@groma/scanner-vue 0.1.3 → 0.1.4

package/dist/index.js

@@ -39605,6 +39605,116 @@ var require_typescript = __commonJS(function(exports) {
   __exportStar(require_createSys(), exports);
 });
 
+// packages/scanner/src/values.ts
+function object(value, label) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`${label} must be an object`);
+  }
+  return value;
+}
+function string(value, label) {
+  if (typeof value !== "string")
+    throw new Error(`${label} must be a string`);
+  return value;
+}
+function array(value, label) {
+  if (!Array.isArray(value))
+    throw new Error(`${label} must be an array`);
+  return value;
+}
+
+// packages/scanner/src/http.ts
+var pathText = /^[A-Za-z0-9\-._~!$&'()*+,;=:@%]+$/;
+var methodToken = /^[A-Z][A-Z-]*$/;
+function fail(message) {
+  throw new Error(message);
+}
+function text(value, label) {
+  if (typeof value !== "string" || !pathText.test(value))
+    fail(`${label} must be nonempty URL path characters`);
+  return value;
+}
+function method(value, label, anyMethod) {
+  if (typeof value !== "string" || !(methodToken.test(value) || anyMethod && value === "*")) {
+    fail(`${label} must be an uppercase HTTP method${anyMethod ? " or *" : ""}`);
+  }
+  return value;
+}
+function operation(value, operations) {
+  if (typeof value !== "string" || !operations.has(value))
+    fail("HTTP fact references unknown operation");
+  return value;
+}
+function endpointSegment(value, last) {
+  const segment = object(value, "HTTP endpoint segment");
+  if (segment.kind === "literal")
+    return { kind: "literal", value: text(segment.value, "HTTP literal segment") };
+  if (segment.kind !== "parameter" && segment.kind !== "catch-all")
+    fail(`unknown HTTP endpoint segment kind: ${String(segment.kind)}`);
+  if (segment.kind === "catch-all" && !last)
+    fail("an HTTP catch-all segment must be last");
+  for (const flag of ["optional", "constrained"]) {
+    if (segment[flag] !== undefined && typeof segment[flag] !== "boolean")
+      fail(`HTTP segment ${flag} must be a boolean`);
+  }
+  return {
+    kind: segment.kind,
+    name: text(segment.name, "HTTP segment name"),
+    ...segment.optional ? { optional: true } : {},
+    ...segment.constrained ? { constrained: true } : {}
+  };
+}
+function requestSegment(value) {
+  const segment = object(value, "HTTP request segment");
+  if (segment.kind === "literal")
+    return { kind: "literal", value: text(segment.value, "HTTP literal segment") };
+  if (segment.kind === "dynamic" || segment.kind === "unknown")
+    return { kind: segment.kind };
+  return fail(`unknown HTTP request segment kind: ${String(segment.kind)}`);
+}
+function order(value) {
+  const fact = object(value, "HTTP endpoint order");
+  const application = string(fact.application, "HTTP endpoint order application");
+  if (application === "")
+    fail("HTTP endpoint order application must be nonempty");
+  const position = fact.position;
+  if (typeof position !== "number" || !Number.isInteger(position) || position < 0) {
+    fail("HTTP endpoint order position must be a nonnegative integer");
+  }
+  return { application, position };
+}
+function endpoint(value, operations) {
+  const fact = object(value, "HTTP endpoint");
+  const path = array(fact.path, "HTTP endpoint path");
+  return {
+    operation: operation(fact.operation, operations),
+    method: method(fact.method, "HTTP endpoint method", true),
+    path: path.map((segment, index) => endpointSegment(segment, index === path.length - 1)),
+    ...fact.order === undefined ? {} : { order: order(fact.order) }
+  };
+}
+function request(value, operations) {
+  const fact = object(value, "HTTP request");
+  if (fact.configured !== undefined && typeof fact.configured !== "boolean")
+    fail("HTTP request configured must be a boolean");
+  return {
+    operation: operation(fact.operation, operations),
+    ...fact.method === undefined ? {} : { method: method(fact.method, "HTTP request method", false) },
+    ...fact.configured ? { configured: true } : {},
+    path: array(fact.path, "HTTP request path").map(requestSegment)
+  };
+}
+function httpEvidence(endpoints, requests, operations) {
+  if (endpoints === undefined && requests === undefined)
+    return {};
+  if (operations === undefined)
+    fail("HTTP facts require operation declarations");
+  return {
+    ...endpoints === undefined ? {} : { httpEndpoints: array(endpoints, "httpEndpoints").map((fact) => endpoint(fact, operations)) },
+    ...requests === undefined ? {} : { httpRequests: array(requests, "httpRequests").map((fact) => request(fact, operations)) }
+  };
+}
+
 // packages/scanner/src/index.ts
 function compare(...values) {
   return values.join("\x00");
@@ -39648,7 +39758,9 @@ function createScanObservation(input) {
     scanner: input.scanner,
     roots,
     files,
+    ...sourceUnits(input.sourceUnits, filePaths),
     ...operationEvidence(input, filePaths),
+    ...httpEvidence(input.httpEndpoints, input.httpRequests, input.operations && new Set(input.operations.map((operation) => operation.id))),
     diagnostics: [...new Map(input.diagnostics.map((diagnostic) => [
       diagnosticKey(diagnostic),
       diagnostic
@@ -39657,6 +39769,23 @@ function createScanObservation(input) {
     })
   };
 }
+function sourceUnits(input, paths) {
+  if (input === undefined)
+    return {};
+  const units = array(input, "sourceUnits").map((entry) => {
+    const unit = object(entry, "source unit");
+    const primary = string(unit.primary, "source unit.primary");
+    const files = [...new Set(array(unit.files, "source unit.files").map((file) => string(file, "source unit.file")))].sort();
+    if (!files.includes(primary))
+      throw new Error(`source unit omits primary file: ${primary}`);
+    for (const file of files) {
+      if (!paths.has(file))
+        throw new Error(`source unit references unknown file: ${file}`);
+    }
+    return { primary, files };
+  });
+  return { sourceUnits: [...new Map(units.map((unit) => [compare(unit.primary, ...unit.files), unit])).values()].sort((a, b) => compare(a.primary, ...a.files).localeCompare(compare(b.primary, ...b.files))) };
+}
 function validateRoots(input) {
   const roots = uniqueBy(input, (root) => root.id, "root id");
   const byId = new Map(roots.map((root) => [root.id, root]));
@@ -39687,16 +39816,6 @@ function diagnosticLocation(value) {
     ...value.line === undefined ? {} : { line: Number(value.line) }
   };
 }
-function string(value, label) {
-  if (typeof value !== "string")
-    throw new Error(`${label} must be a string`);
-  return value;
-}
-function array(value, label) {
-  if (!Array.isArray(value))
-    throw new Error(`${label} must be an array`);
-  return value;
-}
 function operationEvidence(input, files) {
   if (input.operations === undefined && input.invocations !== undefined)
     throw new Error("invocations require operation declarations");
@@ -39776,7 +39895,6 @@ import ts2 from "./typescript.cjs";
 var import_typescript = __toESM(require_typescript(), 1);
 var import_language_core = __toESM(require_language_core2(), 1);
 import { existsSync as existsSync2, readFileSync } from "fs";
-import { createRequire } from "module";
 import path2 from "path";
 import ts from "./typescript.cjs";
 
@@ -39803,9 +39921,12 @@ var excluded = new Set([
   "groma",
   ".groma"
 ]);
-async function projectFiles(root, matches) {
+async function repositoryFiles(root, matches) {
   const { stdout } = await execute("git", ["-C", root, "ls-files", "-z", "--cached", "--others", "--exclude-standard"], { maxBuffer: 64 * 1024 * 1024 });
-  return [...new Set(stdout.split("\x00").filter((file) => file && matches(file) && !file.split("/").some((part) => excluded.has(part)) && existsSync(path.join(root, file))))].sort();
+  return [...new Set(stdout.split("\x00").filter((file) => file && matches(file) && existsSync(path.join(root, file))))].sort();
+}
+function projectFiles(root, matches) {
+  return repositoryFiles(root, (file) => matches(file) && !file.split("/").some((part) => excluded.has(part)));
 }
 function hasDependency(manifest, dependency) {
   return ["dependencies", "devDependencies", "peerDependencies", "optionalDependencies"].some((section) => typeof manifest[section]?.[dependency] === "string");
@@ -39893,10 +40014,32 @@ class VueProject {
     const code = this.language.scripts.get(file)?.generated?.root;
     return code instanceof import_language_core.VueVirtualCode ? code : undefined;
   }
+  sourceUnit(file) {
+    const sfc = this.sfc(file);
+    if (!sfc)
+      return;
+    const primary = relative(this.root, file);
+    const blocks = [sfc.ir.script, sfc.ir.template, ...sfc.ir.styles];
+    const companions = blocks.flatMap((block) => {
+      const src = block?.attrs.src;
+      if (typeof src !== "string" || !src.startsWith("."))
+        return [];
+      const filename = path2.resolve(path2.dirname(file), src);
+      const member = relative(this.root, filename);
+      if (member.startsWith("../"))
+        return [];
+      readFileSync(filename, "utf8");
+      return [member];
+    });
+    return { primary, files: [primary, ...companions] };
+  }
   validateSfc(file) {
     const sfc = this.sfc(file);
     if (!sfc)
       return;
+    if (sfc.ir.scriptSetup && (sfc.ir.scriptSetup.attrs.src !== undefined || sfc.ir.script?.attrs.src !== undefined)) {
+      throw new Error(`${file}: script setup cannot use src or be combined with an external script block`);
+    }
     const errors = [...sfc.vueSfc?.errors ?? [], ...sfc.ir.template?.errors ?? []];
     if (errors.length)
       throw new Error(`${file}: ${errors.map((error) => typeof error === "string" ? error : error.message).join(`
@@ -39939,20 +40082,19 @@ function vueProject(root, repositoryRoot = root) {
   if (!hasDependency(manifest, "vue"))
     return;
   try {
-    createRequire(manifestFile).resolve("vue/package.json");
     return { manifest, project: new VueProject(root, repositoryRoot) };
   } catch (error) {
-    throw new Error(`VUE_PROJECT_PREPARATION: Install project dependencies with its declared package manager and lockfile; ensure project tsconfig.json and Vue sources are valid. ${error}`);
+    throw new Error(`VUE_SOURCE_INVALID: Check the project tsconfig.json and Vue syntax. ${error}`);
   }
 }
 
 // plugins/scanners/vue/src/evidence.ts
-function operation(node) {
-  return ts2.isFunctionDeclaration(node) || ts2.isFunctionExpression(node) || ts2.isArrowFunction(node);
+function operation2(node) {
+  return ts2.isFunctionDeclaration(node) || ts2.isFunctionExpression(node) || ts2.isArrowFunction(node) || ts2.isMethodDeclaration(node);
 }
 function enclosingOperation(node) {
   for (let current = node.parent;current; current = current.parent) {
-    if (operation(current))
+    if (operation2(current))
       return current;
   }
   return;
@@ -39964,9 +40106,11 @@ function immutable(node) {
   return ts2.isVariableDeclaration(parent) && ts2.isVariableDeclarationList(parent.parent) && (parent.parent.flags & ts2.NodeFlags.Const) !== 0;
 }
 function includesEvent(type, event) {
-  if (type.isStringLiteral())
-    return type.value === event;
-  return type.isUnion() && type.types.some((item) => item.isStringLiteral() && item.value === event);
+  if (!type)
+    return false;
+  if (ts2.isLiteralTypeNode(type) && ts2.isStringLiteral(type.literal))
+    return type.literal.text === event;
+  return ts2.isUnionTypeNode(type) && type.types.some((item) => includesEvent(item, event));
 }
 
 class VueEvidence {
@@ -40023,7 +40167,7 @@ class VueEvidence {
         continue;
       for (const signature of this.project.checker.getTypeAtLocation(node).getCallSignatures()) {
         const declaration = signature.declaration;
-        if (declaration && operation(declaration) && immutable(declaration) && this.project.owned(declaration.getSourceFile()))
+        if (declaration && operation2(declaration) && immutable(declaration) && this.project.owned(declaration.getSourceFile()))
           candidates.add(declaration);
       }
     }
@@ -40053,15 +40197,14 @@ class VueEvidence {
   emissions(sfc, event) {
     const symbol = this.emitSymbol(sfc);
     const source = this.project.program.getSourceFile(sfc.fileName);
-    if (!symbol || !source)
+    if (!symbol || !source || !this.declaresEvent(sfc, event))
       return [];
     const calls = [];
     const checker = this.project.checker;
     function visit(node) {
       if (ts2.isCallExpression(node) && checker.getSymbolAtLocation(node.expression) === symbol) {
         const argument = node.arguments[0];
-        const parameter = checker.getResolvedSignature(node)?.parameters[0];
-        if (argument && ts2.isStringLiteral(argument) && argument.text === event && parameter && includesEvent(checker.getTypeOfSymbolAtLocation(parameter, node), event))
+        if (argument && ts2.isStringLiteral(argument) && argument.text === event)
           calls.push(node);
       }
       ts2.forEachChild(node, visit);
@@ -40069,13 +40212,33 @@ class VueEvidence {
     visit(source);
     return calls;
   }
-  addOperation(node) {
+  declaresEvent(sfc, event) {
+    const setup = sfc.ir.scriptSetup;
+    if (!setup)
+      return false;
+    const range = import_language_core2.parseScriptSetupRanges(vueTypeScript, setup.ast, this.project.options).defineEmits?.typeArg;
+    if (!range)
+      return false;
+    let declared = false;
+    function visit(node) {
+      if (node.getStart(setup.ast) === range.start && ts2.isTypeLiteralNode(node)) {
+        declared = node.members.some((member) => ts2.isPropertySignature(member) && (ts2.isIdentifier(member.name) || ts2.isStringLiteral(member.name)) ? member.name.text === event : ts2.isCallSignatureDeclaration(member) && includesEvent(member.parameters[0]?.type, event));
+      }
+      ts2.forEachChild(node, visit);
+    }
+    visit(setup.ast);
+    return declared;
+  }
+  operationId(node) {
     const position = this.project.position(node);
     if (position === undefined)
       return;
     const file = relative(this.project.root, node.getSourceFile().fileName);
     const id = `${file}#${position}`;
-    const name = ts2.isFunctionDeclaration(node) ? node.name?.text : ts2.isVariableDeclaration(node.parent) ? node.parent.name.getText() : undefined;
+    if (this.operations.has(id))
+      return id;
+    const declared = ts2.isFunctionDeclaration(node) || ts2.isMethodDeclaration(node) ? node.name : undefined;
+    const name = declared !== undefined && ts2.isIdentifier(declared) ? declared.text : ts2.isVariableDeclaration(node.parent) ? node.parent.name.getText() : undefined;
     this.operations.set(id, { id, file, position, name: name ?? `callback at ${this.project.line(node.getSourceFile().fileName, position)}` });
     return id;
   }
@@ -40097,8 +40260,8 @@ class VueEvidence {
       const position = this.project.position(call);
       if (!caller || position === undefined)
         continue;
-      const source = this.addOperation(caller);
-      const targetId = this.addOperation(target);
+      const source = this.operationId(caller);
+      const targetId = this.operationId(target);
       if (!source || !targetId)
         continue;
       this.invocations.push({
@@ -40117,7 +40280,26 @@ class VueEvidence {
 }
 
 // plugins/scanners/vue/src/index.ts
+import path5 from "path";
+
+// plugins/scanners/typescript-project.ts
 import path3 from "path";
+async function frameworkSourceFiles(options) {
+  const { root, dependency, projects, sources, also } = options;
+  const directories = (await frameworkProjects(root, dependency, projects)).map((directory) => path3.relative(root, directory).split(path3.sep).join("/") || ".");
+  if (directories.length === 0)
+    return [];
+  const listed = [];
+  for (const file of await projectFiles(root, (candidate) => !candidate.endsWith(".d.ts"))) {
+    const project = directories.find((directory) => directory === "." || file.startsWith(`${directory}/`));
+    if (project === undefined)
+      continue;
+    const local = project === "." ? file : file.slice(project.length + 1);
+    if (sources.some((extension) => file.endsWith(extension)) || (also?.(local) ?? false))
+      listed.push(file);
+  }
+  return listed.sort();
+}
 
 // plugins/scanners/observations.ts
 function combineObservations(parts) {
@@ -40128,6 +40310,9 @@ function combineObservations(parts) {
   const operations = [];
   const invocations = [];
   const diagnostics = [];
+  const sourceUnits = [];
+  const httpEndpoints = [];
+  const httpRequests = [];
   for (const { key, observation } of parts) {
     const id = (value) => JSON.stringify([key, value]);
     roots.push(...observation.roots.map((root) => ({ ...root, id: id(root.id), ...root.parent ? { parent: id(root.parent) } : {} })));
@@ -40139,7 +40324,10 @@ function combineObservations(parts) {
     }
     operations.push(...(observation.operations ?? []).map((operation) => ({ ...operation, id: id(operation.id) })));
     invocations.push(...(observation.invocations ?? []).map((call) => ({ ...call, source: id(call.source), targets: call.targets.map(id) })));
+    httpEndpoints.push(...(observation.httpEndpoints ?? []).map((endpoint) => ({ ...endpoint, operation: id(endpoint.operation) })));
+    httpRequests.push(...(observation.httpRequests ?? []).map((request) => ({ ...request, operation: id(request.operation) })));
     diagnostics.push(...observation.diagnostics);
+    sourceUnits.push(...observation.sourceUnits ?? []);
   }
   return createScanObservation({
     scanner: parts[0].observation.scanner,
@@ -40147,10 +40335,1420 @@ function combineObservations(parts) {
     files: [...files.values()],
     operations,
     invocations,
-    diagnostics
+    diagnostics,
+    ...parts.some((part) => part.observation.sourceUnits !== undefined) ? { sourceUnits } : {},
+    ...parts.some((part) => part.observation.httpEndpoints !== undefined) ? { httpEndpoints } : {},
+    ...parts.some((part) => part.observation.httpRequests !== undefined) ? { httpRequests } : {}
   });
 }
 
+// plugins/scanners/vue/src/http.ts
+import ts3 from "./typescript.cjs";
+
+// plugins/scanners/http-syntax.ts
+function wrapper(ts, node) {
+  return ts.isParenthesizedExpression(node) || ts.isAsExpression(node) || ts.isSatisfiesExpression(node) || ts.isNonNullExpression(node) || ts.isTypeAssertionExpression(node);
+}
+function unwrapped(ts, node) {
+  let current = node;
+  while (wrapper(ts, current))
+    current = current.expression;
+  return current;
+}
+function propertyKey(ts, property) {
+  const name = property.name;
+  if (name === undefined)
+    return;
+  return ts.isIdentifier(name) || ts.isStringLiteral(name) || ts.isNumericLiteral(name) ? name.text : undefined;
+}
+function ownProperty(ts, object, name) {
+  let found = "absent";
+  for (const property of object.properties) {
+    const key = propertyKey(ts, property);
+    if (key === undefined || ts.isGetAccessorDeclaration(property) || ts.isSetAccessorDeclaration(property))
+      return "unknown";
+    if (key === name)
+      found = ts.isPropertyAssignment(property) ? { node: property.initializer } : "unknown";
+  }
+  return found;
+}
+function holderOf(ts, node) {
+  let current = node;
+  while (wrapper(ts, current.parent))
+    current = current.parent;
+  return ts.isVariableDeclaration(current.parent) ? current.parent : undefined;
+}
+function urlText(ts, node) {
+  if (ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node) || ts.isTemplateExpression(node))
+    return true;
+  return ts.isBinaryExpression(node) && node.operatorToken.kind === ts.SyntaxKind.PlusToken;
+}
+
+// plugins/scanners/http-url.ts
+var pathText2 = /^[A-Za-z0-9\-._~!$&'()*+,;=:@%]+$/;
+var absolute = /^([A-Za-z][A-Za-z\d+.-]*:)?\/\//;
+var HOLE = "\x00";
+var computedPart = { kind: "hole", configured: false };
+var configuredPart = { kind: "hole", configured: true };
+var methodToken2 = /^[A-Z][A-Z-]*$/;
+function methodText(text) {
+  const method = text?.toUpperCase();
+  return method !== undefined && methodToken2.test(method) ? method : undefined;
+}
+function requestSegment2(part) {
+  if (part === HOLE)
+    return { kind: "dynamic" };
+  if (part.includes(HOLE) || !pathText2.test(part))
+    return { kind: "unknown" };
+  return { kind: "literal", value: part };
+}
+function segmentsOf(parts) {
+  const url = parts.map((part) => part.kind === "text" ? part.text : HOLE).join("");
+  const end = Math.min(...["?", "#"].map((mark) => url.includes(mark) ? url.indexOf(mark) : url.length));
+  return url.slice(0, end).split("/").filter((part) => part !== "").map(requestSegment2);
+}
+function afterAuthority(text) {
+  const slash = text.indexOf("/", text.indexOf("//") + 2);
+  return slash < 0 ? "" : text.slice(slash);
+}
+function joinedText(input) {
+  const parts = [];
+  for (const part of input) {
+    const last = parts.at(-1);
+    if (part.kind === "text" && last?.kind === "text")
+      parts[parts.length - 1] = { kind: "text", text: last.text + part.text };
+    else if (part.kind === "hole" || part.text !== "")
+      parts.push(part);
+  }
+  return parts;
+}
+function requestUrl(input) {
+  const parts = joinedText(input);
+  const [first, ...rest] = parts;
+  if (first === undefined)
+    return { path: [{ kind: "unknown" }] };
+  if (first.kind === "hole") {
+    const path = segmentsOf(rest);
+    const next = rest[0];
+    const separated = next === undefined || next.kind === "text" && next.text.startsWith("/");
+    return first.configured && separated ? { configured: true, path } : { path: [{ kind: "unknown" }, ...path] };
+  }
+  if (absolute.test(first.text)) {
+    return { path: [{ kind: "unknown" }, ...segmentsOf([{ kind: "text", text: afterAuthority(first.text) }, ...rest])] };
+  }
+  if (!first.text.startsWith("/"))
+    return { path: [{ kind: "unknown" }, ...segmentsOf(parts)] };
+  return { path: segmentsOf(parts) };
+}
+function joinBase(base, url) {
+  const stated = joinedText(base);
+  const path = joinedText(url);
+  const [first] = path;
+  if (stated.length === 0)
+    return path;
+  if (first === undefined)
+    return stated;
+  if (first.kind === "hole")
+    return [computedPart, ...path.slice(1)];
+  return absolute.test(first.text) ? path : [...stated, { kind: "text", text: "/" }, ...path];
+}
+function withBase(base, url) {
+  const stated = joinedText(base);
+  const path = joinedText(url);
+  const [only] = stated;
+  const [first, ...rest] = path;
+  if (stated.length !== 1 || only?.kind !== "text" || first?.kind !== "text" || absolute.test(first.text)) {
+    return joinBase(stated, path);
+  }
+  const prefix = only.text.replace(/\/$/, "");
+  if (first.text.startsWith(prefix)) {
+    const next = first.text[prefix.length];
+    if (next === undefined)
+      return rest.length === 0 ? path : [computedPart, ...rest];
+    return next === "/" || next === "?" ? path : joinBase(stated, path);
+  }
+  return prefix.startsWith(first.text) && rest.length > 0 ? [computedPart, ...rest] : joinBase(stated, path);
+}
+
+// plugins/scanners/http-uses.ts
+function patternPart(ts, parent, target) {
+  if (ts.isPropertyAssignment(parent))
+    return parent.initializer === target;
+  return ts.isArrayLiteralExpression(parent) || ts.isObjectLiteralExpression(parent) || ts.isSpreadElement(parent) || ts.isSpreadAssignment(parent) || ts.isShorthandPropertyAssignment(parent) || wrapper(ts, parent);
+}
+function assignment(ts, parent, direct) {
+  const operator = parent.operatorToken.kind;
+  if (operator < ts.SyntaxKind.FirstAssignment || operator > ts.SyntaxKind.LastAssignment)
+    return;
+  return operator === ts.SyntaxKind.EqualsToken && direct ? { assigned: parent.right } : {};
+}
+function counted(ts, parent) {
+  return (ts.isPrefixUnaryExpression(parent) || ts.isPostfixUnaryExpression(parent)) && (parent.operator === ts.SyntaxKind.PlusPlusToken || parent.operator === ts.SyntaxKind.MinusMinusToken);
+}
+function writeOf(ts, node) {
+  let target = node;
+  while (patternPart(ts, target.parent, target))
+    target = target.parent;
+  const parent = target.parent;
+  const direct = target === node || wrapper(ts, target);
+  if (ts.isBinaryExpression(parent) && parent.left === target)
+    return assignment(ts, parent, direct);
+  if ((ts.isForInStatement(parent) || ts.isForOfStatement(parent)) && parent.initializer === target)
+    return {};
+  return direct && (counted(ts, parent) || ts.isDeleteExpression(parent)) ? {} : undefined;
+}
+function literalKey(ts, node) {
+  return ts.isStringLiteral(node) || ts.isNumericLiteral(node) ? node.text : undefined;
+}
+function calledThrough(ts, node) {
+  const parent = node.parent;
+  if (ts.isCallExpression(parent) || ts.isNewExpression(parent))
+    return parent.expression === node;
+  return ts.isTaggedTemplateExpression(parent) && parent.tag === node;
+}
+function accessKey(ts, parent, object) {
+  if (ts.isPropertyAccessExpression(parent)) {
+    return parent.expression === object && ts.isIdentifier(parent.name) ? parent.name.text : undefined;
+  }
+  if (!ts.isElementAccessExpression(parent) || parent.expression !== object)
+    return;
+  return literalKey(ts, parent.argumentExpression);
+}
+function useOf(ts, reference) {
+  let chain = reference;
+  let receiver;
+  const path = [];
+  for (;; ) {
+    const parent = chain.parent;
+    if (wrapper(ts, parent)) {
+      chain = parent;
+      continue;
+    }
+    const key = accessKey(ts, parent, chain);
+    if (key === undefined)
+      break;
+    receiver = chain;
+    path.push(key);
+    chain = parent;
+  }
+  const write = writeOf(ts, chain);
+  if (write !== undefined)
+    return { kind: "write", path, reference, value: chain, ...write };
+  if (receiver !== undefined && calledThrough(ts, chain)) {
+    return { kind: path.length > 1 ? "read" : "escape", path: path.slice(0, -1), reference, value: receiver };
+  }
+  return { kind: path.length > 0 ? "read" : "escape", path, reference, value: chain };
+}
+function importedName(ts, node) {
+  const parent = node.parent;
+  if (ts.isImportClause(parent))
+    return parent.name === node;
+  return (ts.isImportSpecifier(parent) || ts.isNamespaceImport(parent) || ts.isImportEqualsDeclaration(parent)) && parent.name === node;
+}
+function typePosition(ts, node) {
+  let current = node;
+  while (ts.isQualifiedName(current.parent))
+    current = current.parent;
+  return ts.isTypeQueryNode(current.parent);
+}
+function exportStatement(ts, node) {
+  const parent = node.parent;
+  return ts.isExportSpecifier(parent) || ts.isExportAssignment(parent) && parent.expression === node;
+}
+function exported(ts, declaration) {
+  const statement = declaration.parent.parent;
+  return statement?.modifiers?.some((modifier) => modifier.kind === ts.SyntaxKind.ExportKeyword) === true;
+}
+function topLevel(ts, declaration) {
+  const statement = declaration.parent?.parent;
+  return statement?.parent !== undefined && ts.isSourceFile(statement.parent);
+}
+function scriptFile(ts, source, names) {
+  if (ts.isExternalModule(source) || /\.[cm]js$/.test(source.fileName))
+    return false;
+  const required = (names.get("require") ?? []).some((node) => ts.isCallExpression(node.parent) && node.parent.expression === node);
+  const exporting = ["module", "exports"].some((name) => (names.get(name) ?? []).some((node) => ts.isPropertyAccessExpression(node.parent) && node.parent.expression === node));
+  return !required && !exporting;
+}
+function dynamicBinding(ts, call) {
+  let holder = call;
+  let awaited = false;
+  while (ts.isAwaitExpression(holder.parent) || ts.isParenthesizedExpression(holder.parent)) {
+    awaited ||= ts.isAwaitExpression(holder.parent);
+    holder = holder.parent;
+  }
+  const parent = holder.parent;
+  if (ts.isVariableDeclaration(parent))
+    return awaited && ts.isIdentifier(parent.name) ? parent.name : undefined;
+  const then = ts.isPropertyAccessExpression(parent) && parent.expression === holder && !awaited ? parent.parent : undefined;
+  const callback = then !== undefined && ts.isCallExpression(then) ? then.arguments[0] : undefined;
+  if (callback === undefined || !ts.isArrowFunction(callback) && !ts.isFunctionExpression(callback))
+    return;
+  const [first] = callback.parameters;
+  return first !== undefined && ts.isIdentifier(first.name) ? first.name : undefined;
+}
+function requiredModule(ts, node) {
+  if (node !== undefined && ts.isExternalModuleReference(node))
+    return ts.isStringLiteral(node.expression) ? node.expression.text : undefined;
+  if (node === undefined || !ts.isCallExpression(node) || !ts.isIdentifier(node.expression) || node.expression.text !== "require")
+    return;
+  const [specifier] = node.arguments;
+  return specifier !== undefined && ts.isStringLiteral(specifier) ? specifier.text : undefined;
+}
+function importModule(ts, statement, name) {
+  return ts.isImportDeclaration(statement) && ts.isStringLiteral(statement.moduleSpecifier) ? { module: statement.moduleSpecifier.text, name } : undefined;
+}
+function requiredValue(ts, initializer) {
+  const value = initializer === undefined ? undefined : unwrapped(ts, initializer);
+  const direct = requiredModule(ts, value);
+  if (direct !== undefined)
+    return { module: direct, name: "default" };
+  if (value === undefined || !ts.isPropertyAccessExpression(value) || !ts.isIdentifier(value.name))
+    return;
+  const module = requiredModule(ts, unwrapped(ts, value.expression));
+  return module === undefined ? undefined : { module, name: value.name.text };
+}
+function boundExport(ts, declaration) {
+  if (ts.isImportClause(declaration))
+    return importModule(ts, declaration.parent, "default");
+  if (ts.isNamespaceImport(declaration))
+    return importModule(ts, declaration.parent.parent, "*");
+  if (ts.isImportSpecifier(declaration)) {
+    return importModule(ts, declaration.parent.parent.parent, (declaration.propertyName ?? declaration.name).text);
+  }
+  if (ts.isImportEqualsDeclaration(declaration))
+    return requiredValue(ts, declaration.moduleReference);
+  if (ts.isVariableDeclaration(declaration))
+    return requiredValue(ts, declaration.initializer);
+  if (!ts.isBindingElement(declaration))
+    return;
+  const variable = declaration.parent.parent;
+  const module = ts.isVariableDeclaration(variable) ? requiredModule(ts, variable.initializer) : undefined;
+  const key = declaration.propertyName ?? declaration.name;
+  return module !== undefined && key !== undefined && ts.isIdentifier(key) ? { module, name: key.text } : undefined;
+}
+function defaultImport(ts, name) {
+  const declaration = name.parent;
+  const origin = declaration.name === name ? boundExport(ts, declaration) : undefined;
+  return origin?.name === "default" ? { declaration, module: origin.module } : undefined;
+}
+function indexName(ts, index, node) {
+  const same = index.names.get(node.text);
+  if (same === undefined)
+    index.names.set(node.text, [node]);
+  else
+    same.push(node);
+  if (importedName(ts, node))
+    index.imported.add(node.text);
+  const imported = defaultImport(ts, node);
+  if (imported !== undefined)
+    index.defaults.set(imported.module, [...index.defaults.get(imported.module) ?? [], imported.declaration]);
+}
+function indexSources(ts, sources) {
+  const index = { names: new Map, imported: new Set, dynamic: [], defaults: new Map };
+  const visit = (node) => {
+    if (ts.isIdentifier(node))
+      indexName(ts, index, node);
+    if (ts.isCallExpression(node) && node.expression.kind === ts.SyntaxKind.ImportKeyword) {
+      const binding = dynamicBinding(ts, node);
+      index.dynamic.push({ call: node, ...binding === undefined ? {} : { binding } });
+    }
+    ts.forEachChild(node, visit);
+  };
+  for (const source of sources)
+    visit(source);
+  return index;
+}
+function startsWith(path, prefix) {
+  return prefix.length <= path.length && prefix.every((name, index) => path[index] === name);
+}
+function useAt(ts, node) {
+  const parent = node.parent;
+  if (ts.isVariableDeclaration(parent) && parent.name === node)
+    return { kind: "write", path: [], reference: node, value: node };
+  if (exportStatement(ts, node))
+    return { kind: "export", path: [], reference: node, value: node };
+  const accessed = ts.isPropertyAccessExpression(parent) && parent.name === node;
+  return useOf(ts, accessed ? parent : node);
+}
+function objectUse(ts, node) {
+  const parent = node.parent;
+  const named = ts.isPropertyAccessExpression(parent) && parent.expression === node && ts.isIdentifier(parent.name);
+  const declaring = (ts.isVariableDeclaration(parent) || ts.isParameter(parent)) && parent.name === node;
+  return !named && !declaring && !importedName(ts, node) && !typePosition(ts, node);
+}
+function settingEffect(use, path, keys) {
+  if (use.path.length === 0 || use.kind === "export")
+    return { kind: "none" };
+  if (startsWith(path, use.path))
+    return { kind: "changes" };
+  const key = startsWith(use.path, path) ? use.path[path.length] : undefined;
+  if (key === undefined || !keys.includes(key))
+    return { kind: "none" };
+  if (use.assigned !== undefined && use.path.length === path.length + 1)
+    return { kind: "assigns", key, value: use.assigned };
+  return { kind: "changes" };
+}
+
+// plugins/scanners/http-bindings.ts
+function bindingUses(ts, checker, sources, options) {
+  let index;
+  const indexed = () => {
+    index ??= indexSources(ts, sources);
+    return index;
+  };
+  const uses = new Map;
+  const symbols = new Map;
+  const shorthand = (node) => ts.isShorthandPropertyAssignment(node.parent) && node.parent.name === node;
+  const resolveAll = (names) => {
+    const pending = names.filter((node) => !symbols.has(node) && !shorthand(node));
+    const batch = pending.length === 0 ? Promise.resolve([]) : checker.symbolsAt(pending);
+    for (const [position, node] of pending.entries())
+      symbols.set(node, batch.then((found) => found[position]));
+  };
+  const symbolOf = (node) => {
+    let found = symbols.get(node);
+    if (found === undefined) {
+      found = shorthand(node) ? checker.shorthandValue(node.parent) : checker.symbolsAt([node]).then(([symbol]) => symbol);
+      symbols.set(node, found);
+    }
+    return found;
+  };
+  const refersTo = async (node, declaration) => {
+    const symbol = await symbolOf(node);
+    if (symbol === undefined || node.parent === declaration)
+      return false;
+    if (await checker.declaration(symbol) === declaration)
+      return true;
+    if (importedName(ts, node))
+      return false;
+    return await checker.declaration(await checker.aliased(symbol)) === declaration;
+  };
+  const usesOf = (declaration) => {
+    let found = uses.get(declaration);
+    if (found !== undefined)
+      return found;
+    found = (async () => {
+      const { names, imported } = indexed();
+      const name = declaration.name !== undefined && ts.isIdentifier(declaration.name) ? declaration.name.text : undefined;
+      const texts = name === undefined ? [] : [name, "default", ...imported];
+      const candidates = [...new Set(texts.flatMap((text) => names.get(text) ?? []))].filter((node) => !typePosition(ts, node));
+      resolveAll(candidates);
+      const referring = await Promise.all(candidates.map((node) => refersTo(node, declaration)));
+      return candidates.filter((_, position) => referring[position]).map((node) => useAt(ts, node));
+    })();
+    uses.set(declaration, found);
+    return found;
+  };
+  const dynamicEscapes = async ({ binding }) => {
+    if (binding === undefined)
+      return true;
+    const bound = await symbolOf(binding);
+    const references = indexed().names.get(binding.text) ?? [];
+    resolveAll(references);
+    for (const node of references) {
+      const symbol = await symbolOf(node);
+      if (bound !== undefined && symbol !== undefined && checker.same(symbol, bound) && objectUse(ts, node))
+        return true;
+    }
+    return false;
+  };
+  const moduleOf = async (node) => {
+    const symbol = await symbolOf(node);
+    const module = symbol === undefined ? undefined : await checker.aliased(symbol);
+    return module !== undefined && checker.module(module) ? module : undefined;
+  };
+  const loadedModule = async (entry) => {
+    const [argument] = entry.call.arguments;
+    const [module] = argument === undefined ? [] : await checker.symbolsAt([argument]);
+    return module !== undefined && await dynamicEscapes(entry) ? module : undefined;
+  };
+  const escapedModules = async () => {
+    const { names, imported, dynamic } = indexed();
+    const importedNames = [...imported].flatMap((text) => names.get(text) ?? []).filter((node) => objectUse(ts, node));
+    resolveAll(importedNames);
+    const found = await Promise.all([...importedNames.map(moduleOf), ...dynamic.map(loadedModule)]);
+    const modules = [];
+    for (const module of found) {
+      if (module !== undefined && !modules.some((known) => checker.same(known, module)))
+        modules.push(module);
+    }
+    return modules;
+  };
+  let reachable;
+  const escapedExports = () => {
+    reachable ??= (async () => {
+      const exports = (await Promise.all((await escapedModules()).map((module) => checker.exportsOf(module)))).flat();
+      const declarations = await Promise.all(exports.map(async (symbol) => checker.declaration(await checker.aliased(symbol))));
+      return new Set(declarations.filter((declaration) => declaration !== undefined));
+    })();
+    return reachable;
+  };
+  const script = () => options.fileAlone && sources.some((source) => scriptFile(ts, source, indexed().names));
+  const leaves = async (declaration) => {
+    if (!options.fileAlone)
+      return (await escapedExports()).has(declaration);
+    return exported(ts, declaration) || topLevel(ts, declaration) && script();
+  };
+  const readChanges = async (use) => use.kind !== "read" || !await checker.primitiveAt(use.value);
+  const changes = async (use, path, reference) => {
+    if (use.reference === reference || !startsWith(path, use.path))
+      return false;
+    return use.kind === "export" ? options.fileAlone : readChanges(use);
+  };
+  const settingAt = async (settings, use, path, keys) => {
+    const effect = settingEffect(use, path, keys);
+    if (effect.kind === "assigns")
+      settings.assigned.set(effect.key, [...settings.assigned.get(effect.key) ?? [], effect.value]);
+    else if (effect.kind === "changes")
+      settings.changed ||= await readChanges(use);
+  };
+  return {
+    async unchanged(declaration, path, reference) {
+      if (await leaves(declaration))
+        return false;
+      for (const use of await usesOf(declaration))
+        if (await changes(use, path, reference))
+          return false;
+      return true;
+    },
+    async reassigned(declaration) {
+      if (options.fileAlone && topLevel(ts, declaration) && script())
+        return true;
+      return (await usesOf(declaration)).some((use) => use.kind === "write" && use.path.length === 0);
+    },
+    async settings(declaration, path, keys) {
+      const settings = { assigned: new Map, changed: await leaves(declaration) };
+      for (const use of await usesOf(declaration))
+        await settingAt(settings, use, path, keys);
+      return settings;
+    },
+    defaultImports: (module) => indexed().defaults.get(module) ?? [],
+    references: async (declaration) => (await usesOf(declaration)).map((use) => use.reference),
+    named: (text) => indexed().names.get(text) ?? [],
+    fileAlone: options.fileAlone
+  };
+}
+
+// plugins/scanners/http-values.ts
+function urlContext(ts, checker, sources, fileAlone = false) {
+  return { ts, checker, bindings: bindingUses(ts, checker, sources, { fileAlone }) };
+}
+var MAX_DEPTH = 8;
+function declarationFile(node) {
+  return /\.d\.[cm]?ts$/.test(node.getSourceFile().fileName);
+}
+async function declarationOf(context, node) {
+  const { checker } = context;
+  const [symbol] = await checker.symbolsAt([node]);
+  return symbol === undefined ? undefined : checker.declaration(await checker.aliased(symbol));
+}
+var moduleNamesByFile = new WeakMap;
+function moduleNames(ts, source) {
+  let names = moduleNamesByFile.get(source);
+  if (names !== undefined)
+    return names;
+  const found = new Set;
+  const visit = (node) => {
+    const name = node.name;
+    if (name !== undefined && ts.isIdentifier(name) && boundExport(ts, node) !== undefined)
+      found.add(name.text);
+    ts.forEachChild(node, visit);
+  };
+  visit(source);
+  names = found;
+  moduleNamesByFile.set(source, names);
+  return names;
+}
+async function importOrigin(context, node) {
+  const { ts, checker } = context;
+  const required = requiredModule(ts, node);
+  if (required !== undefined)
+    return { module: required, name: "default" };
+  if (!ts.isIdentifier(node) || !moduleNames(ts, node.getSourceFile()).has(node.text))
+    return;
+  const [symbol] = await checker.symbolsAt([node]);
+  const declaration = symbol === undefined ? undefined : await checker.declaration(symbol);
+  const origin = declaration === undefined ? undefined : boundExport(ts, declaration);
+  if (origin === undefined || !ts.isVariableDeclaration(declaration) && !ts.isBindingElement(declaration))
+    return origin;
+  return await unassigned(context, declaration) ? origin : undefined;
+}
+async function runtimeGlobal(context, node) {
+  if (await importOrigin(context, node) !== undefined)
+    return false;
+  const declaration = await declarationOf(context, node);
+  return declaration === undefined || declarationFile(declaration);
+}
+function ambient(ts, declaration) {
+  const flag = ts.NodeFlags.Ambient ?? 0;
+  return ((declaration.flags ?? 0) & flag) !== 0;
+}
+async function unassigned(context, declaration) {
+  const { ts, checker } = context;
+  const list = ts.isVariableDeclaration(declaration) ? declaration.parent : declaration.parent.parent.parent;
+  if (((list.flags ?? 0) & ts.NodeFlags.Const) !== 0)
+    return true;
+  if (declaration.name === undefined)
+    return false;
+  const [symbol] = await checker.symbolsAt([declaration.name]);
+  return symbol !== undefined && checker.declarationCount(symbol) === 1 && !await context.bindings.reassigned(declaration);
+}
+async function variableHeld(context, name, path, depth) {
+  const { ts } = context;
+  const declaration = await declarationOf(context, name);
+  if (declaration === undefined || declarationFile(declaration) || ambient(ts, declaration))
+    return "unseen";
+  if (path.length === 0 && ts.isFunctionDeclaration(declaration))
+    return { node: declaration };
+  if (!ts.isVariableDeclaration(declaration) || declaration.initializer === undefined)
+    return "unknown";
+  if (!ts.isIdentifier(declaration.name) || !await unassigned(context, declaration))
+    return "unknown";
+  if (path.length > 0 && !await context.bindings.unchanged(declaration, path, name))
+    return "unknown";
+  return held(context, declaration.initializer, path, depth + 1);
+}
+async function extendsClass(context, klass, base, depth = 0) {
+  const { ts } = context;
+  if (!ts.isClassLike(klass) || depth > MAX_DEPTH)
+    return false;
+  const clauses = klass.heritageClauses ?? [];
+  const clause = Array.from(clauses).find((entry) => entry.token === ts.SyntaxKind.ExtendsKeyword);
+  const parent = clause?.types[0];
+  const declaration = parent === undefined ? undefined : await declarationOf(context, parent.expression);
+  return declaration !== undefined && (declaration === base || extendsClass(context, declaration, base, depth + 1));
+}
+async function assignmentAt(context, node, same, declaration) {
+  const { ts } = context;
+  const parent = node.parent;
+  if (ts.isPropertyAccessExpression(parent) && parent.name === node) {
+    const use = same ? useAt(ts, node) : undefined;
+    return use?.kind === "write" ? { value: use.path.length === 0 ? use.assigned : undefined } : undefined;
+  }
+  if (!ts.isPropertyDeclaration(parent) || parent.name !== node || declaration === undefined || parent === declaration)
+    return;
+  return await extendsClass(context, parent.parent, declaration.parent) ? { value: parent.initializer } : undefined;
+}
+async function fieldAssignments(context, name, declaration) {
+  const { ts, checker } = context;
+  const [symbol] = await checker.symbolsAt([name]);
+  const initialized = declaration !== undefined && (ts.isPropertyDeclaration(declaration) || ts.isPropertyAssignment(declaration)) ? declaration.initializer : undefined;
+  const assignments = initialized === undefined ? [] : [initialized];
+  const others = context.bindings.named(name.text).filter((node) => node !== name);
+  const symbols = await checker.symbolsAt(others);
+  for (const [position, node] of others.entries()) {
+    const found = symbols[position];
+    const same = found !== undefined && symbol !== undefined && checker.same(found, symbol);
+    const assignment = await assignmentAt(context, node, same, declaration);
+    if (assignment !== undefined)
+      assignments.push(assignment.value);
+  }
+  return assignments;
+}
+async function fieldHeld(context, access, path, depth) {
+  const { ts, checker } = context;
+  const [symbol] = await checker.symbolsAt([access.name]);
+  const declaration = symbol === undefined ? undefined : await checker.declaration(symbol);
+  const assignments = await fieldAssignments(context, access.name, declaration);
+  const injected = declaration !== undefined && ts.isParameter(declaration);
+  if (assignments.length === 0)
+    return "unseen";
+  const [only] = assignments;
+  if (injected || assignments.length > 1 || only === undefined || path.length > 0 || context.bindings.fileAlone)
+    return "unknown";
+  return held(context, only, path, depth + 1);
+}
+async function held(context, node, path, depth) {
+  const { ts } = context;
+  if (depth > MAX_DEPTH)
+    return "unknown";
+  const value = unwrapped(ts, node);
+  const [name, ...rest] = path;
+  if (ts.isObjectLiteralExpression(value) && name !== undefined) {
+    const property = ownProperty(ts, value, name);
+    if (typeof property !== "string")
+      return held(context, property.node, rest, depth + 1);
+    return property === "absent" && rest.length === 0 ? "absent" : "unknown";
+  }
+  if (ts.isPropertyAccessExpression(value) && ts.isIdentifier(value.name)) {
+    if (value.expression.kind === ts.SyntaxKind.ThisKeyword)
+      return fieldHeld(context, value, path, depth);
+    return held(context, value.expression, [value.name.text, ...path], depth + 1);
+  }
+  if (ts.isIdentifier(value))
+    return variableHeld(context, value, path, depth);
+  if (name === undefined)
+    return { node: value };
+  return ts.isMetaProperty(value) ? "unseen" : "unknown";
+}
+function heldAt(context, node, ...path) {
+  return held(context, node, path, 0);
+}
+async function heldParts(context, value) {
+  if (value === "unseen")
+    return [configuredPart];
+  return typeof value === "string" ? [computedPart] : urlParts(context, value.node);
+}
+async function urlParts(context, node, depth = 0) {
+  const { ts } = context;
+  if (depth > MAX_DEPTH)
+    return [computedPart];
+  const value = unwrapped(ts, node);
+  if (ts.isStringLiteral(value) || ts.isNoSubstitutionTemplateLiteral(value))
+    return [{ kind: "text", text: value.text }];
+  if (ts.isTemplateExpression(value)) {
+    const parts = [{ kind: "text", text: value.head.text }];
+    for (const span of value.templateSpans) {
+      parts.push(...await urlParts(context, span.expression, depth + 1), { kind: "text", text: span.literal.text });
+    }
+    return parts;
+  }
+  if (ts.isBinaryExpression(value) && value.operatorToken.kind === ts.SyntaxKind.PlusToken) {
+    return [...await urlParts(context, value.left, depth + 1), ...await urlParts(context, value.right, depth + 1)];
+  }
+  if (!ts.isIdentifier(value) && !ts.isPropertyAccessExpression(value))
+    return [computedPart];
+  const resolved = await held(context, value, [], depth + 1);
+  return typeof resolved === "string" ? heldParts(context, resolved) : urlParts(context, resolved.node, depth + 1);
+}
+async function literalText(context, node) {
+  if (node === undefined)
+    return;
+  const [first, ...rest] = await urlParts(context, node);
+  return rest.length === 0 && first?.kind === "text" ? first.text : undefined;
+}
+async function methodName(context, node) {
+  return methodText(await literalText(context, node));
+}
+
+// plugins/scanners/http-clients.ts
+async function declaredMethod(context, options, fallback) {
+  if (options === undefined)
+    return fallback;
+  const declared = await heldAt(context, options, "method");
+  if (declared === "absent")
+    return fallback;
+  return typeof declared === "string" ? undefined : methodName(context, declared.node);
+}
+async function optionsBase(context, config, fallback) {
+  if (config === undefined)
+    return fallback;
+  const base = await heldAt(context, config, "baseURL");
+  return base === "absent" ? fallback : heldParts(context, base);
+}
+async function runtimeFetch(context, callee) {
+  if (!context.ts.isIdentifier(callee) || callee.text !== "fetch")
+    return;
+  const origin = await importOrigin(context, callee);
+  const fetch = origin === undefined ? await runtimeGlobal(context, callee) : origin.module === "node-fetch" && origin.name === "default";
+  return fetch ? "fetch" : undefined;
+}
+async function fetchRequest(context, call, client) {
+  const [url, options] = call.arguments;
+  const kind = url === undefined ? undefined : await client(call.expression);
+  if (url === undefined || kind === undefined)
+    return;
+  const input = await heldAt(context, url);
+  const method = input === "unseen" || typeof input === "object" && urlText(context.ts, input.node) ? await declaredMethod(context, options, "GET") : undefined;
+  const parts = await urlParts(context, url);
+  const target = kind === "ofetch" ? withBase(await optionsBase(context, options, []), parts) : parts;
+  return { ...method === undefined ? {} : { method }, ...requestUrl(target) };
+}
+async function withDefaults(context, client, holders) {
+  const found = await Promise.all(holders.map((holder) => context.bindings.settings(holder, ["defaults"], ["baseURL", "method"])));
+  const bases = found.flatMap((settings) => settings.assigned.get("baseURL") ?? []);
+  const methods = found.flatMap((settings) => settings.assigned.get("method") ?? []);
+  if (found.some((settings) => settings.changed) || bases.length > 1 || methods.length > 1)
+    return { base: [computedPart], method: undefined };
+  return {
+    base: bases[0] === undefined ? client.base : await urlParts(context, bases[0]),
+    method: methods[0] === undefined ? client.method : methodText(await literalText(context, methods[0]))
+  };
+}
+function defaultClient(context) {
+  return withDefaults(context, { base: [], method: "GET" }, context.bindings.defaultImports("axios"));
+}
+async function sent(context, client, url, method, config) {
+  const effective = method ?? await declaredMethod(context, config, client.method);
+  const base = await optionsBase(context, config, client.base);
+  return { ...effective === undefined ? {} : { method: effective }, ...requestUrl(joinBase(base, url)) };
+}
+async function configRequest(context, client, config) {
+  const url = config === undefined ? "absent" : await heldAt(context, config, "url");
+  return url === "absent" ? undefined : sent(context, client, await heldParts(context, url), undefined, config);
+}
+async function holdsObject(context, node) {
+  const value = await heldAt(context, node);
+  return typeof value === "object" && context.ts.isObjectLiteralExpression(value.node);
+}
+var SHORTHAND = new Map([
+  ["get", "GET"],
+  ["post", "POST"],
+  ["put", "PUT"],
+  ["patch", "PATCH"],
+  ["delete", "DELETE"],
+  ["head", "HEAD"],
+  ["options", "OPTIONS"]
+]);
+var WITH_BODY = new Set(["post", "put", "patch"]);
+async function isAxios(context, node) {
+  const origin = await importOrigin(context, node);
+  return origin?.module === "axios" && origin.name === "default";
+}
+async function createdClient(context, node) {
+  const { ts } = context;
+  const created = await heldAt(context, node);
+  const call = typeof created === "object" && ts.isCallExpression(created.node) ? created.node : undefined;
+  const callee = call?.expression;
+  if (call === undefined || callee === undefined || !ts.isPropertyAccessExpression(callee) || !ts.isIdentifier(callee.name))
+    return;
+  if (callee.name.text !== "create" || !await isAxios(context, callee.expression))
+    return;
+  const parent = await defaultClient(context);
+  const inherited = { base: parent.base.length === 0 ? [] : [computedPart], method: parent.method === "GET" ? "GET" : undefined };
+  const [config] = call.arguments;
+  const client = { base: await optionsBase(context, config, inherited.base), method: await declaredMethod(context, config, inherited.method) };
+  const holders = [await declarationOf(context, node), holderOf(ts, call)].filter((holder) => holder !== undefined);
+  return withDefaults(context, client, [...new Set(holders)]);
+}
+async function axiosClient(context, node) {
+  if (!context.ts.isIdentifier(node))
+    return;
+  return await isAxios(context, node) ? defaultClient(context) : createdClient(context, node);
+}
+async function axiosRequest(context, call) {
+  const { ts } = context;
+  const callee = call.expression;
+  const [first, second, third] = call.arguments;
+  if (ts.isPropertyAccessExpression(callee) && ts.isIdentifier(callee.name)) {
+    const client = await axiosClient(context, callee.expression);
+    if (client === undefined)
+      return;
+    const member = callee.name.text;
+    const method = SHORTHAND.get(member);
+    if (method !== undefined && first !== undefined) {
+      return sent(context, client, await urlParts(context, first), method, WITH_BODY.has(member) ? third : second);
+    }
+    return member === "request" ? configRequest(context, client, first) : undefined;
+  }
+  const client = await axiosClient(context, callee);
+  if (client === undefined || first === undefined)
+    return;
+  if (await holdsObject(context, first))
+    return configRequest(context, client, first);
+  return sent(context, client, await urlParts(context, first), undefined, second);
+}
+
+// plugins/scanners/http-checker.ts
+function primitive(ts, type) {
+  if (type.isUnion())
+    return (type.types ?? []).every((member) => primitive(ts, member));
+  const flags = ts.TypeFlags;
+  const mask = flags.StringLike | flags.NumberLike | flags.BigIntLike | flags.BooleanLike | flags.EnumLike | flags.ESSymbolLike | flags.VoidLike | flags.Null;
+  return (type.flags & mask) !== 0;
+}
+function classicChecker(ts, checker) {
+  const symbol = (handle) => handle;
+  return {
+    symbolsAt: async (nodes) => nodes.map((node) => checker.getSymbolAtLocation(node)),
+    shorthandValue: async (property) => checker.getShorthandAssignmentValueSymbol(property),
+    aliased: async (handle) => symbol(handle).flags & ts.SymbolFlags.Alias ? checker.getAliasedSymbol(symbol(handle)) : handle,
+    module: (handle) => (symbol(handle).flags & ts.SymbolFlags.ValueModule) !== 0,
+    declaration: async (handle) => symbol(handle).valueDeclaration ?? symbol(handle).declarations?.[0],
+    declarationCount: (handle) => symbol(handle).declarations?.length ?? 0,
+    exportsOf: async (handle) => checker.getExportsOfModule(symbol(handle)),
+    primitiveAt: async (node) => primitive(ts, checker.getTypeAtLocation(node)),
+    same: (left, right) => left === right
+  };
+}
+
+// plugins/scanners/vue/src/server-routes.ts
+var SERVER_ROUTE = /^server\/((?:api|routes)\/.+)\.(?:[cm]?[jt]s|[jt]sx)$/;
+var GROUP = /\([^(/]+\)\//g;
+var SUFFIX = /(?:\.(connect|delete|get|head|options|patch|post|put|trace))?(?:\.(?:dev|prod|prerender))?$/;
+function named(text) {
+  return text !== "" && pathText2.test(text) ? text : "*";
+}
+function routeSegment(part, last) {
+  const registered = part.replace(/\[\.{3}]/g, "**").replace(/\[\.{3}(\w+)]/g, "**:$1").replace(/\[([^/\]]+)]/g, ":$1");
+  if (registered.startsWith("**"))
+    return last ? { kind: "catch-all", name: named(registered.slice(3)) } : undefined;
+  if (registered.startsWith(":"))
+    return { kind: "parameter", name: named(registered.slice(1)) };
+  return pathText2.test(registered) ? { kind: "literal", value: registered } : undefined;
+}
+function serverRoute(file) {
+  const match = SERVER_ROUTE.exec(file);
+  if (match === null)
+    return;
+  const grouped = match[1].replace(GROUP, "");
+  const suffix = SUFFIX.exec(grouped);
+  const route = grouped.slice(0, suffix.index);
+  const parts = (route.startsWith("routes/") ? route.slice("routes/".length) : route).split("/");
+  const segments = parts.at(-1) === "index" ? parts.slice(0, -1) : parts;
+  const path = [];
+  for (const [index, part] of segments.entries()) {
+    const segment = routeSegment(part, index === segments.length - 1);
+    if (segment === undefined) {
+      path.push({ kind: "catch-all", name: "*", optional: true, constrained: true });
+      break;
+    }
+    path.push(segment);
+  }
+  return { method: suffix[1]?.toUpperCase() ?? "*", path };
+}
+
+// plugins/scanners/vue/src/http.ts
+var NUXT_CLIENTS = new Set(["$fetch", "useFetch"]);
+function projectSource(projectRoot, fileName) {
+  const file = relative(projectRoot, fileName);
+  return !file.startsWith("../") && !file.includes("node_modules/");
+}
+async function vueClient(context, projectRoot, callee) {
+  if (!ts3.isIdentifier(callee) || !NUXT_CLIENTS.has(callee.text))
+    return runtimeFetch(context, callee);
+  const declaration = await declarationOf(context, callee);
+  return declaration !== undefined && !projectSource(projectRoot, declaration.getSourceFile().fileName) ? "ofetch" : undefined;
+}
+function isOperation(node) {
+  if (ts3.isFunctionDeclaration(node) || ts3.isMethodDeclaration(node))
+    return node.body !== undefined;
+  return ts3.isArrowFunction(node) || ts3.isFunctionExpression(node);
+}
+async function localFunction(context, node, source) {
+  if (isOperation(node))
+    return node;
+  if (!ts3.isIdentifier(node))
+    return;
+  const held = await heldAt(context, node);
+  const value = typeof held === "object" ? held.node : undefined;
+  return value !== undefined && isOperation(value) && value.getSourceFile() === source ? value : undefined;
+}
+function isDefaultFunction(statement) {
+  if (!ts3.isFunctionDeclaration(statement) || !ts3.canHaveModifiers(statement))
+    return false;
+  return (ts3.getModifiers(statement) ?? []).some((modifier) => modifier.kind === ts3.SyntaxKind.DefaultKeyword);
+}
+async function routeHandler(context, source) {
+  for (const statement of source.statements) {
+    if (isDefaultFunction(statement))
+      return isOperation(statement) ? statement : undefined;
+    if (!ts3.isExportAssignment(statement) || statement.isExportEquals === true)
+      continue;
+    const value = statement.expression;
+    const handler = ts3.isCallExpression(value) ? value.arguments[0] : value;
+    return handler === undefined ? undefined : localFunction(context, handler, source);
+  }
+  return;
+}
+function calls(source) {
+  const found = [];
+  const visit = (node) => {
+    if (ts3.isCallExpression(node))
+      found.push(node);
+    ts3.forEachChild(node, visit);
+  };
+  visit(source);
+  return found;
+}
+async function fileRequests(context, source, file, input) {
+  const requests = [];
+  for (const call of calls(source)) {
+    const fact = await fetchRequest(context, call, (callee) => vueClient(context, input.projectRoot, callee)) ?? await axiosRequest(context, call);
+    if (fact === undefined)
+      continue;
+    const caller = enclosingOperation(call);
+    const operation = (caller === undefined ? undefined : input.operationId(caller)) ?? input.moduleOperation(file);
+    requests.push({ operation, ...fact });
+  }
+  return requests;
+}
+async function fileEndpoint(context, source, files, input) {
+  const route = input.nuxt ? serverRoute(files.project) : undefined;
+  if (route === undefined)
+    return;
+  const handler = await routeHandler(context, source);
+  const operation = (handler === undefined ? undefined : input.operationId(handler)) ?? input.moduleOperation(files.owned);
+  return { operation, ...route };
+}
+async function vueHttpFacts(input) {
+  const context = urlContext(ts3, classicChecker(ts3, input.project.checker), input.project.files);
+  const httpRequests = [];
+  const httpEndpoints = [];
+  for (const source of input.project.files) {
+    const owned = relative(input.project.root, source.fileName);
+    httpRequests.push(...await fileRequests(context, source, owned, input));
+    const endpoint = await fileEndpoint(context, source, { project: relative(input.projectRoot, source.fileName), owned }, input);
+    if (endpoint !== undefined)
+      httpEndpoints.push(endpoint);
+  }
+  return { httpRequests, httpEndpoints };
+}
+
+// plugins/scanners/vue/src/operations.ts
+import ts4 from "./typescript.cjs";
+
+// plugins/scanners/typescript-operations.ts
+function is(node, kind) {
+  return node !== undefined && node.kind === kind;
+}
+function vocabularyOf(k) {
+  return {
+    leading: new Map([
+      [k.TrueKeyword, "true"],
+      [k.FalseKeyword, "false"],
+      [k.NullKeyword, "null"],
+      [k.ThisKeyword, "this"],
+      [k.SuperKeyword, "super"],
+      [k.QuestionDotToken, "?."],
+      [k.SpreadElement, "..."],
+      [k.SpreadAssignment, "..."],
+      [k.ElementAccessExpression, "index"],
+      [k.ReturnStatement, "return"],
+      [k.ForStatement, "for"],
+      [k.ForInStatement, "for"],
+      [k.ForOfStatement, "for"],
+      [k.WhileStatement, "while"],
+      [k.DoStatement, "do"],
+      [k.SwitchStatement, "switch"],
+      [k.CaseClause, "case"],
+      [k.DefaultClause, "default"],
+      [k.BreakStatement, "break"],
+      [k.ContinueStatement, "continue"],
+      [k.ThrowStatement, "throw"],
+      [k.CatchClause, "catch"],
+      [k.AwaitKeyword, "await"],
+      [k.AwaitExpression, "await"],
+      [k.YieldExpression, "yield"],
+      [k.TypeOfExpression, "typeof"],
+      [k.VoidExpression, "void"],
+      [k.DeleteExpression, "delete"]
+    ]),
+    quoted: new Set([k.StringLiteral, k.NoSubstitutionTemplateLiteral, k.TemplateHead, k.TemplateMiddle, k.TemplateTail]),
+    verbatim: new Set([k.NumericLiteral, k.BigIntLiteral, k.RegularExpressionLiteral]),
+    unary: new Map([
+      [k.ExclamationToken, "!"],
+      [k.MinusToken, "-"],
+      [k.PlusToken, "+"],
+      [k.TildeToken, "~"],
+      [k.PlusPlusToken, "++"],
+      [k.MinusMinusToken, "--"]
+    ]),
+    operators: new Set([
+      k.BinaryExpression,
+      k.ConditionalExpression,
+      k.PrefixUnaryExpression,
+      k.PostfixUnaryExpression,
+      k.TypeOfExpression,
+      k.VoidExpression,
+      k.DeleteExpression,
+      k.AwaitExpression,
+      k.YieldExpression
+    ]),
+    types: new Set([
+      k.TypeParameter,
+      k.ArrayType,
+      k.FunctionType,
+      k.LiteralType,
+      k.TypeLiteral,
+      k.ExpressionWithTypeArguments,
+      k.TypeReference,
+      k.ConditionalType
+    ]),
+    assertions: new Set([k.AsExpression, k.SatisfiesExpression, k.NonNullExpression]),
+    functions: new Set([
+      k.ArrowFunction,
+      k.FunctionExpression,
+      k.FunctionDeclaration,
+      k.MethodDeclaration,
+      k.Constructor,
+      k.GetAccessor,
+      k.SetAccessor
+    ])
+  };
+}
+function typeScriptOperations(ts) {
+  const k = ts.SyntaxKind;
+  const words = vocabularyOf(k);
+  function executable(node) {
+    if (node.kind === k.ArrowFunction || node.kind === k.FunctionExpression)
+      return true;
+    const declared = node.kind === k.FunctionDeclaration || node.kind === k.MethodDeclaration || node.kind === k.Constructor;
+    return declared && node.body !== undefined;
+  }
+  function callArgumentProperty(node) {
+    const property = is(node.parent, k.PropertyAssignment) ? node.parent : node;
+    if (property.kind !== k.PropertyAssignment && property.kind !== k.MethodDeclaration)
+      return false;
+    if (!is(property.parent, k.ObjectLiteralExpression))
+      return false;
+    let holder = property.parent.parent;
+    while (holder !== undefined && (holder.kind === k.ParenthesizedExpression || words.assertions.has(holder.kind))) {
+      holder = holder.parent;
+    }
+    return is(holder, k.CallExpression) || is(holder, k.NewExpression);
+  }
+  function comparableName(node) {
+    if (!executable(node) || callArgumentProperty(node))
+      return;
+    if (node.kind === k.Constructor)
+      return "constructor";
+    const name = node.name;
+    if (is(name, k.Identifier))
+      return name.text;
+    const parent = node.parent;
+    if (is(parent, k.PropertyAssignment) || is(parent, k.VariableDeclaration))
+      return parent.name.getText();
+    return;
+  }
+  function operationFields(node) {
+    const name = comparableName(node);
+    if (name === undefined)
+      return { name: "(anonymous)" };
+    const source = node.getSourceFile();
+    const line = (position) => source.getLineAndCharacterOfPosition(position).line + 1;
+    return { name, startLine: line(node.getStart()), endLine: line(node.end), tokens: tokenize(k, words, node) };
+  }
+  return { executable, operationFields };
+}
+function lookup(scope, name) {
+  return scope.slots.get(name) ?? (scope.parent === undefined ? undefined : lookup(scope.parent, name));
+}
+function tokenize(k, words, operation) {
+  const tokens = [];
+  let next = 0;
+  let scope = { slots: new Map };
+  function bindPattern(part) {
+    if (part === undefined)
+      return;
+    if (is(part, k.Identifier)) {
+      scope.slots.set(part.text, next++);
+      return;
+    }
+    if (is(part, k.BindingElement))
+      bindElement(part);
+    else
+      part.forEachChild((child) => bindPattern(child));
+  }
+  function bindElement(element) {
+    const key = element.propertyName ?? (is(element.parent, k.ObjectBindingPattern) ? element.name : undefined);
+    if (is(key, k.Identifier) || is(key, k.StringLiteral) || is(key, k.NumericLiteral))
+      tokens.push(`k.${key.text}`);
+    else
+      walk(key);
+    bindPattern(element.name);
+    walk(element.initializer);
+  }
+  function inScope(run) {
+    const previous = scope;
+    scope = { parent: previous, slots: new Map };
+    run();
+    scope = previous;
+  }
+  function declare(node) {
+    bindPattern(node.name);
+    walk(node.initializer);
+  }
+  function declareParameters(node) {
+    for (const parameter of node.parameters)
+      if (is(parameter, k.Parameter))
+        declare(parameter);
+  }
+  function identifierToken(node) {
+    const parent = node.parent;
+    if (is(parent, k.PropertyAccessExpression) && parent.name === node)
+      return `.${node.text}`;
+    const key = is(parent, k.PropertyAssignment) || is(parent, k.ShorthandPropertyAssignment);
+    if (key && parent.name === node)
+      return `k.${node.text}`;
+    const slot = lookup(scope, node.text);
+    return slot === undefined ? node.text : `$${slot}`;
+  }
+  function groupsOperator(expression) {
+    let node = expression;
+    while (words.assertions.has(node.kind))
+      node = node.expression;
+    return words.operators.has(node.kind);
+  }
+  function emitText(node) {
+    if (words.quoted.has(node.kind))
+      tokens.push(JSON.stringify(node.text));
+    else if (words.verbatim.has(node.kind))
+      tokens.push(node.text);
+    else
+      return false;
+    return true;
+  }
+  function emitCall(node) {
+    if (!is(node, k.CallExpression) && !is(node, k.NewExpression))
+      return false;
+    if (node.kind === k.NewExpression)
+      tokens.push("new");
+    walk(node.expression);
+    walk(node.questionDotToken);
+    tokens.push("call");
+    for (const argument of node.arguments ?? [])
+      walk(argument);
+    return true;
+  }
+  function emitOperator(node) {
+    if (is(node, k.BinaryExpression)) {
+      walk(node.left);
+      tokens.push(node.operatorToken.getText());
+      walk(node.right);
+    } else if (is(node, k.PrefixUnaryExpression)) {
+      tokens.push(words.unary.get(node.operator));
+      walk(node.operand);
+    } else if (is(node, k.PostfixUnaryExpression)) {
+      walk(node.operand);
+      tokens.push(words.unary.get(node.operator));
+    } else if (is(node, k.ConditionalExpression)) {
+      walk(node.condition);
+      tokens.push("?");
+      walk(node.whenTrue);
+      tokens.push(":");
+      walk(node.whenFalse);
+    } else if (is(node, k.ParenthesizedExpression) && groupsOperator(node.expression)) {
+      tokens.push("(");
+      walk(node.expression);
+      tokens.push(")");
+    } else
+      return false;
+    return true;
+  }
+  function emitBranches(node) {
+    if (is(node, k.IfStatement)) {
+      tokens.push("if");
+      walk(node.expression);
+      walk(node.thenStatement);
+      branch("else", node.elseStatement);
+    } else if (is(node, k.TryStatement)) {
+      tokens.push("try");
+      walk(node.tryBlock);
+      walk(node.catchClause);
+      branch("finally", node.finallyBlock);
+    } else
+      return false;
+    return true;
+  }
+  function branch(keyword, statement) {
+    if (statement === undefined)
+      return;
+    tokens.push(keyword);
+    walk(statement);
+  }
+  function emitStructure(node) {
+    if (node.kind === k.Block)
+      inScope(() => node.forEachChild((child) => walk(child)));
+    else if (is(node, k.VariableDeclaration) || is(node, k.Parameter))
+      declare(node);
+    else if (words.functions.has(node.kind)) {
+      tokens.push("fn");
+      inScope(() => {
+        declareParameters(node);
+        walk(node.body);
+      });
+    } else
+      return false;
+    return true;
+  }
+  function walk(node) {
+    if (node === undefined || words.types.has(node.kind) || emitStructure(node))
+      return;
+    if (is(node, k.Identifier) || is(node, k.PrivateIdentifier)) {
+      tokens.push(identifierToken(node));
+      return;
+    }
+    if (emitText(node) || emitCall(node) || emitOperator(node) || emitBranches(node))
+      return;
+    const leading = words.leading.get(node.kind);
+    if (leading !== undefined)
+      tokens.push(leading);
+    node.forEachChild((child) => walk(child));
+  }
+  declareParameters(operation);
+  walk(operation.body);
+  return tokens;
+}
+
+// plugins/scanners/vue/src/sfc.ts
+var import_language_core3 = __toESM(require_language_core2(), 1);
+function sfcScripts(file, text) {
+  const { descriptor } = import_language_core3.parse(text);
+  const blocks = [
+    ...descriptor.script ? [{ block: descriptor.script, setup: false }] : [],
+    ...descriptor.scriptSetup ? [{ block: descriptor.scriptSetup, setup: true }] : []
+  ].sort((left, right) => left.block.loc.start.offset - right.block.loc.start.offset);
+  return blocks.map(({ block, setup }) => ({
+    fileName: `${file}.${block.lang ?? "js"}`,
+    text: text.slice(0, block.loc.start.offset).replace(/[^\n]/g, " ") + block.content,
+    setup
+  }));
+}
+
+// plugins/scanners/vue/src/operations.ts
+var { operationFields } = typeScriptOperations(ts4);
+function comparedOperations(file, text) {
+  const operations = [];
+  for (const script of sfcScripts(file, text)) {
+    const source = ts4.createSourceFile(script.fileName, script.text, ts4.ScriptTarget.Latest, true);
+    const visit = (node) => {
+      const fields = operationFields(node);
+      if (fields.tokens !== undefined) {
+        const position = node.getStart(source);
+        operations.push({ id: `${file}#${position}`, file, position, ...fields });
+      }
+      node.forEachChild(visit);
+    };
+    source.forEachChild(visit);
+  }
+  return operations;
+}
+function addComparedOperations(project, operations) {
+  for (const source of project.files) {
+    if (!project.sfc(source.fileName))
+      continue;
+    const file = relative(project.root, source.fileName);
+    for (const operation of comparedOperations(file, project.text(source.fileName))) {
+      operations.set(operation.id, operation);
+    }
+  }
+}
+
+// plugins/scanners/vue/src/outline.ts
+import { readFile as readFile2 } from "fs/promises";
+import path4 from "path";
+import ts5 from "./typescript.cjs";
+
+// plugins/scanners/typescript-outline.ts
+function is2(node, kind) {
+  return node !== undefined && node.kind === kind;
+}
+var NO_EXPORTS = new Set;
+function hasModifier(node, kind) {
+  return node.modifiers?.some((modifier) => modifier.kind === kind) ?? false;
+}
+function listedExports(k, statement) {
+  if (is2(statement, k.ExportAssignment)) {
+    return is2(statement.expression, k.Identifier) ? [statement.expression.text] : [];
+  }
+  if (!is2(statement, k.ExportDeclaration) || statement.moduleSpecifier !== undefined)
+    return [];
+  const clause = statement.exportClause;
+  if (!is2(clause, k.NamedExports))
+    return [];
+  return clause.elements.map((element) => (element.propertyName ?? element.name).text);
+}
+function topLevelVisibility(scope, name, statement) {
+  if (scope.topLevelPrivate)
+    return "private";
+  return hasModifier(statement, scope.k.ExportKeyword) || scope.exported.has(name) ? "public" : "private";
+}
+function memberVisibility(scope, member) {
+  const { k } = scope;
+  if (is2(member.name, k.PrivateIdentifier) || hasModifier(member, k.PrivateKeyword))
+    return "private";
+  return hasModifier(member, k.ProtectedKeyword) ? "protected" : "public";
+}
+function symbolAt(scope, name, node, visibility) {
+  const line = scope.source.getLineAndCharacterOfPosition(node.getStart()).line + 1;
+  return { name, line, visibility, entry: scope.symbols.includes(name) };
+}
+function functionDeclarations(scope, statement) {
+  const { k } = scope;
+  if (is2(statement, k.FunctionDeclaration) && is2(statement.name, k.Identifier)) {
+    const name = statement.name.text;
+    return [{ kind: "function", ...symbolAt(scope, name, statement.name, topLevelVisibility(scope, name, statement)) }];
+  }
+  if (!is2(statement, k.VariableStatement))
+    return [];
+  return statement.declarationList.declarations.flatMap((declaration) => {
+    const { name, initializer } = declaration;
+    if (!is2(name, k.Identifier))
+      return [];
+    if (!is2(initializer, k.ArrowFunction) && !is2(initializer, k.FunctionExpression))
+      return [];
+    return [{ kind: "function", ...symbolAt(scope, name.text, name, topLevelVisibility(scope, name.text, statement)) }];
+  });
+}
+function memberName(scope, name) {
+  const { k } = scope;
+  if (is2(name, k.Identifier) || is2(name, k.PrivateIdentifier))
+    return name;
+  return is2(name, k.StringLiteral) || is2(name, k.NumericLiteral) ? name : undefined;
+}
+function typeMember(scope, member) {
+  const { k } = scope;
+  if (member.kind === k.Constructor)
+    return [symbolAt(scope, "constructor", member, memberVisibility(scope, member))];
+  if (!is2(member, k.MethodDeclaration) && !is2(member, k.MethodSignature))
+    return [];
+  const name = memberName(scope, member.name);
+  return name === undefined ? [] : [symbolAt(scope, name.text, name, memberVisibility(scope, member))];
+}
+function typeMembers(k, statement) {
+  if (is2(statement, k.ClassDeclaration) || is2(statement, k.InterfaceDeclaration))
+    return statement.members;
+  return statement.kind === k.EnumDeclaration ? [] : undefined;
+}
+function typeDeclaration(scope, statement) {
+  const members = typeMembers(scope.k, statement);
+  const { name } = statement;
+  if (members === undefined || !is2(name, scope.k.Identifier))
+    return [];
+  return [{
+    kind: "type",
+    ...symbolAt(scope, name.text, name, topLevelVisibility(scope, name.text, statement)),
+    members: members.flatMap((member) => typeMember(scope, member))
+  }];
+}
+function moduleStatements(k, statement) {
+  let body = statement.body;
+  while (is2(body, k.ModuleDeclaration))
+    body = body.body;
+  return is2(body, k.ModuleBlock) ? body.statements : [];
+}
+function declarationsIn(scope, statements) {
+  return statements.flatMap((statement) => {
+    if (is2(statement, scope.k.ModuleDeclaration)) {
+      return declarationsIn({ ...scope, exported: NO_EXPORTS }, moduleStatements(scope.k, statement));
+    }
+    return [...functionDeclarations(scope, statement), ...typeDeclaration(scope, statement)];
+  });
+}
+function outlineSource(ts, source, context) {
+  const k = ts.SyntaxKind;
+  const exported = new Set([...source.statements.flatMap((statement) => listedExports(k, statement)), ...context.exported ?? []]);
+  const scope = { k, source, symbols: context.symbols, exported, topLevelPrivate: context.topLevelPrivate ?? false };
+  return declarationsIn(scope, source.statements);
+}
+function outlineDeclarations(ts, block) {
+  return outlineSource(ts, ts.createSourceFile(block.fileName, block.text, ts.ScriptTarget.Latest, true), block);
+}
+
+// plugins/scanners/vue/src/outline.ts
+var SCRIPT = /\.(?:vue|ts|js)$/;
+function componentDeclarations(fileName, text, symbols) {
+  return sfcScripts(fileName, text).flatMap((script) => outlineDeclarations(ts5, {
+    fileName: script.fileName,
+    text: script.text,
+    symbols,
+    topLevelPrivate: script.setup
+  }));
+}
+async function readVueOutline(repositoryRoot, references) {
+  const files = [];
+  for (const reference of references.filter((reference) => SCRIPT.test(reference.file))) {
+    const fileName = path4.join(repositoryRoot, reference.file);
+    const text = await readFile2(fileName, "utf8");
+    const declarations = reference.file.endsWith(".vue") ? componentDeclarations(fileName, text, reference.symbols) : outlineDeclarations(ts5, { fileName, text, symbols: reference.symbols });
+    if (declarations.length > 0)
+      files.push({ file: reference.file, declarations });
+  }
+  return files;
+}
+
 // plugins/scanners/vue/src/index.ts
 async function scanVue(root) {
   const parts = [];
@@ -40172,19 +41770,46 @@ async function scanVueProject(projectRoot, root) {
     if (sfc)
       evidence.inspect(source.fileName, sfc);
   }
+  const { httpRequests, httpEndpoints } = await vueHttpFacts({
+    project,
+    projectRoot,
+    nuxt: hasDependency(manifest, "nuxt"),
+    operationId: (node) => evidence.operationId(node),
+    moduleOperation: (file) => {
+      const id = `${file}#module`;
+      evidence.operations.set(id, { id, file, name: "(module)" });
+      return id;
+    }
+  });
+  addComparedOperations(project, evidence.operations);
   const files = project.files.map((source) => ({ file: relative(root, source.fileName), symbols: [] }));
+  const sourceUnits = project.files.flatMap((source) => project.sourceUnit(source.fileName) ?? []);
+  for (const file of new Set(sourceUnits.flatMap((unit) => unit.files))) {
+    if (!files.some((source) => source.file === file))
+      files.push({ file, symbols: [] });
+  }
   return createScanObservation({
     scanner: { id: "vue", technology: "typescript/vue", engine: "@vue/language-core", engineVersion: "3.3.11" },
-    roots: [{ id: "vue-project", kind: "package", name: manifest.name, file: relative(root, path3.join(projectRoot, "package.json")) }],
+    roots: [{ id: "vue-project", kind: "package", name: manifest.name, file: relative(root, path5.join(projectRoot, "package.json")) }],
     files: files.map((file) => ({ ...file, roots: ["vue-project"] })),
+    sourceUnits,
     operations: [...evidence.operations.values()],
     invocations: evidence.invocations,
-    diagnostics: evidence.diagnostics
+    diagnostics: evidence.diagnostics,
+    ...httpEndpoints.length ? { httpEndpoints } : {},
+    ...httpRequests.length ? { httpRequests } : {}
   });
 }
 var src_default = {
   id: "vue",
-  watch: { include: ["**/*.vue", "**/*.ts", "**/tsconfig*.json", "**/package.json"], exclude: [] },
+  watch: { include: ["**/*.vue", "**/*.ts", "**/*.js", "**/*.html", "**/*.css", "**/*.scss", "**/*.sass", "**/*.less", "**/*.styl", "**/tsconfig*.json", "**/package.json"], exclude: [] },
+  readCodeStructure: readVueOutline,
+  listSourceFiles: (root) => frameworkSourceFiles({
+    root,
+    dependency: "vue",
+    projects: [".vue"],
+    sources: [".vue", ".ts", ".tsx", ".js", ".jsx", ".html", ".css", ".scss", ".sass", ".less", ".styl"]
+  }),
   checkReadiness: async (root) => {
     const projects = await frameworkProjects(root, "vue", [".vue"]);
     for (const project of projects)