(node, kind) {
+  return node !== undefined && node.kind === kind;
+}
+var NO_EXPORTS = new Set;
+function hasModifier(node, kind) {
+  return node.modifiers?.some((modifier) => modifier.kind === kind) ?? false;
+}
+function listedExports(k, statement) {
+  if (is2(statement, k.ExportAssignment)) {
+    return is2(statement.expression, k.Identifier) ? [statement.expression.text] : [];
+  }
+  if (!is2(statement, k.ExportDeclaration) || statement.moduleSpecifier !== undefined)
+    return [];
+  const clause = statement.exportClause;
+  if (!is2(clause, k.NamedExports))
+    return [];
+  return clause.elements.map((element) => (element.propertyName ?? element.name).text);
+}
+function topLevelVisibility(scope, name, statement) {
+  if (scope.topLevelPrivate)
+    return "private";
+  return hasModifier(statement, scope.k.ExportKeyword) || scope.exported.has(name) ? "public" : "private";
+}
+function memberVisibility(scope, member) {
+  const { k } = scope;
+  if (is2(member.name, k.PrivateIdentifier) || hasModifier(member, k.PrivateKeyword))
+    return "private";
+  return hasModifier(member, k.ProtectedKeyword) ? "protected" : "public";
+}
+function symbolAt(scope, name, node, visibility) {
+  const line = scope.source.getLineAndCharacterOfPosition(node.getStart()).line + 1;
+  return { name, line, visibility, entry: scope.symbols.includes(name) };
+}
+function functionDeclarations(scope, statement) {
+  const { k } = scope;
+  if (is2(statement, k.FunctionDeclaration) && is2(statement.name, k.Identifier)) {
+    const name = statement.name.text;
+    return [{ kind: "function", ...symbolAt(scope, name, statement.name, topLevelVisibility(scope, name, statement)) }];
+  }
+  if (!is2(statement, k.VariableStatement))
+    return [];
+  return statement.declarationList.declarations.flatMap((declaration) => {
+    const { name, initializer } = declaration;
+    if (!is2(name, k.Identifier))
+      return [];
+    if (!is2(initializer, k.ArrowFunction) && !is2(initializer, k.FunctionExpression))
+      return [];
+    return [{ kind: "function", ...symbolAt(scope, name.text, name, topLevelVisibility(scope, name.text, statement)) }];
+  });
+}
+function memberName(scope, name) {
+  const { k } = scope;
+  if (is2(name, k.Identifier) || is2(name, k.PrivateIdentifier))
+    return name;
+  return is2(name, k.StringLiteral) || is2(name, k.NumericLiteral) ? name : undefined;
+}
+function typeMember(scope, member) {
+  const { k } = scope;
+  if (member.kind === k.Constructor)
+    return [symbolAt(scope, "constructor", member, memberVisibility(scope, member))];
+  if (!is2(member, k.MethodDeclaration) && !is2(member, k.MethodSignature))
+    return [];
+  const name = memberName(scope, member.name);
+  return name === undefined ? [] : [symbolAt(scope, name.text, name, memberVisibility(scope, member))];
+}
+function typeMembers(k, statement) {
+  if (is2(statement, k.ClassDeclaration) || is2(statement, k.InterfaceDeclaration))
+    return statement.members;
+  return statement.kind === k.EnumDeclaration ? [] : undefined;
+}
+function typeDeclaration(scope, statement) {
+  const members = typeMembers(scope.k, statement);
+  const { name } = statement;
+  if (members === undefined || !is2(name, scope.k.Identifier))
+    return [];
+  return [{
+    kind: "type",
+    ...symbolAt(scope, name.text, name, topLevelVisibility(scope, name.text, statement)),
+    members: members.flatMap((member) => typeMember(scope, member))
+  }];
+}
+function moduleStatements(k, statement) {
+  let body = statement.body;
+  while (is2(body, k.ModuleDeclaration))
+    body = body.body;
+  return is2(body, k.ModuleBlock) ? body.statements : [];
+}
+function declarationsIn(scope, statements) {
+  return statements.flatMap((statement) => {
+    if (is2(statement, scope.k.ModuleDeclaration)) {
+      return declarationsIn({ ...scope, exported: NO_EXPORTS }, moduleStatements(scope.k, statement));
+    }
+    return [...functionDeclarations(scope, statement), ...typeDeclaration(scope, statement)];
+  });
+}
+function outlineSource(ts, source, context) {
+  const k = ts.SyntaxKind;
+  const exported = new Set([...source.statements.flatMap((statement) => listedExports(k, statement)), ...context.exported ?? []]);
+  const scope = { k, source, symbols: context.symbols, exported, topLevelPrivate: context.topLevelPrivate ?? false };
+  return declarationsIn(scope, source.statements);
+}
+
+// plugins/scanners/javascript/src/outline.ts
+var MODULE_EXTENSION = /\.(?:mjs|cjs)$/;
+function isExportsReference(node) {
+  if (ts5.isIdentifier(node))
+    return node.text === "exports";
+  return ts5.isPropertyAccessExpression(node) && ts5.isIdentifier(node.expression) && node.expression.text === "module" && node.name.text === "exports";
+}
+function assignedNames(value) {
+  if (ts5.isIdentifier(value))
+    return [value.text];
+  if (!ts5.isObjectLiteralExpression(value))
+    return [];
+  return value.properties.flatMap((property) => {
+    if (ts5.isShorthandPropertyAssignment(property))
+      return [property.name.text];
+    return ts5.isPropertyAssignment(property) && ts5.isIdentifier(property.initializer) ? [property.initializer.text] : [];
+  });
+}
+function commonJsExport2(statement) {
+  if (!ts5.isExpressionStatement(statement))
+    return;
+  const assignment = statement.expression;
+  if (!ts5.isBinaryExpression(assignment) || assignment.operatorToken.kind !== ts5.SyntaxKind.EqualsToken)
+    return;
+  const { left } = assignment;
+  const target = ts5.isPropertyAccessExpression(left) && isExportsReference(left.expression) ? left.expression : left;
+  return isExportsReference(target) ? assignment : undefined;
+}
+function publishedBy(assignment) {
+  const { left, right } = assignment;
+  if (ts5.isPropertyAccessExpression(left) && isExportsReference(left.expression)) {
+    return ts5.isIdentifier(right) ? [right.text] : [];
+  }
+  return assignedNames(right);
+}
+function statesEcmaScriptModule(source) {
+  return source.statements.some((statement) => ts5.isImportDeclaration(statement) || ts5.isExportDeclaration(statement) || ts5.isExportAssignment(statement) || ts5.canHaveModifiers(statement) && (ts5.getModifiers(statement) ?? []).some((modifier) => modifier.kind === ts5.SyntaxKind.ExportKeyword));
+}
+function publishedNames(file, source) {
+  const exports = source.statements.flatMap((statement) => commonJsExport2(statement) ?? []);
+  if (exports.length > 0 || MODULE_EXTENSION.test(file) || statesEcmaScriptModule(source)) {
+    return exports.flatMap(publishedBy);
+  }
+  return topLevelDeclarations(source).map((declaration) => declaration.name);
+}
+async function readJavaScriptOutline(repositoryRoot, references) {
+  const files = [];
+  for (const reference of references) {
+    const fileName = path.join(repositoryRoot, reference.file);
+    const text = await readFile(fileName, "utf8");
+    const source = ts5.createSourceFile(fileName, text, ts5.ScriptTarget.Latest, true);
+    const declarations = outlineSource(ts5, source, { symbols: reference.symbols, exported: publishedNames(reference.file, source) });
+    if (declarations.length > 0)
+      files.push({ file: reference.file, declarations });
+  }
+  return files;
+}
+
+// plugins/scanners/javascript/src/sources.ts
+import { readFile as readFile2 } from "fs/promises";
+import path3 from "path";
+
+// plugins/scanners/projects.ts
+import { execFile } from "child_process";
+import { existsSync } from "fs";
+import path2 from "path";
+import { promisify } from "util";
+var execute = promisify(execFile);
+var excluded = new Set([
+  ".git",
+  "node_modules",
+  "vendor",
+  "target",
+  "dist",
+  "build",
+  "bin",
+  "obj",
+  ".gradle",
+  ".angular",
+  "coverage",
+  "generated",
+  "groma",
+  ".groma"
+]);
+async function repositoryFiles(root, matches) {
+  const { stdout } = await execute("git", ["-C", root, "ls-files", "-z", "--cached", "--others", "--exclude-standard"], { maxBuffer: 64 * 1024 * 1024 });
+  return [...new Set(stdout.split("\x00").filter((file) => file && matches(file) && existsSync(path2.join(root, file))))].sort();
+}
+function projectFiles(root, matches) {
+  return repositoryFiles(root, (file) => matches(file) && !file.split("/").some((part) => excluded.has(part)));
+}
+
+// plugins/scanners/javascript/src/sources.ts
+var SOURCE = /\.(?:js|mjs|cjs|jsx)$/;
+var MINIFIED_NAME = /\.min\.(?:js|mjs|cjs|jsx)$/;
+var MINIFIED_LINE_LENGTH = 500;
+function isJavaScriptFile(file) {
+  return SOURCE.test(file);
+}
+function hasMinifiedName(file) {
+  return MINIFIED_NAME.test(path3.posix.basename(file));
+}
+function isMinifiedText(text) {
+  const code = text.trimEnd();
+  return code.length / code.split(`
+`).length >= MINIFIED_LINE_LENGTH;
+}
+async function javaScriptSources(root) {
+  const files = await projectFiles(root, (file) => isJavaScriptFile(file) && !hasMinifiedName(file));
+  const sources = [];
+  for (const file of files) {
+    const text = await readFile2(path3.join(root, file), "utf8");
+    if (!isMinifiedText(text))
+      sources.push({ file, text });
+  }
+  return sources;
+}
+
+// plugins/scanners/javascript/src/index.ts
+function parse(source) {
+  return ts6.createSourceFile(source.file, source.text, ts6.ScriptTarget.Latest, true);
+}
+var SLOPPY_MODE_ONLY = new Set([1121, 1487, 1488, 1489]);
+function parseWarning(source) {
+  const { parseDiagnostics } = source;
+  const first = parseDiagnostics.find((diagnostic) => !SLOPPY_MODE_ONLY.has(diagnostic.code));
+  if (first === undefined)
+    return;
+  return {
+    severity: "warning",
+    code: "JAVASCRIPT_SOURCE_INVALID",
+    file: source.fileName,
+    line: source.getLineAndCharacterOfPosition(first.start).line + 1,
+    message: `The file does not parse, so it contributes no evidence: ${ts6.flattenDiagnosticMessageText(first.messageText, " ")}`
+  };
+}
+var src_default = {
+  id: "javascript",
+  watch: {
+    include: ["**/*.js", "**/*.mjs", "**/*.cjs", "**/*.jsx"],
+    exclude: ["**/*.min.js", "**/*.min.mjs", "**/*.min.cjs", "**/*.min.jsx"]
+  },
+  listSourceFiles: async (root) => (await javaScriptSources(root)).map((source) => source.file),
+  async checkReadiness(root) {
+    if (!(await javaScriptSources(root)).length) {
+      throw new Error("javascript: No authored JavaScript source files were found in the Git repository.");
+    }
+  },
+  async scan(root) {
+    const sources = await javaScriptSources(root);
+    if (!sources.length)
+      return;
+    const parsed = sources.map(parse);
+    const warnings = parsed.map(parseWarning);
+    const readable = parsed.filter((_, index) => warnings[index] === undefined);
+    const scanned = await Promise.all(readable.map(async (source) => {
+      const evidence = javaScriptEvidence(source.fileName, source);
+      return { file: source.fileName, evidence, facts: await javaScriptHttpFacts(source, evidence) };
+    }));
+    const symbols = new Map(scanned.map(({ file, evidence }) => [file, evidence.symbols]));
+    return createScanObservation({
+      scanner: { id: "javascript", technology: "javascript", engine: "typescript-sdk", engineVersion: ts6.version },
+      roots: [{ id: "javascript-source", kind: "source-group", name: path4.basename(root) }],
+      files: parsed.map(({ fileName: file }) => ({ file, symbols: symbols.get(file) ?? [], roots: ["javascript-source"] })),
+      operations: scanned.flatMap(({ evidence }) => evidence.operations),
+      invocations: scanned.flatMap(({ evidence }) => evidence.invocations),
+      httpEndpoints: scanned.flatMap(({ facts }) => facts.httpEndpoints),
+      httpRequests: scanned.flatMap(({ facts }) => facts.httpRequests),
+      diagnostics: [
+        {
+          severity: "info",
+          code: "JAVASCRIPT_SOURCE_SCOPE",
+          message: "Source syntax only. Module loading, dynamic dispatch, framework wiring and external symbols remain unresolved."
+        },
+        ...warnings.filter((warning) => warning !== undefined)
+      ]
+    });
+  },
+  readCodeStructure: readJavaScriptOutline
+};
+export {
+  src_default as default
+};