@patchstack/connect 0.5.15 → 0.5.16

package/dist/cli.js

@@ -3119,6 +3119,16 @@ function rootIdentifier(node, ts) {
   }
   return void 0;
 }
+function rootIdentifierNode(node, ts) {
+  let cur = node;
+  while (cur) {
+    if (ts.isIdentifier(cur)) return cur;
+    if (ts.isPropertyAccessExpression(cur) || ts.isElementAccessExpression(cur) || ts.isCallExpression(cur) || ts.isNewExpression(cur) || ts.isNonNullExpression(cur) || ts.isParenthesizedExpression(cur) || ts.isAwaitExpression(cur)) {
+      cur = cur.expression;
+    } else return void 0;
+  }
+  return void 0;
+}
 function spanOf(node) {
   const out = { line: lineOf(node) };
   try {
@@ -3223,6 +3233,15 @@ function opCallOf(propAccess, ts) {
   const p = propAccess?.parent;
   return p && ts.isCallExpression(p) && p.expression === propAccess ? p : propAccess;
 }
+function localCallIdentifiers(node, ts) {
+  const out = [];
+  const visit = (n) => {
+    if (ts.isCallExpression(n) && ts.isIdentifier(n.expression)) out.push(n.expression);
+    ts.forEachChild(n, visit);
+  };
+  visit(node);
+  return out;
+}
 function localCalls(node, ts) {
   const names = [];
   const visit = (n) => {
@@ -3259,8 +3278,9 @@ function routeFromFilePath(relFile) {
     segs = dirs.slice(at("routes") + 1);
   } else if (at("pages") !== -1) {
     segs = [...dirs.slice(at("pages") + 1), ...base === "index" ? [] : [base]];
-  } else if (at("server") !== -1) {
-    segs = [...dirs.slice(at("server") + 1), ...base === "index" ? [] : [base.replace(/\.(get|post|put|patch|delete|head|options)$/i, "")]];
+  } else if (nuxtRoot(dirs) !== void 0) {
+    const root = nuxtRoot(dirs);
+    segs = [...root, ...base === "index" ? [] : [base.replace(/\.(get|post|put|patch|delete|head|options)$/i, "")]];
   }
   if (!segs) return {};
   segs = segs.filter((s) => !(s.startsWith("(") && s.endsWith(")")) && !s.startsWith("@") && !s.startsWith("_"));
@@ -3276,6 +3296,21 @@ function routeFromFilePath(relFile) {
   const route = "/" + mapped.join("/");
   return { route: route.length > 1 ? route.replace(/\/+$/, "") : "/", dynamic };
 }
+function isPagesApiFile(relFile) {
+  const dirs = relFile.split(/[\\/]/).filter(Boolean).slice(0, -1);
+  const i = dirs.lastIndexOf("pages");
+  return i !== -1 && dirs[i + 1] === "api";
+}
+function nuxtRoot(dirs) {
+  const i = dirs.lastIndexOf("server");
+  if (i === -1) return void 0;
+  if (dirs[i + 1] === "api") return dirs.slice(i + 1);
+  if (dirs[i + 1] === "routes") return dirs.slice(i + 2);
+  return void 0;
+}
+function isRoutePath(route) {
+  return route.startsWith("/") || route === "*";
+}
 function routeFromChain(expr, ts) {
   let cur = expr;
   while (cur && ts.isCallExpression(cur) && ts.isPropertyAccessExpression(cur.expression)) {
@@ -3336,7 +3371,35 @@ function detectFramework(cwd) {
   }
   return "unknown";
 }
-var isSourceFile = (name) => /\.(ts|tsx|mts|cts|js|jsx|mjs|cjs)$/.test(name) && !name.endsWith(".d.ts");
+var isSourceFile = (name) => /\.(ts|tsx|mts|cts|js|jsx|mjs|cjs)$/.test(name) && !name.endsWith(".d.ts") || isComponentFile(name);
+var isComponentFile = (name) => /\.(vue|svelte|astro)$/.test(name);
+function componentScript(text, file) {
+  const keep = [];
+  if (file.endsWith(".astro")) {
+    const open2 = /^?\s*---[^\S\r\n]*\r?\n/.exec(text);
+    if (open2) {
+      const start = open2[0].length;
+      const close = /\r?\n---[^\S\r\n]*(\r?\n|$)/g;
+      close.lastIndex = start - 1;
+      const end = close.exec(text);
+      if (!end) return null;
+      if (end.index > start) keep.push([start, end.index]);
+    }
+  }
+  const opening = /<script\b[^>]*>/gi;
+  for (let m = opening.exec(text); m; m = opening.exec(text)) {
+    const start = m.index + m[0].length;
+    const closing = /<\/script\s*>/gi;
+    closing.lastIndex = start;
+    const end = closing.exec(text);
+    if (!end) return null;
+    keep.push([start, end.index]);
+    opening.lastIndex = end.index + end[0].length;
+  }
+  let out = text.replace(/[^\r\n]/g, " ");
+  for (const [start, end] of keep) out = out.slice(0, start) + text.slice(start, end) + out.slice(end);
+  return out;
+}
 var SKIP_DIRS = /* @__PURE__ */ new Set([
   "node_modules",
   "dist",
@@ -7017,6 +7080,97 @@ function npmPackageOf(spec) {
 
 // src/map/sinks.ts
 import { createHash as createHash4 } from "crypto";
+
+// src/map/scope.ts
+var scopeCache = /* @__PURE__ */ new WeakMap();
+function declarationOf(id, ts) {
+  if (!id || !ts.isIdentifier(id)) return void 0;
+  const name = id.text;
+  for (let cur = id.parent; cur; cur = cur.parent) {
+    const declared = declaredIn(cur, ts);
+    if (declared?.has(name)) return declared.get(name);
+  }
+  return void 0;
+}
+function isGlobal(node, name, ts) {
+  if (ts.isIdentifier(node)) return node.text === name && declarationOf(node, ts) === void 0;
+  return ts.isPropertyAccessExpression(node) && node.name.text === name && ts.isIdentifier(node.expression) && node.expression.text === "globalThis" && declarationOf(node.expression, ts) === void 0;
+}
+function boundIdentifiers(name, ts) {
+  if (!name) return [];
+  if (ts.isIdentifier(name)) return [name];
+  if (ts.isObjectBindingPattern(name) || ts.isArrayBindingPattern(name)) {
+    return name.elements.flatMap((el) => ts.isBindingElement(el) ? boundIdentifiers(el.name, ts) : []);
+  }
+  return [];
+}
+function isFunctionScope(n, ts) {
+  return ts.isFunctionDeclaration(n) || ts.isFunctionExpression(n) || ts.isArrowFunction(n) || ts.isMethodDeclaration(n) || ts.isConstructorDeclaration(n) || ts.isGetAccessorDeclaration(n) || ts.isSetAccessorDeclaration(n) || ts.isSourceFile(n);
+}
+function declaredIn(n, ts) {
+  const cached2 = scopeCache.get(n);
+  if (cached2) return cached2;
+  const out = /* @__PURE__ */ new Map();
+  const add = (ids) => {
+    for (const i of ids) if (!out.has(i.text)) out.set(i.text, i);
+  };
+  if (isFunctionScope(n, ts)) {
+    if ((ts.isFunctionExpression(n) || ts.isClassExpression?.(n)) && n.name) add([n.name]);
+    for (const p of n.parameters ?? []) add(boundIdentifiers(p.name, ts));
+    collectVarScoped(ts.isSourceFile(n) ? n : n.body, ts, add);
+    if (ts.isSourceFile(n)) collectLexical(n.statements, ts, add, true);
+  } else if (ts.isBlock(n) || ts.isModuleBlock(n) || ts.isCaseBlock(n)) {
+    const statements = ts.isCaseBlock(n) ? n.clauses.flatMap((c) => [...c.statements]) : n.statements;
+    collectLexical(statements, ts, add, false);
+  } else if (ts.isForStatement(n) || ts.isForInStatement(n) || ts.isForOfStatement(n)) {
+    const init = n.initializer;
+    if (init && ts.isVariableDeclarationList(init) && isLexicalList(init, ts)) {
+      for (const d of init.declarations) add(boundIdentifiers(d.name, ts));
+    }
+  } else if (ts.isCatchClause(n)) {
+    if (n.variableDeclaration) add(boundIdentifiers(n.variableDeclaration.name, ts));
+  } else if (ts.isClassExpression?.(n) && n.name) {
+    add([n.name]);
+  } else {
+    return void 0;
+  }
+  scopeCache.set(n, out);
+  return out;
+}
+function isLexicalList(list, ts) {
+  return (list.flags & (ts.NodeFlags.Let | ts.NodeFlags.Const)) !== 0;
+}
+function collectLexical(statements, ts, add, topLevel) {
+  for (const s of statements ?? []) {
+    if (ts.isVariableStatement(s) && isLexicalList(s.declarationList, ts)) {
+      for (const d of s.declarationList.declarations) add(boundIdentifiers(d.name, ts));
+    } else if ((ts.isClassDeclaration(s) || ts.isFunctionDeclaration(s) || ts.isEnumDeclaration(s)) && s.name) {
+      add([s.name]);
+    } else if (topLevel && ts.isImportDeclaration(s) && s.importClause) {
+      const clause = s.importClause;
+      if (clause.name) add([clause.name]);
+      const bindings = clause.namedBindings;
+      if (bindings && ts.isNamespaceImport(bindings)) add([bindings.name]);
+      if (bindings && ts.isNamedImports(bindings)) add(bindings.elements.map((e) => e.name));
+    } else if (topLevel && ts.isImportEqualsDeclaration(s)) {
+      add([s.name]);
+    }
+  }
+}
+function collectVarScoped(node, ts, add) {
+  const visit = (n) => {
+    if (!n) return;
+    if (ts.isVariableDeclarationList(n) && !isLexicalList(n, ts)) {
+      for (const d of n.declarations) add(boundIdentifiers(d.name, ts));
+    }
+    if (n !== node && isFunctionScope(n, ts)) return;
+    if (ts.isClassDeclaration(n) || ts.isClassExpression?.(n)) return;
+    ts.forEachChild(n, visit);
+  };
+  visit(node);
+}
+
+// src/map/sinks.ts
 var DB_OPS = /* @__PURE__ */ new Set(["insert", "update", "delete", "select", "upsert", "rpc"]);
 var PRISMA_OPS = /* @__PURE__ */ new Set(["create", "createMany", "update", "updateMany", "delete", "deleteMany", "upsert", "findFirst", "findUnique", "findMany", "count", "aggregate"]);
 var FS_CALLS = /^(readFile|writeFile|readFileSync|writeFileSync|appendFile|createReadStream|createWriteStream|unlink|rm|rmSync|mkdir|readdir|stat|open)$/;
@@ -7059,29 +7213,39 @@ function recognizedSinkKinds(pkg) {
   return kinds;
 }
 function collectLocalSinks(sf, ts, bindings, ctx) {
-  const map = /* @__PURE__ */ new Map();
-  const visit = (node) => {
-    if (ts.isFunctionDeclaration(node) && node.name && node.body) map.set(node.name.text, directSinks(node.body, ts, bindings, ctx));
+  const byDeclaration = /* @__PURE__ */ new Map();
+  const byName = /* @__PURE__ */ new Map();
+  const record = (name, body, topLevel) => {
+    const sinks = directSinks(body, ts, bindings, ctx);
+    byDeclaration.set(name, sinks);
+    if (topLevel || !byName.has(name.text)) byName.set(name.text, sinks);
+  };
+  const visit = (node, depth) => {
+    const topLevel = depth === 0;
+    if (ts.isFunctionDeclaration(node) && node.name && node.body) record(node.name, node.body, topLevel);
     else if (ts.isVariableStatement(node)) {
       for (const decl of node.declarationList.declarations) {
         if (ts.isIdentifier(decl.name) && decl.initializer && isFnLike(decl.initializer, ts)) {
-          map.set(decl.name.text, directSinks(decl.initializer.body, ts, bindings, ctx));
+          record(decl.name, decl.initializer.body, topLevel);
         }
       }
     }
-    ts.forEachChild(node, visit);
+    ts.forEachChild(node, (child) => visit(child, depth + (ts.isSourceFile(node) ? 0 : 1)));
   };
-  visit(sf);
-  return map;
+  visit(sf, 0);
+  return { byDeclaration, byName };
 }
 function sinksFrom(arrowOrNode, ts, localSinks, bindings, ctx) {
   if (!arrowOrNode) return [];
   const body = arrowOrNode.isSyntheticBody ? arrowOrNode.body : isFnLike(arrowOrNode, ts) ? arrowOrNode.body : arrowOrNode;
   if (!body) return [];
   const sinks = directSinks(body, ts, bindings, ctx);
-  for (const called of localCalls(body, ts)) {
-    for (const s of localSinks.get(called) ?? []) sinks.push(s);
-    if (ctx) {
+  for (const callee of localCallIdentifiers(body, ts)) {
+    const called = callee.text;
+    const declaration = declarationOf(callee, ts);
+    const helper = declaration === void 0 ? void 0 : localSinks.byDeclaration.get(declaration);
+    for (const s of helper ?? []) sinks.push(s);
+    if (ctx && (declaration === void 0 || isModuleLevel(declaration, ts))) {
       const spec = bindings.resolve(called);
       if (spec && spec.startsWith(".")) {
         for (const s of ctx.graph.importedSinks(ctx.file, spec, bindings.exportNameOf(called) ?? called)) sinks.push(s);
@@ -7098,6 +7262,22 @@ function sinksFrom(arrowOrNode, ts, localSinks, bindings, ctx) {
   }
   return dedupeSinks(sinks, ctx?.owner ?? "");
 }
+function isContextRequest(node, ts) {
+  if (!ts.isPropertyAccessExpression(node) || node.name.text !== "req" || !ts.isIdentifier(node.expression)) return false;
+  const declaration = declarationOf(node.expression, ts);
+  for (let cur = declaration?.parent; cur; cur = cur.parent) {
+    if (ts.isParameter(cur)) return true;
+    if (!ts.isBindingElement(cur) && !ts.isObjectBindingPattern(cur) && !ts.isArrayBindingPattern(cur)) return false;
+  }
+  return false;
+}
+function isModuleLevel(declaration, ts) {
+  for (let cur = declaration?.parent; cur; cur = cur.parent) {
+    if (ts.isSourceFile(cur)) return true;
+    if (ts.isFunctionLike(cur) || ts.isBlock(cur) || ts.isClassLike(cur)) return false;
+  }
+  return false;
+}
 function namespaceMemberCalls(node, ts) {
   const out = [];
   const visit = (n) => {
@@ -7158,7 +7338,7 @@ function directSinks(node, ts, bindings, ctx) {
             const prismaLikely = b.pkg === "@prisma/client" || !b.pkg && (bindings.imports.has("@prisma/client") || /prisma/i.test(b.root ?? ""));
             if (prismaLikely) push({ kind: "db", ...b.pkg ? { provider: "prisma" } : {}, package: "@prisma/client", table: callee.expression.name.text, op: method, attribution: b.pkg ? "import" : "inferred", ...spanOf(n) });
           }
-          if (method === "query" || method === "execute") {
+          if ((method === "query" || method === "execute") && !isContextRequest(callee.expression, ts)) {
             const pkg = b.pkg ?? infer("db");
             const attribution = attributionOf(b, pkg);
             push({ kind: "db", ...dbApi(pkg, attribution), package: pkg, op: method, attribution, ...spanOf(n) });
@@ -7298,114 +7478,6 @@ function dedupeSinks(sinks, owner) {
   return out;
 }
 
-// src/map/module-graph.ts
-import { readFileSync as readFileSync14, realpathSync as realpathSync5, statSync as statSync7 } from "fs";
-import { dirname as dirname8, join as join16, relative as relative5, resolve as resolvePath } from "path";
-var RESOLVE_EXTS = [".ts", ".tsx", ".mts", ".cts", ".js", ".jsx", ".mjs", ".cjs"];
-function createModuleGraph(ts, opts) {
-  const cache = /* @__PURE__ */ new Map();
-  const load = (file) => {
-    if (cache.has(file)) return cache.get(file) ?? null;
-    let entry = null;
-    try {
-      const text = readFileSync14(file, "utf8");
-      const sf = ts.createSourceFile(file, text, ts.ScriptTarget.Latest, true, guessScriptKind(ts, file));
-      const bindings = buildModuleBindings(sf, ts);
-      entry = { fnSinks: collectLocalSinks(sf, ts, bindings), calleesOf: collectCallees(sf, ts), bindings };
-    } catch {
-      entry = null;
-    }
-    cache.set(file, entry);
-    return entry;
-  };
-  const resolveInProject = (fromFile, specifier) => {
-    const target = resolveRelativeModule(fromFile, specifier);
-    if (!target) return void 0;
-    if (!opts.followOutside) {
-      let real = target;
-      try {
-        real = realpathSync5(target);
-      } catch {
-      }
-      if (!isInside(real, opts.boundary)) return void 0;
-    }
-    return target;
-  };
-  return {
-    resolveLocal: resolveInProject,
-    importedSinks(fromFile, specifier, exportName) {
-      const target = resolveInProject(fromFile, specifier);
-      if (!target) return [];
-      const mod = load(target);
-      if (!mod) return [];
-      const collected = [...mod.fnSinks.get(exportName) ?? []];
-      for (const callee of mod.calleesOf.get(exportName) ?? []) {
-        for (const s of mod.fnSinks.get(callee) ?? []) collected.push(s);
-      }
-      const rel = relative5(opts.cwd, target);
-      return collected.map((s) => ({ ...s, file: rel }));
-    },
-    // A different question about the same module: not "what sinks are in there" but "what does this
-    // export TRACE TO". The common AI-built layout puts the client in a lib file —
-    // `export const db = createClient(...)` in `lib/db.ts`, imported everywhere — so the receiver of
-    // `db.from('orders').insert(...)` resolves to a relative specifier and nothing else. Refusing it (as
-    // an unattributable receiver) is right for app code but wrong here: one hop away it is a real
-    // dependency, and that chain is import-to-import, fully static — evidence, not inference.
-    importedBinding(fromFile, specifier, exportName) {
-      const target = resolveInProject(fromFile, specifier);
-      if (!target) return void 0;
-      const mod = load(target);
-      if (!mod) return void 0;
-      const pkg = npmPackageOf(mod.bindings.resolve(exportName));
-      if (pkg === void 0) return void 0;
-      return {
-        package: pkg,
-        origin: mod.bindings.originOf(exportName) ?? "direct",
-        name: mod.bindings.exportNameOf(exportName) ?? exportName
-      };
-    }
-  };
-}
-function resolveRelativeModule(fromFile, spec) {
-  if (!spec.startsWith(".")) return void 0;
-  const dir = dirname8(fromFile);
-  const base = resolvePath(dir, spec);
-  const candidates = [];
-  const jsLike = /\.(js|jsx|mjs|cjs)$/.exec(base);
-  if (jsLike) {
-    const stem = base.slice(0, -jsLike[0].length);
-    for (const e of RESOLVE_EXTS) candidates.push(stem + e);
-  }
-  candidates.push(base);
-  for (const e of RESOLVE_EXTS) candidates.push(base + e);
-  for (const e of RESOLVE_EXTS) candidates.push(join16(base, "index" + e));
-  for (const c of candidates) {
-    try {
-      if (statSync7(c).isFile()) return c;
-    } catch {
-    }
-  }
-  return void 0;
-}
-function collectCallees(sf, ts) {
-  const map = /* @__PURE__ */ new Map();
-  const visit = (node) => {
-    let name;
-    let body;
-    if (ts.isFunctionDeclaration(node) && node.name && node.body) {
-      name = node.name.text;
-      body = node.body;
-    } else if (ts.isVariableDeclaration(node) && ts.isIdentifier(node.name) && node.initializer && isFnLike(node.initializer, ts)) {
-      name = node.name.text;
-      body = node.initializer.body;
-    }
-    if (name && body) map.set(name, localCalls(body, ts));
-    ts.forEachChild(node, visit);
-  };
-  visit(sf);
-  return map;
-}
-
 // src/map/coordinates.ts
 function runtimeCoordinate(source, path17) {
   if (/\[\d*\]/.test(path17)) {
@@ -7477,7 +7549,9 @@ function inputsFromValidator(validatorCall, ts, bindings) {
 }
 function inputsFromHandler(params, body, ts, bindings, opts = {}) {
   const schemaSource = opts.validatorSource ?? "json-body";
-  const schemaFields = zodObjectFields(body, ts, bindings);
+  const inline = zodObjectFields(body, ts, bindings);
+  const referenced = inline.length > 0 ? { fields: [], unresolved: false } : referencedSchemaFields(params, body, ts, bindings);
+  const schemaFields = inline.length > 0 ? inline : referenced.fields;
   const reads = requestMemberAccesses(params, body, ts, opts);
   const byId = /* @__PURE__ */ new Map();
   const put = (name, source, extra = {}) => {
@@ -7490,7 +7564,58 @@ function inputsFromHandler(params, body, ts, bindings, opts = {}) {
     put(name, source ?? schemaSource, shape);
   }
   for (const { name, sources } of reads) for (const source of sources) put(name, source);
-  return [...byId.values()];
+  return { inputs: [...byId.values()], schemaUnresolved: referenced.unresolved };
+}
+var SCHEMA_METHODS = /* @__PURE__ */ new Set(["parse", "safeParse", "parseAsync", "safeParseAsync"]);
+function referencedSchemaFields(params, body, ts, bindings) {
+  if (!body) return { fields: [], unresolved: false };
+  const paramDecls = /* @__PURE__ */ new Set();
+  for (const p of params ?? []) {
+    if (!p?.name) continue;
+    if (ts.isIdentifier(p.name)) paramDecls.add(p.name);
+    else if (ts.isObjectBindingPattern(p.name)) {
+      for (const el of p.name.elements) if (ts.isIdentifier(el.name)) paramDecls.add(el.name);
+    }
+  }
+  const fromParams = (e) => {
+    const root = rootIdentifierNode(e, ts);
+    const declaration = root ? declarationOf(root, ts) : void 0;
+    if (declaration === void 0) return false;
+    if (paramDecls.has(declaration)) return true;
+    const owner = declaration.parent;
+    if (owner && ts.isVariableDeclaration(owner) && owner.name === declaration && owner.initializer) {
+      const inner = rootIdentifierNode(owner.initializer, ts);
+      const innerDeclaration = inner ? declarationOf(inner, ts) : void 0;
+      return innerDeclaration !== void 0 && paramDecls.has(innerDeclaration);
+    }
+    return false;
+  };
+  let fields = [];
+  let unresolved = false;
+  const visit = (n) => {
+    if (fields.length > 0) return;
+    if (ts.isCallExpression(n) && ts.isPropertyAccessExpression(n.expression) && SCHEMA_METHODS.has(n.expression.name.text) && ts.isIdentifier(n.expression.expression) && n.arguments.some((a) => fromParams(a))) {
+      const declaration = declarationOf(n.expression.expression, ts);
+      const owner = declaration?.parent;
+      if (owner && ts.isVariableDeclaration(owner) && owner.name === declaration && owner.initializer) {
+        const literal = findValidatorObject(owner.initializer, ts, bindings);
+        if (literal) fields = fieldsOfObject(literal, ts, bindings, "");
+        else unresolved = true;
+      } else if (declaration !== void 0 && isImported(declaration, ts)) {
+        unresolved = true;
+      }
+    }
+    ts.forEachChild(n, visit);
+  };
+  visit(body);
+  return { fields, unresolved: fields.length === 0 && unresolved };
+}
+function isImported(declaration, ts) {
+  for (let cur = declaration?.parent; cur; cur = cur.parent) {
+    if (ts.isImportDeclaration(cur)) return true;
+    if (ts.isSourceFile(cur) || ts.isStatement(cur)) return false;
+  }
+  return false;
 }
 function findValidatorObject(node, ts, bindings) {
   let found = null;
@@ -7569,16 +7694,29 @@ function requestMemberAccesses(params, body, ts, opts = {}) {
     out.set(name, list);
   };
   const p0 = params?.[0];
-  const reqName = p0 && ts.isIdentifier(p0.name) ? p0.name.text : void 0;
+  const reqDecl = p0 && ts.isIdentifier(p0.name) ? p0.name : void 0;
+  const requestDecls = new Set(reqDecl ? [reqDecl] : []);
+  const isRequest = (e) => ts.isIdentifier(e) && requestDecls.has(declarationOf(e, ts));
+  const isRequestObject = (e) => isRequest(e) || ts.isPropertyAccessExpression(e) && e.name.text === "req" && isRequest(e.expression);
+  const urlDecls = /* @__PURE__ */ new Set();
+  const searchParamDecls = /* @__PURE__ */ new Set();
   const sourceNames = /* @__PURE__ */ new Map();
   const payloadNames = /* @__PURE__ */ new Set();
-  if (opts.payloadParam && p0 && ts.isIdentifier(p0.name)) payloadNames.add(p0.name.text);
-  if (p0 && !reqName && ts.isObjectBindingPattern(p0.name)) {
+  const sourceOf = (e) => ts.isIdentifier(e) ? sourceNames.get(declarationOf(e, ts)) : void 0;
+  if (opts.payloadParam && p0 && ts.isIdentifier(p0.name)) payloadNames.add(p0.name);
+  if (p0 && !reqDecl && ts.isObjectBindingPattern(p0.name)) {
     for (const el of p0.name.elements) {
       const key = bindingKey(el, ts);
-      if (key && REQ_SOURCES.includes(key) && ts.isIdentifier(el.name)) {
-        sourceNames.set(el.name.text, namespaceSource(key));
-      }
+      if (!key || !ts.isIdentifier(el.name)) continue;
+      if (REQ_SOURCES.includes(key)) sourceNames.set(el.name, namespaceSource(key));
+      else if (key === "request") requestDecls.add(el.name);
+      else if (key === "url") urlDecls.add(el.name);
+    }
+  }
+  for (const p of (params ?? []).slice(1)) {
+    if (!p?.name || !ts.isObjectBindingPattern(p.name)) continue;
+    for (const el of p.name.elements) {
+      if (bindingKey(el, ts) === "params" && ts.isIdentifier(el.name)) sourceNames.set(el.name, "route-param");
     }
   }
   const unwrap = (e) => {
@@ -7586,14 +7724,36 @@ function requestMemberAccesses(params, body, ts, opts = {}) {
     while (cur && (ts.isAwaitExpression(cur) || ts.isAsExpression(cur) || ts.isParenthesizedExpression(cur) || ts.isNonNullExpression(cur))) cur = cur.expression;
     return cur;
   };
-  const isPayloadExpr = (e) => ts.isIdentifier(e) && payloadNames.has(e.text);
-  const isReqSourceExpr = (e) => isPayloadExpr(e) || ts.isPropertyAccessExpression(e) && ts.isIdentifier(e.expression) && e.expression.text === reqName && REQ_SOURCES.includes(e.name.text) || ts.isIdentifier(e) && sourceNames.has(e.text);
+  const isPayloadExpr = (e) => ts.isIdentifier(e) && payloadNames.has(declarationOf(e, ts));
+  const isReqSourceExpr = (e) => isPayloadExpr(e) || ts.isPropertyAccessExpression(e) && isRequest(e.expression) && REQ_SOURCES.includes(e.name.text) || sourceOf(e) !== void 0;
   const isBodyReadCall = (e) => {
     const inner = unwrap(e);
-    return Boolean(inner && ts.isCallExpression(inner) && ts.isPropertyAccessExpression(inner.expression) && ["json", "formData"].includes(inner.expression.name.text) && ts.isIdentifier(inner.expression.expression) && inner.expression.expression.text === reqName);
+    return Boolean(inner && ts.isCallExpression(inner) && ts.isPropertyAccessExpression(inner.expression) && ["json", "formData"].includes(inner.expression.name.text) && isRequestObject(inner.expression.expression));
+  };
+  const isRequestUrl = (e) => {
+    const cur = unwrap(e);
+    if (!cur) return false;
+    if (ts.isIdentifier(cur)) return urlDecls.has(declarationOf(cur, ts));
+    if (ts.isPropertyAccessExpression(cur) && cur.name.text === "nextUrl") return isRequest(cur.expression);
+    if (ts.isNewExpression(cur) && isGlobal(cur.expression, "URL", ts)) {
+      const [href] = cur.arguments ?? [];
+      return Boolean(href && ts.isPropertyAccessExpression(href) && href.name.text === "url" && isRequestObject(href.expression));
+    }
+    return false;
+  };
+  const isSearchParams = (e) => {
+    const cur = unwrap(e);
+    if (!cur) return false;
+    if (ts.isIdentifier(cur)) return searchParamDecls.has(declarationOf(cur, ts));
+    return ts.isPropertyAccessExpression(cur) && cur.name.text === "searchParams" && isRequestUrl(cur.expression);
+  };
+  const literalArgument = (call) => {
+    const [arg] = call.arguments ?? [];
+    return call.arguments?.length === 1 && arg && ts.isStringLiteral(arg) ? arg.text : void 0;
   };
   const isCallee = (n) => Boolean(n.parent && (ts.isCallExpression(n.parent) || ts.isNewExpression(n.parent)) && n.parent.expression === n);
   const ACCESSOR_SOURCES = /* @__PURE__ */ new Set(["header", "cookie", "form-body"]);
+  const HONO_ACCESSORS = { query: "query", param: "route-param", header: "header" };
   const visit = (n) => {
     if (ts.isPropertyAccessExpression(n) && isReqSourceExpr(n.expression) && !isCallee(n)) {
       record(n.name.text, sourceOfExpr(n.expression));
@@ -7604,13 +7764,34 @@ function requestMemberAccesses(params, body, ts, opts = {}) {
     if (ts.isCallExpression(n) && ts.isPropertyAccessExpression(n.expression) && n.expression.name.text === "get" && isReqSourceExpr(n.expression.expression) && n.arguments.length === 1 && n.arguments[0] && ts.isStringLiteral(n.arguments[0]) && ACCESSOR_SOURCES.has(sourceOfExpr(n.expression.expression))) {
       record(n.arguments[0].text, sourceOfExpr(n.expression.expression));
     }
+    if (ts.isCallExpression(n) && ts.isPropertyAccessExpression(n.expression) && n.expression.name.text === "get" && isSearchParams(n.expression.expression)) {
+      const name = literalArgument(n);
+      if (name !== void 0) record(name, "query");
+    }
+    if (ts.isCallExpression(n) && ts.isPropertyAccessExpression(n.expression) && ts.isPropertyAccessExpression(n.expression.expression) && n.expression.expression.name.text === "req" && isRequest(n.expression.expression.expression)) {
+      const source = HONO_ACCESSORS[n.expression.name.text];
+      const name = literalArgument(n);
+      if (source && name !== void 0) record(name, source);
+    }
     if (ts.isVariableDeclaration(n) && n.initializer) {
       const init = unwrap(n.initializer);
-      if (ts.isIdentifier(n.name) && isBodyReadCall(n.initializer)) sourceNames.set(n.name.text, bodyReadSource(n.initializer));
-      if (ts.isObjectBindingPattern(n.name) && ts.isIdentifier(init) && reqName && init.text === reqName) {
+      if (ts.isIdentifier(n.name)) {
+        if (isRequest(init)) requestDecls.add(n.name);
+        else if (ts.isPropertyAccessExpression(init) && isRequest(init.expression) && REQ_SOURCES.includes(init.name.text)) {
+          sourceNames.set(n.name, namespaceSource(init.name.text));
+        } else if (isRequestUrl(init)) urlDecls.add(n.name);
+        else if (isSearchParams(init)) searchParamDecls.add(n.name);
+      }
+      if (ts.isObjectBindingPattern(n.name) && isRequestUrl(init)) {
+        for (const el of n.name.elements) {
+          if (bindingKey(el, ts) === "searchParams" && ts.isIdentifier(el.name)) searchParamDecls.add(el.name);
+        }
+      }
+      if (ts.isIdentifier(n.name) && isBodyReadCall(n.initializer)) sourceNames.set(n.name, bodyReadSource(n.initializer));
+      if (ts.isObjectBindingPattern(n.name) && isRequest(init)) {
         for (const el of n.name.elements) {
           const key = bindingKey(el, ts);
-          if (key && REQ_SOURCES.includes(key) && ts.isIdentifier(el.name)) sourceNames.set(el.name.text, namespaceSource(key));
+          if (key && REQ_SOURCES.includes(key) && ts.isIdentifier(el.name)) sourceNames.set(el.name, namespaceSource(key));
         }
       }
       if (ts.isObjectBindingPattern(n.name) && (isReqSourceExpr(init) || isBodyReadCall(n.initializer))) {
@@ -7632,7 +7813,7 @@ function requestMemberAccesses(params, body, ts, opts = {}) {
       if (REQ_SOURCES.includes(e.name.text)) return named;
     }
     if (ts.isIdentifier(e)) {
-      const recorded = sourceNames.get(e.text);
+      const recorded = sourceOf(e);
       if (recorded) return recorded;
     }
     return "body";
@@ -7653,6 +7834,74 @@ function requestMemberAccesses(params, body, ts, opts = {}) {
 
 // src/map/flows.ts
 var MAX_DEPENDENCY_INPUT_FLOWS_PER_ENDPOINT = 100;
+var MAX_UNPROVEN_FLOWS_PER_ENDPOINT = 200;
+function boundUnprovenFlows(flows, limit) {
+  let unproven = 0;
+  let truncated = false;
+  const kept = flows.filter((f) => {
+    if (isProvenFlow(f.confidence)) return true;
+    if (unproven >= limit) {
+      truncated = true;
+      return false;
+    }
+    unproven++;
+    return true;
+  });
+  return { flows: kept, truncated };
+}
+var Roots = class {
+  constructor(ts) {
+    this.ts = ts;
+  }
+  ts;
+  byDeclaration = /* @__PURE__ */ new Map();
+  add(declaration, root) {
+    if (!this.byDeclaration.has(declaration)) this.byDeclaration.set(declaration, root);
+  }
+  /** The root an identifier occurrence refers to, when its binding is tainted. */
+  get(id) {
+    const declaration = declarationOf(id, this.ts);
+    return declaration === void 0 ? void 0 : this.byDeclaration.get(declaration);
+  }
+};
+function reassignedDeclarations(body, ts) {
+  const out = /* @__PURE__ */ new Set();
+  const target = (n) => {
+    if (!n) return;
+    if (ts.isParenthesizedExpression(n)) return target(n.expression);
+    if (ts.isIdentifier(n)) {
+      const declaration = declarationOf(n, ts);
+      if (declaration !== void 0) out.add(declaration);
+      return;
+    }
+    if (ts.isObjectLiteralExpression(n)) {
+      for (const p of n.properties) {
+        if (ts.isShorthandPropertyAssignment(p)) target(p.name);
+        else if (ts.isPropertyAssignment(p)) target(p.initializer);
+        else if (ts.isSpreadAssignment(p)) target(p.expression);
+      }
+      return;
+    }
+    if (ts.isArrayLiteralExpression(n)) {
+      for (const e of n.elements) target(ts.isSpreadElement(e) ? e.expression : e);
+      return;
+    }
+    if (ts.isBinaryExpression(n) && n.operatorToken.kind === ts.SyntaxKind.EqualsToken) target(n.left);
+  };
+  const visit = (n) => {
+    if (!n) return;
+    if (ts.isBinaryExpression(n) && n.operatorToken.kind >= ts.SyntaxKind.FirstAssignment && n.operatorToken.kind <= ts.SyntaxKind.LastAssignment) {
+      target(n.left);
+    }
+    if ((ts.isPrefixUnaryExpression(n) || ts.isPostfixUnaryExpression(n)) && (n.operator === ts.SyntaxKind.PlusPlusToken || n.operator === ts.SyntaxKind.MinusMinusToken)) {
+      target(n.operand);
+    }
+    if ((ts.isForOfStatement(n) || ts.isForInStatement(n)) && !ts.isVariableDeclarationList(n.initializer)) target(n.initializer);
+    ts.forEachChild(n, visit);
+  };
+  visit(body);
+  return out;
+}
 var ACCESSOR_NAMESPACES = /* @__PURE__ */ new Set(["headers", "cookies"]);
 function spaceOfKey(key) {
   if (key === "query") return "get";
@@ -7665,9 +7914,11 @@ function spaceOfKey(key) {
   return void 0;
 }
 function linkedFlows(body, params, inputs, sinks, ts, invocations = []) {
-  const { flows, limitations, dependencyInputFlows, dependencyInputFlowsTruncated } = linkFlows(body, params, inputs, sinks, ts, invocations);
+  const { flows: linked, limitations, dependencyInputFlows, dependencyInputFlowsTruncated } = linkFlows(body, params, inputs, sinks, ts, invocations);
+  const { flows, truncated } = boundUnprovenFlows(linked, MAX_UNPROVEN_FLOWS_PER_ENDPOINT);
   return {
     flows,
+    ...truncated ? { flowsTruncated: true } : {},
     ...limitations.length > 0 ? { limitations } : {},
     ...dependencyInputFlows.length > 0 ? { dependencyInputFlows } : {},
     ...dependencyInputFlowsTruncated ? { dependencyInputFlowsTruncated: true } : {}
@@ -7678,19 +7929,29 @@ function linkFlows(bodyNode, params, inputs, sinks, ts, invocations) {
     return { flows: [], limitations: [], dependencyInputFlows: [], dependencyInputFlowsTruncated: false };
   }
   const CONTAINER_KEYS = /* @__PURE__ */ new Set([...REQ_SOURCES, "data", "input", "payload"]);
-  const rootPath = /* @__PURE__ */ new Map();
-  const addRoot = (name, path17, space, accessor = false, request = false) => {
-    if (!rootPath.has(name)) rootPath.set(name, { path: path17, space, ...accessor ? { accessor } : {}, ...request ? { request } : {} });
+  const rootPath = new Roots(ts);
+  const reassigned = reassignedDeclarations(bodyNode, ts);
+  const addRoot = (declaration, path17, space, accessor = false, request = false, inherited = false, url = false) => {
+    const changed = inherited || reassigned.has(declaration);
+    rootPath.add(declaration, { path: path17, space, ...accessor ? { accessor } : {}, ...request ? { request } : {}, ...changed ? { reassigned: true } : {}, ...url ? { url } : {} });
   };
   for (const [index, p] of (params ?? []).entries()) {
     if (!p?.name) continue;
-    if (ts.isIdentifier(p.name)) addRoot(p.name.text, "", void 0, false, index === 0);
+    if (ts.isIdentifier(p.name)) addRoot(p.name, "", void 0, false, index === 0);
     else if (ts.isObjectBindingPattern(p.name)) {
       for (const el of p.name.elements) {
         if (!ts.isBindingElement(el) || !ts.isIdentifier(el.name)) continue;
         const key = bindingKey(el, ts);
+        if (index === 0 && key === "request") {
+          addRoot(el.name, "", void 0, false, true);
+          continue;
+        }
+        if (index === 0 && key === "url") {
+          addRoot(el.name, "", void 0, false, false, false, true);
+          continue;
+        }
         const container = key !== void 0 && CONTAINER_KEYS.has(key);
-        addRoot(el.name.text, container ? "" : key ?? el.name.text, container ? spaceOfKey(key) : void 0, container && ACCESSOR_NAMESPACES.has(key));
+        addRoot(el.name, container ? "" : key ?? el.name.text, container ? spaceOfKey(key) : void 0, container && ACCESSOR_NAMESPACES.has(key));
       }
     }
   }
@@ -7698,12 +7959,17 @@ function linkFlows(bodyNode, params, inputs, sinks, ts, invocations) {
     let cur = init;
     while (cur && (ts.isAwaitExpression(cur) || ts.isParenthesizedExpression(cur) || ts.isAsExpression(cur) || ts.isNonNullExpression(cur))) cur = cur.expression;
     if (!cur) return void 0;
+    const params2 = searchParamsOrigin(cur, ts, rootPath);
+    if (params2) return { path: "", space: "get", accessor: true, ...carried(params2) };
+    const url = requestUrlOrigin(cur, ts, rootPath);
+    if (url) return { path: "", url: true, ...carried(url) };
     if (ts.isCallExpression(cur) && ts.isPropertyAccessExpression(cur.expression)) {
       const m = cur.expression.name.text;
       if (["json", "formData", "text"].includes(m)) {
-        const root = rootIdentifier(cur.expression.expression, ts);
-        if (!root || !rootPath.has(root)) return void 0;
-        return m === "formData" ? { path: "", space: "post", accessor: true } : { path: "", space: "post" };
+        const root = rootIdentifierNode(cur.expression.expression, ts);
+        const owner = root ? rootPath.get(root) : void 0;
+        if (!owner) return void 0;
+        return m === "formData" ? { path: "", space: "post", accessor: true, ...carried(owner) } : { path: "", space: "post", ...carried(owner) };
       }
       if (["parse", "safeParse", "validate", "cast"].includes(m)) {
         for (const a of cur.arguments) {
@@ -7719,15 +7985,19 @@ function linkFlows(bodyNode, params, inputs, sinks, ts, invocations) {
     if (ts.isVariableDeclaration(n) && n.initializer) {
       const base = requestReadPath(n.initializer);
       if (base !== void 0) {
-        if (ts.isIdentifier(n.name)) addRoot(n.name.text, base.path, base.space, base.accessor === true);
+        if (ts.isIdentifier(n.name)) addRoot(n.name, base.path, base.space, base.accessor === true, base.request === true, base.reassigned === true, base.url === true);
         else if (ts.isObjectBindingPattern(n.name)) {
           for (const el of n.name.elements) {
             if (!ts.isBindingElement(el) || !ts.isIdentifier(el.name)) continue;
             const key = bindingKey(el, ts);
+            if (base.url === true) {
+              if (key === "searchParams") addRoot(el.name, "", "get", true, false, base.reassigned === true);
+              continue;
+            }
             const namespace = base.request === true && key !== void 0 && REQ_SOURCES.includes(key);
             const container = base.path === "" && key !== void 0 && CONTAINER_KEYS.has(key) && (namespace || !REQ_SOURCES.includes(key));
             const space = base.space ?? (namespace ? spaceOfKey(key) : void 0);
-            addRoot(el.name.text, container ? "" : join22(base.path, key ?? el.name.text), space, namespace && ACCESSOR_NAMESPACES.has(key));
+            addRoot(el.name, container ? "" : join22(base.path, key ?? el.name.text), space, namespace && ACCESSOR_NAMESPACES.has(key), false, base.reassigned === true);
           }
         }
       }
@@ -7762,7 +8032,7 @@ function linkFlows(bodyNode, params, inputs, sinks, ts, invocations) {
           const whole = pathFromTainted(args[i], ts, rootPath) ?? accessorRead(args[i], ts, rootPath);
           for (const read2 of taintedReadPaths(args[i], ts, rootPath)) {
             const key = `${read2.space ?? "*"}:${read2.path}`;
-            const exact = whole !== void 0 && whole.path === read2.path && whole.space === read2.space;
+            const exact = whole !== void 0 && whole.path === read2.path && whole.space === read2.space && whole.reassigned !== true;
             const entry = reads.get(key) ?? { read: read2, roles: /* @__PURE__ */ new Set(), exact: false };
             entry.roles.add(role);
             entry.exact = entry.exact || exact;
@@ -7852,7 +8122,7 @@ function linkFlows(bodyNode, params, inputs, sinks, ts, invocations) {
               kind: invocation.kind,
               resolution: invocation.resolution,
               argumentIndex,
-              argumentUse: whole?.path === read2.path && whole.space === read2.space ? "direct" : "within-expression",
+              argumentUse: whole?.path === read2.path && whole.space === read2.space && whole.reassigned !== true ? "direct" : "within-expression",
               line: site.line,
               start: site.start,
               end: site.end
@@ -7940,9 +8210,9 @@ function taintedReadPaths(node, ts, rootPath, includeDeferredBodies = true) {
         return;
       }
     }
-    if (ts.isIdentifier(n) && rootPath.has(n.text) && isValueRead(n, ts)) {
-      const r = rootPath.get(n.text);
-      if (r.path) add({ path: normalizePath(r.path), space: r.space });
+    const bound = ts.isIdentifier(n) && isValueRead(n, ts) ? rootPath.get(n) : void 0;
+    if (bound) {
+      if (bound.path) add({ path: normalizePath(bound.path), space: bound.space });
     }
     ts.forEachChild(n, visit);
   };
@@ -7968,15 +8238,15 @@ function sinkArgumentLimitations(node, ts, rootPath) {
   const visit = (n) => {
     if (!n) return;
     if (ts.isElementAccessExpression(n)) {
-      const root = rootIdentifier(n.expression, ts);
+      const root = rootIdentifierNode(n.expression, ts);
       const arg = n.argumentExpression;
-      if (root && rootPath.has(root) && arg && !ts.isStringLiteralLike(arg) && !ts.isNumericLiteral(arg)) {
+      if (root && rootPath.get(root) && arg && !ts.isStringLiteralLike(arg) && !ts.isNumericLiteral(arg)) {
         add("dynamic-key", text(n), n);
       }
     }
     if ((ts.isSpreadAssignment?.(n) || ts.isSpreadElement(n)) && n.expression) {
-      const root = rootIdentifier(n.expression, ts);
-      if (root && rootPath.has(root)) add("spread-into-sink", text(n.parent ?? n), n);
+      const root = rootIdentifierNode(n.expression, ts);
+      if (root && rootPath.get(root)) add("spread-into-sink", text(n.parent ?? n), n);
     }
     ts.forEachChild(n, visit);
   };
@@ -7988,16 +8258,66 @@ function accessorRead(node, ts, rootPath) {
   while (cur && (ts.isAwaitExpression(cur) || ts.isParenthesizedExpression(cur) || ts.isNonNullExpression(cur))) cur = cur.expression;
   if (!cur || !ts.isCallExpression(cur) || !ts.isPropertyAccessExpression(cur.expression)) return void 0;
   const [name] = cur.arguments;
-  if (cur.expression.name.text !== "get" || cur.arguments.length !== 1 || !name || !ts.isStringLiteralLike(name)) return void 0;
-  if (!isAccessor(cur.expression.expression, ts, rootPath)) return void 0;
-  return pathFromTainted(cur.expression.expression, ts, rootPath, [name.text]);
+  if (cur.arguments.length !== 1 || !name || !ts.isStringLiteralLike(name)) return void 0;
+  const method = cur.expression.name.text;
+  const receiver = cur.expression.expression;
+  const hono = HONO_ACCESSOR_SPACES[method];
+  if (hono && ts.isPropertyAccessExpression(receiver) && receiver.name.text === "req" && ts.isIdentifier(receiver.expression)) {
+    const context = rootPath.get(receiver.expression);
+    if (context?.request === true) return { path: normalizePath(name.text), space: hono, ...carried(context) };
+  }
+  if (method !== "get") return void 0;
+  const params = ts.isIdentifier(receiver) ? void 0 : searchParamsOrigin(receiver, ts, rootPath);
+  if (params) return { path: normalizePath(name.text), space: "get", ...carried(params) };
+  if (!isAccessor(receiver, ts, rootPath)) return void 0;
+  return pathFromTainted(receiver, ts, rootPath, [name.text]);
+}
+var HONO_ACCESSOR_SPACES = { query: "get", param: "route-param", header: "server" };
+function carried(origin) {
+  return origin.reassigned === true ? { reassigned: true } : {};
+}
+function requestUrlOrigin(node, ts, rootPath) {
+  let cur = node;
+  while (cur && (ts.isParenthesizedExpression(cur) || ts.isNonNullExpression(cur) || ts.isAwaitExpression(cur) || ts.isAsExpression(cur))) cur = cur.expression;
+  if (!cur) return void 0;
+  if (ts.isIdentifier(cur)) {
+    const root = rootPath.get(cur);
+    return root?.url === true ? root : void 0;
+  }
+  const request = (e) => {
+    let inner = e;
+    while (inner && (ts.isParenthesizedExpression(inner) || ts.isNonNullExpression(inner) || ts.isAsExpression(inner))) inner = inner.expression;
+    if (!inner || !ts.isIdentifier(inner)) return void 0;
+    const root = rootPath.get(inner);
+    return root?.request === true ? root : void 0;
+  };
+  if (ts.isPropertyAccessExpression(cur) && cur.name.text === "nextUrl") return request(cur.expression);
+  if (ts.isNewExpression(cur) && isGlobal(cur.expression, "URL", ts)) {
+    const [href] = cur.arguments ?? [];
+    if (!href || !ts.isPropertyAccessExpression(href) || href.name.text !== "url") return void 0;
+    const owner = href.expression;
+    if (ts.isPropertyAccessExpression(owner) && owner.name.text === "req") return request(owner.expression) ?? request(owner);
+    return request(owner);
+  }
+  return void 0;
+}
+function searchParamsOrigin(node, ts, rootPath) {
+  let cur = node;
+  while (cur && (ts.isParenthesizedExpression(cur) || ts.isNonNullExpression(cur) || ts.isAsExpression(cur))) cur = cur.expression;
+  if (!cur) return void 0;
+  if (ts.isIdentifier(cur)) {
+    const root = rootPath.get(cur);
+    return root?.accessor === true && root.space === "get" ? root : void 0;
+  }
+  if (!ts.isPropertyAccessExpression(cur) || cur.name.text !== "searchParams") return void 0;
+  return requestUrlOrigin(cur.expression, ts, rootPath);
 }
 function isAccessor(node, ts, rootPath) {
   let cur = node;
   while (cur && (ts.isParenthesizedExpression(cur) || ts.isNonNullExpression(cur))) cur = cur.expression;
-  if (ts.isIdentifier(cur)) return rootPath.get(cur.text)?.accessor === true;
+  if (ts.isIdentifier(cur)) return rootPath.get(cur)?.accessor === true;
   if (ts.isPropertyAccessExpression(cur) && ACCESSOR_NAMESPACES.has(cur.name.text) && ts.isIdentifier(cur.expression)) {
-    return rootPath.get(cur.expression.text)?.request === true;
+    return rootPath.get(cur.expression)?.request === true;
   }
   return false;
 }
@@ -8023,16 +8343,128 @@ function pathFromTainted(node, ts, rootPath, trailing = []) {
     break;
   }
   if (!cur || !ts.isIdentifier(cur)) return void 0;
-  const base = rootPath.get(cur.text);
-  if (base === void 0) return void 0;
+  const base = rootPath.get(cur);
+  if (base === void 0 || base.url === true) return void 0;
   segs.push(...trailing);
   let space = base.space;
-  if (base.request === true && base.path === "" && segs.length > 1 && REQ_SOURCES.includes(segs[0])) {
-    space = spaceOfKey(segs[0]) ?? space;
+  let namespace;
+  if (base.request === true && base.path === "" && segs.length > 0 && REQ_SOURCES.includes(segs[0])) {
+    namespace = segs[0];
+    space = spaceOfKey(namespace) ?? space;
     segs.shift();
   }
-  const request = base.request === true && segs.length === 0 ? { request: true } : {};
-  return { path: normalizePath([base.path, ...segs].filter(Boolean).join(".")), space, ...request };
+  const request = base.request === true && namespace === void 0 && segs.length === 0 ? { request: true } : {};
+  const accessor = namespace !== void 0 && segs.length === 0 && ACCESSOR_NAMESPACES.has(namespace) ? { accessor: true } : {};
+  const reassigned = base.reassigned === true ? { reassigned: true } : {};
+  return { path: normalizePath([base.path, ...segs].filter(Boolean).join(".")), space, ...request, ...accessor, ...reassigned };
+}
+
+// src/map/module-graph.ts
+import { readFileSync as readFileSync14, realpathSync as realpathSync5, statSync as statSync7 } from "fs";
+import { dirname as dirname8, join as join16, relative as relative5, resolve as resolvePath } from "path";
+var RESOLVE_EXTS = [".ts", ".tsx", ".mts", ".cts", ".js", ".jsx", ".mjs", ".cjs"];
+function createModuleGraph(ts, opts) {
+  const cache = /* @__PURE__ */ new Map();
+  const load = (file) => {
+    if (cache.has(file)) return cache.get(file) ?? null;
+    let entry = null;
+    try {
+      const text = readFileSync14(file, "utf8");
+      const sf = ts.createSourceFile(file, text, ts.ScriptTarget.Latest, true, guessScriptKind(ts, file));
+      const bindings = buildModuleBindings(sf, ts);
+      entry = { fnSinks: collectLocalSinks(sf, ts, bindings).byName, calleesOf: collectCallees(sf, ts), bindings };
+    } catch {
+      entry = null;
+    }
+    cache.set(file, entry);
+    return entry;
+  };
+  const resolveInProject = (fromFile, specifier) => {
+    const target = resolveRelativeModule(fromFile, specifier);
+    if (!target) return void 0;
+    if (!opts.followOutside) {
+      let real = target;
+      try {
+        real = realpathSync5(target);
+      } catch {
+      }
+      if (!isInside(real, opts.boundary)) return void 0;
+    }
+    return target;
+  };
+  return {
+    resolveLocal: resolveInProject,
+    importedSinks(fromFile, specifier, exportName) {
+      const target = resolveInProject(fromFile, specifier);
+      if (!target) return [];
+      const mod = load(target);
+      if (!mod) return [];
+      const collected = [...mod.fnSinks.get(exportName) ?? []];
+      for (const callee of mod.calleesOf.get(exportName) ?? []) {
+        for (const s of mod.fnSinks.get(callee) ?? []) collected.push(s);
+      }
+      const rel = relative5(opts.cwd, target);
+      return collected.map((s) => ({ ...s, file: rel }));
+    },
+    // A different question about the same module: not "what sinks are in there" but "what does this
+    // export TRACE TO". The common AI-built layout puts the client in a lib file —
+    // `export const db = createClient(...)` in `lib/db.ts`, imported everywhere — so the receiver of
+    // `db.from('orders').insert(...)` resolves to a relative specifier and nothing else. Refusing it (as
+    // an unattributable receiver) is right for app code but wrong here: one hop away it is a real
+    // dependency, and that chain is import-to-import, fully static — evidence, not inference.
+    importedBinding(fromFile, specifier, exportName) {
+      const target = resolveInProject(fromFile, specifier);
+      if (!target) return void 0;
+      const mod = load(target);
+      if (!mod) return void 0;
+      const pkg = npmPackageOf(mod.bindings.resolve(exportName));
+      if (pkg === void 0) return void 0;
+      return {
+        package: pkg,
+        origin: mod.bindings.originOf(exportName) ?? "direct",
+        name: mod.bindings.exportNameOf(exportName) ?? exportName
+      };
+    }
+  };
+}
+function resolveRelativeModule(fromFile, spec) {
+  if (!spec.startsWith(".")) return void 0;
+  const dir = dirname8(fromFile);
+  const base = resolvePath(dir, spec);
+  const candidates = [];
+  const jsLike = /\.(js|jsx|mjs|cjs)$/.exec(base);
+  if (jsLike) {
+    const stem = base.slice(0, -jsLike[0].length);
+    for (const e of RESOLVE_EXTS) candidates.push(stem + e);
+  }
+  candidates.push(base);
+  for (const e of RESOLVE_EXTS) candidates.push(base + e);
+  for (const e of RESOLVE_EXTS) candidates.push(join16(base, "index" + e));
+  for (const c of candidates) {
+    try {
+      if (statSync7(c).isFile()) return c;
+    } catch {
+    }
+  }
+  return void 0;
+}
+function collectCallees(sf, ts) {
+  const map = /* @__PURE__ */ new Map();
+  const visit = (node) => {
+    let name;
+    let body;
+    if (ts.isFunctionDeclaration(node) && node.name && node.body) {
+      name = node.name.text;
+      body = node.body;
+    } else if (ts.isVariableDeclaration(node) && ts.isIdentifier(node.name) && node.initializer && isFnLike(node.initializer, ts)) {
+      name = node.name.text;
+      body = node.initializer.body;
+    }
+    if (name && body) map.set(name, localCalls(body, ts));
+    ts.forEachChild(node, visit);
+  };
+  visit(sf);
+  return map;
 }
 
 // src/map/invocations.ts
@@ -8154,6 +8586,7 @@ var HTTP_METHODS = /* @__PURE__ */ new Set(["GET", "POST", "PUT", "PATCH", "DELE
 function extractFromFile(sf, ts, localSinks, bindings, ctx) {
   const out = [];
   const isServerActionsFile = fileHasUseServer(sf, ts);
+  const pagesApi = isPagesApiFile(ctx.owner);
   const visit = (node) => {
     if (ts.isVariableStatement(node) && hasExport(node, ts)) {
       for (const decl of node.declarationList.declarations) {
@@ -8195,6 +8628,12 @@ function extractFromFile(sf, ts, localSinks, bindings, ctx) {
         out.push(handlerEntry(node.name.text, "server-action", node.parameters, node.body, ts, localSinks, bindings, ctx, spanOf(node)));
       }
     }
+    if (pagesApi) {
+      const handler = defaultExportedHandler(node, ts);
+      if (handler) {
+        out.push(handlerEntry(handler.name ?? "default", "default-export", handler.fn.parameters, handler.fn.body, ts, localSinks, bindings, ctx, spanOf(handler.fn)));
+      }
+    }
     if (ts.isCallExpression(node)) {
       const c = node.expression;
       const denoServe = ts.isPropertyAccessExpression(c) && c.name.text === "serve" && ts.isIdentifier(c.expression) && c.expression.text === "Deno";
@@ -8213,7 +8652,7 @@ function extractFromFile(sf, ts, localSinks, bindings, ctx) {
         const first = args[0];
         const route = first && ts.isStringLiteralLike(first) ? first.text : routeFromChain(node.expression.expression, ts);
         const handler = args[args.length - 1];
-        if (route !== void 0 && handler && isFnLike(handler, ts)) {
+        if (route !== void 0 && isRoutePath(route) && handler && isFnLike(handler, ts)) {
           out.push(handlerEntry(route, "route-registration", handler.parameters, handler.body, ts, localSinks, bindings, ctx, {
             // `use`/`all` register handlers but are not HTTP methods — leave method undefined.
             method: HTTP_METHODS.has(mname.toUpperCase()) ? mname.toUpperCase() : void 0,
@@ -8226,7 +8665,7 @@ function extractFromFile(sf, ts, localSinks, bindings, ctx) {
         const arg = node.arguments[0];
         if (arg && ts.isObjectLiteralExpression(arg)) {
           const reg = routeObject(arg, ts);
-          if (reg.url && reg.handler) {
+          if (reg.url && isRoutePath(reg.url) && reg.handler) {
             for (const m of reg.methods.length ? reg.methods : [void 0]) {
               out.push(handlerEntry(reg.url, "route-registration", reg.handler.parameters, reg.handler.body, ts, localSinks, bindings, ctx, { method: m, route: reg.url, ...spanOf(node) }));
             }
@@ -8239,6 +8678,19 @@ function extractFromFile(sf, ts, localSinks, bindings, ctx) {
   visit(sf);
   return out;
 }
+function defaultExportedHandler(node, ts) {
+  const isDefault = (n) => Boolean(n.modifiers?.some((m) => m.kind === ts.SyntaxKind.DefaultKeyword));
+  if (ts.isFunctionDeclaration(node) && hasExport(node, ts) && isDefault(node) && node.body) return { name: node.name?.text, fn: node };
+  if (!ts.isExportAssignment(node) || node.isExportEquals) return void 0;
+  const target = node.expression;
+  if (isFnLike(target, ts)) return { fn: target };
+  if (!ts.isIdentifier(target)) return void 0;
+  const declaration = declarationOf(target, ts);
+  const owner = declaration?.parent;
+  if (owner && ts.isFunctionDeclaration(owner) && owner.body) return { name: target.text, fn: owner };
+  if (owner && ts.isVariableDeclaration(owner) && owner.initializer && isFnLike(owner.initializer, ts)) return { name: target.text, fn: owner.initializer };
+  return void 0;
+}
 function fileHasUseServer(sf, ts) {
   const first = sf.statements?.[0];
   return Boolean(first && ts.isExpressionStatement(first) && ts.isStringLiteralLike(first.expression) && first.expression.text === "use server");
@@ -8254,7 +8706,7 @@ function handlerInvocations(body, ts, bindings, ctx) {
 function handlerEntry(name, kindLabel, params, body, ts, localSinks, bindings, ctx, extra = {}) {
   const entryKind = kindLabel === "route-registration" || kindLabel === "server-action" || kindLabel === "edge-function" ? kindLabel : "route-handler";
   const payloadStyle = kindLabel === "server-action";
-  const inputs = inputsFromHandler(params, body, ts, bindings, {
+  const { inputs, schemaUnresolved } = inputsFromHandler(params, body, ts, bindings, {
     payloadParam: payloadStyle,
     validatorSource: payloadStyle ? "server-fn-data" : "json-body"
   });
@@ -8269,7 +8721,9 @@ function handlerEntry(name, kindLabel, params, body, ts, localSinks, bindings, c
     end: extra.end,
     inputs,
     sinks,
-    ...linkedFlows(body, params, inputs, sinks, ts, handlerInvocations(body, ts, bindings, ctx))
+    ...linkedFlows(body, params, inputs, sinks, ts, handlerInvocations(body, ts, bindings, ctx)),
+    // The handler validates its request with a schema declared in another module: its fields are unknown.
+    ...schemaUnresolved ? { inputsResolved: false } : {}
   };
 }
 
@@ -8528,6 +8982,7 @@ function lineAt(starts, pos) {
 
 // src/map/extract.ts
 var MAX_DEPENDENCY_INPUT_FLOWS_PER_MAP = 500;
+var MAX_UNPROVEN_FLOWS_PER_MAP = 1e3;
 async function extractInputMap(cwd, ts, options = {}) {
   const notes = [];
   const endpoints = [];
@@ -8543,9 +8998,11 @@ async function extractInputMap(cwd, ts, options = {}) {
   const imports = createImportInventory(readPathAliases(cwd));
   const invocations = createInvocationInventory();
   let dependencyInputFlowCount = 0;
+  let unprovenFlowCount = 0;
   let parsed = 0;
   let preFiltered = 0;
   let importScanFailures = 0;
+  let componentFiles = 0;
   let unresolvableImports = 0;
   let sourceBytes = 0;
   const calls = { total: 0, dependency: 0, local: 0, ambiguous: 0 };
@@ -8557,7 +9014,17 @@ async function extractInputMap(cwd, ts, options = {}) {
       const text = readFileSync16(file, "utf8");
       const relFile = relative6(cwd, file);
       sourceBytes += text.length;
-      if (!hasEntrySignal(text)) {
+      if (isComponentFile(file)) {
+        componentFiles++;
+        preFiltered++;
+        const script = componentScript(text, file);
+        const scanned = script === null ? null : scanFileImports(script, ts);
+        if (scanned === null) importScanFailures++;
+        else imports.add(relFile, scanned, false);
+        if (script !== null) unresolvableImports += countUnresolvableImports(script, ts);
+        continue;
+      }
+      if (!hasEntrySignal(text) && !isPagesApiFile(relFile)) {
         preFiltered++;
         const scanned = scanFileImports(text, ts);
         if (scanned === null) importScanFailures++;
@@ -8593,11 +9060,17 @@ async function extractInputMap(cwd, ts, options = {}) {
           ep.dependencyInputFlowsTruncated = true;
         }
         dependencyInputFlowCount += ep.dependencyInputFlows?.length ?? 0;
+        const bounded = boundUnprovenFlows(ep.flows, Math.max(0, MAX_UNPROVEN_FLOWS_PER_MAP - unprovenFlowCount));
+        if (bounded.truncated) {
+          ep.flows = bounded.flows;
+          ep.flowsTruncated = true;
+        }
+        unprovenFlowCount += ep.flows.filter((f) => !isProvenFlow(f.confidence)).length;
         if (ep.route === void 0 && ep.entryKind === "edge-function") {
           const fn = functionNameFromPath(relFile);
           if (fn) ep.route = "/" + fn;
         }
-        if (ep.route === void 0 && (ep.entryKind === "route-handler" || ep.entryKind === "server-action")) {
+        if (ep.route === void 0 && ep.entryKind === "route-handler") {
           const derived = routeFromFilePath(relFile);
           if (derived.route) {
             ep.route = derived.route;
@@ -8648,6 +9121,10 @@ async function extractInputMap(cwd, ts, options = {}) {
   if (truncatedDependencyFlows > 0) {
     notes.push(`${truncatedDependencyFlows} endpoint(s) had more dependency-input links than the bounded map carries; those endpoint records are marked dependencyInputFlowsTruncated.`);
   }
+  const truncatedFlows = endpoints.filter((e) => e.flowsTruncated).length;
+  if (truncatedFlows > 0) {
+    notes.push(`${truncatedFlows} endpoint(s) had more unproven flows than the bounded map carries; those endpoint records are marked flowsTruncated. Every proven flow is kept.`);
+  }
   if (unresolved > 0) {
     notes.push(`${unresolved} endpoint(s) declare an input validator that could not be statically parsed \u2014 their inputs are UNKNOWN, not empty (marked inputsResolved: false).`);
   }
@@ -8655,6 +9132,9 @@ async function extractInputMap(cwd, ts, options = {}) {
   if (heuristicOnly > 0) {
     notes.push(`${heuristicOnly} endpoint(s) have inputs and sinks but no proven data link \u2014 their flows say "may reach", not "does reach" (see each flow's confidence).`);
   }
+  if (componentFiles > 0) {
+    notes.push(`${componentFiles} single-file component(s) (.vue, .svelte, .astro) were scanned for imports only. Code in their script blocks and Astro frontmatter can run on the server, but it is not analyzed for endpoints, inputs or sinks.`);
+  }
   if (endpoints.length === 0) notes.push("No recognized server-side entry points found under the analyzed roots.");
   const importList = imports.list();
   const unmodelled = importList.filter((d) => d.recognizedSinkKinds.length === 0).length;