canship 0.6.0 → 0.7.0

package/dist/cli.js

@@ -3144,6 +3144,46 @@ function project(value, path) {
   }
   return current;
 }
+var SERVER_ENV = /^(?:process\s*\.\s*env|(?:[A-Za-z_$][\w$]*\s*\.\s*)?env(?:\s*\(\s*\))?)\s*\.\s*[A-Z_][A-Z0-9_]*$/;
+var SERVER_ENV_OBJECT = /^(?:process\s*\.\s*env|(?:[A-Za-z_$][\w$]*\s*\.\s*)?env(?:\s*\(\s*\))?)$/;
+function isServerSecretExpression(expression) {
+  const text = expression.trim();
+  if (SERVER_ENV.test(text)) return true;
+  const template = /^`[^`$]*\$\{([^{}`]{1,200})\}[^`$]*`$/.exec(text);
+  return template !== null && SERVER_ENV.test(template[1].trim());
+}
+var CLAIMED_IDENTITY = new RegExp(
+  "^(?:get|validate|verify|authenticate|authorize|require|check|resolve|read|load|fetch)(?:Current|Session|Authenticated|LoggedIn|Request|Auth|Api|Access|Bearer|Jwt)?(?:User|UserId|Session|SessionToken|SessionCookie|Auth|AuthToken|Token|AccessToken|Jwt|Claims|Identity|Principal|Viewer|Account|ApiKey|Key|Credentials)(?:From[A-Z]\\w*|OrThrow|OrNull)?$"
+);
+var CREDENTIAL_ID = /^(?:session|token|apiKey|key|auth|access|refresh)(?:Id|_id)$/i;
+var SIGNATURE_CHECK = /^(?:verify|verify\w*Signature|validate\w*Signature|check\w*Signature|isValid\w*Signature)$/;
+function claimedIdentityCall(expr) {
+  const call = /^(?:await\s+)?(?:[A-Za-z_$][\w$]*\s*\.\s*)*([A-Za-z_$][\w$]*)\s*\(/.exec(expr);
+  if (!call) return false;
+  const signature = SIGNATURE_CHECK.test(call[1]);
+  if (signature ? !/^await\s/.test(expr) : !CLAIMED_IDENTITY.test(call[1])) return false;
+  const masked = maskJsNoise(expr);
+  let depth = 1, end = call[0].length;
+  for (; end < masked.length && depth > 0; end++) {
+    if (masked[end] === "(") depth++;
+    else if (masked[end] === ")") depth--;
+  }
+  if (depth !== 0 || masked.slice(end).trim() !== "") return false;
+  if (signature) return true;
+  const args = masked.slice(call[0].length, end - 1);
+  if (/\.\s*(?:params|query|body|searchParams)\b|\bparams\b|\bid\b/.test(args)) return false;
+  return ![...args.matchAll(/\b[A-Za-z_$][\w$]*(?:[a-z]Id|_id)\b/g)].some((m) => !CREDENTIAL_ID.test(m[0]));
+}
+function synchronousLocal(file, expr) {
+  const name = /^([A-Za-z_$][\w$]*)\s*\(/.exec(expr)?.[1];
+  if (!name) return false;
+  const code = noiseMaskedOf(file);
+  const escaped = name.replace(/\$/g, "\\$");
+  const declared = new RegExp(`(?:^|[^\\w$])(async\\s+)?function\\s*\\*?\\s*${escaped}\\s*\\(`).exec(code);
+  if (declared) return !declared[1];
+  const assigned = new RegExp(`\\b(?:const|let|var)\\s+${escaped}\\s*(?::[^=;]{0,200})?=\\s*(async\\b)?\\s*(?:function\\b|\\([^()]*\\)\\s*(?::[^=;{]{0,200})?=>|[A-Za-z_$][\\w$]*\\s*=>)`).exec(code);
+  return assigned !== null && !assigned[1];
+}
 var limited = /* @__PURE__ */ new WeakSet();
 var cache2 = /* @__PURE__ */ new WeakMap();
 var reverseCache = /* @__PURE__ */ new WeakMap();
@@ -3340,7 +3380,7 @@ var AuthValues = class {
       limited.add(this.file);
       return { kind: "opaque" };
     }
-    if (/^process\.env\.[A-Z_][A-Z0-9_]*$/.test(expr)) return { kind: "secret" };
+    if (SERVER_ENV.test(expr)) return { kind: "secret" };
     const template = /^`[^`$]*\$\{([^{}`]{1,200})\}[^`$]*`$/.exec(expr);
     if (template) return this.value(template[1], at, depth + 1).kind === "secret" ? { kind: "secret" } : { kind: "literal" };
     if (/^(?:(?:true|false|null|undefined)\b|\d|['"`{\[])/.test(expr)) return { kind: "literal" };
@@ -3362,7 +3402,12 @@ var AuthValues = class {
       if (envelope) return { kind: "envelope", field: envelope === "getUser" ? "user" : "claims" };
       return { kind: "identity" };
     }
+    if (claimedIdentityCall(expr)) return /^await\s/.test(expr) || synchronousLocal(this.file, expr) ? { kind: "claimed" } : { kind: "promise" };
     if (/\.(?:body|query|headers|cookies|searchParams)\b|\.(?:json|text|formData)\s*\(/.test(expr)) return { kind: "input" };
+    const keyed = /^([A-Za-z_$][\w$]*)\s*\.\s*get\s*\(\s*['"][\w$.-]+['"]\s*\)$/.exec(expr);
+    if (keyed && this.parameters.has(keyed[1]) && !this.assignments.has(keyed[1])) {
+      return { kind: "parameter", parameters: [this.parameters.get(keyed[1])] };
+    }
     const access = /^([A-Za-z_$][\w$]*)((?:\??\.[A-Za-z_$][\w$]*)*)$/.exec(expr);
     if (!access) return { kind: "opaque" };
     const name = access[1];
@@ -3381,6 +3426,8 @@ var AuthValues = class {
         return { kind: "opaque" };
       }
       if (this.conditions.some((range) => range.start <= assignment.at && assignment.at <= range.end && !(range.start <= at && at <= range.end))) return { kind: "opaque" };
+      const key = [...assignment.projection ?? [], ...access[2].split(/\??\./).filter(Boolean)];
+      if (assignment.projection !== null && key.length === 1 && /^[A-Z_][A-Z0-9_]*$/.test(key[0]) && SERVER_ENV_OBJECT.test(assignment.expression)) return { kind: "secret" };
       value = this.value(assignment.expression, assignment.at, depth + 1);
       value = assignment.projection === null ? { kind: "opaque" } : project(value, assignment.projection);
     } else if (this.parameters.has(name)) value = { kind: "parameter", parameters: [this.parameters.get(name)] };
@@ -3394,6 +3441,964 @@ function identityRequirement(value, allowParameters) {
   return null;
 }
 
+// src/rules/routers.ts
+var NODE_FRAMEWORKS = /* @__PURE__ */ new Set(["express", "hono", "fastify"]);
+var METHODS = "get|post|put|patch|delete|all|options|head";
+var GENERICS = String.raw`(?:<[^()]{0,300}>\s*)?`;
+var FASTIFY_HOOKS = /^(?:onRequest|preParsing|preValidation|preHandler)$/;
+var HONO_CALL = `${METHODS}|on|use|route`;
+var analysedCache = /* @__PURE__ */ new WeakMap();
+function analyse(file) {
+  const cached = analysedCache.get(file);
+  if (cached) return cached;
+  const code = noiseMaskedOf(file);
+  const pairs = delimiterPairs(code);
+  const openers = /* @__PURE__ */ new Map();
+  for (const [open, close] of pairs) openers.set(close, open);
+  const result = { file, code, source: commentsMaskedOf(file), pairs, openers, bodies: functionBodies(code, pairs) };
+  analysedCache.set(file, result);
+  return result;
+}
+function argsOf(a, open, close) {
+  const args = [];
+  let from = open + 1;
+  const push = (end) => {
+    const raw = a.code.slice(from, end);
+    const lead = raw.length - raw.trimStart().length;
+    const text = raw.trim();
+    if (text) args.push({ text, source: a.source.slice(from + lead, from + lead + text.length), at: from + lead });
+  };
+  for (let i = open + 1; i < close; i++) {
+    const end = a.pairs.get(i);
+    if (end !== void 0) {
+      i = end;
+      continue;
+    }
+    if (a.code[i] === ",") {
+      push(i);
+      from = i + 1;
+    }
+  }
+  push(close);
+  return args;
+}
+function flatten(a, args) {
+  return args.flatMap((arg) => {
+    if (!arg.text.startsWith("[")) return [arg];
+    const close = a.pairs.get(arg.at);
+    return close === void 0 ? [arg] : argsOf(a, arg.at, close);
+  });
+}
+function scopeOf(path) {
+  return /^(.*?\/)?(?:src|app|lib|server|routes|api|controllers|plugins)\//.exec(path)?.[1] ?? "";
+}
+function entriesOf(a, arg) {
+  const entries = /* @__PURE__ */ new Map();
+  if (!arg || a.code[arg.at] !== "{") return entries;
+  const close = a.pairs.get(arg.at);
+  if (close === void 0) return entries;
+  for (const part of argsOf(a, arg.at, close)) {
+    const key = /^(?:async\s+)?['"]?([A-Za-z_$][\w$]*)['"]?/.exec(part.source);
+    if (!key) continue;
+    const rest = part.text.slice(key[0].length);
+    const colon = /^\s*:\s*/.exec(rest);
+    if (colon) {
+      const offset = key[0].length + colon[0].length;
+      entries.set(key[1], { value: { text: part.text.slice(offset), source: part.source.slice(offset), at: part.at + offset }, range: null });
+    } else if (/^\s*(?:<[^()]{0,200}>\s*)?\(/.test(rest)) {
+      const open = part.at + key[0].length + rest.indexOf("(");
+      const close2 = a.pairs.get(open);
+      const brace = close2 === void 0 ? null : /^\s*(?::[^{;=]{0,200})?\{/.exec(a.code.slice(close2 + 1, close2 + 260));
+      const start = close2 === void 0 || !brace ? void 0 : close2 + brace[0].length;
+      const end = start === void 0 ? void 0 : a.pairs.get(start);
+      entries.set(key[1], { value: null, range: start !== void 0 && end !== void 0 ? { file: a.file, start, end } : null });
+    } else if (rest.trim() === "") {
+      entries.set(key[1], { value: part, range: null });
+    }
+  }
+  return entries;
+}
+function frameworkNamesOf(a) {
+  const names = { express: /* @__PURE__ */ new Set(), router: /* @__PURE__ */ new Set(), hono: /* @__PURE__ */ new Set(), fastify: /* @__PURE__ */ new Set(), types: /* @__PURE__ */ new Set() };
+  const named = (list, wanted, into, fallback) => {
+    for (const part of list.split(",")) {
+      const m = /^\s*(?:type\s+)?([A-Za-z_$][\w$]*)\s*(?:(?:as|:)\s*([A-Za-z_$][\w$]*))?\s*$/.exec(part);
+      if (!m) continue;
+      if (wanted.test(m[1]) && !/^\s*type\s/.test(part)) into.add(m[2] ?? m[1]);
+      fallback?.(m[1]);
+    }
+  };
+  for (const m of a.source.matchAll(/\bimport\s+(type\s+)?(?:([A-Za-z_$][\w$]*)\s*,?\s*)?(?:\{([^{}]*)\}|\*\s+as\s+([A-Za-z_$][\w$]*))?\s*from\s*['"](express|hono(?:\/tiny|\/quick)?|@hono\/zod-openapi|fastify)['"]/g)) {
+    const typeOnly = Boolean(m[1]);
+    if (m[5] === "express") {
+      if (!typeOnly && m[2]) names.express.add(m[2]);
+      if (!typeOnly && m[4]) names.express.add(m[4]);
+      if (m[3]) named(m[3], /^Router$/, names.router);
+      names.types.add("express");
+    } else if (m[5] === "fastify") {
+      if (!typeOnly && m[2]) names.fastify.add(m[2]);
+      if (!typeOnly && m[3]) named(m[3], /^fastify$/, names.fastify);
+      names.types.add("fastify");
+    } else {
+      if (!typeOnly && m[3]) named(m[3], /^(?:Hono|OpenAPIHono)$/, names.hono);
+      names.types.add("hono");
+    }
+  }
+  for (const m of a.source.matchAll(/\b(?:const|let|var)\s+(?:([A-Za-z_$][\w$]*)|\{([^{}]*)\})\s*=\s*require\s*\(\s*['"](express|hono(?:\/tiny|\/quick)?|@hono\/zod-openapi|fastify)['"]\s*\)(?!\s*\()/g)) {
+    if (m[3] === "express") {
+      if (m[1]) names.express.add(m[1]);
+      if (m[2]) named(m[2], /^Router$/, names.router);
+    } else if (m[3] === "fastify") {
+      if (m[1]) names.fastify.add(m[1]);
+      if (m[2]) named(m[2], /^fastify$/, names.fastify);
+    } else if (m[2]) named(m[2], /^(?:Hono|OpenAPIHono)$/, names.hono);
+    names.types.add(m[3] === "express" || m[3] === "fastify" ? m[3] : "hono");
+  }
+  for (const m of a.source.matchAll(/\brequire\s*\(\s*['"](express|fastify)['"]\s*\)/g)) names.types.add(m[1]);
+  return names.types.size ? names : null;
+}
+function instancesOf(a, names) {
+  const found = [];
+  const add = (instance) => {
+    if (!found.some((other) => other.name === instance.name)) found.push(instance);
+  };
+  for (const m of a.source.matchAll(/\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*(?::[^=;]{0,100})?=\s*(?:await\s+)?(new\s+)?([A-Za-z_$][\w$]*)\s*(?:\.\s*(Router)\s*)?(<[^()]{0,300}>\s*)?\(/g)) {
+    const [, name, isNew, callee, router] = m;
+    if (!isNew && (names.express.has(callee) && (router === "Router" || router === void 0) || names.router.has(callee) && router === void 0)) {
+      add({ name, framework: "express", prefix: "", weak: false });
+    } else if (isNew && names.hono.has(callee) && router === void 0) {
+      const open = m.index + m[0].length - 1;
+      let close = a.pairs.get(open);
+      if (close === void 0) continue;
+      let prefix = "";
+      const base = /^\s*\.\s*basePath\s*\(/.exec(a.code.slice(close + 1, close + 200));
+      if (base) {
+        const baseOpen = close + base[0].length;
+        const baseClose = a.pairs.get(baseOpen);
+        const arg = baseClose === void 0 ? void 0 : argsOf(a, baseOpen, baseClose)[0];
+        prefix = (arg && pathOf(a, arg)) ?? "";
+        if (baseClose !== void 0) close = baseClose;
+      }
+      add({ name, framework: "hono", prefix, weak: false, chainFrom: close });
+    } else if (!isNew && names.fastify.has(callee) && router === void 0) {
+      add({ name, framework: "fastify", prefix: "", weak: false });
+    }
+  }
+  for (const m of a.source.matchAll(/\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(?:await\s+)?require\s*\(\s*['"](express|fastify)['"]\s*\)\s*(?:\.\s*(Router)\s*)?\(/g)) {
+    if (m[2] === "express" || !m[3]) add({ name: m[1], framework: m[2], prefix: "", weak: false });
+  }
+  const typed = [
+    ["express", String.raw`(?:Express|Router|Application)\b(?!\s*[.<(])`],
+    ["hono", String.raw`(?:Hono|OpenAPIHono)\b(?!\s*[.(])`],
+    ["fastify", String.raw`FastifyInstance\b(?!\s*[.(])`]
+  ];
+  for (const [framework, type] of typed) {
+    if (!names.types.has(framework)) continue;
+    for (const m of a.code.matchAll(new RegExp(String.raw`([A-Za-z_$][\w$]*)\s*\??:\s*(?:[A-Za-z_$][\w$]*\s*\.\s*)?${type}`, "g"))) {
+      add({ name: m[1], framework, prefix: "", weak: true });
+    }
+  }
+  return found;
+}
+function literalOf(arg) {
+  const m = /^(['"`])([^'"`$]*)\1$/.exec(arg.source);
+  return m ? m[2] : null;
+}
+function constantOf(a, name) {
+  const m = new RegExp(`\\bconst\\s+${name.replace(/\$/g, "\\$")}\\s*(?::\\s*string\\s*)?=\\s*(['"\`])([^'"\`$]*)\\1`).exec(a.source);
+  return m ? m[2] : null;
+}
+function pathsOf(a, arg) {
+  if (!arg.text.startsWith("[")) return [pathOf(a, arg)];
+  const close = a.pairs.get(arg.at);
+  const items = close === void 0 ? [] : argsOf(a, arg.at, close);
+  return items.length ? items.map((item) => pathOf(a, item)) : [null];
+}
+function usePrefixes(a, arg) {
+  if (arg.text.startsWith("[")) {
+    const close = a.pairs.get(arg.at);
+    const items = close === void 0 ? [] : argsOf(a, arg.at, close);
+    if (items.length === 0 || !items.every((item) => /^['"`]/.test(item.source))) return null;
+    return items.map((item) => pathOf(a, item)).filter((path) => path !== null);
+  }
+  const prefix = pathOf(a, arg);
+  return prefix === null ? null : [prefix];
+}
+function pathOf(a, arg) {
+  if (arg.text.startsWith("[")) return null;
+  const literal2 = literalOf(arg);
+  if (literal2 !== null) return literal2;
+  if (/^[A-Za-z_$][\w$]*$/.test(arg.source)) return constantOf(a, arg.source);
+  const template = /^`((?:[^`$\\]|\$\{\s*[A-Za-z_$][\w$]*\s*\})*)`$/.exec(arg.source);
+  if (!template) return null;
+  let unresolved = false;
+  const path = template[1].replace(/\$\{\s*([A-Za-z_$][\w$]*)\s*\}/g, (_whole, name) => {
+    const value = constantOf(a, name);
+    if (value === null) unresolved = true;
+    return value ?? "";
+  });
+  return unresolved ? null : path;
+}
+function joinPath(prefix, path) {
+  if (!prefix || prefix === "/" || !path.startsWith("/")) return path;
+  const base = prefix.replace(/\/+$/, "");
+  return path === "/" ? base || "/" : `${base}${path}`;
+}
+function expressRegistrations(a, name) {
+  const found = [];
+  const escaped = name.replace(/\$/g, "\\$");
+  const add = (paths, args, at) => {
+    const callbacks = flatten(a, args);
+    if (callbacks.length === 0) return;
+    for (const path of paths) found.push({ path, middleware: callbacks.slice(0, -1), handler: callbacks.at(-1), handlerRange: null, at });
+  };
+  for (const m of a.code.matchAll(new RegExp(`(?<![\\w$.])${escaped}\\s*\\.\\s*(?:${METHODS})\\s*${GENERICS}\\(`, "g"))) {
+    const open = m.index + m[0].length - 1;
+    const close = a.pairs.get(open);
+    if (close === void 0) continue;
+    const args = argsOf(a, open, close);
+    if (args.length < 2) continue;
+    add(pathsOf(a, args[0]), args.slice(1), m.index);
+  }
+  for (const m of a.code.matchAll(new RegExp(`(?<![\\w$.])${escaped}\\s*\\.\\s*route\\s*\\(`, "g"))) {
+    const open = m.index + m[0].length - 1;
+    let close = a.pairs.get(open);
+    if (close === void 0) continue;
+    const pathArg = argsOf(a, open, close)[0];
+    const paths = pathArg ? pathsOf(a, pathArg) : [null];
+    for (let guard = 0; guard < 16; guard++) {
+      const next = new RegExp(`^\\s*\\.\\s*(?:${METHODS})\\s*${GENERICS}\\(`).exec(a.code.slice(close + 1, close + 500));
+      if (!next) break;
+      const methodOpen = close + 1 + next[0].length - 1;
+      const methodClose = a.pairs.get(methodOpen);
+      if (methodClose === void 0) break;
+      add(paths, argsOf(a, methodOpen, methodClose), close + 1 + next[0].search(/[a-z]/));
+      close = methodClose;
+    }
+  }
+  return found.sort((x, y) => x.at - y.at);
+}
+function expressUses(a, name) {
+  const found = [];
+  for (const m of a.code.matchAll(new RegExp(`(?<![\\w$.])${name.replace(/\$/g, "\\$")}\\s*\\.\\s*use\\s*\\(`, "g"))) {
+    const open = m.index + m[0].length - 1;
+    const close = a.pairs.get(open);
+    if (close === void 0) continue;
+    const args = argsOf(a, open, close);
+    const prefixes = args[0] ? usePrefixes(a, args[0]) : null;
+    const middleware = flatten(a, prefixes === null ? args : args.slice(1));
+    for (const prefix of prefixes ?? [null]) found.push({ prefix, args: middleware, at: m.index });
+  }
+  return found.sort((x, y) => x.at - y.at);
+}
+function honoOps(a, name, chainFrom) {
+  const registrations = [];
+  const uses = [];
+  const visit = (method, open, close, at, previous) => {
+    const args = argsOf(a, open, close);
+    if (method === "use") {
+      const prefixes = args[0] ? usePrefixes(a, args[0]) : null;
+      const middleware = flatten(a, prefixes === null ? args : args.slice(1));
+      for (const prefix of prefixes ?? [null]) uses.push({ prefix, args: middleware, at });
+      return previous;
+    }
+    if (method === "route") {
+      if (args.length >= 2) uses.push({ prefix: pathOf(a, args[0]), args: [args[1]], at, mount: true });
+      return previous;
+    }
+    let rest = method === "on" ? args.slice(1) : args;
+    let paths = previous;
+    if (rest[0] && /^['"`[]/.test(rest[0].source)) {
+      paths = pathsOf(a, rest[0]);
+      rest = rest.slice(1);
+    }
+    if (rest.length > 0) {
+      for (const path of paths) registrations.push({ path, middleware: rest.slice(0, -1), handler: rest.at(-1), handlerRange: null, at });
+    }
+    return paths;
+  };
+  const chain = (after, previous) => {
+    for (let guard = 0; guard < 64; guard++) {
+      const next = new RegExp(`^\\s*\\.\\s*(${HONO_CALL})\\s*${GENERICS}\\(`).exec(a.code.slice(after + 1, after + 500));
+      if (!next) return;
+      const open = after + next[0].length;
+      const close = a.pairs.get(open);
+      if (close === void 0) return;
+      previous = visit(next[1], open, close, after + 1 + next[0].search(/[a-z]/), previous);
+      after = close;
+    }
+  };
+  if (chainFrom !== void 0) chain(chainFrom, [null]);
+  for (const m of a.code.matchAll(new RegExp(`(?<![\\w$.])${name.replace(/\$/g, "\\$")}\\s*\\.\\s*(${HONO_CALL})\\s*${GENERICS}\\(`, "g"))) {
+    const open = m.index + m[0].length - 1;
+    const close = a.pairs.get(open);
+    if (close === void 0) continue;
+    chain(close, visit(m[1], open, close, m.index, [null]));
+  }
+  registrations.sort((x, y) => x.at - y.at);
+  uses.sort((x, y) => x.at - y.at);
+  return { registrations, uses };
+}
+function fastifyOps(a, name) {
+  const registrations = [];
+  const uses = [];
+  const registers = [];
+  const lead = String.raw`(?<![\w$.])${name.replace(/\$/g, "\\$")}\s*\.\s*(?:withTypeProvider\s*<[^()]{0,200}>\s*\(\s*\)\s*\.\s*)?`;
+  const hooksOf = (entries) => [...entries].filter(([key, entry]) => FASTIFY_HOOKS.test(key) && entry.value).flatMap(([, entry]) => flatten(a, [entry.value]));
+  for (const m of a.code.matchAll(new RegExp(`${lead}(${METHODS}|route|addHook|register)\\s*${GENERICS}\\(`, "g"))) {
+    const open = m.index + m[0].length - 1;
+    const close = a.pairs.get(open);
+    if (close === void 0) continue;
+    const args = argsOf(a, open, close);
+    const call = m[1];
+    if (call === "addHook") {
+      const hook = args[0] ? literalOf(args[0]) : null;
+      if (hook && FASTIFY_HOOKS.test(hook) && args[1]) uses.push({ prefix: null, args: flatten(a, [args[1]]), at: m.index });
+    } else if (call === "register") {
+      if (!args[0]) continue;
+      registers.push({ target: args[0], options: args[1], at: m.index });
+      const ident = /^[A-Za-z_$][\w$]*$/.exec(args[0].text)?.[0];
+      if (ident && packageOf(a, ident) === "@fastify/bearer-auth" && !/^false$/.test(entriesOf(a, args[1]).get("addHook")?.value?.text ?? "")) {
+        uses.push({ prefix: null, args: [args[0]], at: m.index });
+      }
+    } else if (call === "route") {
+      const entries = entriesOf(a, args[0]);
+      const url = entries.get("url")?.value ?? entries.get("path")?.value;
+      const handler = entries.get("handler");
+      if (!handler) continue;
+      registrations.push({ path: url ? pathOf(a, url) : null, middleware: hooksOf(entries), handler: handler.value, handlerRange: handler.range, at: m.index });
+    } else {
+      if (args.length < 2) continue;
+      const path = pathOf(a, args[0]);
+      const options = entriesOf(a, args[1]);
+      const objectOnly = args.length === 2 && args[1].text.startsWith("{");
+      const inOptions = objectOnly ? options.get("handler") : void 0;
+      if (objectOnly && !inOptions) continue;
+      registrations.push({
+        path,
+        middleware: args.length >= 3 || inOptions ? hooksOf(options) : [],
+        handler: inOptions ? inOptions.value : args.at(-1),
+        handlerRange: inOptions?.range ?? null,
+        at: m.index
+      });
+    }
+  }
+  registrations.sort((x, y) => x.at - y.at);
+  uses.sort((x, y) => x.at - y.at);
+  return { registrations, uses, registers };
+}
+var pathMatches = (prefix, path, framework) => {
+  if (prefix === null) return true;
+  const wildcard = /\*$/.test(prefix);
+  if (framework === "hono" && !wildcard) return path !== null && path.replace(/\/+$/, "") === prefix.replace(/\/+$/, "");
+  const base = prefix.replace(/\/?\*$/, "");
+  return base === "" || base === "/" || path !== null && (path === base || path.startsWith(base.endsWith("/") ? base : `${base}/`));
+};
+function expressionEnd(a, from) {
+  for (let i = from; i < a.code.length; i++) {
+    const end = a.pairs.get(i);
+    if (end !== void 0) {
+      i = end;
+      continue;
+    }
+    const ch = a.code[i];
+    if (ch === ";" || ch === "," || ch === ")" || ch === "]" || ch === "}") return i;
+    if (ch === "\n") {
+      const after = a.code.slice(i + 1, i + 40).trimStart();
+      const before = a.code.slice(from, i).trimEnd();
+      if (before === "" || /[=+\-*/%&|^!?:,.([{<>]$/.test(before) || /^(?:[.?+\-*/%&|^,:<>=]|=>)/.test(after)) continue;
+      return i;
+    }
+  }
+  return a.code.length;
+}
+function skipGenerics(code, from) {
+  if (code[from] !== "<") return from;
+  let depth = 0;
+  for (let i = from; i < Math.min(code.length, from + 2e3); i++) {
+    if (code[i] === "<") depth++;
+    else if (code[i] === ">" && code[i - 1] !== "=" && --depth === 0) return i + 1;
+  }
+  return from;
+}
+function functionAt(a, from, to) {
+  const body = a.bodies.find((b) => b.declaration >= from && b.start < to);
+  if (body) return { file: a.file, start: body.start, end: body.end };
+  const arrow = a.code.indexOf("=>", from);
+  return arrow !== -1 && arrow < to ? { file: a.file, start: arrow, end: to, arrow: true } : null;
+}
+var FUNCTION_EXPRESSION = /^(?:async\b\s*)?(?:function\b|\([^()]*\)\s*(?::[^=]{0,200})?=>|[A-Za-z_$][\w$]*\s*=>)/;
+function findFunction(a, name, depth = 0) {
+  if (depth > 3) return null;
+  const escaped = name.replace(/\$/g, "\\$");
+  for (const body of a.bodies) {
+    if (declarationOf(a.code, body, a.openers)?.name === name && /^function\b/.test(a.code.slice(body.declaration, body.declaration + 8))) {
+      return { file: a.file, start: body.start, end: body.end };
+    }
+  }
+  const assigned = new RegExp(`(?:\\b(?:const|let|var)\\s+${escaped}\\s*(?::[^=;]{0,200})?|(?<![\\w$])(?:module\\s*\\.\\s*)?exports\\s*\\.\\s*${escaped}\\s*)=(?![=>])\\s*`, "g");
+  for (const m of a.code.matchAll(assigned)) {
+    const from = m.index + m[0].length;
+    if (/^(?:await\s+)?(?:require\s*\(|import\s*\()/.test(a.code.slice(from, from + 20))) continue;
+    const alias = /^([A-Za-z_$][\w$]*)\s*(?:[;,\n}]|$)/.exec(a.code.slice(from, from + 120));
+    if (alias && alias[1] !== name && !/^(?:async|function)$/.test(alias[1])) {
+      const target = findFunction(a, alias[1], depth + 1);
+      if (target) return target;
+    }
+    return { file: a.file, start: from, end: expressionEnd(a, skipGenerics(a.code, from)) };
+  }
+  for (const m of a.code.matchAll(new RegExp(`(?<![\\w$.])(?:async\\s+)?${escaped}\\s*(?:\\(|:\\s*)`, "g"))) {
+    const at = m.index + m[0].length;
+    if (m[0].endsWith("(")) {
+      const close = a.pairs.get(at - 1);
+      if (close === void 0) continue;
+      const brace = /^\s*(?::[^{;=]{0,200})?\{/.exec(a.code.slice(close + 1, close + 260));
+      if (!brace) continue;
+      const open = close + brace[0].length;
+      const end = a.pairs.get(open);
+      if (end !== void 0) return { file: a.file, start: open, end };
+      continue;
+    }
+    if (/^(?:async\b\s*)?(?:function\b|\(|[A-Za-z_$][\w$]*\s*=>)/.test(a.code.slice(at, at + 40))) {
+      return { file: a.file, start: at, end: expressionEnd(a, at) };
+    }
+  }
+  return null;
+}
+function defaultExport(a) {
+  const m = /\bexport\s+default\s+|(?<![\w$.])module\s*\.\s*exports\s*=(?!=)\s*/.exec(a.code);
+  if (!m) return null;
+  const from = m.index + m[0].length;
+  const name = /^([A-Za-z_$][\w$]*)\s*(?:[;\n]|$)/.exec(a.code.slice(from, from + 120))?.[1];
+  if (name && !/^(?:async|function|class)$/.test(name)) return findFunction(a, name);
+  return functionAt(a, from, expressionEnd(a, from)) ?? { file: a.file, start: from, end: expressionEnd(a, from) };
+}
+function moduleFor(spec, file, files) {
+  const direct = bindingModule(spec, file, files, scopeOf(file.path));
+  if (direct || spec.startsWith(".")) return direct;
+  const parts = file.path.split("/").slice(0, -1);
+  for (let i = parts.length; i >= 0; i--) {
+    const found = bindingModule(spec, file, files, i > 0 ? `${parts.slice(0, i).join("/")}/` : "");
+    if (found) return found;
+  }
+  return null;
+}
+function importOf(a, local, files) {
+  const resolve3 = (spec, name) => {
+    const file = moduleFor(spec, a.file, files);
+    return file ? { file, name } : null;
+  };
+  const escaped = local.replace(/\$/g, "\\$");
+  const es = bindingsOf(a.file).imports.find((binding) => binding.local === local && binding.spec);
+  if (es) return resolve3(es.spec, es.imported);
+  const namespace = new RegExp(`\\bimport\\s+(?:${escaped}\\s*,[^;]*?|\\*\\s+as\\s+${escaped}\\s+|${escaped}\\s*,\\s*\\{[^{}]*\\}\\s*)from\\s*['"]([^'"]+)['"]`).exec(a.source);
+  if (namespace) return resolve3(namespace[1], "default");
+  const whole = new RegExp(`\\b(?:const|let|var)\\s+${escaped}\\s*=\\s*require\\s*\\(\\s*['"]([^'"]+)['"]\\s*\\)`).exec(a.source);
+  if (whole) return resolve3(whole[1], "default");
+  for (const m of a.source.matchAll(/\b(?:const|let|var)\s*\{([^{}]*)\}\s*=\s*require\s*\(\s*['"]([^'"]+)['"]\s*\)/g)) {
+    for (const part of m[1].split(",")) {
+      const names = /^\s*([A-Za-z_$][\w$]*)\s*(?::\s*([A-Za-z_$][\w$]*))?\s*$/.exec(part);
+      if (names && (names[2] ?? names[1]) === local) return resolve3(m[2], names[1]);
+    }
+  }
+  return null;
+}
+function packageOf(a, local) {
+  const escaped = local.replace(/\$/g, "\\$");
+  const es = bindingsOf(a.file).imports.find((binding) => binding.local === local);
+  const cjs = new RegExp(`\\b(?:const|let|var)\\s+(?:${escaped}|\\{[^{}]*\\b${escaped}\\b[^{}]*\\})\\s*=\\s*require\\s*\\(\\s*['"]([^'"]+)['"]\\s*\\)`).exec(a.source);
+  const named = new RegExp(`\\bimport\\s+${escaped}\\s*(?:,[^;]*?)?from\\s*['"]([^'"]+)['"]`).exec(a.source);
+  const spec = es?.spec ?? cjs?.[1] ?? named?.[1] ?? null;
+  return spec && !spec.startsWith(".") && !/^(?:[@~#]|~~|@@|\$lib)\//.test(spec) ? spec : null;
+}
+function importedFunction(target, member) {
+  const ta = analyse(target.file);
+  if (member) return findFunction(ta, member);
+  return target.name === "default" ? defaultExport(ta) : findFunction(ta, target.name);
+}
+function exportedMember(file, name, files, depth) {
+  const t = analyse(file);
+  const own = findFunction(t, name);
+  if (own || depth >= 3) return own;
+  const escaped = name.replace(/\$/g, "\\$");
+  for (const m of t.source.matchAll(/\bexport\s*\{([^{}]*)\}\s*from\s*['"]([^'"]+)['"]/g)) {
+    for (const part of m[1].split(",")) {
+      const names = new RegExp(`^\\s*(?:type\\s+)?([A-Za-z_$][\\w$]*)\\s*(?:as\\s+${escaped})?\\s*$`).exec(part);
+      if (!names || names[1] !== name && !part.includes(" as ")) continue;
+      const module = moduleFor(m[2], file, files);
+      if (module) return exportedMember(module, names[1], files, depth + 1);
+    }
+  }
+  const spreads = [
+    ...[...t.source.matchAll(/\bexport\s*\*\s*from\s*['"]([^'"]+)['"]/g)].map((m) => moduleFor(m[1], file, files)),
+    ...[...t.source.matchAll(/\.\.\.\s*require\s*\(\s*['"]([^'"]+)['"]\s*\)/g)].map((m) => moduleFor(m[1], file, files)),
+    ...[...t.code.matchAll(/\.\.\.\s*([A-Za-z_$][\w$]*)\s*[,}]/g)].map((m) => importOf(t, m[1], files)?.file ?? null)
+  ];
+  for (const module of spreads) {
+    const found = module && module !== file ? exportedMember(module, name, files, depth + 1) : null;
+    if (found) return found;
+  }
+  const imported = importOf(t, name, files);
+  return imported && imported.file !== file ? exportedMember(imported.file, imported.name === "default" ? name : imported.name, files, depth + 1) : null;
+}
+function calleeDefinition(file, name, member, files) {
+  const a = analyse(file);
+  if (member === null) {
+    const local = findFunction(a, name);
+    if (local) return local;
+  }
+  const target = importOf(a, name, files);
+  if (!target || target.file === file) return null;
+  if (member === null && target.name === "default") return defaultExport(analyse(target.file));
+  return exportedMember(target.file, member ?? target.name, files, 0);
+}
+function handlerOf(a, arg, files, depth = 0) {
+  const text = arg.text;
+  if (FUNCTION_EXPRESSION.test(text)) return functionAt(a, arg.at, arg.at + text.length);
+  const call = /^([A-Za-z_$][\w$.]*)\s*\(/.exec(text);
+  if (call && depth < 3) {
+    const open = arg.at + call[0].length - 1;
+    const close = a.pairs.get(open);
+    if (close === arg.at + text.length - 1) {
+      const inner = argsOf(a, open, close).at(-1);
+      return inner ? handlerOf(a, inner, files, depth + 1) : null;
+    }
+    return null;
+  }
+  const ident = /^([A-Za-z_$][\w$]*)$/.exec(text);
+  if (ident) {
+    const local = findFunction(a, ident[1]);
+    if (local) return local;
+    const target = importOf(a, ident[1], files);
+    return target ? importedFunction(target, null) : null;
+  }
+  const member = /^([A-Za-z_$][\w$]*)\s*\.\s*([A-Za-z_$][\w$]*)$/.exec(text);
+  if (member) {
+    const target = importOf(a, member[1], files);
+    return target ? importedFunction(target, member[2]) : null;
+  }
+  return null;
+}
+function pluginOf(a, arg, files, depth = 0) {
+  if (depth > 3) return null;
+  const inline = /^(?:await\s+)?(?:require|import)\s*\(\s*['"]([^'"]+)['"]\s*\)$/.exec(arg.source);
+  if (inline) {
+    const module = moduleFor(inline[1], a.file, files);
+    return module ? exportedPlugin(analyse(module), files, depth + 1) : null;
+  }
+  if (FUNCTION_EXPRESSION.test(arg.text)) return functionAt(a, arg.at, arg.at + arg.text.length);
+  const call = /^([A-Za-z_$][\w$.]*)\s*\(/.exec(arg.text);
+  if (call) {
+    const open = arg.at + call[0].length - 1;
+    const close = a.pairs.get(open);
+    if (close === void 0) return null;
+    for (const inner of argsOf(a, open, close)) {
+      const range = pluginOf(a, inner, files, depth + 1);
+      if (range) return range;
+    }
+    return null;
+  }
+  const ident = /^([A-Za-z_$][\w$]*)$/.exec(arg.text);
+  if (ident) {
+    const local = findFunction(a, ident[1]);
+    if (local) {
+      const text = a.code.slice(local.start, local.end).trim();
+      return /^[A-Za-z_$][\w$.]*\s*\(/.test(text) && !FUNCTION_EXPRESSION.test(text) && a.code.startsWith(text, local.start) ? pluginOf(a, { text, source: a.source.slice(local.start, local.start + text.length), at: local.start }, files, depth + 1) : local;
+    }
+    const target = importOf(a, ident[1], files);
+    if (!target) return null;
+    return target.name === "default" ? exportedPlugin(analyse(target.file), files, depth + 1) : findFunction(analyse(target.file), target.name);
+  }
+  return handlerOf(a, arg, files);
+}
+function exportedPlugin(t, files, depth) {
+  const m = /\bexport\s+default\s+|(?<![\w$.])module\s*\.\s*exports\s*=(?!=)\s*/.exec(t.code);
+  if (!m) return null;
+  const from = m.index + m[0].length;
+  const end = expressionEnd(t, from);
+  const text = t.code.slice(from, end).trimEnd();
+  return pluginOf(t, { text, source: t.source.slice(from, from + text.length), at: from }, files, depth);
+}
+var toRefs = (a, args) => args.map((arg) => ({ text: arg.source, at: arg.at, file: a.file }));
+function mountedFile(a, arg, files) {
+  const inline = /^require\s*\(\s*['"]([^'"]+)['"]\s*\)$/.exec(arg.source);
+  if (inline) return moduleFor(inline[1], a.file, files);
+  const ident = /^([A-Za-z_$][\w$]*)$/.exec(arg.text);
+  return ident ? importOf(a, ident[1], files)?.file ?? null : null;
+}
+function functionParams(range) {
+  return paramNamesOf(analyse(range.file), range).filter(Boolean);
+}
+function paramNamesOf(a, range) {
+  const code = a.code;
+  let open;
+  if (code[range.start] === "{") {
+    let i = range.start - 1;
+    const skip = () => {
+      while (i >= 0 && /\s/.test(code[i])) i--;
+    };
+    skip();
+    let arrow = false;
+    if (code[i] === ">" && code[i - 1] === "=") {
+      arrow = true;
+      i -= 2;
+      skip();
+    }
+    if (arrow && /[\w$]/.test(code[i] ?? "")) {
+      const end = i + 1;
+      while (i >= 0 && /[\w$]/.test(code[i])) i--;
+      return [code.slice(i + 1, end)];
+    }
+    if (code[i] !== ")") {
+      const window = code.slice(Math.max(0, i - 200), i + 1);
+      const close2 = window.lastIndexOf(")");
+      if (close2 === -1) return [];
+      i -= window.length - 1 - close2;
+    }
+    open = a.openers.get(i);
+  } else {
+    const head = /^\s*(?:async\b\s*)?(?:function\b[^(]{0,80})?\(/.exec(code.slice(range.start, range.start + 200));
+    if (head) open = range.start + head[0].length - 1;
+    else {
+      const single = /^\s*(?:async\s+)?([A-Za-z_$][\w$]*)\s*=>/.exec(code.slice(range.start, range.start + 200));
+      return single ? [single[1]] : [];
+    }
+  }
+  if (open === void 0) return [];
+  const close = a.pairs.get(open);
+  if (close === void 0) return [];
+  return argsOf(a, open, close).map((arg) => /^(?:\.\.\.)?\s*([A-Za-z_$][\w$]*)/.exec(arg.text)?.[1] ?? "");
+}
+var within = (site, at) => site.range === null || site.range.start <= at && at <= site.range.end;
+var opsCache = /* @__PURE__ */ new WeakMap();
+function opsOf(site) {
+  const cached = opsCache.get(site);
+  if (cached) return cached;
+  const { a, name } = site;
+  let ops;
+  if (site.framework === "express") ops = { registrations: expressRegistrations(a, name), uses: expressUses(a, name), registers: [] };
+  else if (site.framework === "hono") ops = { ...honoOps(a, name, site.chainFrom), registers: [] };
+  else ops = fastifyOps(a, name);
+  const result = {
+    registrations: ops.registrations.filter((reg) => within(site, reg.at)),
+    uses: ops.uses.filter((use) => within(site, use.at)),
+    registers: ops.registers.filter((reg) => within(site, reg.at))
+  };
+  opsCache.set(site, result);
+  return result;
+}
+function generalMiddleware(site, before, files) {
+  const args = opsOf(site).uses.filter((use) => !use.mount && use.at < before && (use.prefix === null || use.prefix === "/" || /^\/?\*$/.test(use.prefix))).flatMap((use) => use.args).filter((arg) => site.framework !== "express" || mountedFile(site.a, arg, files) === null);
+  return toRefs(site.a, args);
+}
+function passedSites(site, files) {
+  const { a } = site;
+  const found = [];
+  const receive = (range, index, at) => {
+    if (!range) return;
+    const target = analyse(range.file);
+    const name = paramNamesOf(target, range)[index];
+    if (!name) return;
+    found.push({
+      a: target,
+      name,
+      framework: site.framework,
+      range: { start: range.start, end: range.end },
+      prefix: site.prefix,
+      root: site.root ?? site,
+      inherited: [...site.inherited, ...generalMiddleware(site, at, files)]
+    });
+  };
+  for (const m of a.source.matchAll(/\brequire\s*\(\s*['"]([^'"]+)['"]\s*\)\s*\(/g)) {
+    if (!within(site, m.index)) continue;
+    const open = m.index + m[0].length - 1;
+    const close = a.pairs.get(open);
+    if (close === void 0) continue;
+    const index = argsOf(a, open, close).findIndex((arg) => arg.text === site.name);
+    const module = index === -1 ? null : moduleFor(m[1], a.file, files);
+    if (module) receive(defaultExport(analyse(module)), index, m.index);
+  }
+  for (const m of a.code.matchAll(/(?<![\w$.])(?:([A-Za-z_$][\w$]*)\s*\.\s*)?([A-Za-z_$][\w$]*)\s*\(/g)) {
+    if (!within(site, m.index) || m[1] === site.name || m[2] === "require" || m[2] === site.name) continue;
+    const open = m.index + m[0].length - 1;
+    const close = a.pairs.get(open);
+    if (close === void 0) continue;
+    const index = argsOf(a, open, close).findIndex((arg) => arg.text === site.name);
+    if (index === -1) continue;
+    if (m[1]) {
+      const target = importOf(a, m[1], files);
+      receive(target ? importedFunction(target, m[2]) : null, index, m.index);
+    } else {
+      const local = findFunction(a, m[2]);
+      if (local) {
+        receive(local, index, m.index);
+        continue;
+      }
+      const target = importOf(a, m[2], files);
+      receive(target ? importedFunction(target, null) : null, index, m.index);
+    }
+  }
+  return found;
+}
+function normalizePath(path) {
+  const parts = [];
+  for (const part of path.split("/")) {
+    if (part === "" || part === ".") continue;
+    if (part === "..") parts.pop();
+    else parts.push(part);
+  }
+  return parts.join("/");
+}
+function registeredSites(site, files) {
+  const { a } = site;
+  const found = [];
+  for (const reg of opsOf(site).registers) {
+    const options = entriesOf(a, reg.options);
+    const prefixArg = options.get("prefix")?.value;
+    const prefix = joinPath(site.prefix, (prefixArg && pathOf(a, prefixArg)) ?? "");
+    const inherited = [...site.inherited, ...generalMiddleware(site, reg.at, files)];
+    const child = (range, childPrefix, hooks) => {
+      if (!range) return;
+      const target = analyse(range.file);
+      const name = paramNamesOf(target, range)[0];
+      if (name) found.push({
+        a: target,
+        name,
+        framework: "fastify",
+        range: { start: range.start, end: range.end },
+        prefix: childPrefix,
+        root: site.root ?? site,
+        inherited: [...inherited, ...hooks]
+      });
+    };
+    const ident = /^[A-Za-z_$][\w$]*$/.exec(reg.target.text)?.[0];
+    if (ident && packageOf(a, ident) === "@fastify/autoload") {
+      const dirValue = options.get("dir")?.value;
+      if (!dirValue) continue;
+      const parts = [...dirValue.source.matchAll(/['"`]([^'"`$]+)['"`]/g)].map((m) => m[1]);
+      if (parts.length === 0) continue;
+      const here = a.file.path.includes("/") ? a.file.path.slice(0, a.file.path.lastIndexOf("/")) : "";
+      const dir = normalizePath(`${here}/${parts.join("/")}`);
+      const optionPrefix = entriesOf(a, options.get("options")?.value ?? void 0).get("prefix")?.value;
+      const base = joinPath(prefix, (optionPrefix && pathOf(a, optionPrefix)) ?? "");
+      const autoHooks = /^true$/.test(options.get("autoHooks")?.value?.text ?? "");
+      const plugins = files.filter((f) => f.path.startsWith(`${dir}/`) && /\.[mc]?[jt]s$/.test(f.path) && !/\.d\.[mc]?ts$|\.(?:test|spec)\.[mc]?[jt]s$/.test(f.path));
+      const hooksByDir = /* @__PURE__ */ new Map();
+      if (autoHooks) {
+        for (const file of plugins.filter((f) => /(?:^|\/)autohooks\.[mc]?[jt]s$/.test(f.path))) {
+          const range = exportedPlugin(analyse(file), files, 0);
+          const name = range ? paramNamesOf(analyse(file), range)[0] : void 0;
+          if (!range || !name) continue;
+          const hookSite = { a: analyse(file), name, framework: "fastify", range: { start: range.start, end: range.end }, prefix: "", inherited: [] };
+          hooksByDir.set(file.path.slice(0, file.path.lastIndexOf("/")), generalMiddleware(hookSite, Infinity, files));
+        }
+      }
+      for (const file of plugins) {
+        if (/(?:^|\/)autohooks\.[mc]?[jt]s$/.test(file.path)) continue;
+        const relative3 = file.path.slice(dir.length + 1);
+        const folders = relative3.split("/").slice(0, -1);
+        const hooks = [...hooksByDir].filter(([folder]) => file.path.startsWith(`${folder}/`)).flatMap(([, refs]) => refs);
+        child(exportedPlugin(analyse(file), files, 0), joinPath(base, folders.length ? `/${folders.join("/")}` : "/"), hooks);
+      }
+      continue;
+    }
+    child(pluginOf(a, reg.target, files), prefix, []);
+  }
+  return found;
+}
+var indexCache = /* @__PURE__ */ new WeakMap();
+function serverIndex(files) {
+  const cached = indexCache.get(files);
+  if (cached) return cached;
+  const sites = [];
+  const seen = /* @__PURE__ */ new Set();
+  const add = (site) => {
+    const key = `${site.a.file.path}\0${site.name}\0${site.range?.start ?? -1}\0${site.prefix}`;
+    if (seen.has(key)) return false;
+    seen.add(key);
+    sites.push(site);
+    return true;
+  };
+  for (const file of files) {
+    if (!/\.[mc]?[jt]sx?$/.test(file.path) || !/\b(?:express|hono|fastify)\b/.test(file.content)) continue;
+    const a = analyse(file);
+    const names = frameworkNamesOf(a);
+    if (!names) continue;
+    for (const instance of instancesOf(a, names)) {
+      add({
+        a,
+        name: instance.name,
+        framework: instance.framework,
+        range: null,
+        prefix: instance.prefix,
+        inherited: [],
+        weak: instance.weak,
+        ...instance.chainFrom === void 0 ? {} : { chainFrom: instance.chainFrom }
+      });
+    }
+  }
+  let frontier = [...sites];
+  for (let level = 0; level < 4 && frontier.length; level++) {
+    const next = [];
+    for (const site of frontier) {
+      const children = [...passedSites(site, files), ...site.framework === "fastify" ? registeredSites(site, files) : []];
+      for (const child of children) if (add(child)) next.push(child);
+    }
+    frontier = next;
+  }
+  const shadowed = (site, at) => Boolean(site.weak) && sites.some((other) => other !== site && !other.weak && other.a === site.a && other.name === site.name && other.range !== null && within(other, at));
+  const byRouterFile = /* @__PURE__ */ new Map();
+  const byRoot = /* @__PURE__ */ new Map();
+  for (const site of sites) {
+    const { a } = site;
+    const { registrations, uses } = opsOf(site);
+    const routes = byRouterFile.get(a.file) ?? [];
+    for (const reg of registrations) {
+      if (shadowed(site, reg.at)) continue;
+      const handler = reg.handlerRange ?? (reg.handler ? handlerOf(a, reg.handler, files) : null);
+      if (!handler) continue;
+      const before = uses.filter((use) => !use.mount && use.at < reg.at && pathMatches(use.prefix, reg.path, site.framework)).flatMap((use) => use.args.filter((arg) => site.framework !== "express" || mountedFile(a, arg, files) === null));
+      const url = reg.path === null ? "(dynamic path)" : joinPath(site.prefix, reg.path);
+      const callbacks = flatten(a, reg.middleware);
+      const root = site.root ?? site;
+      const add2 = (range, middleware) => {
+        const route = {
+          file: range.file,
+          framework: site.framework,
+          url,
+          scope: scopeOf(range.file.path),
+          reachable: { start: range.start, end: range.end },
+          middleware: [...site.inherited, ...toRefs(a, before), ...toRefs(a, middleware)],
+          mounts: []
+        };
+        routes.push(route);
+        byRoot.set(root, [...byRoot.get(root) ?? [], route]);
+      };
+      add2(handler, callbacks);
+      callbacks.forEach((callback, index2) => {
+        if (!FUNCTION_EXPRESSION.test(callback.text)) return;
+        const range = functionAt(a, callback.at, callback.at + callback.text.length);
+        if (range) add2(range, callbacks.slice(0, index2));
+      });
+    }
+    if (routes.length) byRouterFile.set(a.file, routes);
+  }
+  const localRoutes = (a, arg) => {
+    const root = sites.find((other) => other.a === a && other.range === null && other.name === arg.text && !other.root);
+    return root ? byRoot.get(root) : void 0;
+  };
+  for (const site of sites) {
+    if (site.framework === "fastify") continue;
+    const { a } = site;
+    const uses = opsOf(site).uses;
+    for (const use of uses) {
+      if (site.framework === "hono" && !use.mount) continue;
+      use.args.forEach((arg, index2) => {
+        const target = mountedFile(a, arg, files);
+        const routes = target && target !== a.file ? byRouterFile.get(target) : localRoutes(a, arg);
+        if (!routes || routes.length === 0) return;
+        const isMiddleware = (x) => mountedFile(a, x, files) === null && localRoutes(a, x) === void 0;
+        const covers2 = (other) => site.framework === "hono" ? other.prefix === null || /\*$/.test(other.prefix) && pathMatches(other.prefix, use.prefix, "hono") : pathMatches(other.prefix, use.prefix, site.framework);
+        const earlier = uses.filter((other) => !other.mount && other.at < use.at && covers2(other)).flatMap((other) => site.framework === "hono" ? other.args : other.args.filter(isMiddleware));
+        const middleware = [...site.inherited, ...toRefs(a, earlier), ...toRefs(a, use.args.slice(0, index2).filter(isMiddleware))];
+        const prefix = joinPath(site.prefix, use.prefix ?? "/");
+        for (const route of routes) {
+          route.mounts.push(middleware);
+          if (prefix !== "/" && route.mounts.length === 1 && route.url.startsWith("/")) route.url = joinPath(prefix, route.url);
+        }
+      });
+    }
+  }
+  const byHandlerFile = /* @__PURE__ */ new Map();
+  for (const routes of byRouterFile.values()) {
+    for (const route of routes) {
+      const list = byHandlerFile.get(route.file) ?? [];
+      list.push(route);
+      byHandlerFile.set(route.file, list);
+    }
+  }
+  const index = { byHandlerFile };
+  indexCache.set(files, index);
+  return index;
+}
+function nodeRoutesFor(file, files) {
+  return serverIndex(files).byHandlerFile.get(file) ?? [];
+}
+function serverRoutesOf(file, files) {
+  const route = routeOf(file);
+  if (route) return [route];
+  const actions = serverActionRoutes(file);
+  return actions.length ? actions : nodeRoutesFor(file, files);
+}
+var decoratorCache = /* @__PURE__ */ new WeakMap();
+function decoratorOf(name, files) {
+  let cache3 = decoratorCache.get(files);
+  if (!cache3) {
+    cache3 = /* @__PURE__ */ new Map();
+    for (const file of files) {
+      if (!/\.[mc]?[jt]sx?$/.test(file.path) || !file.content.includes("decorate")) continue;
+      const a = analyse(file);
+      for (const m of a.source.matchAll(/\.\s*decorate\s*\(\s*['"]([A-Za-z_$][\w$]*)['"]\s*,/g)) {
+        if (cache3.has(m[1])) continue;
+        const open = a.source.indexOf("(", m.index);
+        const close = a.pairs.get(open);
+        const value = close === void 0 ? void 0 : argsOf(a, open, close)[1];
+        cache3.set(m[1], value ? handlerOf(a, value, files) : null);
+      }
+    }
+    decoratorCache.set(files, cache3);
+  }
+  return cache3.get(name) ?? null;
+}
+function authCompositionOf(ref) {
+  const a = analyse(ref.file);
+  const m = /^[A-Za-z_$][\w$]*\s*\.\s*auth\s*\(/.exec(ref.text);
+  if (!m) return null;
+  const open = ref.at + m[0].length - 1;
+  const close = a.pairs.get(open);
+  if (close === void 0) return null;
+  const args = argsOf(a, open, close);
+  if (!args[0]?.text.startsWith("[")) return null;
+  const relation = entriesOf(a, args[1]).get("relation")?.value;
+  return { refs: toRefs(a, flatten(a, [args[0]])), relation: relation && literalOf(relation) === "and" ? "and" : "or" };
+}
+function middlewareDefinition(ref, files) {
+  const a = analyse(ref.file);
+  const text = a.code.slice(ref.at, ref.at + ref.text.length);
+  let inline = null;
+  if (FUNCTION_EXPRESSION.test(text)) {
+    inline = functionAt(a, ref.at, ref.at + text.length);
+    return { name: "an inline middleware", range: null, spec: null, inline };
+  }
+  const call = /^[A-Za-z_$][\w$.]*\s*\(/.exec(text);
+  if (call) {
+    const open = ref.at + call[0].length - 1;
+    const close = a.pairs.get(open);
+    const last = close === void 0 ? void 0 : argsOf(a, open, close).at(-1);
+    if (last && FUNCTION_EXPRESSION.test(last.text)) inline = functionAt(a, last.at, last.at + last.text.length);
+  }
+  const root = /^([A-Za-z_$][\w$]*)/.exec(ref.text)?.[1] ?? "";
+  const member = /^[A-Za-z_$][\w$]*\s*\.\s*([A-Za-z_$][\w$]*)/.exec(ref.text)?.[1] ?? null;
+  const callee = member ?? root;
+  const spec = packageOf(a, root);
+  if (member && (spec === null || spec === "fastify")) {
+    const decorated = decoratorOf(member, files);
+    if (decorated) return { name: callee, range: decorated, spec: null, inline };
+  }
+  if (spec) return { name: callee, range: null, spec, inline };
+  const local = member === null ? findFunction(a, root) : null;
+  if (local) return { name: callee, range: local, spec: null, inline };
+  const target = importOf(a, root, files);
+  const range = target ? importedFunction(target, member) ?? (member ? propertyValue(analyse(target.file), member) : null) : null;
+  return { name: callee, range, spec: null, inline };
+}
+function propertyValue(a, name) {
+  const m = new RegExp(`(?<![\\w$.])${name.replace(/\$/g, "\\$")}\\s*:\\s*(?=[A-Za-z_$][\\w$.]*\\s*\\()`).exec(a.code);
+  if (!m) return null;
+  const from = m.index + m[0].length;
+  return { file: a.file, start: from, end: expressionEnd(a, from) - 1 };
+}
+
 // src/rules/apiauth.ts
 var APP_ROUTER = /(?:^|\/)app\/api\/(?:.+\/)?route\.[mc]?[jt]sx?$/;
 var PAGES_ROUTER = /(?:^|\/)pages\/api\/.+\.[mc]?[jt]sx?$/;
@@ -3601,11 +4606,38 @@ var AUTH_ENDPOINT_NAMES = /^(?:\/api)?\/auth\/(?:sign[-_]?in|sign[-_]?up|sign[-_
 var AUTH_CALLBACK = /^(?:\/api)?\/auth\/callback(?:\/[^/]+)?$/;
 var PROVIDER_CALLBACK = /^(?:\/api)?\/(?:auth|oauth|login|sign-?in)\/[^/]+\/callback$/;
 var OAUTH_HANDLER = /\bdefineOAuth\w*EventHandler\s*\(/;
+var NODE_AUTH_PATH = /\/(?:sign[-_]?(?:in|up|out)|log[-_]?(?:in|out)|register|forgot[-_]?password|reset[-_]?password|verify(?:[-_]?email)?|confirm(?:[-_]?email)?|magic[-_]?link|otp|callback|refresh(?:[-_]?token)?|(?:[\w-]*(?:password|passkey|webauthn|credentials)|oauth|sso)\/authori[sz]e|oauth\/(?:token|revoke|introspect|register)|request[-_]?token)\/?$/i;
 function isAuthEndpoint(route) {
   if (route.action !== void 0) return AUTH_ACTION_NAMES.test(route.action);
+  if (NODE_FRAMEWORKS.has(route.framework)) return NODE_AUTH_PATH.test(route.url) || /\/callback(?:\/|$)/i.test(route.url);
   return AUTH_ENDPOINT_NAMES.test(route.url) || AUTH_CALLBACK.test(route.url) || PROVIDER_CALLBACK.test(route.url) || OAUTH_HANDLER.test(noiseMaskedOf(route.file));
 }
 var AUTH_ENFORCING_CALL = /\b(?:NextAuth|require(?:Auth|User|Session|Admin)\w*|withAuth|verifyAuth|ensureAuth|assertAuth(?:enticated)?|verifyIdToken|constructEvent)\s*\(/i;
+var WEBHOOK_VERIFIERS = [
+  { spec: /^@polar-sh\/sdk\/webhooks$/, imported: "validateEvent", sync: true, instance: false },
+  { spec: /^@clerk\/[\w-]+(?:\/webhooks)?$/, imported: "verifyWebhook", sync: false, instance: false },
+  { spec: /^(?:svix|standardwebhooks)$/, imported: "Webhook", sync: true, instance: true }
+];
+var webhookVerifierCache = /* @__PURE__ */ new WeakMap();
+function webhookVerifiersOf(file) {
+  if (webhookVerifierCache.has(file)) return webhookVerifierCache.get(file);
+  const calls = [];
+  const syncCalls = [];
+  for (const binding of bindingsOf(file).imports) {
+    const verifier = WEBHOOK_VERIFIERS.find((v) => binding.spec && v.spec.test(binding.spec) && binding.imported === v.imported);
+    if (!verifier) continue;
+    const local = binding.local.replace(/\$/g, "\\$");
+    const names = verifier.instance ? [...noiseMaskedOf(file).matchAll(new RegExp(`\\b(?:const|let|var)\\s+([A-Za-z_$][\\w$]*)\\s*=\\s*new\\s+${local}\\s*\\(`, "g"))].map((m) => `${m[1].replace(/\$/g, "\\$")}\\s*\\.\\s*verify`) : [local];
+    calls.push(...names);
+    if (verifier.sync) syncCalls.push(...names);
+  }
+  const result = calls.length === 0 ? null : {
+    call: new RegExp(`^(?:${calls.join("|")})\\s*\\(`),
+    sync: new RegExp(`^(?:${syncCalls.length ? syncCalls.join("|") : "(?!)"})\\s*\\(`)
+  };
+  webhookVerifierCache.set(file, result);
+  return result;
+}
 var AUTH_CONDITION = /\b(?:session|token|user|userid|user_id|authorization|bearer|jwt|auth|signature|CRON_SECRET|WEBHOOK_SECRET|REVALIDATE_SECRET|ADMIN_SECRET)\b|\blocals\s*\.\s*user\b|\b(?:getUser|getSession|getServerSession|currentUser|getAuth|isAuthenticated|checkAuth|verifyAuth|ensureAuth|verifyIdToken|timingSafeEqual)\s*\(/i;
 var ACCESS_CHAIN = String.raw`[\w$]+(?:\??\.[\w$]+)*`;
 var NEGATED_IDENTITY = new RegExp(`^!\\s*${ACCESS_CHAIN}(?:\\s*\\([^=]*\\))?$`);
@@ -3614,7 +4646,7 @@ var IDENTITY_MISMATCH = new RegExp(`^${ACCESS_CHAIN}\\s*!={1,2}\\s*(?!(?:null|un
 var COMPARED_VALUE = String.raw`(?!(?:null|undefined|true|false)\b)(?:${ACCESS_CHAIN}(?:\s*\([^()]{0,200}\))?|\`[^\`]{0,300}\`)`;
 var SECRET_MISMATCH = new RegExp(`^${COMPARED_VALUE}\\s*!={1,2}\\s*${COMPARED_VALUE}$`);
 var STOPS_REQUEST = /^(?:(?:return|throw|redirect|notFound)\b|error\s*\(\s*40[13]\b)/;
-var DENIED_STATUS = /\b(?:return|throw)\b[\s\S]{0,300}\bstatus(?:Code)?\s*[:(=]\s*(?:401|403)\b|\berror\s*\(\s*40[13]\b/i;
+var DENIED_STATUS = /\b(?:return|throw)\b[\s\S]{0,300}(?:\bstatus(?:Code)?\s*[:(=]\s*|\bcode\s*\(\s*|\b\w*(?:Error|Exception|Response)\s*\(\s*|\b(?:c|ctx|context)\s*\.\s*(?:json|text|body|html|newResponse)\s*\([^;]{0,300}?,\s*)(?:401|403)\b|\berror\s*\(\s*40[13]\b/i;
 function closingDelimiter(source, start, open, close) {
   let depth = 0;
   for (let i = start; i < source.length; i++) {
@@ -3631,16 +4663,28 @@ function controlledStatement(source, afterCondition) {
   let start = afterCondition;
   while (/\s/.test(source[start] ?? "")) start++;
   if (source[start] === "{") {
-    const end2 = closingDelimiter(source, start, "{", "}");
-    return source.slice(start, end2 === null ? Math.min(source.length, start + 600) : end2 + 1);
+    const end = closingDelimiter(source, start, "{", "}");
+    return source.slice(start, end === null ? Math.min(source.length, start + 600) : end + 1);
+  }
+  const limit = Math.min(source.length, start + 400);
+  let depth = 0;
+  for (let i = start; i < limit; i++) {
+    const ch = source[i];
+    if ("([{".includes(ch)) depth++;
+    else if (")]}".includes(ch)) depth--;
+    else if (depth === 0 && ch === ";") return source.slice(start, i + 1);
+    else if (depth === 0 && ch === "\n") {
+      const before = source.slice(start, i).trimEnd();
+      const after = source.slice(i + 1, i + 40).trimStart();
+      if (before !== "" && !/[=+\-*/%&|^!?:,.([{<>]$/.test(before) && !/^(?:[.?+\-*/%&|^,:<>=)\]}]|=>)/.test(after)) return source.slice(start, i);
+    }
   }
-  const semicolon = source.indexOf(";", start);
-  const end = semicolon === -1 ? Math.min(source.length, start + 400) : Math.min(semicolon + 1, start + 400);
-  return source.slice(start, end);
+  return source.slice(start, limit);
 }
+var NON_IDENTITY_CHECK = /origin|referr?er|cors|rate[_-]?limit|captcha/i;
 function rejectsMissingIdentity(term, returnsDeniedStatus) {
   const rejects = NEGATED_IDENTITY.test(term) || IDENTITY_IS_EMPTY.test(term) || IDENTITY_MISMATCH.test(term);
-  return rejects && (AUTH_CONDITION.test(term) || returnsDeniedStatus);
+  return rejects && (AUTH_CONDITION.test(term) || returnsDeniedStatus && !NON_IDENTITY_CHECK.test(term));
 }
 function hasConditionalAuthGuard(code, requireThrow = false, accept) {
   const starts = /\bif\s*\(/g;
@@ -3765,10 +4809,14 @@ function statementEnd2(code, start, limit, pairs) {
   return limit;
 }
 var unguardedCache = /* @__PURE__ */ new WeakMap();
-function unguardedOpsOf(file) {
+var nodeRouteFiles = /* @__PURE__ */ new WeakSet();
+function unguardedOpsOf(file, files) {
   let hit = unguardedCache.get(file);
   if (hit === void 0) {
-    hit = unguardedOperations(file, findDataOps(file));
+    const node = serverRoutesOf(file, files).some((route) => NODE_FRAMEWORKS.has(route.framework));
+    if (node) nodeRouteFiles.add(file);
+    const ops = [...findDataOps(file), ...node ? delegatedWrites(file, files) : []].sort((a, b) => a.index - b.index);
+    hit = unguardedOperations(file, ops);
     unguardedCache.set(file, hit);
   }
   return hit;
@@ -3826,6 +4874,7 @@ function unguardedOperations(file, ops, extra, requireThrow = false, observe) {
   const functionStarts = new Set(bodies.map((body) => body.start));
   const bodiesByStart = new Map(bodies.map((body) => [body.start, body]));
   const localNames = localAuthNames(file);
+  const webhookVerifiers = webhookVerifiersOf(file);
   const guardEnds = /* @__PURE__ */ new Map();
   const guardNames = /* @__PURE__ */ new Map();
   const guardRequirements = /* @__PURE__ */ new Map();
@@ -3945,7 +4994,12 @@ function unguardedOperations(file, ops, extra, requireThrow = false, observe) {
             dependencies.forEach((index) => required.add(index));
             return true;
           }
-          return !observe && value.kind === "unknown" && rejectsMissingIdentity(term, DENIED_STATUS.test(code.slice(i, end)));
+          if (value.kind === "claimed") {
+            const branch = code.slice(i, end);
+            return rejectsMissingIdentity(term, true) && (/\b(?:throw|redirect)\b/.test(branch) || DENIED_STATUS.test(branch));
+          }
+          const frameworkContext = value.kind === "parameter" && nodeRouteFiles.has(file) && !/\.\s*(?:params|param|query|queries|body|headers?|cookies|raw|url|originalUrl|path|ip|ips|hostname|files?)\b/.test(subject);
+          return !observe && (value.kind === "unknown" || frameworkContext) && rejectsMissingIdentity(term, DENIED_STATUS.test(code.slice(i, end)));
         });
         if (end <= owner.end && accepted) {
           guardRequirements.set(owner.start, [...required]);
@@ -3965,7 +5019,9 @@ function unguardedOperations(file, ops, extra, requireThrow = false, observe) {
         continue;
       }
       const indirectCall = i > 0 && /[\w$.]/.test(code[i - 1]) ? null : extraCalls?.exec(code.slice(i, i + 100));
-      const call = indirectCall ?? AUTH_ENFORCING_CALL.exec(code.slice(i, i + 100));
+      const enforcing = AUTH_ENFORCING_CALL.exec(code.slice(i, i + 100));
+      const verifier = enforcing?.index === 0 ? null : webhookVerifiers?.call.exec(code.slice(i, i + 100)) ?? null;
+      const call = indirectCall ?? verifier ?? enforcing;
       const callName = call?.[0].replace(/\s*\($/, "");
       if (!indirectCall && call?.index === 0 && callName && localNames.has(callName)) continue;
       if (call?.index === 0 && !/^(?:withAuth|NextAuth)\b/i.test(call[0]) && !/\bfunction\s*$/.test(code.slice(Math.max(owner.start, i - 30), i))) {
@@ -3977,7 +5033,7 @@ function unguardedOperations(file, ops, extra, requireThrow = false, observe) {
         const prefix = code.slice(prefixStart, i).trim();
         if (/(?:&&|\|\||\?|:)\s*$/.test(code.slice(owner.start + 1, prefixStart))) continue;
         const awaited = /^(?:await|(?:const|let|var)\s+[\w${},:\s]+?=\s*await)(?:\s+[\w$.]+\.)?$/.test(prefix) || requireThrow && /^return(?:\s+await)?$/.test(prefix);
-        const synchronous = /^(?:assertAuth(?:enticated)?|constructEvent)\b/i.test(call[0]) && /^(?:(?:const|let|var)\s+[\w$]+\s*=\s*)?(?:[\w$]+\.)*$/.test(prefix);
+        const synchronous = (/^(?:assertAuth(?:enticated)?|constructEvent)\b/i.test(call[0]) || verifier !== null && webhookVerifiers.sync.test(call[0])) && /^(?:(?:const|let|var)\s+[\w$]+\s*=\s*)?(?:[\w$]+\.)*$/.test(prefix);
         if (!awaited && !synchronous) continue;
         const close2 = pairs.get(i + call[0].length - 1);
         if (close2 !== void 0 && close2 < owner.end) {
@@ -4255,9 +5311,23 @@ function guardDefinitions(file) {
   for (const body of bodies) {
     if (body.start < until) continue;
     until = body.end;
-    const declaration = declarationOf(code, body, openers);
+    let declaration = declarationOf(code, body, openers);
+    let declaredAt = body.declaration;
+    let curried = false;
+    if (!declaration && code.startsWith("=>", body.declaration)) {
+      let outer = curriedOuterArrow(code, body.declaration, openers);
+      for (let level = 0; outer !== null && level < 3; level++) {
+        declaration = declarationOf(code, { declaration: outer, start: body.start, end: body.end }, openers);
+        if (declaration) {
+          declaredAt = outer;
+          curried = true;
+          break;
+        }
+        outer = curriedOuterArrow(code, outer, openers);
+      }
+    }
     if (!declaration) continue;
-    const returned = /\breturn\s+(?:async\s+)?(?:function\b|(?:\([^)]{0,200}\)|[A-Za-z_$][\w$]*)\s*=>)/.exec(code.slice(body.start + 1, body.end));
+    const returned = curried ? null : /\breturn\s+(?:async\s+)?(?:function\b|(?:\([^)]{0,200}\)|[A-Za-z_$][\w$]*)\s*=>)/.exec(code.slice(body.start + 1, body.end));
     const nestedAt = returned ? body.start + 1 + returned.index + (returned[0].includes("=>") ? returned[0].lastIndexOf("=>") : returned[0].lastIndexOf("function")) : -1;
     const target = byDeclaration.get(nestedAt) ?? body;
     let at = target.end;
@@ -4281,10 +5351,10 @@ function guardDefinitions(file) {
     }
     const definition = {
       file,
-      line: lineNumberAt(lineStartsCached(file), body.declaration),
-      wrapper: target !== body
+      line: lineNumberAt(lineStartsCached(file), declaredAt),
+      wrapper: curried || target !== body
     };
-    const exported = !declaration.exported ? null : /\bexport\s+default\s+(?:async\s+)?$/.test(code.slice(Math.max(0, body.declaration - 80), body.declaration)) ? "default" : declaration.name;
+    const exported = !declaration.exported ? null : /\bexport\s+default\s+(?:async\s+)?$/.test(code.slice(Math.max(0, declaredAt - 80), declaredAt)) ? "default" : declaration.name;
     candidates.push({ name: declaration.name, exported, definition, at, start: target.start });
   }
   const unguarded = /* @__PURE__ */ new Set();
@@ -4311,6 +5381,26 @@ function guardDefinitions(file) {
   definitionsCache.set(file, result);
   return result;
 }
+function curriedOuterArrow(code, arrow, openers) {
+  let i = arrow - 1;
+  while (i >= 0 && /\s/.test(code[i])) i--;
+  const window = code.slice(Math.max(0, arrow - 200), arrow);
+  const close = window.lastIndexOf(")");
+  if (close !== -1 && /^\s*(?::[^=;{()]*)?$/.test(window.slice(close + 1))) {
+    const open = openers.get(arrow - window.length + close);
+    if (open === void 0) return null;
+    i = open - 1;
+  } else {
+    if (!/[\w$]/.test(code[i] ?? "")) return null;
+    while (i >= 0 && /[\w$]/.test(code[i])) i--;
+  }
+  while (i >= 0 && /\s/.test(code[i])) i--;
+  if (code.slice(i - 4, i + 1) === "async" && !/[\w$]/.test(code[i - 5] ?? "")) {
+    i -= 5;
+    while (i >= 0 && /\s/.test(code[i])) i--;
+  }
+  return code[i] === ">" && code[i - 1] === "=" ? i - 1 : null;
+}
 function bindingModule(spec, file, allFiles, scope) {
   const target = normalizeSpec(spec, file.path);
   if (!target) return null;
@@ -4426,25 +5516,72 @@ function delegatedGuard(file, candidate, allFiles, scope, state, depth, seen) {
   });
   return selected ? { ...candidate.definition, requiredArgs, chain: [selected, ...selected.chain ?? []] } : null;
 }
+var HELPER_BUDGET = 64;
+var ROUTE_BUDGET = 1024;
+var AUTH_HELPER_NAME = /auth|session|user|admin|guard|protect|verify|require|permission|role|access|owner|member|login|sign[_-]?in|token|jwt|^with[A-Z]/i;
+var EXPORT_WRAPPER = /\bexport\s+(?:const\s+(?:[A-Za-z_$][\w$]*|\{[^{}]{0,500}\})\s*(?::[^=;]{0,200})?=|default)\s*(?:await\s+)?([A-Za-z_$][\w$]*)\s*(?:<[^()]{0,200}>\s*)?\(/g;
+var AUTH_DENIAL = /\b(?:status(?:Code)?\s*[:(=]\s*|code\s*\(\s*|,\s*)40[13]\b|\b\w*(?:Unauthori[sz]ed|Forbidden)\w*|['"](?:unauthorized|forbidden)['"]|redirect\s*\(\s*['"`][^'"`]*(?:login|sign-?in|auth)/i;
+var AUTH_SIGNAL = /\b(?:session|token|apiKey|api_key|authorization|bearer|jwt|auth|credentials?|currentUser)\b|\b(?:getServerSession|getSession|getUser|getClaims|verifyIdToken|authenticate)\s*\(/i;
+function evidenceWrapper(file, name, files) {
+  const definition = calleeDefinition(file, name, null, files);
+  if (!definition) return null;
+  const queue = [{ range: definition, depth: 0 }];
+  const seen = /* @__PURE__ */ new Set();
+  for (let i = 0; i < queue.length && i < 24; i++) {
+    const { range, depth } = queue[i];
+    const key = `${range.file.path}\0${range.start}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    const text = commentsMaskedOf(range.file).slice(range.start, range.end + 1);
+    if (AUTH_DENIAL.test(text) && AUTH_SIGNAL.test(text)) {
+      return { file: definition.file, line: lineNumberAt(lineStartsCached(definition.file), definition.start), wrapper: true };
+    }
+    if (depth >= 2) continue;
+    const code = noiseMaskedOf(range.file).slice(range.start, range.end + 1);
+    const params = new Set(functionParams({ file: range.file, start: range.start, end: range.end }));
+    const pairs = delimiterPairs(code);
+    for (const m of code.matchAll(/(?<![\w$.])([A-Za-z_$][\w$]*)\s*(?:<[^()]{0,200}>\s*)?\(|(?<=[(,]\s*)([A-Za-z_$][\w$]*)\s*(?=[,)])/g)) {
+      const callee = m[1] ?? m[2];
+      if (NOT_CALLEE.test(callee) || params.has(callee)) continue;
+      if (m[1]) {
+        const close = pairs.get(m.index + m[0].length - 1);
+        const args = close === void 0 ? "" : code.slice(m.index + m[0].length, close);
+        if ([...params].some((p) => new RegExp(`(?<![\\w$.])${p.replace(/\$/g, "\\$")}(?![\\w$])`).test(args))) continue;
+      }
+      const target = calleeDefinition(range.file, callee, null, files);
+      if (target) queue.push({ range: target, depth: depth + 1 });
+    }
+  }
+  return null;
+}
 function indirectGuardOperations(route, ctx) {
-  const state = { remaining: 128, truncated: false };
   const { called } = guardBindings(route.file);
+  const wrappers = new Set([...noiseMaskedOf(route.file).matchAll(EXPORT_WRAPPER)].map((m) => m[1]));
+  const rank = (name) => wrappers.has(name) ? 0 : AUTH_HELPER_NAME.test(name) ? 1 : 2;
+  const ordered = [...called].sort((a, b) => rank(a) - rank(b));
   const names = /* @__PURE__ */ new Map();
-  for (const name of called) {
-    if (state.remaining <= 0) {
-      state.truncated = true;
+  let total = ROUTE_BUDGET;
+  let truncated = false;
+  let evidenceBudget = 16;
+  for (const name of ordered) {
+    if (total <= 0) {
+      truncated = true;
       break;
     }
+    const budget = Math.min(HELPER_BUDGET, total);
+    const state = { remaining: budget, truncated: false };
     const definition = namedGuard(route.file, name, ctx.files, route.scope, state, 0, /* @__PURE__ */ new Set());
+    total -= budget - Math.max(0, state.remaining);
+    if (state.truncated) truncated = true;
     if (definition) names.set(name, definition);
+    else if (rank(name) <= 1 && evidenceBudget-- > 0) {
+      const wrapper = evidenceWrapper(route.file, name, ctx.files);
+      if (wrapper) names.set(name, wrapper);
+    }
   }
-  if (state.truncated) ctx.reportIncomplete(
-    "api/db-access-without-auth",
-    `${route.file.path} reached the authentication resolution limit (8 hops or 128 symbols); unresolved guards were not accepted`
-  );
   const protectedOps = /* @__PURE__ */ new Map();
-  if (names.size === 0) return protectedOps;
-  unguardedOperations(route.file, unguardedOpsOf(route.file), {
+  if (names.size === 0) return { ops: protectedOps, truncated };
+  unguardedOperations(route.file, unguardedOpsOf(route.file, ctx.files), {
     guards: new Set([...names].filter(([, definition]) => !definition.wrapper).map(([name]) => name)),
     wrappers: new Set([...names].filter(([, definition]) => definition.wrapper).map(([name]) => name)),
     requirements: new Map([...names].map(([name, guard]) => [name, guard.requiredArgs ?? []])),
@@ -4453,7 +5590,63 @@ function indirectGuardOperations(route, ctx) {
       if (definition) protectedOps.set(index, definition);
     }
   });
-  return protectedOps;
+  return { ops: protectedOps, truncated };
+}
+var DELEGATE_DEPTH = 2;
+var DELEGATE_BUDGET = 256;
+var NOT_CALLEE = /^(?:if|for|while|switch|catch|function|return|typeof|await|new|super|this|import|require|async|void|delete|in|of)$/;
+var directUnguardedCache = /* @__PURE__ */ new WeakMap();
+function directUnguardedOps(file) {
+  let hit = directUnguardedCache.get(file);
+  if (hit === void 0) {
+    hit = unguardedOperations(file, findDataOps(file));
+    directUnguardedCache.set(file, hit);
+  }
+  return hit;
+}
+var delegatedCache = /* @__PURE__ */ new WeakMap();
+function delegatedWrites(file, files, depth = 0) {
+  let byDepth = delegatedCache.get(file);
+  if (!byDepth) {
+    byDepth = /* @__PURE__ */ new Map();
+    delegatedCache.set(file, byDepth);
+  }
+  const cached = byDepth.get(depth);
+  if (cached) return cached;
+  byDepth.set(depth, []);
+  const code = noiseMaskedOf(file);
+  const pairs = delimiterPairs(code);
+  const chains = /* @__PURE__ */ new Map();
+  const hits = [];
+  for (const m of code.matchAll(/(?<![\w$.])([A-Za-z_$][\w$]*)(?:\s*\??\.\s*([A-Za-z_$][\w$]*))?\s*\(/g)) {
+    const name = m[1];
+    const member = m[2] ?? null;
+    if (NOT_CALLEE.test(name)) continue;
+    if (/\bfunction\s*\*?\s*$|\b(?:get|set|static)\s+$/.test(code.slice(Math.max(0, m.index - 12), m.index))) continue;
+    const close = pairs.get(m.index + m[0].length - 1);
+    if (close !== void 0 && /^\s*(?::[^{;=]{0,200})?\{/.test(code.slice(close + 1, close + 220))) continue;
+    const key = `${name}.${member ?? ""}`;
+    let resolved = chains.get(key);
+    if (resolved === void 0) {
+      resolved = chains.size < DELEGATE_BUDGET ? writeChain(file, name, member, files, depth) : null;
+      chains.set(key, resolved);
+    }
+    if (!resolved || resolved.range && resolved.range.start <= m.index && m.index <= resolved.range.end) continue;
+    hits.push({ index: m.index, writes: true, via: resolved.chain });
+  }
+  byDepth.set(depth, hits);
+  return hits;
+}
+function writeChain(file, name, member, files, depth) {
+  const range = calleeDefinition(file, name, member, files);
+  if (!range) return null;
+  if (/^with[A-Z]/.test(member ?? name) || middlewareRejects(noiseMaskedOf(range.file).slice(range.start, range.end + 1))) return null;
+  const local = range.file === file ? { start: range.start, end: range.end } : null;
+  const own = operationsInRange(directUnguardedOps(range.file), range.start, range.end).find((op) => op.writes);
+  if (own) return { range: local, chain: [{ file: range.file, index: own.index }] };
+  if (depth + 1 >= DELEGATE_DEPTH) return null;
+  const nested = operationsInRange(delegatedWrites(range.file, files, depth + 1), range.start, range.end)[0];
+  return nested ? { range: local, chain: [{ file: range.file, index: nested.index }, ...nested.via] } : null;
 }
 var SUPABASE_TABLE = /\.from\(\s*['"`][^'"`]+['"`]\s*\)\s*\.?\s*(\w+)?/g;
 var SUPABASE_ADMIN_API = /\bauth\s*\.\s*admin\s*\.\s*(\w+)\s*\(/g;
@@ -4462,7 +5655,7 @@ var PRISMA_OP = /\b(?:prisma|db)\s*\.\s*\$?(\w+)\s*\.\s*(findMany|findFirst|find
 var PRISMA_RAW = /\b(?:prisma|db)\s*\.\s*\$(queryRaw|executeRaw)/g;
 var PRISMA_WRITES = /^(?:create|createMany|update|updateMany|upsert|delete|deleteMany)$/;
 var DRIZZLE_OP = /\bdb\s*\.\s*(select|insert|update|delete)\s*\(/g;
-var MONGO_OP = /\.(?:deleteMany|deleteOne|updateMany|updateOne|insertMany|insertOne|findOneAndDelete|findOneAndUpdate)\s*\(/g;
+var MONGO_OP = /\.(?:deleteMany|deleteOne|updateMany|updateOne|insertMany|insertOne|findOneAndDelete|findOneAndUpdate|findOneAndReplace|replaceOne|bulkWrite|findByIdAndUpdate|findByIdAndDelete|findByIdAndRemove)\s*\(/g;
 var RAW_SQL = /\b(?:sql|query|execute)\s*(?:`|\(\s*['"`])\s*(select|insert|update|delete|drop|truncate)\b/gi;
 var RAW_SQL_WRITES = /^(?:insert|update|delete|drop|truncate)$/i;
 function findDataOps(file) {
@@ -4485,8 +5678,11 @@ function findDataOps(file) {
     push(m.index, PRISMA_WRITES.test(m[2] ?? ""));
   }
   PRISMA_RAW.lastIndex = 0;
+  const source = commentsMaskedOf(file);
   while ((m = PRISMA_RAW.exec(code)) !== null) {
-    push(m.index, (m[1] ?? "") === "executeRaw");
+    const statement = source.slice(m.index + m[0].length, m.index + m[0].length + 300);
+    const readOnly = /^(?:Unsafe)?\s*(?:`|\(\s*['"`])\s*SELECT\b(?![^`'"]*\bINTO\b)/i.test(statement);
+    push(m.index, (m[1] ?? "") === "executeRaw" && !readOnly);
   }
   DRIZZLE_OP.lastIndex = 0;
   while ((m = DRIZZLE_OP.exec(code)) !== null) {
@@ -4787,6 +5983,187 @@ function containsAuthCheck(file) {
   return found;
 }
 var SECRET_SHAPED = /['"`]([A-Za-z0-9_\-.]{32,})['"`]/g;
+var AUTH_LIBRARIES = [
+  [/^passport$/, /\.\s*authenticate\s*\((?!\s*['"]anonymous['"])/],
+  // credentialsRequired: false / authRequired: false 时只解析令牌、不拒绝请求。
+  [/^express-jwt$/, /^(?![\s\S]*\bcredentialsRequired\s*:\s*false\b)[A-Za-z_$][\w$]*\s*\(/],
+  [/^express-openid-connect$/, /^requiresAuth\s*\(/],
+  [/^express-oauth2-jwt-bearer$/, /^(?![\s\S]*\bauthRequired\s*:\s*false\b)(?:auth|requiredScopes|claimCheck|claimEquals|claimIncludes)\s*\(/],
+  [/^@clerk\/(?:express|clerk-sdk-node)$/, /^(?:requireAuth|ClerkExpressRequireAuth)\s*\(/],
+  [/^connect-ensure-login$/, /^(?:ensureLoggedIn|[A-Za-z_$][\w$]*\s*\.\s*ensureLoggedIn)\s*\(/],
+  [/^express-basic-auth$/, /^[A-Za-z_$][\w$]*\s*\(/],
+  [/^hono\/jwt$/, /^jwt\s*\(/],
+  [/^hono\/jwk$/, /^jwk\s*\(/],
+  [/^hono\/bearer-auth$/, /^bearerAuth\s*\(/],
+  [/^hono\/basic-auth$/, /^basicAuth\s*\(/],
+  // 注册即为所在作用域添加 onRequest 校验钩子。
+  [/^@fastify\/bearer-auth$/, /^[A-Za-z_$][\w$]*$/]
+];
+var FASTIFY_AUTH_DECORATORS = [["@fastify/basic-auth", "basicAuth"]];
+var NON_AUTH_MIDDLEWARE = /^(?:express-session|cookie-session|cookie-parser|lusca|helmet|cors|csurf|express-rate-limit|body-parser|multer|compression|morgan|connect-flash|express-flash|connect-mongo|express-validator)$/;
+var DENIED_RESPONSE = /\b(?:sendStatus|status|code)\s*\(\s*40[13]\b|\bstatus(?:Code)?\s*:\s*40[13]\b|,\s*40[13]\s*\)|\bHTTPException\s*\(\s*40[13]\b/;
+var DENIES_REQUEST = new RegExp(
+  String.raw`\b(?:res(?:ponse)?|c|ctx)\s*\.\s*redirect\s*\(|${DENIED_RESPONSE.source}|\bnext\s*\(\s*(?:new\s+)?[\w$.]*(?:Unauthori[sz]ed|Forbidden|Auth)\w*`
+);
+function passesOnlyAuthenticated(code) {
+  for (const m of code.matchAll(/\bif\s*\(/g)) {
+    const open = m.index + m[0].length - 1;
+    const close = closingDelimiter(code, open, "(", ")");
+    if (close === null) continue;
+    const condition = code.slice(open + 1, close);
+    if (condition.trimStart().startsWith("!") || !AUTH_CONDITION.test(condition)) continue;
+    const rest = code.slice(close + 1);
+    const pass = /^\s*\{?\s*(?:return\s+)?(?:await\s+)?next\s*\(\s*\)\s*;?\s*(?:return\s*;?\s*)?\}?/.exec(rest);
+    if (pass && DENIES_REQUEST.test(rest.slice(pass[0].length))) return true;
+  }
+  return false;
+}
+function awaitedCall(code, pattern) {
+  for (const m of code.matchAll(new RegExp(pattern.source, pattern.flags.includes("g") ? pattern.flags : `${pattern.flags}g`))) {
+    const before = code.slice(Math.max(0, m.index - 300), m.index).replace(/(?:[A-Za-z_$][\w$]*(?:\s*\([^()]*\))?\s*\??\.\s*)*$/, "").trimEnd();
+    if (/(?:^|[^\w$.])(?:await|return)$/.test(before)) return true;
+  }
+  return false;
+}
+function maskUnusedFunctions(code) {
+  let out = code;
+  const definitions = /\b(?:(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*(?::[^=;]{0,200})?=\s*(?:async\b\s*)?(?:function\b[^(]{0,80}\([^()]*\)|\([^()]*\)\s*(?::[^=;{]{0,200})?=>|[A-Za-z_$][\w$]*\s*=>)|(?:async\s+)?function\s*\*?\s*([A-Za-z_$][\w$]*)\s*\([^()]*\))\s*/g;
+  for (const m of code.matchAll(definitions)) {
+    const name = m[1] ?? m[2];
+    const bodyAt = m.index + m[0].length;
+    let end;
+    if (code[bodyAt] === "{") end = closingDelimiter(code, bodyAt, "{", "}") ?? code.length - 1;
+    else {
+      end = bodyAt;
+      for (let depth = 0; end < code.length; end++) {
+        const ch = code[end];
+        if ("([{".includes(ch)) depth++;
+        else if (")]}".includes(ch)) {
+          if (depth === 0) break;
+          depth--;
+        } else if (depth === 0 && (ch === ";" || ch === "," || ch === "\n")) break;
+      }
+      end--;
+    }
+    const reference = new RegExp(`(?<![\\w$.])${name.replace(/\$/g, "\\$")}(?![\\w$])`, "g");
+    const used = [...code.matchAll(reference)].some((r) => r.index < m.index || r.index > end);
+    if (!used) out = out.slice(0, m.index) + out.slice(m.index, end + 1).replace(/[^\n]/g, " ") + out.slice(end + 1);
+  }
+  return out;
+}
+function jwtVerifyRejects(code) {
+  if (!awaitedCall(code, /\bjwtVerify\s*\(/)) return false;
+  const handlers = [...code.matchAll(/\bcatch\s*(?:\([^()]*\))?\s*\{/g)].map((m) => {
+    const open = m.index + m[0].length - 1;
+    return code.slice(open, closingDelimiter(code, open, "{", "}") ?? open);
+  });
+  return handlers.every((body) => /\bsend\s*\(|\bthrow\b/.test(body) || DENIED_RESPONSE.test(body));
+}
+function rejectsSecretMismatch(code) {
+  for (const m of code.matchAll(/\bif\s*\(/g)) {
+    const open = m.index + m[0].length - 1;
+    const close = closingDelimiter(code, open, "(", ")");
+    if (close === null) continue;
+    const condition = code.slice(open + 1, close);
+    if (/&&|\?(?!\.)/.test(condition)) continue;
+    const mismatch = condition.split("||").some((part) => {
+      const sides = /^([\s\S]*?)\s*!={1,2}\s*([\s\S]*)$/.exec(part.trim());
+      return sides !== null && (isServerSecretExpression(sides[1]) || isServerSecretExpression(sides[2]));
+    });
+    if (mismatch && DENIED_STATUS.test(controlledStatement(code, close + 1))) return true;
+  }
+  return false;
+}
+function catchDenies(code) {
+  for (const m of code.matchAll(/\btry\s*\{/g)) {
+    const tryOpen = m.index + m[0].length - 1;
+    const tryClose = closingDelimiter(code, tryOpen, "{", "}");
+    if (tryClose === null) continue;
+    if (!/\b\w*(?:auth|valid|verify|session|token|user|client|key|secret|permission|access)\w*\s*\(/i.test(code.slice(tryOpen, tryClose))) continue;
+    const handler = /^\s*catch\s*(?:\([^()]*\))?\s*\{/.exec(code.slice(tryClose + 1));
+    if (!handler) continue;
+    const open = tryClose + handler[0].length;
+    const close = closingDelimiter(code, open, "{", "}");
+    if (close === null) continue;
+    const body = code.slice(open + 1, close);
+    const exits = [...body.matchAll(/\b(?:return|throw)\b/g)].map((exit) => exit.index);
+    if (exits.length === 0) continue;
+    const denies = exits.every((at, i) => {
+      const statement = body.slice(at, exits[i + 1] ?? body.length);
+      return statement.startsWith("throw") || DENIED_STATUS.test(statement) || /\bsend\s*\(\s*(?:err|error|e)\s*\)/.test(statement);
+    });
+    const pairs = delimiterPairs(body);
+    let topLevelExit = false;
+    for (let i = 0; i < body.length; i++) {
+      const end = pairs.get(i);
+      if (end !== void 0) {
+        i = end;
+        continue;
+      }
+      if (/^(?:return|throw)\b/.test(body.slice(i, i + 6)) && (i === 0 || !/[\w$.]/.test(body[i - 1]))) {
+        topLevelExit = true;
+        break;
+      }
+    }
+    if (denies && topLevelExit) return true;
+  }
+  return false;
+}
+var MIDDLEWARE_CREDENTIAL = /auth|secret|token|api[_-]?key|signature|session|jwt|bearer|credential|password|timingSafeEqual|verif/i;
+function rejectsMissingCredential(code) {
+  return hasConditionalAuthGuard(code.replace(/!\s*await\s+/g, "!"), false, (term) => (NEGATED_IDENTITY.test(term) || IDENTITY_IS_EMPTY.test(term)) && MIDDLEWARE_CREDENTIAL.test(term));
+}
+function middlewareRejects(source) {
+  const code = maskUnusedFunctions(source);
+  if (hasConditionalAuthGuard(code) || rejectsMissingCredential(code) || passesOnlyAuthenticated(code) || rejectsSecretMismatch(code) || catchDenies(code) || AUTH_ENFORCING_CALL.test(code) || jwtVerifyRejects(code)) return true;
+  return (/\b(?:jwt\s*\.\s*verify|verifyToken|verifyJwt|verifyIdToken|verifyAccessToken)\s*\(/.test(code) || awaitedCall(code, /\bjwtVerify\s*\(/)) && DENIED_RESPONSE.test(code);
+}
+function middlewareStatus(ref, files, depth = 0) {
+  const composition = depth < 3 ? authCompositionOf(ref) : null;
+  if (composition) {
+    const parts = composition.refs.map((part) => middlewareStatus(part, files, depth + 1));
+    const guarded = composition.relation === "and" ? parts.some((part) => part.status === "guard") : parts.length > 0 && parts.every((part) => part.status === "guard");
+    if (guarded) return { status: "guard", name: "auth" };
+    const unconfirmed = parts.find((part) => part.status === "unconfirmed");
+    return unconfirmed ?? { status: "none", name: "auth" };
+  }
+  const { name, range, spec, inline } = middlewareDefinition(ref, files);
+  const known = spec ? AUTH_LIBRARIES.find(([pkg]) => pkg.test(spec)) : void 0;
+  if (known && known[1].test(ref.text)) return { status: "guard", name };
+  if (inline && middlewareRejects(noiseMaskedOf(inline.file).slice(inline.start, inline.end + 1))) return { status: "guard", name };
+  if (spec) {
+    if (known || NON_AUTH_MIDDLEWARE.test(spec)) return { status: "none", name };
+  } else if (range) {
+    const code = noiseMaskedOf(range.file).slice(range.start, range.end + 1);
+    if (middlewareRejects(code)) return { status: "guard", name };
+    const initializer = commentsMaskedOf(range.file).slice(range.start, range.end + 1).trim();
+    if (initializer !== ref.text && /^[A-Za-z_$][\w$.]*\s*\(/.test(initializer) && depth < 3) {
+      const inner = middlewareStatus({ text: initializer, at: range.start, file: range.file }, files, depth + 1);
+      if (inner.status === "guard") return { status: "guard", name };
+    }
+  } else if (/^[A-Za-z_$][\w$]*\s*\.\s*[A-Za-z_$][\w$]*$/.test(ref.text)) {
+    const plugin = FASTIFY_AUTH_DECORATORS.find(([pkg, decorator]) => decorator === name && files.some((file) => file.content.includes(`'${pkg}'`) || file.content.includes(`"${pkg}"`)));
+    if (plugin) return { status: "guard", name };
+  }
+  return { status: AUTH_HELPER_NAME.test(name) ? "unconfirmed" : "none", name };
+}
+function middlewareGuardStatus(route, files) {
+  const unconfirmed = /* @__PURE__ */ new Set();
+  const scan2 = (refs) => {
+    let guarded = false;
+    for (const ref of refs) {
+      const { status, name } = middlewareStatus(ref, files);
+      if (status === "guard") guarded = true;
+      else if (status === "unconfirmed") unconfirmed.add(name);
+    }
+    return guarded;
+  };
+  if (scan2(route.middleware ?? [])) return { guarded: true, unconfirmed: [] };
+  const mounts = route.mounts ?? [];
+  const mounted = mounts.map(scan2);
+  if (mounted.length > 0 && mounted.every(Boolean)) return { guarded: true, unconfirmed: [] };
+  return { guarded: false, unconfirmed: [...unconfirmed] };
+}
 function excerptFor(file, line) {
   const raw = (file.lines[line - 1] ?? "").trim();
   let out = raw;
@@ -4801,10 +6178,7 @@ var apiAuthRule = {
   id: "api/db-access-without-auth",
   severity: "P0",
   check(ctx) {
-    const routes = ctx.files.flatMap((file) => {
-      const route = routeOf(file);
-      return route === null ? serverActionRoutes(file) : [route];
-    });
+    const routes = ctx.files.flatMap((file) => serverRoutesOf(file, ctx.files));
     if (routes.length === 0) return [];
     for (const middlewareFile of ctx.files.filter((f) => isAnyMiddlewareFile(f.path))) {
       const config = extractMatcherConfig(middlewareFile);
@@ -4820,21 +6194,31 @@ var apiAuthRule = {
     const sessionModules = ctx.files.filter(buildsSessionClient);
     const findings = [];
     const indirectByFile = /* @__PURE__ */ new Map();
+    const reportedRanges = /* @__PURE__ */ new Set();
     for (const route of routes) {
       const reachable = route.reachable;
-      const unguarded = unguardedOpsOf(route.file);
+      const unguarded = unguardedOpsOf(route.file, ctx.files);
       let ops = reachable === void 0 ? unguarded : operationsInRange(unguarded, reachable.start, reachable.end);
       if (ops.length === 0) continue;
-      let indirectOps = indirectByFile.get(route.file);
-      if (!indirectOps) {
-        indirectOps = indirectGuardOperations(route, ctx);
-        indirectByFile.set(route.file, indirectOps);
+      let indirectGuards = indirectByFile.get(route.file);
+      if (!indirectGuards) {
+        indirectGuards = indirectGuardOperations(route, ctx);
+        indirectByFile.set(route.file, indirectGuards);
       }
+      const indirectOps = indirectGuards.ops;
+      ops = ops.filter((op) => !(op.via && indirectOps.has(op.index)));
+      if (ops.length === 0) continue;
       const unprotected = ops.filter((op) => !indirectOps.has(op.index));
-      if (unprotected.length > 0) ops = unprotected;
+      if (unprotected.length > 0 && (unprotected.some((op) => op.writes) || !ops.some((op) => op.writes) || usesAdminClient(route, adminModules, ctx.files))) ops = unprotected;
       const url = route.url;
       if (isAuthEndpoint(route)) continue;
       if ((route.framework === "next" || route.framework === "astro") && route.action === void 0 && middlewareCovers(ctx, route)) continue;
+      let unconfirmedMiddleware = [];
+      if (NODE_FRAMEWORKS.has(route.framework)) {
+        const status = middlewareGuardStatus(route, ctx.files);
+        if (status.guarded) continue;
+        unconfirmedMiddleware = status.unconfirmed;
+      }
       const globalGuard = globalGuardFor(ctx, route);
       const globalNote = globalGuard === null ? [] : [
         `${globalGuard} contains an authentication check that may cover ${url}. Its path conditions are written in code, so the scan cannot tell which routes it applies to; this finding is reported at lower confidence. Confirm that check runs for ${url}.`
@@ -4843,6 +6227,15 @@ var apiAuthRule = {
       if (/\.auth\s*\.\s*getSession\s*\(/.test(handlerCode)) globalNote.push(
         "This handler checks supabase.auth.getSession(). On the server that reads the session from the cookie without verifying it, so a forged cookie passes; it is not counted as authentication. Use supabase.auth.getClaims() or getUser() instead."
       );
+      for (const name of unconfirmedMiddleware) globalNote.push(
+        `The route goes through ${name}, which looks like authentication but could not be followed to code that rejects unauthenticated requests, so this finding is reported at lower confidence. Confirm ${name} rejects requests without a valid user.`
+      );
+      if (indirectGuards.truncated) globalNote.push(
+        "The scan stopped following local helpers in this file at its limit (8 hops, 64 symbols per helper, 1,024 per file). Unfollowed helpers cannot hide a finding, but if one of them enforces authentication for this operation, treat this as a finding to review."
+      );
+      const rangeKey = `${route.file.path}\0${reachable?.start ?? -1}\0${reachable?.end ?? -1}`;
+      if (reportedRanges.has(rangeKey)) continue;
+      reportedRanges.add(rangeKey);
       const admin = usesAdminClient(route, adminModules, ctx.files);
       const hit = ops.find((o) => o.writes) ?? ops[0];
       const indirect = indirectOps.get(hit.index);
@@ -4855,17 +6248,28 @@ var apiAuthRule = {
         description: "Local authentication helper in the recognized delegation chain; verify runtime behaviour and caller coverage."
       })) : [];
       if (indirect) globalNote.push("A local authentication helper or wrapper was recognized before this operation. This finding is retained for review because indirect control flow is not a proof of authorization.");
+      const delegated = (hit.via ?? []).map((step) => ({ file: step.file.path, line: lineNumberAt(lineStartsCached(step.file), step.index) }));
+      const delegatedEvidence = delegated.map((step, i) => ({
+        kind: "operation",
+        file: step.file,
+        line: step.line,
+        description: i === delegated.length - 1 ? "Database write reached from this handler." : "Project function on the call path to the write."
+      }));
+      if (delegated.length > 0) {
+        const target = delegated.at(-1);
+        globalNote.push(`The write itself happens in ${target.file}:${target.line}, reached from this call` + (delegated.length > 1 ? ` through ${delegated.slice(0, -1).map((step) => `${step.file}:${step.line}`).join(", ")}` : "") + ". The scan followed the call into project code and found no authentication check on the way.");
+      }
       if (admin) {
         const trace = adminEvidence(route, adminModules, ctx.files, line);
-        const evidence = [...trace.evidence ?? [], ...indirectEvidence];
+        const evidence = [...trace.evidence ?? [], ...delegatedEvidence, ...indirectEvidence];
         findings.push({
           ruleId: "api/admin-db-access-without-auth",
           ...trace,
           evidence: evidence.slice(0, 24),
           evidenceTruncated: trace.evidenceTruncated || evidence.length > 24,
           severity: "P0",
-          // 管理员客户端缺少鉴权时使用确定置信度；可能受全局鉴权覆盖时降为疑似。
-          confidence: globalGuard === null && !indirect ? "certain" : "likely",
+          // 管理员客户端缺少鉴权时使用确定置信度；可能受全局鉴权或未确认的中间件覆盖时降为疑似。
+          confidence: globalGuard === null && !indirect && unconfirmedMiddleware.length === 0 ? "certain" : "likely",
           title: indirect ? `Review indirect authentication for admin database access in ${url}` : `Anyone can call ${url} and it queries your database as admin`,
           file: route.file.path,
           line,
@@ -4900,12 +6304,16 @@ var apiAuthRule = {
           file: route.file.path,
           line,
           excerpt,
-          ...indirect ? { evidence: [{
-            kind: "operation",
-            file: route.file.path,
-            line,
-            description: "Data write using a local authentication helper."
-          }, ...indirectEvidence] } : {},
+          ...indirect || delegated.length > 0 ? { evidence: [
+            {
+              kind: "operation",
+              file: route.file.path,
+              line,
+              description: indirect ? "Data write using a local authentication helper." : "Call that leads to a database write."
+            },
+            ...delegatedEvidence,
+            ...indirectEvidence
+          ] } : {},
           why: [
             ...globalNote,
             indirect ? "This route changes data after a local authentication helper; verify that it rejects unauthorized callers." : `This route changes data, and the scan did not recognize an authentication guard before the operation. Indirect guards and runtime controls require manual verification.`,
@@ -5304,7 +6712,7 @@ var corsRule = {
 // src/rules/request-input.ts
 var MAX_VALUE_HOPS = 8;
 var MAX_ASSIGNMENTS = 512;
-var MAX_EXPRESSION = 4e3;
+var MAX_EXPRESSION = 65536;
 var REQUEST_OBJECT_NAMES = /^(?:req|request|event|evt|ctx|context)$/;
 var DESTRUCTURED_OBJECTS = /* @__PURE__ */ new Set(["request", "req", "event"]);
 var DESTRUCTURED_URLS = /* @__PURE__ */ new Set(["url"]);
@@ -5346,6 +6754,8 @@ var TRANSPARENT_CALLS = /* @__PURE__ */ new Set([
   "getRequestURL"
 ]);
 var H3_READERS = "readBody|readFormData|readMultipartFormData|readRawBody|readValidatedBody|getQuery|getValidatedQuery|getRouterParams?|getValidatedRouterParams|getHeaders?|getRequestHeaders?|getCookie|parseCookies|getRequestURL";
+var HONO_MEMBERS = "param|query|queries|header|json|text|parseBody|formData|arrayBuffer|blob|url|path|valid|headers";
+var HONO_READ_CALLS = "param|query|queries|header|json|text|parseBody|formData|arrayBuffer|blob|valid";
 var LITERAL = String.raw`(?:'[^']*'|"[^"]*"|\x60[^\x60$]*\x60|-?\d+(?:\.\d+)?|null|undefined|true|false)`;
 var CLEAN_EXPRESSION = [
   /^(?:await\s+)?(?:Number|parseInt|parseFloat|Boolean|BigInt|isNaN|Math\s*\.\s*\w+|Number\s*\.\s*\w+)\s*\(/,
@@ -5356,10 +6766,86 @@ var CLEAN_EXPRESSION = [
   // 带标签的模板由标签函数处理插值（Prisma.sql、sql、html），String.raw 除外。
   /^(?:await\s+)?(?!String\s*\.\s*raw\b)[\w$]+(?:\s*\.\s*[\w$]+)*\s*\x60/
 ];
+var MIRROR_CALLS = /* @__PURE__ */ new Set([
+  "parse",
+  "safeParse",
+  "parseAsync",
+  "safeParseAsync",
+  "validate",
+  "validateSync",
+  "validateAsync",
+  "cast",
+  "structuredClone",
+  "clone",
+  "assign"
+]);
+var VALUE_MEMBERS = /^\s*\??\.\s*(?:toString|valueOf|href|trim|trimStart|trimEnd|toLowerCase|toUpperCase|normalize)\b/;
+var HOST_HEADER = /^\s*(?:\??\.\s*get\s*\(\s*['"]host['"]\s*\)|\??\.\s*host\b|\[\s*['"]host['"]\s*\]|\(\s*['"]host['"]\s*\))/i;
 var URL_INPUT_ACCESS = /\??\.\s*(?:searchParams|pathname|search|hash)\b/;
 var URL_INPUT_KEYS = /* @__PURE__ */ new Set(["searchParams", "pathname", "search", "hash"]);
 var URL_ORIGIN_ACCESS = /^\s*\??\.\s*(?:origin|host|hostname|protocol|port)\b/;
 var URL_ORIGIN_KEYS = /* @__PURE__ */ new Set(["origin", "host", "hostname", "protocol", "port"]);
+function closeOf(text, open) {
+  const pairs = { "(": ")", "[": "]", "{": "}" };
+  const stack = [];
+  for (let i = open; i < text.length; i++) {
+    const ch = text[i];
+    if (pairs[ch]) stack.push(pairs[ch]);
+    else if (ch === stack[stack.length - 1]) {
+      stack.pop();
+      if (stack.length === 0) return i;
+    }
+  }
+  return -1;
+}
+function callResultOf(expression) {
+  const text = expression.trim().replace(/\s+as\s+[\w$.<>[\]| ]+$/, "").replace(/^(?:(?:await|new)\s+)+/, "");
+  let i = 0;
+  let callee = null;
+  let members = false;
+  if (text[0] === "(") {
+    const close = closeOf(text, 0);
+    if (close === -1) return null;
+    const inner = callResultOf(text.slice(1, close));
+    if (!inner || inner.members) return null;
+    callee = inner.callee;
+    i = close + 1;
+  } else {
+    const head = /^[A-Za-z_$][\w$]*/.exec(text);
+    if (!head) return null;
+    i = head[0].length;
+  }
+  let last = callee === null ? text.slice(0, i) : callee;
+  while (i < text.length) {
+    const rest = text.slice(i);
+    const member = /^\s*(?:\??\.)\s*([A-Za-z_$][\w$]*)/.exec(rest);
+    if (member) {
+      last = member[1];
+      if (callee !== null) members = true;
+      i += member[0].length;
+      continue;
+    }
+    const open = /^\s*(?:\?\.)?\s*([([])/.exec(rest);
+    if (open) {
+      const at = i + open[0].length - 1;
+      const close = closeOf(text, at);
+      if (close === -1) return null;
+      if (open[1] === "(") {
+        callee = last;
+        members = false;
+      } else if (callee !== null) members = true;
+      i = close + 1;
+      continue;
+    }
+    if (/^\s*!/.test(rest) && !/^\s*!=/.test(rest)) {
+      i += rest.indexOf("!") + 1;
+      continue;
+    }
+    if (rest.trim() === "") break;
+    return null;
+  }
+  return callee === null ? null : { callee, members };
+}
 function isComparison(expr) {
   return !/\?/.test(expr) && !/=>/.test(expr) && /(?:===|!==|==|!=|<=|>=|\binstanceof\b)/.test(expr);
 }
@@ -5393,10 +6879,10 @@ function patternNames(pattern) {
   const stripped = text.replace(/[A-Za-z_$][\w$]*\s*:(?!:)/g, " ").replace(/=[^,}\]]*/g, " ");
   return stripped.match(/[A-Za-z_$][\w$]*/g) ?? [];
 }
-function paramRoles(paramsText, paramsStart, allInput) {
-  const roles = { objects: /* @__PURE__ */ new Map(), urls: /* @__PURE__ */ new Map(), cookies: /* @__PURE__ */ new Map(), values: /* @__PURE__ */ new Map() };
+function paramRoles(paramsText, paramsStart, allInput, context = false) {
+  const roles = { objects: /* @__PURE__ */ new Map(), urls: /* @__PURE__ */ new Map(), cookies: /* @__PURE__ */ new Map(), values: /* @__PURE__ */ new Map(), contexts: /* @__PURE__ */ new Map() };
   let offset = 0;
-  for (const raw of parameterList(paramsText)) {
+  for (const [index, raw] of parameterList(paramsText).entries()) {
     const at = paramsStart + Math.max(0, paramsText.indexOf(raw, offset));
     offset = Math.max(offset, paramsText.indexOf(raw, offset) + raw.length);
     const param = raw.startsWith("{") || raw.startsWith("[") ? raw.slice(0, matchingClose(raw) + 1) : raw.replace(/^\.\.\./, "").split(/[:=]/)[0].trim();
@@ -5404,6 +6890,10 @@ function paramRoles(paramsText, paramsStart, allInput) {
       for (const name of patternNames(param)) roles.values.set(name, at);
       continue;
     }
+    if (context && index === 0 && /^[A-Za-z_$][\w$]*$/.test(param)) {
+      roles.contexts.set(param, at);
+      continue;
+    }
     if (param.startsWith("{")) {
       for (const { key, local } of destructuredKeys(param)) {
         if (DESTRUCTURED_OBJECTS.has(key)) roles.objects.set(local, at);
@@ -5440,7 +6930,7 @@ function parametersOf(code, body, pairs, openers) {
   const single = /([A-Za-z_$][\w$]*)\s*$/.exec(window);
   return single ? { start: body.declaration - window.length + single.index, end: body.declaration - window.length + single.index + single[1].length } : null;
 }
-function expressionEnd(code, from, limit, pairs, truncated) {
+function expressionEnd2(code, from, limit, pairs, truncated) {
   const stop = Math.min(limit, from + MAX_EXPRESSION);
   for (let i = from; i < stop; i++) {
     const ch = code[i];
@@ -5507,6 +6997,7 @@ var InputFlow = class {
     this.fixedTables = fixedTables;
     for (const [name, at] of roles.values) this.parameters.set(name, { level: "direct", origin: at, names: /* @__PURE__ */ new Set([name]), ownUrl: false });
     this.sourcePattern = sourceRegex(roles);
+    this.contextRead = roles.contexts.size > 0 ? new RegExp(String.raw`(?<![\w$.])(?:${namePattern(roles.contexts.keys())})\s*\??\.\s*req(?:\s*\??\.\s*raw)?\s*\??\.\s*(${HONO_READ_CALLS})\s*\(`) : null;
     const assignments = this.assignments().sort((a, b) => a.at - b.at);
     const region = code.slice(span.start, span.end);
     const functions = this.localFunctions(region, assignments);
@@ -5520,7 +7011,7 @@ var InputFlow = class {
       const open = span.start + m.index + m[0].length - 1;
       let start = m[0] === "else" ? open + 1 : (pairs.get(open) ?? open) + 1;
       while (/\s/.test(code[start] ?? "")) start++;
-      controls.push({ start, end: pairs.get(start) ?? expressionEnd(code, start, span.end, pairs, () => {
+      controls.push({ start, end: pairs.get(start) ?? expressionEnd2(code, start, span.end, pairs, () => {
         this.limited = true;
       }) });
       if (controls.length >= MAX_ASSIGNMENTS) {
@@ -5552,9 +7043,11 @@ var InputFlow = class {
   limited = false;
   assignmentList = /* @__PURE__ */ new Map();
   sourcePattern;
+  contextRead;
   references = null;
   values = /* @__PURE__ */ new Map();
   strings = /* @__PURE__ */ new Map();
+  mirrors = /* @__PURE__ */ new Map();
   /** 只索引当前处理函数；未引用的具名闭包不影响外层值。 */
   localFunctions(region, assignments) {
     const offset = this.span.start;
@@ -5565,7 +7058,7 @@ var InputFlow = class {
     }));
     for (const m of region.matchAll(/=>\s*(?!\s*\{)/g)) {
       const start = offset + m.index + m[0].length;
-      const end = expressionEnd(this.code, start, this.span.end, this.pairs, () => {
+      const end = expressionEnd2(this.code, start, this.span.end, this.pairs, () => {
         this.limited = true;
       });
       bodies.push({ declaration: offset + m.index, start: start - 1, end });
@@ -5607,13 +7100,16 @@ var InputFlow = class {
       this.sourcePattern.lastIndex = 0;
       for (const m of observed.matchAll(this.sourcePattern)) {
         const after = observed.slice(m.index + m[0].length);
-        const ownUrl = m[1] === "url" || m[1] === "nextUrl";
+        const member = m.slice(1).find((group) => group !== void 0);
+        const ownUrl = member === "url" || member === "nextUrl";
         if (ownUrl && URL_ORIGIN_ACCESS.test(after)) continue;
+        const hostAt = exprAt + m.index + m[0].length;
+        const hostHeader = (member === "headers" || member === "header") && HOST_HEADER.test(this.source.slice(hostAt, hostAt + 80));
         found = mergeTaint(found, {
           level: "direct",
           origin: exprAt + m.index,
           names: /* @__PURE__ */ new Set(),
-          ownUrl: ownUrl && !URL_INPUT_ACCESS.test(after.slice(0, 40))
+          ownUrl: hostHeader || ownUrl && !URL_INPUT_ACCESS.test(after.slice(0, 40))
         });
       }
     }
@@ -5626,16 +7122,72 @@ var InputFlow = class {
         if (/^\s*:(?!:)/.test(after) && /[{,]$/.test(before)) continue;
         const t = this.valueOf(m[0], exprAt, depth);
         if (!t) continue;
+        if (t.opaque && /^\s*(?:\??\.\s*[\w$]|\?\.\s*\[|\[)/.test(after) && !VALUE_MEMBERS.test(after)) continue;
         if (t.ownUrl && URL_ORIGIN_ACCESS.test(after)) continue;
         found = mergeTaint(found, t.ownUrl && URL_INPUT_ACCESS.test(after.slice(0, 40)) ? { ...t, ownUrl: false } : t);
       }
     }
     if (!found) return null;
     if (found.ownUrl && URL_INPUT_ACCESS.test(text)) found.ownUrl = false;
-    const calls = [...text.replace(/\bJSON\s*\.\s*parse\s*\(/g, "(").matchAll(/([\w$]+)\s*\(/g)].map((m) => m[1]);
+    const read = this.contextRead ? text.replace(new RegExp(this.contextRead.source, "g"), (_whole, call2) => call2 === "valid" ? "parse(" : "json(") : text;
+    const calls = [...read.replace(/\bJSON\s*\.\s*parse\s*\(/g, "(").matchAll(/([\w$]+)\s*\(/g)].map((m) => m[1]);
     if (calls.some((name) => !TRANSPARENT_CALLS.has(name))) found.level = "derived";
+    const call = callResultOf(read);
+    if (call && !TRANSPARENT_CALLS.has(call.callee) && !MIRROR_CALLS.has(call.callee) && !this.returnsArgument(read, call.callee)) {
+      if (call.members) return null;
+      found.opaque = true;
+    }
     return found;
   }
+  /**
+   * 表达式直接调用同文件中定义的函数，且该函数在调用参数之外返回某个形参：return value、return { ...value }、
+   * (v) => v.trim()。return db.find(value) 之类把形参交给其他调用的不算，结果仍按未知函数处理。
+   */
+  returnsArgument(expression, callee) {
+    const escaped = callee.replace(/\$/g, "\\$");
+    if (!new RegExp(`^(?:(?:await|new)\\s+)*${escaped}\\s*\\(`).test(expression)) return false;
+    const cached = this.mirrors.get(callee);
+    if (cached !== void 0) return cached;
+    const code = this.code;
+    let params = "";
+    let after = -1;
+    const declared = new RegExp(`(?:^|[^\\w$.])(?:async\\s+)?function\\s*\\*?\\s*${escaped}\\s*\\(`).exec(code);
+    const assigned = declared ? null : new RegExp(`\\b(?:const|let|var)\\s+${escaped}\\s*(?::[^=;]{0,200})?=\\s*(?:async\\b\\s*)?(?:function\\b[^(]{0,80}\\(|\\(|([A-Za-z_$][\\w$]*)\\s*=>)`).exec(code);
+    const match = declared ?? assigned;
+    if (match && assigned?.[1]) {
+      params = assigned[1];
+      after = match.index + match[0].length;
+    } else if (match) {
+      const open = match.index + match[0].length - 1;
+      const close = this.pairs.get(open);
+      if (close !== void 0) {
+        params = code.slice(open + 1, close);
+        after = close + 1;
+      }
+    }
+    let result = false;
+    if (after !== -1) {
+      const names = params.split(",").flatMap((part) => part.replace(/[:=][\s\S]*$/, "").match(/[A-Za-z_$][\w$]*/g) ?? []);
+      const head = /^\s*(?::[^={]{0,200})?(?:=>)?\s*/.exec(code.slice(after, after + 260));
+      const start = after + head[0].length;
+      const end = (from, limit) => expressionEnd2(code, from, limit, this.pairs, () => {
+        this.limited = true;
+      });
+      const bodyEnd = this.pairs.get(start) ?? start;
+      const returns = code[start] === "{" ? [...code.slice(start, bodyEnd).matchAll(/\breturn\b/g)].map((m) => {
+        const from = start + m.index + m[0].length;
+        return code.slice(from, end(from, bodyEnd));
+      }) : [code.slice(start, end(start, code.length))];
+      const outsideCalls = (text) => {
+        let current = text.replace(/\.\.\./g, "   ");
+        for (let i = 0; i < 8 && /[\w$)\]]\s*\([^()]*\)/.test(current); i++) current = current.replace(/([\w$)\]])\s*\([^()]*\)/g, "$1");
+        return current;
+      };
+      result = names.length > 0 && returns.some((text) => names.some((name) => new RegExp(`(?<![\\w$.])${name.replace(/\$/g, "\\$")}(?![\\w$])`).test(outsideCalls(text))));
+    }
+    this.mirrors.set(callee, result);
+    return result;
+  }
   /** 字符串拼接：无标签模板的插值或含字符串操作数的 + 拼接中携带请求输入。 */
   builtOf(expr, exprAt, depth = 0) {
     if (expr.length > MAX_EXPRESSION) this.limited = true;
@@ -5687,6 +7239,7 @@ var InputFlow = class {
     for (const a of assignments) {
       const taint = this.builtOf(a.expr, a.exprAt, depth + 1) ?? this.taintOf(a.expr, a.exprAt, depth + 1);
       if (!taint) continue;
+      if (taint.opaque && (a.iterate || /^[{[]/.test(a.pattern.trim()))) continue;
       const own = this.targetsOf(a, taint).find(([target]) => target === name);
       if (own) found = mergeTaint(found, { ...taint, level: a.indirect ? "derived" : taint.level, ownUrl: own[1], names: /* @__PURE__ */ new Set([name, ...taint.names]) });
     }
@@ -5826,7 +7379,7 @@ ${part}`.slice(0, MAX_EXPRESSION);
         const forOf = /^\s+of\s+/.exec(rest);
         if (forOf) {
           const exprAt2 = patternEnd + forOf[0].length;
-          const end2 = expressionEnd(code, exprAt2, span.end, pairs, () => {
+          const end2 = expressionEnd2(code, exprAt2, span.end, pairs, () => {
             this.limited = true;
           });
           push({ at, pattern, names: patternNames(pattern), expr: code.slice(exprAt2, end2), exprAt: exprAt2, iterate: true, append: false, declaration: true });
@@ -5835,7 +7388,7 @@ ${part}`.slice(0, MAX_EXPRESSION);
         const eq = /^\s*(?::[^=;]{0,200}?)?=(?![=>])/.exec(rest);
         if (!eq) break;
         const exprAt = patternEnd + eq[0].length;
-        const end = expressionEnd(code, exprAt, span.end, pairs, () => {
+        const end = expressionEnd2(code, exprAt, span.end, pairs, () => {
           this.limited = true;
         });
         push({ at, pattern, names: patternNames(pattern), expr: code.slice(exprAt, end), exprAt, iterate: false, append: false, declaration: true });
@@ -5848,7 +7401,7 @@ ${part}`.slice(0, MAX_EXPRESSION);
       const before = region.slice(Math.max(0, m.index - 8), m.index);
       if (/\b(?:const|let|var)\s+$/.test(before)) continue;
       const exprAt = span.start + m.index + m[0].length;
-      const end = expressionEnd(code, exprAt, span.end, pairs, () => {
+      const end = expressionEnd2(code, exprAt, span.end, pairs, () => {
         this.limited = true;
       });
       push({ at: span.start + m.index, pattern: m[1], names: [m[1]], expr: code.slice(exprAt, end), exprAt, iterate: false, append: m[2] === "+=" });
@@ -5858,6 +7411,9 @@ ${part}`.slice(0, MAX_EXPRESSION);
 };
 function sourceRegex(roles) {
   const parts = [];
+  if (roles.contexts.size > 0) {
+    parts.push(String.raw`(?<![\w$.])(?:${namePattern(roles.contexts.keys())})\s*\??\.\s*req(?:\s*\??\.\s*raw)?\s*\??\.\s*(${HONO_MEMBERS})\b`);
+  }
   if (roles.objects.size > 0) {
     const objects = namePattern(roles.objects.keys());
     parts.push(
@@ -5875,7 +7431,8 @@ function sourceRegex(roles) {
   return parts.length === 0 ? null : new RegExp(parts.join("|"), "g");
 }
 function mergeTaint(found, t) {
-  if (!found) return { level: t.level, origin: t.origin, names: new Set(t.names), ownUrl: t.ownUrl };
+  if (!found) return { level: t.level, origin: t.origin, names: new Set(t.names), ownUrl: t.ownUrl, ...t.opaque ? { opaque: true } : {} };
+  if (found.opaque && !t.opaque) delete found.opaque;
   if (t.level === "derived") found.level = "derived";
   if (found.ownUrl && !t.ownUrl) {
     found.ownUrl = false;
@@ -5885,7 +7442,7 @@ function mergeTaint(found, t) {
   return found;
 }
 function hasInput(roles) {
-  return roles.objects.size + roles.urls.size + roles.cookies.size + roles.values.size > 0;
+  return roles.objects.size + roles.urls.size + roles.cookies.size + roles.values.size + roles.contexts.size > 0;
 }
 function lowerBound(values, value) {
   let low = 0, high = values.length;
@@ -5935,20 +7492,25 @@ var HandlerFile = class {
   }
 };
 var handlerCache = /* @__PURE__ */ new WeakMap();
-function handlerFileOf(file) {
+function handlerFileOf(file, files) {
   const cached = handlerCache.get(file);
   if (cached !== void 0) return cached;
   let result = null;
   if (/\.[mc]?[jt]sx?$/.test(file.path)) {
-    const route = routeOf(file);
-    const routes = route === null ? serverActionRoutes(file) : [route];
+    const routes = serverRoutesOf(file, files);
     if (routes.length > 0) {
       const code = noiseMaskedOf(file);
       const source = commentsMaskedOf(file);
       const pairs = delimiterPairs(code);
       const openers = /* @__PURE__ */ new Map();
       for (const [open, close] of pairs) openers.set(close, open);
-      const bodies = functionBodies(code, pairs).sort((a, b) => a.start - b.start);
+      const bodies = functionBodies(code, pairs);
+      for (const r of routes) {
+        if (NODE_FRAMEWORKS.has(r.framework) && r.reachable && code.startsWith("=>", r.reachable.start)) {
+          bodies.push({ declaration: r.reachable.start, start: r.reachable.start, end: r.reachable.end });
+        }
+      }
+      bodies.sort((a, b) => a.start - b.start);
       const starts = bodies.map((body) => body.start);
       const candidates = [];
       for (const r of routes) {
@@ -5961,7 +7523,8 @@ function handlerFileOf(file) {
           const action = r.action !== void 0 && reachable !== void 0 && body.start === reachable.start;
           const params = parametersOf(code, body, pairs, openers);
           if (!params) continue;
-          const roles = paramRoles(source.slice(params.start, params.end), params.start, action);
+          const context = r.framework === "hono" && reachable !== void 0 && body.start === reachable.start;
+          const roles = paramRoles(source.slice(params.start, params.end), params.start, action, context);
           if (hasInput(roles)) candidates.push({ route: r, body, roles });
         }
       }
@@ -5974,7 +7537,7 @@ function handlerFileOf(file) {
 function reportInputLimit(ctx, file, analysed) {
   if (analysed.limited) ctx.reportIncomplete(
     "request-input/tracking",
-    `${file.path} reached the request-input tracking limit (8 value hops, 512 assignments or control/function regions, 4000 expression characters, or bounded URL analysis)`
+    `${file.path} reached the request-input tracking limit (8 value hops, 512 assignments or control/function regions, 64 KiB expressions, or bounded URL analysis)`
   );
 }
 
@@ -6146,7 +7709,7 @@ var injectionRule = {
   check(ctx) {
     const findings = [];
     for (const file of ctx.files) {
-      const analysed = handlerFileOf(file);
+      const analysed = handlerFileOf(file, ctx.files);
       if (!analysed) continue;
       const { code, source, pairs, lineStarts } = analysed;
       const sinks = sinksIn(code, pairs, commandCallees(file));
@@ -6181,7 +7744,7 @@ var injectionRule = {
 // src/rules/outbound.ts
 var FETCH_CALL = /(?<![\w$.])(?:fetch|\$fetch|ofetch|axios|got|ky|needle)\s*(?:<[^()]{0,200}>\s*)?\(/g;
 var FETCH_METHOD = /(?<![\w$.])(?:axios|got|ky|needle|http|https|undici)\s*\.\s*(?:get|post|put|patch|delete|head|request|stream)\s*(?:<[^()]{0,200}>\s*)?\(/g;
-var REDIRECT_CALL = /(?<![\w$.])(?:redirect|permanentRedirect|sendRedirect)\s*\(|(?<![\w$.])(?:NextResponse|Response|res|reply|response|ctx|context|Astro)\s*\.\s*redirect\s*\(/g;
+var REDIRECT_CALL = /(?<![\w$.])(?:redirect|permanentRedirect|sendRedirect)\s*\(|(?<![\w$.])(?:NextResponse|Response|res|reply|response|ctx|context|c|Astro)\s*\.\s*redirect\s*\(/g;
 function callsIn(code, pairs) {
   const calls = [];
   const add = (regex, kind) => {
@@ -6199,6 +7762,8 @@ function callsIn(code, pairs) {
 }
 var HOST_OPEN = /^(?:X?|[a-z][\w+.-]*:\/\/[^/?#\\]*)$/i;
 var REDIRECT_OPEN = /^(?:\/|[/\\]{2}[^/?#\\]*)$/;
+var HOST_OPENABLE = /^(?:X?|[a-z][\w+.-]*(?::(?:\/(?:\/[^/?#\\]*)?)?)?)$/i;
+var REDIRECT_OPENABLE = /^(?:[/\\](?:[/\\][^/?#\\]*)?)?$/;
 function controlsStart(expr, at, flow, source, kind, depth = 0) {
   const lead = expr.length - expr.trimStart().length;
   const text = expr.trim();
@@ -6208,11 +7773,19 @@ function controlsStart(expr, at, flow, source, kind, depth = 0) {
     flow.limited = true;
     return null;
   }
-  if (text.length > 4e3) {
+  if (text.length > MAX_EXPRESSION) {
     flow.limited = true;
     return null;
   }
   const open = (prefix) => HOST_OPEN.test(prefix) || kind === "redirect" && REDIRECT_OPEN.test(prefix);
+  const branches = alternativesOf(text);
+  if (branches) {
+    for (const branch of branches) {
+      const t2 = controlsStart(branch.text, start + branch.at, flow, source, kind, depth + 1);
+      if (t2) return t2;
+    }
+    return null;
+  }
   const url = /^new\s+URL\s*\(/.exec(text);
   if (url) {
     const argsStart = start + url[0].length;
@@ -6223,9 +7796,10 @@ function controlsStart(expr, at, flow, source, kind, depth = 0) {
       return first === void 0 ? null : controlsStart(first, argsStart, flow, source, "redirect", depth + 1);
     }
   }
-  if (text.startsWith("`")) return templateStart(text, start, flow, source, open);
-  const operands = flow.operandsOf(text, start);
-  if (operands.length > 1) {
+  if (text.startsWith("`")) return templateStart(text, start, flow, source, open, kind, depth);
+  const joined = joinedElements(text, start);
+  const operands = joined ?? flow.operandsOf(text, start);
+  if (operands.length > 1 || joined && operands.length > 0) {
     let prefix = "";
     for (const operand of operands) {
       const inner = operand.text.trim();
@@ -6233,7 +7807,7 @@ function controlsStart(expr, at, flow, source, kind, depth = 0) {
         prefix += source.slice(operand.at + operand.text.indexOf(inner) + 1, operand.at + operand.text.indexOf(inner) + inner.length - 1);
         continue;
       }
-      const t2 = inner.startsWith("`") ? templateStart(inner, operand.at + operand.text.indexOf(inner), flow, source, open) : controlsStart(inner, operand.at + operand.text.indexOf(inner), flow, source, kind, depth + 1);
+      const t2 = inner.startsWith("`") ? templateStart(inner, operand.at + operand.text.indexOf(inner), flow, source, open, kind, depth) : controlsStart(inner, operand.at + operand.text.indexOf(inner), flow, source, kind, depth + 1);
       if (t2) return open(prefix) ? t2 : null;
       prefix += "X";
       if (!open(prefix)) return null;
@@ -6247,6 +7821,11 @@ function controlsStart(expr, at, flow, source, kind, depth = 0) {
       return t2 && !t2.ownUrl ? t2 : null;
     }
     for (const a of assignments) {
+      if (a.iterate || /^[{[]/.test(a.pattern.trim())) {
+        const t3 = flow.valueOf(text, at);
+        if (t3 && !t3.ownUrl) return t3;
+        continue;
+      }
       const t2 = controlsStart(a.expr, a.exprAt, flow, source, kind, depth + 1);
       if (t2) return { ...t2, level: a.indirect ? "derived" : t2.level, names: /* @__PURE__ */ new Set([...t2.names, text]) };
     }
@@ -6255,7 +7834,42 @@ function controlsStart(expr, at, flow, source, kind, depth = 0) {
   const t = flow.taintOf(text, start);
   return t && !t.ownUrl ? t : null;
 }
-function templateStart(text, start, flow, source, open) {
+function alternativesOf(text) {
+  const top = [];
+  let depth = 0;
+  for (let i = 0; i < text.length; i++) {
+    const ch = text[i];
+    if ("([{".includes(ch)) depth++;
+    else if (")]}".includes(ch)) depth--;
+    else if (depth === 0) top.push(i);
+  }
+  const at = (i) => top.includes(i) ? text[i] : "";
+  for (const i of top) {
+    if (text[i] !== "?" || text[i + 1] === "." || text[i + 1] === "?" || text[i - 1] === "?") continue;
+    let nested = 0;
+    for (const j of top) {
+      if (j <= i) continue;
+      if (text[j] === "?" && text[j + 1] !== "." && text[j + 1] !== "?" && text[j - 1] !== "?") nested++;
+      else if (text[j] === ":" && nested-- === 0) {
+        return [{ text: text.slice(i + 1, j), at: i + 1 }, { text: text.slice(j + 1), at: j + 1 }];
+      }
+    }
+    return null;
+  }
+  const parts = [];
+  let from = 0;
+  for (const i of top) {
+    const pair = at(i) + at(i + 1);
+    if ((pair === "??" || pair === "||") && i >= from) {
+      parts.push({ text: text.slice(from, i), at: from });
+      from = i + 2;
+    }
+  }
+  if (parts.length === 0) return null;
+  parts.push({ text: text.slice(from), at: from });
+  return parts;
+}
+function templateStart(text, start, flow, source, open, kind, depth) {
   let prefix = "";
   for (let i = 1; i < text.length; i++) {
     if (text[i] === "`") return null;
@@ -6263,12 +7877,16 @@ function templateStart(text, start, flow, source, open) {
       const close = matchingBrace(text, i + 1);
       if (close === null) return null;
       const t = flow.taintOf(text.slice(i + 2, close), start + i + 2);
-      if (t && !t.ownUrl) return open(prefix) ? t : null;
+      if (t && !t.ownUrl) {
+        if (!open(prefix)) return null;
+        return prefix === "" ? controlsStart(text.slice(i + 2, close), start + i + 2, flow, source, kind, depth + 1) : t;
+      }
       prefix += "X";
       i = close;
       continue;
     }
     prefix += source[start + i];
+    if (!HOST_OPENABLE.test(prefix) && !(kind === "redirect" && REDIRECT_OPENABLE.test(prefix))) return null;
     if (prefix.length > 200) {
       flow.limited = true;
       return null;
@@ -6292,6 +7910,30 @@ function matchingBrace(text, open) {
   }
   return null;
 }
+function joinedElements(text, start) {
+  if (!text.startsWith("[")) return null;
+  let depth = 0, close = -1;
+  for (let i = 0; i < text.length; i++) {
+    if ("([{".includes(text[i])) depth++;
+    else if (")]}".includes(text[i]) && --depth === 0) {
+      close = i;
+      break;
+    }
+  }
+  if (close === -1 || text[close] !== "]" || !/^\s*\.\s*join\s*\(\s*(['"\x60])\1\s*\)\s*$/.test(text.slice(close + 1))) return null;
+  const elements = [];
+  let from = 1;
+  depth = 0;
+  for (let i = 1; i <= close; i++) {
+    if (i < close && "([{".includes(text[i])) depth++;
+    else if (i < close && ")]}".includes(text[i])) depth--;
+    else if (i === close || text[i] === "," && depth === 0) {
+      if (text.slice(from, i).trim() !== "") elements.push({ text: text.slice(from, i), at: start + from });
+      from = i + 1;
+    }
+  }
+  return elements;
+}
 function splitTopLevel(text) {
   const parts = [];
   let depth = 0, from = 0;
@@ -6380,13 +8022,14 @@ function redirectFinding(route, file, line, originLine, certain) {
 function check(ctx, kind) {
   const findings = [];
   for (const file of ctx.files) {
-    const analysed = handlerFileOf(file);
+    const analysed = handlerFileOf(file, ctx.files);
     if (!analysed) continue;
     const calls = callsIn(analysed.code, analysed.pairs).filter((call) => call.kind === kind).sort((a, b) => a.at - b.at);
     if (calls.length === 0) continue;
     const positions = calls.map((call) => call.at);
     const reported = /* @__PURE__ */ new Set();
     for (const { route, body, flow } of analysed.handlersAround(positions)) {
+      if (kind === "redirect" && route.action !== void 0) continue;
       for (let i = lowerBound(positions, body.start + 1); i < calls.length && calls[i].at < body.end; i++) {
         const call = calls[i];
         if (call.close >= body.end || reported.has(call.at)) continue;
@@ -6589,18 +8232,19 @@ var SERVER_PATH = [
   /\.server\.[mc]?[jt]s$/,
   /(?:^|\/)server\/.+\.[mc]?[jt]s$/
 ];
-function isServerFile(file) {
+function isServerFile(file, files) {
   if (!/\.[mc]?[jt]sx?$/.test(file.path)) return false;
   if (/^\s*(?:(?:'use strict'|"use strict");?\s*)?['"]use client['"]/.test(commentsMaskedOf(file))) return false;
-  return SERVER_PATH.some((pattern) => pattern.test(file.path)) || routeOf(file) !== null || serverActionRoutes(file).length > 0;
+  return SERVER_PATH.some((pattern) => pattern.test(file.path)) || serverRoutesOf(file, files).length > 0;
 }
 var sessionRule = {
   id: "auth/unverified-session",
   severity: "P1",
   appliesTo(file) {
-    return file.content.includes("getSession") && isServerFile(file);
+    return file.content.includes("getSession");
   },
-  check(file) {
+  check(file, ctx) {
+    if (!isServerFile(file, ctx.files)) return [];
     const code = noiseMaskedOf(file);
     const context = new LocalVerification(file);
     const { pairs, bodies } = context;
@@ -6657,7 +8301,7 @@ var STRIPE_EVENT = /(?:\bcase\s*|\.type\s*[!=]==?\s*)['"`]((?:checkout\.session|
 function verifiedEvent(context, name, at) {
   const assignment = context.assignment(name, at);
   if (!assignment || assignment.member || !context.enforcedBefore(assignment.at, at)) return false;
-  const call = /^(?:(await)\s+)?[\w$.]+\.(constructEvent(?:Async)?|retrieve|parseEventNotification)\s*\(/.exec(assignment.expression);
+  const call = /^(?:(await)\s+)?(?:[\w$]+(?:\s*\([^()]*\))?\s*\??\.\s*)+(constructEvent(?:Async)?|retrieve|parseEventNotification)\s*\(/.exec(assignment.expression);
   if (!call || call[2] !== "constructEvent" && !call[1]) return false;
   if (call[2] === "retrieve" && !/\.events\s*\.\s*retrieve/.test(call[0])) return false;
   const close = context.pairs.get(assignment.from + call[0].length - 1);
@@ -6673,22 +8317,71 @@ function eventName(context, event) {
   }
   return name;
 }
-var READS_BODY = /\.\s*(?:json|text|arrayBuffer|formData)\s*\(|\breq(?:uest)?\s*\.\s*body\b|\b(?:readBody|readRawBody)\s*\(|\bbuffer\s*\(\s*req\b/;
+var READS_BODY = /(?<![\w$])(?:req|request)\s*(?:\.\s*raw\s*)?\.\s*(?:json|text|arrayBuffer|formData|parseBody)\s*\(|\breq(?:uest)?\s*\.\s*body\b|\b(?:readBody|readRawBody)\s*\(|\bbuffer\s*\(\s*req\b/;
+var SIGNATURE_HEADER = /['"]stripe-signature['"]/i;
+function middlewareVerifies(code) {
+  const masked = maskUnusedFunctions(code);
+  const verifies = /\bconstructEvent\s*\(/.test(masked) || awaitedCall(masked, /\bconstructEventAsync\s*\(/);
+  if (!verifies) return false;
+  for (const m of masked.matchAll(/\bcatch\s*(?:\([^()]*\))?\s*\{/g)) {
+    const open = m.index + m[0].length - 1;
+    let close = open;
+    for (let depth = 0; close < masked.length; close++) {
+      if (masked[close] === "{") depth++;
+      else if (masked[close] === "}" && --depth === 0) break;
+    }
+    const body = masked.slice(open, close);
+    if (/\bnext\s*\(\s*\)/.test(body)) return false;
+  }
+  return true;
+}
+function verifiedByMiddleware(route, files) {
+  if (!NODE_FRAMEWORKS.has(route.framework)) return null;
+  const codeOf = (ref) => {
+    const { inline, range } = middlewareDefinition(ref, files);
+    const target = inline ?? range;
+    return target === null ? null : { file: target.file, code: commentsMaskedOf(target.file).slice(target.start, target.end + 1) };
+  };
+  const verifies = ({ file, code }) => {
+    if (middlewareVerifies(code)) return true;
+    const masked = maskUnusedFunctions(code);
+    const calls = [...masked.matchAll(/(?<![\w$.])([A-Za-z_$][\w$]*)\s*(?:\.\s*([A-Za-z_$][\w$]*)\s*)?\(/g)].slice(0, 16);
+    return calls.some((m) => {
+      const definition = calleeDefinition(file, m[1], m[2] ?? null, files);
+      return definition !== null && middlewareVerifies(commentsMaskedOf(definition.file).slice(definition.start, definition.end + 1));
+    });
+  };
+  const status = (test) => {
+    const check2 = (ref) => {
+      const target = codeOf(ref);
+      return target !== null && test(target);
+    };
+    const mounts = route.mounts ?? [];
+    return (route.middleware ?? []).some(check2) || mounts.length > 0 && mounts.every((refs) => refs.some(check2));
+  };
+  if (status(verifies)) return "verified";
+  return status(({ code }) => SIGNATURE_HEADER.test(code)) ? "custom" : null;
+}
 var webhookRule = {
   id: "webhook/unverified-signature",
   severity: "P1",
   appliesTo(file) {
-    return /stripe/i.test(file.content) && routeOf(file) !== null;
+    return /stripe/i.test(file.content);
   },
-  check(file) {
-    const route = routeOf(file);
-    if (!route) return [];
+  check(file, ctx) {
+    const routes = serverRoutesOf(file, ctx.files);
+    if (routes.length === 0) return [];
+    const routeAt = (at) => routes.find((r) => !r.reachable || r.reachable.start <= at && at <= r.reachable.end);
     const context = new LocalVerification(file);
     const { source, code } = context;
     const findings = [];
     const reported = /* @__PURE__ */ new Set();
     for (const event of source.matchAll(new RegExp(STRIPE_EVENT.source, "g"))) {
       if (code[event.index] !== source[event.index]) continue;
+      const route = routeAt(event.index);
+      if (!route) continue;
+      const middleware = verifiedByMiddleware(route, ctx.files);
+      if (middleware === "verified") continue;
       const owner = context.owner(event.index);
       const name = eventName(context, event);
       if (name && verifiedEvent(context, name, event.index)) continue;
@@ -6698,7 +8391,7 @@ var webhookRule = {
       const line = lineNumberAt(lineStartsOf(file.content), event.index);
       const region = code.slice(owner?.start ?? 0, owner?.end ?? code.length);
       const readsBody = READS_BODY.test(region);
-      const customCheck = /\bverifyHeader\s*\(/.test(region) || /\bcreateHmac\s*\(/.test(region) && /\btimingSafeEqual\s*\(/.test(region);
+      const customCheck = middleware === "custom" || /\bverifyHeader\s*\(/.test(region) || /\bcreateHmac\s*\(/.test(region) && /\btimingSafeEqual\s*\(/.test(region);
       findings.push({
         ruleId: "webhook/unverified-signature",
         severity: "P1",
@@ -8247,16 +9940,16 @@ var RULE_CATALOG = [
     "Admin database access without a recognized auth guard",
     "P0",
     "certain",
-    "Server routes and Next.js Server Functions in Next.js, SvelteKit (endpoints and form actions), Nuxt, Remix/React Router, and Astro, including workspace applications.",
-    "Syntactic guards only; runtime authentication and business authorization are not verified. Local calls, identity arguments, branches and exception paths are analysed within documented limits. Local auth evidence, SvelteKit hooks and Nuxt middleware may lower confidence without removing findings; exceeded limits disclose incomplete coverage."
+    "Server routes and Next.js Server Functions in Next.js, SvelteKit (endpoints and form actions), Nuxt, Remix/React Router, Astro, Express, Hono, and Fastify, including workspace applications.",
+    "Syntactic guards only; runtime authentication and business authorization are not verified. Local calls, identity arguments, branches and exception paths are analysed within documented limits. Express, Hono, and Fastify middleware and hooks remove findings only when they resolve to code that rejects unauthenticated requests or to a known auth library; auth-like middleware that cannot be followed, local auth evidence, SvelteKit hooks and Nuxt middleware may lower confidence without removing findings; exceeded limits disclose incomplete coverage."
   ),
   rule(
     "api/db-write-without-auth",
     "Database write without a recognized auth guard",
     "P1",
     "likely",
-    "Server routes and Next.js Server Functions in Next.js, SvelteKit (endpoints and form actions), Nuxt, Remix/React Router, and Astro.",
-    "Session-scoped clients and indirect guards may need manual review."
+    "Server routes and Next.js Server Functions in Next.js, SvelteKit (endpoints and form actions), Nuxt, Remix/React Router, Astro, Express, Hono, and Fastify.",
+    "Session-scoped clients and indirect guards may need manual review. In Express, Hono, and Fastify routes, writes in called project functions are followed two levels deep; file-based routes report writes in the route file only. Hono app.openapi() routes are not analysed."
   ),
   rule(
     "auth/unverified-session",
@@ -8557,7 +10250,7 @@ function openReport(path, onError, options = {}) {
 }
 
 // src/cli.ts
-var VERSION = true ? "0.6.0" : "0.0.0-dev";
+var VERSION = true ? "0.7.0" : "0.0.0-dev";
 function finish(code) {
   process.exitCode = code;
 }