@patchstack/connect 0.3.23 → 0.3.25

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import { readFileSync as readFileSync7, writeFileSync as writeFileSync7 } from "fs";
+import { readFileSync as readFileSync12, writeFileSync as writeFileSync7 } from "fs";
 
 // src/parsers/index.ts
 import { access } from "fs/promises";
@@ -927,6 +927,88 @@ function computeManifestChecksum(packages) {
   return createHash("sha256").update(JSON.stringify(canonical)).digest("hex").slice(0, 12);
 }
 
+// src/pulse-token.ts
+var TOKEN_SKEW_MS = 6e4;
+function buildTokenUrl(manifestEndpoint) {
+  const url = new URL(manifestEndpoint);
+  const path11 = url.pathname.replace(/\/$/, "");
+  url.pathname = path11.endsWith("/manifest") ? `${path11.slice(0, -"/manifest".length)}/token` : "/monitor/pulse/token";
+  url.search = "";
+  url.hash = "";
+  return url.toString();
+}
+function parsePulseAuth(credential) {
+  const index = credential.lastIndexOf("-");
+  if (index <= 0 || index === credential.length - 1) return null;
+  const clientId = credential.slice(index + 1);
+  if (!/^\d+$/.test(clientId)) return null;
+  return { clientId, clientSecret: credential.slice(0, index) };
+}
+var cached = null;
+var inflight = null;
+function clearPulseToken() {
+  cached = null;
+}
+async function getPulseToken(config, fetchImpl = fetch) {
+  if (typeof config.pulseAuth !== "string" || config.pulseAuth.length === 0) return null;
+  if (cached !== null && Date.now() < cached.expiresAt - TOKEN_SKEW_MS) {
+    return cached.token;
+  }
+  if (inflight !== null) return inflight;
+  const credentials = parsePulseAuth(config.pulseAuth);
+  if (credentials === null) return null;
+  inflight = (async () => {
+    try {
+      const response = await fetchImpl(buildTokenUrl(config.endpoint), {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          Accept: "application/json",
+          "User-Agent": "@patchstack/connect"
+        },
+        body: JSON.stringify({
+          grant_type: "client_credentials",
+          client_id: credentials.clientId,
+          client_secret: credentials.clientSecret
+        }),
+        signal: AbortSignal.timeout(config.timeoutMs)
+      });
+      if (!response.ok) return null;
+      const body = await response.json();
+      if (typeof body.access_token !== "string" || body.access_token.length === 0) return null;
+      const expiresIn = Number(body.expires_in);
+      const ttlMs = Number.isFinite(expiresIn) && expiresIn > 0 ? expiresIn * 1e3 : 36e5;
+      cached = { token: body.access_token, expiresAt: Date.now() + ttlMs };
+      return body.access_token;
+    } catch {
+      return null;
+    } finally {
+      inflight = null;
+    }
+  })();
+  return inflight;
+}
+async function pulseAuthHeader(config, fetchImpl = fetch) {
+  const token = await getPulseToken(config, fetchImpl);
+  return token === null ? {} : { Authorization: `Bearer ${token}` };
+}
+async function pulseFetch(config, url, init, fetchImpl = fetch) {
+  const send = async () => {
+    const auth = await pulseAuthHeader(config, fetchImpl);
+    const response = await fetchImpl(url, {
+      ...init,
+      headers: { ...init.headers, ...auth }
+    });
+    return { response, authenticated: auth.Authorization !== void 0 };
+  };
+  const first = await send();
+  if (first.response.status === 401 && first.authenticated) {
+    clearPulseToken();
+    return (await send()).response;
+  }
+  return first.response;
+}
+
 // src/client.ts
 var DEFAULT_ENDPOINT = "https://api.patchstack.com/monitor/pulse/manifest";
 var DEFAULT_TIMEOUT_MS = 3e4;
@@ -950,6 +1032,86 @@ function buildSettingsUrl(endpoint, siteUuid) {
   const origin = new URL(endpoint).origin;
   return `${origin}/monitor/widget/settings/${encodeURIComponent(siteUuid)}`;
 }
+function buildPackageRemovedUrl(manifestEndpoint, siteUuid) {
+  const url = new URL(manifestEndpoint);
+  const path11 = url.pathname.replace(/\/$/, "");
+  url.pathname = path11.endsWith("/manifest") ? `${path11.slice(0, -"/manifest".length)}/package-removed/${encodeURIComponent(siteUuid)}` : `/monitor/pulse/package-removed/${encodeURIComponent(siteUuid)}`;
+  url.search = "";
+  url.hash = "";
+  return url.toString();
+}
+function buildInputMapUrl(manifestEndpoint, siteUuid) {
+  const url = new URL(manifestEndpoint);
+  const path11 = url.pathname.replace(/\/$/, "");
+  url.pathname = path11.endsWith("/manifest") ? `${path11.slice(0, -"/manifest".length)}/input-map/${encodeURIComponent(siteUuid)}` : `/monitor/pulse/input-map/${encodeURIComponent(siteUuid)}`;
+  url.search = "";
+  url.hash = "";
+  return url.toString();
+}
+async function postInputMap(config, map) {
+  if (config.siteUuid === null) {
+    return { result: "skipped", message: "No site UUID configured \u2014 run `patchstack-connect scan` first." };
+  }
+  const url = buildInputMapUrl(config.endpoint, config.siteUuid);
+  try {
+    const response = await pulseFetch(config, url, {
+      method: "POST",
+      headers: {
+        Accept: "application/json",
+        "Content-Type": "application/json",
+        "User-Agent": "@patchstack/connect"
+      },
+      body: JSON.stringify(map),
+      signal: AbortSignal.timeout(config.timeoutMs)
+    });
+    if (response.status === 404) {
+      return { result: "failed", message: "Site not found \u2014 the configured site UUID is unknown to Patchstack." };
+    }
+    if (response.status === 422) {
+      return { result: "failed", message: `Patchstack does not accept this map schema (version ${map.version}). Update @patchstack/connect.` };
+    }
+    if (!response.ok) {
+      return { result: "failed", message: `Patchstack returned ${response.status}.` };
+    }
+    const body = await response.json();
+    const revision = Number(body.revision);
+    if ((body.result === "stored" || body.result === "unchanged") && Number.isInteger(revision) && revision > 0) {
+      return { result: body.result, revision };
+    }
+    return { result: "failed", message: "Patchstack returned an unexpected response." };
+  } catch {
+    return { result: "failed", message: `Could not reach Patchstack at ${url}.` };
+  }
+}
+async function postPackageRemoved(config) {
+  if (config.siteUuid === null) {
+    return { result: "failed", message: "No site UUID configured." };
+  }
+  const url = buildPackageRemovedUrl(config.endpoint, config.siteUuid);
+  try {
+    const response = await pulseFetch(config, url, {
+      method: "POST",
+      headers: {
+        Accept: "application/json",
+        "User-Agent": "@patchstack/connect"
+      },
+      signal: AbortSignal.timeout(config.timeoutMs)
+    });
+    if (response.status === 404) {
+      return { result: "gone", message: null };
+    }
+    if (!response.ok) {
+      return { result: "failed", message: `Patchstack returned ${response.status}.` };
+    }
+    const body = await response.json();
+    if (body.status === "deleted" || body.status === "flagged") {
+      return { result: body.status, message: body.message ?? null };
+    }
+    return { result: "failed", message: "Patchstack returned an unexpected response." };
+  } catch {
+    return { result: "failed", message: `Could not reach Patchstack at ${url}.` };
+  }
+}
 async function fetchSiteStatus(config) {
   if (config.siteUuid === null) return "unknown";
   const url = new URL(buildSettingsUrl(config.endpoint, config.siteUuid));
@@ -976,7 +1138,7 @@ async function postManifest(config, payload) {
   const timeoutMs = config.timeoutMs;
   let response;
   try {
-    response = await fetch(url, {
+    response = await pulseFetch(config, url, {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
@@ -1273,9 +1435,11 @@ async function resolveConfig(options) {
     );
   }
   const apiKeyRaw = fromEnv.apiKey ?? fromFile.apiKey ?? null;
+  const pulseAuthRaw = fromEnv.pulseAuth ?? fromFile.pulseAuth ?? apiKeyRaw;
   return {
     siteUuid: siteUuid === null || siteUuid.length === 0 ? null : siteUuid,
     apiKey: apiKeyRaw === null || apiKeyRaw.length === 0 ? null : apiKeyRaw,
+    pulseAuth: pulseAuthRaw === null || pulseAuthRaw.length === 0 ? null : pulseAuthRaw,
     endpoint,
     timeoutMs,
     environment,
@@ -1296,6 +1460,10 @@ async function persistApiKey(cwd, apiKey) {
   const existing = await readConfigFile(cwd);
   return writeConfigFile(cwd, { ...existing, apiKey });
 }
+async function persistPulseAuth(cwd, pulseAuth) {
+  const existing = await readConfigFile(cwd);
+  return writeConfigFile(cwd, { ...existing, pulseAuth });
+}
 async function readConfigFile(cwd) {
   const target = path6.join(cwd, CONFIG_FILENAME);
   let raw;
@@ -1338,6 +1506,7 @@ function readEnv() {
   return {
     siteUuid: process.env.PATCHSTACK_SITE_UUID ?? void 0,
     apiKey: process.env.PATCHSTACK_API_KEY ?? void 0,
+    pulseAuth: process.env.PATCHSTACK_PULSE_AUTH ?? void 0,
     endpoint: process.env.PATCHSTACK_ENDPOINT ?? void 0,
     timeoutMs,
     environment: environmentRaw !== void 0 && environmentRaw.length > 0 ? environmentRaw : void 0
@@ -2783,145 +2952,2562 @@ function renderGuideChecklist(state, useColor) {
   return lines.join("\n");
 }
 
-// src/setup.ts
-import { readFileSync as readFileSync6, writeFileSync as writeFileSync6 } from "fs";
-import path10 from "path";
-var SCAN_COMMAND = "patchstack-connect scan";
-var MARK_BUILD_COMMAND = "patchstack-connect mark-build";
-function setupProtection(cwd) {
-  const install = runProtect(cwd);
-  const verification = runVerify(cwd);
-  return { install, verification };
+// src/login.ts
+function baseFrom(manifestEndpoint) {
+  const url = new URL(manifestEndpoint);
+  const path11 = url.pathname.replace(/\/$/, "");
+  url.pathname = path11.endsWith("/manifest") ? path11.slice(0, -"/manifest".length) : "/monitor/pulse";
+  url.search = "";
+  url.hash = "";
+  return url.toString().replace(/\/$/, "");
+}
+async function login(config, onPrompt, deps = {}) {
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const now = deps.now ?? (() => Date.now());
+  if (config.siteUuid === null) {
+    return { status: "failed", message: "No site UUID configured \u2014 run `patchstack-connect scan` first." };
+  }
+  const base = baseFrom(config.endpoint);
+  const started = await fetchImpl(`${base}/device/code`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", Accept: "application/json" },
+    body: JSON.stringify({ site_uuid: config.siteUuid })
+  });
+  if (started.status === 409) {
+    return {
+      status: "unclaimed",
+      message: "This site has not been claimed yet, so there is no owner to approve the request. Claim it in the dashboard, or delete .patchstackrc.json to provision a new site."
+    };
+  }
+  if (started.status === 404) {
+    return { status: "not-found", message: "Patchstack does not recognise this site UUID." };
+  }
+  if (!started.ok) {
+    return { status: "failed", message: `Could not start the login (HTTP ${started.status}).` };
+  }
+  const { device_code: deviceCode, user_code: userCode, expires_in: expiresIn, interval } = await started.json();
+  const verificationUri = `${base}/device?code=${encodeURIComponent(userCode)}`;
+  onPrompt(userCode, verificationUri);
+  const deadline = now() + expiresIn * 1e3;
+  const intervalMs = Math.max(1, interval) * 1e3;
+  while (now() < deadline) {
+    await sleep(intervalMs);
+    const polled = await fetchImpl(`${base}/device/token`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", Accept: "application/json" },
+      body: JSON.stringify({ device_code: deviceCode })
+    });
+    if (polled.status === 428) continue;
+    if (!polled.ok) return { status: "expired", message: "The login request expired. Run the command again." };
+    const { api_key: apiKey } = await polled.json();
+    if (typeof apiKey !== "string" || apiKey.length === 0) {
+      return { status: "failed", message: "Patchstack approved the request but returned no credential." };
+    }
+    await persistPulseAuth(process.cwd(), apiKey);
+    await persistApiKey(process.cwd(), apiKey);
+    return { status: "approved", userCode, verificationUri };
+  }
+  return { status: "expired", message: "The login request expired. Run the command again." };
 }
-function appendHook(existing, command) {
-  if (existing === void 0 || existing.trim().length === 0) {
-    return command;
+
+// src/map/ts-loader.ts
+import { createRequire } from "module";
+import { pathToFileURL } from "url";
+import { join as join11 } from "path";
+async function loadTypeScript(cwd) {
+  try {
+    const req = createRequire(pathToFileURL(join11(cwd, "package.json")));
+    const resolved = req.resolve("typescript");
+    const mod = await import(pathToFileURL(resolved).href);
+    return mod.default ?? mod;
+  } catch {
   }
-  if (existing.includes(command)) {
-    return existing;
+  try {
+    const mod = await import("typescript");
+    return mod.default ?? mod;
+  } catch {
+    return null;
   }
-  return `${existing} && ${command}`;
 }
-function wireBuildScripts(cwd, packageManager) {
-  const target = path10.join(cwd, "package.json");
-  const raw = readFileSync6(target, "utf8");
-  const pkg = JSON.parse(raw);
-  const scripts = pkg.scripts ?? {};
-  const build = scripts.build;
-  const postinstall = appendHook(scripts.postinstall, SCAN_COMMAND);
-  if (build === void 0 || build.trim().length === 0) {
-    if (postinstall === scripts.postinstall) {
-      return {
-        changed: false,
-        strategy: "postinstall-only",
-        detail: "dependency-install scan already wired; no build script to integrate."
-      };
+
+// src/map/extract.ts
+import { readFileSync as readFileSync10, realpathSync as realpathSync3 } from "fs";
+import { createHash as createHash3 } from "crypto";
+import { relative as relative4 } from "path";
+
+// src/map/ast.ts
+function rootIdentifier(node, ts) {
+  let cur = node;
+  while (cur) {
+    if (ts.isIdentifier(cur)) return cur.text;
+    if (ts.isPropertyAccessExpression(cur) || ts.isElementAccessExpression(cur) || ts.isCallExpression(cur) || ts.isNewExpression(cur) || ts.isNonNullExpression(cur) || ts.isParenthesizedExpression(cur) || ts.isAwaitExpression(cur)) {
+      cur = cur.expression;
+    } else return void 0;
+  }
+  return void 0;
+}
+function spanOf(node) {
+  const out = { line: lineOf(node) };
+  try {
+    out.start = node.getStart();
+    out.end = node.getEnd();
+  } catch {
+  }
+  return out;
+}
+function lineOf(node) {
+  const sf = typeof node?.getSourceFile === "function" ? node.getSourceFile() : void 0;
+  if (!sf) return void 0;
+  try {
+    return sf.getLineAndCharacterOfPosition(node.getStart(sf)).line + 1;
+  } catch {
+    return void 0;
+  }
+}
+function guessScriptKind(ts, file) {
+  if (file.endsWith(".tsx")) return ts.ScriptKind.TSX;
+  if (file.endsWith(".jsx")) return ts.ScriptKind.JSX;
+  if (file.endsWith(".js")) return ts.ScriptKind.JS;
+  return ts.ScriptKind.TS;
+}
+function isFnLike(n, ts) {
+  return ts.isArrowFunction(n) || ts.isFunctionExpression(n);
+}
+function hasExport(node, ts) {
+  return Boolean(node.modifiers?.some((m) => m.kind === ts.SyntaxKind.ExportKeyword));
+}
+function unwindChain(node, ts) {
+  const calls = {};
+  let cur = node;
+  while (cur && ts.isCallExpression(cur)) {
+    const callee = cur.expression;
+    if (ts.isPropertyAccessExpression(callee)) {
+      calls[callee.name.text] = cur;
+      cur = callee.expression;
+    } else if (ts.isIdentifier(callee)) return { baseName: callee.text, baseCall: cur, calls };
+    else break;
+  }
+  return { calls };
+}
+function methodFromObjectArg(baseCall, ts) {
+  const arg = baseCall?.arguments?.[0];
+  if (!arg || !ts.isObjectLiteralExpression(arg)) return void 0;
+  for (const p of arg.properties) {
+    if (ts.isPropertyAssignment(p) && p.name?.text === "method" && ts.isStringLiteralLike(p.initializer)) {
+      return p.initializer.text.toUpperCase();
     }
-    scripts.postinstall = postinstall;
-  } else if (packageManager === "bun") {
-    let nextBuild = build;
-    if (!nextBuild.includes(SCAN_COMMAND)) {
-      nextBuild = `${SCAN_COMMAND} && ${nextBuild}`;
+  }
+  return void 0;
+}
+function bindingKey(el, ts) {
+  if (!ts.isBindingElement(el)) return void 0;
+  const prop = el.propertyName ?? el.name;
+  return prop && ts.isIdentifier(prop) ? prop.text : void 0;
+}
+function isUninvokedFunctionDeclaration(n, ts) {
+  if (ts.isFunctionDeclaration(n)) return true;
+  if (isFnLike(n, ts)) {
+    const p = n.parent;
+    if (p && (ts.isVariableDeclaration(p) || ts.isPropertyAssignment(p) || ts.isPropertyDeclaration(p))) return true;
+  }
+  return false;
+}
+function isShadowedByEnclosingBinding(node, name, ts) {
+  for (let cur = node?.parent; cur; cur = cur.parent) {
+    if (ts.isCatchClause(cur) && cur.variableDeclaration && ts.isIdentifier(cur.variableDeclaration.name) && cur.variableDeclaration.name.text === name) return true;
+    const params = cur.parameters;
+    if (!params) continue;
+    for (const p of params) {
+      if (!p?.name) continue;
+      if (ts.isIdentifier(p.name) && p.name.text === name) return true;
+      if (ts.isObjectBindingPattern(p.name) || ts.isArrayBindingPattern(p.name)) {
+        for (const el of p.name.elements) {
+          if (ts.isBindingElement(el) && ts.isIdentifier(el.name) && el.name.text === name) return true;
+        }
+      }
     }
-    if (!nextBuild.includes(MARK_BUILD_COMMAND)) {
-      nextBuild = `${nextBuild} && ${MARK_BUILD_COMMAND}`;
+  }
+  return false;
+}
+function calleeName(call, ts) {
+  const c = call?.expression;
+  if (!c) return void 0;
+  if (ts.isPropertyAccessExpression(c)) return c.name.text;
+  if (ts.isIdentifier(c)) return c.text;
+  return void 0;
+}
+function isValueRead(id, ts) {
+  const p = id.parent;
+  if (!p) return true;
+  if (ts.isPropertyAssignment(p) && p.name === id) return false;
+  if (ts.isPropertyAccessExpression(p) && p.name === id) return false;
+  if (ts.isBindingElement(p) && p.propertyName === id) return false;
+  if ((ts.isVariableDeclaration(p) || ts.isParameter(p) || ts.isBindingElement(p)) && p.name === id) return false;
+  if (ts.isPropertySignature(p) || ts.isMethodSignature(p)) return false;
+  return true;
+}
+function opCallOf(propAccess, ts) {
+  const p = propAccess?.parent;
+  return p && ts.isCallExpression(p) && p.expression === propAccess ? p : propAccess;
+}
+function localCalls(node, ts) {
+  const names = [];
+  const visit = (n) => {
+    if (ts.isCallExpression(n) && ts.isIdentifier(n.expression)) names.push(n.expression.text);
+    ts.forEachChild(n, visit);
+  };
+  visit(node);
+  return names;
+}
+
+// src/map/bindings.ts
+import { builtinModules } from "module";
+var BUILTINS = new Set(builtinModules);
+function buildModuleBindings(sf, ts) {
+  const nameToModule = /* @__PURE__ */ new Map();
+  const declared = /* @__PURE__ */ new Set();
+  const exportNames = /* @__PURE__ */ new Map();
+  const members = /* @__PURE__ */ new Set();
+  const imports = /* @__PURE__ */ new Set();
+  const origins = /* @__PURE__ */ new Map();
+  const record = (local, mod, origin = "direct") => {
+    nameToModule.set(local, mod);
+    imports.add(mod);
+    if (!origins.has(local)) origins.set(local, origin);
+  };
+  const declareBound = (nameNode) => {
+    if (ts.isIdentifier(nameNode)) declared.add(nameNode.text);
+    else if (ts.isObjectBindingPattern(nameNode) || ts.isArrayBindingPattern(nameNode)) {
+      for (const el of nameNode.elements) if (ts.isBindingElement(el) && ts.isIdentifier(el.name)) declared.add(el.name.text);
     }
-    if (nextBuild === build && postinstall === scripts.postinstall) {
-      return {
-        changed: false,
-        strategy: "build-chain",
-        detail: "dependency-install scan and build chain already wired."
-      };
+  };
+  const visit = (node) => {
+    if (ts.isImportDeclaration(node) && node.moduleSpecifier && ts.isStringLiteralLike(node.moduleSpecifier)) {
+      const mod = node.moduleSpecifier.text;
+      imports.add(mod);
+      const clause = node.importClause;
+      if (clause?.name) record(clause.name.text, mod);
+      const nb = clause?.namedBindings;
+      if (nb) {
+        if (ts.isNamespaceImport(nb)) record(nb.name.text, mod);
+        else if (ts.isNamedImports(nb)) for (const el of nb.elements) {
+          record(el.name.text, mod);
+          members.add(el.name.text);
+          if (el.propertyName && ts.isIdentifier(el.propertyName)) exportNames.set(el.name.text, el.propertyName.text);
+        }
+      }
     }
-    scripts.postinstall = postinstall;
-    scripts.build = nextBuild;
-  } else {
-    const prebuild = appendHook(scripts.prebuild, SCAN_COMMAND);
-    const postbuild = appendHook(scripts.postbuild, MARK_BUILD_COMMAND);
-    if (prebuild === scripts.prebuild && postbuild === scripts.postbuild && postinstall === scripts.postinstall) {
-      return {
-        changed: false,
-        strategy: "lifecycle-hooks",
-        detail: "dependency-install, prebuild, and postbuild hooks are already wired."
-      };
+    if (ts.isFunctionDeclaration(node) && node.name) declared.add(node.name.text);
+    if (ts.isClassDeclaration(node) && node.name) declared.add(node.name.text);
+    if (ts.isVariableStatement(node)) {
+      for (const decl of node.declarationList.declarations) {
+        declareBound(decl.name);
+        const init = decl.initializer;
+        const reqMod = requireSpecifier(init, ts);
+        if (reqMod) {
+          if (ts.isIdentifier(decl.name)) record(decl.name.text, reqMod);
+          else if (ts.isObjectBindingPattern(decl.name)) {
+            for (const el of decl.name.elements) if (ts.isIdentifier(el.name)) {
+              record(el.name.text, reqMod);
+              members.add(el.name.text);
+              if (el.propertyName && ts.isIdentifier(el.propertyName)) exportNames.set(el.name.text, el.propertyName.text);
+            }
+          }
+        }
+        if (init && ts.isIdentifier(decl.name)) {
+          const callee = ts.isCallExpression(init) ? init.expression : ts.isNewExpression(init) ? init.expression : void 0;
+          const root = callee ? rootIdentifier(callee, ts) : void 0;
+          if (root) {
+            pending.push([decl.name.text, root]);
+            if (nameToModule.has(root)) record(decl.name.text, nameToModule.get(root), "factory");
+          }
+        }
+      }
     }
-    scripts.postinstall = postinstall;
-    scripts.prebuild = prebuild;
-    scripts.postbuild = postbuild;
-  }
-  pkg.scripts = scripts;
-  const indentMatch = raw.match(/^[\t ]+(?=")/m)?.[0];
-  const indent = indentMatch?.includes("	") ? "	" : indentMatch?.length ?? 2;
-  const trailingNewline = raw.endsWith("\n") ? "\n" : "";
-  writeFileSync6(target, `${JSON.stringify(pkg, null, indent)}${trailingNewline}`, "utf8");
-  if (build === void 0 || build.trim().length === 0) {
-    return {
-      changed: true,
-      strategy: "postinstall-only",
-      detail: "added a dependency-install scan; package.json has no build script."
-    };
+    if ((ts.isFunctionDeclaration(node) || isFnLike(node, ts)) && node.body) {
+      const fnName = ts.isFunctionDeclaration(node) && node.name ? node.name.text : ts.isVariableDeclaration(node.parent) && ts.isIdentifier(node.parent.name) ? node.parent.name.text : void 0;
+      if (fnName) {
+        const root = returnedRootIdentifier(node.body, ts);
+        if (root) pending.push([fnName, root]);
+      }
+    }
+    ts.forEachChild(node, visit);
+  };
+  const pending = [];
+  visit(sf);
+  for (let i = 0; i < 4; i++) {
+    let changed = false;
+    for (const [name, root] of pending) {
+      if (!nameToModule.has(name) && nameToModule.has(root)) {
+        record(name, nameToModule.get(root), "factory");
+        changed = true;
+      }
+    }
+    if (!changed) break;
   }
-  return packageManager === "bun" ? {
-    changed: true,
-    strategy: "build-chain",
-    detail: "added a dependency-install scan and chained scan/mark-build around the build."
-  } : {
-    changed: true,
-    strategy: "lifecycle-hooks",
-    detail: "added scans to postinstall/prebuild and mark-build to postbuild."
+  const locals = new Set([...declared].filter((n) => !nameToModule.has(n)));
+  return {
+    resolve: (name) => nameToModule.get(name),
+    exportNameOf: (name) => exportNames.get(name),
+    originOf: (name) => origins.get(name),
+    isPackageMember: (name) => members.has(name),
+    imports,
+    locals
   };
 }
+function returnedRootIdentifier(body, ts) {
+  if (!ts.isBlock(body)) return rootIdentifier(body, ts);
+  let found;
+  const visit = (n) => {
+    if (found) return;
+    if (isUninvokedFunctionDeclaration(n, ts) && n !== body) return;
+    if (ts.isReturnStatement(n) && n.expression) {
+      found = rootIdentifier(n.expression, ts);
+      return;
+    }
+    ts.forEachChild(n, visit);
+  };
+  visit(body);
+  return found;
+}
+function requireSpecifier(init, ts) {
+  if (init && ts.isCallExpression(init) && ts.isIdentifier(init.expression) && init.expression.text === "require") {
+    const a = init.arguments[0];
+    if (a && ts.isStringLiteralLike(a)) return a.text;
+  }
+  return void 0;
+}
+function npmPackageOf(spec) {
+  if (!spec) return void 0;
+  if (spec.startsWith(".") || spec.startsWith("/")) return void 0;
+  if (spec.startsWith("node:")) return spec;
+  if (BUILTINS.has(spec)) return `node:${spec}`;
+  const parts = spec.split("/");
+  return spec.startsWith("@") ? parts.slice(0, 2).join("/") : parts[0];
+}
 
-// src/cli.ts
-var HELP = `@patchstack/connect \u2014 scan your lockfile and report packages to Patchstack.
-
-Usage:
-  patchstack-connect scan   [options]                Scan lockfile and POST to Patchstack.
-                                                     If no UUID is configured, the server
-                                                     provisions one and we persist it. After a
-                                                     successful post it also adds/updates the
-                                                     disclosure-widget <script> tag in the root
-                                                     HTML shell (index.html, public/index.html,
-                                                     or src/app.html) \u2014 opt out with
-                                                     "widget": false in .patchstackrc.json
-  patchstack-connect setup  [options]                Finish the bounded project setup: run scan,
-                                                     manage the widget, install + verify runtime
-                                                     protection, and wire dependency/build scans.
-                                                     Never runs the project build
-  patchstack-connect init   <site-uuid>              Optional: pre-seed .patchstackrc.json
-                                                     with an existing site UUID
-  patchstack-connect status [options]                Show current configuration and whether the
-                                                     site still exists on Patchstack (active /
-                                                     removed)
-  patchstack-connect mark-build [options]            Stamp built HTML with a production flag +
-                                                     build fingerprint, and ensure the widget
-                                                     tag in built pages (run as a postbuild step)
-  patchstack-connect protect [--demo|--check]        Install always-on runtime protection (the
-                                                     guard). Auto-wires supported server stacks;
-                                                     for others it scaffolds a
-                                                     generic guard + prints a wiring plan.
-                                                     --demo seeds a broad sample rule set (for
-                                                     demonstrations, not production).
-                                                     --check verifies the guard is wired (exit 1
-                                                     if not) \u2014 for the wire-then-verify loop.
-  patchstack-connect demo node-serialize [--url URL] Run the production-backed node-serialize
-                                                     walkthrough: verify the vulnerable package,
-                                                     scan it, wait for live rule 18843, install +
-                                                     verify the guard, and print test requests.
-                                                     Does not install vulnerable dependencies.
-  patchstack-connect demo-guide node-serialize       Show a read-only, state-aware walkthrough for
-                                                     preparing, running, proving, and cleaning up
-                                                     the production-backed local demo.
-  patchstack-connect guide [--full]                  Show this project's setup status (what's done,
-                                                     what's missing, with tailored commands), then
-                                                     print the full setup guide. --full prints the
-                                                     guide even when setup is complete
-  patchstack-connect help                            Print this message
-
-Options (for scan, setup, and status):
-  --site-uuid <uuid>      Override the configured site UUID
-  --endpoint <url>        Override the API endpoint
-  --dry-run               (scan only) Show the payload without posting
+// src/map/sources.ts
+import { readFileSync as readFileSync6, readdirSync as readdirSync5, realpathSync, statSync as statSync3 } from "fs";
+import { join as join12, relative as relative2, isAbsolute } from "path";
+
+// src/map/routes.ts
+var ROUTE_REGISTER_NAMES = ["get", "post", "put", "patch", "delete", "options", "all", "head", "use"];
+var ROUTE_REGISTER = new Set(ROUTE_REGISTER_NAMES);
+var ROUTE_CALL_RE = new RegExp(`\\.(${[...ROUTE_REGISTER_NAMES, "route"].join("|")})\\s*\\(`);
+function functionNameFromPath(relFile) {
+  const parts = relFile.split(/[\\/]/).filter(Boolean);
+  const i = parts.lastIndexOf("functions");
+  if (i === -1 || i === parts.length - 1) return void 0;
+  const next = parts[i + 1];
+  if (!next) return void 0;
+  const base = next.replace(/\.(ts|tsx|mts|cts|js|jsx|mjs|cjs)$/, "");
+  return base === "index" ? void 0 : base;
+}
+function routeFromFilePath(relFile) {
+  const parts = relFile.split(/[\\/]/).filter(Boolean);
+  if (parts.length === 0) return {};
+  const base = (parts[parts.length - 1] ?? "").replace(/\.(ts|tsx|mts|cts|js|jsx|mjs|cjs)$/, "");
+  const dirs = parts.slice(0, -1);
+  const at = (name) => dirs.lastIndexOf(name);
+  let segs = null;
+  if (base === "route" && at("app") !== -1) {
+    segs = dirs.slice(at("app") + 1);
+  } else if (base === "+server" && at("routes") !== -1) {
+    segs = dirs.slice(at("routes") + 1);
+  } else if (at("pages") !== -1) {
+    segs = [...dirs.slice(at("pages") + 1), ...base === "index" ? [] : [base]];
+  } else if (at("server") !== -1) {
+    segs = [...dirs.slice(at("server") + 1), ...base === "index" ? [] : [base.replace(/\.(get|post|put|patch|delete|head|options)$/i, "")]];
+  }
+  if (!segs) return {};
+  segs = segs.filter((s) => !(s.startsWith("(") && s.endsWith(")")) && !s.startsWith("@") && !s.startsWith("_"));
+  let dynamic = false;
+  const mapped = segs.map((s) => {
+    const m = /^\[+(\.{0,3})(.+?)\]+$/.exec(s);
+    if (m) {
+      dynamic = true;
+      return ":" + m[2];
+    }
+    return s;
+  });
+  const route = "/" + mapped.join("/");
+  return { route: route.length > 1 ? route.replace(/\/+$/, "") : "/", dynamic };
+}
+function routeFromChain(expr, ts) {
+  let cur = expr;
+  while (cur && ts.isCallExpression(cur) && ts.isPropertyAccessExpression(cur.expression)) {
+    const nm = cur.expression.name.text;
+    if (nm === "route") {
+      const a = cur.arguments[0];
+      return a && ts.isStringLiteralLike(a) ? a.text : void 0;
+    }
+    if (!ROUTE_REGISTER.has(nm)) return void 0;
+    cur = cur.expression.expression;
+  }
+  return void 0;
+}
+function routeObject(obj, ts) {
+  let url;
+  let handler;
+  const methods = [];
+  for (const p of obj.properties) {
+    const key = p.name?.text;
+    if (ts.isPropertyAssignment(p)) {
+      if ((key === "url" || key === "path") && ts.isStringLiteralLike(p.initializer)) url = p.initializer.text;
+      if (key === "method") {
+        if (ts.isStringLiteralLike(p.initializer)) methods.push(p.initializer.text.toUpperCase());
+        else if (ts.isArrayLiteralExpression(p.initializer)) {
+          for (const el of p.initializer.elements) if (ts.isStringLiteralLike(el)) methods.push(el.text.toUpperCase());
+        }
+      }
+      if (key === "handler" && isFnLike(p.initializer, ts)) handler = p.initializer;
+    } else if (ts.isMethodDeclaration(p) && key === "handler") handler = p;
+  }
+  return { url, methods, handler };
+}
+
+// src/map/sources.ts
+function hasEntrySignal(text) {
+  return text.includes("createServerFn") || /\bexport\s+(async\s+)?(function|const)\s+(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS)\b/.test(text) || ROUTE_CALL_RE.test(text) || text.includes("'use server'") || text.includes('"use server"') || text.includes("Deno.serve") || /\bserve\s*\(/.test(text);
+}
+function detectFramework(cwd) {
+  try {
+    const pkg = JSON.parse(readFileSync6(join12(cwd, "package.json"), "utf8"));
+    const d = { ...pkg.dependencies, ...pkg.devDependencies };
+    if (d["@tanstack/react-start"] || d["@tanstack/start"] || d["@tanstack/solid-start"]) return "tanstack-start";
+    if (d["next"]) return "next";
+    if (d["@sveltejs/kit"]) return "sveltekit";
+    if (d["@nestjs/core"]) return "nestjs";
+    if (d["fastify"]) return "fastify";
+    if (d["express"]) return "express";
+    if (d["hono"]) return "hono";
+  } catch {
+  }
+  try {
+    if (statSync3(join12(cwd, "supabase", "functions")).isDirectory()) return "supabase-functions";
+  } catch {
+  }
+  try {
+    if (statSync3(join12(cwd, "functions")).isDirectory()) return "deno-functions";
+  } catch {
+  }
+  return "unknown";
+}
+var isSourceFile = (name) => /\.(ts|tsx|mts|cts|js|jsx|mjs|cjs)$/.test(name) && !name.endsWith(".d.ts");
+var SKIP_DIRS2 = /* @__PURE__ */ new Set([
+  "node_modules",
+  "dist",
+  "build",
+  "out",
+  "coverage",
+  "public",
+  "static",
+  "assets",
+  ".git",
+  ".next",
+  ".nuxt",
+  ".svelte-kit",
+  ".output",
+  ".vercel",
+  ".wrangler",
+  ".turbo",
+  ".cache",
+  "vendor",
+  "tmp",
+  "temp",
+  "__pycache__"
+]);
+function collectSources(dir, boundary, opts, out = [], seen = /* @__PURE__ */ new Set(), stats = { discovered: 0, unwalked: 0 }) {
+  let key;
+  try {
+    key = realpathSync(dir);
+  } catch {
+    stats.unwalked++;
+    return out;
+  }
+  if (seen.has(key)) return out;
+  if (!opts.followOutside && !isInside(key, boundary)) {
+    stats.unwalked++;
+    return out;
+  }
+  seen.add(key);
+  let entries;
+  try {
+    entries = readdirSync5(dir, { withFileTypes: true });
+  } catch {
+    stats.unwalked++;
+    return out;
+  }
+  entries.sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+  for (const e of entries) {
+    if (SKIP_DIRS2.has(e.name) || e.name.startsWith(".") && e.name !== ".") continue;
+    const full = join12(dir, e.name);
+    if (e.isDirectory()) collectSources(full, boundary, opts, out, seen, stats);
+    else if (e.isSymbolicLink()) {
+      let st, real;
+      try {
+        st = statSync3(full);
+        real = realpathSync(full);
+      } catch {
+        stats.unwalked++;
+        continue;
+      }
+      if (!opts.followOutside && !isInside(real, boundary)) {
+        if (st.isDirectory() || isSourceFile(e.name)) stats.unwalked++;
+        continue;
+      }
+      if (st.isDirectory()) collectSources(full, boundary, opts, out, seen, stats);
+      else if (st.isFile() && isSourceFile(e.name)) {
+        out.push(full);
+        stats.discovered++;
+      }
+    } else if (isSourceFile(e.name)) {
+      out.push(full);
+      stats.discovered++;
+    }
+  }
+  return out;
+}
+function isInside(candidate, boundary) {
+  if (candidate === boundary) return true;
+  const rel = relative2(boundary, candidate);
+  return rel !== "" && !rel.startsWith("..") && !isAbsolute(rel);
+}
+var DEPLOYMENT_SHAPES = [
+  // Config first: these are declarations by the project itself, and they survive a build output being
+  // absent (a fresh clone has no `.vercel`/`.wrangler` directory).
+  { shape: "vercel", evidence: "deployment-config", files: ["vercel.json"] },
+  { shape: "netlify", evidence: "deployment-config", files: ["netlify.toml"] },
+  // Wrangler names a Workers/Pages deployment. `.jsonc` and `.json` are both current spellings.
+  { shape: "cloudflare-workers", evidence: "deployment-config", files: ["wrangler.toml", "wrangler.jsonc", "wrangler.json"] },
+  // Pages advanced mode: a single worker entry at the project root takes over routing entirely. Unlike a
+  // wrangler config, this file IS the server — it is a runtime entry, not a deployment declaration.
+  { shape: "cloudflare-pages-advanced", evidence: "runtime-entry", files: ["_worker.js", "_worker.ts"] },
+  { shape: "netlify-functions", evidence: "runtime-entry", dirs: ["netlify/functions", "netlify/edge-functions"] },
+  { shape: "supabase-functions", evidence: "runtime-entry", dirs: ["supabase/functions"], requiresFunctionEntry: true },
+  // Ambiguous by nature and reported as one shape: a root `functions/` directory is Cloudflare Pages
+  // Functions, Firebase functions, or a Deno layout depending on the platform, and nothing inside the
+  // repository always distinguishes them. Naming it honestly is better than guessing a provider.
+  { shape: "root-functions-directory", evidence: "layout", dirs: ["functions"] },
+  // The bare-root Vercel convention: `api/handler.ts` with no framework router. Next owns `pages/api`
+  // and `app/api` instead, which the endpoint walk already recognizes, so this is reported as its own
+  // shape rather than folded into `vercel`.
+  { shape: "root-api-directory", evidence: "layout", dirs: ["api"] }
+];
+function detectDeploymentShapes(cwd, opts = {}) {
+  let boundary = opts.boundary ?? cwd;
+  try {
+    boundary = realpathSync(boundary);
+  } catch {
+  }
+  const inProject = (path11) => {
+    if (opts.followOutside) return true;
+    try {
+      return isInside(realpathSync(path11), boundary);
+    } catch {
+      return false;
+    }
+  };
+  const found = [];
+  for (const candidate of DEPLOYMENT_SHAPES) {
+    for (const file of candidate.files ?? []) {
+      const full = join12(cwd, file);
+      try {
+        if (statSync3(full).isFile() && inProject(full)) {
+          found.push({ shape: candidate.shape, source: file, evidence: candidate.evidence });
+          break;
+        }
+      } catch {
+      }
+    }
+    for (const dir of candidate.dirs ?? []) {
+      const full = join12(cwd, dir);
+      try {
+        if (!statSync3(full).isDirectory() || !inProject(full)) continue;
+      } catch {
+        continue;
+      }
+      if (candidate.requiresFunctionEntry ? holdsFunctionEntry(full) : holdsSourceFile(full)) {
+        found.push({ shape: candidate.shape, source: dir, evidence: candidate.evidence });
+        break;
+      }
+    }
+  }
+  return found;
+}
+function holdsFunctionEntry(dir) {
+  try {
+    for (const entry of readdirSync5(dir, { withFileTypes: true })) {
+      if (!entry.isDirectory() || entry.name.startsWith("_")) continue;
+      try {
+        for (const nested of readdirSync5(join12(dir, entry.name), { withFileTypes: true })) {
+          if (nested.isFile() && /^index\.(ts|tsx|mts|cts|js|jsx|mjs|cjs)$/.test(nested.name)) return true;
+        }
+      } catch {
+      }
+    }
+  } catch {
+  }
+  return false;
+}
+function holdsSourceFile(dir) {
+  try {
+    for (const entry of readdirSync5(dir, { withFileTypes: true })) {
+      if (entry.isFile() && isSourceFile(entry.name)) return true;
+      if (entry.isDirectory()) {
+        try {
+          for (const nested of readdirSync5(join12(dir, entry.name), { withFileTypes: true })) {
+            if (nested.isFile() && isSourceFile(nested.name)) return true;
+          }
+        } catch {
+        }
+      }
+    }
+  } catch {
+  }
+  return false;
+}
+
+// src/map/surface.ts
+import { readFileSync as readFileSync7 } from "fs";
+import { join as join13 } from "path";
+var STATIC_GENERATORS = [
+  { dep: "vite", label: "vite" },
+  { dep: "react-scripts", label: "create-react-app" },
+  { dep: "gatsby", label: "gatsby" },
+  { dep: "parcel", label: "parcel" },
+  { dep: "@sveltejs/adapter-static", label: "sveltekit-static-adapter" }
+];
+var SSR_COMPANIONS = ["vike", "vite-plugin-ssr", "@react-router/node", "@react-router/serve", "vite-plugin-node"];
+var SERVER_DEPENDENCIES = [
+  "express",
+  "fastify",
+  "hono",
+  "koa",
+  "@nestjs/core",
+  "@hapi/hapi",
+  "h3",
+  "polka",
+  "restify",
+  "@tanstack/react-start",
+  "@tanstack/start",
+  "@tanstack/solid-start",
+  "nuxt",
+  "remix",
+  "@remix-run/node",
+  "@remix-run/server-runtime"
+];
+var CONDITIONAL_SERVER_DEPENDENCIES = [
+  { dep: "@sveltejs/kit", staticWhen: "@sveltejs/adapter-static" }
+];
+var SSR_ADAPTERS = ["@astrojs/node", "@astrojs/vercel", "@astrojs/cloudflare", "@astrojs/netlify", "@astrojs/deno"];
+var SHAPE_SIGNAL = {
+  "runtime-entry": "runtime-entry",
+  "deployment-config": "deployment-config",
+  layout: "ambiguous-layout"
+};
+function readManifest(cwd) {
+  try {
+    const parsed = JSON.parse(readFileSync7(join13(cwd, "package.json"), "utf8"));
+    return typeof parsed === "object" && parsed !== null ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function nextExportsStatically(cwd, manifest, ts) {
+  const scripts = Object.values(manifest.scripts ?? {}).join(" ");
+  if (/\bnext\s+export\b/.test(scripts)) return "next export (build script)";
+  if (ts === void 0) return null;
+  for (const file of ["next.config.js", "next.config.mjs", "next.config.ts", "next.config.cjs"]) {
+    let text;
+    try {
+      text = readFileSync7(join13(cwd, file), "utf8");
+    } catch {
+      continue;
+    }
+    try {
+      const sf = ts.createSourceFile(file, text, ts.ScriptTarget.Latest, true);
+      if (exportedConfigIsStatic(sf, ts)) return `output: 'export' (${file})`;
+    } catch {
+    }
+  }
+  return null;
+}
+function exportedConfigIsStatic(sf, ts) {
+  const objects = [];
+  const followed = /* @__PURE__ */ new Set();
+  const collectFrom = (expr) => {
+    if (!expr) return;
+    if (ts.isObjectLiteralExpression(expr)) {
+      objects.push(expr);
+      return;
+    }
+    if (ts.isCallExpression(expr)) {
+      for (const arg of expr.arguments) collectFrom(arg);
+      return;
+    }
+    if (ts.isIdentifier(expr)) {
+      const name = expr.text;
+      if (followed.has(name)) return;
+      followed.add(name);
+      const visit = (node) => {
+        if (ts.isVariableDeclaration(node) && ts.isIdentifier(node.name) && node.name.text === name) {
+          collectFrom(node.initializer);
+        }
+        ts.forEachChild(node, visit);
+      };
+      visit(sf);
+    }
+  };
+  const findExports = (node) => {
+    if (ts.isExportAssignment(node)) collectFrom(node.expression);
+    if (ts.isBinaryExpression(node) && node.operatorToken.kind === ts.SyntaxKind.EqualsToken && ts.isPropertyAccessExpression(node.left) && node.left.name.text === "exports") {
+      collectFrom(node.right);
+    }
+    ts.forEachChild(node, findExports);
+  };
+  findExports(sf);
+  for (const object of objects) {
+    for (const property of object.properties) {
+      if (!ts.isPropertyAssignment(property)) continue;
+      const key = property.name;
+      const keyName = ts.isIdentifier(key) || ts.isStringLiteralLike(key) ? key.text : void 0;
+      if (keyName !== "output") continue;
+      if (ts.isStringLiteralLike(property.initializer) && property.initializer.text === "export") return true;
+    }
+  }
+  return false;
+}
+function staticSignals(cwd, ts) {
+  const manifest = readManifest(cwd);
+  if (manifest === null) return [];
+  const deps = { ...manifest.dependencies, ...manifest.devDependencies };
+  const signals = [];
+  for (const generator of STATIC_GENERATORS) {
+    if (deps[generator.dep] !== void 0) {
+      signals.push({ signal: "static-generator", source: generator.label });
+    }
+  }
+  if (deps["astro"] !== void 0 && !SSR_ADAPTERS.some((adapter) => deps[adapter] !== void 0)) {
+    signals.push({ signal: "static-generator", source: "astro (no SSR adapter)" });
+  }
+  if (deps["next"] !== void 0) {
+    const exported = nextExportsStatically(cwd, manifest, ts);
+    if (exported !== null) signals.push({ signal: "static-generator", source: `next: ${exported}` });
+  }
+  return signals;
+}
+function serverDependencySignals(cwd, ts) {
+  const manifest = readManifest(cwd);
+  if (manifest === null) return [];
+  const deps = { ...manifest.dependencies, ...manifest.devDependencies };
+  const found = SERVER_DEPENDENCIES.filter((dep) => deps[dep] !== void 0);
+  for (const conditional of CONDITIONAL_SERVER_DEPENDENCIES) {
+    if (deps[conditional.dep] !== void 0 && deps[conditional.staticWhen] === void 0) {
+      found.push(conditional.dep);
+    }
+  }
+  for (const companion of SSR_COMPANIONS) if (deps[companion] !== void 0) found.push(companion);
+  if (deps["next"] !== void 0 && nextExportsStatically(cwd, manifest, ts) === null) found.push("next");
+  if (deps["astro"] !== void 0) {
+    for (const adapter of SSR_ADAPTERS) if (deps[adapter] !== void 0) found.push(adapter);
+  }
+  return found.map((dep) => ({ signal: "server-dependency", source: dep }));
+}
+function classifyServerSurface(cwd, endpointCount, deploymentShapes, ts) {
+  const evidence = [];
+  if (endpointCount > 0) {
+    evidence.push({ signal: "endpoint", source: `${endpointCount} recognized entry point(s)` });
+  }
+  for (const shape of deploymentShapes) {
+    evidence.push({
+      signal: SHAPE_SIGNAL[shape.evidence],
+      source: `${shape.shape} (${shape.source})`
+    });
+  }
+  const servers = serverDependencySignals(cwd, ts);
+  const statics = staticSignals(cwd, ts);
+  const servesRequests = deploymentShapes.some((shape) => shape.evidence === "runtime-entry");
+  if (endpointCount > 0 || servesRequests) {
+    return { state: "server-runtime-detected", evidence };
+  }
+  evidence.push(...servers, ...statics);
+  const blocked = servers.length > 0 || deploymentShapes.length > 0;
+  if (statics.length > 0 && !blocked) {
+    return { state: "static-build-detected", evidence };
+  }
+  return { state: "unknown", evidence };
+}
+function surfaceNote(surface) {
+  if (surface.state === "server-runtime-detected") {
+    return "serverSurface: a server runtime was recognized in the analysed source (see its evidence). Request-path protection applies to this app.";
+  }
+  if (surface.state === "static-build-detected") {
+    return "serverSurface: a static build was identified and no server runtime was recognized in the analysed source. This is NOT deployment attestation \u2014 it describes the source, not what is deployed, and a serverless function added at the platform level would not appear here. Advisories against this app are dependency and bundle concerns rather than request-path risk.";
+  }
+  return 'serverSurface is UNKNOWN: neither a server runtime nor a static build could be positively identified. This is the honest answer for an unrecognised stack, and it must not be read as "no server side" \u2014 an unparsed framework produces no endpoints, and entry-point recognition has no completeness flag.';
+}
+
+// src/map/sinks.ts
+import { createHash as createHash2 } from "crypto";
+var DB_OPS = /* @__PURE__ */ new Set(["insert", "update", "delete", "select", "upsert", "rpc"]);
+var PRISMA_OPS = /* @__PURE__ */ new Set(["create", "createMany", "update", "updateMany", "delete", "deleteMany", "upsert", "findFirst", "findUnique", "findMany", "count", "aggregate"]);
+var FS_CALLS = /^(readFile|writeFile|readFileSync|writeFileSync|appendFile|createReadStream|createWriteStream|unlink|rm|rmSync|mkdir|readdir|stat|open)$/;
+var EXEC_CALLS = /^(exec|execSync|spawn|spawnSync|execFile|execFileSync|fork)$/;
+var HTTP_CALLS = /^(fetch|got|request)$/;
+var HTTP_MEMBER_METHODS = /* @__PURE__ */ new Set(["get", "post", "put", "patch", "delete", "head", "request"]);
+var DB_PACKAGES = ["@supabase/supabase-js", "@prisma/client", "drizzle-orm", "knex", "kysely", "pg", "mysql2", "mysql", "sequelize", "typeorm", "mongoose", "better-sqlite3"];
+var MORE_DB_PACKAGES = [
+  "postgres",
+  "mssql",
+  "tedious",
+  "oracledb",
+  "sqlite3",
+  "mongodb",
+  "ioredis",
+  "@planetscale/database",
+  "@neondatabase/serverless",
+  "@libsql/client",
+  "@vercel/postgres",
+  "slonik",
+  "sql.js"
+];
+var isDbPackage = (pkg) => DB_PACKAGES.includes(pkg) || MORE_DB_PACKAGES.includes(pkg) || [...DB_PACKAGES, ...MORE_DB_PACKAGES].some((p) => pkg.startsWith(p + "/"));
+var HTTP_PACKAGES = ["axios", "got", "node-fetch", "undici", "superagent", "ky"];
+var isHttpPackage = (pkg) => HTTP_PACKAGES.includes(pkg) || pkg === "node:http" || pkg === "node:https";
+var FS_PACKAGES = ["fs-extra", "graceful-fs", "memfs"];
+var isFsPackage = (pkg) => /^node:fs(\/promises)?$/.test(pkg) || FS_PACKAGES.includes(pkg);
+var EXEC_PACKAGES = ["execa", "cross-spawn", "shelljs", "zx"];
+var isExecPackage = (pkg) => pkg === "node:child_process" || EXEC_PACKAGES.includes(pkg);
+function recognizedSinkKinds(pkg) {
+  const kinds = [];
+  if (isDbPackage(pkg)) kinds.push("db");
+  if (isFsPackage(pkg)) kinds.push("fs");
+  if (isExecPackage(pkg)) kinds.push("exec");
+  if (isHttpPackage(pkg)) kinds.push("http");
+  return kinds;
+}
+function collectLocalSinks(sf, ts, bindings, ctx) {
+  const map = /* @__PURE__ */ new Map();
+  const visit = (node) => {
+    if (ts.isFunctionDeclaration(node) && node.name && node.body) map.set(node.name.text, directSinks(node.body, ts, bindings, ctx));
+    else if (ts.isVariableStatement(node)) {
+      for (const decl of node.declarationList.declarations) {
+        if (ts.isIdentifier(decl.name) && decl.initializer && isFnLike(decl.initializer, ts)) {
+          map.set(decl.name.text, directSinks(decl.initializer.body, ts, bindings, ctx));
+        }
+      }
+    }
+    ts.forEachChild(node, visit);
+  };
+  visit(sf);
+  return map;
+}
+function sinksFrom(arrowOrNode, ts, localSinks, bindings, ctx) {
+  if (!arrowOrNode) return [];
+  const body = arrowOrNode.isSyntheticBody ? arrowOrNode.body : isFnLike(arrowOrNode, ts) ? arrowOrNode.body : arrowOrNode;
+  if (!body) return [];
+  const sinks = directSinks(body, ts, bindings, ctx);
+  for (const called of localCalls(body, ts)) {
+    for (const s of localSinks.get(called) ?? []) sinks.push(s);
+    if (ctx) {
+      const spec = bindings.resolve(called);
+      if (spec && spec.startsWith(".")) {
+        for (const s of ctx.graph.importedSinks(ctx.file, spec, bindings.exportNameOf(called) ?? called)) sinks.push(s);
+      }
+    }
+  }
+  if (ctx) {
+    for (const [root, member] of namespaceMemberCalls(body, ts)) {
+      const spec = bindings.resolve(root);
+      if (spec && spec.startsWith(".")) {
+        for (const s of ctx.graph.importedSinks(ctx.file, spec, member)) sinks.push(s);
+      }
+    }
+  }
+  return dedupeSinks(sinks, ctx?.owner ?? "");
+}
+function namespaceMemberCalls(node, ts) {
+  const out = [];
+  const visit = (n) => {
+    if (ts.isCallExpression(n) && ts.isPropertyAccessExpression(n.expression) && ts.isIdentifier(n.expression.expression)) {
+      out.push([n.expression.expression.text, n.expression.name.text]);
+    }
+    ts.forEachChild(n, visit);
+  };
+  visit(node);
+  return out;
+}
+function directSinks(node, ts, bindings, ctx) {
+  const sinks = [];
+  const baseOf = (base) => {
+    const root = base ? rootIdentifier(base, ts) : void 0;
+    if (!root) return {};
+    const spec = bindings.resolve(root);
+    const relative5 = spec !== void 0 && (spec.startsWith(".") || spec.startsWith("/"));
+    const pkg = npmPackageOf(spec);
+    if (pkg) return { pkg, root, spec };
+    if (relative5 && ctx && spec) {
+      const viaModule = ctx.graph.importedBinding(ctx.file, spec, bindings.exportNameOf(root) ?? root);
+      if (viaModule) return { pkg: viaModule.package, root, spec };
+    }
+    return { local: bindings.locals.has(root), root, spec, relative: relative5 };
+  };
+  const attributionOf = (b, pkg) => b.pkg ? "import" : pkg ? "inferred" : void 0;
+  const dbApi = (pkg, attribution) => {
+    if (pkg && !isDbPackage(pkg)) return { apiUnconfirmed: true };
+    return attribution === "import" || attribution === "global" ? { provider: "sql" } : {};
+  };
+  const infer = (kind) => {
+    const table = kind === "db" ? DB_PACKAGES : HTTP_PACKAGES;
+    for (const p of table) if (bindings.imports.has(p)) return p;
+    return void 0;
+  };
+  const push = (s) => sinks.push(s);
+  const visit = (n) => {
+    if (n !== node && isUninvokedFunctionDeclaration(n, ts)) return;
+    if (ts.isCallExpression(n)) {
+      const callee = n.expression;
+      if (ts.isPropertyAccessExpression(callee) && callee.name.text === "from") {
+        const b = baseOf(callee.expression);
+        const t = n.arguments[0];
+        const table = t && ts.isStringLiteralLike(t) ? t.text : void 0;
+        const parent = n.parent;
+        if (!b.local && !b.relative && parent && ts.isPropertyAccessExpression(parent) && DB_OPS.has(parent.name.text)) {
+          const pkg = b.pkg ?? infer("db");
+          const attribution = attributionOf(b, pkg);
+          push({ kind: "db", ...dbApi(pkg, attribution), package: pkg, table, op: parent.name.text, attribution, ...spanOf(opCallOf(parent, ts)) });
+        }
+      }
+      if (ts.isPropertyAccessExpression(callee)) {
+        const method = callee.name.text;
+        const b = baseOf(callee.expression);
+        if (!b.local && !b.relative) {
+          if (PRISMA_OPS.has(method) && ts.isPropertyAccessExpression(callee.expression)) {
+            const prismaLikely = b.pkg === "@prisma/client" || !b.pkg && (bindings.imports.has("@prisma/client") || /prisma/i.test(b.root ?? ""));
+            if (prismaLikely) push({ kind: "db", ...b.pkg ? { provider: "prisma" } : {}, package: "@prisma/client", table: callee.expression.name.text, op: method, attribution: b.pkg ? "import" : "inferred", ...spanOf(n) });
+          }
+          if (method === "query" || method === "execute") {
+            const pkg = b.pkg ?? infer("db");
+            const attribution = attributionOf(b, pkg);
+            push({ kind: "db", ...dbApi(pkg, attribution), package: pkg, op: method, attribution, ...spanOf(n) });
+          }
+          if (FS_CALLS.test(method) && b.pkg && isFsPackage(b.pkg)) {
+            push({ kind: "fs", package: b.pkg, op: method, attribution: "import", ...spanOf(n) });
+          }
+          if (EXEC_CALLS.test(method) && b.pkg && isExecPackage(b.pkg)) {
+            push({ kind: "exec", package: b.pkg, op: method, attribution: "import", ...spanOf(n) });
+          }
+          if (HTTP_MEMBER_METHODS.has(method)) {
+            if (b.pkg && isHttpPackage(b.pkg)) {
+              push({ kind: "http", provider: b.root, package: b.pkg, op: method, attribution: "import", ...spanOf(n) });
+            } else if (!b.spec && ts.isIdentifier(callee.expression) && /^(axios|http|https|got|ky)$/.test(callee.expression.text)) {
+              push({ kind: "http", provider: callee.expression.text, package: infer("http"), op: method, attribution: "inferred", ...spanOf(n) });
+            }
+          }
+        }
+      }
+      if (ts.isIdentifier(callee) && !bindings.locals.has(callee.text)) {
+        const name = callee.text;
+        const spec = bindings.resolve(name);
+        const pkg = npmPackageOf(spec);
+        const shadowed = isShadowedByEnclosingBinding(n, name, ts);
+        const fromModule = spec !== void 0;
+        const trueGlobal = !fromModule && !shadowed;
+        if (HTTP_CALLS.test(name)) {
+          if (pkg && isHttpPackage(pkg)) push({ kind: "http", provider: name, package: pkg, op: "request", attribution: "import", ...spanOf(n) });
+          else if (name === "fetch" && trueGlobal) push({ kind: "http", provider: "fetch", op: "request", attribution: "global", ...spanOf(n) });
+        }
+        if (FS_CALLS.test(name) && pkg && isFsPackage(pkg)) {
+          push({ kind: "fs", package: pkg, op: name, attribution: "import", ...spanOf(n) });
+        }
+        if (EXEC_CALLS.test(name) && pkg && isExecPackage(pkg)) {
+          push({ kind: "exec", package: pkg, op: name, attribution: "import", ...spanOf(n) });
+        }
+        if (name === "eval" && trueGlobal) push({ kind: "eval", op: "eval", attribution: "global", ...spanOf(n) });
+      }
+    }
+    if (ts.isNewExpression(n) && ts.isIdentifier(n.expression) && n.expression.text === "Function" && !bindings.locals.has("Function") && !isShadowedByEnclosingBinding(n, "Function", ts)) {
+      push({ kind: "eval", op: "new Function", attribution: "global", ...spanOf(n) });
+    }
+    ts.forEachChild(n, visit);
+  };
+  visit(node);
+  return sinks;
+}
+var ARGUMENT_ROLES = {
+  exec: {
+    exec: ["command"],
+    execSync: ["command"],
+    execFile: ["file", "args"],
+    execFileSync: ["file", "args"],
+    spawn: ["command", "args"],
+    spawnSync: ["command", "args"],
+    fork: ["file", "args"]
+  },
+  http: {
+    fetch: ["url", "init"],
+    request: ["url", "options"],
+    get: ["url", "options"],
+    head: ["url", "options"],
+    delete: ["url", "options"],
+    post: ["url", "body"],
+    put: ["url", "body"],
+    patch: ["url", "body"]
+  },
+  fs: {
+    readFile: ["path"],
+    readFileSync: ["path"],
+    open: ["path"],
+    writeFile: ["path", "content"],
+    writeFileSync: ["path", "content"],
+    appendFile: ["path", "content"],
+    unlink: ["path"],
+    rm: ["path"],
+    rmSync: ["path"],
+    mkdir: ["path"],
+    readdir: ["path"],
+    stat: ["path"],
+    createReadStream: ["path"],
+    createWriteStream: ["path"]
+  },
+  db: {
+    query: ["sql", "values"],
+    execute: ["sql", "values"],
+    insert: ["values"],
+    update: ["values"],
+    upsert: ["values"],
+    select: ["columns"],
+    // Filters: the value half is still request data reaching the query, but as a bound parameter.
+    eq: ["column", "value"],
+    neq: ["column", "value"],
+    gt: ["column", "value"],
+    gte: ["column", "value"],
+    lt: ["column", "value"],
+    lte: ["column", "value"],
+    like: ["column", "value"],
+    ilike: ["column", "value"],
+    match: ["values"],
+    filter: ["column", "value"]
+  },
+  eval: { eval: ["code"], Function: ["code"] }
+};
+var CANDIDATE_FAMILIES = {
+  http: { url: "ssrf" },
+  exec: { command: "command-injection", file: "command-injection", args: "command-injection" },
+  fs: { path: "path-traversal" },
+  db: { sql: "sql-injection" },
+  eval: { code: "code-injection" }
+};
+function argumentRoleOf(sinkKind, method, index, total = 0) {
+  if (sinkKind === "eval" && method === "Function") return index === total - 1 ? "code" : "args";
+  const table = method ? ARGUMENT_ROLES[sinkKind]?.[method] : void 0;
+  return table?.[index] ?? "unknown";
+}
+function sinkId(s, owner) {
+  return createHash2("sha256").update([s.kind, s.provider, s.package, s.table, s.op, s.file ?? owner, s.start, s.end].join("|")).digest("hex").slice(0, 12);
+}
+function dedupeSinks(sinks, owner) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const s of sinks) {
+    const key = `${s.kind}:${s.provider}:${s.package}:${s.table}:${s.op}:${s.line}:${s.start}`;
+    if (!seen.has(key)) {
+      seen.add(key);
+      out.push({ ...s, id: sinkId(s, owner) });
+    }
+  }
+  return out;
+}
+
+// src/map/module-graph.ts
+import { readFileSync as readFileSync8, realpathSync as realpathSync2, statSync as statSync4 } from "fs";
+import { dirname as dirname4, join as join14, relative as relative3, resolve as resolvePath } from "path";
+var RESOLVE_EXTS = [".ts", ".tsx", ".mts", ".cts", ".js", ".jsx", ".mjs", ".cjs"];
+function createModuleGraph(ts, opts) {
+  const cache = /* @__PURE__ */ new Map();
+  const load = (file) => {
+    if (cache.has(file)) return cache.get(file) ?? null;
+    let entry = null;
+    try {
+      const text = readFileSync8(file, "utf8");
+      const sf = ts.createSourceFile(file, text, ts.ScriptTarget.Latest, true, guessScriptKind(ts, file));
+      const bindings = buildModuleBindings(sf, ts);
+      entry = { fnSinks: collectLocalSinks(sf, ts, bindings), calleesOf: collectCallees(sf, ts), bindings };
+    } catch {
+      entry = null;
+    }
+    cache.set(file, entry);
+    return entry;
+  };
+  const resolveInProject = (fromFile, specifier) => {
+    const target = resolveRelativeModule(fromFile, specifier);
+    if (!target) return void 0;
+    if (!opts.followOutside) {
+      let real = target;
+      try {
+        real = realpathSync2(target);
+      } catch {
+      }
+      if (!isInside(real, opts.boundary)) return void 0;
+    }
+    return target;
+  };
+  return {
+    resolveLocal: resolveInProject,
+    importedSinks(fromFile, specifier, exportName) {
+      const target = resolveInProject(fromFile, specifier);
+      if (!target) return [];
+      const mod = load(target);
+      if (!mod) return [];
+      const collected = [...mod.fnSinks.get(exportName) ?? []];
+      for (const callee of mod.calleesOf.get(exportName) ?? []) {
+        for (const s of mod.fnSinks.get(callee) ?? []) collected.push(s);
+      }
+      const rel = relative3(opts.cwd, target);
+      return collected.map((s) => ({ ...s, file: rel }));
+    },
+    // A different question about the same module: not "what sinks are in there" but "what does this
+    // export TRACE TO". The common AI-built layout puts the client in a lib file —
+    // `export const db = createClient(...)` in `lib/db.ts`, imported everywhere — so the receiver of
+    // `db.from('orders').insert(...)` resolves to a relative specifier and nothing else. Refusing it (as
+    // an unattributable receiver) is right for app code but wrong here: one hop away it is a real
+    // dependency, and that chain is import-to-import, fully static — evidence, not inference.
+    importedBinding(fromFile, specifier, exportName) {
+      const target = resolveInProject(fromFile, specifier);
+      if (!target) return void 0;
+      const mod = load(target);
+      if (!mod) return void 0;
+      const pkg = npmPackageOf(mod.bindings.resolve(exportName));
+      if (pkg === void 0) return void 0;
+      return {
+        package: pkg,
+        origin: mod.bindings.originOf(exportName) ?? "direct",
+        name: mod.bindings.exportNameOf(exportName) ?? exportName
+      };
+    }
+  };
+}
+function resolveRelativeModule(fromFile, spec) {
+  if (!spec.startsWith(".")) return void 0;
+  const dir = dirname4(fromFile);
+  const base = resolvePath(dir, spec);
+  const candidates = [];
+  const jsLike = /\.(js|jsx|mjs|cjs)$/.exec(base);
+  if (jsLike) {
+    const stem = base.slice(0, -jsLike[0].length);
+    for (const e of RESOLVE_EXTS) candidates.push(stem + e);
+  }
+  candidates.push(base);
+  for (const e of RESOLVE_EXTS) candidates.push(base + e);
+  for (const e of RESOLVE_EXTS) candidates.push(join14(base, "index" + e));
+  for (const c of candidates) {
+    try {
+      if (statSync4(c).isFile()) return c;
+    } catch {
+    }
+  }
+  return void 0;
+}
+function collectCallees(sf, ts) {
+  const map = /* @__PURE__ */ new Map();
+  const visit = (node) => {
+    let name;
+    let body;
+    if (ts.isFunctionDeclaration(node) && node.name && node.body) {
+      name = node.name.text;
+      body = node.body;
+    } else if (ts.isVariableDeclaration(node) && ts.isIdentifier(node.name) && node.initializer && isFnLike(node.initializer, ts)) {
+      name = node.name.text;
+      body = node.initializer.body;
+    }
+    if (name && body) map.set(name, localCalls(body, ts));
+    ts.forEachChild(node, visit);
+  };
+  visit(sf);
+  return map;
+}
+
+// src/map/coordinates.ts
+function runtimeCoordinate(source, path11) {
+  if (/\[\d*\]/.test(path11)) {
+    return { runtimeParameter: null, runtimeParameterReason: "array traversal: needs an array_key_value rule, not a dotted parameter" };
+  }
+  switch (source) {
+    case "json-body":
+    case "form-body":
+    case "multipart":
+    case "body":
+    case "server-fn-data":
+      return { runtimeParameter: `post.${path11}` };
+    case "query":
+      return { runtimeParameter: `get.${path11}` };
+    case "cookie":
+      return { runtimeParameter: `cookie.${path11}` };
+    case "file":
+      return { runtimeParameter: `files.${path11}` };
+    case "header":
+      return { runtimeParameter: `server.HTTP_${path11.toUpperCase().replace(/-/g, "_")}` };
+    case "route-param":
+      return { runtimeParameter: null, runtimeParameterReason: "route parameters are not exposed by the runtime resolver" };
+    default:
+      return { runtimeParameter: null, runtimeParameterReason: "input source could not be determined" };
+  }
+}
+function addressSpaceOf(source) {
+  switch (source) {
+    case "json-body":
+    case "form-body":
+    case "multipart":
+    case "body":
+    case "server-fn-data":
+      return "post";
+    case "query":
+      return "get";
+    case "cookie":
+      return "cookie";
+    case "file":
+      return "files";
+    case "header":
+      return "server";
+    case "route-param":
+      return "route-param";
+    default:
+      return "unknown";
+  }
+}
+function isProvenFlow(confidence) {
+  return confidence === "exact-local" || confidence === "transformed-local";
+}
+function inputIdOf(source, path11) {
+  return `${addressSpaceOf(source)}:${path11}`;
+}
+function withCoordinates(fields, source) {
+  return fields.map((f) => {
+    const src = f.source ?? source;
+    return { ...f, source: src, id: inputIdOf(src, f.name), ...runtimeCoordinate(src, f.name) };
+  });
+}
+
+// src/map/inputs.ts
+var ZOD_BASE = /* @__PURE__ */ new Set(["string", "number", "boolean", "array", "object", "enum", "bigint", "date", "record"]);
+var STRING_FORMATS = /* @__PURE__ */ new Set(["email", "uuid", "url", "ip", "ipv4", "ipv6", "cuid", "cuid2", "ulid", "emoji", "datetime", "base64", "jwt", "nanoid"]);
+var VALIDATOR_PACKAGES = /* @__PURE__ */ new Set(["zod", "valibot", "yup", "joi", "@hapi/joi", "superstruct"]);
+function inputsFromValidator(validatorCall, ts, bindings) {
+  if (!validatorCall) return [];
+  return zodObjectFields(validatorCall, ts, bindings);
+}
+function inputsFromHandler(params, body, ts, bindings, opts = {}) {
+  const schemaSource = opts.validatorSource ?? "json-body";
+  const schemaFields = zodObjectFields(body, ts, bindings);
+  const reads = requestMemberAccesses(params, body, ts, opts);
+  const byId = /* @__PURE__ */ new Map();
+  const put = (name, source, extra = {}) => {
+    const id = inputIdOf(source, name);
+    if (byId.has(id)) return;
+    byId.set(id, { ...extra, id, name, source, ...runtimeCoordinate(source, name) });
+  };
+  for (const f of schemaFields) {
+    const { name, source, ...shape } = f;
+    put(name, source ?? schemaSource, shape);
+  }
+  for (const { name, sources } of reads) for (const source of sources) put(name, source);
+  return [...byId.values()];
+}
+function findValidatorObject(node, ts, bindings) {
+  let found = null;
+  const find = (n) => {
+    if (found || !n) return;
+    if (ts.isCallExpression(n) && ts.isPropertyAccessExpression(n.expression) && n.expression.name.text === "object") {
+      const root = rootIdentifier(n.expression.expression, ts);
+      const pkg = root ? npmPackageOf(bindings.resolve(root)) : void 0;
+      const isValidator = pkg && VALIDATOR_PACKAGES.has(pkg) || !pkg && root === "z" && !bindings.locals.has(root);
+      if (isValidator) {
+        const arg = n.arguments[0];
+        if (arg && ts.isObjectLiteralExpression(arg)) {
+          found = arg;
+          return;
+        }
+      }
+    }
+    ts.forEachChild(n, find);
+  };
+  find(node);
+  return found;
+}
+function zodObjectFields(node, ts, bindings) {
+  if (!node) return [];
+  const lit = findValidatorObject(node.body ?? node, ts, bindings);
+  return lit ? fieldsOfObject(lit, ts, bindings, "") : [];
+}
+function fieldsOfObject(objectLiteral, ts, bindings, prefix) {
+  const fields = [];
+  for (const p of objectLiteral.properties) {
+    if (!ts.isPropertyAssignment(p) || !p.name) continue;
+    const fname = p.name.text;
+    if (!fname) continue;
+    const shape = zodShape(p.initializer, ts);
+    fields.push({ name: prefix + fname, ...shape });
+    const nested = findValidatorObject(p.initializer, ts, bindings);
+    if (nested) fields.push(...fieldsOfObject(nested, ts, bindings, prefix + fname + (shape.type === "array" ? "[]." : ".")));
+  }
+  return fields;
+}
+function numericValue(arg, ts) {
+  if (!arg) return void 0;
+  if (ts.isNumericLiteral(arg)) return Number(arg.text);
+  if (ts.isPrefixUnaryExpression(arg) && arg.operator === ts.SyntaxKind.MinusToken && ts.isNumericLiteral(arg.operand)) return -Number(arg.operand.text);
+  return void 0;
+}
+function zodShape(node, ts) {
+  const shape = {};
+  let cur = node;
+  while (cur && ts.isCallExpression(cur) && ts.isPropertyAccessExpression(cur.expression)) {
+    const method = cur.expression.name.text;
+    const arg0 = cur.arguments[0];
+    if (ZOD_BASE.has(method) && !shape.type) shape.type = method;
+    if (method === "min") {
+      const v = numericValue(arg0, ts);
+      if (v !== void 0) shape.min = v;
+    }
+    if (method === "max") {
+      const v = numericValue(arg0, ts);
+      if (v !== void 0) shape.max = v;
+    }
+    if (STRING_FORMATS.has(method) && !shape.format) shape.format = method;
+    if (method === "regex" && arg0 && ts.isRegularExpressionLiteral(arg0) && !shape.pattern) shape.pattern = arg0.text;
+    if (method === "optional" || method === "nullish") shape.optional = true;
+    cur = cur.expression.expression;
+  }
+  return shape;
+}
+var REQ_SOURCES = ["body", "query", "params"];
+function requestMemberAccesses(params, body, ts, opts = {}) {
+  if (!body) return [];
+  const out = /* @__PURE__ */ new Map();
+  const record = (name, source) => {
+    const list = out.get(name) ?? [];
+    if (!list.includes(source)) list.push(source);
+    out.set(name, list);
+  };
+  const p0 = params?.[0];
+  const reqName = p0 && ts.isIdentifier(p0.name) ? p0.name.text : void 0;
+  const sourceNames = /* @__PURE__ */ new Map();
+  const payloadNames = /* @__PURE__ */ new Set();
+  if (opts.payloadParam && p0 && ts.isIdentifier(p0.name)) payloadNames.add(p0.name.text);
+  if (p0 && !reqName && ts.isObjectBindingPattern(p0.name)) {
+    for (const el of p0.name.elements) {
+      const key = bindingKey(el, ts);
+      if (key && REQ_SOURCES.includes(key) && ts.isIdentifier(el.name)) {
+        sourceNames.set(el.name.text, namespaceSource(key));
+      }
+    }
+  }
+  const unwrap = (e) => {
+    let cur = e;
+    while (cur && (ts.isAwaitExpression(cur) || ts.isAsExpression(cur) || ts.isParenthesizedExpression(cur) || ts.isNonNullExpression(cur))) cur = cur.expression;
+    return cur;
+  };
+  const isPayloadExpr = (e) => ts.isIdentifier(e) && payloadNames.has(e.text);
+  const isReqSourceExpr = (e) => isPayloadExpr(e) || ts.isPropertyAccessExpression(e) && ts.isIdentifier(e.expression) && e.expression.text === reqName && REQ_SOURCES.includes(e.name.text) || ts.isIdentifier(e) && sourceNames.has(e.text);
+  const isBodyReadCall = (e) => {
+    const inner = unwrap(e);
+    return Boolean(inner && ts.isCallExpression(inner) && ts.isPropertyAccessExpression(inner.expression) && ["json", "formData"].includes(inner.expression.name.text) && ts.isIdentifier(inner.expression.expression) && inner.expression.expression.text === reqName);
+  };
+  const visit = (n) => {
+    if (ts.isPropertyAccessExpression(n) && isReqSourceExpr(n.expression)) {
+      record(n.name.text, sourceOfExpr(n.expression));
+    }
+    if (ts.isVariableDeclaration(n) && n.initializer) {
+      const init = unwrap(n.initializer);
+      if (ts.isIdentifier(n.name) && isBodyReadCall(n.initializer)) sourceNames.set(n.name.text, bodyReadSource(n.initializer));
+      if (ts.isObjectBindingPattern(n.name) && ts.isIdentifier(init) && reqName && init.text === reqName) {
+        for (const el of n.name.elements) {
+          const key = bindingKey(el, ts);
+          if (key && REQ_SOURCES.includes(key) && ts.isIdentifier(el.name)) sourceNames.set(el.name.text, namespaceSource(key));
+        }
+      }
+      if (ts.isObjectBindingPattern(n.name) && (isReqSourceExpr(init) || isBodyReadCall(n.initializer))) {
+        const src = isBodyReadCall(n.initializer) ? bodyReadSource(n.initializer) : sourceOfExpr(init);
+        for (const el of n.name.elements) {
+          const key = bindingKey(el, ts);
+          if (key) record(key, src);
+        }
+      }
+    }
+    ts.forEachChild(n, visit);
+  };
+  visit(body);
+  return [...out].map(([name, sources]) => ({ name, sources }));
+  function sourceOfExpr(e) {
+    if (isPayloadExpr(e)) return "server-fn-data";
+    if (ts.isPropertyAccessExpression(e)) {
+      if (e.name.text === "query") return "query";
+      if (e.name.text === "params") return "route-param";
+      if (e.name.text === "body") return "body";
+    }
+    if (ts.isIdentifier(e)) {
+      const recorded = sourceNames.get(e.text);
+      if (recorded) return recorded;
+    }
+    return "body";
+  }
+  function namespaceSource(key) {
+    if (key === "query") return "query";
+    if (key === "params") return "route-param";
+    return "body";
+  }
+  function bodyReadSource(init) {
+    const t = init?.getText?.() ?? "";
+    return /formData\s*\(/.test(t) ? "form-body" : "json-body";
+  }
+}
+
+// src/map/flows.ts
+function spaceOfKey(key) {
+  if (key === "query") return "get";
+  if (key === "params") return "route-param";
+  if (key === "body") return "post";
+  if (key === "data" || key === "input" || key === "payload") return "post";
+  return void 0;
+}
+function linkedFlows(body, params, inputs, sinks, ts) {
+  const { flows, limitations } = linkFlows(body, params, inputs, sinks, ts);
+  return limitations.length > 0 ? { flows, limitations } : { flows };
+}
+function linkFlows(bodyNode, params, inputs, sinks, ts) {
+  if (!bodyNode || sinks.length === 0 || inputs.length === 0) return { flows: [], limitations: [] };
+  const CONTAINER_KEYS = /* @__PURE__ */ new Set([...REQ_SOURCES, "data", "input", "payload"]);
+  const rootPath = /* @__PURE__ */ new Map();
+  const addRoot = (name, path11, space) => {
+    if (!rootPath.has(name)) rootPath.set(name, { path: path11, space });
+  };
+  for (const p of params ?? []) {
+    if (!p?.name) continue;
+    if (ts.isIdentifier(p.name)) addRoot(p.name.text, "");
+    else if (ts.isObjectBindingPattern(p.name)) {
+      for (const el of p.name.elements) {
+        if (!ts.isBindingElement(el) || !ts.isIdentifier(el.name)) continue;
+        const key = bindingKey(el, ts);
+        const container = key !== void 0 && CONTAINER_KEYS.has(key);
+        addRoot(el.name.text, container ? "" : key ?? el.name.text, container ? spaceOfKey(key) : void 0);
+      }
+    }
+  }
+  const requestReadPath = (init) => {
+    let cur = init;
+    while (cur && (ts.isAwaitExpression(cur) || ts.isParenthesizedExpression(cur) || ts.isAsExpression(cur) || ts.isNonNullExpression(cur))) cur = cur.expression;
+    if (!cur) return void 0;
+    if (ts.isCallExpression(cur) && ts.isPropertyAccessExpression(cur.expression)) {
+      const m = cur.expression.name.text;
+      if (["json", "formData", "text"].includes(m)) {
+        const root = rootIdentifier(cur.expression.expression, ts);
+        return root && rootPath.has(root) ? { path: "", space: "post" } : void 0;
+      }
+      if (["parse", "safeParse", "validate", "cast"].includes(m)) {
+        for (const a of cur.arguments) {
+          const inner = requestReadPath(a);
+          if (inner !== void 0) return inner;
+        }
+        return void 0;
+      }
+    }
+    const p = pathFromTainted(cur, ts, rootPath);
+    return p;
+  };
+  const aliasVisit = (n) => {
+    if (ts.isVariableDeclaration(n) && n.initializer) {
+      const base = requestReadPath(n.initializer);
+      if (base !== void 0) {
+        if (ts.isIdentifier(n.name)) addRoot(n.name.text, base.path, base.space);
+        else if (ts.isObjectBindingPattern(n.name)) {
+          for (const el of n.name.elements) {
+            if (!ts.isBindingElement(el) || !ts.isIdentifier(el.name)) continue;
+            const key = bindingKey(el, ts);
+            const space = base.space ?? (base.path === "" ? spaceOfKey(key) : void 0);
+            const container = base.path === "" && key !== void 0 && CONTAINER_KEYS.has(key);
+            addRoot(el.name.text, container ? "" : join22(base.path, key ?? el.name.text), space);
+          }
+        }
+      }
+    }
+    ts.forEachChild(n, aliasVisit);
+  };
+  aliasVisit(bodyNode);
+  const callBySpan = /* @__PURE__ */ new Map();
+  const callVisit = (n) => {
+    if (ts.isCallExpression(n) || ts.isNewExpression(n)) {
+      try {
+        callBySpan.set(`${n.getStart()}:${n.getEnd()}`, n);
+      } catch {
+      }
+    }
+    ts.forEachChild(n, callVisit);
+  };
+  callVisit(bodyNode);
+  const flows = [];
+  const allLimits = [];
+  for (const sink of sinks) {
+    const node = sink.file === void 0 && sink.start !== void 0 && sink.end !== void 0 ? callBySpan.get(`${sink.start}:${sink.end}`) : void 0;
+    const reads = /* @__PURE__ */ new Map();
+    const sinkLimits = [];
+    if (node) {
+      for (const call of fluentChainCalls(node, ts)) {
+        const method = calleeName(call, ts);
+        const args = call.arguments ?? [];
+        for (const a of args) for (const l of sinkArgumentLimitations(a, ts, rootPath)) sinkLimits.push(l);
+        for (let i = 0; i < args.length; i++) {
+          const role = argumentRoleOf(sink.kind, method, i, args.length);
+          const whole = pathFromTainted(args[i], ts, rootPath);
+          for (const read2 of taintedReadPaths(args[i], ts, rootPath)) {
+            const key = `${read2.space ?? "*"}:${read2.path}`;
+            const exact = whole !== void 0 && whole.path === read2.path && whole.space === read2.space;
+            const entry = reads.get(key) ?? { read: read2, roles: /* @__PURE__ */ new Set(), exact: false };
+            entry.roles.add(role);
+            entry.exact = entry.exact || exact;
+            reads.set(key, entry);
+          }
+        }
+      }
+    }
+    for (const input of inputs) {
+      const inputPath = normalizePath(input.name);
+      const inputSpace = addressSpaceOf(input.source);
+      const matched = [...reads.values()].filter(({ read: read2 }) => (read2.space === void 0 || read2.space === inputSpace) && (read2.path === inputPath || read2.path.startsWith(inputPath + ".")));
+      const proven = matched.length > 0;
+      const confidence = proven ? matched.some((m) => m.exact) ? "exact-local" : "transformed-local" : sink.file !== void 0 ? "imported" : sink.start === void 0 ? "unknown" : "heuristic";
+      const roles = new Set(matched.flatMap(({ roles: rs }) => [...rs]));
+      const family = sink.apiUnconfirmed ? void 0 : [...roles].map((r) => CANDIDATE_FAMILIES[sink.kind]?.[r]).find(Boolean);
+      const argumentRole = family ? [...roles].find((r) => CANDIDATE_FAMILIES[sink.kind]?.[r]) : [...roles].find((r) => r !== "unknown") ?? (proven ? "unknown" : void 0);
+      const reasons = [];
+      if (!proven) reasons.push(`flow evidence is "${confidence}": no proven local read of this input into the sink call`);
+      if (!input.runtimeParameter) reasons.push(input.runtimeParameterReason ?? "input has no runtime parameter");
+      if (sink.file !== void 0) reasons.push("sink is in an imported module: no local call-site evidence");
+      if (sink.start === void 0) reasons.push("sink call could not be located in the source");
+      if (sink.apiUnconfirmed) {
+        reasons.push(`sink package "${sink.package}" is not a known ${sink.kind} provider: it does not establish a ${sink.kind} API (method name alone is not evidence)`);
+      }
+      if (sink.attribution !== "import" && sink.attribution !== "global") {
+        reasons.push(sink.attribution === "inferred" ? `sink package "${sink.package}" was inferred from the file's other imports, not from the receiver (${sink.kind}.${sink.op ?? "?"}): the receiver may be any app object` : `sink receiver could not be traced to a dependency (${sink.kind}.${sink.op ?? "?"} on an unresolved receiver): a rule here would be a guess`);
+      }
+      if (proven && argumentRole === "unknown") reasons.push(`sink argument role is not modelled for ${sink.kind}.${sink.op ?? "?"}`);
+      for (const l of sinkLimits) {
+        reasons.push(l.kind === "dynamic-key" ? `dynamic computed key reaches this sink (${l.detail}): the field cannot be named by a parameter` : `spread reaches this sink (${l.detail}): the specific field is not identifiable`);
+      }
+      if (proven && argumentRole && argumentRole !== "unknown" && !family && !sink.apiUnconfirmed) {
+        reasons.push(`argument role "${argumentRole}" on a ${sink.kind} sink is not a blockable pattern on its own`);
+      }
+      flows.push({
+        input: input.name,
+        inputId: input.id,
+        sink,
+        confidence,
+        line: sink.line,
+        ...argumentRole ? { argumentRole } : {},
+        ...family ? { candidateFamily: family } : {},
+        ruleGeneratable: reasons.length === 0,
+        ruleGeneratableReasons: reasons
+      });
+    }
+    for (const l of sinkLimits) allLimits.push(l);
+  }
+  return { flows, limitations: dedupeLimitations(allLimits) };
+}
+function dedupeLimitations(list) {
+  const seen = /* @__PURE__ */ new Set();
+  return list.filter((l) => {
+    const k = `${l.kind}:${l.detail}:${l.line}`;
+    if (seen.has(k)) return false;
+    seen.add(k);
+    return true;
+  });
+}
+function join22(base, seg) {
+  return base ? `${base}.${seg}` : seg;
+}
+function normalizePath(path11) {
+  return path11.replace(/\[\d*\]/g, "").split(".").filter(Boolean).join(".");
+}
+function fluentChainCalls(call, ts) {
+  let root = call;
+  for (; ; ) {
+    const p = root.parent;
+    if (p && ts.isPropertyAccessExpression(p) && p.expression === root) {
+      root = p;
+      continue;
+    }
+    if (p && ts.isCallExpression(p) && p.expression === root) {
+      root = p;
+      continue;
+    }
+    if (p && (ts.isAwaitExpression(p) || ts.isParenthesizedExpression(p) || ts.isNonNullExpression(p)) && p.expression === root) {
+      root = p;
+      continue;
+    }
+    break;
+  }
+  const out = [];
+  const collect = (n) => {
+    if (!n) return;
+    if (ts.isCallExpression(n) || ts.isNewExpression(n)) out.push(n);
+    if (ts.isCallExpression(n) || ts.isPropertyAccessExpression(n) || ts.isAwaitExpression(n) || ts.isParenthesizedExpression(n) || ts.isNonNullExpression(n)) {
+      collect(n.expression);
+    }
+  };
+  collect(root);
+  return out;
+}
+function taintedReadPaths(node, ts, rootPath) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  const add = (r) => {
+    const key = `${r.space ?? "*"}:${r.path}`;
+    if (!seen.has(key)) {
+      seen.add(key);
+      out.push(r);
+    }
+  };
+  const visit = (n) => {
+    if (!n) return;
+    if (ts.isPropertyAccessExpression(n) || ts.isElementAccessExpression(n)) {
+      const read2 = pathFromTainted(n, ts, rootPath);
+      if (read2 !== void 0) {
+        add(read2);
+        return;
+      }
+    }
+    if (ts.isIdentifier(n) && rootPath.has(n.text) && isValueRead(n, ts)) {
+      const r = rootPath.get(n.text);
+      if (r.path) add({ path: normalizePath(r.path), space: r.space });
+    }
+    ts.forEachChild(n, visit);
+  };
+  visit(node);
+  return out;
+}
+function sinkArgumentLimitations(node, ts, rootPath) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  const add = (kind, detail, n) => {
+    const key = `${kind}:${detail}`;
+    if (seen.has(key)) return;
+    seen.add(key);
+    out.push({ kind, detail, line: lineOf(n) });
+  };
+  const text = (n) => {
+    try {
+      return String(n.getText()).replace(/\s+/g, " ").slice(0, 120);
+    } catch {
+      return "<expression>";
+    }
+  };
+  const visit = (n) => {
+    if (!n) return;
+    if (ts.isElementAccessExpression(n)) {
+      const root = rootIdentifier(n.expression, ts);
+      const arg = n.argumentExpression;
+      if (root && rootPath.has(root) && arg && !ts.isStringLiteralLike(arg) && !ts.isNumericLiteral(arg)) {
+        add("dynamic-key", text(n), n);
+      }
+    }
+    if ((ts.isSpreadAssignment?.(n) || ts.isSpreadElement(n)) && n.expression) {
+      const root = rootIdentifier(n.expression, ts);
+      if (root && rootPath.has(root)) add("spread-into-sink", text(n.parent ?? n), n);
+    }
+    ts.forEachChild(n, visit);
+  };
+  visit(node);
+  return out;
+}
+function pathFromTainted(node, ts, rootPath) {
+  const segs = [];
+  let cur = node;
+  for (; ; ) {
+    if (ts.isPropertyAccessExpression(cur)) {
+      segs.unshift(cur.name.text);
+      cur = cur.expression;
+      continue;
+    }
+    if (ts.isElementAccessExpression(cur)) {
+      const a = cur.argumentExpression;
+      segs.unshift(a && ts.isStringLiteralLike(a) ? a.text : "[]");
+      cur = cur.expression;
+      continue;
+    }
+    if (ts.isNonNullExpression(cur) || ts.isParenthesizedExpression(cur) || ts.isAwaitExpression(cur)) {
+      cur = cur.expression;
+      continue;
+    }
+    break;
+  }
+  if (!cur || !ts.isIdentifier(cur)) return void 0;
+  const base = rootPath.get(cur.text);
+  if (base === void 0) return void 0;
+  let space = base.space;
+  if (base.path === "" && segs.length > 1 && REQ_SOURCES.includes(segs[0])) {
+    space = spaceOfKey(segs[0]) ?? space;
+    segs.shift();
+  }
+  return { path: normalizePath([base.path, ...segs].filter(Boolean).join(".")), space };
+}
+
+// src/map/entries.ts
+var HTTP_METHODS = /* @__PURE__ */ new Set(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"]);
+function extractFromFile(sf, ts, localSinks, bindings, ctx) {
+  const out = [];
+  const isServerActionsFile = fileHasUseServer(sf, ts);
+  const visit = (node) => {
+    if (ts.isVariableStatement(node) && hasExport(node, ts)) {
+      for (const decl of node.declarationList.declarations) {
+        if (decl.initializer && ts.isCallExpression(decl.initializer)) {
+          const chain = unwindChain(decl.initializer, ts);
+          if (chain.baseName === "createServerFn" && ts.isIdentifier(decl.name)) {
+            const validatorCall = chain.calls["inputValidator"] ?? chain.calls["validator"];
+            const inputs = withCoordinates(inputsFromValidator(validatorCall, ts, bindings), "server-fn-data");
+            const handlerFn = chain.calls["handler"]?.arguments?.[0];
+            const sinks = sinksFrom(handlerFn, ts, localSinks, bindings, ctx);
+            const handlerBody = handlerFn && isFnLike(handlerFn, ts) ? handlerFn.body : void 0;
+            const ep = {
+              name: decl.name.text,
+              entryKind: "server-fn",
+              method: methodFromObjectArg(chain.baseCall, ts),
+              ...spanOf(decl),
+              inputs,
+              sinks,
+              ...linkedFlows(handlerBody, handlerFn?.parameters, inputs, sinks, ts)
+            };
+            if (validatorCall && inputs.length === 0) ep.inputsResolved = false;
+            out.push(ep);
+            continue;
+          }
+        }
+        if (ts.isIdentifier(decl.name) && decl.initializer && isFnLike(decl.initializer, ts)) {
+          if (HTTP_METHODS.has(decl.name.text)) {
+            out.push(handlerEntry(decl.name.text, decl.name.text, decl.initializer.parameters, decl.initializer.body, ts, localSinks, bindings, ctx, spanOf(decl)));
+          } else if (isServerActionsFile) {
+            out.push(handlerEntry(decl.name.text, "server-action", decl.initializer.parameters, decl.initializer.body, ts, localSinks, bindings, ctx, spanOf(decl)));
+          }
+        }
+      }
+    }
+    if (ts.isFunctionDeclaration(node) && node.name && hasExport(node, ts)) {
+      if (HTTP_METHODS.has(node.name.text)) {
+        out.push(handlerEntry(node.name.text, node.name.text, node.parameters, node.body, ts, localSinks, bindings, ctx, spanOf(node)));
+      } else if (isServerActionsFile || hasUseServerDirective(node, ts)) {
+        out.push(handlerEntry(node.name.text, "server-action", node.parameters, node.body, ts, localSinks, bindings, ctx, spanOf(node)));
+      }
+    }
+    if (ts.isCallExpression(node)) {
+      const c = node.expression;
+      const denoServe = ts.isPropertyAccessExpression(c) && c.name.text === "serve" && ts.isIdentifier(c.expression) && c.expression.text === "Deno";
+      const bareServe = ts.isIdentifier(c) && c.text === "serve";
+      if (denoServe || bareServe) {
+        const handler = node.arguments.find((a) => isFnLike(a, ts));
+        if (handler) {
+          out.push(handlerEntry(functionNameFromPath(ctx.file) ?? "serve", "edge-function", handler.parameters, handler.body, ts, localSinks, bindings, ctx, spanOf(node)));
+        }
+      }
+    }
+    if (ts.isCallExpression(node) && ts.isPropertyAccessExpression(node.expression)) {
+      const mname = node.expression.name.text;
+      if (ROUTE_REGISTER.has(mname)) {
+        const args = node.arguments;
+        const first = args[0];
+        const route = first && ts.isStringLiteralLike(first) ? first.text : routeFromChain(node.expression.expression, ts);
+        const handler = args[args.length - 1];
+        if (route !== void 0 && handler && isFnLike(handler, ts)) {
+          out.push(handlerEntry(route, "route-registration", handler.parameters, handler.body, ts, localSinks, bindings, ctx, {
+            // `use`/`all` register handlers but are not HTTP methods — leave method undefined.
+            method: HTTP_METHODS.has(mname.toUpperCase()) ? mname.toUpperCase() : void 0,
+            route,
+            ...spanOf(node)
+          }));
+        }
+      }
+      if (mname === "route") {
+        const arg = node.arguments[0];
+        if (arg && ts.isObjectLiteralExpression(arg)) {
+          const reg = routeObject(arg, ts);
+          if (reg.url && reg.handler) {
+            for (const m of reg.methods.length ? reg.methods : [void 0]) {
+              out.push(handlerEntry(reg.url, "route-registration", reg.handler.parameters, reg.handler.body, ts, localSinks, bindings, ctx, { method: m, route: reg.url, ...spanOf(node) }));
+            }
+          }
+        }
+      }
+    }
+    ts.forEachChild(node, visit);
+  };
+  visit(sf);
+  return out;
+}
+function fileHasUseServer(sf, ts) {
+  const first = sf.statements?.[0];
+  return Boolean(first && ts.isExpressionStatement(first) && ts.isStringLiteralLike(first.expression) && first.expression.text === "use server");
+}
+function hasUseServerDirective(fn, ts) {
+  const first = fn.body?.statements?.[0];
+  return Boolean(first && ts.isExpressionStatement(first) && ts.isStringLiteralLike(first.expression) && first.expression.text === "use server");
+}
+function handlerEntry(name, kindLabel, params, body, ts, localSinks, bindings, ctx, extra = {}) {
+  const entryKind = kindLabel === "route-registration" || kindLabel === "server-action" || kindLabel === "edge-function" ? kindLabel : "route-handler";
+  const payloadStyle = kindLabel === "server-action";
+  const inputs = inputsFromHandler(params, body, ts, bindings, {
+    payloadParam: payloadStyle,
+    validatorSource: payloadStyle ? "server-fn-data" : "json-body"
+  });
+  const sinks = sinksFrom({ body, parameters: params, isSyntheticBody: true }, ts, localSinks, bindings, ctx);
+  return {
+    name,
+    entryKind,
+    method: extra.method ?? (HTTP_METHODS.has(name) ? name : void 0),
+    route: extra.route,
+    line: extra.line,
+    start: extra.start,
+    end: extra.end,
+    inputs,
+    sinks,
+    ...linkedFlows(body, params, inputs, sinks, ts)
+  };
+}
+
+// src/map/imports.ts
+import { readFileSync as readFileSync9 } from "fs";
+import { join as join15 } from "path";
+var MAX_SITES = 5;
+var NPM_NAME = /^(?:@[^/@\s~][^/@\s]*\/)?[^/@\s.~][^/@\s]*$/;
+function isNpmPackageName(pkg) {
+  return pkg.startsWith("node:") || NPM_NAME.test(pkg);
+}
+function readPathAliases(cwd) {
+  const aliases = [];
+  for (const name of ["tsconfig.json", "jsconfig.json"]) {
+    let paths;
+    try {
+      const raw = readFileSync9(join15(cwd, name), "utf8");
+      const parsed = JSON.parse(stripJsonComments(raw));
+      paths = parsed.compilerOptions?.paths;
+    } catch {
+      continue;
+    }
+    for (const key of Object.keys(paths ?? {})) {
+      if (key.startsWith(".")) continue;
+      if (key.endsWith("*")) aliases.push({ prefix: key.slice(0, -1), wildcard: true });
+      else aliases.push({ prefix: key, wildcard: false });
+    }
+  }
+  return aliases;
+}
+function stripJsonComments(text) {
+  let out = "";
+  let inString = false;
+  let quote = "";
+  for (let i = 0; i < text.length; i++) {
+    const c = text[i];
+    const next = text[i + 1];
+    if (inString) {
+      out += c;
+      if (c === "\\") {
+        out += next ?? "";
+        i++;
+        continue;
+      }
+      if (c === quote) inString = false;
+      continue;
+    }
+    if (c === '"' || c === "'") {
+      inString = true;
+      quote = c;
+      out += c;
+      continue;
+    }
+    if (c === "/" && next === "/") {
+      while (i < text.length && text[i] !== "\n") i++;
+      out += "\n";
+      continue;
+    }
+    if (c === "/" && next === "*") {
+      i += 2;
+      while (i < text.length && !(text[i] === "*" && text[i + 1] === "/")) i++;
+      i++;
+      continue;
+    }
+    out += c;
+  }
+  return out.replace(/,(\s*[}\]])/g, "$1");
+}
+function collectFileImports(sf, ts) {
+  const found = [];
+  const lineOf2 = (node) => {
+    try {
+      return sf.getLineAndCharacterOfPosition(node.getStart(sf)).line + 1;
+    } catch {
+      return void 0;
+    }
+  };
+  const visit = (node) => {
+    if (ts.isImportDeclaration(node) && ts.isStringLiteralLike(node.moduleSpecifier)) {
+      const names = [];
+      const clause = node.importClause;
+      if (clause?.name) names.push("default");
+      const nb = clause?.namedBindings;
+      if (nb) {
+        if (ts.isNamespaceImport(nb)) names.push("*");
+        else if (ts.isNamedImports(nb)) {
+          for (const el of nb.elements) names.push((el.propertyName ?? el.name).text);
+        }
+      }
+      found.push({ specifier: node.moduleSpecifier.text, names, line: lineOf2(node) });
+    }
+    if (ts.isExportDeclaration(node) && node.moduleSpecifier && ts.isStringLiteralLike(node.moduleSpecifier)) {
+      const names = [];
+      const ec = node.exportClause;
+      if (ec && ts.isNamedExports(ec)) for (const el of ec.elements) names.push((el.propertyName ?? el.name).text);
+      else if (ec && ts.isNamespaceExport(ec)) names.push("*");
+      else names.push("*");
+      found.push({ specifier: node.moduleSpecifier.text, names, line: lineOf2(node) });
+    }
+    if (ts.isCallExpression(node)) {
+      const arg = node.arguments[0];
+      const isRequire = ts.isIdentifier(node.expression) && node.expression.text === "require";
+      const isDynamic = node.expression.kind === ts.SyntaxKind.ImportKeyword;
+      if ((isRequire || isDynamic) && arg && ts.isStringLiteralLike(arg)) {
+        found.push({ specifier: arg.text, names: [isRequire ? "require" : "import()"], line: lineOf2(node) });
+      }
+    }
+    ts.forEachChild(node, visit);
+  };
+  visit(sf);
+  return found;
+}
+function scanFileImports(text, ts) {
+  let refs;
+  try {
+    const pre = ts.preProcessFile(
+      text,
+      /* readImportFiles */
+      true,
+      /* detectJavaScriptImports */
+      true
+    );
+    refs = pre.importedFiles ?? [];
+  } catch {
+    return null;
+  }
+  if (refs.length === 0) return [];
+  const lineStarts = lineStartOffsets(text);
+  return refs.map((r) => ({ specifier: r.fileName, names: [], line: lineAt(lineStarts, r.pos) }));
+}
+function countUnresolvableImports(text, ts) {
+  let scanner;
+  try {
+    scanner = ts.createScanner(
+      ts.ScriptTarget.Latest,
+      /* skipTrivia */
+      true,
+      void 0,
+      text
+    );
+  } catch {
+    return 0;
+  }
+  const CALLEE_KINDS = new Set([
+    ts.SyntaxKind.Identifier,
+    ts.SyntaxKind.RequireKeyword,
+    ts.SyntaxKind.ImportKeyword
+  ].filter((k) => k !== void 0));
+  const DOT_KINDS = new Set([ts.SyntaxKind.DotToken, ts.SyntaxKind.QuestionDotToken].filter((k) => k !== void 0));
+  const EMPTY = { kind: void 0, text: "" };
+  const history = [EMPTY, EMPTY, EMPTY];
+  const remember = (kind, text2) => {
+    history[2] = history[1];
+    history[1] = history[0];
+    history[0] = { kind, text: text2 };
+  };
+  const escapedLoaderReference = (next) => {
+    const callee = history[0];
+    const qualifier = history[1];
+    if (callee.kind === void 0 || !CALLEE_KINDS.has(callee.kind) || callee.text !== "require") return false;
+    if (qualifier.kind !== void 0 && DOT_KINDS.has(qualifier.kind)) return false;
+    return next !== ts.SyntaxKind.OpenParenToken && next !== ts.SyntaxKind.QuestionDotToken && next !== ts.SyntaxKind.DotToken;
+  };
+  let count = 0;
+  try {
+    for (let token = scanner.scan(); token !== ts.SyntaxKind.EndOfFileToken; token = scanner.scan()) {
+      const text2 = scanner.getTokenText();
+      if (escapedLoaderReference(token)) count++;
+      if (token !== ts.SyntaxKind.OpenParenToken) {
+        remember(token, text2);
+        continue;
+      }
+      const optionalCall = history[0].kind === ts.SyntaxKind.QuestionDotToken;
+      const callee = optionalCall ? history[1] : history[0];
+      const qualifier = optionalCall ? history[2] : history[1];
+      const isRequireCall = callee.kind !== void 0 && CALLEE_KINDS.has(callee.kind) && (callee.text === "require" || callee.text === "import") && !(qualifier.kind !== void 0 && DOT_KINDS.has(qualifier.kind));
+      if (!isRequireCall) {
+        remember(token, text2);
+        continue;
+      }
+      remember(token, text2);
+      const argument = scanner.scan();
+      const argumentText = scanner.getTokenText();
+      remember(argument, argumentText);
+      const isLiteral = argument === ts.SyntaxKind.StringLiteral || argument === ts.SyntaxKind.NoSubstitutionTemplateLiteral;
+      if (!isLiteral) {
+        count++;
+        continue;
+      }
+      const following = scanner.scan();
+      remember(following, scanner.getTokenText());
+      const argumentEnded = following === ts.SyntaxKind.CloseParenToken || following === ts.SyntaxKind.CommaToken;
+      if (!argumentEnded) count++;
+    }
+    if (escapedLoaderReference(ts.SyntaxKind.EndOfFileToken)) count++;
+  } catch {
+    return count;
+  }
+  return count;
+}
+function createImportInventory(aliases = []) {
+  const byPackage = /* @__PURE__ */ new Map();
+  return {
+    /** @param parsed whether these edges came from a full parse (names are trustworthy) or the scan. */
+    add(relFile, edges, parsed) {
+      for (const edge of edges) {
+        const aliased = aliases.some((a) => a.wildcard ? edge.specifier.startsWith(a.prefix) : edge.specifier === a.prefix);
+        if (aliased) continue;
+        const pkg = npmPackageOf(edge.specifier);
+        if (!pkg) continue;
+        if (!isNpmPackageName(pkg)) continue;
+        let acc = byPackage.get(pkg);
+        if (!acc) {
+          acc = { specifiers: /* @__PURE__ */ new Set(), names: /* @__PURE__ */ new Set(), namesComplete: true, sites: [], siteCount: 0 };
+          byPackage.set(pkg, acc);
+        }
+        acc.specifiers.add(edge.specifier);
+        for (const n of edge.names) acc.names.add(n);
+        if (!parsed) acc.namesComplete = false;
+        acc.siteCount++;
+        if (acc.sites.length < MAX_SITES) acc.sites.push({ file: relFile, line: edge.line });
+      }
+    },
+    list() {
+      return [...byPackage.entries()].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([pkg, acc]) => {
+        const names = [...acc.names].sort();
+        const entry = {
+          package: pkg,
+          specifiers: [...acc.specifiers].sort(),
+          namesComplete: acc.namesComplete,
+          sites: acc.sites,
+          siteCount: acc.siteCount,
+          recognizedSinkKinds: recognizedSinkKinds(pkg)
+        };
+        if (names.length > 0) entry.names = names;
+        return entry;
+      });
+    }
+  };
+}
+function lineStartOffsets(text) {
+  const starts = [0];
+  for (let i = 0; i < text.length; i++) if (text.charCodeAt(i) === 10) starts.push(i + 1);
+  return starts;
+}
+function lineAt(starts, pos) {
+  let lo = 0;
+  let hi = starts.length - 1;
+  while (lo < hi) {
+    const mid = lo + hi + 1 >> 1;
+    if ((starts[mid] ?? 0) <= pos) lo = mid;
+    else hi = mid - 1;
+  }
+  return lo + 1;
+}
+
+// src/map/invocations.ts
+var MAX_SITES2 = 3;
+function collectInvocations(sf, ts, bindings, ctx) {
+  const found = [];
+  const counts = { total: 0, dependency: 0, local: 0, ambiguous: 0 };
+  const isLocalName = (name, node) => bindings.locals.has(name) || isShadowedByEnclosingBinding(node, name, ts);
+  const lineOf2 = (node) => {
+    try {
+      return sf.getLineAndCharacterOfPosition(node.getStart(sf)).line + 1;
+    } catch {
+      return void 0;
+    }
+  };
+  const traceRoot = (root) => {
+    const specifier = bindings.resolve(root);
+    if (specifier === void 0) return null;
+    const direct = npmPackageOf(specifier);
+    if (direct !== void 0) {
+      const resolution = bindings.originOf(root) ?? "direct";
+      return { pkg: direct, specifier, resolution, named: resolution === "direct" };
+    }
+    const exportName = bindings.exportNameOf(root) ?? root;
+    const viaModule = ctx.graph.importedBinding(ctx.file, specifier, exportName);
+    if (viaModule !== void 0) {
+      return {
+        pkg: viaModule.package,
+        specifier,
+        resolution: "reexport",
+        named: viaModule.origin === "direct",
+        apiName: viaModule.name
+      };
+    }
+    return null;
+  };
+  const push = (traced, api, receiver, kind, node) => {
+    const span = spanOf(node);
+    found.push({
+      package: traced.pkg,
+      specifiers: [traced.specifier],
+      api,
+      ...receiver !== void 0 ? { receiver } : {},
+      symbol: receiver !== void 0 ? `${receiver}.${api}` : api,
+      kind,
+      // Only ever `import`: a global has no package to correlate against, and an inferred package is not
+      // evidence about the value being called.
+      attribution: "import",
+      resolution: traced.resolution,
+      callCount: 1,
+      sites: [{ file: ctx.owner, line: lineOf2(node), start: span.start, end: span.end }]
+    });
+  };
+  const visit = (node) => {
+    if (ts.isCallExpression(node) || ts.isNewExpression(node)) {
+      const callee = node.expression;
+      counts.total++;
+      if (ts.isIdentifier(callee)) {
+        const traced = traceRoot(callee.text);
+        if (traced?.named) {
+          const api = traced.apiName ?? bindings.exportNameOf(callee.text) ?? callee.text;
+          push(traced, api, void 0, ts.isNewExpression(node) ? "construct" : "call", node);
+          counts.dependency++;
+        } else if (traced) {
+          counts.ambiguous++;
+        } else if (isLocalName(callee.text, node)) {
+          counts.local++;
+        } else {
+          counts.ambiguous++;
+        }
+      } else if (ts.isPropertyAccessExpression(callee) && ts.isIdentifier(callee.name)) {
+        const root = rootIdentifier(callee.expression, ts);
+        const traced = root !== void 0 ? traceRoot(root) : null;
+        if (traced && root !== void 0) {
+          counts.dependency++;
+          const receiver = traced.resolution === "direct" && bindings.isPackageMember(root) ? bindings.exportNameOf(root) ?? root : void 0;
+          push(traced, callee.name.text, receiver, "member", node);
+        } else if (root !== void 0 && ts.isIdentifier(callee.expression) && isLocalName(root, node)) {
+          counts.local++;
+        } else {
+          counts.ambiguous++;
+        }
+      } else {
+        counts.ambiguous++;
+      }
+    }
+    ts.forEachChild(node, visit);
+  };
+  visit(sf);
+  return { invocations: found, counts };
+}
+function createInvocationInventory() {
+  const byKey = /* @__PURE__ */ new Map();
+  return {
+    add(invocations) {
+      for (const invocation of invocations) {
+        const key = `${invocation.package}|${invocation.symbol}|${invocation.kind}|${invocation.resolution}`;
+        const existing = byKey.get(key);
+        if (existing === void 0) {
+          byKey.set(key, { ...invocation });
+          continue;
+        }
+        existing.callCount += invocation.callCount;
+        for (const specifier of invocation.specifiers) {
+          if (!existing.specifiers.includes(specifier)) existing.specifiers.push(specifier);
+        }
+        if (existing.sites.length < MAX_SITES2) existing.sites.push(...invocation.sites.slice(0, MAX_SITES2 - existing.sites.length));
+      }
+    },
+    list() {
+      return [...byKey.entries()].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([, invocation]) => ({ ...invocation, specifiers: [...invocation.specifiers].sort() }));
+    }
+  };
+}
+
+// src/map/extract.ts
+async function extractInputMap(cwd, ts, options = {}) {
+  const notes = [];
+  const endpoints = [];
+  const failed = [];
+  let boundary = cwd;
+  try {
+    boundary = realpathSync3(cwd);
+  } catch {
+  }
+  const graph = createModuleGraph(ts, { cwd, boundary, followOutside: options.followSymlinks });
+  const stats = { discovered: 0, unwalked: 0 };
+  const files = collectSources(cwd, boundary, { followOutside: options.followSymlinks }, [], /* @__PURE__ */ new Set(), stats);
+  const imports = createImportInventory(readPathAliases(cwd));
+  const invocations = createInvocationInventory();
+  let parsed = 0;
+  let preFiltered = 0;
+  let importScanFailures = 0;
+  let unresolvableImports = 0;
+  let sourceBytes = 0;
+  const calls = { total: 0, dependency: 0, local: 0, ambiguous: 0 };
+  const startedAt = Date.now();
+  const entryFiles = /* @__PURE__ */ new Set();
+  const hopTargets = /* @__PURE__ */ new Set();
+  for (const file of files) {
+    try {
+      const text = readFileSync10(file, "utf8");
+      const relFile = relative4(cwd, file);
+      sourceBytes += text.length;
+      if (!hasEntrySignal(text)) {
+        preFiltered++;
+        const scanned = scanFileImports(text, ts);
+        if (scanned === null) importScanFailures++;
+        else imports.add(relFile, scanned, false);
+        unresolvableImports += countUnresolvableImports(text, ts);
+        continue;
+      }
+      parsed++;
+      entryFiles.add(file);
+      const fingerprint = createHash3("sha256").update(text).digest("hex").slice(0, 16);
+      const sf = ts.createSourceFile(file, text, ts.ScriptTarget.Latest, true, guessScriptKind(ts, file));
+      const bindings = buildModuleBindings(sf, ts);
+      for (const specifier of bindings.imports) {
+        if (!specifier.startsWith(".")) continue;
+        const target = graph.resolveLocal(file, specifier);
+        if (target !== void 0) hopTargets.add(target);
+      }
+      imports.add(relFile, collectFileImports(sf, ts), true);
+      unresolvableImports += countUnresolvableImports(text, ts);
+      const ctx = { file, owner: relFile, graph };
+      const called = collectInvocations(sf, ts, bindings, ctx);
+      invocations.add(called.invocations);
+      calls.total += called.counts.total;
+      calls.dependency += called.counts.dependency;
+      calls.local += called.counts.local;
+      calls.ambiguous += called.counts.ambiguous;
+      const localSinks = collectLocalSinks(sf, ts, bindings, ctx);
+      for (const ep of extractFromFile(sf, ts, localSinks, bindings, ctx)) {
+        if (ep.route === void 0 && ep.entryKind === "edge-function") {
+          const fn = functionNameFromPath(relFile);
+          if (fn) ep.route = "/" + fn;
+        }
+        if (ep.route === void 0 && (ep.entryKind === "route-handler" || ep.entryKind === "server-action")) {
+          const derived = routeFromFilePath(relFile);
+          if (derived.route) {
+            ep.route = derived.route;
+            if (derived.dynamic) ep.routeDynamic = true;
+          }
+        }
+        endpoints.push({ ...ep, file: relFile, fingerprint });
+      }
+    } catch (e) {
+      if (typeof process !== "undefined" && process.env?.PS_MAP_DEBUG) console.error("[patchstack] map error", file, e);
+      failed.push(relative4(cwd, file));
+    }
+  }
+  let hopParsed = 0;
+  let hopFailures = 0;
+  for (const target of hopTargets) {
+    if (entryFiles.has(target)) continue;
+    try {
+      const text = readFileSync10(target, "utf8");
+      const sf = ts.createSourceFile(target, text, ts.ScriptTarget.Latest, true, guessScriptKind(ts, target));
+      const bindings = buildModuleBindings(sf, ts);
+      const called = collectInvocations(sf, ts, bindings, { file: target, owner: relative4(cwd, target), graph });
+      invocations.add(called.invocations);
+      calls.total += called.counts.total;
+      calls.dependency += called.counts.dependency;
+      calls.local += called.counts.local;
+      calls.ambiguous += called.counts.ambiguous;
+      hopParsed++;
+    } catch (e) {
+      if (typeof process !== "undefined" && process.env?.PS_MAP_DEBUG) console.error("[patchstack] map hop error", target, e);
+      hopFailures++;
+    }
+  }
+  notes.push("Static analysis is best-effort \u2014 this is the DETECTED surface, not a proof of completeness.");
+  notes.push('`inputs` and `sinks` are INVENTORIES (both present in the handler). Only `flows` asserts that an input reaches a sink: require confidence "exact-local" or "transformed-local" before pinning a rule, and identify the input by `inputId` \u2014 a field NAME can occur in more than one request namespace.');
+  notes.push("Sinks are followed into same-file helpers and ONE hop into an imported relative module (a dependency\u2019s internals are not followed); deeper or dynamic indirection is not traced. Sinks inside declared-but-uncalled local functions are excluded.");
+  notes.push('A sink `package` is resolved from the file\u2019s imports (`attribution: "import"`) or inferred from another import in the same file (`"inferred"`); an inferred package is a hint for a reviewer, not evidence about the receiver, and never licenses a rule.');
+  if (!options.followSymlinks) notes.push("Symlinks leaving the project directory were not followed (use --follow-symlinks to include them).");
+  if (failed.length > 0) {
+    const sample = failed.slice(0, 5).join(", ");
+    notes.push(`${failed.length} file(s) could not be analyzed and were skipped (fail-open): ${sample}${failed.length > 5 ? ", \u2026" : ""}.`);
+  }
+  const unresolved = endpoints.filter((e) => e.inputsResolved === false).length;
+  if (unresolved > 0) {
+    notes.push(`${unresolved} endpoint(s) declare an input validator that could not be statically parsed \u2014 their inputs are UNKNOWN, not empty (marked inputsResolved: false).`);
+  }
+  const heuristicOnly = endpoints.filter((e) => e.sinks.length > 0 && e.inputs.length > 0 && !e.flows.some((f) => isProvenFlow(f.confidence))).length;
+  if (heuristicOnly > 0) {
+    notes.push(`${heuristicOnly} endpoint(s) have inputs and sinks but no proven data link \u2014 their flows say "may reach", not "does reach" (see each flow's confidence).`);
+  }
+  if (endpoints.length === 0) notes.push("No recognized server-side entry points found under the analyzed roots.");
+  const importList = imports.list();
+  const unmodelled = importList.filter((d) => d.recognizedSinkKinds.length === 0).length;
+  const importCoverageGaps = {
+    unreadableFiles: failed.length,
+    unscannableFiles: importScanFailures,
+    unwalkedPaths: stats.unwalked,
+    unresolvableImports
+  };
+  const environmentalGaps = failed.length + importScanFailures + stats.unwalked;
+  const importsComplete = environmentalGaps === 0 && unresolvableImports === 0;
+  notes.push("`imports` lists every package the app imports, from ALL source files \u2014 not only files holding an entry point. Absence of a SINK for a package is never evidence; absence of the PACKAGE is evidence only when coverage.importsComplete is true.");
+  notes.push(`${unmodelled} of ${importList.length} imported package(s) have no recognized sink family (recognizedSinkKinds: []). The extractor models a small set of API families, so for those packages it cannot tell whether input reaches them: a vulnerability in one must stay "needs review" and can never be closed as unreachable using this map.`);
+  if (environmentalGaps > 0) {
+    notes.push(`The import inventory is INCOMPLETE: ${failed.length} file(s) could not be read, ${importScanFailures} could not be scanned, and ${stats.unwalked} path(s) could not be walked at all (unreadable directory, broken link, or a symlink leaving the project). A package may therefore be imported without appearing in \`imports\`. Do not read a package's absence as "not imported" while coverage.importsComplete is false.`);
+  }
+  if (unresolvableImports > 0) {
+    notes.push(`The import inventory is INCOMPLETE for a reason no re-run can fix: ${unresolvableImports} import(s) do not name a resolvable module \u2014 either the specifier is computed at runtime (\`require(REGISTRY[kind])\`) or the loader itself was aliased (\`const r = require\`), so which package is loaded is not knowable from the source. Those imports appear NOWHERE in \`imports\` \u2014 not as an unresolved entry, simply absent \u2014 so a package's absence is not evidence of it being unused. This is a property of the application's code, not a scan failure. Reported conservatively: an aliased loader counts even if every call through it uses a literal.`);
+  }
+  const invocationList = invocations.list();
+  if (invocationList.length > 0 || parsed > 0) {
+    notes.push(`\`apiInvocations\` records ${invocationList.length} dependency API call(s) resolved from ${parsed} entry file(s) plus ${hopParsed} local module(s) they import directly. POSITIVE EVIDENCE ONLY: a package missing from it may still have its API called \u2014 see coverage.apiInventoryLimitations.`);
+  }
+  if (hopFailures > 0) {
+    notes.push(`${hopFailures} local module(s) imported by an entry file could not be parsed, so any dependency call written in them is missing from \`apiInvocations\`.`);
+  }
+  let rssBytes;
+  let peakRssBytes;
+  try {
+    if (typeof process !== "undefined") {
+      if (typeof process.memoryUsage === "function") rssBytes = process.memoryUsage().rss;
+      if (typeof process.resourceUsage === "function") {
+        const maxRssKb = process.resourceUsage().maxRSS;
+        if (typeof maxRssKb === "number" && maxRssKb > 0) peakRssBytes = maxRssKb * 1024;
+      }
+    }
+  } catch {
+  }
+  const deploymentShapes = detectDeploymentShapes(cwd, { boundary, followOutside: options.followSymlinks });
+  notes.push(deploymentShapes.length === 0 ? "`deploymentShapes` is EMPTY: no deployment artifact was recognized. That is not evidence the app has no server-side runtime \u2014 a serverless handler this analysis cannot parse produces no endpoint and looks identical to an app that has none, and entry-point recognition has no completeness flag (coverage.importsComplete covers the import inventory only). A definitive answer needs deployment or build attestation, which source analysis cannot supply." : `\`deploymentShapes\` records ${deploymentShapes.length} deployment artifact(s) the project declares (${deploymentShapes.map((s) => s.shape).join(", ")}). POSITIVE EVIDENCE ONLY, and findings differ in strength: only \`runtime-entry\` (a worker entry, or a provider function directory with source) shows something that serves. \`deployment-config\` means the project deploys to a platform \u2014 a static site on Netlify has a \`netlify.toml\` \u2014 and \`layout\` (a root \`api/\` or \`functions/\` folder) is an ordinary application folder. Neither may on its own be read as a server runtime.`);
+  const serverSurface = classifyServerSurface(cwd, endpoints.length, deploymentShapes, ts);
+  notes.push(surfaceNote(serverSurface));
+  return {
+    version: 3,
+    framework: detectFramework(cwd),
+    deploymentShapes,
+    serverSurface,
+    endpoints,
+    imports: importList,
+    apiInvocations: invocationList,
+    coverage: {
+      adapter: "agnostic-v1",
+      filesDiscovered: stats.discovered,
+      filesParsed: parsed,
+      filesPreFiltered: preFiltered,
+      filesHopParsed: hopParsed,
+      filesSkipped: failed.length,
+      pathsUnwalked: stats.unwalked,
+      importsComplete,
+      importCoverageGaps,
+      apiInvocations: invocationList.length,
+      callsTotal: calls.total,
+      callsDependency: calls.dependency,
+      callsLocal: calls.local,
+      callsAmbiguous: calls.ambiguous,
+      sourceBytes,
+      analysisMs: Date.now() - startedAt,
+      ...rssBytes !== void 0 ? { rssBytes } : {},
+      ...peakRssBytes !== void 0 ? { peakRssBytes } : {},
+      // The list IS the partiality statement. There is deliberately no `apiInventoryComplete`: parsing
+      // every file would raise recall without removing any of these, so no parsing budget could make an
+      // absent invocation mean "not called".
+      apiInventoryLimitations: [
+        "only files carrying an entry-point signal, and the local modules they import directly, are parsed \u2014 a call two hops away is unseen",
+        "a computed callee or property (`client[name]()`) cannot be resolved to an API",
+        "a dynamic import()/require() with a non-literal specifier is not traced",
+        "reflection, generated code, and syntax that fails to parse are invisible",
+        "a receiver reached through more than one local hop, or through dependency injection, is not followed"
+      ],
+      roots: ["."],
+      notes
+    }
+  };
+}
+
+// src/map/index.ts
+async function buildInputMap(cwd, options = {}) {
+  const ts = await loadTypeScript(cwd);
+  if (!ts) {
+    return {
+      map: null,
+      error: "Could not resolve a TypeScript compiler to parse the app. `map` uses your project\u2019s own `typescript` (already a devDependency of a TypeScript app) \u2014 install it and retry."
+    };
+  }
+  const map = await extractInputMap(cwd, ts, options);
+  return { map };
+}
+
+// src/setup.ts
+import { readFileSync as readFileSync11, writeFileSync as writeFileSync6 } from "fs";
+import path10 from "path";
+var SCAN_COMMAND = "patchstack-connect scan";
+var MARK_BUILD_COMMAND = "patchstack-connect mark-build";
+function setupProtection(cwd) {
+  const install = runProtect(cwd);
+  const verification = runVerify(cwd);
+  return { install, verification };
+}
+function appendHook(existing, command) {
+  if (existing === void 0 || existing.trim().length === 0) {
+    return command;
+  }
+  if (existing.includes(command)) {
+    return existing;
+  }
+  return `${existing} && ${command}`;
+}
+function wireBuildScripts(cwd, packageManager) {
+  const target = path10.join(cwd, "package.json");
+  const raw = readFileSync11(target, "utf8");
+  const pkg = JSON.parse(raw);
+  const scripts = pkg.scripts ?? {};
+  const build = scripts.build;
+  const postinstall = appendHook(scripts.postinstall, SCAN_COMMAND);
+  if (build === void 0 || build.trim().length === 0) {
+    if (postinstall === scripts.postinstall) {
+      return {
+        changed: false,
+        strategy: "postinstall-only",
+        detail: "dependency-install scan already wired; no build script to integrate."
+      };
+    }
+    scripts.postinstall = postinstall;
+  } else if (packageManager === "bun") {
+    let nextBuild = build;
+    if (!nextBuild.includes(SCAN_COMMAND)) {
+      nextBuild = `${SCAN_COMMAND} && ${nextBuild}`;
+    }
+    if (!nextBuild.includes(MARK_BUILD_COMMAND)) {
+      nextBuild = `${nextBuild} && ${MARK_BUILD_COMMAND}`;
+    }
+    if (nextBuild === build && postinstall === scripts.postinstall) {
+      return {
+        changed: false,
+        strategy: "build-chain",
+        detail: "dependency-install scan and build chain already wired."
+      };
+    }
+    scripts.postinstall = postinstall;
+    scripts.build = nextBuild;
+  } else {
+    const prebuild = appendHook(scripts.prebuild, SCAN_COMMAND);
+    const postbuild = appendHook(scripts.postbuild, MARK_BUILD_COMMAND);
+    if (prebuild === scripts.prebuild && postbuild === scripts.postbuild && postinstall === scripts.postinstall) {
+      return {
+        changed: false,
+        strategy: "lifecycle-hooks",
+        detail: "dependency-install, prebuild, and postbuild hooks are already wired."
+      };
+    }
+    scripts.postinstall = postinstall;
+    scripts.prebuild = prebuild;
+    scripts.postbuild = postbuild;
+  }
+  pkg.scripts = scripts;
+  const indentMatch = raw.match(/^[\t ]+(?=")/m)?.[0];
+  const indent = indentMatch?.includes("	") ? "	" : indentMatch?.length ?? 2;
+  const trailingNewline = raw.endsWith("\n") ? "\n" : "";
+  writeFileSync6(target, `${JSON.stringify(pkg, null, indent)}${trailingNewline}`, "utf8");
+  if (build === void 0 || build.trim().length === 0) {
+    return {
+      changed: true,
+      strategy: "postinstall-only",
+      detail: "added a dependency-install scan; package.json has no build script."
+    };
+  }
+  return packageManager === "bun" ? {
+    changed: true,
+    strategy: "build-chain",
+    detail: "added a dependency-install scan and chained scan/mark-build around the build."
+  } : {
+    changed: true,
+    strategy: "lifecycle-hooks",
+    detail: "added scans to postinstall/prebuild and mark-build to postbuild."
+  };
+}
+
+// src/cli.ts
+var HELP = `@patchstack/connect \u2014 scan your lockfile and report packages to Patchstack.
+
+Usage:
+  patchstack-connect scan   [options]                Scan lockfile and POST to Patchstack.
+                                                     If no UUID is configured, the server
+                                                     provisions one and we persist it. After a
+                                                     successful post it also adds/updates the
+                                                     disclosure-widget <script> tag in the root
+                                                     HTML shell (index.html, public/index.html,
+                                                     or src/app.html) \u2014 opt out with
+                                                     "widget": false in .patchstackrc.json
+  patchstack-connect setup  [options]                Finish the bounded project setup: run scan,
+                                                     manage the widget, install + verify runtime
+                                                     protection, and wire dependency/build scans.
+                                                     Never runs the project build
+  patchstack-connect map    [--dir <p>] [--out <f>] [--upload]
+                                                     Map the app's attack surface: entry points, the
+                                                     inputs each reads, the sinks it can reach, and
+                                                     evidence-backed input\u2192sink flows (each labelled
+                                                     with how the link was established). Best-effort static
+                                                     analysis \u2014 reports the DETECTED surface, with
+                                                     coverage counters. Prints JSON (--out writes a
+                                                     file; --follow-symlinks leaves the project dir).
+                                                     Uses the app's own TypeScript
+  patchstack-connect init   <site-uuid>              Optional: pre-seed .patchstackrc.json
+                                                     with an existing site UUID
+  patchstack-connect status [options]                Show current configuration and whether the
+                                                     site still exists on Patchstack (active /
+                                                     removed)
+  patchstack-connect uninstall [options]             Signal Patchstack that this package is being
+                                                     removed from the project. An unclaimed site
+                                                     record is deleted; a claimed site is flagged
+                                                     for its owner to remove in the dashboard.
+                                                     Does NOT touch local files \u2014 see the
+                                                     "Uninstalling" steps in AGENT-INSTALL.md
+  patchstack-connect mark-build [options]            Stamp built HTML with a production flag +
+                                                     build fingerprint, and ensure the widget
+                                                     tag in built pages (run as a postbuild step)
+  patchstack-connect protect [--demo|--check]        Install always-on runtime protection (the
+                                                     guard). Auto-wires supported server stacks;
+                                                     for others it scaffolds a
+                                                     generic guard + prints a wiring plan.
+                                                     --demo seeds a broad sample rule set (for
+                                                     demonstrations, not production).
+                                                     --check verifies the guard is wired (exit 1
+                                                     if not) \u2014 for the wire-then-verify loop.
+  patchstack-connect demo node-serialize [--url URL] Run the production-backed node-serialize
+                                                     walkthrough: verify the vulnerable package,
+                                                     scan it, wait for live rule 18843, install +
+                                                     verify the guard, and print test requests.
+                                                     Does not install vulnerable dependencies.
+  patchstack-connect demo-guide node-serialize       Show a read-only, state-aware walkthrough for
+                                                     preparing, running, proving, and cleaning up
+                                                     the production-backed local demo.
+  patchstack-connect guide [--full]                  Show this project's setup status (what's done,
+                                                     what's missing, with tailored commands), then
+                                                     print the full setup guide. --full prints the
+                                                     guide even when setup is complete
+  patchstack-connect login  [options]                Recover this site's Patchstack credential when
+                                                     .patchstackrc.json has been lost. Prints a short
+                                                     code to approve in the dashboard; approving
+                                                     rotates the credential, so the old one stops
+                                                     working
+  patchstack-connect help                            Print this message
+
+Options (for scan, setup, status, and uninstall):
+  --site-uuid <uuid>      Override the configured site UUID
+  --endpoint <url>        Override the API endpoint
+  --dry-run               (scan only) Show the payload without posting
 
 Options (for mark-build):
   --dir <path>            Build output directory (default: auto-detect
@@ -2934,6 +5520,7 @@ Options (for demo and demo-guide):
 Environment:
   PATCHSTACK_SITE_UUID    Site UUID
   PATCHSTACK_API_KEY      WP-format site API key for block-log reporting (never put in the widget)
+  PATCHSTACK_PULSE_AUTH   Credential for authenticated Pulse ingest (defaults to PATCHSTACK_API_KEY)
   PATCHSTACK_TELEMETRY    Set to off to disable block-log reporting
   PATCHSTACK_API_BASE     API origin for /oauth/token and /api/logs/log (default: https://api.patchstack.com)
   PATCHSTACK_ENDPOINT     API endpoint (default: https://api.patchstack.com/monitor/pulse/manifest)
@@ -2953,7 +5540,7 @@ Examples:
   npx @patchstack/connect demo node-serialize
   npx @patchstack/connect demo-guide node-serialize
 `;
-var VALUE_FLAGS = /* @__PURE__ */ new Set(["site-uuid", "endpoint", "dir", "url"]);
+var VALUE_FLAGS = /* @__PURE__ */ new Set(["site-uuid", "endpoint", "dir", "url", "out"]);
 function parseArgs(argv) {
   const args = argv.slice(2);
   const positional = [];
@@ -3005,6 +5592,103 @@ async function runInit(args) {
   console.log("Next: run `npx @patchstack/connect scan` to send your first manifest.");
   return 0;
 }
+async function runLogin(args) {
+  if (process.env.CI !== void 0 && process.env.CI !== "" && process.env.CI !== "false") {
+    console.error("`login` is interactive and cannot run in CI. Set PATCHSTACK_PULSE_AUTH instead.");
+    return 1;
+  }
+  const config = await resolveConfig({
+    cwd: process.cwd(),
+    cliSiteUuid: getStringFlag(args.flags, "site-uuid"),
+    cliEndpoint: getStringFlag(args.flags, "endpoint")
+  });
+  const result = await login(config, (userCode, verificationUri) => {
+    console.log(`
+  Your code:  ${userCode}`);
+    console.log(`  Approve at: ${verificationUri}
+`);
+    console.log("  Waiting for approval\u2026");
+  });
+  if (result.status === "approved") {
+    console.log("\n  \u2713 Credential restored and saved to .patchstackrc.json.\n");
+    return 0;
+  }
+  console.error(`
+  ${result.message ?? "Login failed."}
+`);
+  return 1;
+}
+async function runMap(args) {
+  const cwd = getStringFlag(args.flags, "dir") ?? process.cwd();
+  const { map, error } = await buildInputMap(cwd, {
+    followSymlinks: args.flags.get("follow-symlinks") === true
+  });
+  if (!map) {
+    console.error(`patchstack: ${error}`);
+    return 1;
+  }
+  const inputs = map.endpoints.reduce((n, e) => n + e.inputs.length, 0);
+  const sinks = map.endpoints.reduce((n, e) => n + e.sinks.length, 0);
+  const proven = map.endpoints.reduce((n, e) => n + e.flows.filter((f) => isProvenFlow(f.confidence)).length, 0);
+  const c = map.coverage;
+  console.error(
+    `patchstack: ${map.endpoints.length} entry point(s), ${inputs} input(s), ${sinks} sink(s), ${proven} proven input\u2192sink flow(s) [${map.framework}].`
+  );
+  console.error(
+    // All three buckets, explicitly: "6/66 parsed" reads as "91% unanalysed" when the other 60 files
+    // simply contain no server entry point (most of a project is client code). Only `skipped` is a
+    // failure to analyse.
+    `patchstack: ${c.filesDiscovered} file(s) found \u2014 ${c.filesParsed} analysed, ${c.filesPreFiltered} skipped (no server entry point)` + (c.filesSkipped ? `, ${c.filesSkipped} could not be analysed` : "") + `. DETECTED surface only \u2014 static analysis is best-effort; every flow carries the tier it was established at ("exact-local" and "transformed-local" are proven; "imported", "heuristic" and "unknown" are not).`
+  );
+  const invoked = map.apiInvocations ?? [];
+  if (invoked.length > 0) {
+    const c2 = map.coverage;
+    const dependency = c2.callsDependency ?? 0;
+    const ambiguous = c2.callsAmbiguous ?? 0;
+    const denominator = dependency + ambiguous;
+    const quality = denominator > 0 ? Math.round(100 * dependency / denominator) : 100;
+    console.error(
+      `patchstack: ${invoked.length} dependency API call(s) resolved across ${new Set(invoked.map((i) => i.package)).size} package(s) from ${c2.callsTotal ?? 0} call site(s) \u2014 ${quality}% of dependency-candidate receivers resolved (${c2.callsLocal ?? 0} local, ${ambiguous} ambiguous). Positive evidence only: absence here never means an API is not called.`
+    );
+  }
+  const imported = map.imports ?? [];
+  if (imported.length > 0) {
+    const unmodelled = imported.filter((d) => d.recognizedSinkKinds.length === 0).length;
+    console.error(
+      `patchstack: ${imported.length} package(s) imported \u2014 ${unmodelled} with no recognized sink family, so a vulnerability in those cannot be judged reachable or unreachable from this map.`
+    );
+  }
+  const json = JSON.stringify(map, null, 2);
+  const out = getStringFlag(args.flags, "out");
+  if (out) {
+    writeFileSync7(out, json);
+    console.error(`patchstack: wrote ${out}`);
+  } else if (args.flags.get("upload") !== true) {
+    console.log(json);
+  }
+  if (args.flags.get("upload") === true) {
+    if (map.endpoints.length === 0) {
+      console.error("patchstack: nothing to upload \u2014 no server entry points were detected.");
+      return 0;
+    }
+    const config = await resolveConfig({
+      cwd,
+      cliSiteUuid: getStringFlag(args.flags, "site-uuid"),
+      cliEndpoint: getStringFlag(args.flags, "endpoint")
+    });
+    const outcome = await postInputMap(config, map);
+    if (outcome.result === "stored") {
+      console.error(`patchstack: uploaded the attack surface (revision ${outcome.revision}).`);
+    } else if (outcome.result === "unchanged") {
+      console.error(`patchstack: attack surface unchanged since revision ${outcome.revision} \u2014 nothing to store.`);
+    } else if (outcome.result === "skipped") {
+      console.error(`patchstack: did not upload the attack surface \u2014 ${outcome.message}`);
+    } else {
+      console.error(`patchstack: could not upload the attack surface \u2014 ${outcome.message}`);
+    }
+  }
+  return 0;
+}
 async function runScan(args, options = {}) {
   const dryRun = args.flags.get("dry-run") === true;
   const config = await resolveConfig({
@@ -3061,7 +5745,8 @@ async function runScan(args, options = {}) {
   }
   if (typeof response.api_key === "string" && response.api_key.length > 0) {
     const target = await persistApiKey(process.cwd(), response.api_key);
-    console.log(`Saved API key to ${target} (for block-log reporting via /api/logs/log; keep out of the public widget).`);
+    await persistPulseAuth(process.cwd(), response.api_key);
+    console.log(`Saved API key to ${target} (authenticates Pulse ingest and block-log reporting; keep out of the public widget).`);
   }
   if (response.stored) {
     console.log(`Stored manifest #${response.manifest_id} (checksum ${response.checksum}).`);
@@ -3263,7 +5948,7 @@ async function runGuide(args) {
   console.log("\u2014\u2014\u2014\u2014 Full reference guide (ships as AGENT-INSTALL.md) \u2014\u2014\u2014\u2014");
   console.log("");
   const guidePath = new URL("../AGENT-INSTALL.md", import.meta.url);
-  console.log(readFileSync7(guidePath, "utf8"));
+  console.log(readFileSync12(guidePath, "utf8"));
   return 0;
 }
 async function runSetup(args) {
@@ -3354,6 +6039,40 @@ async function runStatus(args) {
   }
   return 0;
 }
+async function runUninstall(args) {
+  const config = await resolveConfig({
+    cwd: process.cwd(),
+    cliSiteUuid: getStringFlag(args.flags, "site-uuid"),
+    cliEndpoint: getStringFlag(args.flags, "endpoint")
+  });
+  if (config.siteUuid === null) {
+    console.log("No site UUID configured \u2014 there is no site record to signal about.");
+    console.log('Continue with the local removal steps in AGENT-INSTALL.md ("Uninstalling").');
+    return 0;
+  }
+  console.log(`Signalling Patchstack that @patchstack/connect is being removed (site ${config.siteUuid})\u2026`);
+  const outcome = await postPackageRemoved(config);
+  switch (outcome.result) {
+    case "deleted":
+      console.log("Site record removed from Patchstack (the site was unclaimed).");
+      break;
+    case "flagged":
+      console.log("This site is claimed by a Patchstack account, so its record was kept and flagged.");
+      console.log("Its owner can remove it at https://app.patchstack.com to free the site slot.");
+      break;
+    case "gone":
+      console.log("The site record no longer exists on Patchstack \u2014 nothing to signal.");
+      break;
+    case "failed":
+      console.warn(`Could not signal Patchstack${outcome.message !== null ? ` (${outcome.message})` : ""}.`);
+      console.warn("The site record may remain \u2014 it can always be removed from the dashboard at https://app.patchstack.com.");
+      break;
+  }
+  console.log("");
+  console.log("This command only signals Patchstack. The local integration files must still be");
+  console.log('removed \u2014 follow the "Uninstalling" steps in AGENT-INSTALL.md.');
+  return 0;
+}
 function describeStack(stack) {
   const parts = [stack.builder, stack.framework, stack.ui, stack.runtime].filter(
     (part) => part !== null
@@ -3410,7 +6129,7 @@ async function runMarkBuild(args) {
   let marked = 0;
   let widgetTouched = 0;
   for (const file of files) {
-    const before = readFileSync7(file, "utf8");
+    const before = readFileSync12(file, "utf8");
     let after = injectMarker(before, snippet);
     if (widgetUuid !== null) {
       const ensured = ensureWidgetInHtml(after, widgetUuid);
@@ -3443,6 +6162,8 @@ async function main() {
       return runScan(args);
     case "status":
       return runStatus(args);
+    case "uninstall":
+      return runUninstall(args);
     case "mark-build":
       return runMarkBuild(args);
     case "protect":
@@ -3455,6 +6176,10 @@ async function main() {
       return runGuide(args);
     case "setup":
       return runSetup(args);
+    case "map":
+      return runMap(args);
+    case "login":
+      return runLogin(args);
     default:
       console.error(`Unknown command: ${args.command}
 `);