canship 0.4.0 → 0.5.0

package/dist/index.js

@@ -8,6 +8,7 @@ import { resolve as resolve2 } from "path";
 var IRRELEVANT_HOSTS = /^(?:localhost|127\.0\.0\.1|0\.0\.0\.0|\[::1\]|host\.docker\.internal|.*\.?example\.(?:com|org|net)|.*\.(?:test|invalid|localhost))$/i;
 var JWT_SOURCE = String.raw`eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}`;
 var SB_SECRET_SOURCE = String.raw`sb_secret_[A-Za-z0-9_-]{8,}`;
+var PRIVATE_KEY_BEGIN_SOURCE = String.raw`-----BEGIN (?:(?:RSA|EC|DSA|OPENSSH|ENCRYPTED|PGP) )?PRIVATE KEY(?: BLOCK)?-----`;
 var SECRET_PATTERNS = [
   {
     id: "openai",
@@ -133,7 +134,7 @@ var SECRET_PATTERNS = [
     id: "private-key",
     name: "Private key file contents",
     rotateLabel: "private key",
-    pattern: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----/g,
+    pattern: new RegExp(PRIVATE_KEY_BEGIN_SOURCE, "g"),
     impact: "A private key in source code can be used to impersonate your server, decrypt traffic, or log into your machines."
   },
   {
@@ -214,13 +215,29 @@ function redactSecret(secret) {
   return `${head}\u2026(${secret.length} chars)\u2026${tail}`;
 }
 function redactLine(line, secret) {
-  const trimmed = line.trim();
+  const trimmed = redactPrivateKeys(line.trim());
   if (!secret) return trimmed;
   return trimmed.split(secret).join(redactSecret(secret));
 }
 var JWT_SHAPED = new RegExp(String.raw`\b${JWT_SOURCE}\b`, "g");
+function redactPrivateKeys(text) {
+  const starts = new RegExp(PRIVATE_KEY_BEGIN_SOURCE, "g");
+  const parts = [];
+  let from = 0;
+  let match;
+  while ((match = starts.exec(text)) !== null) {
+    const closing = match[0].replace("BEGIN ", "END ");
+    const end = text.indexOf(closing, starts.lastIndex);
+    parts.push(text.slice(from, match.index), "[REDACTED PRIVATE KEY]");
+    from = end === -1 ? text.length : end + closing.length;
+    starts.lastIndex = from;
+    if (end === -1) break;
+  }
+  parts.push(text.slice(from));
+  return parts.join("");
+}
 function redactAll(text) {
-  let out = text;
+  let out = redactPrivateKeys(text);
   for (const pat of SECRET_PATTERNS) {
     const re = new RegExp(pat.pattern.source, pat.pattern.flags);
     out = out.replace(re, (match) => redactSecret(match));
@@ -235,8 +252,8 @@ function truncate(s, max = 120) {
 import { basename as basename2 } from "path";
 
 // src/walker.ts
-import { readdirSync, readFileSync as readFileSync2, statSync as statSync2, lstatSync as lstatSync2, openSync, readSync, closeSync } from "fs";
-import { join as join2, relative as relative2, sep as sep2, extname, basename } from "path";
+import { opendirSync, readFileSync as readFileSync2, statSync as statSync2, lstatSync as lstatSync2, realpathSync as realpathSync2, openSync, readSync, closeSync } from "fs";
+import { join as join2, relative as relative2, isAbsolute as isAbsolute2, sep as sep2, extname, basename } from "path";
 
 // src/git.ts
 import { execFileSync } from "child_process";
@@ -473,6 +490,7 @@ function execGitBatch(executable, root, args, input, options = {}) {
 var MAX_FILE_BYTES = 2 * 1024 * 1024;
 var MAX_SCAN_BYTES = 128 * 1024 * 1024;
 var MAX_SCAN_FILES = 1e4;
+var MAX_WALK_ENTRIES = 5e4;
 var MAX_WALK_DEPTH = 16;
 var SKIP_DIRS = /* @__PURE__ */ new Set([
   "node_modules",
@@ -649,16 +667,16 @@ var BINARY_EXTENSIONS = /* @__PURE__ */ new Set([
   ".sqlite3",
   ".mo"
 ]);
-function probeFileType(absPath) {
+function probeFileType(absPath, limit) {
   let fd = null;
   try {
     fd = openSync(absPath, "r");
-    const buf = Buffer.alloc(PROBE_BYTES);
-    const read = readSync(fd, buf, 0, PROBE_BYTES, 0);
+    const buf = Buffer.alloc(limit);
+    const read = readSync(fd, buf, 0, limit, 0);
     const head = buf.subarray(0, read);
     const hasTextBom = head.length >= 2 && head[0] === 255 && head[1] === 254 || head.length >= 2 && head[0] === 254 && head[1] === 255 || head.length >= 3 && head[0] === 239 && head[1] === 187 && head[2] === 191;
-    if (hasTextBom) return { kind: "text" };
-    return head.includes(0) ? { kind: "binary" } : { kind: "text" };
+    if (hasTextBom) return { kind: "text", bytes: read };
+    return { kind: head.includes(0) ? "binary" : "text", bytes: read };
   } catch (err) {
     return {
       kind: "unreadable",
@@ -731,10 +749,13 @@ function listViaGit(root, gitExecutable) {
     return null;
   }
 }
-function walkTree(root, skipped, wantAll) {
+function walkTree(root, skipped, wantAll, maxEntries) {
   const all = [];
   const found = [];
+  let visited = 0;
+  let exhausted = false;
   const walk = (dir, depth) => {
+    if (exhausted) return;
     if (depth > MAX_WALK_DEPTH) {
       skipped.push({
         path: relative2(root, dir).split(sep2).join("/") || ".",
@@ -745,7 +766,7 @@ function walkTree(root, skipped, wantAll) {
     }
     let entries;
     try {
-      entries = readdirSync(dir, { withFileTypes: true });
+      entries = opendirSync(dir);
     } catch (err) {
       if (!isMissing(err)) {
         skipped.push({
@@ -756,31 +777,57 @@ function walkTree(root, skipped, wantAll) {
       }
       return;
     }
-    for (const entry of entries) {
-      const full = join2(dir, entry.name);
-      const rel = relative2(root, full).split(sep2).join("/");
-      if (entry.isSymbolicLink()) {
-        if (!SKIP_DIRS.has(entry.name)) {
-          skipped.push({ path: rel, reason: "symlink", detail: "symbolic links are not followed" });
+    try {
+      while (!exhausted) {
+        const entry = entries.readSync();
+        if (entry === null) break;
+        if (visited >= maxEntries) {
+          exhausted = true;
+          skipped.push({
+            path: relative2(root, dir).split(sep2).join("/") || ".",
+            reason: "directory-unreadable",
+            detail: `directory entry budget exceeded (${maxEntries} entries)`
+          });
+          break;
         }
-        continue;
-      }
-      if (entry.isDirectory()) {
-        if (SKIP_DIRS.has(entry.name)) continue;
-        walk(full, depth + 1);
-        continue;
-      }
-      if (!entry.isFile()) continue;
-      if (wantAll) all.push(rel);
-      let isCandidate = isEnvFile(entry.name) || CREDENTIAL_FILENAMES.has(entry.name) || CREDENTIAL_EXTENSIONS.has(extname(entry.name).toLowerCase());
-      if (!isCandidate && isWorthProbing(rel)) {
-        const probe = probeFileType(full);
-        if (probe.kind === "text") isCandidate = true;
-        else if (probe.kind === "unreadable") {
-          skipped.push({ path: rel, reason: "unreadable", detail: probe.detail });
+        visited++;
+        const full = join2(dir, entry.name);
+        const rel = relative2(root, full).split(sep2).join("/");
+        let metadata;
+        try {
+          metadata = lstatSync2(full);
+        } catch (err) {
+          if (!isMissing(err)) skipped.push({
+            path: rel,
+            reason: "unreadable",
+            detail: String(err instanceof Error ? err.message : err)
+          });
+          continue;
+        }
+        if (metadata.isSymbolicLink()) {
+          if (!SKIP_DIRS.has(entry.name)) {
+            skipped.push({ path: rel, reason: "symlink", detail: "symbolic links are not followed" });
+          }
+          continue;
+        }
+        if (metadata.isDirectory()) {
+          if (SKIP_DIRS.has(entry.name)) continue;
+          walk(full, depth + 1);
+          continue;
         }
+        if (!metadata.isFile()) continue;
+        if (wantAll) all.push(rel);
+        const isCandidate = isEnvFile(entry.name) || CREDENTIAL_FILENAMES.has(entry.name) || CREDENTIAL_EXTENSIONS.has(extname(entry.name).toLowerCase()) || isWorthProbing(rel);
+        if (isCandidate) found.push(rel);
       }
-      if (isCandidate) found.push(rel);
+    } catch (err) {
+      if (!isMissing(err)) skipped.push({
+        path: relative2(root, dir).split(sep2).join("/") || ".",
+        reason: "directory-unreadable",
+        detail: String(err instanceof Error ? err.message : err)
+      });
+    } finally {
+      entries.closeSync();
     }
   };
   walk(root, 0);
@@ -824,11 +871,41 @@ function isExampleContext(relPath) {
   if (/\.(test|spec)\.[jt]sx?$/i.test(name)) return true;
   return false;
 }
+function readablePath(root, path, skipped) {
+  const rel = relative2(root, path);
+  if (!rel || rel === ".." || rel.startsWith(`..${sep2}`) || isAbsolute2(rel)) {
+    skipped.push({ path: ".", reason: "unreadable", detail: "candidate path is outside the scan root" });
+    return false;
+  }
+  let current = root;
+  for (const segment of rel.split(sep2)) {
+    current = join2(current, segment);
+    const stat = lstatSync2(current);
+    if (stat.isSymbolicLink()) {
+      const linked = relative2(root, current).split(sep2).join("/");
+      if (!skipped.some((item) => item.path === linked && item.reason === "symlink")) {
+        skipped.push({ path: linked, reason: "symlink", detail: "symbolic links are not followed" });
+      }
+      return false;
+    }
+  }
+  const real = relative2(root, realpathSync2(path));
+  if (real === ".." || real.startsWith(`..${sep2}`) || isAbsolute2(real)) {
+    skipped.push({ path: rel.split(sep2).join("/"), reason: "unreadable", detail: "resolved path is outside the scan root" });
+    return false;
+  }
+  if (!lstatSync2(path).isFile()) {
+    skipped.push({ path: rel.split(sep2).join("/"), reason: "unreadable", detail: "not a regular file" });
+    return false;
+  }
+  return true;
+}
 function collectFiles(root, isGitRepo, gitExecutable = resolveGitExecutable(root), limits = {}, honorIgnoreMarkers = true) {
+  root = realpathSync2(root);
   const skipped = [];
   const ignored = [];
   const fromGit = isGitRepo ? listViaGit(root, gitExecutable) : null;
-  const walked = walkTree(root, skipped, fromGit === null);
+  const walked = walkTree(root, skipped, fromGit === null, limits.maxEntries ?? MAX_WALK_ENTRIES);
   const listed = fromGit?.files ?? walked.all;
   const candidates = /* @__PURE__ */ new Set();
   let vendored = 0;
@@ -862,14 +939,10 @@ function collectFiles(root, isGitRepo, gitExecutable = resolveGitExecutable(root
     const absPath = join2(root, relPath);
     let content;
     try {
-      if (lstatSync2(absPath).isSymbolicLink()) {
-        if (!skipped.some((entry) => entry.path === relPath && entry.reason === "symlink")) {
-          skipped.push({ path: relPath, reason: "symlink", detail: "symbolic links are not followed" });
-        }
-        continue;
-      }
+      if (!readablePath(root, absPath, skipped)) continue;
       const size = statSync2(absPath).size;
-      if (size > MAX_FILE_BYTES) {
+      const needsProbe = isWorthProbing(relPath);
+      if (!needsProbe && size > MAX_FILE_BYTES) {
         skipped.push({
           path: relPath,
           reason: "too-large",
@@ -877,7 +950,8 @@ function collectFiles(root, isGitRepo, gitExecutable = resolveGitExecutable(root
         });
         continue;
       }
-      if (filesRead >= maxFiles || bytesRead + size > maxBytes) {
+      const initialBytes = needsProbe ? Math.min(size, PROBE_BYTES) : size;
+      if (filesRead >= maxFiles || bytesRead + initialBytes > maxBytes) {
         skipped.push({
           path: relPath,
           reason: "too-large",
@@ -885,9 +959,30 @@ function collectFiles(root, isGitRepo, gitExecutable = resolveGitExecutable(root
         });
         break;
       }
+      filesRead++;
+      if (needsProbe) {
+        const probe = probeFileType(absPath, initialBytes);
+        if (probe.kind === "unreadable") {
+          skipped.push({ path: relPath, reason: "unreadable", detail: probe.detail });
+          continue;
+        }
+        bytesRead += probe.bytes;
+        if (probe.kind === "binary") continue;
+        if (size > MAX_FILE_BYTES) {
+          skipped.push({
+            path: relPath,
+            reason: "too-large",
+            detail: `${Math.round(size / 1024)} KB, cap is ${MAX_FILE_BYTES / 1024} KB`
+          });
+          continue;
+        }
+        if (bytesRead + size > maxBytes) {
+          skipped.push({ path: relPath, reason: "too-large", detail: "scan read budget exceeded after file probe" });
+          break;
+        }
+      }
       const bytes = readFileSync2(absPath);
       bytesRead += bytes.length;
-      filesRead++;
       if (bytesRead > maxBytes) {
         skipped.push({ path: relPath, reason: "too-large", detail: "scan read budget exceeded during file read" });
         break;
@@ -997,6 +1092,69 @@ function endOfString(src, start, quote) {
   }
   return length;
 }
+var REGEX_PREFIX_WORDS = /* @__PURE__ */ new Set(["return", "throw", "case", "delete", "void", "typeof", "instanceof", "in", "of", "new", "yield", "await", "else", "do"]);
+var CONTROL_WORDS = /* @__PURE__ */ new Set(["if", "while", "for", "with", "switch", "catch"]);
+var regexContext = () => ({ allowed: true, control: false, member: false, parentheses: [], failedUntil: -1 });
+function valueEnded(context) {
+  context.allowed = false;
+  context.control = false;
+  context.member = false;
+}
+function regexAt(src, start, context) {
+  if (!context.allowed || start < context.failedUntil || src[start + 1] === "=") return null;
+  let inClass = false;
+  for (let i = start + 1; i < src.length; i++) {
+    const ch = src[i];
+    if (ch === "\n" || ch === "\r") {
+      context.failedUntil = i;
+      return null;
+    }
+    if (ch === "\\") {
+      i++;
+      continue;
+    }
+    if (ch === "[") inClass = true;
+    else if (ch === "]") inClass = false;
+    else if (ch === "/" && !inClass) {
+      let end = i + 1;
+      while (end < src.length && /[A-Za-z]/.test(src[end])) end++;
+      valueEnded(context);
+      return { close: i, end };
+    }
+  }
+  context.failedUntil = src.length;
+  return null;
+}
+function advanceCode(src, at, context) {
+  const ch = src[at];
+  if (/\s/.test(ch)) return at + 1;
+  if (/[A-Za-z_$\u0080-\uffff]/.test(ch)) {
+    let end = at + 1;
+    while (end < src.length && /[\w$\u0080-\uffff]/.test(src[end])) end++;
+    const word = src.slice(at, end);
+    context.control = !context.member && CONTROL_WORDS.has(word);
+    context.allowed = !context.member && REGEX_PREFIX_WORDS.has(word);
+    context.member = false;
+    return end;
+  }
+  if (ch === "(") {
+    context.parentheses.push(context.control);
+    context.allowed = true;
+  } else if (ch === ")") context.allowed = context.parentheses.pop() ?? false;
+  else if (ch === "." || ch === "?" && src[at + 1] === ".") {
+    context.allowed = false;
+    context.control = false;
+    context.member = true;
+    return at + (ch === "?" ? 2 : 1);
+  } else if ((ch === "+" || ch === "-") && src[at + 1] === ch) {
+    context.control = false;
+    context.member = false;
+    return at + 2;
+  } else context.allowed = !/[\d\]}]/.test(ch);
+  context.control = false;
+  context.member = false;
+  return at + 1;
+}
 function maskTemplate(src, out, start, maskStrings = true) {
   const length = src.length;
   const stack = [{ kind: "literal", from: start + 1 }];
@@ -1012,12 +1170,14 @@ function maskTemplate(src, out, start, maskStrings = true) {
       if (ch === BACKTICK) {
         if (maskStrings) blank(out, frame.from, i);
         stack.pop();
+        const parent = stack[stack.length - 1];
+        if (parent?.kind === "expression") valueEnded(parent.lexical);
         i++;
         continue;
       }
       if (ch === DOLLAR && src.charCodeAt(i + 1) === OPEN_BRACE) {
         if (maskStrings) blank(out, frame.from, i);
-        stack.push({ kind: "expression", depth: 1 });
+        stack.push({ kind: "expression", depth: 1, lexical: regexContext() });
         i += 2;
         continue;
       }
@@ -1033,10 +1193,17 @@ function maskTemplate(src, out, start, maskStrings = true) {
         i = stop;
         continue;
       }
+      const regex = regexAt(src, i, frame.lexical);
+      if (regex) {
+        if (maskStrings) blank(out, i + 1, regex.close);
+        i = regex.end;
+        continue;
+      }
     }
     if (ch === DOUBLE_QUOTE || ch === SINGLE_QUOTE) {
       const stop = endOfString(src, i, ch);
       if (maskStrings) blank(out, i + 1, stop - 1);
+      valueEnded(frame.lexical);
       i = stop;
       continue;
     }
@@ -1054,7 +1221,7 @@ function maskTemplate(src, out, start, maskStrings = true) {
         if (parent.kind === "literal") parent.from = i + 1;
       }
     }
-    i++;
+    i = advanceCode(src, i, frame.lexical);
   }
   const last = stack[stack.length - 1];
   if (maskStrings && last?.kind === "literal") blank(out, last.from, length);
@@ -1064,6 +1231,7 @@ function maskJsComments(src) {
   const length = src.length;
   const out = codesOf(src);
   let i = 0;
+  const lexical = regexContext();
   while (i < length) {
     const ch = src.charCodeAt(i);
     if (ch === SLASH) {
@@ -1083,15 +1251,24 @@ function maskJsComments(src) {
         continue;
       }
     }
+    if (ch === SLASH) {
+      const regex = regexAt(src, i, lexical);
+      if (regex) {
+        i = regex.end;
+        continue;
+      }
+    }
     if (ch === DOUBLE_QUOTE || ch === SINGLE_QUOTE) {
       i = endOfString(src, i, ch);
+      valueEnded(lexical);
       continue;
     }
     if (ch === BACKTICK) {
       i = maskTemplate(src, out, i, false);
+      valueEnded(lexical);
       continue;
     }
-    i++;
+    i = advanceCode(src, i, lexical);
   }
   return stringOf(out);
 }
@@ -1099,6 +1276,7 @@ function maskJsNoise(src) {
   const length = src.length;
   const out = codesOf(src);
   let i = 0;
+  const lexical = regexContext();
   while (i < length) {
     const ch = src.charCodeAt(i);
     if (ch === SLASH) {
@@ -1118,17 +1296,27 @@ function maskJsNoise(src) {
         continue;
       }
     }
+    if (ch === SLASH) {
+      const regex = regexAt(src, i, lexical);
+      if (regex) {
+        blank(out, i + 1, regex.close);
+        i = regex.end;
+        continue;
+      }
+    }
     if (ch === DOUBLE_QUOTE || ch === SINGLE_QUOTE) {
       const stop = endOfString(src, i, ch);
       blank(out, i + 1, stop - 1);
+      valueEnded(lexical);
       i = stop;
       continue;
     }
     if (ch === BACKTICK) {
       i = maskTemplate(src, out, i);
+      valueEnded(lexical);
       continue;
     }
-    i++;
+    i = advanceCode(src, i, lexical);
   }
   return stringOf(out);
 }
@@ -2562,7 +2750,7 @@ function policyFindings(ctx, policies, live, keyOf, buckets) {
         ...p.command === "select" || p.command === "insert" ? [`Public read-only tables and open forms can be intentional. If this one is, keep it and consider restricting the columns the API exposes.`] : []
       ],
       fix: [
-        `Replace the condition with one that ties each row to its owner, e.g. USING ((select auth.uid()) = user_id)${p.command === "insert" || p.command === "update" || p.command === "all" ? " and WITH CHECK ((select auth.uid()) = user_id)" : ""}.`,
+        `Tie each row to its owner; adapt user_id to your schema. For ${p.command.toUpperCase()}, use ` + (p.command === "insert" ? "WITH CHECK ((select auth.uid()) = user_id)." : `USING ((select auth.uid()) = user_id)${p.command === "update" || p.command === "all" ? " and WITH CHECK ((select auth.uid()) = user_id)" : ""}.`),
         `If a broad policy is needed as a base, add an AS RESTRICTIVE policy alongside it to limit which rows it reaches.`,
         `Keep the change in a migration, so the rule travels with your code.`
       ],
@@ -2664,7 +2852,7 @@ function checkRealtimeRules(file, ctx) {
         ]
       ],
       fix: [
-        `Require sign-in and ownership instead, for example: ".read": "auth !== null && auth.uid === $uid" under a "$uid" node.`,
+        `Require sign-in and ownership for ${[openRead ? ".read" : "", openWrite ? ".write" : ""].filter(Boolean).join(" and ")}. For a per-user "$uid" node, use "auth !== null && auth.uid === $uid" for each of those rule values; adapt the path to your data model.`,
         `Test the new rules with the Firebase emulator before deploying.`,
         ...openWrite ? [`If this database has been open for a while, assume the data has already been copied or changed.`] : []
       ]
@@ -2718,6 +2906,18 @@ var WRITE_OPS = /* @__PURE__ */ new Set(["write", "create", "update", "delete"])
 function parseOps(raw) {
   return raw.split(",").map((s) => s.trim().toLowerCase()).filter(Boolean);
 }
+function ownershipAdvice(product, rawOps) {
+  const prefix = `Replace the open or date-based condition for ${rawOps.trim()} with authentication and ownership checks. `;
+  if (product !== "Firestore") {
+    return prefix + "Bind request.auth.uid to the owner in the matched path or trusted metadata; use rules for your Firebase product and data model. Do not grant additional operations.";
+  }
+  const ops = new Set(parseOps(rawOps));
+  const checks = ["Require request.auth != null. Adapt userId to your ownership field."];
+  if (ops.has("create") || ops.has("write")) checks.push("For create, check request.resource.data.userId == request.auth.uid; no existing resource is available.");
+  if (ops.has("update") || ops.has("write")) checks.push("For update, check resource.data.userId == request.auth.uid and request.resource.data.userId == resource.data.userId to prevent ownership changes.");
+  if (["read", "get", "list", "delete", "write"].some((op) => ops.has(op))) checks.push("For read or delete operations already allowed here, check resource.data.userId == request.auth.uid.");
+  return prefix + checks.join(" ") + " Do not grant additional operations.";
+}
 function neutralizePathWildcards(content) {
   return content.replace(/\{[a-zA-Z_]\w*(?:\s*=\s*\*\*)?\}/g, (m) => "_".repeat(m.length));
 }
@@ -2816,7 +3016,7 @@ var firebaseRulesRule = {
           `Writes are still denied by default, so this is only a problem if the data is not meant to be public. If it is a public catalogue or announcements, ignore this \u2014 and consider adding "allow write: if false;" to make that intent explicit.`
         ],
         fix: canWrite ? [
-          `Decide who should actually have access. For per-user data the usual rule is: allow read, write: if request.auth != null && request.auth.uid == resource.data.userId;`,
+          ownershipAdvice(product, rawOps),
           `For data that is genuinely public, restrict it to reads only: allow read: if true; allow write: if false;`,
           `Test your rules with the Firebase emulator before deploying, so you do not lock yourself out.`,
           `If this database has been open for a while, assume the data has already been copied.`
@@ -2854,7 +3054,7 @@ var firebaseRulesRule = {
           `Neither state is what you want in production.`
         ],
         fix: [
-          `Replace the date check with a real authorisation rule. For per-user data: allow read, write: if request.auth != null && request.auth.uid == resource.data.userId;`,
+          ownershipAdvice(product, rawOps),
           `Test the new rules with the Firebase emulator before deploying.`,
           expired ? `Note that your app is currently denied access here, so fixing this also fixes whatever stopped working.` : `Do this before ${dateStr}, otherwise your app breaks on that date.`
         ]
@@ -2907,6 +3107,256 @@ function namePattern(names) {
   return [...names].map((name) => name.replace(/\$/g, "\\$")).join("|");
 }
 
+// src/rules/auth-values.ts
+var limited = /* @__PURE__ */ new WeakSet();
+var cache2 = /* @__PURE__ */ new WeakMap();
+var reverseCache = /* @__PURE__ */ new WeakMap();
+var identityFlowLimited = (file) => limited.has(file);
+function bindingNames(pattern, path = []) {
+  const text = pattern.trim();
+  if (path.length > 8) return (text.match(/[A-Za-z_$][\w$]*/g) ?? []).map((name) => ({ name, path: null }));
+  if (/^[A-Za-z_$][\w$]*$/.test(text)) return [{ name: text, path }];
+  if (text.startsWith("{") && text.endsWith("}")) {
+    const parts = [];
+    let from = 1, depth = 0;
+    for (let i = 1; i < text.length - 1; i++) {
+      if ("{[(".includes(text[i])) depth++;
+      else if ("}])".includes(text[i])) depth--;
+      else if (text[i] === "," && depth === 0) {
+        parts.push(text.slice(from, i));
+        from = i + 1;
+      }
+    }
+    parts.push(text.slice(from, -1));
+    const result = [];
+    for (const part of parts) {
+      if (!part.trim()) continue;
+      const property = /^\s*([A-Za-z_$][\w$]*)(?:\s*:\s*([^=]+))?\s*$/.exec(part);
+      if (property) result.push(...bindingNames(property[2] ?? property[1], [...path, property[1]]));
+      else for (const name of part.match(/[A-Za-z_$][\w$]*/g) ?? []) result.push({ name, path: null });
+    }
+    return result;
+  }
+  return (text.match(/[A-Za-z_$][\w$]*/g) ?? []).map((name) => ({ name, path: null }));
+}
+function argumentExpressions(code, source, start, end, pairs) {
+  const result = [];
+  let from = start;
+  for (let i = start; i < end; i++) {
+    if (code[i] === ",") {
+      result.push(source.slice(from, i).trim());
+      from = i + 1;
+    }
+    const close = pairs.get(i);
+    if (close !== void 0) i = close;
+  }
+  if (from < end) result.push(source.slice(from, end).trim());
+  return result;
+}
+function authValuesOf(file, body, bodies, pairs) {
+  let contexts = cache2.get(file);
+  if (!contexts) {
+    contexts = /* @__PURE__ */ new Map();
+    cache2.set(file, contexts);
+  }
+  let found = contexts.get(body.start);
+  if (!found) {
+    found = new AuthValues(file, body, bodies, pairs);
+    contexts.set(body.start, found);
+  }
+  return found;
+}
+var AuthValues = class {
+  constructor(file, body, bodies, pairs) {
+    this.file = file;
+    const code = noiseMaskedOf(file);
+    const source = commentsMaskedOf(file);
+    let open = code.indexOf("(", body.declaration);
+    let close = pairs.get(open);
+    if (code.startsWith("=>", body.declaration)) {
+      const window = code.slice(Math.max(0, body.declaration - 300), body.declaration);
+      const before = window.trimEnd();
+      if (before.endsWith(")")) {
+        close = body.declaration - (window.length - before.length) - 1;
+        let reverse = reverseCache.get(file);
+        if (!reverse) {
+          reverse = new Map([...pairs].map(([left, right]) => [right, left]));
+          reverseCache.set(file, reverse);
+        }
+        open = reverse.get(close) ?? -1;
+      } else {
+        const single = /([A-Za-z_$][\w$]*)$/.exec(before)?.[1];
+        if (single) this.parameters.set(single, 0);
+        open = -1;
+      }
+    }
+    if (open >= 0 && close !== void 0 && close < body.start) {
+      argumentExpressions(code, code, open + 1, close, pairs).forEach((part, index) => {
+        const name = /^([A-Za-z_$][\w$]*)(?:\s*\??\s*:[^=]+)?$/.exec(part)?.[1];
+        if (name) this.parameters.set(name, index);
+      });
+    }
+    const text = code.slice(body.start + 1, body.end);
+    const endOf = (start) => {
+      const boundary = Math.min(body.end, start + 4001);
+      let previous = "";
+      for (let i = start; i < boundary; i++) {
+        if (code[i] === ";" || code[i] === "}") return i;
+        if (code[i] === "\n") {
+          let next = i + 1;
+          while (next < boundary && /\s/.test(code[next])) next++;
+          if (next === boundary && boundary < body.end) return boundary;
+          if (!/[.?+\-*/%&|^,:([`=]/.test(code[next] ?? "") && !/[=+\-*/%&|^?:,.]/.test(previous)) return i;
+          i = next - 1;
+          continue;
+        }
+        if (!/\s/.test(code[i])) previous = code[i];
+        const close2 = pairs.get(i);
+        if (close2 !== void 0) {
+          i = close2;
+          previous = code[close2];
+        }
+      }
+      return boundary;
+    };
+    for (const match2 of text.matchAll(/\b(?:if|for|while|switch|catch)\s*\(/g)) {
+      const close2 = pairs.get(body.start + 1 + match2.index + match2[0].length - 1);
+      if (close2 === void 0) continue;
+      let start = close2 + 1;
+      while (/\s/.test(code[start] ?? "")) start++;
+      this.conditions.push({ start, end: pairs.get(start) ?? endOf(start) });
+      if (this.conditions.length > 512) {
+        this.exhausted = true;
+        limited.add(file);
+        break;
+      }
+    }
+    let low = 0, high = bodies.length;
+    while (low < high) {
+      const middle = low + high >>> 1;
+      if (bodies[middle].declaration <= body.start) low = middle + 1;
+      else high = middle;
+    }
+    const nested = [];
+    for (let i = low; i < bodies.length && bodies[i].declaration < body.end; i++) nested.push(bodies[i]);
+    let nestedIndex = 0;
+    let count = 0;
+    const declarations = /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*|[\[{])|(?<![\w$.])([A-Za-z_$][\w$]*)\s*=(?!=|>)/g;
+    let match;
+    while ((match = declarations.exec(text)) !== null) {
+      if (this.exhausted) break;
+      const at = body.start + 1 + match.index;
+      while (nestedIndex < nested.length && nested[nestedIndex].end < at) nestedIndex++;
+      if (nested[nestedIndex] && at >= nested[nestedIndex].declaration && at < nested[nestedIndex].end) continue;
+      if (++count > 512) {
+        this.exhausted = true;
+        limited.add(file);
+        break;
+      }
+      let binding = match[1] ?? match[2];
+      let from = at + match[0].length;
+      if (match[1]) {
+        if (binding === "{" || binding === "[") {
+          const start = from - 1;
+          const close2 = pairs.get(start);
+          if (close2 === void 0) continue;
+          if (close2 - start > 4e3) {
+            this.exhausted = true;
+            limited.add(file);
+            break;
+          }
+          binding = code.slice(start, close2 + 1);
+          from = close2 + 1;
+        }
+        while (/\s/.test(code[from] ?? "")) from++;
+        if (code[from] === ":") {
+          const type = /^:[^=;\n]{1,120}/.exec(code.slice(from, from + 121));
+          if (type) from += type[0].length;
+        }
+        if (code[from] !== "=" || /[=>]/.test(code[from + 1] ?? "")) continue;
+        from++;
+      }
+      while (/\s/.test(code[from] ?? "")) from++;
+      declarations.lastIndex = from - body.start - 1;
+      const end = endOf(from);
+      for (const { name, path } of bindingNames(binding)) {
+        if (!this.assignments.has(name) && this.assignments.size >= 512) {
+          this.exhausted = true;
+          limited.add(file);
+          break;
+        }
+        const list = this.assignments.get(name) ?? [];
+        list.push({ at, expression: end - from <= 4e3 ? source.slice(from, end).trim() : "", projection: path, overLimit: end - from > 4e3 });
+        this.assignments.set(name, list);
+      }
+    }
+  }
+  file;
+  assignments = /* @__PURE__ */ new Map();
+  parameters = /* @__PURE__ */ new Map();
+  conditions = [];
+  exhausted = false;
+  value(expression, at, depth = 0) {
+    if (depth >= 8) limited.add(this.file);
+    if (this.exhausted || depth >= 8) return { kind: "opaque" };
+    const expr = expression.trim();
+    if (expr.length > 4e3) {
+      limited.add(this.file);
+      return { kind: "opaque" };
+    }
+    if (/^process\.env\.[A-Z_][A-Z0-9_]*$/.test(expr)) return { kind: "secret" };
+    if (/^(?:(?:true|false|null|undefined)\b|\d|['"`{\[])/.test(expr)) return { kind: "literal" };
+    const call = /^(?:await\s+)?((?:[A-Za-z_$][\w$]*\.)*(?:getUser|getUserSession|getSession|getServerSession|safeGetSession|currentUser|verifyIdToken|auth))\s*\(/.exec(expr);
+    const callee = call?.[1];
+    const identityCall = callee && !/\.(?:body|query|headers|cookies)\b/.test(callee);
+    if (identityCall) {
+      if (!/^await\s+/.test(expr)) return { kind: "promise" };
+      const masked = maskJsNoise(expr);
+      let depth2 = 1, end = call[0].length;
+      for (; end < masked.length && depth2 > 0; end++) {
+        if (masked[end] === "(") depth2++;
+        else if (masked[end] === ")") depth2--;
+      }
+      if (depth2 !== 0 || masked.slice(end).trim() !== "") return { kind: "opaque" };
+      if (/\|\||&&|\?(?!\.)|\.then\s*\(/.test(expr) || /\.catch\s*\(/.test(expr)) return { kind: "opaque" };
+      return { kind: /\.auth\.getUser\s*\(/.test(expr) ? "envelope" : "identity" };
+    }
+    if (/\.(?:body|query|headers|cookies|searchParams)\b|\.(?:json|text|formData)\s*\(/.test(expr)) return { kind: "input" };
+    const access = /^([A-Za-z_$][\w$]*)((?:\??\.[A-Za-z_$][\w$]*)*)$/.exec(expr);
+    if (!access) return { kind: "opaque" };
+    const name = access[1];
+    const list = this.assignments.get(name) ?? [];
+    let low = 0, high = list.length;
+    while (low < high) {
+      const middle = low + high >>> 1;
+      if (list[middle].at < at) low = middle + 1;
+      else high = middle;
+    }
+    const assignment = list[low - 1];
+    let value;
+    if (assignment) {
+      if (assignment.overLimit) {
+        limited.add(this.file);
+        return { kind: "opaque" };
+      }
+      if (this.conditions.some((range) => range.start <= assignment.at && assignment.at <= range.end && !(range.start <= at && at <= range.end))) return { kind: "opaque" };
+      value = this.value(assignment.expression, assignment.at, depth + 1);
+      if (assignment.projection === null) value = { kind: "opaque" };
+      else if (assignment.projection.length && value.kind === "envelope") value = {
+        kind: assignment.projection.join(".") === "data.user" ? "identity" : "opaque"
+      };
+    } else if (this.parameters.has(name)) value = { kind: "parameter", parameters: [this.parameters.get(name)] };
+    else value = { kind: "unknown" };
+    if (value.kind === "envelope") return { kind: /^\??\.data\??\.user$/.test(access[2]) ? "identity" : "envelope" };
+    return value;
+  }
+};
+function identityRequirement(value, allowParameters) {
+  if (value.kind === "identity") return [];
+  if (allowParameters && value.kind === "parameter") return value.parameters ?? [];
+  return null;
+}
+
 // src/rules/apiauth.ts
 var APP_ROUTER = /(?:^|\/)app\/api\/(?:.+\/)?route\.[mc]?[jt]sx?$/;
 var PAGES_ROUTER = /(?:^|\/)pages\/api\/.+\.[mc]?[jt]sx?$/;
@@ -3153,7 +3603,7 @@ function rejectsMissingIdentity(term, returnsDeniedStatus) {
   const rejects = NEGATED_IDENTITY.test(term) || IDENTITY_IS_EMPTY.test(term) || IDENTITY_MISMATCH.test(term);
   return rejects && (AUTH_CONDITION.test(term) || returnsDeniedStatus);
 }
-function hasConditionalAuthGuard(code) {
+function hasConditionalAuthGuard(code, requireThrow = false, accept) {
   const starts = /\bif\s*\(/g;
   let match;
   while ((match = starts.exec(code)) !== null) {
@@ -3167,7 +3617,7 @@ function hasConditionalAuthGuard(code) {
     let stopsRequest = false;
     for (let i = 0; i < body.length; i++) {
       if (STOPS_REQUEST.test(body.slice(i, i + 16)) && (i === 0 || !/[\w$]/.test(body[i - 1]))) {
-        stopsRequest = true;
+        stopsRequest = !requireThrow || !/^return\b/.test(body.slice(i, i + 16));
         break;
       }
       if (/^if\s*\(/.test(body.slice(i, i + 16))) break;
@@ -3179,7 +3629,10 @@ function hasConditionalAuthGuard(code) {
     starts.lastIndex = statementStart + statement.length;
     if (!stopsRequest) continue;
     const returnsDeniedStatus = DENIED_STATUS.test(statement);
-    const negative = !/&&|\?(?!\.)/.test(condition) && condition.split("||").some((part) => rejectsMissingIdentity(part.trim(), returnsDeniedStatus));
+    const negative = !/&&|\?(?!\.)/.test(condition) && condition.split("||").some((part) => {
+      const term = part.trim();
+      return accept ? (NEGATED_IDENTITY.test(term) || IDENTITY_IS_EMPTY.test(term) || IDENTITY_MISMATCH.test(term)) && accept(term) : rejectsMissingIdentity(term, returnsDeniedStatus);
+    });
     if (negative) return true;
   }
   return false;
@@ -3281,6 +3734,18 @@ function unguardedOpsOf(file) {
   }
   return hit;
 }
+function operationsInRange(ops, start, end) {
+  const lowerBound = (value) => {
+    let low = 0, high = ops.length;
+    while (low < high) {
+      const middle = low + high >>> 1;
+      if (ops[middle].index < value) low = middle + 1;
+      else high = middle;
+    }
+    return low;
+  };
+  return ops.slice(lowerBound(start + 1), lowerBound(end));
+}
 var lineStartsCache = /* @__PURE__ */ new WeakMap();
 function lineStartsCached(file) {
   let hit = lineStartsCache.get(file);
@@ -3291,38 +3756,96 @@ function lineStartsCached(file) {
   return hit;
 }
 function cachedByFile(check) {
-  const cache2 = /* @__PURE__ */ new WeakMap();
+  const cache3 = /* @__PURE__ */ new WeakMap();
   return (file) => {
-    let hit = cache2.get(file);
+    let hit = cache3.get(file);
     if (hit === void 0) {
       hit = check(file);
-      cache2.set(file, hit);
+      cache3.set(file, hit);
     }
     return hit;
   };
 }
-function unguardedOperations(file, ops, extra) {
+var localAuthNamesCache = /* @__PURE__ */ new WeakMap();
+var controlFlowLimited = /* @__PURE__ */ new WeakSet();
+function localAuthNames(file) {
+  const cached = localAuthNamesCache.get(file);
+  if (cached) return cached;
+  const names = new Set(bindingsOf(file).imports.filter((binding) => binding.spec && normalizeSpec(binding.spec, file.path)).map((binding) => binding.local));
+  const { declared, shadowed } = guardBindings(file);
+  for (const name of declared) names.add(name);
+  for (const name of shadowed) names.add(name);
+  localAuthNamesCache.set(file, names);
+  return names;
+}
+function unguardedOperations(file, ops, extra, requireThrow = false, observe) {
   if (ops.length === 0) return ops;
   const code = noiseMaskedOf(file);
   const pairs = delimiterPairs(code);
   const bodies = functionBodies(code, pairs);
   const declarations = new Map(bodies.map((body) => [body.declaration, body]));
   const functionStarts = new Set(bodies.map((body) => body.start));
+  const bodiesByStart = new Map(bodies.map((body) => [body.start, body]));
+  const localNames = localAuthNames(file);
   const guardEnds = /* @__PURE__ */ new Map();
   const guardNames = /* @__PURE__ */ new Map();
+  const guardRequirements = /* @__PURE__ */ new Map();
   const extraCalls = extra?.guards.size ? new RegExp(`^(${namePattern(extra.guards)})\\s*\\(`) : null;
   const blocks = [...pairs].filter(([start]) => code[start] === "{").map(([start, end]) => ({ start, end })).sort((a, b) => a.start - b.start);
   const active = [];
   let blockIndex = 0;
   const wrapperPattern = extra?.wrappers.size ? new RegExp(`(?<![\\w$.])(${namePattern(extra.wrappers)})\\s*\\(`, "g") : null;
   const wrappers = [
-    ...code.matchAll(/\b(withAuth|NextAuth)\s*\(/g),
+    ...[...code.matchAll(/\b(withAuth|NextAuth)\s*\(/g)].filter((match) => !localNames.has(match[1])),
     ...wrapperPattern ? code.matchAll(wrapperPattern) : []
   ].map((match) => {
     const open = match.index + match[0].length - 1;
     return { start: open, end: pairs.get(open) ?? open, name: match[1] };
   });
-  const guardEnd = (owner) => {
+  const skipSpace = (at) => {
+    while (/\s/.test(code[at] ?? "")) at++;
+    return at;
+  };
+  const blockAt = (at) => {
+    const start = skipSpace(at);
+    const end = pairs.get(start);
+    return code[start] === "{" && end !== void 0 ? { start, end } : null;
+  };
+  const denies = (block) => {
+    for (let i = block.start + 1; i < block.end; i++) {
+      if (i > 0 && /[\w$]/.test(code[i - 1])) continue;
+      const tail = code.slice(i, i + 400);
+      if (/^(?:if|for|while|switch|try)\b/.test(tail)) return false;
+      if (/^(?:throw|redirect|notFound)\b|^error\s*\(\s*40[13]\b/.test(tail)) return true;
+      if (/^return\b/.test(tail)) return !requireThrow && DENIED_STATUS.test(code.slice(i, statementEnd2(code, i, block.end, pairs)));
+      const end = pairs.get(i);
+      if (end !== void 0) i = end;
+    }
+    return false;
+  };
+  const checkedEnd = (block, fn, depth) => {
+    const cached = guardEnds.get(block.start);
+    if (cached !== void 0) return cached;
+    const result = guardEnd(block, fn, depth);
+    guardEnds.set(block.start, result);
+    return result;
+  };
+  const allProtected = (owner, children, fn, depth) => {
+    const required = /* @__PURE__ */ new Set();
+    for (const child of children) {
+      if (!Number.isFinite(checkedEnd(child, fn, depth + 1)) && !denies(child)) return false;
+      for (const argument of guardRequirements.get(child.start) ?? []) required.add(argument);
+    }
+    guardRequirements.set(owner.start, [...required]);
+    const name = children.map((child) => guardNames.get(child.start)).find(Boolean);
+    if (name) guardNames.set(owner.start, name);
+    return true;
+  };
+  const guardEnd = (owner, fn, depth = 0) => {
+    if (depth > 8) {
+      controlFlowLimited.add(file);
+      return Infinity;
+    }
     for (let i = owner.start + 1; i < owner.end; i++) {
       const nested = declarations.get(i);
       if (nested) {
@@ -3334,6 +3857,35 @@ function unguardedOperations(file, ops, extra) {
         continue;
       }
       if (i > 0 && /[\w$]/.test(code[i - 1])) continue;
+      if (/^try\s*\{/.test(code.slice(i, i + 32))) {
+        const attempted = blockAt(i + 3);
+        if (attempted) {
+          let cursor = skipSpace(attempted.end + 1);
+          const children = [attempted];
+          if (/^catch\b/.test(code.slice(cursor, cursor + 8))) {
+            cursor = skipSpace(cursor + 5);
+            if (code[cursor] === "(") cursor = skipSpace((pairs.get(cursor) ?? cursor) + 1);
+            const caught = blockAt(cursor);
+            if (!caught) {
+              i = attempted.end;
+              continue;
+            }
+            children.push(caught);
+            cursor = skipSpace(caught.end + 1);
+          }
+          let overrides = false;
+          if (/^finally\b/.test(code.slice(cursor, cursor + 10))) {
+            const final = blockAt(cursor + 7);
+            if (final) {
+              overrides = /\breturn\b/.test(code.slice(final.start + 1, final.end));
+              cursor = final.end + 1;
+            }
+          }
+          if (!overrides && allProtected(owner, children, fn, depth)) return cursor;
+          i = cursor - 1;
+          continue;
+        }
+      }
       const conditional = /^if\s*\(/.exec(code.slice(i, i + 32));
       if (conditional) {
         const open = i + conditional[0].length - 1;
@@ -3342,12 +3894,41 @@ function unguardedOperations(file, ops, extra) {
         let start = close2 + 1;
         while (/\s/.test(code[start] ?? "")) start++;
         const end = statementEnd2(code, start, owner.end, pairs);
-        if (end <= owner.end && hasConditionalAuthGuard(code.slice(i, end))) return end;
+        const required = /* @__PURE__ */ new Set();
+        const values = authValuesOf(file, fn, bodies, pairs);
+        const accepted = hasConditionalAuthGuard(code.slice(i, end), requireThrow, (term) => {
+          const mismatch = /^(.*?)\s*!={1,2}\s*(.*?)$/.exec(term);
+          if (mismatch && (values.value(mismatch[1], i).kind === "secret" || values.value(mismatch[2], i).kind === "secret")) return true;
+          const subject = term.replace(/^!\s*/, "").split(/\s*(?:={2,3}|!={1,2})\s*/)[0];
+          const value = values.value(subject, i);
+          const dependencies = identityRequirement(value, !!observe);
+          if (dependencies) {
+            dependencies.forEach((index) => required.add(index));
+            return true;
+          }
+          return !observe && value.kind === "unknown" && rejectsMissingIdentity(term, DENIED_STATUS.test(code.slice(i, end)));
+        });
+        if (end <= owner.end && accepted) {
+          guardRequirements.set(owner.start, [...required]);
+          return end;
+        }
+        const other = skipSpace(end);
+        if (/^else\b/.test(code.slice(other, other + 8))) {
+          const first = blockAt(start);
+          const second = blockAt(other + 4);
+          if (first && second) {
+            if (allProtected(owner, [first, second], fn, depth)) return second.end + 1;
+            i = second.end;
+            continue;
+          }
+        }
         i = Math.min(end, owner.end) - 1;
         continue;
       }
       const indirectCall = i > 0 && /[\w$.]/.test(code[i - 1]) ? null : extraCalls?.exec(code.slice(i, i + 100));
       const call = indirectCall ?? AUTH_ENFORCING_CALL.exec(code.slice(i, i + 100));
+      const callName = call?.[0].replace(/\s*\($/, "");
+      if (!indirectCall && call?.index === 0 && callName && localNames.has(callName)) continue;
       if (call?.index === 0 && !/^(?:withAuth|NextAuth)\b/i.test(call[0]) && !/\bfunction\s*$/.test(code.slice(Math.max(owner.start, i - 30), i))) {
         const prefixStart = Math.max(
           owner.start + 1,
@@ -3356,11 +3937,27 @@ function unguardedOperations(file, ops, extra) {
         );
         const prefix = code.slice(prefixStart, i).trim();
         if (/(?:&&|\|\||\?|:)\s*$/.test(code.slice(owner.start + 1, prefixStart))) continue;
-        const awaited = /^(?:await|(?:const|let|var)\s+[\w${},:\s]+?=\s*await)(?:\s+[\w$.]+\.)?$/.test(prefix);
+        const awaited = /^(?:await|(?:const|let|var)\s+[\w${},:\s]+?=\s*await)(?:\s+[\w$.]+\.)?$/.test(prefix) || requireThrow && /^return(?:\s+await)?$/.test(prefix);
         const synchronous = /^(?:assertAuth(?:enticated)?|constructEvent)\b/i.test(call[0]) && /^(?:(?:const|let|var)\s+[\w$]+\s*=\s*)?(?:[\w$]+\.)*$/.test(prefix);
         if (!awaited && !synchronous) continue;
         const close2 = pairs.get(i + call[0].length - 1);
         if (close2 !== void 0 && close2 < owner.end) {
+          if (/^\s*(?:\.|\?\.)/.test(code.slice(close2 + 1, close2 + 100))) continue;
+          const required = /* @__PURE__ */ new Set();
+          const requirements = indirectCall ? extra?.requirements?.get(indirectCall[1]) ?? [] : [];
+          const argumentsOfCall = requirements.length ? argumentExpressions(code, commentsMaskedOf(file), i + call[0].length, close2, pairs) : [];
+          let valid = true;
+          for (const argument of requirements) {
+            const origin = authValuesOf(file, fn, bodies, pairs).value(argumentsOfCall[argument] ?? "undefined", i);
+            const dependencies = identityRequirement(origin, !!observe);
+            if (!dependencies) {
+              valid = false;
+              break;
+            }
+            dependencies.forEach((index) => required.add(index));
+          }
+          if (!valid) continue;
+          guardRequirements.set(owner.start, [...required]);
           if (indirectCall) guardNames.set(owner.start, indirectCall[1]);
           return close2 + 1;
         }
@@ -3379,6 +3976,8 @@ function unguardedOperations(file, ops, extra) {
     while (active.length && active[active.length - 1].end < op.index) active.pop();
     const wrapper = wrappers.find((w) => w.start < op.index && w.end > op.index);
     if (wrapper) {
+      if (extra?.requirements?.get(wrapper.name)?.length) return true;
+      observe?.(op.index, []);
       if (extra?.wrappers.has(wrapper.name)) extra.onGuard(op.index, wrapper.name);
       return false;
     }
@@ -3389,10 +3988,11 @@ function unguardedOperations(file, ops, extra) {
       const block = active[index];
       let end = guardEnds.get(block.start);
       if (end === void 0) {
-        end = guardEnd(block);
+        end = guardEnd(block, bodiesByStart.get(active[ownerIndex].start));
         guardEnds.set(block.start, end);
       }
       if (end <= op.index) {
+        observe?.(op.index, guardRequirements.get(block.start) ?? []);
         const name = guardNames.get(block.start);
         if (name) extra?.onGuard(op.index, name);
         return false;
@@ -3605,7 +4205,7 @@ var definitionsCache = /* @__PURE__ */ new WeakMap();
 function guardDefinitions(file) {
   const cached = definitionsCache.get(file);
   if (cached) return cached;
-  const result = { locals: /* @__PURE__ */ new Map(), exports: /* @__PURE__ */ new Map() };
+  const result = { locals: /* @__PURE__ */ new Map(), exports: /* @__PURE__ */ new Map(), candidates: /* @__PURE__ */ new Map(), exportedCandidates: /* @__PURE__ */ new Map() };
   const code = noiseMaskedOf(file);
   const pairs = delimiterPairs(code);
   const openers = new Map([...pairs].map(([open, close]) => [close, open]));
@@ -3623,8 +4223,18 @@ function guardDefinitions(file) {
     const target = byDeclaration.get(nestedAt) ?? body;
     let at = target.end;
     for (let i = target.start + 1; i < target.end; i++) {
+      const conditional = /^if\s*\(/.exec(code.slice(i, i + 32));
+      if (conditional && (i === 0 || !/[\w$]/.test(code[i - 1]))) {
+        const close2 = pairs.get(i + conditional[0].length - 1);
+        if (close2 !== void 0) {
+          let start = close2 + 1;
+          while (/\s/.test(code[start] ?? "")) start++;
+          i = statementEnd2(code, start, target.end, pairs) - 1;
+          continue;
+        }
+      }
       if (code.startsWith("return", i) && !/[\w$]/.test(code[i - 1] ?? "") && !/[\w$]/.test(code[i + 6] ?? "")) {
-        at = i;
+        at = Math.min(target.end, statementEnd2(code, i, target.end, pairs));
         break;
       }
       const close = pairs.get(i);
@@ -3636,14 +4246,26 @@ function guardDefinitions(file) {
       wrapper: target !== body
     };
     const exported = !declaration.exported ? null : /\bexport\s+default\s+(?:async\s+)?$/.test(code.slice(Math.max(0, body.declaration - 80), body.declaration)) ? "default" : declaration.name;
-    candidates.push({ name: declaration.name, exported, definition, at });
+    candidates.push({ name: declaration.name, exported, definition, at, start: target.start });
+  }
+  const unguarded = /* @__PURE__ */ new Set();
+  const requirements = /* @__PURE__ */ new Map();
+  for (const wrapper of [false, true]) {
+    const ops = candidates.filter((candidate) => candidate.definition.wrapper === wrapper).map((candidate) => ({ index: candidate.at, writes: false })).sort((a, b) => a.index - b.index);
+    for (const hit of unguardedOperations(
+      file,
+      ops,
+      void 0,
+      !wrapper,
+      (index, required) => requirements.set(index, required)
+    )) unguarded.add(hit.index);
   }
-  const unguarded = new Set(unguardedOperations(
-    file,
-    candidates.map((candidate) => ({ index: candidate.at, writes: false })).sort((a, b) => a.index - b.index)
-  ).map((hit) => hit.index));
   for (const candidate of candidates) {
+    result.candidates.set(candidate.name, candidate);
+    if (candidate.exported) result.exportedCandidates.set(candidate.exported, candidate);
     if (unguarded.has(candidate.at)) continue;
+    candidate.definition.requiredArgs = requirements.get(candidate.at) ?? [];
+    if (candidate.definition.wrapper && candidate.definition.requiredArgs.length) continue;
     result.locals.set(candidate.name, candidate.definition);
     if (candidate.exported) result.exports.set(candidate.exported, candidate.definition);
   }
@@ -3657,23 +4279,33 @@ function bindingModule(spec, file, allFiles, scope) {
   const found = new Set(keys.flatMap((key) => moduleIndexOf(allFiles).get(moduleKey(key)) ?? []));
   return found.size === 1 ? [...found][0] : null;
 }
-function exportedGuard(file, name, allFiles, scope, depth = 0, seen = /* @__PURE__ */ new Set()) {
+function exportedGuard(file, name, allFiles, scope, state, depth = 0, seen = /* @__PURE__ */ new Set()) {
   const key = `${file.path}\0${name}`;
-  if (depth >= 8 || seen.has(key)) return null;
-  seen.add(key);
+  if (seen.has(key)) return null;
+  if (depth >= 8 || state.remaining-- <= 0) {
+    state.truncated = true;
+    return null;
+  }
+  seen = new Set(seen).add(key);
   const definitions = guardDefinitions(file);
+  const candidate = definitions.exportedCandidates.get(name);
+  if (candidate && guardBindings(file).shadowed.has(candidate.name)) return null;
   const direct = definitions.exports.get(name);
   if (direct) return direct;
+  if (candidate) return delegatedGuard(file, candidate, allFiles, scope, state, depth, seen);
   const bindings = bindingsOf(file);
   const exported = bindings.exports.find((binding) => binding.local === name);
   const follow = (spec, imported) => {
     const target = bindingModule(spec, file, allFiles, scope);
-    return target ? exportedGuard(target, imported, allFiles, scope, depth + 1, seen) : null;
+    return target ? exportedGuard(target, imported, allFiles, scope, state, depth + 1, seen) : null;
   };
   if (exported) {
     if (exported.spec) return follow(exported.spec, exported.imported);
+    if (guardBindings(file).shadowed.has(exported.imported)) return null;
     const local = definitions.locals.get(exported.imported);
     if (local) return local;
+    const candidate2 = definitions.candidates.get(exported.imported);
+    if (candidate2) return delegatedGuard(file, candidate2, allFiles, scope, state, depth, seen);
     const imported = bindings.imports.find((binding) => binding.local === exported.imported);
     if (imported?.spec) return follow(imported.spec, imported.imported);
   }
@@ -3683,22 +4315,100 @@ function exportedGuard(file, name, allFiles, scope, depth = 0, seen = /* @__PURE
   }
   return null;
 }
-function indirectGuardOperations(route, allFiles) {
+var guardBindingCache = /* @__PURE__ */ new WeakMap();
+function guardBindings(file) {
+  const cached = guardBindingCache.get(file);
+  if (cached) return cached;
+  const code = noiseMaskedOf(file);
+  const declarations = code.replace(/\b(?:import|export)\s+(?:[A-Za-z_$][\w$]*\s*,\s*)?\{[^{}]{0,4000}\}/g, (text) => " ".repeat(text.length));
+  const shadowed = /* @__PURE__ */ new Set();
+  const declared = /* @__PURE__ */ new Set();
+  const called = /* @__PURE__ */ new Set();
+  for (const match of declarations.matchAll(/[({,]\s*([A-Za-z_$][\w$]*)\s*[,}):=]|(?<![\w$.])([A-Za-z_$][\w$]*)\s*=(?!=)|(?<![\w$])([A-Za-z_$][\w$]*)\s*=>/g)) {
+    if (match[2] && /\b(?:const|let|var)\s*$/.test(declarations.slice(Math.max(0, match.index - 40), match.index))) continue;
+    shadowed.add(match[1] ?? match[2] ?? match[3]);
+  }
+  for (const match of declarations.matchAll(/\b(?:const|let|var|function|class)\s+([A-Za-z_$][\w$]*)/g)) {
+    if (declared.has(match[1])) shadowed.add(match[1]);
+    declared.add(match[1]);
+  }
+  for (const match of code.matchAll(/(?<![\w$.])([A-Za-z_$][\w$]*)\s*\(/g)) {
+    if (!/\bfunction\s*\*?\s*$/.test(code.slice(Math.max(0, match.index - 40), match.index))) called.add(match[1]);
+  }
+  const result = { shadowed, declared, called };
+  guardBindingCache.set(file, result);
+  return result;
+}
+function namedGuard(file, name, allFiles, scope, state, depth, seen) {
+  const bindings = guardBindings(file);
+  if (bindings.shadowed.has(name)) return null;
+  const definitions = guardDefinitions(file);
+  const candidate = definitions.candidates.get(name);
+  if (candidate) {
+    const key = `${file.path}\0${name}`;
+    if (seen.has(key)) return null;
+    if (depth >= 8 || state.remaining-- <= 0) {
+      state.truncated = true;
+      return null;
+    }
+    return definitions.locals.get(name) ?? delegatedGuard(file, candidate, allFiles, scope, state, depth, new Set(seen).add(key));
+  }
+  if (bindings.declared.has(name)) return null;
+  const imported = bindingsOf(file).imports.find((binding) => binding.local === name);
+  if (!imported?.spec) return null;
+  const target = bindingModule(imported.spec, file, allFiles, scope);
+  return target ? exportedGuard(target, imported.imported, allFiles, scope, state, depth, seen) : null;
+}
+function delegatedGuard(file, candidate, allFiles, scope, state, depth, seen) {
+  const code = noiseMaskedOf(file);
+  const calls = /* @__PURE__ */ new Set();
+  for (const match of code.slice(candidate.start + 1, candidate.at).matchAll(/(?<![\w$.])([A-Za-z_$][\w$]*)\s*\(/g)) calls.add(match[1]);
+  const resolved = /* @__PURE__ */ new Map();
+  for (const name of calls) {
+    if (state.remaining <= 0) {
+      state.truncated = true;
+      break;
+    }
+    const guard = namedGuard(file, name, allFiles, scope, state, depth + 1, seen);
+    if (guard && !guard.wrapper) resolved.set(name, guard);
+  }
+  if (resolved.size === 0) return null;
+  let selected;
+  let requiredArgs = [];
+  unguardedOperations(file, [{ index: candidate.at, writes: false }], {
+    guards: new Set(resolved.keys()),
+    wrappers: /* @__PURE__ */ new Set(),
+    requirements: new Map([...resolved].map(([name, guard]) => [name, guard.requiredArgs ?? []])),
+    onGuard: (_index, name) => {
+      selected = resolved.get(name);
+    }
+  }, !candidate.definition.wrapper, (_index, required) => {
+    requiredArgs = required;
+  });
+  return selected ? { ...candidate.definition, requiredArgs, chain: [selected, ...selected.chain ?? []] } : null;
+}
+function indirectGuardOperations(route, ctx) {
+  const state = { remaining: 128, truncated: false };
+  const { called } = guardBindings(route.file);
   const names = /* @__PURE__ */ new Map();
-  const code = noiseMaskedOf(route.file);
-  for (const binding of bindingsOf(route.file).imports) {
-    if (!binding.spec) continue;
-    const name = namePattern([binding.local]);
-    if (new RegExp(`\\b(?:const|let|var|function|class)\\s+${name}(?![\\w$])|[({,]\\s*${name}\\s*[,}):=]|(?<![\\w$])${name}\\s*=>`).test(code)) continue;
-    const target = bindingModule(binding.spec, route.file, allFiles, route.scope);
-    const definition = target ? exportedGuard(target, binding.imported, allFiles, route.scope) : null;
-    if (definition) names.set(binding.local, definition);
+  for (const name of called) {
+    if (state.remaining <= 0) {
+      state.truncated = true;
+      break;
+    }
+    const definition = namedGuard(route.file, name, ctx.files, route.scope, state, 0, /* @__PURE__ */ new Set());
+    if (definition) names.set(name, definition);
   }
+  if (state.truncated) ctx.reportIncomplete(
+    "api/db-access-without-auth",
+    `${route.file.path} reached the authentication resolution limit (8 hops or 128 symbols); unresolved guards were not accepted`
+  );
   const protectedOps = /* @__PURE__ */ new Map();
   if (names.size === 0) return protectedOps;
   unguardedOperations(route.file, unguardedOpsOf(route.file), {
     guards: new Set([...names].filter(([, definition]) => !definition.wrapper).map(([name]) => name)),
     wrappers: new Set([...names].filter(([, definition]) => definition.wrapper).map(([name]) => name)),
+    requirements: new Map([...names].map(([name, guard]) => [name, guard.requiredArgs ?? []])),
     onGuard: (index, name) => {
       const definition = names.get(name);
       if (definition) protectedOps.set(index, definition);
@@ -4073,11 +4783,12 @@ var apiAuthRule = {
     const indirectByFile = /* @__PURE__ */ new Map();
     for (const route of routes) {
       const reachable = route.reachable;
-      let ops = unguardedOpsOf(route.file).filter((op) => reachable === void 0 || op.index > reachable.start && op.index < reachable.end);
+      const unguarded = unguardedOpsOf(route.file);
+      let ops = reachable === void 0 ? unguarded : operationsInRange(unguarded, reachable.start, reachable.end);
       if (ops.length === 0) continue;
       let indirectOps = indirectByFile.get(route.file);
       if (!indirectOps) {
-        indirectOps = indirectGuardOperations(route, ctx.files);
+        indirectOps = indirectGuardOperations(route, ctx);
         indirectByFile.set(route.file, indirectOps);
       }
       const unprotected = ops.filter((op) => !indirectOps.has(op.index));
@@ -4094,19 +4805,21 @@ var apiAuthRule = {
       const indirect = indirectOps.get(hit.index);
       const line = lineNumberAt(lineStartsCached(route.file), hit.index);
       const excerpt = excerptFor(route.file, line);
-      const indirectEvidence = indirect ? [{
+      const indirectEvidence = indirect ? [indirect, ...indirect.chain ?? []].map((guard) => ({
         kind: "auth-helper",
-        file: indirect.file.path,
-        line: indirect.line,
-        description: "Local authentication helper recognized through imports; verify its runtime behaviour and caller coverage."
-      }] : [];
+        file: guard.file.path,
+        line: guard.line,
+        description: "Local authentication helper in the recognized delegation chain; verify runtime behaviour and caller coverage."
+      })) : [];
       if (indirect) globalNote.push("A local authentication helper or wrapper was recognized before this operation. This finding is retained for review because indirect control flow is not a proof of authorization.");
       if (admin) {
         const trace = adminEvidence(route, adminModules, ctx.files, line);
+        const evidence = [...trace.evidence ?? [], ...indirectEvidence];
         findings.push({
           ruleId: "api/admin-db-access-without-auth",
           ...trace,
-          evidence: [...trace.evidence ?? [], ...indirectEvidence],
+          evidence: evidence.slice(0, 24),
+          evidenceTruncated: trace.evidenceTruncated || evidence.length > 24,
           severity: "P0",
           // 管理员客户端缺少鉴权时使用确定置信度；可能受全局鉴权覆盖时降为疑似。
           confidence: globalGuard === null && !indirect ? "certain" : "likely",
@@ -4164,6 +4877,14 @@ var apiAuthRule = {
         });
       }
     }
+    for (const file of ctx.files) if (identityFlowLimited(file)) ctx.reportIncomplete(
+      "api/db-access-without-auth",
+      `${file.path} reached the identity flow limit (8 value hops, 4000 expression characters, or 512 assignments or branches per function)`
+    );
+    for (const file of ctx.files) if (controlFlowLimited.has(file)) ctx.reportIncomplete(
+      "api/db-access-without-auth",
+      `${file.path} reached the control-flow proof limit (8 nested branch or exception regions)`
+    );
     return findings;
   }
 };
@@ -4782,7 +5503,7 @@ var RULE_CATALOG = [
     "P0",
     "certain",
     "Server routes and Next.js Server Functions in Next.js, SvelteKit (endpoints and form actions), Nuxt, Remix/React Router, and Astro, including workspace applications.",
-    "Syntactic guards only; runtime authentication and business authorization are not verified. Local auth imports/re-exports (up to eight hops), SvelteKit hooks and Nuxt middleware may lower confidence, without removing findings."
+    "Syntactic guards only; runtime authentication and business authorization are not verified. Local calls, identity arguments, branches and exception paths are analysed within documented limits. Local auth evidence, SvelteKit hooks and Nuxt middleware may lower confidence without removing findings; exceeded limits disclose incomplete coverage."
   ),
   rule(
     "api/db-write-without-auth",