@groma/scanner-react 0.1.3 → 0.1.4

package/dist/index.js

@@ -1,8 +1,541 @@
 // @bun
-// plugins/scanners/react/src/scan.ts
-import { existsSync as existsSync2, readFileSync } from "fs";
-import { createRequire } from "module";
+// plugins/scanners/react/src/index.ts
+import ts5 from "./typescript.cjs";
+
+// plugins/scanners/typescript-outline.ts
+import { readFile } from "fs/promises";
+import path from "path";
+function is(node, kind) {
+  return node !== undefined && node.kind === kind;
+}
+var NO_EXPORTS = new Set;
+function hasModifier(node, kind) {
+  return node.modifiers?.some((modifier) => modifier.kind === kind) ?? false;
+}
+function listedExports(k, statement) {
+  if (is(statement, k.ExportAssignment)) {
+    return is(statement.expression, k.Identifier) ? [statement.expression.text] : [];
+  }
+  if (!is(statement, k.ExportDeclaration) || statement.moduleSpecifier !== undefined)
+    return [];
+  const clause = statement.exportClause;
+  if (!is(clause, k.NamedExports))
+    return [];
+  return clause.elements.map((element) => (element.propertyName ?? element.name).text);
+}
+function topLevelVisibility(scope, name, statement) {
+  if (scope.topLevelPrivate)
+    return "private";
+  return hasModifier(statement, scope.k.ExportKeyword) || scope.exported.has(name) ? "public" : "private";
+}
+function memberVisibility(scope, member) {
+  const { k } = scope;
+  if (is(member.name, k.PrivateIdentifier) || hasModifier(member, k.PrivateKeyword))
+    return "private";
+  return hasModifier(member, k.ProtectedKeyword) ? "protected" : "public";
+}
+function symbolAt(scope, name, node, visibility) {
+  const line = scope.source.getLineAndCharacterOfPosition(node.getStart()).line + 1;
+  return { name, line, visibility, entry: scope.symbols.includes(name) };
+}
+function functionDeclarations(scope, statement) {
+  const { k } = scope;
+  if (is(statement, k.FunctionDeclaration) && is(statement.name, k.Identifier)) {
+    const name = statement.name.text;
+    return [{ kind: "function", ...symbolAt(scope, name, statement.name, topLevelVisibility(scope, name, statement)) }];
+  }
+  if (!is(statement, k.VariableStatement))
+    return [];
+  return statement.declarationList.declarations.flatMap((declaration) => {
+    const { name, initializer } = declaration;
+    if (!is(name, k.Identifier))
+      return [];
+    if (!is(initializer, k.ArrowFunction) && !is(initializer, k.FunctionExpression))
+      return [];
+    return [{ kind: "function", ...symbolAt(scope, name.text, name, topLevelVisibility(scope, name.text, statement)) }];
+  });
+}
+function memberName(scope, name) {
+  const { k } = scope;
+  if (is(name, k.Identifier) || is(name, k.PrivateIdentifier))
+    return name;
+  return is(name, k.StringLiteral) || is(name, k.NumericLiteral) ? name : undefined;
+}
+function typeMember(scope, member) {
+  const { k } = scope;
+  if (member.kind === k.Constructor)
+    return [symbolAt(scope, "constructor", member, memberVisibility(scope, member))];
+  if (!is(member, k.MethodDeclaration) && !is(member, k.MethodSignature))
+    return [];
+  const name = memberName(scope, member.name);
+  return name === undefined ? [] : [symbolAt(scope, name.text, name, memberVisibility(scope, member))];
+}
+function typeMembers(k, statement) {
+  if (is(statement, k.ClassDeclaration) || is(statement, k.InterfaceDeclaration))
+    return statement.members;
+  return statement.kind === k.EnumDeclaration ? [] : undefined;
+}
+function typeDeclaration(scope, statement) {
+  const members = typeMembers(scope.k, statement);
+  const { name } = statement;
+  if (members === undefined || !is(name, scope.k.Identifier))
+    return [];
+  return [{
+    kind: "type",
+    ...symbolAt(scope, name.text, name, topLevelVisibility(scope, name.text, statement)),
+    members: members.flatMap((member) => typeMember(scope, member))
+  }];
+}
+function moduleStatements(k, statement) {
+  let body = statement.body;
+  while (is(body, k.ModuleDeclaration))
+    body = body.body;
+  return is(body, k.ModuleBlock) ? body.statements : [];
+}
+function declarationsIn(scope, statements) {
+  return statements.flatMap((statement) => {
+    if (is(statement, scope.k.ModuleDeclaration)) {
+      return declarationsIn({ ...scope, exported: NO_EXPORTS }, moduleStatements(scope.k, statement));
+    }
+    return [...functionDeclarations(scope, statement), ...typeDeclaration(scope, statement)];
+  });
+}
+function outlineSource(ts, source, context) {
+  const k = ts.SyntaxKind;
+  const exported = new Set([...source.statements.flatMap((statement) => listedExports(k, statement)), ...context.exported ?? []]);
+  const scope = { k, source, symbols: context.symbols, exported, topLevelPrivate: context.topLevelPrivate ?? false };
+  return declarationsIn(scope, source.statements);
+}
+function outlineDeclarations(ts, block) {
+  return outlineSource(ts, ts.createSourceFile(block.fileName, block.text, ts.ScriptTarget.Latest, true), block);
+}
+async function readTypeScriptOutline(ts, repositoryRoot, references) {
+  const files = [];
+  for (const reference of references) {
+    const fileName = path.join(repositoryRoot, reference.file);
+    const text = await readFile(fileName, "utf8");
+    const declarations = outlineDeclarations(ts, { fileName, text, symbols: reference.symbols });
+    if (declarations.length > 0)
+      files.push({ file: reference.file, declarations });
+  }
+  return files;
+}
+
+// plugins/scanners/typescript-project.ts
+import path3 from "path";
+
+// plugins/scanners/projects.ts
+import { execFile } from "child_process";
+import { existsSync } from "fs";
+import { readFile as readFile2 } from "fs/promises";
 import path2 from "path";
+import { promisify } from "util";
+var execute = promisify(execFile);
+var excluded = new Set([
+  ".git",
+  "node_modules",
+  "vendor",
+  "target",
+  "dist",
+  "build",
+  "bin",
+  "obj",
+  ".gradle",
+  ".angular",
+  "coverage",
+  "generated",
+  "groma",
+  ".groma"
+]);
+async function repositoryFiles(root, matches) {
+  const { stdout } = await execute("git", ["-C", root, "ls-files", "-z", "--cached", "--others", "--exclude-standard"], { maxBuffer: 64 * 1024 * 1024 });
+  return [...new Set(stdout.split("\x00").filter((file) => file && matches(file) && existsSync(path2.join(root, file))))].sort();
+}
+function projectFiles(root, matches) {
+  return repositoryFiles(root, (file) => matches(file) && !file.split("/").some((part) => excluded.has(part)));
+}
+function hasDependency(manifest, dependency) {
+  return ["dependencies", "devDependencies", "peerDependencies", "optionalDependencies"].some((section) => typeof manifest[section]?.[dependency] === "string");
+}
+async function frameworkProjects(root, dependency, extensions) {
+  const files = await projectFiles(root, () => true);
+  const manifests = files.filter((file) => path2.posix.basename(file) === "package.json");
+  const directories = new Set(manifests.map((file) => path2.posix.dirname(file)));
+  const sources = new Set;
+  for (const file of files.filter((file) => extensions.some((extension) => file.endsWith(extension)) && !file.endsWith(".d.ts"))) {
+    let directory = path2.posix.dirname(file);
+    while (directory !== "." && !directories.has(directory))
+      directory = path2.posix.dirname(directory);
+    sources.add(directory);
+  }
+  const projects = [];
+  for (const file of manifests) {
+    const directory = path2.posix.dirname(file);
+    if (!sources.has(directory) || !files.includes(path2.posix.join(directory, "tsconfig.json")))
+      continue;
+    const manifest = JSON.parse(await readFile2(path2.join(root, file), "utf8"));
+    if (hasDependency(manifest, dependency))
+      projects.push(path2.dirname(path2.join(root, file)));
+  }
+  return projects;
+}
+
+// plugins/scanners/typescript-project.ts
+async function frameworkSourceFiles(options) {
+  const { root, dependency, projects, sources, also } = options;
+  const directories = (await frameworkProjects(root, dependency, projects)).map((directory) => path3.relative(root, directory).split(path3.sep).join("/") || ".");
+  if (directories.length === 0)
+    return [];
+  const listed = [];
+  for (const file of await projectFiles(root, (candidate) => !candidate.endsWith(".d.ts"))) {
+    const project = directories.find((directory) => directory === "." || file.startsWith(`${directory}/`));
+    if (project === undefined)
+      continue;
+    const local = project === "." ? file : file.slice(project.length + 1);
+    if (sources.some((extension) => file.endsWith(extension)) || (also?.(local) ?? false))
+      listed.push(file);
+  }
+  return listed.sort();
+}
+
+// plugins/scanners/react/src/routes.ts
+import { existsSync as existsSync2 } from "fs";
+import path4 from "path";
+import ts2 from "./typescript.cjs";
+
+// plugins/scanners/http-url.ts
+var pathText = /^[A-Za-z0-9\-._~!$&'()*+,;=:@%]+$/;
+var absolute = /^([A-Za-z][A-Za-z\d+.-]*:)?\/\//;
+var HOLE = "\x00";
+var computedPart = { kind: "hole", configured: false };
+var configuredPart = { kind: "hole", configured: true };
+var methodToken = /^[A-Z][A-Z-]*$/;
+function methodText(text) {
+  const method = text?.toUpperCase();
+  return method !== undefined && methodToken.test(method) ? method : undefined;
+}
+function requestSegment(part) {
+  if (part === HOLE)
+    return { kind: "dynamic" };
+  if (part.includes(HOLE) || !pathText.test(part))
+    return { kind: "unknown" };
+  return { kind: "literal", value: part };
+}
+function segmentsOf(parts) {
+  const url = parts.map((part) => part.kind === "text" ? part.text : HOLE).join("");
+  const end = Math.min(...["?", "#"].map((mark) => url.includes(mark) ? url.indexOf(mark) : url.length));
+  return url.slice(0, end).split("/").filter((part) => part !== "").map(requestSegment);
+}
+function afterAuthority(text) {
+  const slash = text.indexOf("/", text.indexOf("//") + 2);
+  return slash < 0 ? "" : text.slice(slash);
+}
+function joinedText(input) {
+  const parts = [];
+  for (const part of input) {
+    const last = parts.at(-1);
+    if (part.kind === "text" && last?.kind === "text")
+      parts[parts.length - 1] = { kind: "text", text: last.text + part.text };
+    else if (part.kind === "hole" || part.text !== "")
+      parts.push(part);
+  }
+  return parts;
+}
+function requestUrl(input) {
+  const parts = joinedText(input);
+  const [first, ...rest] = parts;
+  if (first === undefined)
+    return { path: [{ kind: "unknown" }] };
+  if (first.kind === "hole") {
+    const path = segmentsOf(rest);
+    const next = rest[0];
+    const separated = next === undefined || next.kind === "text" && next.text.startsWith("/");
+    return first.configured && separated ? { configured: true, path } : { path: [{ kind: "unknown" }, ...path] };
+  }
+  if (absolute.test(first.text)) {
+    return { path: [{ kind: "unknown" }, ...segmentsOf([{ kind: "text", text: afterAuthority(first.text) }, ...rest])] };
+  }
+  if (!first.text.startsWith("/"))
+    return { path: [{ kind: "unknown" }, ...segmentsOf(parts)] };
+  return { path: segmentsOf(parts) };
+}
+function joinBase(base, url) {
+  const stated = joinedText(base);
+  const path = joinedText(url);
+  const [first] = path;
+  if (stated.length === 0)
+    return path;
+  if (first === undefined)
+    return stated;
+  if (first.kind === "hole")
+    return [computedPart, ...path.slice(1)];
+  return absolute.test(first.text) ? path : [...stated, { kind: "text", text: "/" }, ...path];
+}
+function withBase(base, url) {
+  const stated = joinedText(base);
+  const path = joinedText(url);
+  const [only] = stated;
+  const [first, ...rest] = path;
+  if (stated.length !== 1 || only?.kind !== "text" || first?.kind !== "text" || absolute.test(first.text)) {
+    return joinBase(stated, path);
+  }
+  const prefix = only.text.replace(/\/$/, "");
+  if (first.text.startsWith(prefix)) {
+    const next = first.text[prefix.length];
+    if (next === undefined)
+      return rest.length === 0 ? path : [computedPart, ...rest];
+    return next === "/" || next === "?" ? path : joinBase(stated, path);
+  }
+  return prefix.startsWith(first.text) && rest.length > 0 ? [computedPart, ...rest] : joinBase(stated, path);
+}
+
+// plugins/scanners/react/src/functions.ts
+import ts from "./typescript.cjs";
+function executable(node) {
+  return ts.isArrowFunction(node) || ts.isFunctionExpression(node) || ts.isFunctionDeclaration(node) && !!node.body;
+}
+
+// plugins/scanners/react/src/routes.ts
+var METHODS = new Set(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"]);
+var APP_ROUTE = /^(?:(.+)\/)?route\.tsx?$/;
+var PAGES_API = /^(api\/.+)\.tsx?$/;
+var OPTIONAL_CATCH_ALL = /^\[\[\.\.\.(.+)\]\]$/;
+var CATCH_ALL = /^\[\.\.\.(.+)\]$/;
+var PARAMETER = /^\[(.+)\]$/;
+function nextRouters(projectRoot) {
+  const active = (name) => existsSync2(path4.join(projectRoot, name)) ? name : `src/${name}`;
+  return { app: active("app"), pages: active("pages") };
+}
+function routeLocation(file, routers) {
+  const within = (directory) => file.startsWith(`${directory}/`) ? file.slice(directory.length + 1) : undefined;
+  const app = APP_ROUTE.exec(within(routers.app) ?? "");
+  if (app)
+    return { router: "app", ...app[1] === undefined ? {} : { directory: app[1] } };
+  const pages = PAGES_API.exec(within(routers.pages) ?? "");
+  return pages ? { router: "pages", directory: pages[1] } : undefined;
+}
+function routeCandidate(file) {
+  return ["", "src/"].some((prefix) => routeLocation(file, { app: `${prefix}app`, pages: `${prefix}pages` }) !== undefined);
+}
+var GROUP = /^\((?!\.+\))[^)]+\)$/;
+function routeSegment(part, last) {
+  const optional = OPTIONAL_CATCH_ALL.exec(part);
+  if (optional)
+    return last && pathText.test(optional[1]) ? { kind: "catch-all", name: optional[1], optional: true } : undefined;
+  const rest = CATCH_ALL.exec(part);
+  if (rest)
+    return last && pathText.test(rest[1]) ? { kind: "catch-all", name: rest[1] } : undefined;
+  const parameter = PARAMETER.exec(part);
+  if (parameter)
+    return pathText.test(parameter[1]) ? { kind: "parameter", name: parameter[1] } : undefined;
+  if (part.startsWith("(") || part.startsWith("@") || part.includes("[") || part.includes("]"))
+    return;
+  return pathText.test(part) ? { kind: "literal", value: part } : undefined;
+}
+function routeParts(directory, stripIndex) {
+  const parts = (directory ?? "").split("/").filter((part) => part !== "" && !GROUP.test(part));
+  return stripIndex && parts.at(-1) === "index" ? parts.slice(0, -1) : parts;
+}
+function routePath(directory, stripIndex) {
+  const parts = routeParts(directory, stripIndex);
+  const segments = [];
+  for (const [index, part] of parts.entries()) {
+    const segment = routeSegment(part, index === parts.length - 1);
+    if (segment === undefined)
+      return;
+    segments.push(segment);
+  }
+  return segments;
+}
+function functionValue(node) {
+  return node !== undefined && executable(node) ? node : undefined;
+}
+function hasModifier2(statement, kind) {
+  return ts2.canHaveModifiers(statement) && (ts2.getModifiers(statement) ?? []).some((modifier) => modifier.kind === kind);
+}
+function declaredHandler(statement) {
+  if (!ts2.isFunctionDeclaration(statement) || statement.name === undefined)
+    return;
+  const handler = functionValue(statement);
+  return handler !== undefined && METHODS.has(statement.name.text) ? [statement.name.text, handler] : undefined;
+}
+function boundHandlers(statement) {
+  if (!ts2.isVariableStatement(statement))
+    return [];
+  return statement.declarationList.declarations.flatMap((declaration) => {
+    const handler = functionValue(declaration.initializer);
+    if (handler === undefined || !ts2.isIdentifier(declaration.name) || !METHODS.has(declaration.name.text))
+      return [];
+    return [[declaration.name.text, handler]];
+  });
+}
+function appHandlers(source) {
+  const exported = source.statements.filter((statement) => hasModifier2(statement, ts2.SyntaxKind.ExportKeyword));
+  return new Map(exported.flatMap((statement) => {
+    const declared = declaredHandler(statement);
+    return declared === undefined ? boundHandlers(statement) : [declared];
+  }));
+}
+function localFunction(source, name) {
+  for (const statement of source.statements) {
+    if (ts2.isFunctionDeclaration(statement) && statement.name?.text === name)
+      return functionValue(statement);
+    if (!ts2.isVariableStatement(statement))
+      continue;
+    for (const declaration of statement.declarationList.declarations) {
+      if (ts2.isIdentifier(declaration.name) && declaration.name.text === name)
+        return functionValue(declaration.initializer);
+    }
+  }
+  return;
+}
+function pagesHandler(source) {
+  for (const statement of source.statements) {
+    if (ts2.isFunctionDeclaration(statement) && hasModifier2(statement, ts2.SyntaxKind.DefaultKeyword))
+      return functionValue(statement);
+    if (!ts2.isExportAssignment(statement) || statement.isExportEquals === true)
+      continue;
+    const value = functionValue(statement.expression);
+    if (value !== undefined)
+      return value;
+    if (ts2.isIdentifier(statement.expression))
+      return localFunction(source, statement.expression.text);
+  }
+  return;
+}
+function nextRouteEndpoints(sources, projectRoot, routers, operationId) {
+  const endpoints = [];
+  for (const source of sources) {
+    const location = routeLocation(path4.relative(projectRoot, source.fileName).split(path4.sep).join("/"), routers);
+    const segments = location === undefined ? undefined : routePath(location.directory, location.router === "pages");
+    if (location === undefined || segments === undefined)
+      continue;
+    if (location.router === "app") {
+      for (const [method, handler] of appHandlers(source)) {
+        endpoints.push({ operation: operationId(handler), method, path: segments });
+      }
+      continue;
+    }
+    const handler = pagesHandler(source);
+    if (handler !== undefined)
+      endpoints.push({ operation: operationId(handler), method: "*", path: segments });
+  }
+  return endpoints;
+}
+
+// plugins/scanners/react/src/scan.ts
+import { existsSync as existsSync3, readFileSync } from "fs";
+import path5 from "path";
+
+// packages/scanner/src/values.ts
+function object(value, label) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`${label} must be an object`);
+  }
+  return value;
+}
+function string(value, label) {
+  if (typeof value !== "string")
+    throw new Error(`${label} must be a string`);
+  return value;
+}
+function array(value, label) {
+  if (!Array.isArray(value))
+    throw new Error(`${label} must be an array`);
+  return value;
+}
+
+// packages/scanner/src/http.ts
+var pathText2 = /^[A-Za-z0-9\-._~!$&'()*+,;=:@%]+$/;
+var methodToken2 = /^[A-Z][A-Z-]*$/;
+function fail(message) {
+  throw new Error(message);
+}
+function text(value, label) {
+  if (typeof value !== "string" || !pathText2.test(value))
+    fail(`${label} must be nonempty URL path characters`);
+  return value;
+}
+function method(value, label, anyMethod) {
+  if (typeof value !== "string" || !(methodToken2.test(value) || anyMethod && value === "*")) {
+    fail(`${label} must be an uppercase HTTP method${anyMethod ? " or *" : ""}`);
+  }
+  return value;
+}
+function operation(value, operations) {
+  if (typeof value !== "string" || !operations.has(value))
+    fail("HTTP fact references unknown operation");
+  return value;
+}
+function endpointSegment(value, last) {
+  const segment = object(value, "HTTP endpoint segment");
+  if (segment.kind === "literal")
+    return { kind: "literal", value: text(segment.value, "HTTP literal segment") };
+  if (segment.kind !== "parameter" && segment.kind !== "catch-all")
+    fail(`unknown HTTP endpoint segment kind: ${String(segment.kind)}`);
+  if (segment.kind === "catch-all" && !last)
+    fail("an HTTP catch-all segment must be last");
+  for (const flag of ["optional", "constrained"]) {
+    if (segment[flag] !== undefined && typeof segment[flag] !== "boolean")
+      fail(`HTTP segment ${flag} must be a boolean`);
+  }
+  return {
+    kind: segment.kind,
+    name: text(segment.name, "HTTP segment name"),
+    ...segment.optional ? { optional: true } : {},
+    ...segment.constrained ? { constrained: true } : {}
+  };
+}
+function requestSegment2(value) {
+  const segment = object(value, "HTTP request segment");
+  if (segment.kind === "literal")
+    return { kind: "literal", value: text(segment.value, "HTTP literal segment") };
+  if (segment.kind === "dynamic" || segment.kind === "unknown")
+    return { kind: segment.kind };
+  return fail(`unknown HTTP request segment kind: ${String(segment.kind)}`);
+}
+function order(value) {
+  const fact = object(value, "HTTP endpoint order");
+  const application = string(fact.application, "HTTP endpoint order application");
+  if (application === "")
+    fail("HTTP endpoint order application must be nonempty");
+  const position = fact.position;
+  if (typeof position !== "number" || !Number.isInteger(position) || position < 0) {
+    fail("HTTP endpoint order position must be a nonnegative integer");
+  }
+  return { application, position };
+}
+function endpoint(value, operations) {
+  const fact = object(value, "HTTP endpoint");
+  const path = array(fact.path, "HTTP endpoint path");
+  return {
+    operation: operation(fact.operation, operations),
+    method: method(fact.method, "HTTP endpoint method", true),
+    path: path.map((segment, index) => endpointSegment(segment, index === path.length - 1)),
+    ...fact.order === undefined ? {} : { order: order(fact.order) }
+  };
+}
+function request(value, operations) {
+  const fact = object(value, "HTTP request");
+  if (fact.configured !== undefined && typeof fact.configured !== "boolean")
+    fail("HTTP request configured must be a boolean");
+  return {
+    operation: operation(fact.operation, operations),
+    ...fact.method === undefined ? {} : { method: method(fact.method, "HTTP request method", false) },
+    ...fact.configured ? { configured: true } : {},
+    path: array(fact.path, "HTTP request path").map(requestSegment2)
+  };
+}
+function httpEvidence(endpoints, requests, operations) {
+  if (endpoints === undefined && requests === undefined)
+    return {};
+  if (operations === undefined)
+    fail("HTTP facts require operation declarations");
+  return {
+    ...endpoints === undefined ? {} : { httpEndpoints: array(endpoints, "httpEndpoints").map((fact) => endpoint(fact, operations)) },
+    ...requests === undefined ? {} : { httpRequests: array(requests, "httpRequests").map((fact) => request(fact, operations)) }
+  };
+}
 
 // packages/scanner/src/index.ts
 function compare(...values) {
@@ -47,7 +580,9 @@ function createScanObservation(input) {
     scanner: input.scanner,
     roots,
     files,
+    ...sourceUnits(input.sourceUnits, filePaths),
     ...operationEvidence(input, filePaths),
+    ...httpEvidence(input.httpEndpoints, input.httpRequests, input.operations && new Set(input.operations.map((operation) => operation.id))),
     diagnostics: [...new Map(input.diagnostics.map((diagnostic) => [
       diagnosticKey(diagnostic),
       diagnostic
@@ -56,6 +591,23 @@ function createScanObservation(input) {
     })
   };
 }
+function sourceUnits(input, paths) {
+  if (input === undefined)
+    return {};
+  const units = array(input, "sourceUnits").map((entry) => {
+    const unit = object(entry, "source unit");
+    const primary = string(unit.primary, "source unit.primary");
+    const files = [...new Set(array(unit.files, "source unit.files").map((file) => string(file, "source unit.file")))].sort();
+    if (!files.includes(primary))
+      throw new Error(`source unit omits primary file: ${primary}`);
+    for (const file of files) {
+      if (!paths.has(file))
+        throw new Error(`source unit references unknown file: ${file}`);
+    }
+    return { primary, files };
+  });
+  return { sourceUnits: [...new Map(units.map((unit) => [compare(unit.primary, ...unit.files), unit])).values()].sort((a, b) => compare(a.primary, ...a.files).localeCompare(compare(b.primary, ...b.files))) };
+}
 function validateRoots(input) {
   const roots = uniqueBy(input, (root) => root.id, "root id");
   const byId = new Map(roots.map((root) => [root.id, root]));
@@ -86,16 +638,6 @@ function diagnosticLocation(value) {
     ...value.line === undefined ? {} : { line: Number(value.line) }
   };
 }
-function string(value, label) {
-  if (typeof value !== "string")
-    throw new Error(`${label} must be a string`);
-  return value;
-}
-function array(value, label) {
-  if (!Array.isArray(value))
-    throw new Error(`${label} must be an array`);
-  return value;
-}
 function operationEvidence(input, files) {
   if (input.operations === undefined && input.invocations !== undefined)
     throw new Error("invocations require operation declarations");
@@ -167,60 +709,7 @@ function sourcePosition(position) {
 }
 
 // plugins/scanners/react/src/scan.ts
-import ts from "./typescript.cjs";
-
-// plugins/scanners/projects.ts
-import { execFile } from "child_process";
-import { existsSync } from "fs";
-import { readFile } from "fs/promises";
-import path from "path";
-import { promisify } from "util";
-var execute = promisify(execFile);
-var excluded = new Set([
-  ".git",
-  "node_modules",
-  "vendor",
-  "target",
-  "dist",
-  "build",
-  "bin",
-  "obj",
-  ".gradle",
-  ".angular",
-  "coverage",
-  "generated",
-  "groma",
-  ".groma"
-]);
-async function projectFiles(root, matches) {
-  const { stdout } = await execute("git", ["-C", root, "ls-files", "-z", "--cached", "--others", "--exclude-standard"], { maxBuffer: 64 * 1024 * 1024 });
-  return [...new Set(stdout.split("\x00").filter((file) => file && matches(file) && !file.split("/").some((part) => excluded.has(part)) && existsSync(path.join(root, file))))].sort();
-}
-function hasDependency(manifest, dependency) {
-  return ["dependencies", "devDependencies", "peerDependencies", "optionalDependencies"].some((section) => typeof manifest[section]?.[dependency] === "string");
-}
-async function frameworkProjects(root, dependency, extensions) {
-  const files = await projectFiles(root, () => true);
-  const manifests = files.filter((file) => path.posix.basename(file) === "package.json");
-  const directories = new Set(manifests.map((file) => path.posix.dirname(file)));
-  const sources = new Set;
-  for (const file of files.filter((file) => extensions.some((extension) => file.endsWith(extension)) && !file.endsWith(".d.ts"))) {
-    let directory = path.posix.dirname(file);
-    while (directory !== "." && !directories.has(directory))
-      directory = path.posix.dirname(directory);
-    sources.add(directory);
-  }
-  const projects = [];
-  for (const file of manifests) {
-    const directory = path.posix.dirname(file);
-    if (!sources.has(directory) || !files.includes(path.posix.join(directory, "tsconfig.json")))
-      continue;
-    const manifest = JSON.parse(await readFile(path.join(root, file), "utf8"));
-    if (hasDependency(manifest, dependency))
-      projects.push(path.dirname(path.join(root, file)));
-  }
-  return projects;
-}
+import ts4 from "./typescript.cjs";
 
 // plugins/scanners/observations.ts
 function combineObservations(parts) {
@@ -231,6 +720,9 @@ function combineObservations(parts) {
   const operations = [];
   const invocations = [];
   const diagnostics = [];
+  const sourceUnits = [];
+  const httpEndpoints = [];
+  const httpRequests = [];
   for (const { key, observation } of parts) {
     const id = (value) => JSON.stringify([key, value]);
     roots.push(...observation.roots.map((root) => ({ ...root, id: id(root.id), ...root.parent ? { parent: id(root.parent) } : {} })));
@@ -242,7 +734,10 @@ function combineObservations(parts) {
     }
     operations.push(...(observation.operations ?? []).map((operation) => ({ ...operation, id: id(operation.id) })));
     invocations.push(...(observation.invocations ?? []).map((call) => ({ ...call, source: id(call.source), targets: call.targets.map(id) })));
+    httpEndpoints.push(...(observation.httpEndpoints ?? []).map((endpoint) => ({ ...endpoint, operation: id(endpoint.operation) })));
+    httpRequests.push(...(observation.httpRequests ?? []).map((request) => ({ ...request, operation: id(request.operation) })));
     diagnostics.push(...observation.diagnostics);
+    sourceUnits.push(...observation.sourceUnits ?? []);
   }
   return createScanObservation({
     scanner: parts[0].observation.scanner,
@@ -250,58 +745,810 @@ function combineObservations(parts) {
     files: [...files.values()],
     operations,
     invocations,
-    diagnostics
+    diagnostics,
+    ...parts.some((part) => part.observation.sourceUnits !== undefined) ? { sourceUnits } : {},
+    ...parts.some((part) => part.observation.httpEndpoints !== undefined) ? { httpEndpoints } : {},
+    ...parts.some((part) => part.observation.httpRequests !== undefined) ? { httpRequests } : {}
   });
 }
 
+// plugins/scanners/react/src/http.ts
+import ts3 from "./typescript.cjs";
+
+// plugins/scanners/http-syntax.ts
+function wrapper(ts, node) {
+  return ts.isParenthesizedExpression(node) || ts.isAsExpression(node) || ts.isSatisfiesExpression(node) || ts.isNonNullExpression(node) || ts.isTypeAssertionExpression(node);
+}
+function unwrapped(ts, node) {
+  let current = node;
+  while (wrapper(ts, current))
+    current = current.expression;
+  return current;
+}
+function propertyKey(ts, property) {
+  const name = property.name;
+  if (name === undefined)
+    return;
+  return ts.isIdentifier(name) || ts.isStringLiteral(name) || ts.isNumericLiteral(name) ? name.text : undefined;
+}
+function ownProperty(ts, object, name) {
+  let found = "absent";
+  for (const property of object.properties) {
+    const key = propertyKey(ts, property);
+    if (key === undefined || ts.isGetAccessorDeclaration(property) || ts.isSetAccessorDeclaration(property))
+      return "unknown";
+    if (key === name)
+      found = ts.isPropertyAssignment(property) ? { node: property.initializer } : "unknown";
+  }
+  return found;
+}
+function holderOf(ts, node) {
+  let current = node;
+  while (wrapper(ts, current.parent))
+    current = current.parent;
+  return ts.isVariableDeclaration(current.parent) ? current.parent : undefined;
+}
+function urlText(ts, node) {
+  if (ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node) || ts.isTemplateExpression(node))
+    return true;
+  return ts.isBinaryExpression(node) && node.operatorToken.kind === ts.SyntaxKind.PlusToken;
+}
+
+// plugins/scanners/http-uses.ts
+function patternPart(ts, parent, target) {
+  if (ts.isPropertyAssignment(parent))
+    return parent.initializer === target;
+  return ts.isArrayLiteralExpression(parent) || ts.isObjectLiteralExpression(parent) || ts.isSpreadElement(parent) || ts.isSpreadAssignment(parent) || ts.isShorthandPropertyAssignment(parent) || wrapper(ts, parent);
+}
+function assignment(ts, parent, direct) {
+  const operator = parent.operatorToken.kind;
+  if (operator < ts.SyntaxKind.FirstAssignment || operator > ts.SyntaxKind.LastAssignment)
+    return;
+  return operator === ts.SyntaxKind.EqualsToken && direct ? { assigned: parent.right } : {};
+}
+function counted(ts, parent) {
+  return (ts.isPrefixUnaryExpression(parent) || ts.isPostfixUnaryExpression(parent)) && (parent.operator === ts.SyntaxKind.PlusPlusToken || parent.operator === ts.SyntaxKind.MinusMinusToken);
+}
+function writeOf(ts, node) {
+  let target = node;
+  while (patternPart(ts, target.parent, target))
+    target = target.parent;
+  const parent = target.parent;
+  const direct = target === node || wrapper(ts, target);
+  if (ts.isBinaryExpression(parent) && parent.left === target)
+    return assignment(ts, parent, direct);
+  if ((ts.isForInStatement(parent) || ts.isForOfStatement(parent)) && parent.initializer === target)
+    return {};
+  return direct && (counted(ts, parent) || ts.isDeleteExpression(parent)) ? {} : undefined;
+}
+function literalKey(ts, node) {
+  return ts.isStringLiteral(node) || ts.isNumericLiteral(node) ? node.text : undefined;
+}
+function calledThrough(ts, node) {
+  const parent = node.parent;
+  if (ts.isCallExpression(parent) || ts.isNewExpression(parent))
+    return parent.expression === node;
+  return ts.isTaggedTemplateExpression(parent) && parent.tag === node;
+}
+function accessKey(ts, parent, object) {
+  if (ts.isPropertyAccessExpression(parent)) {
+    return parent.expression === object && ts.isIdentifier(parent.name) ? parent.name.text : undefined;
+  }
+  if (!ts.isElementAccessExpression(parent) || parent.expression !== object)
+    return;
+  return literalKey(ts, parent.argumentExpression);
+}
+function useOf(ts, reference) {
+  let chain = reference;
+  let receiver;
+  const path = [];
+  for (;; ) {
+    const parent = chain.parent;
+    if (wrapper(ts, parent)) {
+      chain = parent;
+      continue;
+    }
+    const key = accessKey(ts, parent, chain);
+    if (key === undefined)
+      break;
+    receiver = chain;
+    path.push(key);
+    chain = parent;
+  }
+  const write = writeOf(ts, chain);
+  if (write !== undefined)
+    return { kind: "write", path, reference, value: chain, ...write };
+  if (receiver !== undefined && calledThrough(ts, chain)) {
+    return { kind: path.length > 1 ? "read" : "escape", path: path.slice(0, -1), reference, value: receiver };
+  }
+  return { kind: path.length > 0 ? "read" : "escape", path, reference, value: chain };
+}
+function importedName(ts, node) {
+  const parent = node.parent;
+  if (ts.isImportClause(parent))
+    return parent.name === node;
+  return (ts.isImportSpecifier(parent) || ts.isNamespaceImport(parent) || ts.isImportEqualsDeclaration(parent)) && parent.name === node;
+}
+function typePosition(ts, node) {
+  let current = node;
+  while (ts.isQualifiedName(current.parent))
+    current = current.parent;
+  return ts.isTypeQueryNode(current.parent);
+}
+function exportStatement(ts, node) {
+  const parent = node.parent;
+  return ts.isExportSpecifier(parent) || ts.isExportAssignment(parent) && parent.expression === node;
+}
+function exported(ts, declaration) {
+  const statement = declaration.parent.parent;
+  return statement?.modifiers?.some((modifier) => modifier.kind === ts.SyntaxKind.ExportKeyword) === true;
+}
+function topLevel(ts, declaration) {
+  const statement = declaration.parent?.parent;
+  return statement?.parent !== undefined && ts.isSourceFile(statement.parent);
+}
+function scriptFile(ts, source, names) {
+  if (ts.isExternalModule(source) || /\.[cm]js$/.test(source.fileName))
+    return false;
+  const required = (names.get("require") ?? []).some((node) => ts.isCallExpression(node.parent) && node.parent.expression === node);
+  const exporting = ["module", "exports"].some((name) => (names.get(name) ?? []).some((node) => ts.isPropertyAccessExpression(node.parent) && node.parent.expression === node));
+  return !required && !exporting;
+}
+function dynamicBinding(ts, call) {
+  let holder = call;
+  let awaited = false;
+  while (ts.isAwaitExpression(holder.parent) || ts.isParenthesizedExpression(holder.parent)) {
+    awaited ||= ts.isAwaitExpression(holder.parent);
+    holder = holder.parent;
+  }
+  const parent = holder.parent;
+  if (ts.isVariableDeclaration(parent))
+    return awaited && ts.isIdentifier(parent.name) ? parent.name : undefined;
+  const then = ts.isPropertyAccessExpression(parent) && parent.expression === holder && !awaited ? parent.parent : undefined;
+  const callback = then !== undefined && ts.isCallExpression(then) ? then.arguments[0] : undefined;
+  if (callback === undefined || !ts.isArrowFunction(callback) && !ts.isFunctionExpression(callback))
+    return;
+  const [first] = callback.parameters;
+  return first !== undefined && ts.isIdentifier(first.name) ? first.name : undefined;
+}
+function requiredModule(ts, node) {
+  if (node !== undefined && ts.isExternalModuleReference(node))
+    return ts.isStringLiteral(node.expression) ? node.expression.text : undefined;
+  if (node === undefined || !ts.isCallExpression(node) || !ts.isIdentifier(node.expression) || node.expression.text !== "require")
+    return;
+  const [specifier] = node.arguments;
+  return specifier !== undefined && ts.isStringLiteral(specifier) ? specifier.text : undefined;
+}
+function importModule(ts, statement, name) {
+  return ts.isImportDeclaration(statement) && ts.isStringLiteral(statement.moduleSpecifier) ? { module: statement.moduleSpecifier.text, name } : undefined;
+}
+function requiredValue(ts, initializer) {
+  const value = initializer === undefined ? undefined : unwrapped(ts, initializer);
+  const direct = requiredModule(ts, value);
+  if (direct !== undefined)
+    return { module: direct, name: "default" };
+  if (value === undefined || !ts.isPropertyAccessExpression(value) || !ts.isIdentifier(value.name))
+    return;
+  const module = requiredModule(ts, unwrapped(ts, value.expression));
+  return module === undefined ? undefined : { module, name: value.name.text };
+}
+function boundExport(ts, declaration) {
+  if (ts.isImportClause(declaration))
+    return importModule(ts, declaration.parent, "default");
+  if (ts.isNamespaceImport(declaration))
+    return importModule(ts, declaration.parent.parent, "*");
+  if (ts.isImportSpecifier(declaration)) {
+    return importModule(ts, declaration.parent.parent.parent, (declaration.propertyName ?? declaration.name).text);
+  }
+  if (ts.isImportEqualsDeclaration(declaration))
+    return requiredValue(ts, declaration.moduleReference);
+  if (ts.isVariableDeclaration(declaration))
+    return requiredValue(ts, declaration.initializer);
+  if (!ts.isBindingElement(declaration))
+    return;
+  const variable = declaration.parent.parent;
+  const module = ts.isVariableDeclaration(variable) ? requiredModule(ts, variable.initializer) : undefined;
+  const key = declaration.propertyName ?? declaration.name;
+  return module !== undefined && key !== undefined && ts.isIdentifier(key) ? { module, name: key.text } : undefined;
+}
+function defaultImport(ts, name) {
+  const declaration = name.parent;
+  const origin = declaration.name === name ? boundExport(ts, declaration) : undefined;
+  return origin?.name === "default" ? { declaration, module: origin.module } : undefined;
+}
+function indexName(ts, index, node) {
+  const same = index.names.get(node.text);
+  if (same === undefined)
+    index.names.set(node.text, [node]);
+  else
+    same.push(node);
+  if (importedName(ts, node))
+    index.imported.add(node.text);
+  const imported = defaultImport(ts, node);
+  if (imported !== undefined)
+    index.defaults.set(imported.module, [...index.defaults.get(imported.module) ?? [], imported.declaration]);
+}
+function indexSources(ts, sources) {
+  const index = { names: new Map, imported: new Set, dynamic: [], defaults: new Map };
+  const visit = (node) => {
+    if (ts.isIdentifier(node))
+      indexName(ts, index, node);
+    if (ts.isCallExpression(node) && node.expression.kind === ts.SyntaxKind.ImportKeyword) {
+      const binding = dynamicBinding(ts, node);
+      index.dynamic.push({ call: node, ...binding === undefined ? {} : { binding } });
+    }
+    ts.forEachChild(node, visit);
+  };
+  for (const source of sources)
+    visit(source);
+  return index;
+}
+function startsWith(path, prefix) {
+  return prefix.length <= path.length && prefix.every((name, index) => path[index] === name);
+}
+function useAt(ts, node) {
+  const parent = node.parent;
+  if (ts.isVariableDeclaration(parent) && parent.name === node)
+    return { kind: "write", path: [], reference: node, value: node };
+  if (exportStatement(ts, node))
+    return { kind: "export", path: [], reference: node, value: node };
+  const accessed = ts.isPropertyAccessExpression(parent) && parent.name === node;
+  return useOf(ts, accessed ? parent : node);
+}
+function objectUse(ts, node) {
+  const parent = node.parent;
+  const named = ts.isPropertyAccessExpression(parent) && parent.expression === node && ts.isIdentifier(parent.name);
+  const declaring = (ts.isVariableDeclaration(parent) || ts.isParameter(parent)) && parent.name === node;
+  return !named && !declaring && !importedName(ts, node) && !typePosition(ts, node);
+}
+function settingEffect(use, path, keys) {
+  if (use.path.length === 0 || use.kind === "export")
+    return { kind: "none" };
+  if (startsWith(path, use.path))
+    return { kind: "changes" };
+  const key = startsWith(use.path, path) ? use.path[path.length] : undefined;
+  if (key === undefined || !keys.includes(key))
+    return { kind: "none" };
+  if (use.assigned !== undefined && use.path.length === path.length + 1)
+    return { kind: "assigns", key, value: use.assigned };
+  return { kind: "changes" };
+}
+
+// plugins/scanners/http-bindings.ts
+function bindingUses(ts, checker, sources, options) {
+  let index;
+  const indexed = () => {
+    index ??= indexSources(ts, sources);
+    return index;
+  };
+  const uses = new Map;
+  const symbols = new Map;
+  const shorthand = (node) => ts.isShorthandPropertyAssignment(node.parent) && node.parent.name === node;
+  const resolveAll = (names) => {
+    const pending = names.filter((node) => !symbols.has(node) && !shorthand(node));
+    const batch = pending.length === 0 ? Promise.resolve([]) : checker.symbolsAt(pending);
+    for (const [position, node] of pending.entries())
+      symbols.set(node, batch.then((found) => found[position]));
+  };
+  const symbolOf = (node) => {
+    let found = symbols.get(node);
+    if (found === undefined) {
+      found = shorthand(node) ? checker.shorthandValue(node.parent) : checker.symbolsAt([node]).then(([symbol]) => symbol);
+      symbols.set(node, found);
+    }
+    return found;
+  };
+  const refersTo = async (node, declaration) => {
+    const symbol = await symbolOf(node);
+    if (symbol === undefined || node.parent === declaration)
+      return false;
+    if (await checker.declaration(symbol) === declaration)
+      return true;
+    if (importedName(ts, node))
+      return false;
+    return await checker.declaration(await checker.aliased(symbol)) === declaration;
+  };
+  const usesOf = (declaration) => {
+    let found = uses.get(declaration);
+    if (found !== undefined)
+      return found;
+    found = (async () => {
+      const { names, imported } = indexed();
+      const name = declaration.name !== undefined && ts.isIdentifier(declaration.name) ? declaration.name.text : undefined;
+      const texts = name === undefined ? [] : [name, "default", ...imported];
+      const candidates = [...new Set(texts.flatMap((text) => names.get(text) ?? []))].filter((node) => !typePosition(ts, node));
+      resolveAll(candidates);
+      const referring = await Promise.all(candidates.map((node) => refersTo(node, declaration)));
+      return candidates.filter((_, position) => referring[position]).map((node) => useAt(ts, node));
+    })();
+    uses.set(declaration, found);
+    return found;
+  };
+  const dynamicEscapes = async ({ binding }) => {
+    if (binding === undefined)
+      return true;
+    const bound = await symbolOf(binding);
+    const references = indexed().names.get(binding.text) ?? [];
+    resolveAll(references);
+    for (const node of references) {
+      const symbol = await symbolOf(node);
+      if (bound !== undefined && symbol !== undefined && checker.same(symbol, bound) && objectUse(ts, node))
+        return true;
+    }
+    return false;
+  };
+  const moduleOf = async (node) => {
+    const symbol = await symbolOf(node);
+    const module = symbol === undefined ? undefined : await checker.aliased(symbol);
+    return module !== undefined && checker.module(module) ? module : undefined;
+  };
+  const loadedModule = async (entry) => {
+    const [argument] = entry.call.arguments;
+    const [module] = argument === undefined ? [] : await checker.symbolsAt([argument]);
+    return module !== undefined && await dynamicEscapes(entry) ? module : undefined;
+  };
+  const escapedModules = async () => {
+    const { names, imported, dynamic } = indexed();
+    const importedNames = [...imported].flatMap((text) => names.get(text) ?? []).filter((node) => objectUse(ts, node));
+    resolveAll(importedNames);
+    const found = await Promise.all([...importedNames.map(moduleOf), ...dynamic.map(loadedModule)]);
+    const modules = [];
+    for (const module of found) {
+      if (module !== undefined && !modules.some((known) => checker.same(known, module)))
+        modules.push(module);
+    }
+    return modules;
+  };
+  let reachable;
+  const escapedExports = () => {
+    reachable ??= (async () => {
+      const exports = (await Promise.all((await escapedModules()).map((module) => checker.exportsOf(module)))).flat();
+      const declarations = await Promise.all(exports.map(async (symbol) => checker.declaration(await checker.aliased(symbol))));
+      return new Set(declarations.filter((declaration) => declaration !== undefined));
+    })();
+    return reachable;
+  };
+  const script = () => options.fileAlone && sources.some((source) => scriptFile(ts, source, indexed().names));
+  const leaves = async (declaration) => {
+    if (!options.fileAlone)
+      return (await escapedExports()).has(declaration);
+    return exported(ts, declaration) || topLevel(ts, declaration) && script();
+  };
+  const readChanges = async (use) => use.kind !== "read" || !await checker.primitiveAt(use.value);
+  const changes = async (use, path, reference) => {
+    if (use.reference === reference || !startsWith(path, use.path))
+      return false;
+    return use.kind === "export" ? options.fileAlone : readChanges(use);
+  };
+  const settingAt = async (settings, use, path, keys) => {
+    const effect = settingEffect(use, path, keys);
+    if (effect.kind === "assigns")
+      settings.assigned.set(effect.key, [...settings.assigned.get(effect.key) ?? [], effect.value]);
+    else if (effect.kind === "changes")
+      settings.changed ||= await readChanges(use);
+  };
+  return {
+    async unchanged(declaration, path, reference) {
+      if (await leaves(declaration))
+        return false;
+      for (const use of await usesOf(declaration))
+        if (await changes(use, path, reference))
+          return false;
+      return true;
+    },
+    async reassigned(declaration) {
+      if (options.fileAlone && topLevel(ts, declaration) && script())
+        return true;
+      return (await usesOf(declaration)).some((use) => use.kind === "write" && use.path.length === 0);
+    },
+    async settings(declaration, path, keys) {
+      const settings = { assigned: new Map, changed: await leaves(declaration) };
+      for (const use of await usesOf(declaration))
+        await settingAt(settings, use, path, keys);
+      return settings;
+    },
+    defaultImports: (module) => indexed().defaults.get(module) ?? [],
+    references: async (declaration) => (await usesOf(declaration)).map((use) => use.reference),
+    named: (text) => indexed().names.get(text) ?? [],
+    fileAlone: options.fileAlone
+  };
+}
+
+// plugins/scanners/http-values.ts
+function urlContext(ts, checker, sources, fileAlone = false) {
+  return { ts, checker, bindings: bindingUses(ts, checker, sources, { fileAlone }) };
+}
+var MAX_DEPTH = 8;
+function declarationFile(node) {
+  return /\.d\.[cm]?ts$/.test(node.getSourceFile().fileName);
+}
+async function declarationOf(context, node) {
+  const { checker } = context;
+  const [symbol] = await checker.symbolsAt([node]);
+  return symbol === undefined ? undefined : checker.declaration(await checker.aliased(symbol));
+}
+var moduleNamesByFile = new WeakMap;
+function moduleNames(ts, source) {
+  let names = moduleNamesByFile.get(source);
+  if (names !== undefined)
+    return names;
+  const found = new Set;
+  const visit = (node) => {
+    const name = node.name;
+    if (name !== undefined && ts.isIdentifier(name) && boundExport(ts, node) !== undefined)
+      found.add(name.text);
+    ts.forEachChild(node, visit);
+  };
+  visit(source);
+  names = found;
+  moduleNamesByFile.set(source, names);
+  return names;
+}
+async function importOrigin(context, node) {
+  const { ts, checker } = context;
+  const required = requiredModule(ts, node);
+  if (required !== undefined)
+    return { module: required, name: "default" };
+  if (!ts.isIdentifier(node) || !moduleNames(ts, node.getSourceFile()).has(node.text))
+    return;
+  const [symbol] = await checker.symbolsAt([node]);
+  const declaration = symbol === undefined ? undefined : await checker.declaration(symbol);
+  const origin = declaration === undefined ? undefined : boundExport(ts, declaration);
+  if (origin === undefined || !ts.isVariableDeclaration(declaration) && !ts.isBindingElement(declaration))
+    return origin;
+  return await unassigned(context, declaration) ? origin : undefined;
+}
+async function runtimeGlobal(context, node) {
+  if (await importOrigin(context, node) !== undefined)
+    return false;
+  const declaration = await declarationOf(context, node);
+  return declaration === undefined || declarationFile(declaration);
+}
+function ambient(ts, declaration) {
+  const flag = ts.NodeFlags.Ambient ?? 0;
+  return ((declaration.flags ?? 0) & flag) !== 0;
+}
+async function unassigned(context, declaration) {
+  const { ts, checker } = context;
+  const list = ts.isVariableDeclaration(declaration) ? declaration.parent : declaration.parent.parent.parent;
+  if (((list.flags ?? 0) & ts.NodeFlags.Const) !== 0)
+    return true;
+  if (declaration.name === undefined)
+    return false;
+  const [symbol] = await checker.symbolsAt([declaration.name]);
+  return symbol !== undefined && checker.declarationCount(symbol) === 1 && !await context.bindings.reassigned(declaration);
+}
+async function variableHeld(context, name, path, depth) {
+  const { ts } = context;
+  const declaration = await declarationOf(context, name);
+  if (declaration === undefined || declarationFile(declaration) || ambient(ts, declaration))
+    return "unseen";
+  if (path.length === 0 && ts.isFunctionDeclaration(declaration))
+    return { node: declaration };
+  if (!ts.isVariableDeclaration(declaration) || declaration.initializer === undefined)
+    return "unknown";
+  if (!ts.isIdentifier(declaration.name) || !await unassigned(context, declaration))
+    return "unknown";
+  if (path.length > 0 && !await context.bindings.unchanged(declaration, path, name))
+    return "unknown";
+  return held(context, declaration.initializer, path, depth + 1);
+}
+async function extendsClass(context, klass, base, depth = 0) {
+  const { ts } = context;
+  if (!ts.isClassLike(klass) || depth > MAX_DEPTH)
+    return false;
+  const clauses = klass.heritageClauses ?? [];
+  const clause = Array.from(clauses).find((entry) => entry.token === ts.SyntaxKind.ExtendsKeyword);
+  const parent = clause?.types[0];
+  const declaration = parent === undefined ? undefined : await declarationOf(context, parent.expression);
+  return declaration !== undefined && (declaration === base || extendsClass(context, declaration, base, depth + 1));
+}
+async function assignmentAt(context, node, same, declaration) {
+  const { ts } = context;
+  const parent = node.parent;
+  if (ts.isPropertyAccessExpression(parent) && parent.name === node) {
+    const use = same ? useAt(ts, node) : undefined;
+    return use?.kind === "write" ? { value: use.path.length === 0 ? use.assigned : undefined } : undefined;
+  }
+  if (!ts.isPropertyDeclaration(parent) || parent.name !== node || declaration === undefined || parent === declaration)
+    return;
+  return await extendsClass(context, parent.parent, declaration.parent) ? { value: parent.initializer } : undefined;
+}
+async function fieldAssignments(context, name, declaration) {
+  const { ts, checker } = context;
+  const [symbol] = await checker.symbolsAt([name]);
+  const initialized = declaration !== undefined && (ts.isPropertyDeclaration(declaration) || ts.isPropertyAssignment(declaration)) ? declaration.initializer : undefined;
+  const assignments = initialized === undefined ? [] : [initialized];
+  const others = context.bindings.named(name.text).filter((node) => node !== name);
+  const symbols = await checker.symbolsAt(others);
+  for (const [position, node] of others.entries()) {
+    const found = symbols[position];
+    const same = found !== undefined && symbol !== undefined && checker.same(found, symbol);
+    const assignment = await assignmentAt(context, node, same, declaration);
+    if (assignment !== undefined)
+      assignments.push(assignment.value);
+  }
+  return assignments;
+}
+async function fieldHeld(context, access, path, depth) {
+  const { ts, checker } = context;
+  const [symbol] = await checker.symbolsAt([access.name]);
+  const declaration = symbol === undefined ? undefined : await checker.declaration(symbol);
+  const assignments = await fieldAssignments(context, access.name, declaration);
+  const injected = declaration !== undefined && ts.isParameter(declaration);
+  if (assignments.length === 0)
+    return "unseen";
+  const [only] = assignments;
+  if (injected || assignments.length > 1 || only === undefined || path.length > 0 || context.bindings.fileAlone)
+    return "unknown";
+  return held(context, only, path, depth + 1);
+}
+async function held(context, node, path, depth) {
+  const { ts } = context;
+  if (depth > MAX_DEPTH)
+    return "unknown";
+  const value = unwrapped(ts, node);
+  const [name, ...rest] = path;
+  if (ts.isObjectLiteralExpression(value) && name !== undefined) {
+    const property = ownProperty(ts, value, name);
+    if (typeof property !== "string")
+      return held(context, property.node, rest, depth + 1);
+    return property === "absent" && rest.length === 0 ? "absent" : "unknown";
+  }
+  if (ts.isPropertyAccessExpression(value) && ts.isIdentifier(value.name)) {
+    if (value.expression.kind === ts.SyntaxKind.ThisKeyword)
+      return fieldHeld(context, value, path, depth);
+    return held(context, value.expression, [value.name.text, ...path], depth + 1);
+  }
+  if (ts.isIdentifier(value))
+    return variableHeld(context, value, path, depth);
+  if (name === undefined)
+    return { node: value };
+  return ts.isMetaProperty(value) ? "unseen" : "unknown";
+}
+function heldAt(context, node, ...path) {
+  return held(context, node, path, 0);
+}
+async function heldParts(context, value) {
+  if (value === "unseen")
+    return [configuredPart];
+  return typeof value === "string" ? [computedPart] : urlParts(context, value.node);
+}
+async function urlParts(context, node, depth = 0) {
+  const { ts } = context;
+  if (depth > MAX_DEPTH)
+    return [computedPart];
+  const value = unwrapped(ts, node);
+  if (ts.isStringLiteral(value) || ts.isNoSubstitutionTemplateLiteral(value))
+    return [{ kind: "text", text: value.text }];
+  if (ts.isTemplateExpression(value)) {
+    const parts = [{ kind: "text", text: value.head.text }];
+    for (const span of value.templateSpans) {
+      parts.push(...await urlParts(context, span.expression, depth + 1), { kind: "text", text: span.literal.text });
+    }
+    return parts;
+  }
+  if (ts.isBinaryExpression(value) && value.operatorToken.kind === ts.SyntaxKind.PlusToken) {
+    return [...await urlParts(context, value.left, depth + 1), ...await urlParts(context, value.right, depth + 1)];
+  }
+  if (!ts.isIdentifier(value) && !ts.isPropertyAccessExpression(value))
+    return [computedPart];
+  const resolved = await held(context, value, [], depth + 1);
+  return typeof resolved === "string" ? heldParts(context, resolved) : urlParts(context, resolved.node, depth + 1);
+}
+async function literalText(context, node) {
+  if (node === undefined)
+    return;
+  const [first, ...rest] = await urlParts(context, node);
+  return rest.length === 0 && first?.kind === "text" ? first.text : undefined;
+}
+async function methodName(context, node) {
+  return methodText(await literalText(context, node));
+}
+
+// plugins/scanners/http-clients.ts
+async function declaredMethod(context, options, fallback) {
+  if (options === undefined)
+    return fallback;
+  const declared = await heldAt(context, options, "method");
+  if (declared === "absent")
+    return fallback;
+  return typeof declared === "string" ? undefined : methodName(context, declared.node);
+}
+async function optionsBase(context, config, fallback) {
+  if (config === undefined)
+    return fallback;
+  const base = await heldAt(context, config, "baseURL");
+  return base === "absent" ? fallback : heldParts(context, base);
+}
+async function runtimeFetch(context, callee) {
+  if (!context.ts.isIdentifier(callee) || callee.text !== "fetch")
+    return;
+  const origin = await importOrigin(context, callee);
+  const fetch = origin === undefined ? await runtimeGlobal(context, callee) : origin.module === "node-fetch" && origin.name === "default";
+  return fetch ? "fetch" : undefined;
+}
+async function fetchRequest(context, call, client) {
+  const [url, options] = call.arguments;
+  const kind = url === undefined ? undefined : await client(call.expression);
+  if (url === undefined || kind === undefined)
+    return;
+  const input = await heldAt(context, url);
+  const method = input === "unseen" || typeof input === "object" && urlText(context.ts, input.node) ? await declaredMethod(context, options, "GET") : undefined;
+  const parts = await urlParts(context, url);
+  const target = kind === "ofetch" ? withBase(await optionsBase(context, options, []), parts) : parts;
+  return { ...method === undefined ? {} : { method }, ...requestUrl(target) };
+}
+async function withDefaults(context, client, holders) {
+  const found = await Promise.all(holders.map((holder) => context.bindings.settings(holder, ["defaults"], ["baseURL", "method"])));
+  const bases = found.flatMap((settings) => settings.assigned.get("baseURL") ?? []);
+  const methods = found.flatMap((settings) => settings.assigned.get("method") ?? []);
+  if (found.some((settings) => settings.changed) || bases.length > 1 || methods.length > 1)
+    return { base: [computedPart], method: undefined };
+  return {
+    base: bases[0] === undefined ? client.base : await urlParts(context, bases[0]),
+    method: methods[0] === undefined ? client.method : methodText(await literalText(context, methods[0]))
+  };
+}
+function defaultClient(context) {
+  return withDefaults(context, { base: [], method: "GET" }, context.bindings.defaultImports("axios"));
+}
+async function sent(context, client, url, method, config) {
+  const effective = method ?? await declaredMethod(context, config, client.method);
+  const base = await optionsBase(context, config, client.base);
+  return { ...effective === undefined ? {} : { method: effective }, ...requestUrl(joinBase(base, url)) };
+}
+async function configRequest(context, client, config) {
+  const url = config === undefined ? "absent" : await heldAt(context, config, "url");
+  return url === "absent" ? undefined : sent(context, client, await heldParts(context, url), undefined, config);
+}
+async function holdsObject(context, node) {
+  const value = await heldAt(context, node);
+  return typeof value === "object" && context.ts.isObjectLiteralExpression(value.node);
+}
+var SHORTHAND = new Map([
+  ["get", "GET"],
+  ["post", "POST"],
+  ["put", "PUT"],
+  ["patch", "PATCH"],
+  ["delete", "DELETE"],
+  ["head", "HEAD"],
+  ["options", "OPTIONS"]
+]);
+var WITH_BODY = new Set(["post", "put", "patch"]);
+async function isAxios(context, node) {
+  const origin = await importOrigin(context, node);
+  return origin?.module === "axios" && origin.name === "default";
+}
+async function createdClient(context, node) {
+  const { ts } = context;
+  const created = await heldAt(context, node);
+  const call = typeof created === "object" && ts.isCallExpression(created.node) ? created.node : undefined;
+  const callee = call?.expression;
+  if (call === undefined || callee === undefined || !ts.isPropertyAccessExpression(callee) || !ts.isIdentifier(callee.name))
+    return;
+  if (callee.name.text !== "create" || !await isAxios(context, callee.expression))
+    return;
+  const parent = await defaultClient(context);
+  const inherited = { base: parent.base.length === 0 ? [] : [computedPart], method: parent.method === "GET" ? "GET" : undefined };
+  const [config] = call.arguments;
+  const client = { base: await optionsBase(context, config, inherited.base), method: await declaredMethod(context, config, inherited.method) };
+  const holders = [await declarationOf(context, node), holderOf(ts, call)].filter((holder) => holder !== undefined);
+  return withDefaults(context, client, [...new Set(holders)]);
+}
+async function axiosClient(context, node) {
+  if (!context.ts.isIdentifier(node))
+    return;
+  return await isAxios(context, node) ? defaultClient(context) : createdClient(context, node);
+}
+async function axiosRequest(context, call) {
+  const { ts } = context;
+  const callee = call.expression;
+  const [first, second, third] = call.arguments;
+  if (ts.isPropertyAccessExpression(callee) && ts.isIdentifier(callee.name)) {
+    const client = await axiosClient(context, callee.expression);
+    if (client === undefined)
+      return;
+    const member = callee.name.text;
+    const method = SHORTHAND.get(member);
+    if (method !== undefined && first !== undefined) {
+      return sent(context, client, await urlParts(context, first), method, WITH_BODY.has(member) ? third : second);
+    }
+    return member === "request" ? configRequest(context, client, first) : undefined;
+  }
+  const client = await axiosClient(context, callee);
+  if (client === undefined || first === undefined)
+    return;
+  if (await holdsObject(context, first))
+    return configRequest(context, client, first);
+  return sent(context, client, await urlParts(context, first), undefined, second);
+}
+
+// plugins/scanners/http-checker.ts
+function primitive(ts, type) {
+  if (type.isUnion())
+    return (type.types ?? []).every((member) => primitive(ts, member));
+  const flags = ts.TypeFlags;
+  const mask = flags.StringLike | flags.NumberLike | flags.BigIntLike | flags.BooleanLike | flags.EnumLike | flags.ESSymbolLike | flags.VoidLike | flags.Null;
+  return (type.flags & mask) !== 0;
+}
+function classicChecker(ts, checker) {
+  const symbol = (handle) => handle;
+  return {
+    symbolsAt: async (nodes) => nodes.map((node) => checker.getSymbolAtLocation(node)),
+    shorthandValue: async (property) => checker.getShorthandAssignmentValueSymbol(property),
+    aliased: async (handle) => symbol(handle).flags & ts.SymbolFlags.Alias ? checker.getAliasedSymbol(symbol(handle)) : handle,
+    module: (handle) => (symbol(handle).flags & ts.SymbolFlags.ValueModule) !== 0,
+    declaration: async (handle) => symbol(handle).valueDeclaration ?? symbol(handle).declarations?.[0],
+    declarationCount: (handle) => symbol(handle).declarations?.length ?? 0,
+    exportsOf: async (handle) => checker.getExportsOfModule(symbol(handle)),
+    primitiveAt: async (node) => primitive(ts, checker.getTypeAtLocation(node)),
+    same: (left, right) => left === right
+  };
+}
+
+// plugins/scanners/react/src/http.ts
+async function reactHttpRequests(sources, analyzed, checker, callerOperation) {
+  const context = urlContext(ts3, classicChecker(ts3, checker), analyzed);
+  const calls = [];
+  const visit = (node) => {
+    if (ts3.isCallExpression(node))
+      calls.push(node);
+    ts3.forEachChild(node, visit);
+  };
+  for (const source of sources)
+    visit(source);
+  const requests = [];
+  for (const call of calls) {
+    const request = await fetchRequest(context, call, (callee) => runtimeFetch(context, callee)) ?? await axiosRequest(context, call);
+    const operation = request === undefined ? undefined : callerOperation(call);
+    if (request !== undefined && operation !== undefined)
+      requests.push({ operation, ...request });
+  }
+  return requests;
+}
+
 // plugins/scanners/react/src/scan.ts
 function relative(root, file) {
-  return path2.relative(root, file).split(path2.sep).join("/");
+  return path5.relative(root, file).split(path5.sep).join("/");
 }
 function failDiagnostics(diagnostics) {
-  const errors = diagnostics.filter((item) => item.category === ts.DiagnosticCategory.Error);
+  const errors = diagnostics.filter((item) => item.category === ts4.DiagnosticCategory.Error);
   if (errors.length)
-    throw new Error(errors.map((item) => `${item.file?.fileName ?? "React"}: ${ts.flattenDiagnosticMessageText(item.messageText, `
+    throw new Error(errors.map((item) => `${item.file?.fileName ?? "React"}: ${ts4.flattenDiagnosticMessageText(item.messageText, `
 `)}`).join(`
 `));
 }
 function reactProject(root, repositoryRoot = root) {
-  const manifestFile = path2.join(root, "package.json");
-  if (!existsSync2(manifestFile))
+  const manifestFile = path5.join(root, "package.json");
+  if (!existsSync3(manifestFile))
     return;
   const manifest = JSON.parse(readFileSync(manifestFile, "utf8"));
   if (!hasDependency(manifest, "react"))
     return;
   try {
-    createRequire(manifestFile).resolve("react");
-    const configFile = path2.join(root, "tsconfig.json");
-    const config = ts.readConfigFile(configFile, ts.sys.readFile);
+    const configFile = path5.join(root, "tsconfig.json");
+    const config = ts4.readConfigFile(configFile, ts4.sys.readFile);
     if (config.error)
       failDiagnostics([config.error]);
-    const parsed = ts.parseJsonConfigFileContent(config.config, ts.sys, root, undefined, configFile);
+    const parsed = ts4.parseJsonConfigFileContent(config.config, ts4.sys, root, undefined, configFile);
     failDiagnostics(parsed.errors);
-    const program = ts.createProgram(parsed.fileNames, { ...parsed.options, noEmit: true });
-    const sources = program.getSourceFiles().filter((source) => {
+    const program = ts4.createProgram(parsed.fileNames, { ...parsed.options, noEmit: true });
+    const owned = program.getSourceFiles().filter((source) => {
       const file = relative(repositoryRoot, source.fileName);
-      return file.endsWith(".tsx") && !source.isDeclarationFile && !file.startsWith("../") && !file.includes("node_modules/");
+      return !source.isDeclarationFile && !file.startsWith("../") && !file.includes("node_modules/");
     });
+    const sources = owned.filter((source) => source.fileName.endsWith(".tsx"));
     if (!sources.length)
       throw new Error("The project tsconfig.json must include React TSX source files.");
-    const react = ts.resolveModuleName("react", sources[0].fileName, parsed.options, ts.sys).resolvedModule;
-    if (!react?.resolvedFileName.endsWith(".d.ts"))
-      throw new Error("Install @types/react in the project.");
-    failDiagnostics(program.getOptionsDiagnostics());
+    const routers = nextRouters(root);
+    const routes = hasDependency(manifest, "next") ? owned.filter((source) => routeLocation(relative(root, source.fileName), routers) !== undefined) : [];
     failDiagnostics(program.getSyntacticDiagnostics());
-    for (const source of sources)
-      failDiagnostics(program.getSemanticDiagnostics(source));
-    return { manifest, program, sources };
+    return { manifest, program, owned, sources, routes, routers };
   } catch (error) {
-    throw new Error(`REACT_PROJECT_PREPARATION: Install the project dependencies with its declared package manager and lockfile; provide a valid project tsconfig.json and type-correct TSX files. ${error}`);
+    throw new Error(`REACT_SOURCE_INVALID: Check the project tsconfig.json and TSX syntax. ${error}`);
   }
 }
-function executable(node) {
-  return ts.isArrowFunction(node) || ts.isFunctionExpression(node) || ts.isFunctionDeclaration(node) && !!node.body;
-}
 function caller(node) {
   for (let parent = node.parent;parent; parent = parent.parent)
     if (executable(parent))
@@ -309,20 +1556,20 @@ function caller(node) {
   return;
 }
 function writesSymbol(target, symbol, checker) {
-  if (ts.isIdentifier(target))
+  if (ts4.isIdentifier(target))
     return checker.getSymbolAtLocation(target) === symbol;
-  if (ts.isShorthandPropertyAssignment(target))
+  if (ts4.isShorthandPropertyAssignment(target))
     return checker.getShorthandAssignmentValueSymbol(target) === symbol;
-  if (ts.isArrayLiteralExpression(target))
+  if (ts4.isArrayLiteralExpression(target))
     return target.elements.some((item) => writesSymbol(item, symbol, checker));
-  if (ts.isObjectLiteralExpression(target))
+  if (ts4.isObjectLiteralExpression(target))
     return target.properties.some((item) => writesSymbol(item, symbol, checker));
-  if (ts.isPropertyAssignment(target))
+  if (ts4.isPropertyAssignment(target))
     return writesSymbol(target.initializer, symbol, checker);
-  if (ts.isSpreadElement(target) || ts.isSpreadAssignment(target) || ts.isParenthesizedExpression(target)) {
+  if (ts4.isSpreadElement(target) || ts4.isSpreadAssignment(target) || ts4.isParenthesizedExpression(target)) {
     return writesSymbol(target.expression, symbol, checker);
   }
-  if (ts.isBinaryExpression(target) && target.operatorToken.kind === ts.SyntaxKind.EqualsToken) {
+  if (ts4.isBinaryExpression(target) && target.operatorToken.kind === ts4.SyntaxKind.EqualsToken) {
     return writesSymbol(target.left, symbol, checker);
   }
   return false;
@@ -340,24 +1587,24 @@ class Evidence {
     this.checker = checker;
     this.files = new Set(sources);
   }
-  operation(node) {
+  operationId(node) {
     const file = relative(this.root, node.getSourceFile().fileName);
     const position = node.getStart();
     const id = `${file}#${position}`;
-    const name = node.name?.text ?? (ts.isVariableDeclaration(node.parent) ? node.parent.name.getText() : "callback");
+    const name = node.name?.text ?? (ts4.isVariableDeclaration(node.parent) ? node.parent.name.getText() : "callback");
     this.operations.set(id, { id, file, name, position });
     return id;
   }
   functionValue(name) {
     let symbol = this.checker.getSymbolAtLocation(name);
-    if (symbol && symbol.flags & ts.SymbolFlags.Alias)
+    if (symbol && symbol.flags & ts4.SymbolFlags.Alias)
       symbol = this.checker.getAliasedSymbol(symbol);
     const declaration = symbol?.valueDeclaration;
     if (!declaration || !this.files.has(declaration.getSourceFile()))
       return;
     if (executable(declaration))
       return declaration;
-    if (ts.isVariableDeclaration(declaration) && declaration.parent.flags & ts.NodeFlags.Const && declaration.initializer && executable(declaration.initializer))
+    if (ts4.isVariableDeclaration(declaration) && declaration.parent.flags & ts4.NodeFlags.Const && declaration.initializer && executable(declaration.initializer))
       return declaration.initializer;
     return;
   }
@@ -373,10 +1620,10 @@ class Evidence {
   }
   propCalls(component, attribute) {
     const parameter = component.parameters[0];
-    if (!parameter || !ts.isObjectBindingPattern(parameter.name))
+    if (!parameter || !ts4.isObjectBindingPattern(parameter.name))
       return [];
     const binding = parameter.name.elements.find((element) => !element.dotDotDotToken && !element.initializer && (element.propertyName ?? element.name).getText() === attribute.name.getText());
-    if (!binding || !ts.isIdentifier(binding.name))
+    if (!binding || !ts4.isIdentifier(binding.name))
       return [];
     const symbol = this.checker.getSymbolAtLocation(binding.name);
     if (!symbol)
@@ -385,25 +1632,25 @@ class Evidence {
     let reassigned = false;
     const checker = this.checker;
     const visit = (node) => {
-      if (ts.isBinaryExpression(node) && node.operatorToken.kind >= ts.SyntaxKind.FirstAssignment && node.operatorToken.kind <= ts.SyntaxKind.LastAssignment && writesSymbol(node.left, symbol, checker))
+      if (ts4.isBinaryExpression(node) && node.operatorToken.kind >= ts4.SyntaxKind.FirstAssignment && node.operatorToken.kind <= ts4.SyntaxKind.LastAssignment && writesSymbol(node.left, symbol, checker))
         reassigned = true;
-      if (ts.isForOfStatement(node) && writesSymbol(node.initializer, symbol, checker))
+      if (ts4.isForOfStatement(node) && writesSymbol(node.initializer, symbol, checker))
         reassigned = true;
-      if (ts.isCallExpression(node) && ts.isIdentifier(node.expression) && checker.getSymbolAtLocation(node.expression) === symbol)
+      if (ts4.isCallExpression(node) && ts4.isIdentifier(node.expression) && checker.getSymbolAtLocation(node.expression) === symbol)
         calls.push(node);
-      ts.forEachChild(node, visit);
+      ts4.forEachChild(node, visit);
     };
     visit(component);
     return reassigned ? [] : calls;
   }
   binding(component, attribute) {
     const initializer = attribute.initializer;
-    if (!initializer || !ts.isJsxExpression(initializer) || !initializer.expression)
+    if (!initializer || !ts4.isJsxExpression(initializer) || !initializer.expression)
       return;
     const expression = initializer.expression;
     if (!this.checker.getTypeAtLocation(expression).getCallSignatures().length)
       return;
-    const target = ts.isIdentifier(expression) ? this.functionValue(expression) : undefined;
+    const target = ts4.isIdentifier(expression) ? this.functionValue(expression) : undefined;
     const calls = this.propCalls(component, attribute);
     if (!target || !calls.length) {
       this.unsupported(attribute);
@@ -415,8 +1662,8 @@ class Evidence {
       if (!operation)
         continue;
       this.invocations.push({
-        source: this.operation(operation),
-        targets: [this.operation(target)],
+        source: this.operationId(operation),
+        targets: [this.operationId(target)],
         unresolved: false,
         member: attribute.name.getText(),
         position: call.getStart(),
@@ -433,18 +1680,18 @@ class Evidence {
     const component = this.functionValue(node.tagName);
     if (!component)
       return;
-    if (node.attributes.properties.some(ts.isJsxSpreadAttribute)) {
+    if (node.attributes.properties.some(ts4.isJsxSpreadAttribute)) {
       this.unsupported(node);
       return;
     }
     for (const attribute of node.attributes.properties)
-      if (ts.isJsxAttribute(attribute))
+      if (ts4.isJsxAttribute(attribute))
         this.binding(component, attribute);
   }
   inspect(node) {
-    if (ts.isJsxSelfClosingElement(node) || ts.isJsxOpeningElement(node))
+    if (ts4.isJsxSelfClosingElement(node) || ts4.isJsxOpeningElement(node))
       this.element(node);
-    ts.forEachChild(node, (child) => this.inspect(child));
+    ts4.forEachChild(node, (child) => this.inspect(child));
   }
 }
 async function checkReactReadiness(root) {
@@ -465,18 +1712,25 @@ async function scanReactProject(projectRoot, root) {
   const project = reactProject(projectRoot, root);
   if (!project)
     return;
-  const { manifest, program, sources } = project;
+  const { manifest, program, owned, sources, routes, routers } = project;
   const evidence = new Evidence(root, program.getTypeChecker(), sources);
   for (const source of sources)
     evidence.inspect(source);
-  const files = sources.map((source) => ({ file: relative(root, source.fileName), symbols: [] }));
+  const httpRequests = await reactHttpRequests(sources, owned, program.getTypeChecker(), (call) => {
+    const operation = caller(call);
+    return operation === undefined ? undefined : evidence.operationId(operation);
+  });
+  const httpEndpoints = nextRouteEndpoints(routes, projectRoot, routers, (handler) => evidence.operationId(handler));
+  const files = [...new Set([...sources, ...routes].map((source) => relative(root, source.fileName)))].map((file) => ({ file, symbols: [] }));
   return createScanObservation({
-    scanner: { id: "react", technology: "typescript/react", engine: "typescript-sdk", engineVersion: ts.version },
-    roots: [{ id: "react-project", kind: "package", name: manifest.name, file: relative(root, path2.join(projectRoot, "package.json")) }],
+    scanner: { id: "react", technology: "typescript/react", engine: "typescript-sdk", engineVersion: ts4.version },
+    roots: [{ id: "react-project", kind: "package", name: manifest.name, file: relative(root, path5.join(projectRoot, "package.json")) }],
     files: files.map((file) => ({ ...file, roots: ["react-project"] })),
     operations: [...evidence.operations.values()],
     invocations: evidence.invocations,
-    diagnostics: evidence.diagnostics
+    diagnostics: evidence.diagnostics,
+    ...httpEndpoints.length ? { httpEndpoints } : {},
+    ...httpRequests.length ? { httpRequests } : {}
   });
 }
 
@@ -485,6 +1739,14 @@ var src_default = {
   id: "react",
   watch: { include: ["**/*.tsx", "**/*.ts", "**/tsconfig*.json", "**/package.json"], exclude: [] },
   checkReadiness: checkReactReadiness,
+  listSourceFiles: (root) => frameworkSourceFiles({
+    root,
+    dependency: "react",
+    projects: [".tsx"],
+    sources: [".tsx"],
+    also: routeCandidate
+  }),
+  readCodeStructure: (root, references) => readTypeScriptOutline(ts5, root, references),
   scan: scanReact
 };
 export {