canship 0.7.0 → 0.8.0-rc.1

package/dist/index.js

@@ -1,5 +1,8 @@
 #!/usr/bin/env node
 
+// <define:__CANSHIP_BUILD_INFO__>
+var define_CANSHIP_BUILD_INFO_default = { version: "0.8.0-rc.1", channel: "prerelease", revision: "c290998ae023d55a646c757ab181302ab73cee77", dirty: false };
+
 // src/index.ts
 import { statSync as statSync3 } from "fs";
 import { resolve as resolve2 } from "path";
@@ -749,7 +752,7 @@ function listViaGit(root, gitExecutable) {
     return null;
   }
 }
-function walkTree(root, skipped, wantAll, maxEntries) {
+function walkTree(root, skipped, wantAll, maxEntries, excludePath) {
   const all = [];
   const found = [];
   let visited = 0;
@@ -793,9 +796,10 @@ function walkTree(root, skipped, wantAll, maxEntries) {
         visited++;
         const full = join2(dir, entry.name);
         const rel = relative2(root, full).split(sep2).join("/");
-        let metadata;
+        if (excludePath?.(rel)) continue;
+        let metadata2;
         try {
-          metadata = lstatSync2(full);
+          metadata2 = lstatSync2(full);
         } catch (err) {
           if (!isMissing(err)) skipped.push({
             path: rel,
@@ -804,18 +808,18 @@ function walkTree(root, skipped, wantAll, maxEntries) {
           });
           continue;
         }
-        if (metadata.isSymbolicLink()) {
+        if (metadata2.isSymbolicLink()) {
           if (!SKIP_DIRS.has(entry.name)) {
             skipped.push({ path: rel, reason: "symlink", detail: "symbolic links are not followed" });
           }
           continue;
         }
-        if (metadata.isDirectory()) {
+        if (metadata2.isDirectory()) {
           if (SKIP_DIRS.has(entry.name)) continue;
           walk(full, depth + 1);
           continue;
         }
-        if (!metadata.isFile()) continue;
+        if (!metadata2.isFile()) continue;
         if (wantAll) all.push(rel);
         if (isCredentialName(entry.name) || isWorthProbing(rel)) found.push(rel);
       }
@@ -902,16 +906,17 @@ function readablePath(root, path, skipped) {
   }
   return true;
 }
-function collectFiles(root, isGitRepo, gitExecutable = resolveGitExecutable(root), limits = {}, honorIgnoreMarkers = true) {
+function collectFiles(root, isGitRepo, gitExecutable = resolveGitExecutable(root), limits = {}, honorIgnoreMarkers = true, excludePath) {
   root = realpathSync2(root);
   const skipped = [];
   const ignored = [];
   const fromGit = isGitRepo ? listViaGit(root, gitExecutable) : null;
-  const walked = walkTree(root, skipped, fromGit === null, limits.maxEntries ?? MAX_WALK_ENTRIES);
+  const walked = walkTree(root, skipped, fromGit === null, limits.maxEntries ?? MAX_WALK_ENTRIES, excludePath);
   const listed = fromGit?.files ?? walked.all;
   const candidates = /* @__PURE__ */ new Set();
   let vendored = 0;
   for (const path of fromGit?.nestedRepositories ?? []) {
+    if (excludePath?.(path)) continue;
     if (isVendored(path)) {
       vendored++;
       continue;
@@ -923,11 +928,13 @@ function collectFiles(root, isGitRepo, gitExecutable = resolveGitExecutable(root
     });
   }
   for (const path of listed) {
+    if (excludePath?.(path)) continue;
     if (isVendored(path)) vendored++;
     else candidates.add(path);
   }
   const forced = /* @__PURE__ */ new Set();
   for (const hidden of walked.forced) {
+    if (excludePath?.(hidden)) continue;
     candidates.add(hidden);
     forced.add(hidden);
   }
@@ -1870,7 +1877,7 @@ function gitOrThrow(root, gitExecutable, args) {
   return out;
 }
 function repoPrefix(root, gitExecutable) {
-  return (git(root, gitExecutable, ["rev-parse", "--show-prefix"]) ?? "").trim();
+  return gitOrThrow(root, gitExecutable, ["rev-parse", "--show-prefix"]).trim();
 }
 function trackedEnvFiles(root, gitExecutable) {
   const out = gitOrThrow(root, gitExecutable, ["ls-files", "-z"]);
@@ -1979,6 +1986,7 @@ var gitleakRule = {
     const remoteNote = remote ? `This repository has a remote configured, so these commits have most likely been pushed. Bots scrape public commits within minutes \u2014 assume every key in this file is already in someone else's hands.` : `This repository has no remote yet, so the damage may still be contained. Fix it before you push.`;
     const reportedTracked = /* @__PURE__ */ new Set();
     for (const path of tracked) {
+      if (ctx.excludePath?.(path)) continue;
       const scanned = ctx.files.find((f) => f.path === path);
       const evidence = scanned ? evidenceIn(scanned.lines) : "hint";
       if (evidence === "none") continue;
@@ -2009,6 +2017,7 @@ var gitleakRule = {
     for (const entry of historical) {
       if (reportedTracked.has(entry.localPath)) continue;
       const path = entry.localPath;
+      if (ctx.excludePath?.(path)) continue;
       const stillTracked = tracked.has(entry.localPath);
       const history = historicalEvidence(ctx.root, ctx.gitExecutable, entry);
       if (history && history.unread > 0) {
@@ -3092,7 +3101,7 @@ var firebaseRulesRule = {
 };
 
 // src/rules/apiauth.ts
-import { posix } from "path";
+import { posix as posix2 } from "path";
 
 // src/rules/bindings.ts
 var cache = /* @__PURE__ */ new WeakMap();
@@ -3180,9 +3189,32 @@ function synchronousLocal(file, expr) {
   const code = noiseMaskedOf(file);
   const escaped = name.replace(/\$/g, "\\$");
   const declared = new RegExp(`(?:^|[^\\w$])(async\\s+)?function\\s*\\*?\\s*${escaped}\\s*\\(`).exec(code);
-  if (declared) return !declared[1];
+  if (declared?.[1]) return false;
   const assigned = new RegExp(`\\b(?:const|let|var)\\s+${escaped}\\s*(?::[^=;]{0,200})?=\\s*(async\\b)?\\s*(?:function\\b|\\([^()]*\\)\\s*(?::[^=;{]{0,200})?=>|[A-Za-z_$][\\w$]*\\s*=>)`).exec(code);
-  return assigned !== null && !assigned[1];
+  if (!declared && (!assigned || assigned[1])) return false;
+  const declaration = declared ?? assigned;
+  const pairedEnd = (open, left, right) => {
+    let depth = 0;
+    for (let i = open; i < Math.min(code.length, open + 65536); i++) {
+      if (code[i] === left) depth++;
+      else if (code[i] === right && --depth === 0) return i;
+    }
+    return -1;
+  };
+  let start = declaration.index + declaration[0].length;
+  if (declared) start = pairedEnd(start - 1, "(", ")") + 1;
+  else if (/function\b$/.test(declaration[0])) {
+    const open = code.indexOf("(", start);
+    start = open < 0 ? 0 : pairedEnd(open, "(", ")") + 1;
+  }
+  if (start === 0) return false;
+  start += /^\s*(?::[\w\s.<>,[\]|?]+)?\s*/.exec(code.slice(start))[0].length;
+  const close = code[start] === "{" ? pairedEnd(start, "{", "}") : -1;
+  if (code[start] === "{" && close < 0) return false;
+  const body = close >= 0 ? code.slice(start, close + 1) : `return ${code.slice(start).split(/[;\n]/)[0] ?? ""}`;
+  if (/\b(?:Promise|then|await|new|function|async)\b|=>|\.\.\./.test(body)) return false;
+  if ([...body.matchAll(/([\w$]+)\s*\(/g)].some((m) => !/^(?:if|switch)$/.test(m[1]))) return false;
+  return /\breturn\s+(?:null|false|true|\{|[\w$]+\s*\?)/.test(body);
 }
 var limited = /* @__PURE__ */ new WeakSet();
 var cache2 = /* @__PURE__ */ new WeakMap();
@@ -3441,12 +3473,364 @@ function identityRequirement(value, allowParameters) {
   return null;
 }
 
+// src/rules/routers.ts
+import { createHash as createHash2 } from "crypto";
+
+// src/rules/factory-modules.ts
+import { posix } from "path";
+var unknown = (limited2 = false) => ({ handled: true, file: null, ...limited2 ? { limited: true } : {} });
+var object = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var safePath = (path) => Boolean(path) && path.length <= 512 && !/[\\\u0000-\u0020:%?#]/.test(path) && !posix.isAbsolute(path);
+var contained = (path) => path !== ".." && !path.startsWith("../") && !posix.isAbsolute(path);
+function metadata(file) {
+  if (file.content.length > 65536) return null;
+  let source = commentsMaskedOf(file);
+  const code = noiseMaskedOf(file);
+  const commas = [...code.matchAll(/,\s*[}\]]/g)].map((match) => match.index);
+  if (commas.length) {
+    const characters = source.split("");
+    for (const at of commas) characters[at] = " ";
+    source = characters.join("");
+  }
+  try {
+    const value = JSON.parse(source);
+    return object(value) ? value : null;
+  } catch {
+    return null;
+  }
+}
+function exportTarget(value, limit, depth = 0) {
+  if (depth >= 8) {
+    limit();
+    return null;
+  }
+  if (typeof value === "string") return value.startsWith("./") && safePath(value) && !value.includes("*") && value.split("/").slice(1).every((part) => part !== "." && part !== ".." && part !== "node_modules") ? value : null;
+  if (!object(value)) return null;
+  if (Object.keys(value).length > 32) {
+    limit();
+    return null;
+  }
+  const entries = Object.entries(value).filter(([key]) => key !== "types" && !key.startsWith("types@"));
+  if (!entries.length || entries.some(([key]) => key.startsWith("."))) return null;
+  const targets = entries.map(([, item]) => exportTarget(item, limit, depth + 1));
+  return targets.every((target) => target !== null && target === targets[0]) ? targets[0] : null;
+}
+function factoryModuleResolver(files) {
+  const byPath = new Map(files.map((file) => [file.path, file]));
+  const parsed = /* @__PURE__ */ new Map();
+  let metadataLimited = false;
+  const json = (file) => {
+    if (file.content.length > 65536) {
+      metadataLimited = true;
+      return null;
+    }
+    if (!parsed.has(file)) parsed.set(file, metadata(file));
+    return parsed.get(file);
+  };
+  const parents = (file) => {
+    const found = [];
+    for (let dir = posix.dirname(file.path); ; dir = posix.dirname(dir)) {
+      found.push(dir);
+      if (dir === "." || posix.dirname(dir) === dir) break;
+    }
+    return found;
+  };
+  const nearest = (file, names) => {
+    for (const dir of parents(file)) for (const name of names) {
+      const found = byPath.get(posix.join(dir, name));
+      if (found) return found;
+    }
+    return void 0;
+  };
+  const sourceAt = (path, from) => {
+    if (!contained(path)) return null;
+    const relative3 = posix.relative(posix.dirname(from.path), path);
+    return bindingModule(relative3.startsWith(".") ? relative3 : "./" + relative3, from, files, "");
+  };
+  const configPath = (spec, from) => {
+    const config = nearest(from, ["tsconfig.json", "jsconfig.json"]);
+    if (!config) return null;
+    if (config.content.length > 65536) return unknown(true);
+    const data = json(config);
+    if (!data || "extends" in data || "references" in data) return unknown();
+    const options = data.compilerOptions;
+    if (options === void 0) return null;
+    if (!object(options)) return unknown();
+    if (options.paths === void 0) return null;
+    if (!object(options.paths)) return unknown();
+    if (Object.keys(options.paths).length > 128) return unknown(true);
+    const matches = [];
+    for (const [pattern, target2] of Object.entries(options.paths)) {
+      if (pattern.length > 512) return unknown(true);
+      if (pattern.split("*").length > 2) return unknown();
+      const [prefix, suffix = ""] = pattern.split("*");
+      const exact = !pattern.includes("*");
+      if (exact ? pattern !== spec : !spec.startsWith(prefix) || !spec.endsWith(suffix) || spec.length < prefix.length + suffix.length) continue;
+      matches.push({ target: target2, prefix, suffix, exact, middle: exact ? "" : spec.slice(prefix.length, spec.length - suffix.length) });
+    }
+    if (!matches.length) return null;
+    matches.sort((a, b) => Number(b.exact) - Number(a.exact) || b.prefix.length - a.prefix.length);
+    const selected = matches[0];
+    if (matches[1] && matches[1].exact === selected.exact && matches[1].prefix.length === selected.prefix.length) return unknown();
+    if (!Array.isArray(selected.target) || selected.target.length !== 1 || typeof selected.target[0] !== "string") return unknown();
+    const target = selected.target[0];
+    if (!safePath(target) || target.split("*").length > 2 || selected.exact && target.includes("*")) return unknown();
+    const base = options.baseUrl ?? ".";
+    if (typeof base !== "string" || !safePath(base) || base.includes("*")) return unknown();
+    const path = posix.normalize(posix.join(posix.dirname(config.path), base, target.replace("*", selected.middle)));
+    return { handled: true, file: sourceAt(path, from) };
+  };
+  const manifests = files.filter((file) => /(?:^|\/)package\.json$/.test(file.path));
+  const workspace = (spec, from) => {
+    const name = spec.startsWith("@") ? spec.split("/").slice(0, 2).join("/") : spec.split("/")[0];
+    const subpath = spec === name ? "." : "." + spec.slice(name.length);
+    const owner = nearest(from, ["package.json"]);
+    if (!owner) return null;
+    if (owner.content.length > 65536) return unknown(true);
+    const ownerData = json(owner);
+    const deps = ownerData?.dependencies;
+    const link = object(deps) ? deps[name] : void 0;
+    if (typeof link !== "string" || !/^workspace:(?:\*|\^|~)$/.test(link)) return null;
+    const roots = parents(owner).map((dir2) => byPath.get(posix.join(dir2, "package.json"))).filter((file) => Boolean(file));
+    if (roots.some((file) => file.content.length > 65536)) return unknown(true);
+    const root = roots.find((file) => json(file)?.workspaces !== void 0);
+    if (!root) return unknown();
+    const raw = json(root).workspaces;
+    const patterns = Array.isArray(raw) ? raw : object(raw) ? raw.packages : null;
+    if (!Array.isArray(patterns)) return unknown();
+    if (patterns.length > 64) return unknown(true);
+    if (patterns.some((item) => typeof item !== "string" || !safePath(item) || item.split("*").length > 2)) return unknown();
+    const rootDir = posix.dirname(root.path);
+    const matched = manifests.filter((file) => {
+      const dir2 = posix.relative(rootDir, posix.dirname(file.path));
+      return Boolean(dir2) && contained(dir2) && patterns.some((pattern) => {
+        const [before, after = ""] = pattern.replace(/\/$/, "").split("*");
+        return pattern.includes("*") ? dir2.length >= before.length + after.length && dir2.startsWith(before) && dir2.endsWith(after) && !dir2.slice(before.length, dir2.length - after.length).includes("/") : dir2 === before;
+      }) && json(file)?.name === name;
+    });
+    if (matched.length !== 1) return unknown();
+    const manifest = matched[0], data = json(manifest);
+    let target;
+    if ("exports" in data) {
+      const value = data.exports;
+      if (object(value) && Object.keys(value).some((key) => key.startsWith(".")) && Object.keys(value).some((key) => !key.startsWith("."))) return unknown();
+      const entry = object(value) && Object.keys(value).some((key) => key.startsWith(".")) ? value[subpath] : subpath === "." ? value : null;
+      let limited2 = false;
+      target = exportTarget(entry, () => {
+        limited2 = true;
+      });
+      if (limited2) return unknown(true);
+    } else target = subpath === "." && typeof data.main === "string" && (!data.module || data.module === data.main) ? data.main : null;
+    if (!target || !safePath(target)) return unknown();
+    const dir = posix.dirname(manifest.path), path = posix.normalize(posix.join(dir, target));
+    if (!contained(posix.relative(dir, path))) return unknown();
+    return { handled: true, file: sourceAt(path, from) };
+  };
+  const resolve3 = (spec, from) => {
+    if (!spec || spec.length > 512 || /[\\\u0000-\u0020:%?]/.test(spec) || posix.isAbsolute(spec)) return unknown();
+    if (spec.startsWith(".")) return { handled: true, file: bindingModule(spec, from, files, "") };
+    const configured = configPath(spec, from);
+    if (configured) return configured;
+    const local = workspace(spec, from);
+    if (local) return local;
+    const scope = /^(.*?\/)?(?:src|app|lib|server|routes|api|controllers|plugins)\//.exec(from.path)?.[1] ?? "";
+    const file = bindingModule(spec, from, files, scope);
+    return { handled: Boolean(file), file };
+  };
+  return (spec, from) => {
+    metadataLimited = false;
+    const result = resolve3(spec, from);
+    if (result.file && (!/\.[mc]?[jt]sx?$/.test(result.file.path) || /\.d\.[cm]?ts$/.test(result.file.path))) return unknown();
+    return metadataLimited ? unknown(true) : result;
+  };
+}
+
+// src/rules/registration-context.ts
+function registrationContext(code, pairs, bodies) {
+  const regions = [];
+  const openers = new Map([...pairs].map(([open, close]) => [close, open]));
+  const controlBraces = /* @__PURE__ */ new Set();
+  let limited2 = false;
+  const space = (at) => {
+    while (at < code.length && /\s/.test(code[at])) at++;
+    return at;
+  };
+  const add = (start, end, dead = false, owner2 = false) => {
+    if (regions.some((region) => region.start === start && region.end === end && region.dead === dead && region.owner === owner2)) return;
+    if (regions.length >= 512) {
+      limited2 = true;
+      return;
+    }
+    regions.push({ start, end, dead, owner: owner2 });
+  };
+  const literal2 = (text) => {
+    const match = /^\s*(!\s*)?(true|false)\s*$/.exec(text);
+    return match ? match[2] === "true" !== Boolean(match[1]) : null;
+  };
+  const simpleEnd = (start) => {
+    for (let at = start; at < code.length; at++) {
+      const quote = code[at];
+      if (quote === '"' || quote === "'" || quote === "`") {
+        let end2 = at + 1;
+        for (; end2 < code.length; end2++) {
+          if (quote === "`" && code[end2] === "$" && code[end2 + 1] === "{") {
+            const close = pairs.get(end2 + 1);
+            if (close !== void 0) {
+              end2 = close;
+              continue;
+            }
+          }
+          if (code[end2] === quote) break;
+        }
+        if (end2 === code.length) limited2 = true;
+        at = end2;
+        continue;
+      }
+      const end = pairs.get(at);
+      if (end !== void 0) {
+        at = end;
+        continue;
+      }
+      if (/[;,}\n]/.test(code[at])) return at + (code[at] === ";" ? 1 : 0);
+    }
+    return code.length;
+  };
+  const statementEnd3 = (rawStart, depth = 0) => {
+    const start = space(rawStart);
+    if (depth >= 32) {
+      limited2 = true;
+      return code.length;
+    }
+    if (code[start] === "{") {
+      const end = pairs.get(start);
+      if (end === void 0) limited2 = true;
+      return (end ?? code.length - 1) + 1;
+    }
+    const head = /^(if|for(?:\s+await)?|while|switch|with)\s*\(/.exec(code.slice(start, start + 100));
+    if (head) {
+      const close = pairs.get(start + head[0].length - 1);
+      if (close === void 0) {
+        limited2 = true;
+        return code.length;
+      }
+      let end = statementEnd3(close + 1, depth + 1);
+      const tail = space(end);
+      if (head[1] === "if" && /^else\b/.test(code.slice(tail, tail + 8))) end = statementEnd3(tail + 4, depth + 1);
+      return end;
+    }
+    return simpleEnd(start);
+  };
+  for (const body of bodies) add(body.start, body.end + 1, false, true);
+  for (const match of code.matchAll(/=>\s*(?!\s*\{)/g)) {
+    const start = space(match.index + 2);
+    if (code[start] !== "{") add(start, simpleEnd(start), false, true);
+  }
+  for (const match of code.matchAll(/(?<![\w$.])(if|for(?:\s+await)?|while|switch|catch|with)\s*\(/g)) {
+    const open = match.index + match[0].length - 1, close = pairs.get(open);
+    if (close === void 0) {
+      limited2 = true;
+      continue;
+    }
+    const start = space(close + 1), end = statementEnd3(start);
+    if (code[start] === "{") controlBraces.add(start);
+    const condition = literal2(code.slice(open + 1, close));
+    if (match[1] === "if") {
+      if (condition !== true) add(start, end, condition === false);
+      const next = space(end);
+      if (/^else\b/.test(code.slice(next, next + 8))) {
+        const alternate = space(next + 4), alternateEnd = statementEnd3(alternate);
+        if (code[alternate] === "{") controlBraces.add(alternate);
+        if (condition !== false) add(alternate, alternateEnd, condition === true);
+      }
+    } else {
+      add(start, end, match[1] === "while" && condition === false);
+      if (match[1] === "switch" && code[start] === "{") {
+        const labels = [];
+        for (let at = start + 1; at < end - 1; at++) {
+          const nested = pairs.get(at);
+          if (nested !== void 0) {
+            at = nested;
+            continue;
+          }
+          if ((at === 0 || !/[\w$.]/.test(code[at - 1])) && /^(?:case|default)\b/.test(code.slice(at, at + 10))) labels.push(at);
+        }
+        labels.forEach((at, index) => add(at, labels[index + 1] ?? end - 1));
+      }
+    }
+  }
+  for (const match of code.matchAll(/(?<![\w$.])(?:try|finally|do|catch)\s*\{/g)) {
+    const start = match.index + match[0].length - 1;
+    controlBraces.add(start);
+    add(start, (pairs.get(start) ?? code.length - 1) + 1);
+  }
+  for (const [start, end] of pairs) {
+    if (code[start] !== "{" || controlBraces.has(start) || bodies.some((body) => body.start === start)) continue;
+    if (/\)\s*(?::[\w\s.<>,[\]|?]+)?$/.test(code.slice(Math.max(0, start - 200), start))) add(start, end + 1, false, true);
+  }
+  const contains = (region, at) => region.start <= at && at < region.end;
+  const owner = (at) => regions.filter((region) => region.owner && contains(region, at)).sort((a, b) => a.end - a.start - (b.end - b.start))[0];
+  const inline = (at) => {
+    let start = at;
+    for (let cursor = at - 1; cursor >= 0; cursor--) {
+      if (at - cursor > 4e3) {
+        limited2 = true;
+        return "conditional";
+      }
+      const open = openers.get(cursor);
+      if (open !== void 0) {
+        cursor = open;
+        start = open;
+        continue;
+      }
+      if (code[cursor] === ";" || code[cursor] === "{") {
+        start = cursor + 1;
+        break;
+      }
+      if (code[cursor] === "\n" && !/[&|?:=,(.\\]$/.test(code.slice(Math.max(0, cursor - 100), cursor).trimEnd())) {
+        start = cursor + 1;
+        break;
+      }
+      start = cursor;
+    }
+    let prefix = "";
+    for (let cursor = start; cursor < at; cursor++) {
+      const close = pairs.get(cursor);
+      if (close !== void 0 && close < at) {
+        prefix += " ";
+        cursor = close;
+        continue;
+      }
+      prefix += code[cursor];
+    }
+    prefix = prefix.trim();
+    const simple = /^(?:const\s+[\w$]+\s*=\s*)?(!?\s*(?:true|false))\s*(&&|\|\|)\s*$/.exec(prefix);
+    if (simple) {
+      const truth = literal2(simple[1]);
+      return (simple[2] === "&&" ? truth : !truth) ? "always" : "dead";
+    }
+    return /&&|\|\||\?/.test(prefix) ? "conditional" : "always";
+  };
+  const reachable = (at) => limited2 || !regions.some((region) => region.dead && contains(region, at)) && inline(at) !== "dead";
+  return {
+    get limited() {
+      return limited2;
+    },
+    reachable,
+    covers(guard, operation) {
+      if (limited2 || !reachable(guard) || inline(guard) !== "always") return false;
+      const guardOwner = owner(guard);
+      if (guardOwner && guardOwner !== owner(operation)) return false;
+      return regions.filter((region) => !region.dead && contains(region, guard)).every((region) => contains(region, operation));
+    }
+  };
+}
+
 // src/rules/routers.ts
 var NODE_FRAMEWORKS = /* @__PURE__ */ new Set(["express", "hono", "fastify"]);
 var METHODS = "get|post|put|patch|delete|all|options|head";
 var GENERICS = String.raw`(?:<[^()]{0,300}>\s*)?`;
 var FASTIFY_HOOKS = /^(?:onRequest|preParsing|preValidation|preHandler)$/;
-var HONO_CALL = `${METHODS}|on|use|route`;
+var HONO_CALL = `${METHODS}|on|use|route|openapiRoutes|openapi`;
 var analysedCache = /* @__PURE__ */ new WeakMap();
 function analyse(file) {
   const cached = analysedCache.get(file);
@@ -3485,8 +3869,9 @@ function argsOf(a, open, close) {
 function flatten(a, args) {
   return args.flatMap((arg) => {
     if (!arg.text.startsWith("[")) return [arg];
-    const close = a.pairs.get(arg.at);
-    return close === void 0 ? [arg] : argsOf(a, arg.at, close);
+    const owner = arg.file ? analyse(arg.file) : a;
+    const close = owner.pairs.get(arg.at);
+    return close === void 0 ? [arg] : argsOf(owner, arg.at, close).map((item) => ({ ...item, file: owner.file }));
   });
 }
 function scopeOf(path) {
@@ -3519,7 +3904,7 @@ function entriesOf(a, arg) {
   return entries;
 }
 function frameworkNamesOf(a) {
-  const names = { express: /* @__PURE__ */ new Set(), router: /* @__PURE__ */ new Set(), hono: /* @__PURE__ */ new Set(), fastify: /* @__PURE__ */ new Set(), types: /* @__PURE__ */ new Set() };
+  const names = { express: /* @__PURE__ */ new Set(), router: /* @__PURE__ */ new Set(), hono: /* @__PURE__ */ new Set(), openapi: /* @__PURE__ */ new Set(), fastify: /* @__PURE__ */ new Set(), types: /* @__PURE__ */ new Set() };
   const named = (list, wanted, into, fallback) => {
     for (const part of list.split(",")) {
       const m = /^\s*(?:type\s+)?([A-Za-z_$][\w$]*)\s*(?:(?:as|:)\s*([A-Za-z_$][\w$]*))?\s*$/.exec(part);
@@ -3529,6 +3914,7 @@ function frameworkNamesOf(a) {
     }
   };
   for (const m of a.source.matchAll(/\bimport\s+(type\s+)?(?:([A-Za-z_$][\w$]*)\s*,?\s*)?(?:\{([^{}]*)\}|\*\s+as\s+([A-Za-z_$][\w$]*))?\s*from\s*['"](express|hono(?:\/tiny|\/quick)?|@hono\/zod-openapi|fastify)['"]/g)) {
+    if (a.code.slice(m.index, m.index + 6) !== "import") continue;
     const typeOnly = Boolean(m[1]);
     if (m[5] === "express") {
       if (!typeOnly && m[2]) names.express.add(m[2]);
@@ -3541,20 +3927,27 @@ function frameworkNamesOf(a) {
       names.types.add("fastify");
     } else {
       if (!typeOnly && m[3]) named(m[3], /^(?:Hono|OpenAPIHono)$/, names.hono);
+      if (!typeOnly && m[3] && m[5] === "@hono/zod-openapi") named(m[3], /^OpenAPIHono$/, names.openapi);
       names.types.add("hono");
     }
   }
   for (const m of a.source.matchAll(/\b(?:const|let|var)\s+(?:([A-Za-z_$][\w$]*)|\{([^{}]*)\})\s*=\s*require\s*\(\s*['"](express|hono(?:\/tiny|\/quick)?|@hono\/zod-openapi|fastify)['"]\s*\)(?!\s*\()/g)) {
+    if (!/^(?:const|let|var)\b/.test(a.code.slice(m.index))) continue;
     if (m[3] === "express") {
       if (m[1]) names.express.add(m[1]);
       if (m[2]) named(m[2], /^Router$/, names.router);
     } else if (m[3] === "fastify") {
       if (m[1]) names.fastify.add(m[1]);
       if (m[2]) named(m[2], /^fastify$/, names.fastify);
-    } else if (m[2]) named(m[2], /^(?:Hono|OpenAPIHono)$/, names.hono);
+    } else if (m[2]) {
+      named(m[2], /^(?:Hono|OpenAPIHono)$/, names.hono);
+      if (m[3] === "@hono/zod-openapi") named(m[2], /^OpenAPIHono$/, names.openapi);
+    }
     names.types.add(m[3] === "express" || m[3] === "fastify" ? m[3] : "hono");
   }
-  for (const m of a.source.matchAll(/\brequire\s*\(\s*['"](express|fastify)['"]\s*\)/g)) names.types.add(m[1]);
+  for (const m of a.source.matchAll(/\brequire\s*\(\s*['"](express|fastify)['"]\s*\)/g)) {
+    if (a.code.slice(m.index, m.index + 7) === "require") names.types.add(m[1]);
+  }
   return names.types.size ? names : null;
 }
 function instancesOf(a, names) {
@@ -3563,6 +3956,7 @@ function instancesOf(a, names) {
     if (!found.some((other) => other.name === instance.name)) found.push(instance);
   };
   for (const m of a.source.matchAll(/\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*(?::[^=;]{0,100})?=\s*(?:await\s+)?(new\s+)?([A-Za-z_$][\w$]*)\s*(?:\.\s*(Router)\s*)?(<[^()]{0,300}>\s*)?\(/g)) {
+    if (!/^(?:const|let|var)\b/.test(a.code.slice(m.index))) continue;
     const [, name, isNew, callee, router] = m;
     if (!isNew && (names.express.has(callee) && (router === "Router" || router === void 0) || names.router.has(callee) && router === void 0)) {
       add({ name, framework: "express", prefix: "", weak: false });
@@ -3579,12 +3973,13 @@ function instancesOf(a, names) {
         prefix = (arg && pathOf(a, arg)) ?? "";
         if (baseClose !== void 0) close = baseClose;
       }
-      add({ name, framework: "hono", prefix, weak: false, chainFrom: close });
+      add({ name, framework: "hono", prefix, weak: false, chainFrom: close, openapi: names.openapi.has(callee) });
     } else if (!isNew && names.fastify.has(callee) && router === void 0) {
       add({ name, framework: "fastify", prefix: "", weak: false });
     }
   }
   for (const m of a.source.matchAll(/\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(?:await\s+)?require\s*\(\s*['"](express|fastify)['"]\s*\)\s*(?:\.\s*(Router)\s*)?\(/g)) {
+    if (!/^(?:const|let|var)\b/.test(a.code.slice(m.index))) continue;
     if (m[2] === "express" || !m[3]) add({ name: m[1], framework: m[2], prefix: "", weak: false });
   }
   const typed = [
@@ -3595,11 +3990,180 @@ function instancesOf(a, names) {
   for (const [framework, type] of typed) {
     if (!names.types.has(framework)) continue;
     for (const m of a.code.matchAll(new RegExp(String.raw`([A-Za-z_$][\w$]*)\s*\??:\s*(?:[A-Za-z_$][\w$]*\s*\.\s*)?${type}`, "g"))) {
-      add({ name: m[1], framework, prefix: "", weak: true });
+      add({ name: m[1], framework, prefix: "", weak: true, openapi: framework === "hono" && /\bOpenAPIHono\b/.test(m[0]) });
     }
   }
   return found;
 }
+function factoryBindingClean(a, name, initializer = -1) {
+  const escaped = name.replace(/\$/g, "\\$");
+  if ([...a.code.matchAll(new RegExp(`\\b(?:const|let|var|function|class)\\s+${escaped}(?![\\w$])`, "g"))].length > 1) return false;
+  if (initializer < 0) {
+    const declaration = new RegExp(`\\bconst\\s+(${escaped})\\s*(?::[^=;]{0,200})?=`).exec(a.code);
+    if (declaration) initializer = declaration.index + /^const\s+/.exec(declaration[0])[0].length;
+  }
+  if (new RegExp(`[(,]\\s*${escaped}\\s*(?=[:,)=])|(?<![\\w$.])${escaped}\\s*=>`).test(a.code)) return false;
+  for (const match of a.code.matchAll(/\b(?:const|let|var)\s*([\[{])/g)) {
+    const open = match.index + match[0].length - 1, close = a.pairs.get(open);
+    if (close !== void 0 && new RegExp(`(?<![\\w$])${escaped}(?![\\w$])`).test(a.code.slice(open, close + 1))) return false;
+  }
+  const writes = new RegExp(`(?<![\\w$.])${escaped}\\s*(?:=(?![=>])|[+*/%&|^-]=|\\?\\?=|&&=|\\|\\|=|\\+\\+|--)`, "g");
+  for (const match of a.code.matchAll(writes)) if (match.index !== initializer) return false;
+  return !new RegExp(`(?<![\\w$.])${escaped}(?:\\s*\\.\\s*[\\w$]+|\\s*\\[[^\\]]{0,200}\\])+\\s*=(?!=)|\\bObject\\s*\\.\\s*(?:assign|defineProperty|defineProperties)\\s*\\(\\s*${escaped}(?![\\w$])`).test(a.code);
+}
+function projectFactoryResolver(files, gaps) {
+  const cache3 = /* @__PURE__ */ new Map();
+  const module = factoryModuleResolver(files);
+  let limited2 = false;
+  const topLevel = (a, at) => ![...a.pairs].some(([open, close]) => a.code[open] === "{" && open < at && at < close);
+  const argAt = (a, at, end) => {
+    const lead = a.code.slice(at, end).length - a.code.slice(at, end).trimStart().length;
+    at += lead;
+    const text = a.code.slice(at, end).trimEnd();
+    return { at, text, source: a.source.slice(at, at + text.length) };
+  };
+  const basePath = (a, close, shape) => {
+    for (let i = 0; i < 8; i++) {
+      const next = /^\s*\.\s*basePath\s*\(/.exec(a.code.slice(close + 1, close + 200));
+      if (!next) return { shape, close };
+      if (shape.framework !== "hono") return null;
+      const open = close + next[0].length, end = a.pairs.get(open);
+      const args = end === void 0 ? [] : argsOf(a, open, end);
+      const path = args.length === 1 ? literalOf(args[0]) : null;
+      if (end === void 0 || path === null) return null;
+      shape = { ...shape, prefix: joinPath(shape.prefix, path) };
+      close = end;
+    }
+    if (/^\s*\.\s*basePath\s*\(/.test(a.code.slice(close + 1, close + 200))) {
+      limited2 = true;
+      return null;
+    }
+    return { shape, close };
+  };
+  const expression = (a, arg, depth) => {
+    if (depth >= 8 || arg.text.length > 4e3) {
+      limited2 = true;
+      return null;
+    }
+    if (arg.text[0] === "(" && a.pairs.get(arg.at) === arg.at + arg.text.length - 1) return expression(a, argAt(a, arg.at + 1, arg.at + arg.text.length - 1), depth + 1);
+    const call = /^(new\s+)?([A-Za-z_$][\w$]*)(?:\s*\.\s*(Router))?\s*(?:<[^()]{0,300}>\s*)?\(/.exec(arg.text);
+    if (!call) return null;
+    const [, isNew, name, member] = call;
+    const open = arg.at + call[0].length - 1, close = a.pairs.get(open);
+    if (close === void 0 || close >= arg.at + arg.text.length || !factoryBindingClean(a, name)) return null;
+    const imports = bindingsOf(a.file).imports.filter((item) => item.local === name);
+    const imported = imports.length === 1 ? imports[0] : void 0;
+    let shape = null;
+    const origin = imported?.spec ? module(imported.spec, a.file) : null;
+    if (origin?.limited) limited2 = true;
+    if (imported?.spec && !origin?.handled && !new RegExp(`\\b(?:const|let|var|function|class)\\s+${name.replace(/\$/g, "\\$")}(?![\\w$])`).test(a.code)) {
+      if (isNew && !member && ["hono", "hono/tiny", "hono/quick"].includes(imported.spec ?? "") && imported.imported === "Hono") shape = { framework: "hono", prefix: "", openapi: false };
+      if (isNew && !member && imported.spec === "@hono/zod-openapi" && imported.imported === "OpenAPIHono") shape = { framework: "hono", prefix: "", openapi: true };
+      if (!isNew && imported.spec === "express" && (imported.imported === "default" && (!member || member === "Router") || imported.imported === "Router" && !member)) shape = { framework: "express", prefix: "", openapi: false };
+      if (!isNew && !member && imported.spec === "fastify" && ["default", "fastify"].includes(imported.imported)) shape = { framework: "fastify", prefix: "", openapi: false };
+    }
+    if (!shape && !isNew && !member && !a.source.slice(open + 1, close).trim()) shape = resolve3(a, name, false, depth + 1);
+    if (!shape) return null;
+    const chained = basePath(a, close, shape);
+    return chained && !arg.text.slice(chained.close - arg.at + 1).trim() ? chained.shape : null;
+  };
+  const functionValue = (a, value, depth) => {
+    if (depth >= 8) {
+      limited2 = true;
+      return null;
+    }
+    if (/^[A-Za-z_$][\w$]*$/.test(value.text)) return resolve3(a, value.text, false, depth + 1);
+    const signature = /^(?:function(?:\s+[A-Za-z_$][\w$]*)?\s*\(\s*\)\s*(?::[^{};=]{1,200})?\s*|\(\s*\)\s*(?::[^{};=]{1,200})?\s*=>\s*)/.exec(value.text);
+    if (!signature) return null;
+    let body = argAt(a, value.at + signature[0].length, value.at + value.text.length);
+    if (body.text.startsWith("{")) {
+      const end = a.pairs.get(body.at);
+      if (end !== body.at + body.text.length - 1) return null;
+      const returned = /^\s*return\b[ \t]*/.exec(a.code.slice(body.at + 1, end));
+      if (!returned) return null;
+      const from = body.at + 1 + returned[0].length;
+      if (/[\r\n]/.test(a.code[from] ?? "")) return null;
+      body = argAt(a, from, end);
+      if (body.text.endsWith(";")) body = argAt(a, body.at, body.at + body.text.length - 1);
+    }
+    return expression(a, body, depth);
+  };
+  const resolve3 = (a, name, exported, depth) => {
+    if (depth >= 8) {
+      limited2 = true;
+      return null;
+    }
+    const key = `${a.file.path}\0${name}\0${exported}\0${depth}`;
+    if (cache3.has(key)) return cache3.get(key);
+    const follow = (spec, symbol) => {
+      const resolved = module(spec, a.file);
+      if (resolved.limited) limited2 = true;
+      const target = resolved.file;
+      return target ? resolve3(analyse(target), symbol, true, depth + 1) : null;
+    };
+    const bindings = bindingsOf(a.file), escaped = name.replace(/\$/g, "\\$");
+    let result = null;
+    if (exported) {
+      if (name === "default") {
+        const match = /\bexport\s+default\s+/.exec(a.code);
+        if (match && topLevel(a, match.index)) {
+          const at = match.index + match[0].length;
+          const named = /^function\s+([A-Za-z_$][\w$]*)/.exec(a.code.slice(at));
+          if (!named || factoryBindingClean(a, named[1])) result = functionValue(a, argAt(a, at, expressionEnd(a, at)), depth);
+        }
+      } else if (new RegExp(`\\bexport\\s+(?:const|function)\\s+${escaped}(?![\\w$])`).test(a.code)) result = resolve3(a, name, false, depth);
+      else {
+        const matches = bindings.exports.filter((item) => item.local === name);
+        if (matches.length === 1) {
+          const entry = matches[0];
+          result = entry.spec ? follow(entry.spec, entry.imported) : resolve3(a, entry.imported, false, depth + 1);
+        } else if (!matches.length && name !== "default" && bindings.stars.length === 1) result = follow(bindings.stars[0], name);
+      }
+    } else {
+      const declarations = [...a.code.matchAll(new RegExp(`\\b(const|function)\\s+${escaped}(?![\\w$])`, "g"))];
+      const declaration = declarations.length === 1 ? declarations[0] : void 0;
+      if (declaration && topLevel(a, declaration.index)) {
+        const at = declaration.index;
+        if (declaration[1] === "function" && factoryBindingClean(a, name)) result = functionValue(a, argAt(a, at, expressionEnd(a, at)), depth);
+        if (declaration[1] === "const") {
+          const prefix = new RegExp(`^const\\s+${escaped}\\s*(?::[^=;]{0,200})?=\\s*`).exec(a.code.slice(at));
+          const nameAt = at + /^const\s+/.exec(declaration[0])[0].length;
+          if (prefix && factoryBindingClean(a, name, nameAt)) {
+            const valueAt = at + prefix[0].length;
+            result = functionValue(a, argAt(a, valueAt, expressionEnd(a, valueAt)), depth);
+          }
+        }
+      } else if (!declarations.length && factoryBindingClean(a, name)) {
+        const imports = bindings.imports.filter((item) => item.local === name && item.spec);
+        if (imports.length === 1) result = follow(imports[0].spec, imports[0].imported);
+      }
+    }
+    if (result) cache3.set(key, result);
+    return result;
+  };
+  return (a, known) => {
+    const found = [];
+    const receivers = new Set([...a.code.matchAll(new RegExp(`(?<![\\w$.])([A-Za-z_$][\\w$]*)\\s*\\.\\s*(?:${METHODS}|on|openapi|openapiRoutes|route|register)\\s*${GENERICS}\\(`, "g"))].map((match) => match[1]));
+    let inspected = 0;
+    for (const m of a.code.matchAll(/\bconst\s+([A-Za-z_$][\w$]*)\s*=\s*([A-Za-z_$][\w$]*)\s*\(\s*\)/g)) {
+      const [, name, factory] = m;
+      if (!receivers.has(name) || known.has(name)) continue;
+      if (++inspected > 256) {
+        gaps.set(a.file, m.index);
+        break;
+      }
+      const open = a.code.indexOf("(", m.index), close = m.index + m[0].length - 1;
+      if (!topLevel(a, m.index) || a.source.slice(open + 1, close).trim() || !factoryBindingClean(a, factory) || !factoryBindingClean(a, name)) continue;
+      limited2 = false;
+      const shape = resolve3(a, factory, false, 0);
+      const chained = shape ? basePath(a, m.index + m[0].length - 1, shape) : null;
+      if (limited2) gaps.set(a.file, m.index);
+      const end = expressionEnd(a, open);
+      if (chained && !a.code.slice(chained.close + 1, end).trim()) found.push({ name, ...chained.shape, weak: false, chainFrom: chained.close });
+    }
+    return found;
+  };
+}
 function literalOf(arg) {
   const m = /^(['"`])([^'"`$]*)\1$/.exec(arg.source);
   return m ? m[2] : null;
@@ -3618,11 +4182,13 @@ function usePrefixes(a, arg) {
   if (arg.text.startsWith("[")) {
     const close = a.pairs.get(arg.at);
     const items = close === void 0 ? [] : argsOf(a, arg.at, close);
-    if (items.length === 0 || !items.every((item) => /^['"`]/.test(item.source))) return null;
+    if (items.length === 0 || !items.some((item) => /^['"`]/.test(item.source))) return null;
     return items.map((item) => pathOf(a, item)).filter((path) => path !== null);
   }
   const prefix = pathOf(a, arg);
-  return prefix === null ? null : [prefix];
+  if (prefix !== null) return [prefix];
+  if (/^['"`/]|^new\s+RegExp\b|^(?:process\s*\.\s*env|import\s*\.\s*meta\s*\.\s*env|(?:[\w$]+\s*\.\s*)?env)\s*[.[]/.test(arg.source)) return [];
+  return null;
 }
 function pathOf(a, arg) {
   if (arg.text.startsWith("[")) return null;
@@ -3691,11 +4257,199 @@ function expressUses(a, name) {
   }
   return found.sort((x, y) => x.at - y.at);
 }
-function honoOps(a, name, chainFrom) {
+function openapiMiddleware(a, arg, depth = 0) {
+  if (depth >= 8) return [];
+  if (arg.text.startsWith("[")) {
+    const close = a.pairs.get(arg.at);
+    if (close === void 0 || !/^\s*(?:as\s+const)?\s*$/.test(arg.text.slice(close - arg.at + 1))) return [];
+    return argsOf(a, arg.at, close).flatMap((item) => openapiMiddleware(a, item, depth + 1));
+  }
+  if (/^[A-Za-z_$][\w$]*(?:\s*\.\s*[A-Za-z_$][\w$]*)*$/.test(arg.text) || FUNCTION_EXPRESSION.test(arg.text)) return [arg];
+  const call = /^[A-Za-z_$][\w$.]*\s*\(/.exec(arg.text);
+  return call && a.pairs.get(arg.at + call[0].length - 1) === arg.at + arg.text.length - 1 ? [arg] : [];
+}
+function openapiEntries(a, arg, files, depth = 0) {
+  const value = openapiValue(a, arg, files, depth);
+  if (!value || !value.text.startsWith("{")) return /* @__PURE__ */ new Map();
+  const owner = analyse(value.file);
+  const close = owner.pairs.get(value.at);
+  if (argsOf(owner, value.at, close).some((part) => /^(?:\.\.\.|\[|(?:get|set)\s+)/.test(part.text))) return /* @__PURE__ */ new Map();
+  return new Map([...entriesOf(owner, value)].map(([key, entry]) => [key, {
+    ...entry,
+    value: entry.value ? { ...entry.value, file: owner.file } : null
+  }]));
+}
+function openapiValue(a, arg, files, depth = 0) {
+  if (depth >= 8) return null;
+  const root = /^([A-Za-z_$][\w$]*)(?:\s*[.(]|$)/.exec(arg.text)?.[1];
+  if (root) {
+    const token = new RegExp(`(?<![\\w$])${root.replace(/\$/g, "\\$")}(?![\\w$])`);
+    if (a.bodies.some((body) => body.start < arg.at && arg.at < body.end && token.test(a.code.slice(body.declaration, body.start)))) return null;
+    for (const match of a.code.matchAll(/\b(?:const|let|var)\s*([\[{])/g)) {
+      const open = match.index + match[0].length - 1;
+      const close = a.pairs.get(open);
+      if (close !== void 0 && token.test(a.code.slice(open, close + 1))) return null;
+    }
+  }
+  if (/^[{[]/.test(arg.text)) {
+    const close = a.pairs.get(arg.at);
+    if (close === void 0 || !/^\s*(?:as\s+const|satisfies\s+[\w$.]+)?\s*$/.test(arg.text.slice(close - arg.at + 1))) return null;
+    return { ...arg, file: a.file };
+  }
+  const call = /^([A-Za-z_$][\w$]*)\s*\(/.exec(arg.text);
+  if (call) {
+    const binding = bindingsOf(a.file).imports.find((item) => item.local === call[1]);
+    if (!binding || !["createRoute", "defineOpenAPIRoute"].includes(binding.imported) || binding.spec !== "@hono/zod-openapi") return null;
+    if (new RegExp(`\\b(?:const|let|var|function)\\s+${call[1].replace(/\$/g, "\\$")}(?![\\w$])`).test(a.code)) return null;
+    const open = arg.at + call[0].length - 1;
+    const close = a.pairs.get(open);
+    if (close !== arg.at + arg.text.length - 1) return null;
+    const args = argsOf(a, open, close);
+    return args.length === 1 ? openapiValue(a, args[0], files, depth + 1) : null;
+  }
+  if (root && !unchangedOpenapiReference(a, root)) return null;
+  const member = /^([A-Za-z_$][\w$]*)\s*\.\s*([A-Za-z_$][\w$]*)$/.exec(arg.text);
+  if (member) {
+    const escaped = member[1].replace(/\$/g, "\\$");
+    if (new RegExp(`\\b(?:const|let|var|function|class)\\s+${escaped}(?![\\w$])`).test(a.code)) return null;
+    const namespace = new RegExp(`\\bimport\\s+\\*\\s+as\\s+${escaped}\\s+from\\s*['"]([^'"]+)['"]`).exec(a.source);
+    const module = namespace && a.code.slice(namespace.index, namespace.index + 6) === "import" ? moduleFor(namespace[1], a.file, files) : null;
+    return module ? openapiExportValue(analyse(module), member[2], files, depth + 1) : null;
+  }
+  if (!/^[A-Za-z_$][\w$]*$/.test(arg.text)) return null;
+  const name = arg.text.replace(/\$/g, "\\$");
+  const declarations = [...a.code.matchAll(new RegExp(`\\b(const|let|var)\\s+${name}\\s*(?::[^=;]{0,200})?=(?![=>])\\s*`, "g"))];
+  if (declarations.length === 0) {
+    const imports = bindingsOf(a.file).imports.filter((item) => item.local === arg.text && item.spec);
+    const imported = imports.length === 1 ? imports[0] : void 0;
+    const module = imported ? moduleFor(imported.spec, a.file, files) : null;
+    return module ? openapiExportValue(analyse(module), imported.imported, files, depth + 1) : null;
+  }
+  if (declarations.length !== 1 || declarations[0][1] !== "const") return null;
+  const declaration = declarations[0];
+  if (declaration.index >= arg.at) return null;
+  for (const [open, close] of a.pairs) {
+    if (a.code[open] === "{" && open < declaration.index && declaration.index < close && !(open < arg.at && arg.at < close)) return null;
+  }
+  const from = declaration.index + declaration[0].length;
+  const end = expressionEnd(a, from);
+  const text = a.code.slice(from, end).trimEnd();
+  return openapiValue(a, { at: from, text, source: a.source.slice(from, from + text.length) }, files, depth + 1);
+}
+function unchangedOpenapiReference(a, name) {
+  const aliases = /* @__PURE__ */ new Set([name]);
+  const assignedAliases = [...a.code.matchAll(/\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*([A-Za-z_$][\w$]*)\s*(?=[;,\n]|$)/g)];
+  for (let pass = 0; pass < 8; pass++) {
+    const size = aliases.size;
+    for (const match of assignedAliases) if (aliases.has(match[2])) aliases.add(match[1]);
+    if (aliases.size > 64) return false;
+    if (aliases.size === size) break;
+    if (pass === 7) return false;
+  }
+  for (const alias of aliases) {
+    const escaped = alias.replace(/\$/g, "\\$");
+    const mutable = new RegExp(`(?<![\\w$.])${escaped}\\s*(?:\\.\\s*[\\w$]+|\\[[^\\]]{0,200}\\])+(?:\\s*(?:=|\\?\\?=|\\|\\|=|&&=)|\\s*\\()|\\bdelete\\s+${escaped}(?![\\w$])|\\bObject\\s*\\.\\s*(?:assign|defineProperty|defineProperties)\\s*\\(\\s*${escaped}(?![\\w$])`);
+    if (mutable.test(a.code)) return false;
+  }
+  return true;
+}
+function openapiExportValue(a, name, files, depth) {
+  if (depth >= 8) return null;
+  if (name === "default") {
+    const declaration = /\bexport\s+default\s+/.exec(a.code);
+    if (declaration) {
+      const at = declaration.index + declaration[0].length;
+      const text = a.code.slice(at, expressionEnd(a, at)).trimEnd();
+      return openapiValue(a, { at, text, source: a.source.slice(at, at + text.length) }, files, depth + 1);
+    }
+  } else if (new RegExp(`\\bexport\\s+const\\s+${name.replace(/\$/g, "\\$")}\\s*(?=[:=])`).test(a.code)) {
+    return openapiValue(a, { text: name, source: name, at: a.code.length }, files, depth + 1);
+  }
+  const bindings = bindingsOf(a.file);
+  const matches = bindings.exports.filter((item) => item.local === name);
+  if (matches.length > 1) return null;
+  const binding = matches[0];
+  if (binding?.spec) {
+    const module = moduleFor(binding.spec, a.file, files);
+    return module ? openapiExportValue(analyse(module), binding.imported, files, depth + 1) : null;
+  }
+  if (binding) return openapiValue(a, { text: binding.imported, source: binding.imported, at: a.code.length }, files, depth + 1);
+  if (name !== "default" && bindings.stars.length === 1) {
+    const module = moduleFor(bindings.stars[0], a.file, files);
+    if (module) return openapiExportValue(analyse(module), name, files, depth + 1);
+  }
+  return null;
+}
+function honoOps(a, name, chainFrom, files, openapi = false) {
   const registrations = [];
   const uses = [];
+  const batchGaps = /* @__PURE__ */ new Set();
+  const addOpenapi = (config, handler, handlerRange, at, batch = false) => {
+    const entries = openapiEntries(config.file ? analyse(config.file) : a, config, files);
+    const path = entries.get("path")?.value;
+    const resolved = path ? literalOf(path) : null;
+    const routingPath = resolved?.replace(/\/\{(.+?)\}/g, "/:$1") ?? null;
+    const middleware = entries.get("middleware")?.value;
+    const owner = middleware?.file ? analyse(middleware.file) : a;
+    registrations.push({
+      path: routingPath,
+      middleware: middleware ? openapiMiddleware(owner, middleware).map((arg) => ({ ...arg, file: owner.file })) : [],
+      handler,
+      handlerRange,
+      at,
+      batch
+    });
+    return [routingPath];
+  };
   const visit = (method, open, close, at, previous) => {
     const args = argsOf(a, open, close);
+    if (method === "openapiRoutes") {
+      if (!openapi) return previous;
+      let paths2 = previous;
+      let inspected = 0;
+      const gap = () => {
+        batchGaps.add(at);
+        paths2 = [null];
+      };
+      const walk = (origin, list, depth) => {
+        if (!list || depth >= 8) {
+          gap();
+          return;
+        }
+        const value = openapiValue(origin, list, files);
+        if (!value || !value.text.startsWith("[")) {
+          gap();
+          return;
+        }
+        const owner = analyse(value.file);
+        for (const item of argsOf(owner, value.at, owner.pairs.get(value.at))) {
+          if (++inspected > 256) {
+            gap();
+            return;
+          }
+          if (item.text.startsWith("...")) {
+            const lead = 3 + item.text.slice(3).length - item.text.slice(3).trimStart().length;
+            walk(owner, { at: item.at + lead, text: item.text.slice(lead), source: item.source.slice(lead) }, depth + 1);
+            continue;
+          }
+          const entries = openapiEntries(owner, item, files);
+          if (entries.get("addRoute")?.value?.text === "false") continue;
+          const config = entries.get("route")?.value;
+          const handler = entries.get("handler");
+          if (!config || !handler || !handler.value && !handler.range) {
+            gap();
+            continue;
+          }
+          paths2 = addOpenapi(config, handler.value, handler.range, at, true);
+        }
+      };
+      walk(a, args[0], 0);
+      return paths2;
+    }
+    if (method === "openapi") {
+      if (!openapi || !args[0] || !args[1]) return previous;
+      return addOpenapi(args[0], args[1], null, at);
+    }
     if (method === "use") {
       const prefixes = args[0] ? usePrefixes(a, args[0]) : null;
       const middleware = flatten(a, prefixes === null ? args : args.slice(1));
@@ -3737,7 +4491,7 @@ function honoOps(a, name, chainFrom) {
   }
   registrations.sort((x, y) => x.at - y.at);
   uses.sort((x, y) => x.at - y.at);
-  return { registrations, uses };
+  return { registrations, uses, batchGaps: [...batchGaps] };
 }
 function fastifyOps(a, name) {
   const registrations = [];
@@ -4019,7 +4773,7 @@ function exportedPlugin(t, files, depth) {
   const text = t.code.slice(from, end).trimEnd();
   return pluginOf(t, { text, source: t.source.slice(from, from + text.length), at: from }, files, depth);
 }
-var toRefs = (a, args) => args.map((arg) => ({ text: arg.source, at: arg.at, file: a.file }));
+var toRefs = (a, args) => args.map((arg) => ({ text: arg.source, at: arg.at, file: arg.file ?? a.file }));
 function mountedFile(a, arg, files) {
   const inline = /^require\s*\(\s*['"]([^'"]+)['"]\s*\)$/.exec(arg.source);
   if (inline) return moduleFor(inline[1], a.file, files);
@@ -4071,31 +4825,42 @@ function paramNamesOf(a, range) {
 }
 var within = (site, at) => site.range === null || site.range.start <= at && at <= site.range.end;
 var opsCache = /* @__PURE__ */ new WeakMap();
-function opsOf(site) {
+var contextCache = /* @__PURE__ */ new WeakMap();
+function contextOf(a) {
+  let context = contextCache.get(a.file);
+  if (!context) {
+    context = registrationContext(a.code, a.pairs, a.bodies);
+    contextCache.set(a.file, context);
+  }
+  return context;
+}
+function opsOf(site, files) {
   const cached = opsCache.get(site);
   if (cached) return cached;
   const { a, name } = site;
   let ops;
   if (site.framework === "express") ops = { registrations: expressRegistrations(a, name), uses: expressUses(a, name), registers: [] };
-  else if (site.framework === "hono") ops = { ...honoOps(a, name, site.chainFrom), registers: [] };
+  else if (site.framework === "hono") ops = { ...honoOps(a, name, site.chainFrom, files, site.openapi), registers: [] };
   else ops = fastifyOps(a, name);
+  const context = contextOf(a);
   const result = {
-    registrations: ops.registrations.filter((reg) => within(site, reg.at)),
-    uses: ops.uses.filter((use) => within(site, use.at)),
-    registers: ops.registers.filter((reg) => within(site, reg.at))
+    registrations: ops.registrations.filter((reg) => within(site, reg.at) && context.reachable(reg.at)),
+    uses: ops.uses.filter((use) => within(site, use.at) && context.reachable(use.at)),
+    registers: ops.registers.filter((reg) => within(site, reg.at) && context.reachable(reg.at)),
+    batchGaps: (ops.batchGaps ?? []).filter((at) => within(site, at))
   };
   opsCache.set(site, result);
   return result;
 }
 function generalMiddleware(site, before, files) {
-  const args = opsOf(site).uses.filter((use) => !use.mount && use.at < before && (use.prefix === null || use.prefix === "/" || /^\/?\*$/.test(use.prefix))).flatMap((use) => use.args).filter((arg) => site.framework !== "express" || mountedFile(site.a, arg, files) === null);
+  const args = opsOf(site, files).uses.filter((use) => !use.mount && use.at < before && contextOf(site.a).covers(use.at, Number.isFinite(before) ? before : (site.range?.end ?? site.a.code.length) - 1) && (use.prefix === null || site.framework !== "hono" && use.prefix === "/" || /^\/?\*$/.test(use.prefix))).flatMap((use) => use.args).filter((arg) => site.framework !== "express" || mountedFile(site.a, arg, files) === null);
   return toRefs(site.a, args);
 }
 function passedSites(site, files) {
   const { a } = site;
   const found = [];
   const receive = (range, index, at) => {
-    if (!range) return;
+    if (!range || !contextOf(a).reachable(at)) return;
     const target = analyse(range.file);
     const name = paramNamesOf(target, range)[index];
     if (!name) return;
@@ -4103,6 +4868,7 @@ function passedSites(site, files) {
       a: target,
       name,
       framework: site.framework,
+      openapi: Boolean(site.openapi),
       range: { start: range.start, end: range.end },
       prefix: site.prefix,
       root: site.root ?? site,
@@ -4152,7 +4918,7 @@ function normalizePath(path) {
 function registeredSites(site, files) {
   const { a } = site;
   const found = [];
-  for (const reg of opsOf(site).registers) {
+  for (const reg of opsOf(site, files).registers) {
     const options = entriesOf(a, reg.options);
     const prefixArg = options.get("prefix")?.value;
     const prefix = joinPath(site.prefix, (prefixArg && pathOf(a, prefixArg)) ?? "");
@@ -4211,24 +4977,50 @@ function serverIndex(files) {
   const cached = indexCache.get(files);
   if (cached) return cached;
   const sites = [];
+  const registrationGaps = /* @__PURE__ */ new Set();
+  const factoryGaps = /* @__PURE__ */ new Map();
+  const factories = projectFactoryResolver(files, factoryGaps);
   const seen = /* @__PURE__ */ new Set();
   const add = (site) => {
-    const key = `${site.a.file.path}\0${site.name}\0${site.range?.start ?? -1}\0${site.prefix}`;
+    if (site.inherited.length > 256) {
+      registrationGaps.add(site.a.file);
+      site.inherited = [];
+    }
+    const root = site.root ?? site;
+    const identity2 = createHash2("sha256").update(JSON.stringify([
+      site.a.file.path,
+      site.name,
+      site.framework,
+      site.range?.start ?? -1,
+      site.prefix,
+      Boolean(site.openapi),
+      root.a.file.path,
+      root.name,
+      root.range?.start ?? -1,
+      root.prefix
+    ]));
+    for (const ref of site.inherited) identity2.update(JSON.stringify([ref.file.path, ref.at]));
+    const key = identity2.digest("hex");
     if (seen.has(key)) return false;
+    if (sites.length >= 4096) {
+      registrationGaps.add(site.a.file);
+      return false;
+    }
     seen.add(key);
     sites.push(site);
     return true;
   };
   for (const file of files) {
-    if (!/\.[mc]?[jt]sx?$/.test(file.path) || !/\b(?:express|hono|fastify)\b/.test(file.content)) continue;
+    if (!/\.[mc]?[jt]sx?$/.test(file.path)) continue;
     const a = analyse(file);
     const names = frameworkNamesOf(a);
-    if (!names) continue;
-    for (const instance of instancesOf(a, names)) {
+    const direct = names ? instancesOf(a, names) : [];
+    for (const instance of [...direct, ...factories(a, new Set(direct.map((item) => item.name)))]) {
       add({
         a,
         name: instance.name,
         framework: instance.framework,
+        openapi: Boolean(instance.openapi),
         range: null,
         prefix: instance.prefix,
         inherited: [],
@@ -4249,15 +5041,22 @@ function serverIndex(files) {
   const shadowed = (site, at) => Boolean(site.weak) && sites.some((other) => other !== site && !other.weak && other.a === site.a && other.name === site.name && other.range !== null && within(other, at));
   const byRouterFile = /* @__PURE__ */ new Map();
   const byRoot = /* @__PURE__ */ new Map();
+  const batchGaps = /* @__PURE__ */ new Map();
   for (const site of sites) {
     const { a } = site;
-    const { registrations, uses } = opsOf(site);
+    const { registrations, uses, batchGaps: gaps } = opsOf(site, files);
+    for (const at of gaps ?? []) if (!shadowed(site, at) && !batchGaps.has(a.file)) batchGaps.set(a.file, at);
     const routes = byRouterFile.get(a.file) ?? [];
     for (const reg of registrations) {
       if (shadowed(site, reg.at)) continue;
-      const handler = reg.handlerRange ?? (reg.handler ? handlerOf(a, reg.handler, files) : null);
-      if (!handler) continue;
-      const before = uses.filter((use) => !use.mount && use.at < reg.at && pathMatches(use.prefix, reg.path, site.framework)).flatMap((use) => use.args.filter((arg) => site.framework !== "express" || mountedFile(a, arg, files) === null));
+      const handler = reg.handlerRange ?? (reg.handler ? handlerOf(reg.handler.file ? analyse(reg.handler.file) : a, reg.handler, files) : null);
+      const handlerSource = handler ? analyse(handler.file) : null;
+      const knownBatchHandler = !reg.batch || reg.handlerRange !== null || handler && handlerSource && (handler.arrow || FUNCTION_EXPRESSION.test(handlerSource.code.slice(handler.start, handler.end)) || handlerSource.bodies.some((body) => handler.start <= body.start && body.end <= handler.end));
+      if (!handler || !knownBatchHandler) {
+        if (reg.batch && !batchGaps.has(a.file)) batchGaps.set(a.file, reg.at);
+        continue;
+      }
+      const before = uses.filter((use) => !use.mount && use.at < reg.at && contextOf(a).covers(use.at, reg.at) && pathMatches(use.prefix, reg.path, site.framework)).flatMap((use) => use.args.filter((arg) => site.framework !== "express" || mountedFile(a, arg, files) === null));
       const url = reg.path === null ? "(dynamic path)" : joinPath(site.prefix, reg.path);
       const callbacks = flatten(a, reg.middleware);
       const root = site.root ?? site;
@@ -4276,8 +5075,7 @@ function serverIndex(files) {
       };
       add2(handler, callbacks);
       callbacks.forEach((callback, index2) => {
-        if (!FUNCTION_EXPRESSION.test(callback.text)) return;
-        const range = functionAt(a, callback.at, callback.at + callback.text.length);
+        const range = handlerOf(callback.file ? analyse(callback.file) : a, callback, files);
         if (range) add2(range, callbacks.slice(0, index2));
       });
     }
@@ -4290,7 +5088,7 @@ function serverIndex(files) {
   for (const site of sites) {
     if (site.framework === "fastify") continue;
     const { a } = site;
-    const uses = opsOf(site).uses;
+    const uses = opsOf(site, files).uses;
     for (const use of uses) {
       if (site.framework === "hono" && !use.mount) continue;
       use.args.forEach((arg, index2) => {
@@ -4299,7 +5097,7 @@ function serverIndex(files) {
         if (!routes || routes.length === 0) return;
         const isMiddleware = (x) => mountedFile(a, x, files) === null && localRoutes(a, x) === void 0;
         const covers2 = (other) => site.framework === "hono" ? other.prefix === null || /\*$/.test(other.prefix) && pathMatches(other.prefix, use.prefix, "hono") : pathMatches(other.prefix, use.prefix, site.framework);
-        const earlier = uses.filter((other) => !other.mount && other.at < use.at && covers2(other)).flatMap((other) => site.framework === "hono" ? other.args : other.args.filter(isMiddleware));
+        const earlier = uses.filter((other) => !other.mount && other.at < use.at && contextOf(a).covers(other.at, use.at) && covers2(other)).flatMap((other) => site.framework === "hono" ? other.args : other.args.filter(isMiddleware));
         const middleware = [...site.inherited, ...toRefs(a, earlier), ...toRefs(a, use.args.slice(0, index2).filter(isMiddleware))];
         const prefix = joinPath(site.prefix, use.prefix ?? "/");
         for (const route of routes) {
@@ -4317,38 +5115,64 @@ function serverIndex(files) {
       byHandlerFile.set(route.file, list);
     }
   }
-  const index = { byHandlerFile };
+  for (const site of sites) if (contextOf(site.a).limited) registrationGaps.add(site.a.file);
+  const index = { byHandlerFile, batchGaps, factoryGaps, registrationGaps };
   indexCache.set(files, index);
   return index;
 }
 function nodeRoutesFor(file, files) {
   return serverIndex(files).byHandlerFile.get(file) ?? [];
 }
+function reportOpenapiBatchCoverage(ctx) {
+  for (const file of serverIndex(ctx.files).registrationGaps) {
+    ctx.reportIncomplete("engine/route-registration", `${file.path}: Route registration context reached a documented scope or graph limit. Conditional or truncated inherited middleware was not accepted as protection.`);
+  }
+  for (const [file, at] of serverIndex(ctx.files).factoryGaps) {
+    const line = file.content.slice(0, at).split("\n").length;
+    ctx.reportIncomplete("engine/router-factories", `${file.path}:${line}: Project router-factory analysis reached a resolution, expression, candidate or module-configuration limit. See the documented bounds; simplify the wrapper or scan its direct route entry separately.`);
+  }
+  for (const [file, at] of serverIndex(ctx.files).batchGaps) {
+    const line = file.content.slice(0, at).split("\n").length;
+    ctx.reportIncomplete("engine/openapi-routes", `${file.path}:${line}: OpenAPI batch routes were not fully resolved. Use static entries and resolvable handlers; limits are 8 spread levels and 256 entries per call.`);
+  }
+}
 function serverRoutesOf(file, files) {
   const route = routeOf(file);
   if (route) return [route];
   const actions = serverActionRoutes(file);
   return actions.length ? actions : nodeRoutesFor(file, files);
 }
-var decoratorCache = /* @__PURE__ */ new WeakMap();
-function decoratorOf(name, files) {
-  let cache3 = decoratorCache.get(files);
+function decoratorOf(ref, receiver, name, files) {
+  const a = analyse(ref.file);
+  const owner = (at) => a.bodies.filter((b) => b.start < at && at < b.end).sort((x, y) => y.start - x.start)[0];
+  const pattern = new RegExp(`(?<![\\w$.])${receiver.replace(/\$/g, "\\$")}\\s*\\.\\s*decorate\\s*\\(\\s*['"]${name.replace(/\$/g, "\\$")}['"]\\s*,`, "g");
+  let result = null;
+  for (const m of a.source.matchAll(pattern)) {
+    if (m.index >= ref.at || owner(m.index) !== owner(ref.at)) continue;
+    const open = a.source.indexOf("(", m.index);
+    const close = a.pairs.get(open);
+    const value = close === void 0 ? void 0 : argsOf(a, open, close)[1];
+    result = value ? handlerOf(a, value, files) : null;
+  }
+  return result;
+}
+var authPluginCache = /* @__PURE__ */ new WeakMap();
+function registeredAuthPlugin(ref, pkg) {
+  const a = analyse(ref.file);
+  const receiver = /^([A-Za-z_$][\w$]*)\s*\./.exec(ref.text)?.[1];
+  if (!receiver) return false;
+  let cache3 = authPluginCache.get(ref.file);
   if (!cache3) {
     cache3 = /* @__PURE__ */ new Map();
-    for (const file of files) {
-      if (!/\.[mc]?[jt]sx?$/.test(file.path) || !file.content.includes("decorate")) continue;
-      const a = analyse(file);
-      for (const m of a.source.matchAll(/\.\s*decorate\s*\(\s*['"]([A-Za-z_$][\w$]*)['"]\s*,/g)) {
-        if (cache3.has(m[1])) continue;
-        const open = a.source.indexOf("(", m.index);
-        const close = a.pairs.get(open);
-        const value = close === void 0 ? void 0 : argsOf(a, open, close)[1];
-        cache3.set(m[1], value ? handlerOf(a, value, files) : null);
-      }
-    }
-    decoratorCache.set(files, cache3);
+    authPluginCache.set(ref.file, cache3);
+  }
+  let registers = cache3.get(receiver);
+  if (!registers) {
+    registers = fastifyOps(a, receiver).registers;
+    cache3.set(receiver, registers);
   }
-  return cache3.get(name) ?? null;
+  const owner = (at) => a.bodies.filter((b) => b.start < at && at < b.end).sort((x, y) => y.start - x.start)[0];
+  return registers.some((reg) => reg.at < ref.at && owner(reg.at) === owner(ref.at) && /^[A-Za-z_$][\w$]*$/.test(reg.target.text) && packageOf(a, reg.target.text) === pkg);
 }
 function authCompositionOf(ref) {
   const a = analyse(ref.file);
@@ -4382,7 +5206,7 @@ function middlewareDefinition(ref, files) {
   const callee = member ?? root;
   const spec = packageOf(a, root);
   if (member && (spec === null || spec === "fastify")) {
-    const decorated = decoratorOf(member, files);
+    const decorated = decoratorOf(ref, root, member, files);
     if (decorated) return { name: callee, range: decorated, spec: null, inline };
   }
   if (spec) return { name: callee, range: null, spec, inline };
@@ -4399,66 +5223,241 @@ function propertyValue(a, name) {
   return { file: a.file, start: from, end: expressionEnd(a, from) - 1 };
 }
 
-// src/rules/apiauth.ts
-var APP_ROUTER = /(?:^|\/)app\/api\/(?:.+\/)?route\.[mc]?[jt]sx?$/;
-var PAGES_ROUTER = /(?:^|\/)pages\/api\/.+\.[mc]?[jt]sx?$/;
-var APP_ROUTE_FILE = /(?:^|\/)app\/(?:.+\/)?route\.[mc]?[jt]sx?$/;
-var NEXT_METHODS = "GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS";
-var NEXT_METHOD_EXPORT = new RegExp(
-  String.raw`\bexport\s+(?:async\s+)?function\s+(?:${NEXT_METHODS})\b|\bexport\s+const\s+(?:${NEXT_METHODS})\b|` + // export { handler as GET } 与 Auth.js 的 export const { GET, POST } = handlers；长度有界以免回溯。
-  String.raw`\bexport\s+(?:const\s*)?\{[^{}]{0,500}\b(?:${NEXT_METHODS})\b`
-);
-var SVELTEKIT_ENDPOINT = /^(.*?\/)?src\/routes\/(?:(.*)\/)?\+server\.[mc]?[jt]s$/;
-var SVELTEKIT_PAGE_SERVER = /^(.*?\/)?src\/routes\/(?:(.*)\/)?\+page\.server\.[mc]?[jt]s$/;
-var SVELTEKIT_ACTIONS = /\bexport\s+const\s+actions\b\s*(?::[^=;{}]{0,200})?=\s*\{/;
-var NUXT_ROUTE = /^(.*?\/)?server\/(api|routes)\/(.+)\.[mc]?[jt]s$/;
-var H3_HANDLER = /\b(?:defineEventHandler|eventHandler|defineCachedEventHandler|defineLazyEventHandler)\s*\(/;
-var NUXT_METHOD_SUFFIX = /\.(?:get|post|put|patch|delete|head|options|connect|trace)$/i;
-var REMIX_ROUTE = /^(.*?\/)?app\/routes\/(.+)\.[mc]?[jt]sx?$/;
-var REMIX_EXPORT = /\bexport\s+(?:async\s+)?function\s+(?:loader|action)\b|\bexport\s+const\s+(?:loader|action)\b/;
-var ASTRO_ENDPOINT = /^(.*?\/)?src\/pages\/(.+)\.[mc]?[jt]s$/;
-var ASTRO_EXPORT = /\bexport\s+(?:async\s+)?function\s+(?:GET|POST|PUT|PATCH|DELETE|ALL)\b|\bexport\s+const\s+(?:GET|POST|PUT|PATCH|DELETE|ALL)\b/;
-function isAstroEndpoint(file) {
-  const code = noiseMaskedOf(file);
-  return ASTRO_EXPORT.test(code) && !/\bexport\s+default\b/.test(code);
-}
-function serverActionRoutes(file) {
-  if (!/use server/.test(file.content) || !/\.[mc]?[jt]sx?$/.test(file.path)) return [];
-  const code = noiseMaskedOf(file);
-  const source = commentsMaskedOf(file);
-  const fileLevel = startsWithDirective(source, 0, "use server");
-  const pairs = delimiterPairs(code);
-  const openers = /* @__PURE__ */ new Map();
-  for (const [open, close] of pairs) openers.set(close, open);
-  const exportedList = /* @__PURE__ */ new Set();
-  for (const m of code.matchAll(/\bexport\s*\{([^{}]{0,1000})\}/g)) {
-    for (const part of m[1].split(",")) {
-      const name = /^\s*([A-Za-z_$][\w$]*)/.exec(part)?.[1];
-      if (name) exportedList.add(name);
-    }
+// src/rules/verification.ts
+var LocalVerification = class {
+  constructor(file, responseExits = false) {
+    this.responseExits = responseExits;
+    this.code = noiseMaskedOf(file);
+    this.source = commentsMaskedOf(file);
+    this.pairs = delimiterPairs(this.code);
+    this.bodies = functionBodies(this.code, this.pairs);
   }
-  const scope = /^(.*?\/)?(?:src|app|lib|actions|server|utils)\//.exec(file.path)?.[1] ?? "";
-  const routes = [];
-  for (const body of functionBodies(code, pairs)) {
-    const inline = startsWithDirective(source, body.start + 1, "use server");
-    const declared = declarationOf(code, body, openers);
-    const exported = fileLevel && declared !== null && (declared.exported || exportedList.has(declared.name));
-    if (!inline && !exported) continue;
-    const name = declared?.name ?? "anonymous";
-    routes.push({
-      file,
-      framework: "next",
-      url: `the server action ${name}`,
-      scope,
-      reachable: { start: body.start, end: body.end },
-      action: name
-    });
+  responseExits;
+  code;
+  source;
+  pairs;
+  bodies;
+  owner(at) {
+    return this.bodies.filter((b) => b.start < at && at < b.end).sort((a, b) => b.start - a.start)[0];
   }
-  return routes;
-}
-function startsWithDirective(source, from, directive) {
-  let i = from;
-  while (i < source.length) {
+  skipSpace(at) {
+    while (/\s/.test(this.code[at] ?? "")) at++;
+    return at;
+  }
+  endOf(at, limit = this.code.length) {
+    if (this.code[at] === "{") return (this.pairs.get(at) ?? limit - 1) + 1;
+    for (let i = at; i < limit; i++) {
+      if (/[;\n}]/.test(this.code[i])) return i;
+      const end = this.pairs.get(i);
+      if (end !== void 0) i = end;
+    }
+    return limit;
+  }
+  /**
+   * 块的顶层有无条件退出即算退出，前面可以有记录日志等语句；
+   * 嵌套分支、函数中的 return 以及无花括号 if/else/循环控制的 return 不算。
+   */
+  exits(from, to) {
+    let at = this.skipSpace(from);
+    if (this.code[at] !== "{") return /^(?:return|throw)\b|^(?:redirect|notFound)\s*\(/.test(this.code.slice(at, to));
+    const end = Math.min(to, this.pairs.get(at) ?? to);
+    at = this.skipSpace(at + 1);
+    while (at < end) {
+      const statement = this.code.slice(at, this.statementEnd(at, end));
+      if (/^return\b/.test(statement) && this.responseExits) {
+        if (/^return\s+(?:(?:await\s+)?(?:reply|res|response)\s*\.[\s\S]*\b(?:send|end|json|sendStatus)\s*\(|(?:c|ctx|context)\s*\.\s*(?:json|text|body|html|redirect|newResponse)\s*\(|new\s+Response\s*\(|next\s*\(\s*[^)\s])/.test(statement)) return true;
+        return false;
+      }
+      if (/^(?:return|throw)\b|^(?:redirect|notFound)\s*\(/.test(statement)) return true;
+      if (this.responseExits && /^reply\s*\.\s*(?:(?:code|status)\s*\([^)]*\)\s*\.\s*)?send\s*\(/.test(this.code.slice(at, end))) return true;
+      const next = this.statementEnd(at, end);
+      if (next <= at) return false;
+      at = this.skipSpace(next);
+    }
+    return false;
+  }
+  /** 跳过完整语句；分支、循环和函数内的退出不提升为外层退出。 */
+  statementEnd(at, limit, depth = 0) {
+    if (depth >= 64) return limit;
+    if (this.code[at] === "{") return (this.pairs.get(at) ?? limit - 1) + 1;
+    const control = /^(if|for(?:\s+await)?|while|with|switch)\s*\(/.exec(this.code.slice(at, at + 80));
+    if (control) {
+      const close = this.pairs.get(at + control[0].length - 1);
+      if (close === void 0) return limit;
+      let end = this.statementEnd(this.skipSpace(close + 1), limit, depth + 1);
+      const next = this.skipSpace(end);
+      if (control[1] === "if" && /^else\b/.test(this.code.slice(next, next + 5))) {
+        end = this.statementEnd(this.skipSpace(next + 4), limit, depth + 1);
+      }
+      return end;
+    }
+    if (/^(?:try|do)\b/.test(this.code.slice(at, at + 8))) return limit;
+    for (let i = at; i < limit; i++) {
+      if (this.code[i] === ";") return i + 1;
+      const close = this.pairs.get(i);
+      if (close !== void 0) {
+        i = close;
+        continue;
+      }
+      if (this.code[i] !== "\n") continue;
+      const before = this.code.slice(at, i).trimEnd();
+      const after = this.code.slice(i + 1, limit).trimStart();
+      if (!before || /[=+\-*/%&|^!?:,.([{<>]$/.test(before)) continue;
+      if (/^[.?+\-*/%&|^,:<>=([{`]/.test(after)) continue;
+      if (/\b(?:const|let|var|function|async|await|new|yield)$/.test(before)) continue;
+      return i + 1;
+    }
+    return limit;
+  }
+  /** 验证与使用须在同一函数，且不能依赖可选分支或被吞掉的异常。 */
+  enforcedBefore(from, to) {
+    const owner = this.owner(from);
+    if (from >= to || owner !== this.owner(to)) return false;
+    const start = owner ? owner.start + 1 : 0;
+    for (let i = start; i < from; i++) {
+      const conditional = /^(?:if|for|while|switch)\s*\(/.exec(this.code.slice(i, i + 32));
+      if (conditional && !/[\w$]/.test(this.code[i - 1] ?? "")) {
+        const close = this.pairs.get(i + conditional[0].length - 1);
+        if (close !== void 0) {
+          const body = this.skipSpace(close + 1);
+          const end2 = this.endOf(body);
+          if (from < end2 && to >= end2) return false;
+        }
+      }
+      const end = this.pairs.get(i);
+      if (end === void 0) continue;
+      if (end < from) {
+        i = end;
+        continue;
+      }
+      if (end >= to) continue;
+      if (this.code[i] === "(" && !/(?:\?\.|\b(?:if|for|while|switch|catch))\s*$/.test(this.code.slice(Math.max(start, i - 20), i))) continue;
+      if (this.code[i] !== "{" || !/\btry\s*$/.test(this.code.slice(Math.max(start, i - 16), i))) return false;
+      let next = this.skipSpace(end + 1);
+      if (/^catch\b/.test(this.code.slice(next))) {
+        next = this.skipSpace(next + 5);
+        if (this.code[next] === "(") next = this.skipSpace((this.pairs.get(next) ?? next) + 1);
+        const caughtEnd = this.endOf(next);
+        if (!this.exits(next, caughtEnd)) return false;
+        next = this.skipSpace(caughtEnd);
+      }
+      if (/^finally\b/.test(this.code.slice(next))) return false;
+    }
+    let boundary = start;
+    for (const [open, close] of this.pairs) {
+      if (this.code[open] === "{" && open < from && close > from) boundary = Math.max(boundary, open + 1);
+    }
+    while (boundary < from) {
+      const next = this.statementEnd(this.skipSpace(boundary), this.code.length);
+      if (next <= boundary || next > from) break;
+      boundary = next;
+    }
+    return !/[?]|&&|\|\||=>/.test(this.code.slice(boundary, from));
+  }
+  /** 找出当前函数中最后一次赋值；未知或条件覆盖同样会使旧证明失效。 */
+  assignment(name, at) {
+    const escaped = name.replace(/\$/g, "\\$");
+    const pattern = new RegExp(`(?<![\\w$.])(?:const\\s+|let\\s+|var\\s+)?${escaped}((?:\\s*\\.[\\w$]+|\\s*\\[[^\\]]*\\])*)\\s*(?::[^=;{}\\n]{0,100})?=(?![=>])`, "g");
+    let result = null;
+    for (const m of this.code.slice(0, at).matchAll(pattern)) {
+      if (this.owner(m.index) !== this.owner(at)) continue;
+      const from = this.skipSpace(m.index + m[0].length);
+      const end = this.endOf(from);
+      if (end <= at) result = { at: m.index, from, end, expression: this.code.slice(from, end).trim(), member: m[1].length > 0 };
+    }
+    return result;
+  }
+};
+function enforcedVerification(source, pattern, synchronous = /(?!)/) {
+  const fragment = new LocalVerification({ path: "middleware.ts", content: source, lines: source.split("\n"), isExampleContext: false });
+  const first = fragment.code.search(/\S/);
+  let body = fragment.code[first] === "{" ? { start: first, end: fragment.pairs.get(first) ?? fragment.code.length - 1 } : fragment.bodies.find((b) => b.declaration >= first);
+  if (body) {
+    const returned = fragment.bodies.find((b) => b.declaration > body.start && b.end < body.end && /^\s*return\s+(?:createMiddleware\s*\(\s*)?(?:async\s*)?(?:\([^)]*\)\s*)?$/.test(fragment.code.slice(body.start + 1, b.declaration)));
+    if (returned) body = returned;
+  }
+  const inner = body ? source.slice(body.start + 1, body.end) : source;
+  const content = `async function __guard__(){
+${inner}
+__continuation__();
+}`;
+  const context = new LocalVerification({ path: "middleware.ts", content, lines: content.split("\n"), isExampleContext: false }, true);
+  const owner = context.bodies[0];
+  let end = content.lastIndexOf("__continuation__");
+  for (const m of context.code.matchAll(/(?<![\w$.])next\s*\(\s*\)/g)) {
+    if (context.owner(m.index) === owner) end = Math.min(end, m.index);
+  }
+  const calls = new RegExp(pattern.source, pattern.flags.includes("g") ? pattern.flags : `${pattern.flags}g`);
+  for (const m of context.code.matchAll(calls)) {
+    if (context.owner(m.index) !== owner || !context.enforcedBefore(m.index, end)) continue;
+    const close = context.pairs.get(m.index + m[0].length - 1);
+    if (close === void 0 || /^[.[]|^\?\./.test(context.code.slice(context.skipSpace(close + 1)))) continue;
+    const before = context.code.slice(Math.max(owner?.start ?? 0, m.index - 300), m.index).replace(/(?:[A-Za-z_$][\w$]*(?:\s*\([^()]*\))?\s*\??\.\s*)*$/, "").trimEnd();
+    if (/(?:^|[^\w$.])(?:await|return)$/.test(before) || synchronous.test(m[0])) return true;
+  }
+  return false;
+}
+
+// src/rules/apiauth.ts
+var APP_ROUTER = /(?:^|\/)app\/api\/(?:.+\/)?route\.[mc]?[jt]sx?$/;
+var PAGES_ROUTER = /(?:^|\/)pages\/api\/.+\.[mc]?[jt]sx?$/;
+var APP_ROUTE_FILE = /(?:^|\/)app\/(?:.+\/)?route\.[mc]?[jt]sx?$/;
+var NEXT_METHODS = "GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS";
+var NEXT_METHOD_EXPORT = new RegExp(
+  String.raw`\bexport\s+(?:async\s+)?function\s+(?:${NEXT_METHODS})\b|\bexport\s+const\s+(?:${NEXT_METHODS})\b|` + // export { handler as GET } 与 Auth.js 的 export const { GET, POST } = handlers；长度有界以免回溯。
+  String.raw`\bexport\s+(?:const\s*)?\{[^{}]{0,500}\b(?:${NEXT_METHODS})\b`
+);
+var SVELTEKIT_ENDPOINT = /^(.*?\/)?src\/routes\/(?:(.*)\/)?\+server\.[mc]?[jt]s$/;
+var SVELTEKIT_PAGE_SERVER = /^(.*?\/)?src\/routes\/(?:(.*)\/)?\+page\.server\.[mc]?[jt]s$/;
+var SVELTEKIT_ACTIONS = /\bexport\s+const\s+actions\b\s*(?::[^=;{}]{0,200})?=\s*\{/;
+var NUXT_ROUTE = /^(.*?\/)?server\/(api|routes)\/(.+)\.[mc]?[jt]s$/;
+var H3_HANDLER = /\b(?:defineEventHandler|eventHandler|defineCachedEventHandler|defineLazyEventHandler)\s*\(/;
+var NUXT_METHOD_SUFFIX = /\.(?:get|post|put|patch|delete|head|options|connect|trace)$/i;
+var REMIX_ROUTE = /^(.*?\/)?app\/routes\/(.+)\.[mc]?[jt]sx?$/;
+var REMIX_EXPORT = /\bexport\s+(?:async\s+)?function\s+(?:loader|action)\b|\bexport\s+const\s+(?:loader|action)\b/;
+var ASTRO_ENDPOINT = /^(.*?\/)?src\/pages\/(.+)\.[mc]?[jt]s$/;
+var ASTRO_EXPORT = /\bexport\s+(?:async\s+)?function\s+(?:GET|POST|PUT|PATCH|DELETE|ALL)\b|\bexport\s+const\s+(?:GET|POST|PUT|PATCH|DELETE|ALL)\b/;
+function isAstroEndpoint(file) {
+  const code = noiseMaskedOf(file);
+  return ASTRO_EXPORT.test(code) && !/\bexport\s+default\b/.test(code);
+}
+function serverActionRoutes(file) {
+  if (!/use server/.test(file.content) || !/\.[mc]?[jt]sx?$/.test(file.path)) return [];
+  const code = noiseMaskedOf(file);
+  const source = commentsMaskedOf(file);
+  const fileLevel = startsWithDirective(source, 0, "use server");
+  const pairs = delimiterPairs(code);
+  const openers = /* @__PURE__ */ new Map();
+  for (const [open, close] of pairs) openers.set(close, open);
+  const exportedList = /* @__PURE__ */ new Set();
+  for (const m of code.matchAll(/\bexport\s*\{([^{}]{0,1000})\}/g)) {
+    for (const part of m[1].split(",")) {
+      const name = /^\s*([A-Za-z_$][\w$]*)/.exec(part)?.[1];
+      if (name) exportedList.add(name);
+    }
+  }
+  const scope = /^(.*?\/)?(?:src|app|lib|actions|server|utils)\//.exec(file.path)?.[1] ?? "";
+  const routes = [];
+  for (const body of functionBodies(code, pairs)) {
+    const inline = startsWithDirective(source, body.start + 1, "use server");
+    const declared = declarationOf(code, body, openers);
+    const exported = fileLevel && declared !== null && (declared.exported || exportedList.has(declared.name));
+    if (!inline && !exported) continue;
+    const name = declared?.name ?? "anonymous";
+    routes.push({
+      file,
+      framework: "next",
+      url: `the server action ${name}`,
+      scope,
+      reachable: { start: body.start, end: body.end },
+      action: name
+    });
+  }
+  return routes;
+}
+function startsWithDirective(source, from, directive) {
+  let i = from;
+  while (i < source.length) {
     while (i < source.length && /\s/.test(source[i])) i++;
     const quote = source[i++];
     if (quote !== "'" && quote !== '"') return false;
@@ -5170,7 +6169,7 @@ var IMPORT_SPEC = /(?:from|import|require)\s*\(?\s*['"]([^'"]+)['"]/g;
 function normalizeSpec(spec, fromPath) {
   if (spec.startsWith(".")) {
     return {
-      key: moduleKey(posix.normalize(posix.join(posix.dirname(fromPath), spec))),
+      key: moduleKey(posix2.normalize(posix2.join(posix2.dirname(fromPath), spec))),
       alias: false
     };
   }
@@ -5797,13 +6796,13 @@ function quotedValue(text) {
 function matcherEntry(text) {
   const trimmed = text.trimStart();
   if (trimmed.startsWith("{")) {
-    const object = sliceDelimited(trimmed, "{", "}");
-    if (object === null) return null;
-    if (topLevelPropertyStart(object, "has") !== null || topLevelPropertyStart(object, "missing") !== null) {
+    const object2 = sliceDelimited(trimmed, "{", "}");
+    if (object2 === null) return null;
+    if (topLevelPropertyStart(object2, "has") !== null || topLevelPropertyStart(object2, "missing") !== null) {
       return { conditional: true };
     }
-    const source = topLevelPropertyStart(object, "source");
-    const pattern2 = source === null ? null : quotedValue(object.slice(source));
+    const source = topLevelPropertyStart(object2, "source");
+    const pattern2 = source === null ? null : quotedValue(object2.slice(source));
     return pattern2 === null ? null : { pattern: pattern2 };
   }
   const pattern = quotedValue(trimmed);
@@ -6018,13 +7017,6 @@ function passesOnlyAuthenticated(code) {
   }
   return false;
 }
-function awaitedCall(code, pattern) {
-  for (const m of code.matchAll(new RegExp(pattern.source, pattern.flags.includes("g") ? pattern.flags : `${pattern.flags}g`))) {
-    const before = code.slice(Math.max(0, m.index - 300), m.index).replace(/(?:[A-Za-z_$][\w$]*(?:\s*\([^()]*\))?\s*\??\.\s*)*$/, "").trimEnd();
-    if (/(?:^|[^\w$.])(?:await|return)$/.test(before)) return true;
-  }
-  return false;
-}
 function maskUnusedFunctions(code) {
   let out = code;
   const definitions = /\b(?:(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*(?::[^=;]{0,200})?=\s*(?:async\b\s*)?(?:function\b[^(]{0,80}\([^()]*\)|\([^()]*\)\s*(?::[^=;{]{0,200})?=>|[A-Za-z_$][\w$]*\s*=>)|(?:async\s+)?function\s*\*?\s*([A-Za-z_$][\w$]*)\s*\([^()]*\))\s*/g;
@@ -6052,7 +7044,7 @@ function maskUnusedFunctions(code) {
   return out;
 }
 function jwtVerifyRejects(code) {
-  if (!awaitedCall(code, /\bjwtVerify\s*\(/)) return false;
+  if (!enforcedVerification(code, /\bjwtVerify\s*\(/)) return false;
   const handlers = [...code.matchAll(/\bcatch\s*(?:\([^()]*\))?\s*\{/g)].map((m) => {
     const open = m.index + m[0].length - 1;
     return code.slice(open, closingDelimiter(code, open, "{", "}") ?? open);
@@ -6079,7 +7071,8 @@ function catchDenies(code) {
     const tryOpen = m.index + m[0].length - 1;
     const tryClose = closingDelimiter(code, tryOpen, "{", "}");
     if (tryClose === null) continue;
-    if (!/\b\w*(?:auth|valid|verify|session|token|user|client|key|secret|permission|access)\w*\s*\(/i.test(code.slice(tryOpen, tryClose))) continue;
+    const calls = /\b\w*(?:auth|valid|verify|session|token|user|client|key|secret|permission|access)\w*\s*\(/i;
+    if (!enforcedVerification(code, calls, /^(?:assertAuth(?:enticated)?|constructEvent)\b/i)) continue;
     const handler = /^\s*catch\s*(?:\([^()]*\))?\s*\{/.exec(code.slice(tryClose + 1));
     if (!handler) continue;
     const open = tryClose + handler[0].length;
@@ -6115,8 +7108,8 @@ function rejectsMissingCredential(code) {
 }
 function middlewareRejects(source) {
   const code = maskUnusedFunctions(source);
-  if (hasConditionalAuthGuard(code) || rejectsMissingCredential(code) || passesOnlyAuthenticated(code) || rejectsSecretMismatch(code) || catchDenies(code) || AUTH_ENFORCING_CALL.test(code) || jwtVerifyRejects(code)) return true;
-  return (/\b(?:jwt\s*\.\s*verify|verifyToken|verifyJwt|verifyIdToken|verifyAccessToken)\s*\(/.test(code) || awaitedCall(code, /\bjwtVerify\s*\(/)) && DENIED_RESPONSE.test(code);
+  if (hasConditionalAuthGuard(code) || rejectsMissingCredential(code) || passesOnlyAuthenticated(code) || rejectsSecretMismatch(code) || catchDenies(code) || enforcedVerification(code, AUTH_ENFORCING_CALL, /^(?:assertAuth(?:enticated)?|constructEvent)\b/i) || jwtVerifyRejects(code)) return true;
+  return false;
 }
 function middlewareStatus(ref, files, depth = 0) {
   const composition = depth < 3 ? authCompositionOf(ref) : null;
@@ -6142,7 +7135,7 @@ function middlewareStatus(ref, files, depth = 0) {
       if (inner.status === "guard") return { status: "guard", name };
     }
   } else if (/^[A-Za-z_$][\w$]*\s*\.\s*[A-Za-z_$][\w$]*$/.test(ref.text)) {
-    const plugin = FASTIFY_AUTH_DECORATORS.find(([pkg, decorator]) => decorator === name && files.some((file) => file.content.includes(`'${pkg}'`) || file.content.includes(`"${pkg}"`)));
+    const plugin = FASTIFY_AUTH_DECORATORS.find(([pkg, decorator]) => decorator === name && registeredAuthPlugin(ref, pkg));
     if (plugin) return { status: "guard", name };
   }
   return { status: AUTH_HELPER_NAME.test(name) ? "unconfirmed" : "none", name };
@@ -6989,12 +7982,13 @@ function fixedTablesOf(code, source, pairs) {
   return result;
 }
 var InputFlow = class {
-  constructor(code, source, span, pairs, roles, fixedTables) {
+  constructor(code, source, span, pairs, roles, fixedTables, definition) {
     this.code = code;
     this.source = source;
     this.span = span;
     this.pairs = pairs;
     this.fixedTables = fixedTables;
+    this.definition = definition;
     for (const [name, at] of roles.values) this.parameters.set(name, { level: "direct", origin: at, names: /* @__PURE__ */ new Set([name]), ownUrl: false });
     this.sourcePattern = sourceRegex(roles);
     this.contextRead = roles.contexts.size > 0 ? new RegExp(String.raw`(?<![\w$.])(?:${namePattern(roles.contexts.keys())})\s*\??\.\s*req(?:\s*\??\.\s*raw)?\s*\??\.\s*(${HONO_READ_CALLS})\s*\(`) : null;
@@ -7039,6 +8033,7 @@ var InputFlow = class {
   span;
   pairs;
   fixedTables;
+  definition;
   parameters = /* @__PURE__ */ new Map();
   limited = false;
   assignmentList = /* @__PURE__ */ new Map();
@@ -7148,7 +8143,8 @@ var InputFlow = class {
     if (!new RegExp(`^(?:(?:await|new)\\s+)*${escaped}\\s*\\(`).test(expression)) return false;
     const cached = this.mirrors.get(callee);
     if (cached !== void 0) return cached;
-    const code = this.code;
+    let code = this.code;
+    let pairs = this.pairs;
     let params = "";
     let after = -1;
     const declared = new RegExp(`(?:^|[^\\w$.])(?:async\\s+)?function\\s*\\*?\\s*${escaped}\\s*\\(`).exec(code);
@@ -7159,21 +8155,31 @@ var InputFlow = class {
       after = match.index + match[0].length;
     } else if (match) {
       const open = match.index + match[0].length - 1;
-      const close = this.pairs.get(open);
+      const close = pairs.get(open);
       if (close !== void 0) {
         params = code.slice(open + 1, close);
         after = close + 1;
       }
     }
+    if (!match) {
+      const target = this.definition?.(callee);
+      if (target) {
+        code = noiseMaskedOf(target.file);
+        pairs = delimiterPairs(code);
+        params = functionParams(target).join(",");
+        after = code[target.start] === "{" ? target.start : code.indexOf("=>", target.start) + 2;
+        if (after < target.start || after > target.end) after = -1;
+      }
+    }
     let result = false;
     if (after !== -1) {
       const names = params.split(",").flatMap((part) => part.replace(/[:=][\s\S]*$/, "").match(/[A-Za-z_$][\w$]*/g) ?? []);
       const head = /^\s*(?::[^={]{0,200})?(?:=>)?\s*/.exec(code.slice(after, after + 260));
       const start = after + head[0].length;
-      const end = (from, limit) => expressionEnd2(code, from, limit, this.pairs, () => {
+      const end = (from, limit) => expressionEnd2(code, from, limit, pairs, () => {
         this.limited = true;
       });
-      const bodyEnd = this.pairs.get(start) ?? start;
+      const bodyEnd = pairs.get(start) ?? start;
       const returns = code[start] === "{" ? [...code.slice(start, bodyEnd).matchAll(/\breturn\b/g)].map((m) => {
         const from = start + m.index + m[0].length;
         return code.slice(from, end(from, bodyEnd));
@@ -7454,12 +8460,13 @@ function lowerBound(values, value) {
   return low;
 }
 var HandlerFile = class {
-  constructor(code, source, pairs, lineStarts, candidates) {
+  constructor(code, source, pairs, lineStarts, candidates, definition) {
     this.code = code;
     this.source = source;
     this.pairs = pairs;
     this.lineStarts = lineStarts;
     this.candidates = candidates;
+    this.definition = definition;
     this.fixedTables = fixedTablesOf(code, source, pairs);
   }
   code;
@@ -7467,6 +8474,7 @@ var HandlerFile = class {
   pairs;
   lineStarts;
   candidates;
+  definition;
   flows = /* @__PURE__ */ new Map();
   fixedTables;
   get limited() {
@@ -7483,7 +8491,7 @@ var HandlerFile = class {
       if (first >= positions.length || positions[first] >= body.end) continue;
       let flow = this.flows.get(candidate);
       if (!flow) {
-        flow = new InputFlow(this.code, this.source, { start: body.start, end: body.end }, this.pairs, candidate.roles, this.fixedTables);
+        flow = new InputFlow(this.code, this.source, { start: body.start, end: body.end }, this.pairs, candidate.roles, this.fixedTables, this.definition);
         this.flows.set(candidate, flow);
       }
       result.push({ route: candidate.route, body, flow });
@@ -7528,7 +8536,14 @@ function handlerFileOf(file, files) {
           if (hasInput(roles)) candidates.push({ route: r, body, roles });
         }
       }
-      if (candidates.length > 0) result = new HandlerFile(code, source, pairs, lineStartsOf(file.content), candidates);
+      if (candidates.length > 0) result = new HandlerFile(
+        code,
+        source,
+        pairs,
+        lineStartsOf(file.content),
+        candidates,
+        (name) => calleeDefinition(file, name, null, files)
+      );
     }
   }
   handlerCache.set(file, result);
@@ -8050,140 +9065,6 @@ function check(ctx, kind) {
 var ssrfRule = { id: "ssrf/request-url", severity: "P1", check: (ctx) => check(ctx, "ssrf") };
 var redirectRule = { id: "redirect/open", severity: "P2", check: (ctx) => check(ctx, "redirect") };
 
-// src/rules/verification.ts
-var LocalVerification = class {
-  code;
-  source;
-  pairs;
-  bodies;
-  constructor(file) {
-    this.code = noiseMaskedOf(file);
-    this.source = commentsMaskedOf(file);
-    this.pairs = delimiterPairs(this.code);
-    this.bodies = functionBodies(this.code, this.pairs);
-  }
-  owner(at) {
-    return this.bodies.filter((b) => b.start < at && at < b.end).sort((a, b) => b.start - a.start)[0];
-  }
-  skipSpace(at) {
-    while (/\s/.test(this.code[at] ?? "")) at++;
-    return at;
-  }
-  endOf(at, limit = this.code.length) {
-    if (this.code[at] === "{") return (this.pairs.get(at) ?? limit - 1) + 1;
-    for (let i = at; i < limit; i++) {
-      if (/[;\n}]/.test(this.code[i])) return i;
-      const end = this.pairs.get(i);
-      if (end !== void 0) i = end;
-    }
-    return limit;
-  }
-  /**
-   * 块的顶层有无条件退出即算退出，前面可以有记录日志等语句；
-   * 嵌套分支、函数中的 return 以及无花括号 if/else/循环控制的 return 不算。
-   */
-  exits(from, to) {
-    let at = this.skipSpace(from);
-    if (this.code[at] !== "{") return /^(?:return|throw)\b|^(?:redirect|notFound)\s*\(/.test(this.code.slice(at, to));
-    const end = Math.min(to, this.pairs.get(at) ?? to);
-    at = this.skipSpace(at + 1);
-    while (at < end) {
-      if (/^(?:return|throw)\b|^(?:redirect|notFound)\s*\(/.test(this.code.slice(at, at + 32))) return true;
-      const next = this.statementEnd(at, end);
-      if (next <= at) return false;
-      at = this.skipSpace(next);
-    }
-    return false;
-  }
-  /** 跳过完整语句；分支、循环和函数内的退出不提升为外层退出。 */
-  statementEnd(at, limit, depth = 0) {
-    if (depth >= 64) return limit;
-    if (this.code[at] === "{") return (this.pairs.get(at) ?? limit - 1) + 1;
-    const control = /^(if|for(?:\s+await)?|while|with|switch)\s*\(/.exec(this.code.slice(at, at + 80));
-    if (control) {
-      const close = this.pairs.get(at + control[0].length - 1);
-      if (close === void 0) return limit;
-      let end = this.statementEnd(this.skipSpace(close + 1), limit, depth + 1);
-      const next = this.skipSpace(end);
-      if (control[1] === "if" && /^else\b/.test(this.code.slice(next, next + 5))) {
-        end = this.statementEnd(this.skipSpace(next + 4), limit, depth + 1);
-      }
-      return end;
-    }
-    if (/^(?:try|do)\b/.test(this.code.slice(at, at + 8))) return limit;
-    for (let i = at; i < limit; i++) {
-      if (this.code[i] === ";") return i + 1;
-      const close = this.pairs.get(i);
-      if (close !== void 0) {
-        i = close;
-        continue;
-      }
-      if (this.code[i] !== "\n") continue;
-      const before = this.code.slice(at, i).trimEnd();
-      const after = this.code.slice(i + 1, limit).trimStart();
-      if (!before || /[=+\-*/%&|^!?:,.([{<>]$/.test(before)) continue;
-      if (/^[.?+\-*/%&|^,:<>=([{`]/.test(after)) continue;
-      if (/\b(?:const|let|var|function|async|await|new|yield)$/.test(before)) continue;
-      return i + 1;
-    }
-    return limit;
-  }
-  /** 验证与使用须在同一函数，且不能依赖可选分支或被吞掉的异常。 */
-  enforcedBefore(from, to) {
-    const owner = this.owner(from);
-    if (from >= to || owner !== this.owner(to)) return false;
-    const start = owner ? owner.start + 1 : 0;
-    for (let i = start; i < from; i++) {
-      const conditional = /^(?:if|for|while|switch)\s*\(/.exec(this.code.slice(i, i + 32));
-      if (conditional && !/[\w$]/.test(this.code[i - 1] ?? "")) {
-        const close = this.pairs.get(i + conditional[0].length - 1);
-        if (close !== void 0) {
-          const body = this.skipSpace(close + 1);
-          const end2 = this.endOf(body);
-          if (from < end2 && to >= end2) return false;
-        }
-      }
-      const end = this.pairs.get(i);
-      if (end === void 0) continue;
-      if (end < from) {
-        i = end;
-        continue;
-      }
-      if (end >= to) continue;
-      if (this.code[i] !== "{" || !/\btry\s*$/.test(this.code.slice(Math.max(start, i - 16), i))) return false;
-      let next = this.skipSpace(end + 1);
-      if (/^catch\b/.test(this.code.slice(next))) {
-        next = this.skipSpace(next + 5);
-        if (this.code[next] === "(") next = this.skipSpace((this.pairs.get(next) ?? next) + 1);
-        const caughtEnd = this.endOf(next);
-        if (!this.exits(next, caughtEnd)) return false;
-        next = this.skipSpace(caughtEnd);
-      }
-      if (/^finally\b/.test(this.code.slice(next))) return false;
-    }
-    const boundary = Math.max(
-      start,
-      this.code.lastIndexOf(";", from - 1) + 1,
-      this.code.lastIndexOf("\n", from - 1) + 1,
-      this.code.lastIndexOf("{", from - 1) + 1
-    );
-    return !/[?]|&&|\|\|/.test(this.code.slice(boundary, from));
-  }
-  /** 找出当前函数中最后一次赋值；未知或条件覆盖同样会使旧证明失效。 */
-  assignment(name, at) {
-    const escaped = name.replace(/\$/g, "\\$");
-    const pattern = new RegExp(`(?<![\\w$.])(?:const\\s+|let\\s+|var\\s+)?${escaped}((?:\\s*\\.[\\w$]+|\\s*\\[[^\\]]*\\])*)\\s*(?::[^=;{}\\n]{0,100})?=(?![=>])`, "g");
-    let result = null;
-    for (const m of this.code.slice(0, at).matchAll(pattern)) {
-      if (this.owner(m.index) !== this.owner(at)) continue;
-      const from = this.skipSpace(m.index + m[0].length);
-      const end = this.endOf(from);
-      if (end <= at) result = { at: m.index, from, end, expression: this.code.slice(from, end).trim(), member: m[1].length > 0 };
-    }
-    return result;
-  }
-};
-
 // src/rules/session.ts
 var GET_SESSION = /\.auth\s*\.\s*getSession\s*\(/g;
 function verifiedSession(file, context, sessionAt, names) {
@@ -8321,7 +9202,7 @@ var READS_BODY = /(?<![\w$])(?:req|request)\s*(?:\.\s*raw\s*)?\.\s*(?:json|text|
 var SIGNATURE_HEADER = /['"]stripe-signature['"]/i;
 function middlewareVerifies(code) {
   const masked = maskUnusedFunctions(code);
-  const verifies = /\bconstructEvent\s*\(/.test(masked) || awaitedCall(masked, /\bconstructEventAsync\s*\(/);
+  const verifies = enforcedVerification(masked, /\bconstructEvent(?:Async)?\s*\(/, /^constructEvent\s*\(/);
   if (!verifies) return false;
   for (const m of masked.matchAll(/\bcatch\s*(?:\([^()]*\))?\s*\{/g)) {
     const open = m.index + m[0].length - 1;
@@ -8347,6 +9228,8 @@ function verifiedByMiddleware(route, files) {
     const masked = maskUnusedFunctions(code);
     const calls = [...masked.matchAll(/(?<![\w$.])([A-Za-z_$][\w$]*)\s*(?:\.\s*([A-Za-z_$][\w$]*)\s*)?\(/g)].slice(0, 16);
     return calls.some((m) => {
+      const call = new RegExp(`(?<![\\w$.])${m[1].replace(/\$/g, "\\$")}${m[2] ? `\\s*\\.\\s*${m[2].replace(/\$/g, "\\$")}` : ""}\\s*\\(`);
+      if (!enforcedVerification(masked, call)) return false;
       const definition = calleeDefinition(file, m[1], m[2] ?? null, files);
       return definition !== null && middlewareVerifies(commentsMaskedOf(definition.file).slice(definition.start, definition.end + 1));
     });
@@ -8457,7 +9340,106 @@ function shouldRunRule(id, only, skip) {
 }
 
 // src/engine.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash3 } from "crypto";
+
+// src/diagnostics.ts
+var ScanInputError = class extends TypeError {
+  code = "INVALID_ARGUMENT";
+};
+function diagnosticCodeOf(error) {
+  if (error.kind === "crashed") return "RULE_EXECUTION_FAILED";
+  if (["engine/openapi-routes", "engine/router-factories", "engine/route-registration"].includes(error.ruleId)) return "ROUTE_UNRESOLVED";
+  if (error.ruleId === "engine/findings-limit") return "FINDINGS_LIMIT";
+  if (error.ruleId.startsWith("gitleak/")) return "GIT_CHECK_INCOMPLETE";
+  return "ANALYSIS_INCOMPLETE";
+}
+
+// src/scan-control.ts
+var ScanCancelledError = class extends Error {
+  code = "SCAN_CANCELLED";
+  constructor() {
+    super("Scan cancelled.");
+    this.name = "AbortError";
+  }
+};
+var ScanProgressError = class extends Error {
+  code = "PROGRESS_CALLBACK_FAILED";
+  constructor(cause) {
+    super("Scan progress callback failed.", { cause });
+  }
+};
+function checkScanCancelled(signal) {
+  if (signal?.aborted) throw new ScanCancelledError();
+}
+async function waitForProgress(value, signal) {
+  if (!signal) {
+    await value;
+    return;
+  }
+  let onAbort = () => {
+  };
+  const aborted = new Promise((_, reject) => {
+    onAbort = () => reject(new ScanCancelledError());
+    signal.addEventListener("abort", onAbort, { once: true });
+    if (signal.aborted) onAbort();
+  });
+  try {
+    await Promise.race([Promise.resolve(value), aborted]);
+  } finally {
+    signal.removeEventListener("abort", onAbort);
+  }
+}
+function createScanControl(options) {
+  const { signal, onProgress } = options;
+  return {
+    active: signal !== void 0 || onProgress !== void 0,
+    check: () => checkScanCancelled(signal),
+    async checkpoint(progress) {
+      checkScanCancelled(signal);
+      await new Promise((resolve3) => setImmediate(resolve3));
+      checkScanCancelled(signal);
+      if (onProgress) {
+        try {
+          await waitForProgress(onProgress(Object.freeze({ ...progress })), signal);
+        } catch (error) {
+          if (signal?.aborted || error instanceof ScanCancelledError) throw new ScanCancelledError();
+          throw new ScanProgressError(error);
+        }
+      }
+      checkScanCancelled(signal);
+    }
+  };
+}
+
+// src/exclusions.ts
+var MAX_EXCLUSIONS = 64;
+var MAX_EXCLUSION_LENGTH = 512;
+var SEGMENT = String.raw`[^\s/\\](?:[^/\\]*[^\s/\\])?`;
+var EXCLUSION_PATH_PATTERN = String.raw`^(?![!])(?!.*[:*?\[\]{}\u0000-\u001f\u007f-\u009f\u2028\u2029])(?!(?:.*[/\\])?\.{1,2}(?:[/\\]|$))` + SEGMENT + String.raw`(?:[/\\]` + SEGMENT + String.raw`)*[/\\]?$`;
+var PATH = new RegExp(EXCLUSION_PATH_PATTERN);
+function isExclusionPath(value) {
+  return typeof value === "string" && value.length > 0 && value.length <= MAX_EXCLUSION_LENGTH && PATH.test(value);
+}
+function createExclusions(values = []) {
+  if (values.length > MAX_EXCLUSIONS || !values.every(isExclusionPath)) throw new TypeError("Exclusions must be at most 64 literal relative paths without traversal, wildcards or control characters.");
+  const requested = [...new Set(values.map((value) => value.replace(/\\/g, "/").replace(/\/$/, "")))];
+  const matched = /* @__PURE__ */ new Set();
+  return {
+    requested,
+    matches(path) {
+      const normalized = path.replace(/\\/g, "/").replace(/\/$/, "");
+      let excluded = false;
+      for (const prefix of requested) if (normalized === prefix || normalized.startsWith(prefix + "/")) {
+        matched.add(prefix);
+        excluded = true;
+      }
+      return excluded;
+    },
+    matched: () => [...matched].sort()
+  };
+}
+
+// src/engine.ts
 var SEVERITY_ORDER = { P0: 0, P1: 1, P2: 2 };
 var CONFIDENCE_ORDER = { certain: 0, likely: 1 };
 function dedupe(findings) {
@@ -8486,7 +9468,7 @@ function sanitize(findings, files) {
     const file = f.file === null ? void 0 : byPath.get(f.file);
     const source = f.line === null ? file?.content : file?.lines[f.line - 1];
     return source === void 0 ? {} : {
-      sourceFingerprint: createHash2("sha256").update(source.trim(), "utf8").digest("hex")
+      sourceFingerprint: createHash3("sha256").update(source.trim(), "utf8").digest("hex")
     };
   };
   return findings.map((f) => ({
@@ -8521,9 +9503,9 @@ function sanitizeSkippedForOutput(items) {
   }));
 }
 function downgradeExampleContext(findings, files) {
-  const examples = new Set(files.filter((f) => f.isExampleContext).map((f) => f.path));
+  const examples2 = new Set(files.filter((f) => f.isExampleContext).map((f) => f.path));
   return findings.map(
-    (f) => f.file !== null && examples.has(f.file) ? { ...f, confidence: "likely" } : f
+    (f) => f.file !== null && examples2.has(f.file) ? { ...f, confidence: "likely" } : f
   );
 }
 function suppressIgnoredLines(findings, files) {
@@ -8576,20 +9558,36 @@ function sortFindings(findings) {
 }
 async function scan(root, options = {}) {
   const started = Date.now();
+  const exclusions = createExclusions(options.exclude);
+  const control = createScanControl(options);
+  control.check();
+  const progress = {
+    phase: "discovery",
+    filesCompleted: 0,
+    filesTotal: null,
+    projectRulesCompleted: 0,
+    projectRulesTotal: null
+  };
+  if (control.active) await control.checkpoint(progress);
   const gitExecutable = resolveGitExecutable(root);
   const git2 = detectGitRepo(root, gitExecutable);
   const honorIgnoreMarkers = options.honorIgnoreMarkers !== false;
-  const { files, skipped, ignored, vendored } = collectFiles(root, git2 === "repo", gitExecutable, {}, honorIgnoreMarkers);
+  const { files, skipped, ignored, vendored } = collectFiles(root, git2 === "repo", gitExecutable, {}, honorIgnoreMarkers, exclusions.matches);
   const findings = [];
   const errors = [];
   const fileRules = FILE_RULES.filter((rule2) => shouldRunRule(rule2.id, options.only ?? [], options.skip ?? []));
   const projectRules = PROJECT_RULES.filter((rule2) => shouldRunRule(rule2.id, options.only ?? [], options.skip ?? []));
+  progress.filesTotal = files.length;
+  progress.projectRulesTotal = projectRules.length;
+  progress.phase = "files";
+  if (control.active) await control.checkpoint(progress);
   const incompleteSeen = /* @__PURE__ */ new Set();
   const ctx = {
     root,
     files,
     git: git2,
     gitExecutable,
+    excludePath: exclusions.matches,
     // 统一记录不完整状态，避免重复提示。
     reportIncomplete: (ruleId, message) => {
       if (incompleteSeen.has(`${ruleId} ${message}`)) return;
@@ -8598,6 +9596,7 @@ async function scan(root, options = {}) {
     }
   };
   for (const file of files) {
+    control.check();
     for (const rule2 of fileRules) {
       try {
         if (!rule2.appliesTo(file)) continue;
@@ -8606,13 +9605,29 @@ async function scan(root, options = {}) {
         errors.push({ ruleId: rule2.id, file: file.path, message: messageOf(err), kind: "crashed" });
       }
     }
+    progress.filesCompleted++;
+    if (control.active && progress.filesCompleted % 32 === 0) await control.checkpoint(progress);
   }
+  if (control.active) await control.checkpoint(progress);
   for (const rule2 of projectRules) {
+    progress.phase = rule2.id.startsWith("gitleak/") ? "history" : "project";
+    if (control.active) await control.checkpoint(progress);
     try {
       findings.push(...await rule2.check(ctx));
     } catch (err) {
       errors.push({ ruleId: rule2.id, file: null, message: messageOf(err), kind: "crashed" });
     }
+    control.check();
+    progress.projectRulesCompleted++;
+  }
+  progress.phase = "finalize";
+  if (control.active) await control.checkpoint(progress);
+  if ([...fileRules, ...projectRules].some((rule2) => /^(?:api|auth|injection|ssrf|redirect|webhook)\//.test(rule2.id))) {
+    try {
+      reportOpenapiBatchCoverage(ctx);
+    } catch (err) {
+      errors.push({ ruleId: "engine/openapi-routes", file: null, message: messageOf(err), kind: "crashed" });
+    }
   }
   const deduped = dedupe(downgradeExampleContext(findings, files));
   const { kept, ignored: ignoredFindings } = honorIgnoreMarkers ? suppressIgnoredLines(deduped, files) : { kept: deduped, ignored: [] };
@@ -8628,12 +9643,14 @@ async function scan(root, options = {}) {
     );
     return false;
   });
-  return {
+  const result = {
+    ...exclusions.requested.length ? { exclusions: { requested: exclusions.requested.map(clean), matched: exclusions.matched().map(clean) } } : {},
     findings: sanitize(bounded, files),
     filesScanned: files.length,
     durationMs: Date.now() - started,
     errors: errors.map((e) => ({
       ...e,
+      code: e.code ?? diagnosticCodeOf(e),
       file: e.file === null ? null : clean(e.file),
       message: clean(e.message)
     })),
@@ -8651,14 +9668,113 @@ async function scan(root, options = {}) {
     // 主动忽略不影响完整性；错误、跳过或零文件扫描均标记为未完成。
     partial: errors.length > 0 || skipped.length > 0 || files.length === 0
   };
+  progress.phase = "complete";
+  if (control.active) await control.checkpoint(progress);
+  return result;
 }
 function messageOf(err) {
   if (err instanceof Error) return err.message;
   return String(err);
 }
 
+// src/rules/examples.ts
+var publicEnv = {
+  context: "Server-only environment value",
+  before: "NEXT_PUBLIC_SERVER_TOKEN=<private value>",
+  after: "SERVER_TOKEN=<server-only value>",
+  limitation: "Use the value only in server code. Rotate any exposed credential; renaming does not revoke it."
+};
+var auth = {
+  context: "Supabase route with a request-scoped session client and a separate admin client",
+  before: "await admin.from('items').delete().eq('id', id);",
+  after: "const { data: { user }, error } = await sessionClient.auth.getUser();\nif (error || !user) return new Response(null, { status: 401 });\nif (!await canDelete(user.id, id)) return new Response(null, { status: 403 });\nawait admin.from('items').delete().eq('id', id);",
+  limitation: "Bind sessionClient to the caller. Implement canDelete with actual resource ownership or permissions; authentication alone is insufficient."
+};
+var firestore = {
+  context: "Firestore document ownership",
+  before: "match /users/{uid} { allow read, write: if true; }",
+  after: "match /users/{uid} {\n  allow read, write: if request.auth != null && request.auth.uid == uid;\n}",
+  limitation: "Firestore syntax only. Review field validation and overlapping rules; adapt ownership to the data model."
+};
+var cors = {
+  context: "Express cors middleware with credentialed access from one trusted site",
+  before: "app.use(cors({ origin: true, credentials: true }));",
+  after: "app.use(cors({ origin: 'https://app.example.com', credentials: true }));",
+  limitation: "Replace the example origin with an exact trusted origin. CORS does not replace authentication, authorization or CSRF controls."
+};
+var examples = {
+  "api/admin-db-access-without-auth": auth,
+  "api/db-write-without-auth": auth,
+  "exposure/private-name-in-public-env": publicEnv,
+  "exposure/secret-in-public-env": publicEnv,
+  "exposure/supabase-service-role-in-client": {
+    ...publicEnv,
+    context: "Supabase admin credential",
+    limitation: "Never ship an admin key to the client. Use a publishable/anon key with appropriate RLS for client access; rotate exposed admin credentials."
+  },
+  "cors/reflected-origin-with-credentials": cors,
+  "cors/wildcard-with-credentials": { ...cors, before: "app.use(cors({ origin: '*', credentials: true }));" },
+  "firebase/open-rules": firestore,
+  "firebase/test-mode-rules": { ...firestore, before: "allow read, write: if request.time < timestamp.date(2030, 1, 1);" },
+  "supabase/rls-not-enabled": {
+    context: "Supabase table with a UUID owner_id column",
+    before: "CREATE TABLE public.notes (id uuid PRIMARY KEY, owner_id uuid NOT NULL, body text);",
+    after: "ALTER TABLE public.notes ENABLE ROW LEVEL SECURITY;\nCREATE POLICY owner_access ON public.notes TO authenticated\nUSING ((SELECT auth.uid()) = owner_id)\nWITH CHECK ((SELECT auth.uid()) = owner_id);",
+    limitation: "Apply ownership checks appropriate to the application. Review grants and other policies; service-role access bypasses RLS."
+  },
+  "auth/unverified-session": {
+    context: "Server-side Supabase identity verification",
+    before: "const { data: { session } } = await supabase.auth.getSession();\nif (!session) return new Response(null, { status: 401 });",
+    after: "const { data: { user }, error } = await supabase.auth.getUser();\nif (error || !user) return new Response(null, { status: 401 });",
+    limitation: "Use a client bound to the current request. Verified identity still requires resource-specific authorization."
+  },
+  "injection/sql": {
+    context: "PostgreSQL driver with bound parameters",
+    before: 'await db.query("SELECT * FROM users WHERE id = " + id);',
+    after: "await db.query('SELECT * FROM users WHERE id = $1', [id]);",
+    limitation: "Use the parameter syntax of your actual driver. Parameters do not substitute table names or authorize access."
+  },
+  "injection/command": {
+    context: "A fixed executable with separately validated arguments",
+    before: "exec('tool --input ' + requestValue);",
+    after: "execFile(TRUSTED_EXECUTABLE, ['--input', validatedValue], { shell: false });",
+    limitation: "Set TRUSTED_EXECUTABLE to a trusted absolute path. Validate argument meaning and filesystem access; never let the caller choose the executable."
+  },
+  "redirect/open": {
+    context: "Named destinations on a fixed application origin",
+    before: "return Response.redirect(requestedUrl);",
+    after: "const path = destination === 'settings' ? '/settings' : '/dashboard';\nreturn Response.redirect(new URL(path, APP_ORIGIN));",
+    limitation: "APP_ORIGIN must be trusted configuration, not a request header. Do not replace the fixed paths with caller-controlled URLs."
+  },
+  "ssrf/request-url": {
+    context: "Named server resources instead of caller-provided hosts",
+    before: "return fetch(requestedUrl);",
+    after: "if (resource !== 'status') return new Response(null, { status: 400 });\nreturn fetch('https://api.example.com/status', { redirect: 'error' });",
+    limitation: "Use a destination you control. Review DNS and egress restrictions; a URL allowlist alone is not a complete SSRF defense."
+  },
+  "webhook/unverified-signature": {
+    context: "Stripe webhook using the original request-body bytes",
+    before: "const event = JSON.parse(rawBody);\nawait handle(event);",
+    after: "let event;\ntry { event = stripe.webhooks.constructEvent(rawBody, signature, SERVER_SIGNING_SECRET); }\ncatch { return new Response(null, { status: 400 }); }\nawait handle(event);",
+    limitation: "Preserve raw bytes and use the endpoint signing secret. Verification must finish before side effects; implement replay/idempotency handling separately."
+  }
+};
+function fixExampleFor(ruleId) {
+  if (SECRET_PATTERNS.some((pattern) => !pattern.publicByDesign && ruleId === `secrets/hardcoded/${pattern.id}`)) return {
+    context: "A credential used only by a server runtime",
+    before: "const apiKey = '<private value>';",
+    after: "const apiKey = process.env.SERVICE_API_KEY;\nif (!apiKey) throw new Error('Server credential is missing');",
+    limitation: "Use trusted server-side configuration, never a public/client environment prefix. Rotate the old credential and review history and deployed bundles."
+  };
+  if (!Object.hasOwn(examples, ruleId)) return null;
+  return { ...examples[ruleId] };
+}
+
 // src/rules/catalog.ts
-var rule = (id, name, severity, confidence, scope, limitation) => ({ id, name, severity, confidence, scope, limitation, reportsFindings: true });
+var rule = (id, name, severity, confidence, scope, limitation) => {
+  const example = fixExampleFor(id);
+  return { id, name, severity, confidence, scope, limitation, reportsFindings: true, ...example ? { example } : {} };
+};
 var RULE_CATALOG = [
   rule(
     "api/admin-db-access-without-auth",
@@ -8673,8 +9789,8 @@ var RULE_CATALOG = [
     "Database write without a recognized auth guard",
     "P1",
     "likely",
-    "Server routes and Next.js Server Functions in Next.js, SvelteKit (endpoints and form actions), Nuxt, Remix/React Router, Astro, Express, Hono, and Fastify.",
-    "Session-scoped clients and indirect guards may need manual review. In Express, Hono, and Fastify routes, writes in called project functions are followed two levels deep; file-based routes report writes in the route file only. Hono app.openapi() routes are not analysed."
+    "Server routes and Next.js Server Functions in Next.js, SvelteKit (endpoints and form actions), Nuxt, Remix/React Router, Astro, Express, Hono (including OpenAPIHono.openapi and openapiRoutes), and Fastify.",
+    "Session-scoped clients and indirect guards may need manual review. In Express, Hono, and Fastify routes, writes in called project functions are followed two levels deep; file-based routes report writes in the route file only. OpenAPI configuration follows constants and static ESM imports/re-exports within eight resolution steps. Unresolved configuration does not suppress findings; unresolved batch entries or handlers mark coverage incomplete. OpenAPI security declarations are not authentication, and arbitrary module side effects are not modelled."
   ),
   rule(
     "auth/unverified-session",
@@ -8850,10 +9966,7 @@ function verdictOf(findings) {
   return { blocking, minor, unsure };
 }
 
-// src/index.ts
-function listRules() {
-  return RULE_CATALOG.map((rule2) => ({ ...rule2 }));
-}
+// src/summary.ts
 function summarize(result) {
   const verdict = verdictOf(result.findings);
   const findings = result.changeView?.totalFindings ?? result.findings.length;
@@ -8867,37 +9980,69 @@ function summarize(result) {
     exitCode: blocking > 0 ? 1 : findings > 0 ? 2 : partial ? 3 : 0
   };
 }
+
+// src/build-info.ts
+var VERSION = true ? "0.8.0-rc.1" : "0.0.0-dev";
+var identity = typeof define_CANSHIP_BUILD_INFO_default === "object" ? define_CANSHIP_BUILD_INFO_default : { version: VERSION, channel: "development", revision: null, dirty: null };
+function getBuildInfo() {
+  return { ...identity };
+}
+function getCapabilities() {
+  return {
+    staticScan: { network: false, projectCodeExecution: false, projectWrites: false },
+    fileOutputs: "explicit-only",
+    onlineValidation: true,
+    onlineValidationPolicy: { cliOnly: true, defaultEnabled: false, confirmation: "plan-digest", credentials: false, responseBodiesRetained: false }
+  };
+}
+
+// src/index.ts
+function listRules() {
+  return RULE_CATALOG.map((rule2) => ({ ...rule2, ...rule2.example ? { example: { ...rule2.example } } : {} }));
+}
 async function scan2(root, options = {}) {
-  if (typeof root !== "string" || root.length === 0) throw new TypeError("Scan root must be a non-empty path.");
+  if (typeof root !== "string" || root.length === 0) throw new ScanInputError("Scan root must be a non-empty path.");
   if (options === null || typeof options !== "object" || Array.isArray(options)) {
-    throw new TypeError("Scan options must be an object.");
+    throw new ScanInputError("Scan options must be an object.");
   }
-  const allowed = /* @__PURE__ */ new Set(["only", "skip", "honorIgnoreMarkers", "noExcerpts"]);
-  if (Object.keys(options).some((key) => !allowed.has(key))) throw new TypeError("Unknown scan option.");
+  const allowed = /* @__PURE__ */ new Set(["only", "skip", "honorIgnoreMarkers", "noExcerpts", "signal", "onProgress", "exclude"]);
+  if (Object.keys(options).some((key) => !allowed.has(key))) throw new ScanInputError("Unknown scan option.");
+  if (options.signal !== void 0 && (options.signal === null || typeof options.signal !== "object" || typeof options.signal.aborted !== "boolean" || typeof options.signal.addEventListener !== "function" || typeof options.signal.removeEventListener !== "function")) throw new ScanInputError("Expected an AbortSignal.");
+  if (options.onProgress !== void 0 && typeof options.onProgress !== "function") throw new ScanInputError("Expected a progress callback.");
+  if (options.exclude !== void 0 && (!Array.isArray(options.exclude) || options.exclude.length > MAX_EXCLUSIONS || !options.exclude.every(isExclusionPath))) throw new ScanInputError("Expected at most 64 literal relative exclusion paths.");
   for (const name of ["honorIgnoreMarkers", "noExcerpts"]) {
-    if (options[name] !== void 0 && typeof options[name] !== "boolean") throw new TypeError("Expected a boolean scan option.");
+    if (options[name] !== void 0 && typeof options[name] !== "boolean") throw new ScanInputError("Expected a boolean scan option.");
   }
   for (const name of ["only", "skip"]) {
     const values = options[name];
     if (values !== void 0 && (!Array.isArray(values) || [...values].some((value) => typeof value !== "string" || !isKnownSelector(value)))) {
-      throw new TypeError("Rule selectors must be an array of known IDs or namespaces.");
+      throw new ScanInputError("Rule selectors must be an array of known IDs or namespaces.");
     }
   }
-  if (options.only?.length && options.skip?.length) throw new TypeError("only and skip are mutually exclusive.");
+  if (options.only?.length && options.skip?.length) throw new ScanInputError("only and skip are mutually exclusive.");
+  checkScanCancelled(options.signal);
   const directory = resolve2(root);
   try {
     if (!statSync3(directory).isDirectory()) throw new Error("not a directory");
   } catch {
-    throw new Error("Scan root must be an accessible directory.");
+    throw Object.assign(new Error("Scan root must be an accessible directory."), { code: "SCAN_ROOT_UNAVAILABLE" });
   }
+  const omitExcerpts = options.noExcerpts === true;
   const result = await scan(directory, {
     only: [...options.only ?? []],
     skip: [...options.skip ?? []],
-    honorIgnoreMarkers: options.honorIgnoreMarkers ?? true
+    honorIgnoreMarkers: options.honorIgnoreMarkers ?? true,
+    exclude: [...options.exclude ?? []],
+    ...options.signal === void 0 ? {} : { signal: options.signal },
+    ...options.onProgress === void 0 ? {} : { onProgress: options.onProgress }
   });
-  return options.noExcerpts ? { ...result, findings: result.findings.map((finding) => ({ ...finding, excerpt: null })) } : result;
+  return omitExcerpts ? { ...result, findings: result.findings.map((finding) => ({ ...finding, excerpt: null })) } : result;
 }
 export {
+  ScanCancelledError,
+  ScanProgressError,
+  getBuildInfo,
+  getCapabilities,
   listRules,
   scan2 as scan,
   summarize