@suss/packs 0.34.0 → 0.35.0

package/dist/rails.js

@@ -1,22 +1,26 @@
 // ../framework/rails/dist/index.js
-import fs4 from "fs";
-import path4 from "path";
-import { z } from "zod";
+import fs5 from "fs";
+import path5 from "path";
+import { z as z15 } from "zod";
 import { underscoreConstantPath as underscoreConstantPath2 } from "@suss/adapter-ruby";
 import fs from "fs";
 import path from "path";
+import fs2 from "fs";
+import path2 from "path";
 import {
   bodyStatements,
+  children,
   field,
   parseRubySync,
   underscoreConstantPath
 } from "@suss/adapter-ruby";
-import fs2 from "fs";
-import path2 from "path";
 import fs3 from "fs";
 import path3 from "path";
+import fs4 from "fs";
+import path4 from "path";
 import {
   bodyStatements as bodyStatements2,
+  children as children2,
   field as field2,
   hashKeySymbolName,
   nestedStatements,
@@ -24,6 +28,1448 @@ import {
   stringValueOf,
   symbolValue
 } from "@suss/adapter-ruby";
+
+// ../ir-core/dist/chunk-A46EUIKC.js
+import { z as z13 } from "zod";
+import { z as z12 } from "zod";
+import { z } from "zod";
+import { z as z2 } from "zod";
+import { z as z3 } from "zod";
+import { z as z4 } from "zod";
+import { z as z5 } from "zod";
+import { z as z6 } from "zod";
+import { z as z7 } from "zod";
+import { z as z9 } from "zod";
+import { z as z8 } from "zod";
+import { z as z10 } from "zod";
+import { z as z11 } from "zod";
+function gqlIdentityKey(typeName, fieldName) {
+  return `gql:${typeName}.${fieldName}`;
+}
+function fnIdentityKey(packageName, exportPath) {
+  return `fn:${packageName}::${exportPath.join(".")}`;
+}
+function busIdentityKey(messageBus, subject) {
+  return `bus:${messageBus} ${subject}`;
+}
+function unitIdentityKey(deploymentTarget, instanceName) {
+  return `unit:${deploymentTarget} ${instanceName}`;
+}
+function metricIdentityKey(metricSystem, metricType) {
+  return `metric:${metricSystem} ${metricType}`;
+}
+function ioIdentityKey(target) {
+  return `io:${target}`;
+}
+function defineBoundarySemantics(definition) {
+  return definition;
+}
+var FunctionCallSemanticsSchema = z.object({
+  name: z.literal("function-call"),
+  /**
+   * Where the function lives inside this repository. It is either the
+   * name of a module the project lists in `suss.json`, such as
+   * `"billing"`, or a module path, such as the file a server action is
+   * written in. A name has no separator in it and a path always does.
+   * Packs that don't do cross-module pairing can leave it unset.
+   */
+  module: z.string().optional(),
+  /** Named export within the module, when applicable. */
+  exportName: z.string().optional(),
+  /**
+   * Package name, as written in `package.json`, when this identity
+   * refers to a public package export, for example
+   * `"@suss/behavioral-ir"`. Packs that resolve a package's public
+   * surface (the `packageExports` discovery variant) set it alongside
+   * `exportPath`. It is different from `module`, which is a
+   * repo-relative module path used for pairing inside one repo.
+   */
+  package: z.string().optional(),
+  /**
+   * Path to the exported binding within the package, starting with the
+   * sub-path key when one is used. Examples:
+   *   `["parseSummary"]`: a root export
+   *   `["schemas", "BoundaryBindingSchema"]`: the sub-path `./schemas`
+   *
+   * The first segment is the sub-path without the leading `./`, and
+   * `"."` is left out. The last segment is the exported name.
+   */
+  exportPath: z.array(z.string()).optional()
+});
+function isModuleName(module) {
+  return !module.includes("/") && !module.includes("\\");
+}
+var functionCallSemantics = defineBoundarySemantics({
+  name: "function-call",
+  schema: FunctionCallSemanticsSchema,
+  // A call inside the process does not produce a span, and the
+  // conventions have no attributes for it.
+  semconv: {},
+  behavior: {
+    /** A call returns a value, with no status. */
+    exchangesHttpResponses: false,
+    leavesTheProcess: false,
+    reportsUnpairedItself: false,
+    /**
+     * In-repo units such as components have no key on purpose. They
+     * pair through call edges instead of the keyed pass, so a missing
+     * key does not make them unreachable.
+     */
+    canPair: () => true,
+    rewritePaths(semantics, rewrite) {
+      if (semantics.module === void 0 || isModuleName(semantics.module)) {
+        return semantics;
+      }
+      return { ...semantics, module: rewrite(semantics.module) };
+    },
+    /**
+     * `"fn:<package>::<exportPath>"` when both are set, and
+     * `"fn:<module>::<exportName>"` for an in-repo unit that gives its
+     * module, as a server action does. Components and plain handlers
+     * give neither and have no key.
+     */
+    identityKey(semantics) {
+      if (semantics.package !== void 0 && semantics.exportPath !== void 0 && semantics.exportPath.length > 0) {
+        return fnIdentityKey(semantics.package, semantics.exportPath);
+      }
+      if (semantics.module !== void 0 && semantics.exportName !== void 0) {
+        return fnIdentityKey(semantics.module, [semantics.exportName]);
+      }
+      return null;
+    }
+  }
+});
+var GraphqlOperationSemanticsSchema = z2.object({
+  name: z2.literal("graphql-operation"),
+  /** Optional operation name. An anonymous query or mutation leaves it unset. */
+  operationName: z2.string().optional(),
+  operationType: z2.enum(["query", "mutation", "subscription"])
+});
+var graphqlOperationSemantics = defineBoundarySemantics({
+  name: "graphql-operation",
+  schema: GraphqlOperationSemanticsSchema,
+  semconv: {
+    operationName: { name: "graphql.operation.name" },
+    operationType: { name: "graphql.operation.type" }
+  },
+  behavior: {
+    /**
+     * An operation gets a data-and-errors document back, which the
+     * GraphQL contract checker reads. Status codes do not apply.
+     */
+    exchangesHttpResponses: false,
+    leavesTheProcess: true,
+    reportsUnpairedItself: false,
+    identityKey: () => null,
+    /** No key on purpose. The dedicated pass pairs an operation by its document. */
+    canPair: () => true,
+    /** `query GetUser`. Only for display, since the contract checker does the pairing. */
+    displayLabel(semantics) {
+      return `${semantics.operationType} ${semantics.operationName ?? "<anonymous>"}`;
+    }
+  }
+});
+var GraphqlResolverSemanticsSchema = z3.object({
+  name: z3.literal("graphql-resolver"),
+  /**
+   * GraphQL type the resolver attaches to: "Query", "Mutation",
+   * "Subscription", or an object-type name. Null when the source never
+   * says which one, as with a `@Resolver()` class that has no argument.
+   */
+  typeName: z3.string().min(1).nullable(),
+  /** Field name on that type. */
+  fieldName: z3.string()
+});
+var graphqlResolverSemantics = defineBoundarySemantics({
+  name: "graphql-resolver",
+  schema: GraphqlResolverSemanticsSchema,
+  // The conventions describe the operation a client sent. They have no
+  // attribute for the resolver the server ran for one field of it.
+  semconv: {},
+  behavior: {
+    /** A resolver returns a field value, with no status. */
+    exchangesHttpResponses: false,
+    // A resolver runs because a client outside the process sent a query,
+    // even though the server calls it in its own process.
+    leavesTheProcess: true,
+    reportsUnpairedItself: false,
+    /**
+     * `"gql:<TypeName>.<fieldName>"`, or null when the type is null or
+     * the field is empty, which is how a resolver reports that the
+     * source never gave them.
+     */
+    identityKey(semantics) {
+      if (semantics.typeName === null || semantics.fieldName === "") {
+        return null;
+      }
+      return gqlIdentityKey(semantics.typeName, semantics.fieldName);
+    }
+  }
+});
+var IoSemanticsSchema = z4.object({
+  name: z4.literal("io"),
+  /** The stream, such as `stdout` or `stderr`. Null when the source does not say which. */
+  target: z4.string().nullable()
+});
+var ioSemantics = defineBoundarySemantics({
+  name: "io",
+  schema: IoSemanticsSchema,
+  // The semantic conventions have no attribute for a process's own streams.
+  semconv: {},
+  behavior: {
+    exchangesHttpResponses: false,
+    leavesTheProcess: true,
+    reportsUnpairedItself: false,
+    identityKey(semantics) {
+      return semantics.target === null ? null : ioIdentityKey(semantics.target);
+    },
+    // Nothing declares the reading side, so a write has nothing to meet.
+    canPair: () => false
+  }
+});
+function parseChannel(channel) {
+  const hash = channel.indexOf("#");
+  if (hash === -1) {
+    return { bus: null, subject: channel };
+  }
+  return { bus: channel.slice(0, hash), subject: channel.slice(hash + 1) };
+}
+function busesAgree(a, b) {
+  return a === null || b === null || a === b;
+}
+function channelsPair(a, b) {
+  const left = parseChannel(a);
+  const right = parseChannel(b);
+  return left.subject === right.subject && busesAgree(left.bus, right.bus);
+}
+var MessageBusSemanticsSchema = z5.object({
+  name: z5.literal("message-bus"),
+  messageBus: z5.enum([
+    // The conventions write these two AWS buses differently, one with an
+    // underscore and one with a dot. Both are as the conventions give them.
+    "aws_sqs",
+    "aws.sns",
+    "s3",
+    "eventbridge",
+    // A Kinesis stream and a Firehose delivery stream are different
+    // APIs with different destinations, so a stream named `orders` and
+    // a delivery stream named `orders` are not the same channel.
+    "aws_kinesis",
+    "aws_firehose",
+    "gcp_pubsub",
+    "bullmq",
+    "kafka",
+    "nats",
+    "cloudflare-queues",
+    "cloudflare-cron",
+    "cloudflare-tail"
+  ]),
+  /**
+   * A stable channel identifier: a CloudFormation logical id, a queue or
+   * topic name, a subject pattern, or `bus#detailType`. Null when this
+   * source does not say which channel, as with a send whose queue the
+   * code picks at run time, or a receive whose queue is set in the
+   * event-source mapping.
+   */
+  channel: z5.string().min(1).nullable()
+});
+var messageBusSemantics = defineBoundarySemantics({
+  name: "message-bus",
+  schema: MessageBusSemanticsSchema,
+  semconv: {
+    messageBus: { name: "messaging.system" },
+    channel: { name: "messaging.destination.name" }
+  },
+  behavior: {
+    /** A message goes onto the channel and nothing comes back. */
+    exchangesHttpResponses: false,
+    leavesTheProcess: true,
+    /**
+     * `checkMessageBus` reports every channel, unused ones included, so
+     * the generic unmatched list leaves them out.
+     */
+    reportsUnpairedItself: true,
+    /**
+     * A channel that is null here can still pair. The dedicated pass
+     * follows environment variable chains before comparing, so a
+     * consumer whose channel is set at run time meets the template that
+     * declares it.
+     */
+    canPair: () => true,
+    /**
+     * `"bus:<messageBus> <subject>"`, or null when the channel is null
+     * or its subject is empty.
+     *
+     * The key has the subject and leaves out the bus, so a template
+     * writing `default#order.placed` and a handler writing
+     * `order.placed` land in one bucket, where `sidesAgree` compares the
+     * buses. Keying on the bus would separate a side that cannot know
+     * its bus from the side that can.
+     *
+     * The bus technology stays in, because a queue and an event router
+     * are different destinations even with the same subject. Case stays
+     * too, because AWS compares detail-types and queue ids byte for byte.
+     */
+    identityKey(semantics) {
+      if (semantics.channel === null) {
+        return null;
+      }
+      const { subject } = parseChannel(semantics.channel);
+      if (subject === "") {
+        return null;
+      }
+      return busIdentityKey(semantics.messageBus, subject);
+    },
+    sidesAgree(a, b) {
+      if (a.channel === null || b.channel === null) {
+        return false;
+      }
+      return channelsPair(a.channel, b.channel);
+    },
+    /**
+     * The whole channel, bus included, where the identity key has only
+     * the subject. A reader looking at unmatched channels needs to see
+     * which bus each one was on.
+     */
+    displayLabel(semantics) {
+      if (semantics.channel === null) {
+        return `bus:${semantics.messageBus} (channel named at runtime)`;
+      }
+      return `bus:${semantics.messageBus} ${semantics.channel}`;
+    }
+  }
+});
+var MetricSemanticsSchema = z6.object({
+  name: z6.literal("metric"),
+  /** The system the series is stored in, such as `cloud-monitoring` or `cloudwatch`. */
+  metricSystem: z6.string(),
+  /**
+   * The type string the system uses for the metric, written the same
+   * way on both sides. Null when the reader could not work the string
+   * out, as with a query it could not parse. A null type pairs with
+   * nothing, so it cannot pair with an unrelated metric that happens to
+   * share its source text.
+   */
+  metricType: z6.string().nullable()
+});
+var metricSemantics = defineBoundarySemantics({
+  name: "metric",
+  schema: MetricSemanticsSchema,
+  // OpenTelemetry identifies a metric by its instrument name. It has no
+  // attribute for the metric's system or its type string.
+  semconv: {},
+  behavior: {
+    exchangesHttpResponses: false,
+    leavesTheProcess: true,
+    reportsUnpairedItself: false,
+    identityKey(semantics) {
+      if (semantics.metricType === null) {
+        return null;
+      }
+      return metricIdentityKey(semantics.metricSystem, semantics.metricType);
+    }
+  }
+});
+var HOLE_SPLIT = /(\{[^}]*\})/;
+function isHole(piece) {
+  return piece.startsWith("{") && piece.endsWith("}");
+}
+function parseBoundaryName(name) {
+  const parts = name.split(HOLE_SPLIT).filter((piece) => piece !== "").map(
+    (piece) => isHole(piece) ? { type: "hole", label: piece.slice(1, -1) } : { type: "text", text: piece }
+  );
+  const only = parts.length === 1 ? parts[0] : void 0;
+  if (only !== void 0 && only.type === "hole") {
+    return { type: "reference", path: only.label.split(".") };
+  }
+  if (parts.some((part) => part.type === "hole")) {
+    return { type: "pattern", parts };
+  }
+  return { type: "literal", value: name };
+}
+function patternHole(label) {
+  return `{${label}}`;
+}
+function namesNothing(name) {
+  return parseBoundaryName(name).type === "reference";
+}
+function referenceOf(name) {
+  if (name.type !== "reference") {
+    return null;
+  }
+  const root = name.path[0];
+  if (root === void 0 || name.path.some((part) => part === "")) {
+    return null;
+  }
+  return { root, fields: name.path.slice(1) };
+}
+function referenceFromName(name) {
+  return referenceOf(parseBoundaryName(name));
+}
+var SCHEME_ORIGIN = /^[a-zA-Z][a-zA-Z\d+.-]*:\/\/[^/]*/;
+var PROTOCOL_RELATIVE_ORIGIN = /^\/\/[^/]*/;
+function pathAfterOrigin(text) {
+  const withoutOrigin = text.replace(SCHEME_ORIGIN, "").replace(PROTOCOL_RELATIVE_ORIGIN, "");
+  const cut = withoutOrigin.search(/[?#]/);
+  return cut === -1 ? withoutOrigin : withoutOrigin.slice(0, cut);
+}
+var PRIVATE_SUFFIXES = [
+  "local",
+  "internal",
+  "localhost",
+  "lan",
+  "home.arpa",
+  "svc",
+  "test",
+  "example",
+  "invalid",
+  "example.com",
+  "example.net",
+  "example.org"
+];
+var PRIVATE_IPV4 = /^(?:127\.|10\.|192\.168\.|169\.254\.|172\.(?:1[6-9]|2\d|3[01])\.|0\.0\.0\.0$)/;
+function hostnameOf(host) {
+  const lower = host.toLowerCase();
+  const name = lower.startsWith("[") ? lower.slice(0, lower.indexOf("]") + 1) : lower.split(":")[0] ?? lower;
+  return name.replace(/\.$/, "");
+}
+function hostCanBeOwn(host) {
+  const name = hostnameOf(host);
+  if (name === "[::1]" || /^\[f[cd]/.test(name) || PRIVATE_IPV4.test(name)) {
+    return true;
+  }
+  if (!name.includes(".")) {
+    return true;
+  }
+  return PRIVATE_SUFFIXES.some(
+    (suffix) => name === suffix || name.endsWith(`.${suffix}`)
+  );
+}
+var UNSPELLABLE_OPTION = /[()|?#{}]/;
+function setPiece(options) {
+  if (options.some((option) => UNSPELLABLE_OPTION.test(option))) {
+    return null;
+  }
+  return `(${options.join("|")})`;
+}
+var ONE = { kind: "one" };
+var OPTIONAL = { kind: "optional" };
+var STAR = { kind: "star" };
+var HOLE_SEGMENT = /^\{[^{}]*?([?+*]?)\}$/;
+var SET_PIECE = /\(([^()]*)\)/;
+var ALTERNATIVE_CAP = 64;
+function alternativesOf(path6) {
+  let alternatives = [path6];
+  for (; ; ) {
+    const next = [];
+    let expanded = false;
+    for (const alternative of alternatives) {
+      const set = SET_PIECE.exec(alternative);
+      if (set === null || set.index === void 0) {
+        next.push(alternative);
+        continue;
+      }
+      expanded = true;
+      const head = alternative.slice(0, set.index);
+      const tail = alternative.slice(set.index + set[0].length);
+      for (const option of (set[1] ?? "").split("|")) {
+        next.push(head + option + tail);
+      }
+    }
+    if (!expanded) {
+      return alternatives;
+    }
+    if (next.length > ALTERNATIVE_CAP) {
+      return [path6.replace(new RegExp(SET_PIECE, "g"), "{value}")];
+    }
+    alternatives = next;
+  }
+}
+var HOLE_RANGE_ITEMS = {
+  "": [ONE],
+  "?": [OPTIONAL],
+  "+": [ONE, STAR],
+  "*": [STAR]
+};
+function escapedForRegex(text) {
+  return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function shapedItem(segment) {
+  const source = segment.split(/(\{[^}]*\}|\*)/g).map((part) => {
+    if (part === "*") {
+      return ".*";
+    }
+    if (part.startsWith("{")) {
+      return /[?*]\}$/.test(part) ? "[^/]*" : "[^/]+";
+    }
+    return escapedForRegex(part);
+  }).join("");
+  const holes = segment.match(/\{[^}]*\}|\*/g) ?? [];
+  const text = segment.replace(/\{[^}]*\}|\*/g, "");
+  return {
+    kind: "shaped",
+    shape: segment.replace(/\{[^}]*\}/g, "{}"),
+    test: new RegExp(`^${source}$`),
+    bare: holes.every((hole) => hole === "*" || /[?*]\}$/.test(hole)) ? text : null,
+    textLength: text.length
+  };
+}
+function itemsOf(segment) {
+  if (segment === "*") {
+    return [STAR];
+  }
+  const hole = HOLE_SEGMENT.exec(segment);
+  if (hole !== null) {
+    return HOLE_RANGE_ITEMS[hole[1] ?? ""] ?? [ONE];
+  }
+  if (segment.includes("{") || segment.includes("*")) {
+    return [shapedItem(segment)];
+  }
+  return [{ kind: "text", text: segment }];
+}
+function segmentsOf(alternative) {
+  const trimmed = alternative.startsWith("/") ? alternative.slice(1) : alternative;
+  return trimmed === "" ? [] : trimmed.split("/");
+}
+function patternSegmentsOf(alternative) {
+  const segments = segmentsOf(alternative);
+  const first = segments[0];
+  const opensWithBaseUrl = !alternative.startsWith("/") && first !== void 0 && HOLE_SEGMENT.test(first);
+  return opensWithBaseUrl ? segments.slice(1) : segments;
+}
+function pathAfterBaseUrl(path6) {
+  const segments = segmentsOf(path6);
+  const first = segments[0];
+  if (path6.startsWith("/") || first === void 0 || segments.length < 2 || !HOLE_SEGMENT.test(first)) {
+    return path6;
+  }
+  return `/${segments.slice(1).join("/")}`;
+}
+var PATTERNS = /* @__PURE__ */ new Map();
+var PATTERN_CACHE_LIMIT = 5e4;
+function patternOf(path6) {
+  const known = PATTERNS.get(path6);
+  if (known !== void 0) {
+    return known;
+  }
+  const pattern = alternativesOf(path6).map(
+    (alternative) => patternSegmentsOf(alternative).flatMap(itemsOf)
+  );
+  if (PATTERNS.size >= PATTERN_CACHE_LIMIT) {
+    PATTERNS.clear();
+  }
+  PATTERNS.set(path6, pattern);
+  return pattern;
+}
+function literalItemsOf(path6) {
+  return segmentsOf(path6).map((text) => ({ kind: "text", text }));
+}
+function absorbsAnything(item) {
+  return item.kind === "one" || item.kind === "optional" || item.kind === "star";
+}
+function meetOnOneSegment(a, b) {
+  if (absorbsAnything(a) || absorbsAnything(b)) {
+    return true;
+  }
+  if (a.kind === "text" && b.kind === "text") {
+    return a.text === b.text;
+  }
+  if (a.kind === "text" && b.kind === "shaped") {
+    return b.test.test(a.text);
+  }
+  if (a.kind === "shaped" && b.kind === "text") {
+    return a.test.test(b.text);
+  }
+  return a.kind === "shaped" && b.kind === "shaped" && a.shape === b.shape;
+}
+function skippable(item) {
+  return item.kind === "optional" || item.kind === "star";
+}
+function itemsMeet(a, b) {
+  const width = b.length + 1;
+  const seen = new Uint8Array((a.length + 1) * width);
+  const queue = [0];
+  seen[0] = 1;
+  const visit = (i, j) => {
+    const at = i * width + j;
+    if (seen[at] === 0) {
+      seen[at] = 1;
+      queue.push(at);
+    }
+  };
+  while (queue.length > 0) {
+    const at = queue.pop();
+    const i = Math.floor(at / width);
+    const j = at % width;
+    if (i === a.length && j === b.length) {
+      return true;
+    }
+    const left = a[i];
+    const right = b[j];
+    if (left !== void 0 && skippable(left)) {
+      visit(i + 1, j);
+    }
+    if (right !== void 0 && skippable(right)) {
+      visit(i, j + 1);
+    }
+    if (left !== void 0 && right !== void 0) {
+      if (meetOnOneSegment(left, right)) {
+        visit(
+          left.kind === "star" ? i : i + 1,
+          right.kind === "star" ? j : j + 1
+        );
+      }
+    }
+  }
+  return false;
+}
+function pathsMeet(a, b) {
+  const left = patternOf(a);
+  const right = patternOf(b);
+  return left.some((one) => right.some((other) => itemsMeet(one, other)));
+}
+function patternAdmits(declared, request) {
+  const literal = literalItemsOf(request);
+  return patternOf(declared).some((items) => itemsMeet(items, literal));
+}
+function pathSpansShapes(path6) {
+  return /\{[^{}]*[?+*]\}|\(|(?:^|\/)\*(?:\/|$)/.test(path6);
+}
+function countOf(items, kinds) {
+  return items.filter((item) => kinds.includes(item.kind)).length;
+}
+function readingSpecificity(items) {
+  return [
+    countOf(items, ["text"]),
+    countOf(items, ["shaped"]),
+    -countOf(items, ["optional", "star"])
+  ];
+}
+function segmentFit(route, request) {
+  if (!meetOnOneSegment(route, request)) {
+    return "apart";
+  }
+  if (request.kind === "text") {
+    if (route.kind === "text") {
+      return "stated";
+    }
+    return route.kind === "shaped" ? "shaped" : "free";
+  }
+  if (absorbsAnything(route)) {
+    return "free";
+  }
+  if (request.kind !== "shaped") {
+    return "guess";
+  }
+  if (route.kind === "shaped") {
+    return "free";
+  }
+  return route.kind === "text" && request.bare === route.text ? "stated" : "guess";
+}
+function shapedText(item) {
+  return item.kind === "shaped" ? item.textLength : 0;
+}
+function betterFit(a, b) {
+  return a === void 0 || compareRanks(b, a) > 0;
+}
+function bestFit(route, request) {
+  const width = request.length + 1;
+  const best = new Array((route.length + 1) * width);
+  best[0] = [0, 0];
+  const offer = (i, j, fit) => {
+    const at = i * width + j;
+    if (betterFit(best[at], fit)) {
+      best[at] = fit;
+    }
+  };
+  for (let reached = 0; reached <= route.length + request.length; reached += 1) {
+    for (let i = Math.max(0, reached - request.length); i <= Math.min(route.length, reached); i += 1) {
+      const j = reached - i;
+      const fit = best[i * width + j];
+      if (fit === void 0) {
+        continue;
+      }
+      const left = route[i];
+      const right = request[j];
+      if (left !== void 0 && skippable(left)) {
+        offer(i + 1, j, fit);
+      }
+      if (right !== void 0 && skippable(right)) {
+        offer(i, j + 1, fit);
+      }
+      if (left === void 0 || right === void 0) {
+        continue;
+      }
+      if (left.kind === "star" && right.kind === "star") {
+        continue;
+      }
+      const kind = segmentFit(left, right);
+      if (kind === "apart" || kind === "guess") {
+        continue;
+      }
+      offer(
+        left.kind === "star" ? i : i + 1,
+        right.kind === "star" ? j : j + 1,
+        [
+          fit[0] + (kind === "stated" ? 1 : 0),
+          fit[1] + (kind === "shaped" ? shapedText(left) : 0)
+        ]
+      );
+    }
+  }
+  return best[route.length * width + request.length] ?? null;
+}
+function requestRank(route, request) {
+  let found = null;
+  for (const routeItems of patternOf(route)) {
+    for (const requestItems of patternOf(request)) {
+      const fit = bestFit(routeItems, requestItems);
+      const rank = fit === null ? null : [...fit, ...readingSpecificity(routeItems)];
+      if (rank !== null && (found === null || compareRanks(rank, found) > 0)) {
+        found = rank;
+      }
+    }
+  }
+  return found;
+}
+function isCatchAll(route) {
+  return patternOf(route).some(
+    (items) => items.length > 0 && items.every(absorbsAnything) && items.some((item) => item.kind === "star")
+  );
+}
+function compareRanks(a, b) {
+  const length = Math.max(a.length, b.length);
+  for (let index = 0; index < length; index += 1) {
+    const difference = (a[index] ?? 0) - (b[index] ?? 0);
+    if (difference !== 0) {
+      return difference;
+    }
+  }
+  return 0;
+}
+var RestSemanticsSchema = z7.object({
+  name: z7.literal("rest"),
+  /**
+   * Uppercase HTTP method ("GET", "POST", …), `"*"` for a handler that
+   * responds to every method, or null when this source does not say
+   * which method.
+   */
+  method: z7.string().min(1).nullable(),
+  /** Normalized route path ("/users/{id}"), or null when this source does not give one. */
+  path: z7.string().min(1).nullable(),
+  /**
+   * Status codes the producing source declared explicitly, such as
+   * OpenAPI responses or CloudFormation MethodResponses. They are kept
+   * here so the pairing layer can see them without unwrapping any
+   * metadata. Absent or empty for an inferred source.
+   */
+  declaredResponses: z7.array(z7.number()).optional(),
+  /**
+   * The host a client wrote in an absolute URL, with its port
+   * (`api.example.com:8443`). A piece suss could not read is written
+   * `{name}`. Absent for a relative URL and for a route.
+   */
+  host: z7.string().min(1).optional(),
+  /**
+   * True for a route the framework also serves with `.{format}` after
+   * its path, the way Rails serves `/search.json` from `get "search"`.
+   */
+  optionalFormat: z7.boolean().optional()
+});
+var OPENING_HOLE = /^\{([^{}]+)\}(.*)$/;
+function baseUrlReference(semantics) {
+  const label = OPENING_HOLE.exec(semantics.path ?? "")?.[1];
+  return label === void 0 ? null : referenceFromName(patternHole(label));
+}
+function normalizePath(path6) {
+  let normalized = withoutParameterConstraints(path6).replace(
+    /:([a-zA-Z_]\w*)([?+*]?)/g,
+    "{$1$2}"
+  );
+  if (normalized.length > 1 && normalized.endsWith("/")) {
+    normalized = normalized.slice(0, -1);
+  }
+  normalized = normalized.replace(
+    /\{[^}]+\}|[^{]+/g,
+    (segment) => segment.startsWith("{") ? segment : segment.toLowerCase()
+  );
+  return normalized;
+}
+function withoutParameterConstraints(path6) {
+  let out = "";
+  let i = 0;
+  while (i < path6.length) {
+    const name = /^:[a-zA-Z_]\w*\(/.exec(path6.slice(i));
+    if (name === null) {
+      out += path6[i];
+      i += 1;
+      continue;
+    }
+    const open = i + name[0].length - 1;
+    const close = closingParenthesis(path6, open);
+    if (close === -1) {
+      return out + path6.slice(i);
+    }
+    out += path6.slice(i, open);
+    i = close + 1;
+  }
+  return out;
+}
+function closingParenthesis(text, open) {
+  let depth = 0;
+  for (let i = open; i < text.length; i += 1) {
+    const char = text[i];
+    if (char === "\\") {
+      i += 1;
+      continue;
+    }
+    if (char === "(") {
+      depth += 1;
+    }
+    if (char === ")") {
+      depth -= 1;
+      if (depth === 0) {
+        return i;
+      }
+    }
+  }
+  return -1;
+}
+function pathShape(path6) {
+  return normalizePath(path6).replace(/\{[^{}]*?([?+*]?)\}/g, "{$1}");
+}
+function methodsAgree(a, b) {
+  if (a === null || b === null) {
+    return false;
+  }
+  return a === b || a === "*" || b === "*";
+}
+function routePathAdmits(declaredPath, requestPath) {
+  return patternAdmits(normalizePath(declaredPath), normalizePath(requestPath));
+}
+function readHost(semantics) {
+  const host = semantics.host;
+  return host === void 0 || /[{(]/.test(host) ? void 0 : host;
+}
+function hostsAgree(a, b) {
+  return readHost(a) === readHost(b);
+}
+function hostUnread(semantics) {
+  if (semantics.host !== void 0) {
+    return readHost(semantics) === void 0;
+  }
+  return baseUrlReference(semantics) !== null;
+}
+function servedPath(semantics, path6) {
+  const normalized = normalizePath(path6);
+  return semantics.optionalFormat === true ? `${normalized}(|.{format})` : normalized;
+}
+function withoutHost(semantics) {
+  const { host: _host, ...rest } = semantics;
+  return rest;
+}
+function groundedBaseUrl(semantics, deployment) {
+  const reference = baseUrlReference(semantics);
+  if (reference === null) {
+    return null;
+  }
+  const base = deployment.setTo(reference);
+  if (base === null) {
+    return null;
+  }
+  const rest = OPENING_HOLE.exec(semantics.path ?? "")?.[2] ?? "";
+  const grounded = pathAfterOrigin(`${base}${rest}`);
+  return { ...semantics, path: grounded === "" ? "/" : grounded };
+}
+var restSemantics = defineBoundarySemantics({
+  name: "rest",
+  schema: RestSemanticsSchema,
+  semconv: {
+    // A span states the one method a request used, so a route that
+    // responds to every method has nothing to compare.
+    method: { name: "http.request.method", placeholderValues: ["*"] },
+    path: { name: "http.route" }
+    // declaredResponses is a list, and http.response.status_code is
+    // the one status a request got back.
+  },
+  behavior: {
+    /** A request goes out, a status and a body come back. */
+    exchangesHttpResponses: true,
+    leavesTheProcess: true,
+    reportsUnpairedItself: false,
+    /** `"METHOD /normalized/path"`, or null when either half is missing. */
+    identityKey(semantics) {
+      if (semantics.method === null || semantics.path === null) {
+        return null;
+      }
+      return `${semantics.method.toUpperCase()} ${normalizePath(semantics.path)}`;
+    },
+    /**
+     * The bucket has only the path, so a `"*"` route lands with the
+     * consumers that each give a method, and `methodsAgree` compares the
+     * methods inside the bucket. The identity key is still what a reader
+     * sees and what a suppression targets ("GET /users", "* /users").
+     *
+     * Parameter names are dropped too. A hand-written spec writes
+     * `{userId}` where the Express route that serves it writes `:id`,
+     * and both match the same requests. Pairing on the name would leave
+     * two boundaries that never meet.
+     */
+    pairingKey(semantics) {
+      if (semantics.method === null || semantics.path === null) {
+        return null;
+      }
+      const shape = pathShape(pathAfterBaseUrl(normalizePath(semantics.path)));
+      const host = readHost(semantics);
+      return host === void 0 ? `rest ${shape}` : `rest //${host}${shape}`;
+    },
+    /**
+     * A spec writes `/teams/{team_id}` where the route that serves it
+     * writes `/teams/:id`. The method stays in, so a `"*"` handler is
+     * never compared with the document for one method.
+     */
+    operationKey(semantics) {
+      if (semantics.method === null || semantics.path === null) {
+        return null;
+      }
+      return `${semantics.method.toUpperCase()} ${pathShape(semantics.path)}`;
+    },
+    sidesAgree(a, b) {
+      return methodsAgree(a.method, b.method) && hostsAgree(a, b);
+    },
+    spansBuckets(semantics) {
+      return semantics.path !== null && (semantics.optionalFormat === true || pathSpansShapes(normalizePath(semantics.path)));
+    },
+    bucketsMeet(a, b) {
+      return a.path !== null && b.path !== null && hostsAgree(a, b) && pathsMeet(servedPath(a, a.path), servedPath(b, b.path));
+    },
+    /**
+     * A catch-all route never takes a call whose host suss could not
+     * read, since nothing else ties that call to this app.
+     */
+    pairRank(provider, consumer) {
+      if (provider.path === null || consumer.path === null) {
+        return [];
+      }
+      const route = normalizePath(provider.path);
+      if (hostUnread(consumer) && isCatchAll(route)) {
+        return null;
+      }
+      return requestRank(
+        servedPath(provider, provider.path),
+        normalizePath(consumer.path)
+      );
+    },
+    /**
+     * The identity key, with a missing half still readable: `ANY` when
+     * the source gave no method, and `?` when it gave no path. Null when
+     * both are missing, since then there is nothing to show.
+     */
+    displayLabel(semantics) {
+      if (semantics.method === null && semantics.path === null) {
+        return null;
+      }
+      const method = semantics.method === null ? "ANY" : semantics.method.toUpperCase();
+      const path6 = semantics.path === null ? "?" : normalizePath(semantics.path);
+      return `${method} ${path6}`;
+    },
+    /**
+     * With both halves present, the method goes through `methodsAgree`
+     * (so a `"*"` route matches every method) and the path through
+     * `routePathAdmits`. A route missing either half might still handle
+     * the request, and this declaration cannot settle that, so the
+     * result is `"unknown"`.
+     */
+    servesRequest(semantics, method, path6) {
+      if (semantics.method === null || semantics.path === null) {
+        return "unknown";
+      }
+      if (!methodsAgree(semantics.method, method.toUpperCase())) {
+        return "nomatch";
+      }
+      return routePathAdmits(semantics.path, path6) ? "match" : "nomatch";
+    },
+    /**
+     * A route the registration pattern admits is inside it. A route
+     * without a path counts as outside, because nothing shows that the
+     * pattern covers it.
+     */
+    withinScope(semantics, scope) {
+      return semantics.path !== null && routePathAdmits(scope, semantics.path);
+    },
+    /**
+     * A call whose base URL the deployment fills in, resolved to the
+     * path it reaches, and a call to a host that can be the project's
+     * own, with the host left out so it meets the route.
+     *
+     * The source cannot settle a base URL on its own, so the adapter
+     * leaves the hole in. `API_BASE` could be `http://backend.internal`,
+     * and then the path is `/orders`. It could equally be `/api/v2`, and
+     * then the path is `/api/v2/orders`. Filling in the deployed value
+     * and reading the path back out gets the right one either way, and
+     * a base the deployment sets counts as the app's own.
+     */
+    /** A listed host matches with or without the port the call gives. */
+    withoutOwnHost(semantics, ownHosts) {
+      const host = semantics.host?.toLowerCase();
+      if (host === void 0) {
+        return null;
+      }
+      return ownHosts.has(host) || ownHosts.has(host.replace(/:\d+$/, "")) ? withoutHost(semantics) : null;
+    },
+    groundName(semantics, deployment) {
+      const based = groundedBaseUrl(semantics, deployment);
+      const grounded = based ?? semantics;
+      const host = readHost(grounded);
+      return host !== void 0 && hostCanBeOwn(host) ? withoutHost(grounded) : based;
+    },
+    nameReference: baseUrlReference,
+    ruleBoundary: {
+      // "METHOD /path": one token, a space, then an absolute path.
+      claims(raw) {
+        return /^\S+ +\//.test(raw.trim());
+      },
+      normalize(raw) {
+        const trimmed = raw.trim();
+        const spaceIdx = trimmed.indexOf(" ");
+        const method = trimmed.slice(0, spaceIdx).toUpperCase();
+        return `${method} ${normalizePath(trimmed.slice(spaceIdx + 1).trim())}`;
+      }
+    }
+  }
+});
+var DeployableUnitSchema = z8.object({
+  deploymentTarget: z8.enum([
+    "lambda",
+    "ecs-task",
+    "container",
+    "k8s-deployment",
+    "worker"
+  ]),
+  // An empty name would agree with every other empty name, so a unit
+  // with no name has to leave the field off instead.
+  instanceName: z8.string().min(1)
+});
+var RuntimeConfigSemanticsSchema = DeployableUnitSchema.partial({
+  deploymentTarget: true,
+  instanceName: true
+}).extend({
+  name: z9.literal("runtime-config")
+});
+var runtimeConfigSemantics = defineBoundarySemantics({
+  name: "runtime-config",
+  schema: RuntimeConfigSemanticsSchema,
+  // service.name and cloud.resource_id identify the same deployable, but
+  // instanceName is the template's logical id, a different string from
+  // both.
+  semconv: {},
+  behavior: {
+    /** A process reads its config at startup, and nothing replies. */
+    exchangesHttpResponses: false,
+    // Whoever deploys the process puts the value there, so the value
+    // comes from outside the code.
+    leavesTheProcess: true,
+    reportsUnpairedItself: false,
+    identityKey: () => null,
+    // A reader sees which deployable's environment this is. Code that
+    // reads a variable does not say which deployable runs it, so a read
+    // has no name.
+    displayLabel(semantics) {
+      const instance = semantics.instanceName;
+      return instance === void 0 ? null : `runtime-config:${instance}`;
+    }
+  }
+});
+var StorageSemanticsSchema = z10.object({
+  name: z10.literal("storage"),
+  /**
+   * The storage system: an OpenTelemetry value such as `postgresql` or
+   * `aws.dynamodb`, or suss's own word for one the conventions do not
+   * cover, such as `s3`. Null when the reader could not work out which
+   * system the source uses. Two products' containers can share a name,
+   * and this field keeps them apart. The pairing pass decides how to
+   * treat a null.
+   */
+  storageSystem: z10.string().nullable(),
+  /**
+   * The ORM, schema, or deployment scope. A single-database setup uses
+   * `"default"`, and a monorepo with several schemas gives each one its
+   * own value.
+   */
+  scope: z10.string(),
+  /**
+   * The table, bucket, collection or index, as the source declares it.
+   * Null when the reader could not work out the container, and a null
+   * container pairs with nothing, so it cannot match by accident of
+   * shared source text. The string uses the boundary-name syntax (a
+   * literal, a pattern with `{}` holes, or a reference), and only
+   * `parseBoundaryName` should read it.
+   */
+  container: z10.string().nullable(),
+  /**
+   * A secondary way into the container, such as a DynamoDB global
+   * secondary index or an Elasticsearch alias, each with its own key
+   * fields. Null means the container's primary key. A query through an
+   * index and a query through the table are different accesses, so
+   * they pair separately.
+   */
+  accessPath: z10.string().nullable()
+});
+function containerReference(semantics) {
+  return semantics.container === null ? null : referenceFromName(semantics.container);
+}
+var storageSemantics = defineBoundarySemantics({
+  name: "storage",
+  schema: StorageSemanticsSchema,
+  semconv: {
+    storageSystem: { name: "db.system.name" },
+    // suss writes "default" when the source did not say which database.
+    scope: { name: "db.namespace", placeholderValues: ["default"] },
+    container: { name: "db.collection.name" }
+    // The conventions have no attribute for a secondary index, so
+    // accessPath is left out.
+  },
+  behavior: {
+    /** A query returns rows or items, with no status. */
+    exchangesHttpResponses: false,
+    leavesTheProcess: true,
+    reportsUnpairedItself: false,
+    identityKey: () => null,
+    displayLabel: storageLabel,
+    /**
+     * A container the source gives as a variable is whatever the
+     * deployment sets that variable to. `{SUBSCRIBERS_TABLE}` in the
+     * code and `prod-subscribers-v1` in the manifest are one table.
+     */
+    groundName(semantics, deployment) {
+      const reference = containerReference(semantics);
+      if (reference === null) {
+        return null;
+      }
+      const name = deployment.setTo(reference);
+      return name === null ? null : { ...semantics, container: name };
+    },
+    nameReference: containerReference
+  }
+});
+function storageLabel(semantics) {
+  return `${storageSystemLabel(semantics)}:${storageContainerLabel(semantics)}`;
+}
+function storageSystemLabel(semantics) {
+  return semantics.storageSystem ?? UNKNOWN_ENGINE;
+}
+var UNKNOWN_ENGINE = "<unknown engine>";
+function storageContainerLabel(semantics) {
+  const container = semantics.container ?? "<unnamed container>";
+  const addressed = semantics.accessPath === null ? container : `${container}#${semantics.accessPath}`;
+  return semantics.scope === "default" ? addressed : `${semantics.scope}/${addressed}`;
+}
+var UnitInvocationSemanticsSchema = DeployableUnitSchema.extend({
+  name: z11.literal("unit-invocation"),
+  instanceName: DeployableUnitSchema.shape.instanceName.nullable()
+});
+function calleeReference(semantics) {
+  return semantics.instanceName === null ? null : referenceFromName(semantics.instanceName);
+}
+var unitInvocationSemantics = defineBoundarySemantics({
+  name: "unit-invocation",
+  schema: UnitInvocationSemanticsSchema,
+  // faas.name is the deployed function's own name and instanceName is
+  // the deployment template's logical id, which is a different string.
+  // Runtime config leaves the pair off for the same reason.
+  semconv: {},
+  behavior: {
+    /**
+     * A synchronous invoke gives back whatever the handler returned,
+     * which is a value rather than a status and a body. A handler's
+     * return only becomes an HTTP response under a proxy integration,
+     * and that route gets a REST binding instead of this one.
+     */
+    exchangesHttpResponses: false,
+    leavesTheProcess: true,
+    /**
+     * A unit nothing in the run invokes is the ordinary case, since
+     * most services are reached from a stack suss never read. So an
+     * uninvoked unit stays in the generic unmatched list rather than
+     * being reported as a problem here.
+     */
+    reportsUnpairedItself: false,
+    /**
+     * A callee the source gives only as a variable has no name until the
+     * deployment fills it in. It gets no key, since a key built from the
+     * variable would pair only with itself.
+     */
+    identityKey(semantics) {
+      if (semantics.instanceName === null || namesNothing(semantics.instanceName)) {
+        return null;
+      }
+      return unitIdentityKey(
+        semantics.deploymentTarget,
+        semantics.instanceName
+      );
+    },
+    displayLabel(semantics) {
+      if (semantics.instanceName === null) {
+        return `unit:${semantics.deploymentTarget} (named at runtime)`;
+      }
+      return unitIdentityKey(
+        semantics.deploymentTarget,
+        semantics.instanceName
+      );
+    },
+    /**
+     * A call that reads its callee's name from the environment reaches
+     * whichever resource the template wires that variable to. The name
+     * is grounded to the logical id and not the deployed name, because
+     * the invoked unit's own summary is keyed by the logical id.
+     */
+    groundName(semantics, deployment) {
+      const reference = calleeReference(semantics);
+      if (reference === null) {
+        return null;
+      }
+      const logicalId = deployment.pointsAt(reference);
+      return logicalId === null ? null : { ...semantics, instanceName: logicalId };
+    },
+    nameReference: calleeReference
+  }
+});
+var SemanticsSchema = z12.discriminatedUnion("name", [
+  restSemantics.schema,
+  functionCallSemantics.schema,
+  graphqlResolverSemantics.schema,
+  graphqlOperationSemantics.schema,
+  runtimeConfigSemantics.schema,
+  storageSemantics.schema,
+  messageBusSemantics.schema,
+  metricSemantics.schema,
+  unitInvocationSemantics.schema,
+  ioSemantics.schema
+]);
+var DEFINITIONS = [
+  restSemantics,
+  functionCallSemantics,
+  graphqlResolverSemantics,
+  graphqlOperationSemantics,
+  runtimeConfigSemantics,
+  storageSemantics,
+  messageBusSemantics,
+  metricSemantics,
+  unitInvocationSemantics,
+  ioSemantics
+];
+var BY_NAME = new Map(
+  DEFINITIONS.map((d) => [d.name, d])
+);
+var ConfidenceSourceSchema = z13.enum([
+  "inferred_static",
+  "inferred_ai",
+  "declared",
+  "derived"
+]);
+var ConfidenceLevelSchema = z13.enum(["high", "medium", "low"]);
+var CorroborationSchema = z13.object({
+  outcome: z13.enum(["observed", "refuted", "untested"]),
+  /** Executions that produced a verdict for this claim. */
+  runs: z13.number(),
+  /** Present when refuted: the input and observation that disagreed. */
+  counterexample: z13.unknown().optional(),
+  /** Present when untested: why no verdict was reachable. */
+  reason: z13.string().optional()
+});
+var ConfidenceInfoSchema = z13.object({
+  source: ConfidenceSourceSchema,
+  level: ConfidenceLevelSchema,
+  corroboration: CorroborationSchema.optional()
+});
+var SourceLocationSchema = z13.object({
+  file: z13.string(),
+  /** Line numbers, for a person reading the summary or an editor link. */
+  range: z13.object({ start: z13.number(), end: z13.number() }),
+  /**
+   * Character offsets of the unit in its file. Identity and joins use
+   * these, because two functions can share a line but never an offset
+   * range. `range` gives the same place in lines. Absent on a summary
+   * with no source position, such as one read from a contract.
+   */
+  span: z13.object({ start: z13.number(), end: z13.number() }).optional(),
+  exportName: z13.string().nullable(),
+  /**
+   * The project the extract ran on, by the name the project gives
+   * itself.
+   *
+   * Paths are relative to wherever the extract ran, so two services in
+   * one repository can both report `src/handlers.ts`, and merging their
+   * summaries would mix them up. This field tells them apart, and a
+   * reader groups by it.
+   */
+  workspace: z13.string().optional(),
+  /**
+   * The module of the application the unit belongs to, by the name the
+   * project's `suss.json` gives it. Set only when the project lists its
+   * modules, and then on every unit whose file is under a module's root.
+   */
+  module: z13.string().optional()
+});
+var BoundaryBindingSchema = z13.object({
+  transport: z13.string(),
+  semantics: SemanticsSchema,
+  recognition: z13.string()
+});
+var TypeShapeSchema = z13.lazy(
+  () => z13.discriminatedUnion("type", [
+    z13.object({
+      type: z13.literal("record"),
+      properties: z13.record(z13.string(), TypeShapeSchema),
+      spreads: z13.array(z13.object({ sourceText: z13.string() })).optional()
+    }),
+    z13.object({ type: z13.literal("dictionary"), values: TypeShapeSchema }),
+    z13.object({ type: z13.literal("array"), items: TypeShapeSchema }),
+    z13.object({
+      type: z13.literal("literal"),
+      value: z13.union([z13.string(), z13.number(), z13.boolean()]),
+      raw: z13.string().optional()
+    }),
+    z13.object({ type: z13.literal("text") }),
+    z13.object({ type: z13.literal("integer") }),
+    z13.object({ type: z13.literal("number") }),
+    z13.object({ type: z13.literal("boolean") }),
+    z13.object({ type: z13.literal("null") }),
+    z13.object({ type: z13.literal("undefined") }),
+    z13.object({
+      type: z13.literal("union"),
+      variants: z13.array(TypeShapeSchema)
+    }),
+    z13.object({
+      type: z13.literal("ref"),
+      name: z13.string(),
+      from: z13.string().optional(),
+      def: z13.string().optional()
+    }),
+    z13.object({ type: z13.literal("unknown") })
+  ])
+);
+
+// ../ir-core/dist/index.js
+import { z as z14 } from "zod";
+import { z as z22 } from "zod";
+var RelationSchema = z14.enum([
+  "provides",
+  "reads",
+  "writes",
+  "invokes"
+]);
+var EffectRelationSchema = RelationSchema.exclude(["provides"]);
+var SuppressionSideSchema = z22.object({
+  summary: z22.string().optional(),
+  transitionId: z22.string().optional(),
+  /** The field on that side, for a finding about one field and no transition. */
+  field: z22.string().optional()
+}).optional();
+var SuppressionRuleSchema = z22.object({
+  /**
+   * The finding kind to match, behavioral or intent. The schema accepts
+   * any string because ir-core cannot import either IR's kind enum. The
+   * CLI's loader checks it against both.
+   */
+  kind: z22.string().optional(),
+  /**
+   * The boundary's human-readable key, such as "GET /pet/{petId}" or
+   * "fn:@acme/api::getUser". A REST key goes through the same path
+   * normalizer the checkers use, so `:id` and `{id}` compare equal.
+   */
+  boundary: z22.string().optional(),
+  /**
+   * Consumer-side discriminators, the narrowest useful match. They
+   * apply only to behavioral findings. A rule that sets `consumer`
+   * never matches an intent finding, because an intent finding has no
+   * consumer side.
+   */
+  consumer: SuppressionSideSchema,
+  /**
+   * Provider-side discriminators, matching the same fields as
+   * `consumer`. A finding about a status the provider produces has its
+   * transition id on this side, and that id is the only value narrow
+   * enough to pick out that one finding. As with `consumer`, a rule
+   * that sets `provider` never matches an intent finding.
+   */
+  provider: SuppressionSideSchema,
+  /**
+   * The title of one PRD scenario. A PRD finding's boundary is the
+   * whole PRD, so without this a rule accepts every scenario in it,
+   * including one added later. A rule that sets `scenario` matches
+   * only intent findings about a scenario with that title.
+   */
+  scenario: z22.string().optional(),
+  /**
+   * "narrow", the default, requires `kind` plus one of `boundary`,
+   * `scenario`, `consumer.transitionId` or `provider.transitionId`, so
+   * the rule targets a specific class of finding. "broad" allows a
+   * match on kind alone or boundary alone, and such a rule also
+   * silences future regressions in that category.
+   */
+  scope: z22.enum(["narrow", "broad"]).default("narrow"),
+  /** Required human-written justification. */
+  reason: z22.string().min(1),
+  /** What to do when a finding matches. */
+  effect: z22.enum(["mark", "downgrade", "hide"]).default("mark")
+}).strict();
+var SuppressionFileSchema = z22.object({
+  version: z22.literal(1),
+  rules: z22.array(SuppressionRuleSchema)
+}).strict();
+
+// ../framework/rails/dist/index.js
+var ADDED_PATHS = /config\.(?:eager_load_paths|autoload_paths|autoload_once_paths)\s*(?:<<|\+=|\.push\(|\.unshift\(|\.concat\()\s*([^\n]*)/g;
+var ROOT_JOIN = /Rails\.root\.join\(\s*([^)]*)\)/g;
+var INTERPOLATED_ROOT = /#\{(?:Rails\.root|config\.root|root)\}\/([\w./-]+)/g;
+var AUTOLOAD_LIB = /config\.autoload_lib(?:_once)?\b/;
+var EVERY_LITERAL = /(["'])([^"']*)\1/g;
+function applicationFile(configDirectory) {
+  const file = applicationPath(configDirectory);
+  return fs.existsSync(file) ? [file] : [];
+}
+function applicationPath(configDirectory) {
+  return path.join(configDirectory, "config", "application.rb");
+}
+function readAutoloadRoots(configDirectory) {
+  const file = applicationPath(configDirectory);
+  let source;
+  try {
+    source = fs.readFileSync(file, "utf8");
+  } catch {
+    return [];
+  }
+  const relative = [];
+  for (const line of source.split("\n")) {
+    if (line.trimStart().startsWith("#")) {
+      continue;
+    }
+    if (AUTOLOAD_LIB.test(line)) {
+      relative.push("lib");
+    }
+    for (const added of line.matchAll(ADDED_PATHS)) {
+      relative.push(...directoriesIn(added[1] ?? ""));
+    }
+  }
+  return [...new Set(relative)].map((directory) => path.resolve(configDirectory, directory)).filter((directory) => isDirectory(directory));
+}
+function directoriesIn(fragment) {
+  const joined = [...fragment.matchAll(ROOT_JOIN)].map(
+    (join) => [...(join[1] ?? "").matchAll(EVERY_LITERAL)].map((literal) => literal[2] ?? "").join("/")
+  );
+  const interpolated = [...fragment.matchAll(INTERPOLATED_ROOT)].map(
+    (match) => match[1] ?? ""
+  );
+  return [...joined, ...interpolated].filter((one) => one !== "");
+}
+function isDirectory(directory) {
+  try {
+    return fs.statSync(directory).isDirectory();
+  } catch {
+    return false;
+  }
+}
 var ENGINE_BASE_NAMES = /* @__PURE__ */ new Set(["Rails::Engine", "::Rails::Engine"]);
 var CONSTANT_TYPES = /* @__PURE__ */ new Set(["constant", "scope_resolution"]);
 function readEngines(roots, acronyms = []) {
@@ -31,7 +1477,7 @@ function readEngines(roots, acronyms = []) {
   for (const root of roots) {
     const routesFile = engineRoutesFile(root);
     for (const file of engineFilesUnder(root)) {
-      const source = fs.readFileSync(file, "utf8");
+      const source = fs2.readFileSync(file, "utf8");
       const rootNode = parseRubySync(source).rootNode;
       for (const found of engineClassesIn(rootNode, acronyms)) {
         engines.push({ ...found, routesFile });
@@ -48,48 +1494,45 @@ function engineSourceFiles(root) {
   ];
 }
 function engineRoutesFile(root) {
-  const routesFile = path.join(root, "config", "routes.rb");
-  return fs.existsSync(routesFile) ? routesFile : null;
+  const routesFile = path2.join(root, "config", "routes.rb");
+  return fs2.existsSync(routesFile) ? routesFile : null;
 }
 function engineFilesUnder(root) {
-  const directory = path.join(root, "lib");
-  if (!fs.existsSync(directory)) {
+  const directory = path2.join(root, "lib");
+  if (!fs2.existsSync(directory)) {
     return [];
   }
   return rubyFilesUnder(directory).filter(
-    (file) => fs.readFileSync(file, "utf8").includes("Rails::Engine")
+    (file) => fs2.readFileSync(file, "utf8").includes("Rails::Engine")
   );
 }
 function expandPathPattern(pattern) {
-  const segments = pattern.split(path.sep).filter((s) => s !== "");
-  const start = path.isAbsolute(pattern) ? path.sep : ".";
+  const segments = pattern.split(path2.sep).filter((s) => s !== "");
+  const start = path2.isAbsolute(pattern) ? path2.sep : ".";
   let candidates = [start];
   for (const segment of segments) {
     if (!segment.includes("*")) {
-      candidates = candidates.map((base) => path.join(base, segment));
+      candidates = candidates.map((base) => path2.join(base, segment));
       continue;
     }
     const matcher = new RegExp(
       `^${segment.split("*").map(escapeRegExp).join(".*")}$`
     );
     candidates = candidates.flatMap(
-      (base) => fs.existsSync(base) ? fs.readdirSync(base).filter((name) => matcher.test(name)).sort().map((name) => path.join(base, name)) : []
+      (base) => fs2.existsSync(base) ? fs2.readdirSync(base).filter((name) => matcher.test(name)).sort().map((name) => path2.join(base, name)) : []
     );
   }
-  return candidates.filter((candidate) => fs.existsSync(candidate));
+  return candidates.filter((candidate) => fs2.existsSync(candidate));
 }
 function escapeRegExp(text) {
   return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 function rubyFilesUnder(directory) {
-  return fs.readdirSync(directory, { withFileTypes: true, recursive: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".rb")).map((entry) => path.join(entry.parentPath, entry.name)).sort();
+  return fs2.readdirSync(directory, { withFileTypes: true, recursive: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".rb")).map((entry) => path2.join(entry.parentPath, entry.name)).sort();
 }
 function engineClassesIn(node, acronyms, enclosing = []) {
   const found = [];
-  for (const child of node.namedChildren) {
-    if (child === null) {
-      continue;
-    }
+  for (const child of children(node)) {
     if (child.type === "class" && extendsEngine(child)) {
       const name = definedName(child);
       if (name !== void 0) {
@@ -110,10 +1553,10 @@ function definedName(definition) {
 }
 function extendsEngine(classNode) {
   const superclass = field(classNode, "superclass");
-  const base = superclass?.namedChildren.find(
-    (child) => child !== null && CONSTANT_TYPES.has(child.type)
+  const base = children(superclass).find(
+    (child) => CONSTANT_TYPES.has(child.type)
   );
-  return base !== void 0 && base !== null && ENGINE_BASE_NAMES.has(base.text);
+  return base !== void 0 && ENGINE_BASE_NAMES.has(base.text);
 }
 function isolatedNamespaceOf(classNode, acronyms) {
   const body = field(classNode, "body");
@@ -137,7 +1580,7 @@ var IRREGULAR_CALL = /\.irregular\s*\(?\s*(["'])([^"']*)\1\s*,\s*(["'])([^"']*)\
 var UNCOUNTABLE_CALL = /\.uncountable\s*\(?\s*([^\n]*)/g;
 var SINGULAR_CALL = /\.singular\s*\(?\s*(?:(["'])([^"']*)\1|\/([^/]*)\/([a-z]*))\s*,\s*(["'])([^"']*)\5/g;
 var WORD_LIST = /%[wi][([{]([^)\]}]*)[)\]}]/;
-var EVERY_LITERAL = /(["'])([^"']*)\1/g;
+var EVERY_LITERAL2 = /(["'])([^"']*)\1/g;
 var ANY_CALL = /\.(acronym|irregular|uncountable|singular)[\s("'/]/;
 function group(match, at) {
   return match[at] ?? "";
@@ -148,7 +1591,7 @@ function readInflections(configDirectory) {
   const uncountable = /* @__PURE__ */ new Set();
   const singular = [];
   for (const file of inflectionFiles(configDirectory)) {
-    const source = uncommented(fs2.readFileSync(file, "utf8"));
+    const source = uncommented(fs3.readFileSync(file, "utf8"));
     for (const match of source.matchAll(ACRONYM_CALL)) {
       acronyms.add(group(match, 2));
     }
@@ -182,18 +1625,130 @@ function wordsIn(argument) {
   if (list !== null) {
     return group(list, 1).split(/\s+/).filter((word) => word.length > 0);
   }
-  return [...argument.matchAll(EVERY_LITERAL)].map((match) => group(match, 2));
+  return [...argument.matchAll(EVERY_LITERAL2)].map((match) => group(match, 2));
 }
 function inflectionFiles(configDirectory) {
-  const directory = path2.join(configDirectory, "config", "initializers");
-  if (!fs2.existsSync(directory)) {
+  const directory = path3.join(configDirectory, "config", "initializers");
+  if (!fs3.existsSync(directory)) {
     return [];
   }
-  return fs2.readdirSync(directory, { withFileTypes: true, recursive: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".rb")).map((entry) => path2.join(entry.parentPath, entry.name)).filter((file) => ANY_CALL.test(uncommented(fs2.readFileSync(file, "utf8")))).sort();
+  return fs3.readdirSync(directory, { withFileTypes: true, recursive: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".rb")).map((entry) => path3.join(entry.parentPath, entry.name)).filter((file) => ANY_CALL.test(uncommented(fs3.readFileSync(file, "utf8")))).sort();
 }
 function uncommented(source) {
   return source.split("\n").filter((line) => !line.trimStart().startsWith("#")).join("\n");
 }
+var EXPANSION_CAP = 64;
+function closingParenthesis2(text, open) {
+  let depth = 0;
+  for (let index = open; index < text.length; index += 1) {
+    const char = text[index];
+    if (char === "(") {
+      depth += 1;
+    }
+    if (char === ")") {
+      depth -= 1;
+      if (depth === 0) {
+        return index;
+      }
+    }
+  }
+  return -1;
+}
+function expansions(text) {
+  let found = [""];
+  let index = 0;
+  while (index < text.length) {
+    const open = text.indexOf("(", index);
+    const close = text.indexOf(")", index);
+    if (close !== -1 && (open === -1 || close < open)) {
+      return null;
+    }
+    if (open === -1) {
+      const rest = text.slice(index);
+      found = found.map((prefix) => prefix + rest);
+      break;
+    }
+    const end = closingParenthesis2(text, open);
+    const inner = end === -1 ? null : expansions(text.slice(open + 1, end));
+    if (inner === null) {
+      return null;
+    }
+    const before = text.slice(index, open);
+    const options = ["", ...inner];
+    found = found.flatMap(
+      (prefix) => options.map((option) => prefix + before + option)
+    );
+    if (found.length > EXPANSION_CAP) {
+      found = found.slice(0, 1);
+    }
+    index = end + 1;
+  }
+  return found;
+}
+function tidied(path6) {
+  const squeezed = `/${path6}`.replace(/\/{2,}/g, "/");
+  return squeezed.length > 1 ? squeezed.replace(/\/$/, "") : squeezed;
+}
+function segmentsOf2(path6) {
+  return path6 === "/" ? [] : path6.slice(1).split("/");
+}
+function sharedCount(lists, limit, fromEnd) {
+  const first = lists[0] ?? [];
+  const at = (list, offset) => fromEnd ? list[list.length - 1 - offset] : list[offset];
+  let count = 0;
+  while (count < limit && lists.every((list) => at(list, count) === at(first, count))) {
+    count += 1;
+  }
+  return count;
+}
+var ENDS_IN_PARAMETER = /:[A-Za-z_]\w*$/;
+function headBeforeSet(lists, shortest) {
+  const first = lists[0] ?? [];
+  let count = sharedCount(lists, shortest, false);
+  while (count > 0 && ENDS_IN_PARAMETER.test(first[count - 1] ?? "")) {
+    count -= 1;
+  }
+  return count;
+}
+function asOnePath(paths) {
+  const lists = paths.map(segmentsOf2);
+  const shortest = Math.min(...lists.map((list) => list.length));
+  const headCount = headBeforeSet(lists, shortest);
+  const tailCount = sharedCount(lists, shortest - headCount, true);
+  const first = lists[0] ?? [];
+  const head = first.slice(0, headCount).join("/");
+  const tail = first.slice(first.length - tailCount).join("/");
+  const middles = lists.map(
+    (list) => list.slice(headCount, list.length - tailCount).join("/")
+  );
+  if (head !== "") {
+    const set2 = setPiece(middles.map((middle) => middle ? `/${middle}` : ""));
+    return set2 === null ? null : `/${head}${set2}${tail ? `/${tail}` : ""}`;
+  }
+  const set = setPiece(
+    middles.map((middle) => middle && tail ? `${middle}/` : middle)
+  );
+  return set === null ? null : `/${set}${tail}`;
+}
+function withGlobsAsHoles(path6) {
+  return path6.replace(/(^|[/(])\*([A-Za-z_]\w*)/g, "$1:$2+");
+}
+function pathWithOptionalGroups(written) {
+  const path6 = withGlobsAsHoles(written);
+  if (!path6.includes("(")) {
+    return path6;
+  }
+  const expanded = expansions(path6);
+  if (expanded === null) {
+    return path6;
+  }
+  const paths = [...new Set(expanded.map(tidied))];
+  const withoutGroups = paths[0] ?? path6;
+  if (paths.length === 1) {
+    return withoutGroups;
+  }
+  return asOnePath(paths) ?? withoutGroups;
+}
 function readSimpleArgs(call, defaults = {}) {
   const argumentList = field2(call, "arguments");
   const positional = [];
@@ -261,23 +1816,33 @@ function readSymbolList(node) {
   const single = symbolValue(node);
   return single === null ? null : [single];
 }
+var updateAt = (path6) => [
+  { method: "PATCH", path: path6 },
+  { method: "PUT", path: path6 }
+];
 var RESTFUL_ROUTES_PLURAL = {
-  index: (base) => ({ method: "GET", path: base }),
-  create: (base) => ({ method: "POST", path: base }),
-  new: (base) => ({ method: "GET", path: `${base}/new` }),
-  show: (base) => ({ method: "GET", path: `${base}/:id` }),
-  edit: (base) => ({ method: "GET", path: `${base}/:id/edit` }),
-  update: (base) => ({ method: "PATCH", path: `${base}/:id` }),
-  destroy: (base) => ({ method: "DELETE", path: `${base}/:id` })
+  index: (base) => [{ method: "GET", path: base }],
+  create: (base) => [{ method: "POST", path: base }],
+  new: (base) => [{ method: "GET", path: `${base}/new` }],
+  show: (base) => [{ method: "GET", path: `${base}/:id` }],
+  edit: (base) => [{ method: "GET", path: `${base}/:id/edit` }],
+  update: (base) => updateAt(`${base}/:id`),
+  destroy: (base) => [{ method: "DELETE", path: `${base}/:id` }]
 };
 var RESTFUL_ROUTES_SINGULAR = {
-  create: (base) => ({ method: "POST", path: base }),
-  new: (base) => ({ method: "GET", path: `${base}/new` }),
-  show: (base) => ({ method: "GET", path: base }),
-  edit: (base) => ({ method: "GET", path: `${base}/edit` }),
-  update: (base) => ({ method: "PATCH", path: base }),
-  destroy: (base) => ({ method: "DELETE", path: base })
+  create: (base) => [{ method: "POST", path: base }],
+  new: (base) => [{ method: "GET", path: `${base}/new` }],
+  show: (base) => [{ method: "GET", path: base }],
+  edit: (base) => [{ method: "GET", path: `${base}/edit` }],
+  update: (base) => updateAt(base),
+  destroy: (base) => [{ method: "DELETE", path: base }]
 };
+function restfulRoutes(action, base) {
+  if (!Object.hasOwn(RESTFUL_ROUTES_PLURAL, action)) {
+    return [];
+  }
+  return RESTFUL_ROUTES_PLURAL[action]?.(base) ?? [];
+}
 function pluralize(word) {
   if (/[^aeiou]y$/.test(word)) {
     return `${word.slice(0, -1)}ies`;
@@ -317,12 +1882,19 @@ var RouteAccumulator = class {
   mounting = /* @__PURE__ */ new Set();
   /** The file whose statements are being walked, as a gap message prints it. */
   file = "";
-  /** The first route written for an action wins, because Rails matches routes in the order they are declared. */
+  /** An action routed from several places serves every one of them, so each distinct route is kept. */
   add(controllerKey, action, route) {
     const key = `${controllerKey}#${action}`;
-    if (!this.byKey.has(key)) {
-      this.byKey.set(key, route);
+    const routes = this.byKey.get(key) ?? [];
+    const path6 = pathWithOptionalGroups(route.path);
+    if (!routes.some((one) => one.method === route.method && one.path === path6)) {
+      routes.push({
+        method: route.method,
+        path: path6,
+        ...route.formatless === true ? { formatless: true } : {}
+      });
     }
+    this.byKey.set(key, routes);
   }
   recordUnread(callName) {
     addUnderFile(this.unread, this.file, callName);
@@ -333,8 +1905,8 @@ var RouteAccumulator = class {
   recordMissingDrawn(name) {
     this.missingDrawn.push({ file: this.file, name });
   }
-  routeFor(controllerKey, action) {
-    return this.byKey.get(`${controllerKey}#${action}`) ?? null;
+  routesFor(controllerKey, action) {
+    return this.byKey.get(`${controllerKey}#${action}`) ?? [];
   }
   /** Runs `walk` with gaps attributed to `file`, then goes back to the file being walked before. */
   inFile(file, walk) {
@@ -359,7 +1931,7 @@ var RouteAccumulator = class {
     }
     for (const { file, name } of this.missingDrawn) {
       gaps.push(
-        `${file} draws ${name}, but there is no ${name}.rb under ${path3.basename(this.drawDirectory)}/ beside it to read; whatever that file routes is missing from what suss reports`
+        `${file} draws ${name}, but there is no ${name}.rb under ${path4.basename(this.drawDirectory)}/ beside it to read; whatever that file routes is missing from what suss reports`
       );
     }
     return gaps;
@@ -396,14 +1968,16 @@ function handleResourceCall(call, ctx, out, plural) {
   const only = readSymbolList(args.keyword.only);
   const except = readSymbolList(args.keyword.except);
   const table = plural ? RESTFUL_ROUTES_PLURAL : RESTFUL_ROUTES_SINGULAR;
-  for (const [action, routeAt] of Object.entries(table)) {
+  for (const [action, routesAt] of Object.entries(table)) {
     if (only !== null && !only.includes(action)) {
       continue;
     }
     if (except?.includes(action)) {
       continue;
     }
-    out.add(controllerKey, action, routeAt(base));
+    for (const route of routesAt(base)) {
+      out.add(controllerKey, action, route);
+    }
   }
   const nestedBase = plural ? `${base}/:${singularize(symbol)}_id` : base;
   const nested = {
@@ -447,13 +2021,15 @@ function handleVerb(call, ctx, out, method) {
   const on = wordValue(args.keyword.on, ctx);
   const base = ctx.resource === void 0 ? ctx.pathPrefix : baseForOn(ctx.resource, on);
   const target = readRouteTarget(args, ctx);
+  const format = formatOf(args);
   if (target !== null) {
     const literalPath = args.positional[0] ? textValue(args.positional[0], ctx) : null;
-    const path5 = target.path ?? literalPath;
-    if (path5 !== null) {
+    const path6 = target.path ?? literalPath;
+    if (path6 !== null) {
       out.add(joinKey(ctx.modulePrefix, target.controllerKey), target.action, {
         method,
-        path: joinPath(base, path5)
+        path: joinPath(base, path6),
+        ...format
       });
     }
     return;
@@ -468,7 +2044,14 @@ function handleVerb(call, ctx, out, method) {
   if (controllerKey === void 0) {
     return;
   }
-  out.add(controllerKey, action, { method, path: joinPath(base, segment) });
+  out.add(controllerKey, action, {
+    method,
+    path: joinPath(base, segment),
+    ...format
+  });
+}
+function formatOf(args) {
+  return args.keyword.format?.type === "false" ? { formatless: true } : {};
 }
 function handleRoot(call, ctx, out) {
   const args = readSimpleArgs(call, ctx.defaults);
@@ -598,9 +2181,9 @@ function handleMatch(call, ctx, out) {
   }
 }
 function drawDirectoryOf(routesFile) {
-  return path3.join(
-    path3.dirname(routesFile),
-    path3.basename(routesFile, path3.extname(routesFile))
+  return path4.join(
+    path4.dirname(routesFile),
+    path4.basename(routesFile, path4.extname(routesFile))
   );
 }
 function handleDraw(call, ctx, out) {
@@ -609,16 +2192,16 @@ function handleDraw(call, ctx, out) {
   if (name === null) {
     return;
   }
-  const file = path3.join(out.drawDirectory, `${name}.rb`);
+  const file = path4.join(out.drawDirectory, `${name}.rb`);
   if (out.drawn.has(file)) {
     return;
   }
   out.drawn.add(file);
-  if (!fs3.existsSync(file)) {
+  if (!fs4.existsSync(file)) {
     out.recordMissingDrawn(name);
     return;
   }
-  const tree = parseRubySync2(fs3.readFileSync(file, "utf8"));
+  const tree = parseRubySync2(fs4.readFileSync(file, "utf8"));
   walkBody(tree.rootNode, ctx, out);
 }
 var HANDLERS = {
@@ -726,10 +2309,8 @@ function routeDeclarations(root, displayPath) {
       found.push(declaration);
       return;
     }
-    for (const child of node.namedChildren) {
-      if (child !== null) {
-        visit(child);
-      }
+    for (const child of children2(node)) {
+      visit(child);
     }
   };
   visit(root);
@@ -756,16 +2337,16 @@ function isApplication(owner) {
   return owner === "Rails.application" || /(^|::)Application$/.test(owner);
 }
 function parseDeclarations(source) {
-  if (!fs3.existsSync(source.file)) {
+  if (!fs4.existsSync(source.file)) {
     return [];
   }
-  const tree = parseRubySync2(fs3.readFileSync(source.file, "utf8"));
+  const tree = parseRubySync2(fs4.readFileSync(source.file, "utf8"));
   return routeDeclarations(tree.rootNode, source.displayPath);
 }
 function readRoutes(input) {
-  if (!fs3.existsSync(input.routesFile.file)) {
+  if (!fs4.existsSync(input.routesFile.file)) {
     return {
-      routeFor: () => null,
+      routesFor: () => [],
       fileFound: false,
       gaps: [
         `${input.routesFile.displayPath} does not exist, so this run assumes each action's path and method from Rails' RESTful naming convention instead of reading it from routing`
@@ -806,7 +2387,7 @@ function readRoutes(input) {
     });
   }
   return {
-    routeFor: (controllerKey, action) => out.routeFor(controllerKey, action),
+    routesFor: (controllerKey, action) => out.routesFor(controllerKey, action),
     fileFound: true,
     gaps: out.gaps()
   };
@@ -876,68 +2457,131 @@ var RACK_STATUS_CODE_NAMES = {
   variant_also_negotiates: 506,
   insufficient_storage: 507,
   loop_detected: 508,
+  bandwidth_limit_exceeded: 509,
   not_extended: 510,
   network_authentication_required: 511
 };
-var optionsSchema = z.object({
+var STANDARD_ERROR = ["StandardError", "Exception"];
+var ACTION_CONTROLLER_ERROR = [
+  "ActionController::ActionControllerError",
+  ...STANDARD_ERROR
+];
+var ACTIVE_RECORD_ERROR = [
+  "ActiveRecord::ActiveRecordError",
+  ...STANDARD_ERROR
+];
+var INDEX_ERROR = ["IndexError", ...STANDARD_ERROR];
+var LIBRARY_EXCEPTIONS = {
+  "ActionController::ActionControllerError": { ancestors: STANDARD_ERROR },
+  "ActionController::BadRequest": {
+    status: 400,
+    ancestors: ACTION_CONTROLLER_ERROR
+  },
+  "ActionController::ParameterMissing": {
+    status: 400,
+    ancestors: ["KeyError", ...INDEX_ERROR]
+  },
+  "ActionController::UnpermittedParameters": { ancestors: INDEX_ERROR },
+  "ActionController::RoutingError": {
+    status: 404,
+    ancestors: ACTION_CONTROLLER_ERROR
+  },
+  "AbstractController::ActionNotFound": {
+    status: 404,
+    ancestors: STANDARD_ERROR
+  },
+  "ActionController::MethodNotAllowed": {
+    status: 405,
+    ancestors: ACTION_CONTROLLER_ERROR
+  },
+  "ActionController::NotImplemented": {
+    status: 501,
+    ancestors: [
+      "ActionController::MethodNotAllowed",
+      ...ACTION_CONTROLLER_ERROR
+    ]
+  },
+  "ActionController::UnknownFormat": {
+    status: 406,
+    ancestors: ACTION_CONTROLLER_ERROR
+  },
+  "ActionController::InvalidAuthenticityToken": {
+    status: 422,
+    ancestors: ACTION_CONTROLLER_ERROR
+  },
+  "ActiveRecord::ActiveRecordError": { ancestors: STANDARD_ERROR },
+  "ActiveRecord::RecordNotFound": {
+    status: 404,
+    ancestors: ACTIVE_RECORD_ERROR
+  },
+  "ActiveRecord::RecordInvalid": {
+    status: 422,
+    ancestors: ACTIVE_RECORD_ERROR
+  },
+  "ActiveRecord::RecordNotSaved": {
+    status: 422,
+    ancestors: ACTIVE_RECORD_ERROR
+  },
+  "ActiveRecord::StaleObjectError": {
+    status: 409,
+    ancestors: ACTIVE_RECORD_ERROR
+  }
+};
+var optionsSchema = z15.object({
   /**
    * The directory a bare controller name is looked up under, `app` in a
    * scaffolded Rails app.
    */
-  root: z.string().optional(),
+  root: z15.string().optional(),
   /**
    * The CLI fills this in with the config file's directory, or with the
    * directory the run reads when there is no file. A relative `root` or
    * `routesFile` resolves against it. A config file does not set it.
    */
-  configDirectory: z.string().optional(),
+  configDirectory: z15.string().optional(),
   /**
    * Base classes beyond `ApplicationController` whose subclasses are
    * controllers. A config file may not set this; a dependency stub
    * fills it.
    */
-  baseClassNames: z.array(z.string()).optional(),
+  baseClassNames: z15.array(z15.string()).optional(),
   /**
    * Controller methods a gem such as Devise adds, beyond the ones Rails
    * defines. They are left off an action's effects the same way Rails'
    * own are.
    */
-  inheritedMethodNames: z.array(z.string()).optional(),
+  inheritedMethodNames: z15.array(z15.string()).optional(),
   /**
    * The routes file, `config/routes.rb` in a scaffolded app. A relative
    * path resolves against `configDirectory` when there is one.
    */
-  routesFile: z.string().optional(),
+  routesFile: z15.string().optional(),
   /**
    * Directories that each contain an engine, with its `Rails::Engine`
    * class under `lib/` and its routes in `config/routes.rb`. A `*` in a
    * segment matches any one directory, so `plugins/*` covers every
    * plugin. Relative paths resolve against `configDirectory`.
    */
-  engineRoots: z.array(z.string()).optional(),
+  engineRoots: z15.array(z15.string()).optional(),
   /**
    * Other files that add routes through a `Rails.application.routes.draw`,
    * `.append` or `.prepend` block, most often a plugin's `plugin.rb`.
    * They take `*` the same way `engineRoots` does, and relative paths
    * resolve against `configDirectory`.
    */
-  routesFiles: z.array(z.string()).optional()
+  routesFiles: z15.array(z15.string()).optional()
 }).strict();
 var RAILS_ROOT_CLASS_NAMES = [
   "ActionController::Base",
   "ActionController::API"
 ];
-var RESTFUL_ACTIONS = {
-  index: { method: "GET", pathTemplate: "/:resource" },
-  show: { method: "GET", pathTemplate: "/:resource/:id" },
-  new: { method: "GET", pathTemplate: "/:resource/new" },
-  create: { method: "POST", pathTemplate: "/:resource" },
-  edit: { method: "GET", pathTemplate: "/:resource/:id/edit" },
-  update: { method: "PATCH", pathTemplate: "/:resource/:id" },
-  destroy: { method: "DELETE", pathTemplate: "/:resource/:id" }
-};
 var RESPONSE_STATUS_CALLS = [
-  { name: "render", statusKeyword: "status" },
+  {
+    name: "render",
+    statusKeyword: "status",
+    bodyKeyword: "json",
+    bodySerializers: ["to_json", "as_json"]
+  },
   { name: "head", statusArgument: 0, statusKeyword: "status" },
   { name: "redirect_to", statusKeyword: "status", defaultStatusCode: 302 },
   { name: "redirect_back", statusKeyword: "status", defaultStatusCode: 302 }
@@ -993,22 +2637,15 @@ function controllerKeyFromQualified(qualifiedName, acronyms) {
   const withoutSuffix = qualifiedName.endsWith("Controller") ? qualifiedName.slice(0, -"Controller".length) : qualifiedName;
   return underscoreConstantPath2(withoutSuffix, acronyms);
 }
-function conventionalRoute(controllerKey, actionName) {
-  const template = RESTFUL_ACTIONS[actionName];
-  if (template === void 0) {
-    return null;
-  }
+function conventionalRoutes(controllerKey, actionName) {
   const resource = controllerKey.split("/").pop() ?? controllerKey;
-  return {
-    method: template.method,
-    path: template.pathTemplate.replace(":resource", resource)
-  };
+  return restfulRoutes(actionName, `/${resource}`);
 }
 function resolveAgainst(configDirectory, value) {
-  if (configDirectory === void 0 || path4.isAbsolute(value)) {
+  if (configDirectory === void 0 || path5.isAbsolute(value)) {
     return value;
   }
-  return path4.resolve(configDirectory, value);
+  return path5.resolve(configDirectory, value);
 }
 function railsFramework(options = {}) {
   const root = resolveAgainst(options.configDirectory, options.root ?? "app");
@@ -1016,7 +2653,8 @@ function railsFramework(options = {}) {
     options.configDirectory,
     options.routesFile ?? "config/routes.rb"
   );
-  const displayPathOf = (file) => options.configDirectory === void 0 ? file : path4.relative(options.configDirectory, file);
+  const railsRoot = path5.dirname(root);
+  const displayPathOf = (file) => path5.isAbsolute(file) ? path5.relative(railsRoot, file) : file;
   const engineRoots = () => expandPatterns(options.configDirectory, options.engineRoots);
   const extraRoutesFiles = () => expandPatterns(options.configDirectory, options.routesFiles);
   const inflections = options.configDirectory === void 0 ? EMPTY_INFLECTIONS : readInflections(options.configDirectory);
@@ -1024,7 +2662,7 @@ function railsFramework(options = {}) {
   const routesInput = () => ({
     routesFile: {
       file: routesFile,
-      displayPath: options.routesFile ?? "config/routes.rb"
+      displayPath: displayPathOf(routesFile)
     },
     engines: readEngines(engineRoots(), acronyms).map((engine) => ({
       ...engine,
@@ -1047,24 +2685,28 @@ function railsFramework(options = {}) {
       ...options.baseClassNames ?? []
     ],
     root,
+    autoloadRoots: options.configDirectory === void 0 ? [] : readAutoloadRoots(options.configDirectory),
     pathConvention: "railsUnderscore",
     acronyms,
     ancestryRootClassNames: [...RAILS_ROOT_CLASS_NAMES],
     defaultStatusCode: 200,
     responseStatusCalls: RESPONSE_STATUS_CALLS,
     statusCodeNames: RACK_STATUS_CODE_NAMES,
+    formatSwitch: { name: "respond_to", matchesEvery: "any" },
+    libraryExceptions: LIBRARY_EXCEPTIONS,
     inheritedMethodNames: [
       ...RAILS_CONTROLLER_METHODS,
       ...options.inheritedMethodNames ?? []
     ],
     routesFile,
     filters: CONTROLLER_FILTERS,
-    routeFor: (controllerQualifiedName, actionName) => {
+    routesFor: (controllerQualifiedName, actionName) => {
       const key = controllerKeyFromQualified(controllerQualifiedName, acronyms);
       const found = routeTable();
-      return found.fileFound ? found.routeFor(key, actionName) : conventionalRoute(key, actionName);
+      return found.fileFound ? found.routesFor(key, actionName) : conventionalRoutes(key, actionName);
     },
-    routingGaps: () => routeTable().gaps
+    routingGaps: () => routeTable().gaps,
+    optionalFormat: true
   };
   return {
     name: "rails",
@@ -1089,7 +2731,10 @@ function railsFramework(options = {}) {
       ...drawableRoutesFiles(routesFile),
       ...engineRoots().flatMap(engineSourceFiles),
       ...extraRoutesFiles(),
-      ...options.configDirectory === void 0 ? [] : inflectionFiles(options.configDirectory)
+      ...options.configDirectory === void 0 ? [] : [
+        ...inflectionFiles(options.configDirectory),
+        ...applicationFile(options.configDirectory)
+      ]
     ]
   };
 }
@@ -1100,10 +2745,10 @@ function expandPatterns(configDirectory, patterns) {
 }
 function drawableRoutesFiles(routesFile) {
   const directory = drawDirectoryOf(routesFile);
-  if (!fs4.existsSync(directory)) {
+  if (!fs5.existsSync(directory)) {
     return [];
   }
-  return fs4.readdirSync(directory).filter((name) => name.endsWith(".rb")).sort().map((name) => path4.join(directory, name));
+  return fs5.readdirSync(directory).filter((name) => name.endsWith(".rb")).sort().map((name) => path5.join(directory, name));
 }
 var declares = {
   kind: "framework",