auditai-scan 0.1.0 → 0.2.0

package/dist/auditai-scan.mjs

@@ -173,8 +173,8 @@ function formatScanText(r) {
 }
 
 // packages/scanner/src/scan.ts
-import { existsSync, readFileSync as readFileSync2 } from "node:fs";
-import { join as join3 } from "node:path";
+import { existsSync, readFileSync as readFileSync3 } from "node:fs";
+import { join as join4 } from "node:path";
 
 // packages/graph/src/graph.ts
 var SecurityGraph = class {
@@ -286,7 +286,8 @@ function buildGraph(model) {
         filters: q.filters,
         payload: q.payload,
         text: q.text,
-        table: q.table
+        table: q.table,
+        ...q.via && q.via.length > 0 ? { via: q.via } : {}
       };
       const qn = g.addNode({
         id: `query:${q.location.file}:${q.location.line}:${i}`,
@@ -367,6 +368,8 @@ function isIgnored(rel, patterns) {
 function discoverFiles(root, extraSqlDirs = [], ignoreGlobs = []) {
   const source = [];
   const sql = [];
+  const manifests = [];
+  const tsconfigs = [];
   const ignore = ignoreGlobs.map(globToRegExp);
   const walk2 = (dir, sqlOnly = false) => {
     let entries;
@@ -396,14 +399,18 @@ function discoverFiles(root, extraSqlDirs = [], ignoreGlobs = []) {
         continue;
       }
       if (sqlOnly || name.endsWith(".d.ts")) continue;
-      if (SOURCE_EXT.test(name)) source.push(rel);
+      if (name === "package.json") manifests.push(rel);
+      else if (/^tsconfig(\..+)?\.json$/.test(name)) tsconfigs.push(rel);
+      else if (SOURCE_EXT.test(name)) source.push(rel);
     }
   };
   walk2(root);
   for (const extra of extraSqlDirs) walk2(resolve(root, extra), true);
   source.sort();
   sql.sort();
-  return { source, sql };
+  manifests.sort();
+  tsconfigs.sort();
+  return { source, sql, manifests, tsconfigs };
 }
 
 // packages/parser/src/model.ts
@@ -486,21 +493,80 @@ function hasExportModifier(node) {
   const mods = ts.canHaveModifiers(node) ? ts.getModifiers(node) : void 0;
   return mods?.some((m) => m.kind === ts.SyntaxKind.ExportKeyword) ?? false;
 }
-function exportedFunctions(sf) {
+function functionOfInitializer(init, sf) {
+  const u = unwrap(init);
+  if (ts.isArrowFunction(u) || ts.isFunctionExpression(u)) return { fn: u };
+  if (ts.isCallExpression(u)) {
+    for (const a of u.arguments) {
+      const ua = unwrap(a);
+      if (ts.isArrowFunction(ua) || ts.isFunctionExpression(ua)) {
+        return { fn: ua, wrapper: u.expression.getText(sf).replace(/\s+/g, "") };
+      }
+    }
+  }
+  return null;
+}
+function topLevelFunctions(sf) {
   const out = [];
   for (const stmt of sf.statements) {
-    if (ts.isFunctionDeclaration(stmt) && stmt.name && hasExportModifier(stmt)) {
-      out.push({ name: stmt.name.text, fn: stmt, node: stmt });
-    } else if (ts.isVariableStatement(stmt) && hasExportModifier(stmt)) {
+    if (ts.isFunctionDeclaration(stmt) && stmt.name) {
+      out.push({ name: stmt.name.text, fn: stmt, node: stmt, exported: hasExportModifier(stmt) });
+    } else if (ts.isVariableStatement(stmt)) {
+      const exported = hasExportModifier(stmt);
       for (const d of stmt.declarationList.declarations) {
-        if (ts.isIdentifier(d.name) && d.initializer) {
-          const init = unwrap(d.initializer);
-          if (ts.isArrowFunction(init) || ts.isFunctionExpression(init)) {
-            out.push({ name: d.name.text, fn: init, node: d });
+        if (!ts.isIdentifier(d.name) || !d.initializer) continue;
+        const f = functionOfInitializer(d.initializer, sf);
+        if (!f) continue;
+        out.push(
+          f.wrapper === void 0 ? { name: d.name.text, fn: f.fn, node: d, exported } : { name: d.name.text, fn: f.fn, node: d, exported, wrapper: f.wrapper }
+        );
+      }
+    }
+  }
+  return out;
+}
+function exportedFunctions(sf) {
+  return topLevelFunctions(sf).filter((f) => f.exported);
+}
+function classesIn(sf) {
+  const out = [];
+  for (const stmt of sf.statements) {
+    if (!ts.isClassDeclaration(stmt) || !stmt.name) continue;
+    const ctorParams = [];
+    const propFromParam = /* @__PURE__ */ new Map();
+    const methods = /* @__PURE__ */ new Map();
+    for (const member of stmt.members) {
+      if (ts.isConstructorDeclaration(member)) {
+        member.parameters.forEach((p, i) => {
+          const name = ts.isIdentifier(p.name) ? p.name.text : `arg${i}`;
+          ctorParams.push(name);
+          const mods = ts.getModifiers(p) ?? [];
+          if (mods.some(
+            (m) => m.kind === ts.SyntaxKind.PrivateKeyword || m.kind === ts.SyntaxKind.PublicKeyword || m.kind === ts.SyntaxKind.ProtectedKeyword || m.kind === ts.SyntaxKind.ReadonlyKeyword
+          )) {
+            propFromParam.set(name, i);
+          }
+        });
+        if (member.body) {
+          for (const bin of collect(member.body, ts.isBinaryExpression)) {
+            if (bin.operatorToken.kind === ts.SyntaxKind.EqualsToken && ts.isPropertyAccessExpression(bin.left) && bin.left.expression.kind === ts.SyntaxKind.ThisKeyword && ts.isIdentifier(bin.right)) {
+              const idx = ctorParams.indexOf(bin.right.text);
+              if (idx >= 0) propFromParam.set(bin.left.name.text, idx);
+            }
           }
         }
+      } else if (ts.isMethodDeclaration(member) && ts.isIdentifier(member.name)) {
+        methods.set(member.name.text, member);
       }
     }
+    out.push({
+      name: stmt.name.text,
+      node: stmt,
+      exported: hasExportModifier(stmt),
+      ctorParams,
+      propFromParam,
+      methods
+    });
   }
   return out;
 }
@@ -546,6 +612,11 @@ function enclosingStatement(node) {
 
 // packages/parser/src/nextjs.ts
 var ROUTE_FILE = /^(?:(.*?)\/)?(?:src\/)?app\/(.*?)\/?route\.(ts|tsx|js|jsx|mjs)$/;
+var PAGE_FILE = /^(?:(.*?)\/)?(?:src\/)?app\/(.*?)\/?page\.(tsx|ts|jsx|js)$/;
+function routePath(dir) {
+  const parts = dir.split("/").filter((p) => p.length > 0 && !p.startsWith("(") && !p.startsWith("@"));
+  return `/${parts.join("/")}`;
+}
 function appRootOf(rel) {
   const m = /^(?:(.*?)\/)?(?:src\/)?app\//.exec(rel);
   if (!m) return null;
@@ -555,9 +626,31 @@ function appRootOf(rel) {
 function routeFromFile(rel) {
   const m = ROUTE_FILE.exec(rel);
   if (!m) return null;
-  const dir = m[2] ?? "";
-  const parts = dir.split("/").filter((p) => p.length > 0 && !p.startsWith("(") && !p.startsWith("@"));
-  return `/${parts.join("/")}`;
+  return routePath(m[2] ?? "");
+}
+function pageFromFile(rel) {
+  const m = PAGE_FILE.exec(rel);
+  if (!m) return null;
+  return routePath(m[2] ?? "");
+}
+function pageHandlerIn(sf) {
+  for (const stmt of sf.statements) {
+    if (ts2.isFunctionDeclaration(stmt)) {
+      const mods = ts2.getModifiers(stmt) ?? [];
+      if (mods.some((m) => m.kind === ts2.SyntaxKind.DefaultKeyword)) {
+        return { name: stmt.name?.text ?? "Page", fn: stmt, node: stmt, exported: true };
+      }
+    } else if (ts2.isExportAssignment(stmt) && !stmt.isExportEquals) {
+      const e = unwrap(stmt.expression);
+      if (ts2.isIdentifier(e)) {
+        const f = topLevelFunctions(sf).find((t) => t.name === e.text);
+        if (f) return { ...f, exported: true };
+      } else if (ts2.isArrowFunction(e) || ts2.isFunctionExpression(e)) {
+        return { name: "Page", fn: e, node: stmt, exported: true };
+      }
+    }
+  }
+  return null;
 }
 function routeHandlersIn(sf) {
   const out = [];
@@ -582,9 +675,172 @@ function isClientComponentFile(sf) {
 }
 
 // packages/parser/src/parse-project.ts
+import { readFileSync as readFileSync2 } from "node:fs";
+import { join as join3, resolve as resolve2 } from "node:path";
+import ts5 from "typescript";
+
+// packages/parser/src/resolve.ts
 import { readFileSync } from "node:fs";
-import { join as join2, posix, resolve as resolve2 } from "node:path";
-import ts4 from "typescript";
+import { join as join2, posix } from "node:path";
+import ts3 from "typescript";
+var EXTENSIONS = [".ts", ".tsx", ".js", ".jsx", ".mjs"];
+var CONDITIONS = ["import", "default", "require", "node", "types", "module"];
+function dirOf(rel) {
+  const d = posix.dirname(rel);
+  return d === "." ? "" : d;
+}
+function under(dir, rel) {
+  return posix.normalize(dir ? posix.join(dir, rel) : rel).replace(/^\.\//, "");
+}
+function matchPattern(pattern, spec) {
+  const i = pattern.indexOf("*");
+  if (i < 0) return pattern === spec ? "" : null;
+  const pre = pattern.slice(0, i);
+  const suf = pattern.slice(i + 1);
+  if (spec.length >= pre.length + suf.length && spec.startsWith(pre) && spec.endsWith(suf)) {
+    return spec.slice(pre.length, spec.length - suf.length);
+  }
+  return null;
+}
+function pickCondition(v) {
+  if (typeof v === "string") return [v];
+  if (Array.isArray(v)) return v.flatMap(pickCondition);
+  if (v && typeof v === "object") {
+    const o = v;
+    for (const c of CONDITIONS) {
+      if (c in o) {
+        const r = pickCondition(o[c]);
+        if (r.length > 0) return r;
+      }
+    }
+    for (const val of Object.values(o)) {
+      const r = pickCondition(val);
+      if (r.length > 0) return r;
+    }
+  }
+  return [];
+}
+function resolveExports(exports, subpath) {
+  if (exports === null || exports === void 0) return [];
+  if (typeof exports === "string") return subpath === "." ? [exports] : [];
+  if (Array.isArray(exports)) return exports.flatMap((e) => resolveExports(e, subpath));
+  if (typeof exports !== "object") return [];
+  const obj = exports;
+  const keys = Object.keys(obj);
+  if (!keys.some((k) => k.startsWith("."))) return subpath === "." ? pickCondition(obj) : [];
+  const exact = obj[subpath];
+  if (exact !== void 0) return pickCondition(exact);
+  for (const k of keys) {
+    if (!k.includes("*")) continue;
+    const m = matchPattern(k, subpath);
+    if (m === null) continue;
+    return pickCondition(obj[k]).map((v) => v.replace("*", m));
+  }
+  return [];
+}
+var Resolver = class {
+  constructor(root, files, manifests, tsconfigs, warnings) {
+    this.files = files;
+    for (const rel of manifests) {
+      try {
+        const j = JSON.parse(readFileSync(join2(root, rel), "utf8"));
+        if (typeof j.name !== "string") continue;
+        const main2 = [j.main, j.module, j.types].find((v) => typeof v === "string");
+        this.packages.push({
+          name: j.name,
+          dir: dirOf(rel),
+          exports: j.exports ?? null,
+          main: main2 ?? null
+        });
+      } catch (e) {
+        warnings.push(`could not read ${rel}: ${e instanceof Error ? e.message : String(e)}`);
+      }
+    }
+    this.packages.sort((a, b) => b.name.length - a.name.length);
+    for (const rel of tsconfigs) {
+      const read = ts3.readConfigFile(join2(root, rel), (p) => readFileSync(p, "utf8"));
+      const config = read.config;
+      if (read.error || !config) continue;
+      const co = config.compilerOptions ?? {};
+      const paths = co.paths;
+      if (!paths || typeof paths !== "object") continue;
+      const dir = dirOf(rel);
+      const base = typeof co.baseUrl === "string" ? under(dir, co.baseUrl).replace(/^\.$/, "") : dir;
+      const mappings = [];
+      for (const [pattern, targets] of Object.entries(paths)) {
+        if (!Array.isArray(targets)) continue;
+        mappings.push({
+          pattern,
+          targets: targets.filter((t) => typeof t === "string")
+        });
+      }
+      this.tsconfigs.push({ dir, base, paths: mappings });
+    }
+    this.tsconfigs.sort((a, b) => b.dir.length - a.dir.length);
+  }
+  packages = [];
+  tsconfigs = [];
+  cache = /* @__PURE__ */ new Map();
+  /** Project-relative path of the module `spec` refers to from `fromRel`, or null when it is outside the project. */
+  resolve(spec, fromRel) {
+    const key = `${fromRel}\0${spec}`;
+    const cached = this.cache.get(key);
+    if (cached !== void 0) return cached;
+    let hit = null;
+    for (const base of this.candidates(spec, fromRel)) {
+      hit = this.firstExisting(base);
+      if (hit) break;
+    }
+    this.cache.set(key, hit);
+    return hit;
+  }
+  candidates(spec, fromRel) {
+    const out = [];
+    if (spec.startsWith(".")) {
+      out.push(posix.normalize(posix.join(posix.dirname(fromRel), spec)));
+      return out;
+    }
+    const cfg = this.tsconfigs.find((c) => c.dir === "" || fromRel.startsWith(`${c.dir}/`));
+    if (cfg) {
+      for (const { pattern, targets } of cfg.paths) {
+        const m = matchPattern(pattern, spec);
+        if (m === null) continue;
+        for (const t of targets) out.push(under(cfg.base, t.replace("*", m)));
+      }
+    }
+    if (spec.startsWith("@/") || spec.startsWith("~/")) {
+      const rest = spec.slice(2);
+      const appRoot = appRootOf(fromRel);
+      if (appRoot) out.push(posix.join(appRoot, rest), posix.join(appRoot, "src", rest));
+      out.push(rest, `src/${rest}`);
+    }
+    const pkg = this.packages.find((p) => spec === p.name || spec.startsWith(`${p.name}/`));
+    if (pkg) {
+      const sub = spec === pkg.name ? "." : `.${spec.slice(pkg.name.length)}`;
+      for (const t of resolveExports(pkg.exports, sub)) out.push(under(pkg.dir, t));
+      if (sub === ".") {
+        if (pkg.main) out.push(under(pkg.dir, pkg.main));
+        out.push(under(pkg.dir, "src/index"), under(pkg.dir, "index"));
+      } else {
+        out.push(under(pkg.dir, sub), under(pkg.dir, `src/${sub.slice(2)}`));
+      }
+    }
+    return out;
+  }
+  firstExisting(base) {
+    const b = base.replace(/^\.\//, "");
+    const stems = [b];
+    const m = /\.(js|jsx|mjs|cjs)$/.exec(b);
+    if (m) stems.push(b.slice(0, -m[0].length));
+    for (const s of stems) {
+      if (this.files.has(s)) return s;
+      for (const ext of EXTENSIONS) if (this.files.has(s + ext)) return s + ext;
+      for (const ext of EXTENSIONS)
+        if (this.files.has(`${s}/index${ext}`)) return `${s}/index${ext}`;
+    }
+    return null;
+  }
+};
 
 // packages/parser/src/rls.ts
 var CONSTRAINT_WORDS = /* @__PURE__ */ new Set([
@@ -629,7 +885,7 @@ function splitTopLevel(text) {
   if (cur.trim()) out.push(cur);
   return out.map((s) => s.trim()).filter((s) => s.length > 0);
 }
-var IDENT = String.raw`(?:public\.)?"?([A-Za-z_][A-Za-z0-9_]*)"?`;
+var IDENT = String.raw`(?:"?public"?\.)?"?([A-Za-z_][A-Za-z0-9_]*)"?`;
 var CREATE_TABLE = new RegExp(
   String.raw`^create\s+table\s+(?:if\s+not\s+exists\s+)?${IDENT}\s*\(`,
   "i"
@@ -717,22 +973,22 @@ function parseSqlForRls(rel, text, into) {
 }
 
 // packages/parser/src/supabase.ts
-import ts3 from "typescript";
+import ts4 from "typescript";
 var CREATE_CLIENT_CALLEES = /^(createClient|createServerClient|createBrowserClient)$/;
 function isCreateClientCall(call, sf) {
   const callee = call.expression;
-  if (ts3.isIdentifier(callee)) return CREATE_CLIENT_CALLEES.test(callee.text);
-  if (ts3.isPropertyAccessExpression(callee)) return CREATE_CLIENT_CALLEES.test(callee.name.text);
+  if (ts4.isIdentifier(callee)) return CREATE_CLIENT_CALLEES.test(callee.text);
+  if (ts4.isPropertyAccessExpression(callee)) return CREATE_CLIENT_CALLEES.test(callee.name.text);
   return CREATE_CLIENT_CALLEES.test(callee.getText(sf));
 }
 function resolveArgText(expr, sf) {
   const u = unwrap(expr);
-  if (!ts3.isIdentifier(u)) return expr.getText(sf);
+  if (!ts4.isIdentifier(u)) return expr.getText(sf);
   let scope = expr.parent;
   while (scope) {
-    if (ts3.isFunctionLike(scope) || ts3.isBlock(scope) || ts3.isSourceFile(scope)) {
-      const decl = collect(scope, ts3.isVariableDeclaration).find(
-        (d) => ts3.isIdentifier(d.name) && d.name.text === u.text && d.initializer
+    if (ts4.isFunctionLike(scope) || ts4.isBlock(scope) || ts4.isSourceFile(scope)) {
+      const decl = collect(scope, ts4.isVariableDeclaration).find(
+        (d) => ts4.isIdentifier(d.name) && d.name.text === u.text && d.initializer
       );
       if (decl?.initializer) return `${u.text} = ${decl.initializer.getText(sf)}`;
     }
@@ -751,13 +1007,13 @@ function classifyCreateClientCall(call, sf) {
       evidence: `${callee}() from @supabase/ssr acts as the signed-in user; RLS applies`
     };
   }
-  if (/SERVICE_ROLE|service_role|SECRET_KEY|SB_SECRET|sb_secret/i.test(keyArg)) {
+  if (/SERVICE_?ROLE|SECRET_KEY|SB_SECRET/i.test(keyArg)) {
     return {
       kind: "service_role",
       evidence: `key ${keyArg} is a service-role secret; RLS is bypassed`
     };
   }
-  const anonKey = /ANON|PUBLISHABLE|anon|publishable/.test(keyArg);
+  const anonKey = /ANON|PUBLISHABLE/i.test(keyArg);
   if (anonKey && /Authorization|headers/i.test(optArg)) {
     return {
       kind: "user_scoped",
@@ -773,39 +1029,101 @@ function classifyCreateClientCall(call, sf) {
   return { kind: "unknown", evidence: `could not classify key argument ${keyArg || "(none)"}` };
 }
 var AUTH_CALL = /\.auth\.(getUser|getSession|getClaims)\s*\(/;
+function hasModifier(node, kind) {
+  const mods = ts4.canHaveModifiers(node) ? ts4.getModifiers(node) : void 0;
+  return mods?.some((m) => m.kind === kind) ?? false;
+}
 function analyzeModule(rel, sf) {
   const imports = /* @__PURE__ */ new Map();
+  const reexports = [];
+  const exportedNames = /* @__PURE__ */ new Set();
+  let defaultExport = null;
+  for (const stmt of sf.statements) {
+    if (ts4.isImportDeclaration(stmt) && ts4.isStringLiteral(stmt.moduleSpecifier)) {
+      const spec = stmt.moduleSpecifier.text;
+      const clause = stmt.importClause;
+      if (!clause) continue;
+      if (clause.name) imports.set(clause.name.text, { spec, imported: "default" });
+      const nb = clause.namedBindings;
+      if (nb && ts4.isNamedImports(nb)) {
+        for (const el of nb.elements) {
+          imports.set(el.name.text, { spec, imported: (el.propertyName ?? el.name).text });
+        }
+      }
+      if (nb && ts4.isNamespaceImport(nb)) imports.set(nb.name.text, { spec, imported: "*" });
+    } else if (ts4.isExportDeclaration(stmt)) {
+      const spec = stmt.moduleSpecifier && ts4.isStringLiteral(stmt.moduleSpecifier) ? stmt.moduleSpecifier.text : null;
+      const clause = stmt.exportClause;
+      if (spec && !clause) reexports.push({ star: true, spec });
+      else if (clause && ts4.isNamedExports(clause)) {
+        for (const el of clause.elements) {
+          const name = (el.propertyName ?? el.name).text;
+          if (spec) reexports.push({ star: false, name, alias: el.name.text, spec });
+          else exportedNames.add(name);
+        }
+      }
+    } else if (ts4.isExportAssignment(stmt) && !stmt.isExportEquals) {
+      const e = unwrap(stmt.expression);
+      if (ts4.isIdentifier(e)) defaultExport = e.text;
+    } else if (ts4.isFunctionDeclaration(stmt) && stmt.name && hasModifier(stmt, ts4.SyntaxKind.DefaultKeyword)) {
+      defaultExport = stmt.name.text;
+    }
+  }
+  const functions = /* @__PURE__ */ new Map();
+  for (const f of topLevelFunctions(sf)) {
+    functions.set(f.name, exportedNames.has(f.name) ? { ...f, exported: true } : f);
+  }
+  const classes = /* @__PURE__ */ new Map();
+  for (const c of classesIn(sf)) {
+    classes.set(c.name, exportedNames.has(c.name) ? { ...c, exported: true } : c);
+  }
+  const moduleVars = /* @__PURE__ */ new Map();
   for (const stmt of sf.statements) {
-    if (!ts3.isImportDeclaration(stmt) || !ts3.isStringLiteral(stmt.moduleSpecifier)) continue;
-    const spec = stmt.moduleSpecifier.text;
-    const clause = stmt.importClause;
-    if (!clause) continue;
-    if (clause.name) imports.set(clause.name.text, spec);
-    const nb = clause.namedBindings;
-    if (nb && ts3.isNamedImports(nb)) for (const el of nb.elements) imports.set(el.name.text, spec);
-    if (nb && ts3.isNamespaceImport(nb)) imports.set(nb.name.text, spec);
+    if (!ts4.isVariableStatement(stmt)) continue;
+    const exported = hasModifier(stmt, ts4.SyntaxKind.ExportKeyword);
+    for (const d of stmt.declarationList.declarations) {
+      if (!ts4.isIdentifier(d.name) || !d.initializer || functions.has(d.name.text)) continue;
+      const init = unwrap(d.initializer);
+      if (!ts4.isCallExpression(init) && !ts4.isNewExpression(init)) continue;
+      moduleVars.set(d.name.text, {
+        name: d.name.text,
+        init,
+        exported: exported || exportedNames.has(d.name.text),
+        node: d
+      });
+    }
   }
   const clientFactories = [];
   const authHelpers = [];
-  for (const ex of exportedFunctions(sf)) {
-    const text = ex.fn.getText(sf);
-    const location = { file: rel, line: lineOf(sf, ex.node) };
+  for (const f of functions.values()) {
+    const text = f.fn.getText(sf);
+    const location = { file: rel, line: lineOf(sf, f.node) };
     if (AUTH_CALL.test(text)) {
       authHelpers.push({
-        name: ex.name,
+        name: f.name,
         location,
         evidence: "calls supabase auth.getUser/getSession/getClaims"
       });
       continue;
     }
-    const creates = collect(ex.fn, ts3.isCallExpression).filter((c) => isCreateClientCall(c, sf));
+    const creates = collect(f.fn, ts4.isCallExpression).filter((c) => isCreateClientCall(c, sf));
     const first = creates[0];
     if (first) {
       const { kind, evidence } = classifyCreateClientCall(first, sf);
-      clientFactories.push({ name: ex.name, kind, location, evidence });
+      clientFactories.push({ name: f.name, kind, location, evidence });
     }
   }
-  return { file: rel, clientFactories, authHelpers, imports };
+  return {
+    file: rel,
+    clientFactories,
+    authHelpers,
+    imports,
+    functions,
+    classes,
+    moduleVars,
+    reexports,
+    defaultExport
+  };
 }
 
 // packages/parser/src/parse-project.ts
@@ -831,151 +1149,411 @@ var FILTER_METHODS = /* @__PURE__ */ new Set([
 var WRITE_OPERATIONS = /* @__PURE__ */ new Set(["insert", "update", "upsert"]);
 var OPERATIONS = /* @__PURE__ */ new Set(["select", "insert", "update", "delete", "upsert"]);
 var PUBLIC_SECRET_ENV = /process\.env\.NEXT_PUBLIC_[A-Z0-9_]*(?:SERVICE_ROLE|SECRET)[A-Z0-9_]*/g;
-function resolveImport(spec, fromRel, files) {
-  let base;
-  const bases = [];
-  if (spec.startsWith("@/") || spec.startsWith("~/")) {
-    base = spec.slice(2);
-    const appRoot = appRootOf(fromRel);
-    if (appRoot) bases.push(posix.join(appRoot, base), posix.join(appRoot, "src", base));
-    bases.push(base, `src/${base}`);
-  } else if (spec.startsWith(".")) {
-    base = posix.normalize(posix.join(posix.dirname(fromRel), spec));
-    bases.push(base);
-  } else return null;
-  for (const b of bases) {
-    for (const c of [
-      `${b}.ts`,
-      `${b}.tsx`,
-      `${b}.js`,
-      `${b}.jsx`,
-      `${b}/index.ts`,
-      `${b}/index.tsx`,
-      b
-    ]) {
-      if (files.has(c)) return c;
+var MAX_DEPTH = 3;
+var WRAPPER_AUTH = /enhance(Action|RouteHandler)|auth|protected|session|guard|require|withUser/i;
+var REQUEST_NAME = /^(req|request)$/;
+var NO_ARG = { client: null, instance: null, tainted: false, isRequest: false };
+function ownFunctionSym(facts, name, fn) {
+  const factory = facts.clientFactories.find((c) => c.name === name);
+  if (factory) return { kind: "factory", factory };
+  const helper = facts.authHelpers.find((a) => a.name === name);
+  if (helper) return { kind: "auth", helper };
+  return { kind: "function", name, fn, facts };
+}
+function exportedSym(p, tf, name, depth) {
+  if (depth > 5) return null;
+  const f = tf.functions.get(name);
+  if (f?.exported) return ownFunctionSym(tf, name, f.fn);
+  const c = tf.classes.get(name);
+  if (c?.exported) return { kind: "class", cls: c, facts: tf };
+  const v = tf.moduleVars.get(name);
+  if (v?.exported) return { kind: "var", name, init: v.init, facts: tf };
+  if (name === "default" && tf.defaultExport) {
+    const local = tf.defaultExport;
+    const lf = tf.functions.get(local);
+    if (lf) return ownFunctionSym(tf, local, lf.fn);
+    const lc = tf.classes.get(local);
+    if (lc) return { kind: "class", cls: lc, facts: tf };
+    const lv = tf.moduleVars.get(local);
+    if (lv) return { kind: "var", name: local, init: lv.init, facts: tf };
+  }
+  for (const r of tf.reexports) {
+    const target = p.resolver.resolve(r.spec, tf.file);
+    const t = target ? p.registry.get(target) : void 0;
+    if (!t) continue;
+    if (r.star) {
+      const s = exportedSym(p, t, name, depth + 1);
+      if (s) return s;
+    } else if (r.alias === name) {
+      const s = exportedSym(p, t, r.name, depth + 1);
+      if (s) return s;
     }
   }
   return null;
 }
-function analyzeHandler(ctx) {
-  const { rel, sf, fn, facts, registry, files } = ctx;
-  const loc2 = (n) => ({ file: rel, line: lineOf(sf, n) });
-  const factories = /* @__PURE__ */ new Map();
-  const authHelpers = /* @__PURE__ */ new Map();
-  for (const [local, spec] of facts.imports) {
-    const target = resolveImport(spec, rel, files);
-    const tf = target ? registry.get(target) : void 0;
+function scopeOf(p, facts) {
+  const cached = p.scopes.get(facts.file);
+  if (cached) return cached;
+  const scope = /* @__PURE__ */ new Map();
+  p.scopes.set(facts.file, scope);
+  for (const [name, f] of facts.functions) scope.set(name, ownFunctionSym(facts, name, f.fn));
+  for (const [name, c] of facts.classes) scope.set(name, { kind: "class", cls: c, facts });
+  for (const [name, v] of facts.moduleVars) {
+    scope.set(name, { kind: "var", name, init: v.init, facts });
+  }
+  for (const [local, ref] of facts.imports) {
+    const target = p.resolver.resolve(ref.spec, facts.file);
+    const tf = target ? p.registry.get(target) : void 0;
     if (tf) {
-      const cf = tf.clientFactories.find((c) => c.name === local);
-      if (cf) factories.set(local, cf);
-      const ah = tf.authHelpers.find((a) => a.name === local);
-      if (ah) authHelpers.set(local, ah);
-    } else if (spec.startsWith(".") || spec.startsWith("@/") || spec.startsWith("~/")) {
-      let matched = false;
-      for (const f of registry.values()) {
-        const cf = f.clientFactories.find((c) => c.name === local);
-        if (cf) {
-          factories.set(local, cf);
-          matched = true;
-        }
-        const ah = f.authHelpers.find((a) => a.name === local);
-        if (ah) {
-          authHelpers.set(local, ah);
-          matched = true;
-        }
+      if (ref.imported === "*") scope.set(local, { kind: "namespace", facts: tf });
+      else {
+        const sym = exportedSym(p, tf, ref.imported, 0);
+        if (sym) scope.set(local, sym);
+      }
+      continue;
+    }
+    if (!/^[.~]|^@\//.test(ref.spec)) continue;
+    for (const f of p.registry.values()) {
+      const fn = f.functions.get(ref.imported);
+      if (!fn?.exported) continue;
+      const sym = ownFunctionSym(f, ref.imported, fn.fn);
+      if (sym.kind === "factory" || sym.kind === "auth") {
+        scope.set(local, sym);
+        p.warnings.push(
+          `unresolved import "${ref.spec}" in ${facts.file}; matched "${ref.imported}" by name`
+        );
+        break;
+      }
+    }
+  }
+  return scope;
+}
+function symOfCallee(p, callee, scope) {
+  if (ts5.isIdentifier(callee)) return scope.get(callee.text);
+  if (ts5.isPropertyAccessExpression(callee) && ts5.isIdentifier(callee.expression)) {
+    const ns = scope.get(callee.expression.text);
+    if (ns?.kind === "namespace") return exportedSym(p, ns.facts, callee.name.text, 0) ?? void 0;
+  }
+  return void 0;
+}
+function returnedExpressions(fn) {
+  if (!fn.body) return [];
+  if (!ts5.isBlock(fn.body)) return [fn.body];
+  return collect(fn.body, ts5.isReturnStatement).map((r) => r.expression).filter((e) => e !== void 0);
+}
+function factoryOfFunction(p, sym, depth) {
+  const key = `${sym.facts.file}#${sym.name}`;
+  if (p.factoryOfFn.has(key)) return p.factoryOfFn.get(key) ?? null;
+  p.factoryOfFn.set(key, null);
+  const sf = p.sources.get(sym.facts.file);
+  if (!sf || depth > 2) return null;
+  const scope = scopeOf(p, sym.facts);
+  let found = null;
+  for (const ret of returnedExpressions(sym.fn)) {
+    const u = unwrap(ret);
+    if (!ts5.isCallExpression(u)) continue;
+    found = classifyCall(p, u, sf, scope, null, depth + 1);
+    if (found) break;
+  }
+  p.factoryOfFn.set(key, found);
+  return found;
+}
+function classifyCall(p, call, sf, scope, _frame, depth) {
+  const sym = symOfCallee(p, call.expression, scope);
+  if (sym?.kind === "factory") {
+    return { kind: sym.factory.kind, name: sym.factory.name, location: sym.factory.location };
+  }
+  if (sym?.kind === "function") {
+    const b = factoryOfFunction(p, sym, depth);
+    if (b) return b;
+  }
+  if (isCreateClientCall(call, sf)) {
+    const c = classifyCreateClientCall(call, sf);
+    return {
+      kind: c.kind,
+      name: call.expression.getText(sf),
+      location: { file: sf.fileName, line: lineOf(sf, call) }
+    };
+  }
+  return null;
+}
+function instanceOfCall(p, call, frame, scope) {
+  const sym = symOfCallee(p, call.expression, scope);
+  if (sym?.kind !== "function") return null;
+  const fscope = scopeOf(p, sym.facts);
+  const params = sym.fn.parameters.map((pp) => ts5.isIdentifier(pp.name) ? pp.name.text : null);
+  for (const ret of returnedExpressions(sym.fn)) {
+    const u = unwrap(ret);
+    if (!ts5.isNewExpression(u) || !ts5.isIdentifier(u.expression)) continue;
+    const cs = fscope.get(u.expression.text);
+    if (cs?.kind !== "class") continue;
+    const ctorArgs = (u.arguments ?? []).map((a) => {
+      const ua = unwrap(a);
+      if (ts5.isIdentifier(ua)) {
+        const j = params.indexOf(ua.text);
+        if (j >= 0 && frame) return argBinding(p, call.arguments[j], frame);
+      }
+      return NO_ARG;
+    });
+    return { cls: cs.cls, facts: cs.facts, ctorArgs };
+  }
+  return null;
+}
+function varBinding(p, sym) {
+  const key = `${sym.facts.file}#${sym.name}`;
+  const cached = p.varBindings.get(key);
+  if (cached) return cached;
+  p.varBindings.set(key, NO_ARG);
+  const sf = p.sources.get(sym.facts.file);
+  if (!sf) return NO_ARG;
+  const scope = scopeOf(p, sym.facts);
+  const init = unwrap(sym.init);
+  let out = NO_ARG;
+  if (ts5.isCallExpression(init)) {
+    const found = classifyCall(p, init, sf, scope, null, 0);
+    const client = found ? {
+      kind: found.kind,
+      name: sym.name,
+      location: { file: sym.facts.file, line: lineOf(sf, init) }
+    } : null;
+    const instance = client ? null : instanceOfCall(p, init, null, scope);
+    out = { client, instance, tainted: false, isRequest: false };
+  } else if (ts5.isNewExpression(init) && ts5.isIdentifier(init.expression)) {
+    const cs = scope.get(init.expression.text);
+    if (cs?.kind === "class") {
+      out = {
+        client: null,
+        instance: { cls: cs.cls, facts: cs.facts, ctorArgs: [] },
+        tainted: false,
+        isRequest: false
+      };
+    }
+  }
+  p.varBindings.set(key, out);
+  return out;
+}
+function isQueryChain(call) {
+  return flattenChain(call).segments.some((s) => s.name === "from" || s.name === "rpc");
+}
+function derivedIn(frame, e) {
+  for (const id of identifiersIn(e)) if (frame.inputNames.has(id)) return true;
+  return frame.depth === 0 && /^(params|body|query|searchParams)\b/.test(e.getText(frame.sf));
+}
+function argBinding(p, arg, frame) {
+  if (!arg) return NO_ARG;
+  const u = unwrap(arg);
+  const scope = scopeOf(p, frame.facts);
+  let client = null;
+  let instance = null;
+  let isRequest = false;
+  if (ts5.isIdentifier(u)) {
+    client = frame.clients.get(u.text) ?? null;
+    instance = frame.instances.get(u.text) ?? null;
+    isRequest = frame.reqNames.has(u.text);
+    if (!client && !instance) {
+      const sym = scope.get(u.text);
+      if (sym?.kind === "var") {
+        const vb = varBinding(p, sym);
+        client = vb.client;
+        instance = vb.instance;
       }
-      if (matched)
-        ctx.warnings.push(`unresolved import "${spec}" in ${rel}; matched "${local}" by name`);
+    }
+  } else if (ts5.isPropertyAccessExpression(u) && u.expression.kind === ts5.SyntaxKind.ThisKeyword) {
+    const tp = frame.thisProps.get(u.name.text);
+    if (tp) {
+      client = tp.client;
+      instance = tp.instance;
+      isRequest = tp.isRequest;
+    }
+  } else if (ts5.isCallExpression(u)) {
+    client = classifyCall(p, u, frame.sf, scope, frame, 0);
+    if (!client) instance = instanceOfCall(p, u, frame, scope);
+  } else if (ts5.isNewExpression(u) && ts5.isIdentifier(u.expression)) {
+    const cs = scope.get(u.expression.text);
+    if (cs?.kind === "class") {
+      instance = {
+        cls: cs.cls,
+        facts: cs.facts,
+        ctorArgs: (u.arguments ?? []).map((a) => argBinding(p, a, frame))
+      };
     }
   }
-  for (const cf of facts.clientFactories) factories.set(cf.name, cf);
-  for (const ah of facts.authHelpers) authHelpers.set(ah.name, ah);
+  return { client, instance, tainted: derivedIn(frame, arg), isRequest };
+}
+function methodTarget(inst, method) {
+  const m = inst.cls.methods.get(method);
+  if (!m) return null;
+  const thisProps = /* @__PURE__ */ new Map();
+  for (const [prop, idx] of inst.cls.propFromParam)
+    thisProps.set(prop, inst.ctorArgs[idx] ?? NO_ARG);
+  return { fn: m, facts: inst.facts, name: `${inst.cls.name}.${method}`, cls: inst.cls, thisProps };
+}
+function callTarget(p, call, frame, scope) {
+  const callee = call.expression;
+  if (ts5.isIdentifier(callee)) {
+    const sym = scope.get(callee.text);
+    if (sym?.kind === "function") {
+      return { fn: sym.fn, facts: sym.facts, name: sym.name, cls: null, thisProps: /* @__PURE__ */ new Map() };
+    }
+    return null;
+  }
+  if (!ts5.isPropertyAccessExpression(callee)) return null;
+  const obj = callee.expression;
+  const method = callee.name.text;
+  if (ts5.isIdentifier(obj)) {
+    const inst = frame.instances.get(obj.text);
+    if (inst) return methodTarget(inst, method);
+    const sym = scope.get(obj.text);
+    if (sym?.kind === "namespace") {
+      const s = exportedSym(p, sym.facts, method, 0);
+      if (s?.kind === "function") {
+        return { fn: s.fn, facts: s.facts, name: s.name, cls: null, thisProps: /* @__PURE__ */ new Map() };
+      }
+    } else if (sym?.kind === "var") {
+      const vb = varBinding(p, sym);
+      if (vb.instance) return methodTarget(vb.instance, method);
+    }
+    return null;
+  }
+  if (obj.kind === ts5.SyntaxKind.ThisKeyword && frame.cls) {
+    const m = frame.cls.methods.get(method);
+    if (!m) return null;
+    return {
+      fn: m,
+      facts: frame.facts,
+      name: `${frame.cls.name}.${method}`,
+      cls: frame.cls,
+      thisProps: frame.thisProps
+    };
+  }
+  if (ts5.isPropertyAccessExpression(obj) && obj.expression.kind === ts5.SyntaxKind.ThisKeyword) {
+    const tp = frame.thisProps.get(obj.name.text);
+    if (tp?.instance) return methodTarget(tp.instance, method);
+  }
+  return null;
+}
+function analyzeFrame(p, frame, acc) {
+  const { rel, sf, fn } = frame;
+  const scope = scopeOf(p, frame.facts);
+  const loc2 = (n) => ({ file: rel, line: lineOf(sf, n) });
   const body = fn.body ?? fn;
-  const firstParam = fn.parameters[0];
-  const reqName = firstParam && ts4.isIdentifier(firstParam.name) ? firstParam.name.text : null;
-  const inputs = [];
-  const inputNames = /* @__PURE__ */ new Set(["params", "searchParams"]);
+  for (const [name, sym] of scope) {
+    if (sym.kind !== "var" || frame.clients.has(name) || frame.instances.has(name)) continue;
+    const vb = varBinding(p, sym);
+    if (vb.client) frame.clients.set(name, vb.client);
+    if (vb.instance) frame.instances.set(name, vb.instance);
+  }
   const addInput = (kind, name, n, bind) => {
-    if (!inputs.some((i) => i.kind === kind && i.name === name))
-      inputs.push({ kind, name, location: loc2(n) });
-    if (bind) inputNames.add(name);
+    if (!acc.inputs.some((i) => i.kind === kind && i.name === name)) {
+      acc.inputs.push({ kind, name, location: loc2(n) });
+    }
+    if (bind) frame.inputNames.add(name);
+  };
+  const isRequestCall = (text) => {
+    if (!/\.(json|formData|text)\(\)$/.test(text)) return false;
+    for (const r of frame.reqNames) if (text.startsWith(`${r}.`)) return true;
+    return frame.reqNames.size === 0 && /^(req|request)\./.test(text);
   };
-  if (ctx.kind === "server_action") {
-    for (const p of fn.parameters)
-      for (const nm of boundNames(p.name)) addInput("action_arg", nm, p, true);
-  }
-  walk(body, (n) => {
-    if (ts4.isVariableDeclaration(n) && n.initializer) {
-      const init = unwrap(n.initializer);
-      const text = init.getText(sf);
+  for (const decl of collect(body, ts5.isVariableDeclaration)) {
+    if (!decl.initializer) continue;
+    const init = unwrap(decl.initializer);
+    const names = boundNames(decl.name);
+    const text = init.getText(sf);
+    if (frame.depth === 0) {
       if (/^(params|context\.params|ctx\.params|props\.params)$/.test(text)) {
-        for (const nm of boundNames(n.name)) addInput("route_param", nm, n, true);
-      } else if (ts4.isCallExpression(init) && /\.(json|formData|text)\(\)$/.test(text) && (reqName ? text.startsWith(`${reqName}.`) : /^(req|request)\./.test(text))) {
-        for (const nm of boundNames(n.name)) addInput("body", nm, n, true);
-      } else if (/searchParams\.get\(|\.searchParams$|^new URL\(/.test(text)) {
-        for (const nm of boundNames(n.name)) addInput("query", nm, n, true);
-      } else if (/headers\.get\(/.test(text)) {
-        for (const nm of boundNames(n.name)) addInput("header", nm, n, true);
-      } else if (ts4.isIdentifier(init) && inputNames.has(init.text)) {
-        for (const nm of boundNames(n.name)) addInput("body", nm, n, true);
+        for (const nm of names) addInput("route_param", nm, decl, true);
+        continue;
+      }
+      if (ts5.isCallExpression(init) && isRequestCall(text)) {
+        for (const nm of names) addInput("body", nm, decl, true);
+        continue;
+      }
+      if (/searchParams\.get\(|\.searchParams$|^new URL\(/.test(text)) {
+        for (const nm of names) addInput("query", nm, decl, true);
+        continue;
+      }
+      if (/headers\.get\(/.test(text)) {
+        for (const nm of names) addInput("header", nm, decl, true);
+        continue;
       }
     }
-    if (ts4.isPropertyAccessExpression(n) && ts4.isIdentifier(n.expression) && n.expression.text === "params") {
-      addInput("route_param", n.name.text, n, false);
+    if (ts5.isCallExpression(init)) {
+      const client = classifyCall(p, init, sf, scope, frame, 0);
+      if (client && ts5.isIdentifier(decl.name)) {
+        frame.clients.set(decl.name.text, client);
+        continue;
+      }
+      const inst = instanceOfCall(p, init, frame, scope);
+      if (inst && ts5.isIdentifier(decl.name)) {
+        frame.instances.set(decl.name.text, inst);
+        continue;
+      }
+      if (isQueryChain(init)) continue;
+      if (returnsIdentity(p, init, sf, scope)) continue;
+      const args = init.arguments.map((a) => argBinding(p, a, frame));
+      if (args.some((a) => a.tainted || a.isRequest)) {
+        for (const nm of names) frame.inputNames.add(nm);
+      }
+    } else if (ts5.isNewExpression(init) && ts5.isIdentifier(init.expression)) {
+      const cs = scope.get(init.expression.text);
+      if (cs?.kind === "class" && ts5.isIdentifier(decl.name)) {
+        frame.instances.set(decl.name.text, {
+          cls: cs.cls,
+          facts: cs.facts,
+          ctorArgs: (init.arguments ?? []).map((a) => argBinding(p, a, frame))
+        });
+      }
+    } else if (ts5.isIdentifier(init)) {
+      const c = frame.clients.get(init.text);
+      if (c && ts5.isIdentifier(decl.name)) frame.clients.set(decl.name.text, c);
+      const i = frame.instances.get(init.text);
+      if (i && ts5.isIdentifier(decl.name)) frame.instances.set(decl.name.text, i);
+      if (frame.inputNames.has(init.text)) {
+        for (const nm of names) {
+          if (frame.depth === 0) addInput("body", nm, decl, true);
+          else frame.inputNames.add(nm);
+        }
+      }
+    } else if (!isChainWithQuery(init) && derivedIn(frame, init)) {
+      for (const nm of names) frame.inputNames.add(nm);
     }
-    return void 0;
-  });
-  const derived = (e) => {
-    for (const id of identifiersIn(e)) if (inputNames.has(id)) return true;
-    return /^(params|body|query|searchParams)\b/.test(e.getText(sf));
-  };
+  }
+  if (frame.depth === 0) {
+    walk(body, (n) => {
+      if (ts5.isPropertyAccessExpression(n) && ts5.isIdentifier(n.expression) && n.expression.text === "params") {
+        addInput("route_param", n.name.text, n, false);
+      }
+      return void 0;
+    });
+  }
   const isWholeInput = (e) => {
     const u = unwrap(e);
-    if (ts4.isIdentifier(u)) return inputNames.has(u.text);
-    if (ts4.isObjectLiteralExpression(u)) {
+    if (ts5.isIdentifier(u)) return frame.inputNames.has(u.text);
+    if (ts5.isObjectLiteralExpression(u)) {
       return u.properties.some(
-        (p) => ts4.isSpreadAssignment(p) && ts4.isIdentifier(unwrap(p.expression)) && inputNames.has(unwrap(p.expression).text)
+        (pr) => ts5.isSpreadAssignment(pr) && ts5.isIdentifier(unwrap(pr.expression)) && frame.inputNames.has(unwrap(pr.expression).text)
       );
     }
     return false;
   };
-  const classifyClientCall = (call) => {
-    if (ts4.isIdentifier(call.expression)) {
-      const f = factories.get(call.expression.text);
-      if (f) return { kind: f.kind, name: f.name, location: f.location };
-    }
-    if (isCreateClientCall(call, sf)) {
-      const c = classifyCreateClientCall(call, sf);
-      return { kind: c.kind, name: call.expression.getText(sf), location: loc2(call) };
-    }
-    return null;
-  };
-  const clients = /* @__PURE__ */ new Map();
-  const authChecks = [];
-  for (const call of collect(body, ts4.isCallExpression)) {
+  for (const call of collect(body, ts5.isCallExpression)) {
     const calleeText = call.expression.getText(sf);
-    if (/\.auth\.(getUser|getSession|getClaims)$/.test(calleeText)) authChecks.push(loc2(call));
-    else if (ts4.isIdentifier(call.expression) && authHelpers.has(call.expression.text))
-      authChecks.push(loc2(call));
-  }
-  for (const decl of collect(body, ts4.isVariableDeclaration)) {
-    if (!decl.initializer || !ts4.isIdentifier(decl.name)) continue;
-    const init = unwrap(decl.initializer);
-    if (!ts4.isCallExpression(init)) continue;
-    const binding = classifyClientCall(init);
-    if (binding) clients.set(decl.name.text, binding);
+    if (/\.auth\.(getUser|getSession|getClaims)$/.test(calleeText)) acc.authChecks.push(loc2(call));
+    else if (symOfCallee(p, call.expression, scope)?.kind === "auth")
+      acc.authChecks.push(loc2(call));
   }
-  const metadataAccesses = [];
-  for (const pa of collect(body, ts4.isPropertyAccessExpression)) {
+  for (const pa of collect(body, ts5.isPropertyAccessExpression)) {
     const inner = pa.expression;
-    if (ts4.isPropertyAccessExpression(inner) && (inner.name.text === "user_metadata" || inner.name.text === "app_metadata")) {
-      metadataAccesses.push({ path: pa.getText(sf), bucket: inner.name.text, location: loc2(pa) });
+    if (ts5.isPropertyAccessExpression(inner) && (inner.name.text === "user_metadata" || inner.name.text === "app_metadata")) {
+      acc.metadataAccesses.push({
+        path: pa.getText(sf),
+        bucket: inner.name.text,
+        location: loc2(pa)
+      });
     }
   }
-  const queries = [];
   const seen = /* @__PURE__ */ new Set();
-  for (const call of collect(body, ts4.isCallExpression)) {
+  for (const call of collect(body, ts5.isCallExpression)) {
     if (!isChainTail(call)) continue;
     const chain = flattenChain(call);
     const fromIdx = chain.segments.findIndex((s) => s.name === "from");
@@ -985,21 +1563,18 @@ function analyzeHandler(ctx) {
     if (anchorIdx < 0 || !anchor) continue;
     if (seen.has(anchor.node.pos)) continue;
     seen.add(anchor.node.pos);
-    let client = "unknown";
+    let binding = null;
     let clientName = null;
-    let clientLocation = null;
     const root = unwrap(chain.root);
-    let binding = null;
-    if (ts4.isIdentifier(root)) {
-      binding = clients.get(root.text) ?? null;
+    if (ts5.isIdentifier(root)) {
+      binding = frame.clients.get(root.text) ?? null;
       if (!binding) clientName = root.text;
-    } else if (ts4.isCallExpression(root)) {
-      binding = classifyClientCall(root);
-    }
-    if (binding) {
-      client = binding.kind;
-      clientName = binding.name;
-      clientLocation = binding.location;
+    } else if (ts5.isCallExpression(root)) {
+      binding = classifyCall(p, root, sf, scope, frame, 0);
+      if (!binding) clientName = root.expression.getText(sf);
+    } else if (ts5.isPropertyAccessExpression(root) && root.expression.kind === ts5.SyntaxKind.ThisKeyword) {
+      binding = frame.thisProps.get(root.name.text)?.client ?? null;
+      if (!binding) clientName = root.getText(sf);
     }
     const after = chain.segments.slice(anchorIdx + 1);
     let operation = fromIdx >= 0 ? "unknown" : "rpc";
@@ -1011,7 +1586,7 @@ function analyzeHandler(ctx) {
         if (WRITE_OPERATIONS.has(operation) && arg) {
           payload = {
             text: arg.getText(sf).replace(/\s+/g, " ").slice(0, 200),
-            inputDerived: derived(arg),
+            inputDerived: derivedIn(frame, arg),
             wholeInput: isWholeInput(arg)
           };
         }
@@ -1022,14 +1597,14 @@ function analyzeHandler(ctx) {
     for (const s of after) {
       if (!FILTER_METHODS.has(s.name)) continue;
       const first = s.args[0];
-      if (s.name === "match" && first && ts4.isObjectLiteralExpression(first)) {
-        for (const p of first.properties) {
-          if (ts4.isPropertyAssignment(p)) {
+      if (s.name === "match" && first && ts5.isObjectLiteralExpression(first)) {
+        for (const pr of first.properties) {
+          if (ts5.isPropertyAssignment(pr)) {
             filters.push({
               method: "match",
-              column: p.name.getText(sf).replace(/['"]/g, ""),
-              valueText: p.initializer.getText(sf),
-              inputDerived: derived(p.initializer)
+              column: pr.name.getText(sf).replace(/['"]/g, ""),
+              valueText: pr.initializer.getText(sf),
+              inputDerived: derivedIn(frame, pr.initializer)
             });
           }
         }
@@ -1040,38 +1615,137 @@ function analyzeHandler(ctx) {
         method: s.name,
         column: stringLiteralValue(first),
         valueText: val ? val.getText(sf) : "",
-        inputDerived: val ? derived(val) : false
+        inputDerived: val ? derivedIn(frame, val) : false
       });
     }
-    queries.push({
+    const query = {
       table: stringLiteralValue(anchor.args[0]) ?? "(dynamic)",
       operation,
-      client,
-      clientName,
-      clientLocation,
+      client: binding?.kind ?? "unknown",
+      clientName: binding?.name ?? clientName,
+      clientLocation: binding?.location ?? null,
       filters,
       payload,
       location: loc2(anchor.node),
       text: call.getText(sf).replace(/\s+/g, " ").slice(0, 200)
+    };
+    if (frame.via.length > 0) query.via = frame.via;
+    acc.queries.push(query);
+  }
+  if (frame.depth >= MAX_DEPTH) return;
+  for (const call of collect(body, ts5.isCallExpression)) {
+    const target = callTarget(p, call, frame, scope);
+    if (!target) continue;
+    const tsf = p.sources.get(target.facts.file);
+    if (!tsf) continue;
+    const child = {
+      rel: target.facts.file,
+      sf: tsf,
+      facts: target.facts,
+      fn: target.fn,
+      depth: frame.depth + 1,
+      via: [...frame.via, `${target.name} (${target.facts.file}:${lineOf(tsf, target.fn)})`],
+      inputNames: /* @__PURE__ */ new Set(),
+      reqNames: /* @__PURE__ */ new Set(),
+      clients: /* @__PURE__ */ new Map(),
+      instances: /* @__PURE__ */ new Map(),
+      cls: target.cls,
+      thisProps: target.thisProps
+    };
+    target.fn.parameters.forEach((param, i) => {
+      const ab = argBinding(p, call.arguments[i], frame);
+      const names = boundNames(param.name);
+      const head = names[0];
+      if (ab.client && head !== void 0 && ts5.isIdentifier(param.name)) {
+        child.clients.set(head, ab.client);
+      }
+      if (ab.instance && head !== void 0 && ts5.isIdentifier(param.name)) {
+        child.instances.set(head, ab.instance);
+      }
+      for (const nm of names) {
+        if (ab.isRequest) child.reqNames.add(nm);
+        if (ab.tainted) child.inputNames.add(nm);
+      }
     });
+    const signature = [
+      ...[...child.clients].map(([n, c]) => `${n}=${c.kind}`),
+      ...[...child.inputNames].map((n) => `${n}!`),
+      ...[...child.reqNames].map((n) => `${n}?`),
+      ...[...child.thisProps].map(([n, b]) => `this.${n}=${b.client?.kind ?? "-"}`)
+    ].sort();
+    const key = `${target.facts.file}#${target.name}#${signature.join(",")}`;
+    if (acc.visited.has(key)) continue;
+    acc.visited.add(key);
+    analyzeFrame(p, child, acc);
+  }
+}
+function isChainWithQuery(e) {
+  return ts5.isCallExpression(e) && isQueryChain(e);
+}
+var IDENTITY_CALLEE = /\.auth\.|user|session|claims|auth|principal|viewer/i;
+function returnsIdentity(p, call, sf, scope) {
+  if (symOfCallee(p, call.expression, scope)?.kind === "auth") return true;
+  return IDENTITY_CALLEE.test(call.expression.getText(sf));
+}
+function analyzeHandler(p, h) {
+  const { rel, sf, fn } = h;
+  const loc2 = (n) => ({ file: rel, line: lineOf(sf, n) });
+  const acc = {
+    inputs: [],
+    authChecks: [],
+    queries: [],
+    metadataAccesses: [],
+    visited: /* @__PURE__ */ new Set()
+  };
+  const frame = {
+    rel,
+    sf,
+    facts: h.facts,
+    fn,
+    depth: 0,
+    via: [],
+    inputNames: /* @__PURE__ */ new Set(["params", "searchParams"]),
+    reqNames: /* @__PURE__ */ new Set(),
+    clients: /* @__PURE__ */ new Map(),
+    instances: /* @__PURE__ */ new Map(),
+    cls: null,
+    thisProps: /* @__PURE__ */ new Map()
+  };
+  const first = fn.parameters[0];
+  if (h.kind === "route" && first) {
+    if (ts5.isIdentifier(first.name)) frame.reqNames.add(first.name.text);
+    else for (const nm of boundNames(first.name)) if (REQUEST_NAME.test(nm)) frame.reqNames.add(nm);
+  }
+  if (h.kind === "server_action") {
+    const params = h.wrapper ? fn.parameters.slice(0, 1) : fn.parameters;
+    for (const prm of params) {
+      for (const nm of boundNames(prm.name)) {
+        if (!acc.inputs.some((i) => i.kind === "action_arg" && i.name === nm)) {
+          acc.inputs.push({ kind: "action_arg", name: nm, location: loc2(prm) });
+        }
+        frame.inputNames.add(nm);
+      }
+    }
   }
-  const entry = ctx.kind === "route" ? `${ctx.method} ${ctx.route}` : `server action ${ctx.route}`;
-  const stmt = enclosingStatement(ctx.node);
+  if (h.wrapper && WRAPPER_AUTH.test(h.wrapper)) acc.authChecks.push(loc2(h.node));
+  analyzeFrame(p, frame, acc);
+  const entry = h.kind === "route" ? `${h.method} ${h.route}` : h.kind === "page" ? `PAGE ${h.route}` : `server action ${h.route}`;
+  const stmt = enclosingStatement(h.node);
   const ignores = parseIgnoreDirectives(sf, stmt.getFullStart()).map((d) => ({
     ruleId: d.ruleId,
     reason: d.reason,
     location: { file: rel, line: d.line }
   }));
   return {
-    kind: ctx.kind,
-    route: ctx.route,
-    method: ctx.method,
+    kind: h.kind,
+    route: h.route,
+    method: h.method,
     entry,
-    location: loc2(ctx.node),
-    inputs,
-    authChecks,
-    queries,
-    metadataAccesses,
+    location: loc2(h.node),
+    inputs: acc.inputs,
+    authChecks: acc.authChecks,
+    queries: acc.queries,
+    metadataAccesses: acc.metadataAccesses,
     ignores
   };
 }
@@ -1087,7 +1761,7 @@ function findExposures(rel, sf) {
     });
   }
   if (isClientComponentFile(sf)) {
-    for (const call of collect(sf, ts4.isCallExpression)) {
+    for (const call of collect(sf, ts5.isCallExpression)) {
       if (!isCreateClientCall(call, sf)) continue;
       const c = classifyCreateClientCall(call, sf);
       if (c.kind === "service_role") {
@@ -1106,12 +1780,16 @@ function findExposures(rel, sf) {
 }
 function parseProject(rootInput, opts = {}) {
   const root = resolve2(rootInput);
-  const { source, sql } = discoverFiles(root, opts.sqlDirs ?? [], opts.ignore ?? []);
+  const { source, sql, manifests, tsconfigs } = discoverFiles(
+    root,
+    opts.sqlDirs ?? [],
+    opts.ignore ?? []
+  );
   const warnings = [];
   const sources = /* @__PURE__ */ new Map();
   for (const rel of source) {
     try {
-      sources.set(rel, parseSource(rel, readFileSync(join2(root, rel), "utf8")));
+      sources.set(rel, parseSource(rel, readFileSync2(join3(root, rel), "utf8")));
     } catch (e) {
       warnings.push(`could not read ${rel}: ${e instanceof Error ? e.message : String(e)}`);
     }
@@ -1121,12 +1799,20 @@ function parseProject(rootInput, opts = {}) {
   const tables = /* @__PURE__ */ new Map();
   for (const rel of sql) {
     try {
-      parseSqlForRls(rel, readFileSync(resolve2(root, rel), "utf8"), tables);
+      parseSqlForRls(rel, readFileSync2(resolve2(root, rel), "utf8"), tables);
     } catch (e) {
       warnings.push(`could not read ${rel}: ${e instanceof Error ? e.message : String(e)}`);
     }
   }
-  const files = new Set(source);
+  const project = {
+    sources,
+    registry,
+    resolver: new Resolver(root, new Set(source), manifests, tsconfigs, warnings),
+    scopes: /* @__PURE__ */ new Map(),
+    factoryOfFn: /* @__PURE__ */ new Map(),
+    varBindings: /* @__PURE__ */ new Map(),
+    warnings
+  };
   const routes = [];
   const exposures = [];
   const fileIgnores = {};
@@ -1139,34 +1825,56 @@ function parseProject(rootInput, opts = {}) {
     if (top.length > 0) fileIgnores[rel] = top;
     exposures.push(...findExposures(rel, sf));
     const facts = registry.get(rel) ?? analyzeModule(rel, sf);
-    const common = { rel, sf, facts, registry, files, warnings };
     const route = routeFromFile(rel);
     if (route) {
       for (const { method, exported } of routeHandlersIn(sf)) {
         routes.push(
-          analyzeHandler({
-            ...common,
+          analyzeHandler(project, {
+            rel,
+            sf,
+            facts,
             kind: "route",
             route,
             method,
             fn: exported.fn,
-            node: exported.node
+            node: exported.node,
+            wrapper: exported.wrapper
           })
         );
       }
     } else if (isServerActionFile(sf)) {
       for (const ex of exportedFunctions(sf)) {
         routes.push(
-          analyzeHandler({
-            ...common,
+          analyzeHandler(project, {
+            rel,
+            sf,
+            facts,
             kind: "server_action",
             route: ex.name,
             method: "ACTION",
             fn: ex.fn,
-            node: ex.node
+            node: ex.node,
+            wrapper: ex.wrapper
           })
         );
       }
+    } else {
+      const page = pageFromFile(rel);
+      const handler = page !== null && !isClientComponentFile(sf) ? pageHandlerIn(sf) : null;
+      if (page !== null && handler) {
+        const analysed = analyzeHandler(project, {
+          rel,
+          sf,
+          facts,
+          kind: "page",
+          route: page,
+          method: "PAGE",
+          fn: handler.fn,
+          node: handler.node,
+          wrapper: handler.wrapper
+        });
+        if (analysed.queries.length > 0 || analysed.inputs.length > 0) routes.push(analysed);
+      }
     }
   }
   routes.sort((a, b) => a.entry.localeCompare(b.entry));
@@ -1241,6 +1949,9 @@ function queryViews(ctx, handler) {
 function locations(...refs) {
   return refs.filter((r) => r !== void 0);
 }
+function viaNote(q) {
+  return q.via && q.via.length > 0 ? ` Reached through ${q.via.join(" -> ")}.` : "";
+}
 function rlsNote(t, tableName) {
   if (!t?.known) return `public.${tableName} was not found in migrations; RLS state unknown.`;
   if (!t.rlsEnabled) return `RLS is disabled on public.${tableName}.`;
@@ -1292,7 +2003,7 @@ var serviceRoleObjectAccessWithoutTenantScope = {
         const evidence = [
           {
             kind: "rule",
-            summary: `${q.operation} on public.${tableName} filtered by user-controlled "${idFilter.column}" through a service-role client, with no tenant/owner scoping. ${authNote} ${rlsNote(v.tableData, tableName)}`,
+            summary: `${q.operation} on public.${tableName} filtered by user-controlled "${idFilter.column}" through a service-role client, with no tenant/owner scoping. ${authNote} ${rlsNote(v.tableData, tableName)}${viaNote(q)}`,
             locations: locations(h.handler.location, v.query.location, v.client?.location),
             data: {
               deterministic: false,
@@ -1326,46 +2037,75 @@ var tableWithoutRls = {
   confidence: 0.9,
   cwe: ["CWE-284", "CWE-862"],
   evaluate(ctx) {
-    const out = [];
-    const seen = /* @__PURE__ */ new Set();
+    const groups = /* @__PURE__ */ new Map();
     for (const h of handlerViews(ctx)) {
       for (const v of queryViews(ctx, h.handler)) {
         const c = v.clientData;
         if (c?.kind !== "anon" && c?.kind !== "user_scoped") continue;
         const t = v.tableData;
         if (!t?.known || t.rlsEnabled) continue;
-        const key = `${t.table}:${h.data.entry}`;
-        if (seen.has(key)) continue;
-        seen.add(key);
-        const path = [
-          "HTTP request",
-          h.data.entry,
-          `${c.name} (${c.kind}, RLS would apply)`,
-          `public.${t.table} (RLS disabled)`
-        ];
-        out.push(
-          finding(ctx, this, {
-            title: `Table "${t.table}" is exposed without RLS`,
-            entrypoints: [h.data.entry],
-            sources: h.inputs.map((i) => `${i.kind}:${i.name}`),
-            sinks: [`supabase.${v.data.operation}:public.${t.table}`],
-            path,
-            evidence: [
-              {
-                kind: "rule",
-                summary: `public.${t.table} has no "enable row level security" in migrations but is queried with a ${c.kind} client. Anyone holding the public anon key can read every row directly through PostgREST.`,
-                locations: locations(v.query.location, v.table?.location),
-                data: { deterministic: true, ruleId: this.id }
-              },
-              { kind: "trace", summary: path.join(" -> ") }
-            ]
-          })
-        );
+        const g = group(groups, t.table, () => ({
+          path: [
+            "HTTP request",
+            h.data.entry,
+            `${c.name} (${c.kind}, RLS would apply)`,
+            `public.${t.table} (RLS disabled)`
+          ],
+          summary: `public.${t.table} has no "enable row level security" in migrations but is queried with a ${c.kind} client. Anyone holding the public anon key can read every row directly through PostgREST.`,
+          title: `Table "${t.table}" is exposed without RLS`,
+          data: { deterministic: true, ruleId: this.id },
+          tail: locations(v.table?.location)
+        }));
+        addReach(g, h, v, `supabase.${v.data.operation}:public.${t.table}`);
       }
     }
-    return out;
+    return emitGroups(ctx, this, groups);
   }
 };
+function group(groups, key, init) {
+  let g = groups.get(key);
+  if (!g) {
+    g = { ...init(), entrypoints: [], sources: /* @__PURE__ */ new Set(), sinks: /* @__PURE__ */ new Set(), queryLocations: [] };
+    groups.set(key, g);
+  }
+  return g;
+}
+function addReach(g, h, v, sink) {
+  if (!g.entrypoints.includes(h.data.entry)) g.entrypoints.push(h.data.entry);
+  for (const i of h.inputs) g.sources.add(`${i.kind}:${i.name}`);
+  g.sinks.add(sink);
+  if (v.query.location && !g.queryLocations.some((l) => sameRef(l, v.query.location))) {
+    g.queryLocations.push(v.query.location);
+  }
+}
+function sameRef(a, b) {
+  return b !== void 0 && a.file === b.file && a.line === b.line;
+}
+function emitGroups(ctx, rule, groups) {
+  const out = [];
+  for (const g of groups.values()) {
+    const reached = g.entrypoints.length > 1 ? ` Reached from ${g.entrypoints.length} entry points.` : "";
+    out.push(
+      finding(ctx, rule, {
+        title: g.title,
+        entrypoints: g.entrypoints,
+        sources: [...g.sources],
+        sinks: [...g.sinks],
+        path: g.path,
+        evidence: [
+          {
+            kind: "rule",
+            summary: g.summary + reached,
+            locations: [...g.queryLocations, ...g.tail],
+            data: g.data
+          },
+          { kind: "trace", summary: g.path.join(" -> ") }
+        ]
+      })
+    );
+  }
+  return out;
+}
 var rlsPolicyWithoutCallerPredicate = {
   id: "supabase.rls-policy-without-caller-predicate",
   title: "RLS policy grants rows without a caller predicate",
@@ -1374,8 +2114,7 @@ var rlsPolicyWithoutCallerPredicate = {
   confidence: 0.85,
   cwe: ["CWE-863", "CWE-284"],
   evaluate(ctx) {
-    const out = [];
-    const seen = /* @__PURE__ */ new Set();
+    const groups = /* @__PURE__ */ new Map();
     for (const h of handlerViews(ctx)) {
       for (const v of queryViews(ctx, h.handler)) {
         const c = v.clientData;
@@ -1388,37 +2127,23 @@ var rlsPolicyWithoutCallerPredicate = {
           if (p.command !== "all" && p.command !== op) continue;
           const expr = op === "insert" ? p.check : p.using;
           if (expr === null || policyScopesToCaller(expr)) continue;
-          const key = `${t.table}:${p.name}:${h.data.entry}`;
-          if (seen.has(key)) continue;
-          seen.add(key);
-          const path = [
-            "HTTP request",
-            h.data.entry,
-            `${c.name} (${c.kind})`,
-            `public.${t.table} policy "${p.name}" ${op === "insert" ? "with check" : "using"} (${expr})`
-          ];
-          out.push(
-            finding(ctx, this, {
-              title: `RLS policy "${p.name}" on "${t.table}" does not scope rows to the caller`,
-              entrypoints: [h.data.entry],
-              sources: h.inputs.map((i) => `${i.kind}:${i.name}`),
-              sinks: [`supabase.${op}:public.${t.table}`],
-              path,
-              evidence: [
-                {
-                  kind: "rule",
-                  summary: `Policy "${p.name}" for ${p.command} on public.${t.table} uses (${expr}). The table has a scope column (${t.columns.filter(isScopeColumn).join(", ")}) but the policy never compares it to auth.uid() or the caller's tenant, so RLS lets every ${p.roles.join("/") || "authenticated"} user through.`,
-                  locations: locations(v.query.location, p.location),
-                  data: { deterministic: false, ruleId: this.id, policy: p.name }
-                },
-                { kind: "trace", summary: path.join(" -> ") }
-              ]
-            })
-          );
+          const g = group(groups, `${t.table}:${p.name}:${p.command}`, () => ({
+            path: [
+              "HTTP request",
+              h.data.entry,
+              `${c.name} (${c.kind})`,
+              `public.${t.table} policy "${p.name}" ${op === "insert" ? "with check" : "using"} (${expr})`
+            ],
+            summary: `Policy "${p.name}" for ${p.command} on public.${t.table} uses (${expr}). The table has a scope column (${t.columns.filter(isScopeColumn).join(", ")}) but the policy never compares it to auth.uid() or the caller's tenant, so RLS lets every ${p.roles.join("/") || "authenticated"} user through.`,
+            title: `RLS policy "${p.name}" on "${t.table}" does not scope rows to the caller`,
+            data: { deterministic: false, ruleId: this.id, policy: p.name },
+            tail: locations(p.location)
+          }));
+          addReach(g, h, v, `supabase.${op}:public.${t.table}`);
         }
       }
     }
-    return out;
+    return emitGroups(ctx, this, groups);
   }
 };
 var userControlledTenantScope = {
@@ -1698,10 +2423,10 @@ var defaultRules = [...supabaseAuthorizationPack];
 
 // packages/scanner/src/scan.ts
 function readAuditConfig(root) {
-  const p = join3(root, "audit.config.json");
+  const p = join4(root, "audit.config.json");
   if (!existsSync(p)) return {};
   try {
-    const raw = JSON.parse(readFileSync2(p, "utf8"));
+    const raw = JSON.parse(readFileSync3(p, "utf8"));
     return {
       ...Array.isArray(raw.ignore) ? { ignore: raw.ignore.filter((x) => typeof x === "string") } : {},
       ...Array.isArray(raw.migrations) ? { migrations: raw.migrations.filter((x) => typeof x === "string") } : {}