canship 0.7.1 → 0.8.0

package/dist/index.js

@@ -1,5 +1,8 @@
 #!/usr/bin/env node
 
+// <define:__CANSHIP_BUILD_INFO__>
+var define_CANSHIP_BUILD_INFO_default = { version: "0.8.0", channel: "release", revision: "0700a3d119573b1d13c5f5b60f4e93ab87244b35", dirty: false };
+
 // src/index.ts
 import { statSync as statSync3 } from "fs";
 import { resolve as resolve2 } from "path";
@@ -749,7 +752,7 @@ function listViaGit(root, gitExecutable) {
     return null;
   }
 }
-function walkTree(root, skipped, wantAll, maxEntries) {
+function walkTree(root, skipped, wantAll, maxEntries, excludePath) {
   const all = [];
   const found = [];
   let visited = 0;
@@ -793,9 +796,10 @@ function walkTree(root, skipped, wantAll, maxEntries) {
         visited++;
         const full = join2(dir, entry.name);
         const rel = relative2(root, full).split(sep2).join("/");
-        let metadata;
+        if (excludePath?.(rel)) continue;
+        let metadata2;
         try {
-          metadata = lstatSync2(full);
+          metadata2 = lstatSync2(full);
         } catch (err) {
           if (!isMissing(err)) skipped.push({
             path: rel,
@@ -804,18 +808,18 @@ function walkTree(root, skipped, wantAll, maxEntries) {
           });
           continue;
         }
-        if (metadata.isSymbolicLink()) {
+        if (metadata2.isSymbolicLink()) {
           if (!SKIP_DIRS.has(entry.name)) {
             skipped.push({ path: rel, reason: "symlink", detail: "symbolic links are not followed" });
           }
           continue;
         }
-        if (metadata.isDirectory()) {
+        if (metadata2.isDirectory()) {
           if (SKIP_DIRS.has(entry.name)) continue;
           walk(full, depth + 1);
           continue;
         }
-        if (!metadata.isFile()) continue;
+        if (!metadata2.isFile()) continue;
         if (wantAll) all.push(rel);
         if (isCredentialName(entry.name) || isWorthProbing(rel)) found.push(rel);
       }
@@ -902,16 +906,17 @@ function readablePath(root, path, skipped) {
   }
   return true;
 }
-function collectFiles(root, isGitRepo, gitExecutable = resolveGitExecutable(root), limits = {}, honorIgnoreMarkers = true) {
+function collectFiles(root, isGitRepo, gitExecutable = resolveGitExecutable(root), limits = {}, honorIgnoreMarkers = true, excludePath) {
   root = realpathSync2(root);
   const skipped = [];
   const ignored = [];
   const fromGit = isGitRepo ? listViaGit(root, gitExecutable) : null;
-  const walked = walkTree(root, skipped, fromGit === null, limits.maxEntries ?? MAX_WALK_ENTRIES);
+  const walked = walkTree(root, skipped, fromGit === null, limits.maxEntries ?? MAX_WALK_ENTRIES, excludePath);
   const listed = fromGit?.files ?? walked.all;
   const candidates = /* @__PURE__ */ new Set();
   let vendored = 0;
   for (const path of fromGit?.nestedRepositories ?? []) {
+    if (excludePath?.(path)) continue;
     if (isVendored(path)) {
       vendored++;
       continue;
@@ -923,11 +928,13 @@ function collectFiles(root, isGitRepo, gitExecutable = resolveGitExecutable(root
     });
   }
   for (const path of listed) {
+    if (excludePath?.(path)) continue;
     if (isVendored(path)) vendored++;
     else candidates.add(path);
   }
   const forced = /* @__PURE__ */ new Set();
   for (const hidden of walked.forced) {
+    if (excludePath?.(hidden)) continue;
     candidates.add(hidden);
     forced.add(hidden);
   }
@@ -1870,7 +1877,7 @@ function gitOrThrow(root, gitExecutable, args) {
   return out;
 }
 function repoPrefix(root, gitExecutable) {
-  return (git(root, gitExecutable, ["rev-parse", "--show-prefix"]) ?? "").trim();
+  return gitOrThrow(root, gitExecutable, ["rev-parse", "--show-prefix"]).trim();
 }
 function trackedEnvFiles(root, gitExecutable) {
   const out = gitOrThrow(root, gitExecutable, ["ls-files", "-z"]);
@@ -1979,6 +1986,7 @@ var gitleakRule = {
     const remoteNote = remote ? `This repository has a remote configured, so these commits have most likely been pushed. Bots scrape public commits within minutes \u2014 assume every key in this file is already in someone else's hands.` : `This repository has no remote yet, so the damage may still be contained. Fix it before you push.`;
     const reportedTracked = /* @__PURE__ */ new Set();
     for (const path of tracked) {
+      if (ctx.excludePath?.(path)) continue;
       const scanned = ctx.files.find((f) => f.path === path);
       const evidence = scanned ? evidenceIn(scanned.lines) : "hint";
       if (evidence === "none") continue;
@@ -2009,6 +2017,7 @@ var gitleakRule = {
     for (const entry of historical) {
       if (reportedTracked.has(entry.localPath)) continue;
       const path = entry.localPath;
+      if (ctx.excludePath?.(path)) continue;
       const stillTracked = tracked.has(entry.localPath);
       const history = historicalEvidence(ctx.root, ctx.gitExecutable, entry);
       if (history && history.unread > 0) {
@@ -3092,7 +3101,7 @@ var firebaseRulesRule = {
 };
 
 // src/rules/apiauth.ts
-import { posix } from "path";
+import { posix as posix2 } from "path";
 
 // src/rules/bindings.ts
 var cache = /* @__PURE__ */ new WeakMap();
@@ -3464,12 +3473,364 @@ function identityRequirement(value, allowParameters) {
   return null;
 }
 
+// src/rules/routers.ts
+import { createHash as createHash2 } from "crypto";
+
+// src/rules/factory-modules.ts
+import { posix } from "path";
+var unknown = (limited2 = false) => ({ handled: true, file: null, ...limited2 ? { limited: true } : {} });
+var object = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+var safePath = (path) => Boolean(path) && path.length <= 512 && !/[\\\u0000-\u0020:%?#]/.test(path) && !posix.isAbsolute(path);
+var contained = (path) => path !== ".." && !path.startsWith("../") && !posix.isAbsolute(path);
+function metadata(file) {
+  if (file.content.length > 65536) return null;
+  let source = commentsMaskedOf(file);
+  const code = noiseMaskedOf(file);
+  const commas = [...code.matchAll(/,\s*[}\]]/g)].map((match) => match.index);
+  if (commas.length) {
+    const characters = source.split("");
+    for (const at of commas) characters[at] = " ";
+    source = characters.join("");
+  }
+  try {
+    const value = JSON.parse(source);
+    return object(value) ? value : null;
+  } catch {
+    return null;
+  }
+}
+function exportTarget(value, limit, depth = 0) {
+  if (depth >= 8) {
+    limit();
+    return null;
+  }
+  if (typeof value === "string") return value.startsWith("./") && safePath(value) && !value.includes("*") && value.split("/").slice(1).every((part) => part !== "." && part !== ".." && part !== "node_modules") ? value : null;
+  if (!object(value)) return null;
+  if (Object.keys(value).length > 32) {
+    limit();
+    return null;
+  }
+  const entries = Object.entries(value).filter(([key]) => key !== "types" && !key.startsWith("types@"));
+  if (!entries.length || entries.some(([key]) => key.startsWith("."))) return null;
+  const targets = entries.map(([, item]) => exportTarget(item, limit, depth + 1));
+  return targets.every((target) => target !== null && target === targets[0]) ? targets[0] : null;
+}
+function factoryModuleResolver(files) {
+  const byPath = new Map(files.map((file) => [file.path, file]));
+  const parsed = /* @__PURE__ */ new Map();
+  let metadataLimited = false;
+  const json = (file) => {
+    if (file.content.length > 65536) {
+      metadataLimited = true;
+      return null;
+    }
+    if (!parsed.has(file)) parsed.set(file, metadata(file));
+    return parsed.get(file);
+  };
+  const parents = (file) => {
+    const found = [];
+    for (let dir = posix.dirname(file.path); ; dir = posix.dirname(dir)) {
+      found.push(dir);
+      if (dir === "." || posix.dirname(dir) === dir) break;
+    }
+    return found;
+  };
+  const nearest = (file, names) => {
+    for (const dir of parents(file)) for (const name of names) {
+      const found = byPath.get(posix.join(dir, name));
+      if (found) return found;
+    }
+    return void 0;
+  };
+  const sourceAt = (path, from) => {
+    if (!contained(path)) return null;
+    const relative3 = posix.relative(posix.dirname(from.path), path);
+    return bindingModule(relative3.startsWith(".") ? relative3 : "./" + relative3, from, files, "");
+  };
+  const configPath = (spec, from) => {
+    const config = nearest(from, ["tsconfig.json", "jsconfig.json"]);
+    if (!config) return null;
+    if (config.content.length > 65536) return unknown(true);
+    const data = json(config);
+    if (!data || "extends" in data || "references" in data) return unknown();
+    const options = data.compilerOptions;
+    if (options === void 0) return null;
+    if (!object(options)) return unknown();
+    if (options.paths === void 0) return null;
+    if (!object(options.paths)) return unknown();
+    if (Object.keys(options.paths).length > 128) return unknown(true);
+    const matches = [];
+    for (const [pattern, target2] of Object.entries(options.paths)) {
+      if (pattern.length > 512) return unknown(true);
+      if (pattern.split("*").length > 2) return unknown();
+      const [prefix, suffix = ""] = pattern.split("*");
+      const exact = !pattern.includes("*");
+      if (exact ? pattern !== spec : !spec.startsWith(prefix) || !spec.endsWith(suffix) || spec.length < prefix.length + suffix.length) continue;
+      matches.push({ target: target2, prefix, suffix, exact, middle: exact ? "" : spec.slice(prefix.length, spec.length - suffix.length) });
+    }
+    if (!matches.length) return null;
+    matches.sort((a, b) => Number(b.exact) - Number(a.exact) || b.prefix.length - a.prefix.length);
+    const selected = matches[0];
+    if (matches[1] && matches[1].exact === selected.exact && matches[1].prefix.length === selected.prefix.length) return unknown();
+    if (!Array.isArray(selected.target) || selected.target.length !== 1 || typeof selected.target[0] !== "string") return unknown();
+    const target = selected.target[0];
+    if (!safePath(target) || target.split("*").length > 2 || selected.exact && target.includes("*")) return unknown();
+    const base = options.baseUrl ?? ".";
+    if (typeof base !== "string" || !safePath(base) || base.includes("*")) return unknown();
+    const path = posix.normalize(posix.join(posix.dirname(config.path), base, target.replace("*", selected.middle)));
+    return { handled: true, file: sourceAt(path, from) };
+  };
+  const manifests = files.filter((file) => /(?:^|\/)package\.json$/.test(file.path));
+  const workspace = (spec, from) => {
+    const name = spec.startsWith("@") ? spec.split("/").slice(0, 2).join("/") : spec.split("/")[0];
+    const subpath = spec === name ? "." : "." + spec.slice(name.length);
+    const owner = nearest(from, ["package.json"]);
+    if (!owner) return null;
+    if (owner.content.length > 65536) return unknown(true);
+    const ownerData = json(owner);
+    const deps = ownerData?.dependencies;
+    const link = object(deps) ? deps[name] : void 0;
+    if (typeof link !== "string" || !/^workspace:(?:\*|\^|~)$/.test(link)) return null;
+    const roots = parents(owner).map((dir2) => byPath.get(posix.join(dir2, "package.json"))).filter((file) => Boolean(file));
+    if (roots.some((file) => file.content.length > 65536)) return unknown(true);
+    const root = roots.find((file) => json(file)?.workspaces !== void 0);
+    if (!root) return unknown();
+    const raw = json(root).workspaces;
+    const patterns = Array.isArray(raw) ? raw : object(raw) ? raw.packages : null;
+    if (!Array.isArray(patterns)) return unknown();
+    if (patterns.length > 64) return unknown(true);
+    if (patterns.some((item) => typeof item !== "string" || !safePath(item) || item.split("*").length > 2)) return unknown();
+    const rootDir = posix.dirname(root.path);
+    const matched = manifests.filter((file) => {
+      const dir2 = posix.relative(rootDir, posix.dirname(file.path));
+      return Boolean(dir2) && contained(dir2) && patterns.some((pattern) => {
+        const [before, after = ""] = pattern.replace(/\/$/, "").split("*");
+        return pattern.includes("*") ? dir2.length >= before.length + after.length && dir2.startsWith(before) && dir2.endsWith(after) && !dir2.slice(before.length, dir2.length - after.length).includes("/") : dir2 === before;
+      }) && json(file)?.name === name;
+    });
+    if (matched.length !== 1) return unknown();
+    const manifest = matched[0], data = json(manifest);
+    let target;
+    if ("exports" in data) {
+      const value = data.exports;
+      if (object(value) && Object.keys(value).some((key) => key.startsWith(".")) && Object.keys(value).some((key) => !key.startsWith("."))) return unknown();
+      const entry = object(value) && Object.keys(value).some((key) => key.startsWith(".")) ? value[subpath] : subpath === "." ? value : null;
+      let limited2 = false;
+      target = exportTarget(entry, () => {
+        limited2 = true;
+      });
+      if (limited2) return unknown(true);
+    } else target = subpath === "." && typeof data.main === "string" && (!data.module || data.module === data.main) ? data.main : null;
+    if (!target || !safePath(target)) return unknown();
+    const dir = posix.dirname(manifest.path), path = posix.normalize(posix.join(dir, target));
+    if (!contained(posix.relative(dir, path))) return unknown();
+    return { handled: true, file: sourceAt(path, from) };
+  };
+  const resolve3 = (spec, from) => {
+    if (!spec || spec.length > 512 || /[\\\u0000-\u0020:%?]/.test(spec) || posix.isAbsolute(spec)) return unknown();
+    if (spec.startsWith(".")) return { handled: true, file: bindingModule(spec, from, files, "") };
+    const configured = configPath(spec, from);
+    if (configured) return configured;
+    const local = workspace(spec, from);
+    if (local) return local;
+    const scope = /^(.*?\/)?(?:src|app|lib|server|routes|api|controllers|plugins)\//.exec(from.path)?.[1] ?? "";
+    const file = bindingModule(spec, from, files, scope);
+    return { handled: Boolean(file), file };
+  };
+  return (spec, from) => {
+    metadataLimited = false;
+    const result = resolve3(spec, from);
+    if (result.file && (!/\.[mc]?[jt]sx?$/.test(result.file.path) || /\.d\.[cm]?ts$/.test(result.file.path))) return unknown();
+    return metadataLimited ? unknown(true) : result;
+  };
+}
+
+// src/rules/registration-context.ts
+function registrationContext(code, pairs, bodies) {
+  const regions = [];
+  const openers = new Map([...pairs].map(([open, close]) => [close, open]));
+  const controlBraces = /* @__PURE__ */ new Set();
+  let limited2 = false;
+  const space = (at) => {
+    while (at < code.length && /\s/.test(code[at])) at++;
+    return at;
+  };
+  const add = (start, end, dead = false, owner2 = false) => {
+    if (regions.some((region) => region.start === start && region.end === end && region.dead === dead && region.owner === owner2)) return;
+    if (regions.length >= 512) {
+      limited2 = true;
+      return;
+    }
+    regions.push({ start, end, dead, owner: owner2 });
+  };
+  const literal2 = (text) => {
+    const match = /^\s*(!\s*)?(true|false)\s*$/.exec(text);
+    return match ? match[2] === "true" !== Boolean(match[1]) : null;
+  };
+  const simpleEnd = (start) => {
+    for (let at = start; at < code.length; at++) {
+      const quote = code[at];
+      if (quote === '"' || quote === "'" || quote === "`") {
+        let end2 = at + 1;
+        for (; end2 < code.length; end2++) {
+          if (quote === "`" && code[end2] === "$" && code[end2 + 1] === "{") {
+            const close = pairs.get(end2 + 1);
+            if (close !== void 0) {
+              end2 = close;
+              continue;
+            }
+          }
+          if (code[end2] === quote) break;
+        }
+        if (end2 === code.length) limited2 = true;
+        at = end2;
+        continue;
+      }
+      const end = pairs.get(at);
+      if (end !== void 0) {
+        at = end;
+        continue;
+      }
+      if (/[;,}\n]/.test(code[at])) return at + (code[at] === ";" ? 1 : 0);
+    }
+    return code.length;
+  };
+  const statementEnd3 = (rawStart, depth = 0) => {
+    const start = space(rawStart);
+    if (depth >= 32) {
+      limited2 = true;
+      return code.length;
+    }
+    if (code[start] === "{") {
+      const end = pairs.get(start);
+      if (end === void 0) limited2 = true;
+      return (end ?? code.length - 1) + 1;
+    }
+    const head = /^(if|for(?:\s+await)?|while|switch|with)\s*\(/.exec(code.slice(start, start + 100));
+    if (head) {
+      const close = pairs.get(start + head[0].length - 1);
+      if (close === void 0) {
+        limited2 = true;
+        return code.length;
+      }
+      let end = statementEnd3(close + 1, depth + 1);
+      const tail = space(end);
+      if (head[1] === "if" && /^else\b/.test(code.slice(tail, tail + 8))) end = statementEnd3(tail + 4, depth + 1);
+      return end;
+    }
+    return simpleEnd(start);
+  };
+  for (const body of bodies) add(body.start, body.end + 1, false, true);
+  for (const match of code.matchAll(/=>\s*(?!\s*\{)/g)) {
+    const start = space(match.index + 2);
+    if (code[start] !== "{") add(start, simpleEnd(start), false, true);
+  }
+  for (const match of code.matchAll(/(?<![\w$.])(if|for(?:\s+await)?|while|switch|catch|with)\s*\(/g)) {
+    const open = match.index + match[0].length - 1, close = pairs.get(open);
+    if (close === void 0) {
+      limited2 = true;
+      continue;
+    }
+    const start = space(close + 1), end = statementEnd3(start);
+    if (code[start] === "{") controlBraces.add(start);
+    const condition = literal2(code.slice(open + 1, close));
+    if (match[1] === "if") {
+      if (condition !== true) add(start, end, condition === false);
+      const next = space(end);
+      if (/^else\b/.test(code.slice(next, next + 8))) {
+        const alternate = space(next + 4), alternateEnd = statementEnd3(alternate);
+        if (code[alternate] === "{") controlBraces.add(alternate);
+        if (condition !== false) add(alternate, alternateEnd, condition === true);
+      }
+    } else {
+      add(start, end, match[1] === "while" && condition === false);
+      if (match[1] === "switch" && code[start] === "{") {
+        const labels = [];
+        for (let at = start + 1; at < end - 1; at++) {
+          const nested = pairs.get(at);
+          if (nested !== void 0) {
+            at = nested;
+            continue;
+          }
+          if ((at === 0 || !/[\w$.]/.test(code[at - 1])) && /^(?:case|default)\b/.test(code.slice(at, at + 10))) labels.push(at);
+        }
+        labels.forEach((at, index) => add(at, labels[index + 1] ?? end - 1));
+      }
+    }
+  }
+  for (const match of code.matchAll(/(?<![\w$.])(?:try|finally|do|catch)\s*\{/g)) {
+    const start = match.index + match[0].length - 1;
+    controlBraces.add(start);
+    add(start, (pairs.get(start) ?? code.length - 1) + 1);
+  }
+  for (const [start, end] of pairs) {
+    if (code[start] !== "{" || controlBraces.has(start) || bodies.some((body) => body.start === start)) continue;
+    if (/\)\s*(?::[\w\s.<>,[\]|?]+)?$/.test(code.slice(Math.max(0, start - 200), start))) add(start, end + 1, false, true);
+  }
+  const contains = (region, at) => region.start <= at && at < region.end;
+  const owner = (at) => regions.filter((region) => region.owner && contains(region, at)).sort((a, b) => a.end - a.start - (b.end - b.start))[0];
+  const inline = (at) => {
+    let start = at;
+    for (let cursor = at - 1; cursor >= 0; cursor--) {
+      if (at - cursor > 4e3) {
+        limited2 = true;
+        return "conditional";
+      }
+      const open = openers.get(cursor);
+      if (open !== void 0) {
+        cursor = open;
+        start = open;
+        continue;
+      }
+      if (code[cursor] === ";" || code[cursor] === "{") {
+        start = cursor + 1;
+        break;
+      }
+      if (code[cursor] === "\n" && !/[&|?:=,(.\\]$/.test(code.slice(Math.max(0, cursor - 100), cursor).trimEnd())) {
+        start = cursor + 1;
+        break;
+      }
+      start = cursor;
+    }
+    let prefix = "";
+    for (let cursor = start; cursor < at; cursor++) {
+      const close = pairs.get(cursor);
+      if (close !== void 0 && close < at) {
+        prefix += " ";
+        cursor = close;
+        continue;
+      }
+      prefix += code[cursor];
+    }
+    prefix = prefix.trim();
+    const simple = /^(?:const\s+[\w$]+\s*=\s*)?(!?\s*(?:true|false))\s*(&&|\|\|)\s*$/.exec(prefix);
+    if (simple) {
+      const truth = literal2(simple[1]);
+      return (simple[2] === "&&" ? truth : !truth) ? "always" : "dead";
+    }
+    return /&&|\|\||\?/.test(prefix) ? "conditional" : "always";
+  };
+  const reachable = (at) => limited2 || !regions.some((region) => region.dead && contains(region, at)) && inline(at) !== "dead";
+  return {
+    get limited() {
+      return limited2;
+    },
+    reachable,
+    covers(guard, operation) {
+      if (limited2 || !reachable(guard) || inline(guard) !== "always") return false;
+      const guardOwner = owner(guard);
+      if (guardOwner && guardOwner !== owner(operation)) return false;
+      return regions.filter((region) => !region.dead && contains(region, guard)).every((region) => contains(region, operation));
+    }
+  };
+}
+
 // src/rules/routers.ts
 var NODE_FRAMEWORKS = /* @__PURE__ */ new Set(["express", "hono", "fastify"]);
 var METHODS = "get|post|put|patch|delete|all|options|head";
 var GENERICS = String.raw`(?:<[^()]{0,300}>\s*)?`;
 var FASTIFY_HOOKS = /^(?:onRequest|preParsing|preValidation|preHandler)$/;
-var HONO_CALL = `${METHODS}|on|use|route`;
+var HONO_CALL = `${METHODS}|on|use|route|openapiRoutes|openapi`;
 var analysedCache = /* @__PURE__ */ new WeakMap();
 function analyse(file) {
   const cached = analysedCache.get(file);
@@ -3508,8 +3869,9 @@ function argsOf(a, open, close) {
 function flatten(a, args) {
   return args.flatMap((arg) => {
     if (!arg.text.startsWith("[")) return [arg];
-    const close = a.pairs.get(arg.at);
-    return close === void 0 ? [arg] : argsOf(a, arg.at, close);
+    const owner = arg.file ? analyse(arg.file) : a;
+    const close = owner.pairs.get(arg.at);
+    return close === void 0 ? [arg] : argsOf(owner, arg.at, close).map((item) => ({ ...item, file: owner.file }));
   });
 }
 function scopeOf(path) {
@@ -3542,7 +3904,7 @@ function entriesOf(a, arg) {
   return entries;
 }
 function frameworkNamesOf(a) {
-  const names = { express: /* @__PURE__ */ new Set(), router: /* @__PURE__ */ new Set(), hono: /* @__PURE__ */ new Set(), fastify: /* @__PURE__ */ new Set(), types: /* @__PURE__ */ new Set() };
+  const names = { express: /* @__PURE__ */ new Set(), router: /* @__PURE__ */ new Set(), hono: /* @__PURE__ */ new Set(), openapi: /* @__PURE__ */ new Set(), fastify: /* @__PURE__ */ new Set(), types: /* @__PURE__ */ new Set() };
   const named = (list, wanted, into, fallback) => {
     for (const part of list.split(",")) {
       const m = /^\s*(?:type\s+)?([A-Za-z_$][\w$]*)\s*(?:(?:as|:)\s*([A-Za-z_$][\w$]*))?\s*$/.exec(part);
@@ -3552,6 +3914,7 @@ function frameworkNamesOf(a) {
     }
   };
   for (const m of a.source.matchAll(/\bimport\s+(type\s+)?(?:([A-Za-z_$][\w$]*)\s*,?\s*)?(?:\{([^{}]*)\}|\*\s+as\s+([A-Za-z_$][\w$]*))?\s*from\s*['"](express|hono(?:\/tiny|\/quick)?|@hono\/zod-openapi|fastify)['"]/g)) {
+    if (a.code.slice(m.index, m.index + 6) !== "import") continue;
     const typeOnly = Boolean(m[1]);
     if (m[5] === "express") {
       if (!typeOnly && m[2]) names.express.add(m[2]);
@@ -3564,20 +3927,27 @@ function frameworkNamesOf(a) {
       names.types.add("fastify");
     } else {
       if (!typeOnly && m[3]) named(m[3], /^(?:Hono|OpenAPIHono)$/, names.hono);
+      if (!typeOnly && m[3] && m[5] === "@hono/zod-openapi") named(m[3], /^OpenAPIHono$/, names.openapi);
       names.types.add("hono");
     }
   }
   for (const m of a.source.matchAll(/\b(?:const|let|var)\s+(?:([A-Za-z_$][\w$]*)|\{([^{}]*)\})\s*=\s*require\s*\(\s*['"](express|hono(?:\/tiny|\/quick)?|@hono\/zod-openapi|fastify)['"]\s*\)(?!\s*\()/g)) {
+    if (!/^(?:const|let|var)\b/.test(a.code.slice(m.index))) continue;
     if (m[3] === "express") {
       if (m[1]) names.express.add(m[1]);
       if (m[2]) named(m[2], /^Router$/, names.router);
     } else if (m[3] === "fastify") {
       if (m[1]) names.fastify.add(m[1]);
       if (m[2]) named(m[2], /^fastify$/, names.fastify);
-    } else if (m[2]) named(m[2], /^(?:Hono|OpenAPIHono)$/, names.hono);
+    } else if (m[2]) {
+      named(m[2], /^(?:Hono|OpenAPIHono)$/, names.hono);
+      if (m[3] === "@hono/zod-openapi") named(m[2], /^OpenAPIHono$/, names.openapi);
+    }
     names.types.add(m[3] === "express" || m[3] === "fastify" ? m[3] : "hono");
   }
-  for (const m of a.source.matchAll(/\brequire\s*\(\s*['"](express|fastify)['"]\s*\)/g)) names.types.add(m[1]);
+  for (const m of a.source.matchAll(/\brequire\s*\(\s*['"](express|fastify)['"]\s*\)/g)) {
+    if (a.code.slice(m.index, m.index + 7) === "require") names.types.add(m[1]);
+  }
   return names.types.size ? names : null;
 }
 function instancesOf(a, names) {
@@ -3586,6 +3956,7 @@ function instancesOf(a, names) {
     if (!found.some((other) => other.name === instance.name)) found.push(instance);
   };
   for (const m of a.source.matchAll(/\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*(?::[^=;]{0,100})?=\s*(?:await\s+)?(new\s+)?([A-Za-z_$][\w$]*)\s*(?:\.\s*(Router)\s*)?(<[^()]{0,300}>\s*)?\(/g)) {
+    if (!/^(?:const|let|var)\b/.test(a.code.slice(m.index))) continue;
     const [, name, isNew, callee, router] = m;
     if (!isNew && (names.express.has(callee) && (router === "Router" || router === void 0) || names.router.has(callee) && router === void 0)) {
       add({ name, framework: "express", prefix: "", weak: false });
@@ -3602,12 +3973,13 @@ function instancesOf(a, names) {
         prefix = (arg && pathOf(a, arg)) ?? "";
         if (baseClose !== void 0) close = baseClose;
       }
-      add({ name, framework: "hono", prefix, weak: false, chainFrom: close });
+      add({ name, framework: "hono", prefix, weak: false, chainFrom: close, openapi: names.openapi.has(callee) });
     } else if (!isNew && names.fastify.has(callee) && router === void 0) {
       add({ name, framework: "fastify", prefix: "", weak: false });
     }
   }
   for (const m of a.source.matchAll(/\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(?:await\s+)?require\s*\(\s*['"](express|fastify)['"]\s*\)\s*(?:\.\s*(Router)\s*)?\(/g)) {
+    if (!/^(?:const|let|var)\b/.test(a.code.slice(m.index))) continue;
     if (m[2] === "express" || !m[3]) add({ name: m[1], framework: m[2], prefix: "", weak: false });
   }
   const typed = [
@@ -3618,11 +3990,180 @@ function instancesOf(a, names) {
   for (const [framework, type] of typed) {
     if (!names.types.has(framework)) continue;
     for (const m of a.code.matchAll(new RegExp(String.raw`([A-Za-z_$][\w$]*)\s*\??:\s*(?:[A-Za-z_$][\w$]*\s*\.\s*)?${type}`, "g"))) {
-      add({ name: m[1], framework, prefix: "", weak: true });
+      add({ name: m[1], framework, prefix: "", weak: true, openapi: framework === "hono" && /\bOpenAPIHono\b/.test(m[0]) });
     }
   }
   return found;
 }
+function factoryBindingClean(a, name, initializer = -1) {
+  const escaped = name.replace(/\$/g, "\\$");
+  if ([...a.code.matchAll(new RegExp(`\\b(?:const|let|var|function|class)\\s+${escaped}(?![\\w$])`, "g"))].length > 1) return false;
+  if (initializer < 0) {
+    const declaration = new RegExp(`\\bconst\\s+(${escaped})\\s*(?::[^=;]{0,200})?=`).exec(a.code);
+    if (declaration) initializer = declaration.index + /^const\s+/.exec(declaration[0])[0].length;
+  }
+  if (new RegExp(`[(,]\\s*${escaped}\\s*(?=[:,)=])|(?<![\\w$.])${escaped}\\s*=>`).test(a.code)) return false;
+  for (const match of a.code.matchAll(/\b(?:const|let|var)\s*([\[{])/g)) {
+    const open = match.index + match[0].length - 1, close = a.pairs.get(open);
+    if (close !== void 0 && new RegExp(`(?<![\\w$])${escaped}(?![\\w$])`).test(a.code.slice(open, close + 1))) return false;
+  }
+  const writes = new RegExp(`(?<![\\w$.])${escaped}\\s*(?:=(?![=>])|[+*/%&|^-]=|\\?\\?=|&&=|\\|\\|=|\\+\\+|--)`, "g");
+  for (const match of a.code.matchAll(writes)) if (match.index !== initializer) return false;
+  return !new RegExp(`(?<![\\w$.])${escaped}(?:\\s*\\.\\s*[\\w$]+|\\s*\\[[^\\]]{0,200}\\])+\\s*=(?!=)|\\bObject\\s*\\.\\s*(?:assign|defineProperty|defineProperties)\\s*\\(\\s*${escaped}(?![\\w$])`).test(a.code);
+}
+function projectFactoryResolver(files, gaps) {
+  const cache3 = /* @__PURE__ */ new Map();
+  const module = factoryModuleResolver(files);
+  let limited2 = false;
+  const topLevel = (a, at) => ![...a.pairs].some(([open, close]) => a.code[open] === "{" && open < at && at < close);
+  const argAt = (a, at, end) => {
+    const lead = a.code.slice(at, end).length - a.code.slice(at, end).trimStart().length;
+    at += lead;
+    const text = a.code.slice(at, end).trimEnd();
+    return { at, text, source: a.source.slice(at, at + text.length) };
+  };
+  const basePath = (a, close, shape) => {
+    for (let i = 0; i < 8; i++) {
+      const next = /^\s*\.\s*basePath\s*\(/.exec(a.code.slice(close + 1, close + 200));
+      if (!next) return { shape, close };
+      if (shape.framework !== "hono") return null;
+      const open = close + next[0].length, end = a.pairs.get(open);
+      const args = end === void 0 ? [] : argsOf(a, open, end);
+      const path = args.length === 1 ? literalOf(args[0]) : null;
+      if (end === void 0 || path === null) return null;
+      shape = { ...shape, prefix: joinPath(shape.prefix, path) };
+      close = end;
+    }
+    if (/^\s*\.\s*basePath\s*\(/.test(a.code.slice(close + 1, close + 200))) {
+      limited2 = true;
+      return null;
+    }
+    return { shape, close };
+  };
+  const expression = (a, arg, depth) => {
+    if (depth >= 8 || arg.text.length > 4e3) {
+      limited2 = true;
+      return null;
+    }
+    if (arg.text[0] === "(" && a.pairs.get(arg.at) === arg.at + arg.text.length - 1) return expression(a, argAt(a, arg.at + 1, arg.at + arg.text.length - 1), depth + 1);
+    const call = /^(new\s+)?([A-Za-z_$][\w$]*)(?:\s*\.\s*(Router))?\s*(?:<[^()]{0,300}>\s*)?\(/.exec(arg.text);
+    if (!call) return null;
+    const [, isNew, name, member] = call;
+    const open = arg.at + call[0].length - 1, close = a.pairs.get(open);
+    if (close === void 0 || close >= arg.at + arg.text.length || !factoryBindingClean(a, name)) return null;
+    const imports = bindingsOf(a.file).imports.filter((item) => item.local === name);
+    const imported = imports.length === 1 ? imports[0] : void 0;
+    let shape = null;
+    const origin = imported?.spec ? module(imported.spec, a.file) : null;
+    if (origin?.limited) limited2 = true;
+    if (imported?.spec && !origin?.handled && !new RegExp(`\\b(?:const|let|var|function|class)\\s+${name.replace(/\$/g, "\\$")}(?![\\w$])`).test(a.code)) {
+      if (isNew && !member && ["hono", "hono/tiny", "hono/quick"].includes(imported.spec ?? "") && imported.imported === "Hono") shape = { framework: "hono", prefix: "", openapi: false };
+      if (isNew && !member && imported.spec === "@hono/zod-openapi" && imported.imported === "OpenAPIHono") shape = { framework: "hono", prefix: "", openapi: true };
+      if (!isNew && imported.spec === "express" && (imported.imported === "default" && (!member || member === "Router") || imported.imported === "Router" && !member)) shape = { framework: "express", prefix: "", openapi: false };
+      if (!isNew && !member && imported.spec === "fastify" && ["default", "fastify"].includes(imported.imported)) shape = { framework: "fastify", prefix: "", openapi: false };
+    }
+    if (!shape && !isNew && !member && !a.source.slice(open + 1, close).trim()) shape = resolve3(a, name, false, depth + 1);
+    if (!shape) return null;
+    const chained = basePath(a, close, shape);
+    return chained && !arg.text.slice(chained.close - arg.at + 1).trim() ? chained.shape : null;
+  };
+  const functionValue = (a, value, depth) => {
+    if (depth >= 8) {
+      limited2 = true;
+      return null;
+    }
+    if (/^[A-Za-z_$][\w$]*$/.test(value.text)) return resolve3(a, value.text, false, depth + 1);
+    const signature = /^(?:function(?:\s+[A-Za-z_$][\w$]*)?\s*\(\s*\)\s*(?::[^{};=]{1,200})?\s*|\(\s*\)\s*(?::[^{};=]{1,200})?\s*=>\s*)/.exec(value.text);
+    if (!signature) return null;
+    let body = argAt(a, value.at + signature[0].length, value.at + value.text.length);
+    if (body.text.startsWith("{")) {
+      const end = a.pairs.get(body.at);
+      if (end !== body.at + body.text.length - 1) return null;
+      const returned = /^\s*return\b[ \t]*/.exec(a.code.slice(body.at + 1, end));
+      if (!returned) return null;
+      const from = body.at + 1 + returned[0].length;
+      if (/[\r\n]/.test(a.code[from] ?? "")) return null;
+      body = argAt(a, from, end);
+      if (body.text.endsWith(";")) body = argAt(a, body.at, body.at + body.text.length - 1);
+    }
+    return expression(a, body, depth);
+  };
+  const resolve3 = (a, name, exported, depth) => {
+    if (depth >= 8) {
+      limited2 = true;
+      return null;
+    }
+    const key = `${a.file.path}\0${name}\0${exported}\0${depth}`;
+    if (cache3.has(key)) return cache3.get(key);
+    const follow = (spec, symbol) => {
+      const resolved = module(spec, a.file);
+      if (resolved.limited) limited2 = true;
+      const target = resolved.file;
+      return target ? resolve3(analyse(target), symbol, true, depth + 1) : null;
+    };
+    const bindings = bindingsOf(a.file), escaped = name.replace(/\$/g, "\\$");
+    let result = null;
+    if (exported) {
+      if (name === "default") {
+        const match = /\bexport\s+default\s+/.exec(a.code);
+        if (match && topLevel(a, match.index)) {
+          const at = match.index + match[0].length;
+          const named = /^function\s+([A-Za-z_$][\w$]*)/.exec(a.code.slice(at));
+          if (!named || factoryBindingClean(a, named[1])) result = functionValue(a, argAt(a, at, expressionEnd(a, at)), depth);
+        }
+      } else if (new RegExp(`\\bexport\\s+(?:const|function)\\s+${escaped}(?![\\w$])`).test(a.code)) result = resolve3(a, name, false, depth);
+      else {
+        const matches = bindings.exports.filter((item) => item.local === name);
+        if (matches.length === 1) {
+          const entry = matches[0];
+          result = entry.spec ? follow(entry.spec, entry.imported) : resolve3(a, entry.imported, false, depth + 1);
+        } else if (!matches.length && name !== "default" && bindings.stars.length === 1) result = follow(bindings.stars[0], name);
+      }
+    } else {
+      const declarations = [...a.code.matchAll(new RegExp(`\\b(const|function)\\s+${escaped}(?![\\w$])`, "g"))];
+      const declaration = declarations.length === 1 ? declarations[0] : void 0;
+      if (declaration && topLevel(a, declaration.index)) {
+        const at = declaration.index;
+        if (declaration[1] === "function" && factoryBindingClean(a, name)) result = functionValue(a, argAt(a, at, expressionEnd(a, at)), depth);
+        if (declaration[1] === "const") {
+          const prefix = new RegExp(`^const\\s+${escaped}\\s*(?::[^=;]{0,200})?=\\s*`).exec(a.code.slice(at));
+          const nameAt = at + /^const\s+/.exec(declaration[0])[0].length;
+          if (prefix && factoryBindingClean(a, name, nameAt)) {
+            const valueAt = at + prefix[0].length;
+            result = functionValue(a, argAt(a, valueAt, expressionEnd(a, valueAt)), depth);
+          }
+        }
+      } else if (!declarations.length && factoryBindingClean(a, name)) {
+        const imports = bindings.imports.filter((item) => item.local === name && item.spec);
+        if (imports.length === 1) result = follow(imports[0].spec, imports[0].imported);
+      }
+    }
+    if (result) cache3.set(key, result);
+    return result;
+  };
+  return (a, known) => {
+    const found = [];
+    const receivers = new Set([...a.code.matchAll(new RegExp(`(?<![\\w$.])([A-Za-z_$][\\w$]*)\\s*\\.\\s*(?:${METHODS}|on|openapi|openapiRoutes|route|register)\\s*${GENERICS}\\(`, "g"))].map((match) => match[1]));
+    let inspected = 0;
+    for (const m of a.code.matchAll(/\bconst\s+([A-Za-z_$][\w$]*)\s*=\s*([A-Za-z_$][\w$]*)\s*\(\s*\)/g)) {
+      const [, name, factory] = m;
+      if (!receivers.has(name) || known.has(name)) continue;
+      if (++inspected > 256) {
+        gaps.set(a.file, m.index);
+        break;
+      }
+      const open = a.code.indexOf("(", m.index), close = m.index + m[0].length - 1;
+      if (!topLevel(a, m.index) || a.source.slice(open + 1, close).trim() || !factoryBindingClean(a, factory) || !factoryBindingClean(a, name)) continue;
+      limited2 = false;
+      const shape = resolve3(a, factory, false, 0);
+      const chained = shape ? basePath(a, m.index + m[0].length - 1, shape) : null;
+      if (limited2) gaps.set(a.file, m.index);
+      const end = expressionEnd(a, open);
+      if (chained && !a.code.slice(chained.close + 1, end).trim()) found.push({ name, ...chained.shape, weak: false, chainFrom: chained.close });
+    }
+    return found;
+  };
+}
 function literalOf(arg) {
   const m = /^(['"`])([^'"`$]*)\1$/.exec(arg.source);
   return m ? m[2] : null;
@@ -3716,11 +4257,199 @@ function expressUses(a, name) {
   }
   return found.sort((x, y) => x.at - y.at);
 }
-function honoOps(a, name, chainFrom) {
+function openapiMiddleware(a, arg, depth = 0) {
+  if (depth >= 8) return [];
+  if (arg.text.startsWith("[")) {
+    const close = a.pairs.get(arg.at);
+    if (close === void 0 || !/^\s*(?:as\s+const)?\s*$/.test(arg.text.slice(close - arg.at + 1))) return [];
+    return argsOf(a, arg.at, close).flatMap((item) => openapiMiddleware(a, item, depth + 1));
+  }
+  if (/^[A-Za-z_$][\w$]*(?:\s*\.\s*[A-Za-z_$][\w$]*)*$/.test(arg.text) || FUNCTION_EXPRESSION.test(arg.text)) return [arg];
+  const call = /^[A-Za-z_$][\w$.]*\s*\(/.exec(arg.text);
+  return call && a.pairs.get(arg.at + call[0].length - 1) === arg.at + arg.text.length - 1 ? [arg] : [];
+}
+function openapiEntries(a, arg, files, depth = 0) {
+  const value = openapiValue(a, arg, files, depth);
+  if (!value || !value.text.startsWith("{")) return /* @__PURE__ */ new Map();
+  const owner = analyse(value.file);
+  const close = owner.pairs.get(value.at);
+  if (argsOf(owner, value.at, close).some((part) => /^(?:\.\.\.|\[|(?:get|set)\s+)/.test(part.text))) return /* @__PURE__ */ new Map();
+  return new Map([...entriesOf(owner, value)].map(([key, entry]) => [key, {
+    ...entry,
+    value: entry.value ? { ...entry.value, file: owner.file } : null
+  }]));
+}
+function openapiValue(a, arg, files, depth = 0) {
+  if (depth >= 8) return null;
+  const root = /^([A-Za-z_$][\w$]*)(?:\s*[.(]|$)/.exec(arg.text)?.[1];
+  if (root) {
+    const token = new RegExp(`(?<![\\w$])${root.replace(/\$/g, "\\$")}(?![\\w$])`);
+    if (a.bodies.some((body) => body.start < arg.at && arg.at < body.end && token.test(a.code.slice(body.declaration, body.start)))) return null;
+    for (const match of a.code.matchAll(/\b(?:const|let|var)\s*([\[{])/g)) {
+      const open = match.index + match[0].length - 1;
+      const close = a.pairs.get(open);
+      if (close !== void 0 && token.test(a.code.slice(open, close + 1))) return null;
+    }
+  }
+  if (/^[{[]/.test(arg.text)) {
+    const close = a.pairs.get(arg.at);
+    if (close === void 0 || !/^\s*(?:as\s+const|satisfies\s+[\w$.]+)?\s*$/.test(arg.text.slice(close - arg.at + 1))) return null;
+    return { ...arg, file: a.file };
+  }
+  const call = /^([A-Za-z_$][\w$]*)\s*\(/.exec(arg.text);
+  if (call) {
+    const binding = bindingsOf(a.file).imports.find((item) => item.local === call[1]);
+    if (!binding || !["createRoute", "defineOpenAPIRoute"].includes(binding.imported) || binding.spec !== "@hono/zod-openapi") return null;
+    if (new RegExp(`\\b(?:const|let|var|function)\\s+${call[1].replace(/\$/g, "\\$")}(?![\\w$])`).test(a.code)) return null;
+    const open = arg.at + call[0].length - 1;
+    const close = a.pairs.get(open);
+    if (close !== arg.at + arg.text.length - 1) return null;
+    const args = argsOf(a, open, close);
+    return args.length === 1 ? openapiValue(a, args[0], files, depth + 1) : null;
+  }
+  if (root && !unchangedOpenapiReference(a, root)) return null;
+  const member = /^([A-Za-z_$][\w$]*)\s*\.\s*([A-Za-z_$][\w$]*)$/.exec(arg.text);
+  if (member) {
+    const escaped = member[1].replace(/\$/g, "\\$");
+    if (new RegExp(`\\b(?:const|let|var|function|class)\\s+${escaped}(?![\\w$])`).test(a.code)) return null;
+    const namespace = new RegExp(`\\bimport\\s+\\*\\s+as\\s+${escaped}\\s+from\\s*['"]([^'"]+)['"]`).exec(a.source);
+    const module = namespace && a.code.slice(namespace.index, namespace.index + 6) === "import" ? moduleFor(namespace[1], a.file, files) : null;
+    return module ? openapiExportValue(analyse(module), member[2], files, depth + 1) : null;
+  }
+  if (!/^[A-Za-z_$][\w$]*$/.test(arg.text)) return null;
+  const name = arg.text.replace(/\$/g, "\\$");
+  const declarations = [...a.code.matchAll(new RegExp(`\\b(const|let|var)\\s+${name}\\s*(?::[^=;]{0,200})?=(?![=>])\\s*`, "g"))];
+  if (declarations.length === 0) {
+    const imports = bindingsOf(a.file).imports.filter((item) => item.local === arg.text && item.spec);
+    const imported = imports.length === 1 ? imports[0] : void 0;
+    const module = imported ? moduleFor(imported.spec, a.file, files) : null;
+    return module ? openapiExportValue(analyse(module), imported.imported, files, depth + 1) : null;
+  }
+  if (declarations.length !== 1 || declarations[0][1] !== "const") return null;
+  const declaration = declarations[0];
+  if (declaration.index >= arg.at) return null;
+  for (const [open, close] of a.pairs) {
+    if (a.code[open] === "{" && open < declaration.index && declaration.index < close && !(open < arg.at && arg.at < close)) return null;
+  }
+  const from = declaration.index + declaration[0].length;
+  const end = expressionEnd(a, from);
+  const text = a.code.slice(from, end).trimEnd();
+  return openapiValue(a, { at: from, text, source: a.source.slice(from, from + text.length) }, files, depth + 1);
+}
+function unchangedOpenapiReference(a, name) {
+  const aliases = /* @__PURE__ */ new Set([name]);
+  const assignedAliases = [...a.code.matchAll(/\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*([A-Za-z_$][\w$]*)\s*(?=[;,\n]|$)/g)];
+  for (let pass = 0; pass < 8; pass++) {
+    const size = aliases.size;
+    for (const match of assignedAliases) if (aliases.has(match[2])) aliases.add(match[1]);
+    if (aliases.size > 64) return false;
+    if (aliases.size === size) break;
+    if (pass === 7) return false;
+  }
+  for (const alias of aliases) {
+    const escaped = alias.replace(/\$/g, "\\$");
+    const mutable = new RegExp(`(?<![\\w$.])${escaped}\\s*(?:\\.\\s*[\\w$]+|\\[[^\\]]{0,200}\\])+(?:\\s*(?:=|\\?\\?=|\\|\\|=|&&=)|\\s*\\()|\\bdelete\\s+${escaped}(?![\\w$])|\\bObject\\s*\\.\\s*(?:assign|defineProperty|defineProperties)\\s*\\(\\s*${escaped}(?![\\w$])`);
+    if (mutable.test(a.code)) return false;
+  }
+  return true;
+}
+function openapiExportValue(a, name, files, depth) {
+  if (depth >= 8) return null;
+  if (name === "default") {
+    const declaration = /\bexport\s+default\s+/.exec(a.code);
+    if (declaration) {
+      const at = declaration.index + declaration[0].length;
+      const text = a.code.slice(at, expressionEnd(a, at)).trimEnd();
+      return openapiValue(a, { at, text, source: a.source.slice(at, at + text.length) }, files, depth + 1);
+    }
+  } else if (new RegExp(`\\bexport\\s+const\\s+${name.replace(/\$/g, "\\$")}\\s*(?=[:=])`).test(a.code)) {
+    return openapiValue(a, { text: name, source: name, at: a.code.length }, files, depth + 1);
+  }
+  const bindings = bindingsOf(a.file);
+  const matches = bindings.exports.filter((item) => item.local === name);
+  if (matches.length > 1) return null;
+  const binding = matches[0];
+  if (binding?.spec) {
+    const module = moduleFor(binding.spec, a.file, files);
+    return module ? openapiExportValue(analyse(module), binding.imported, files, depth + 1) : null;
+  }
+  if (binding) return openapiValue(a, { text: binding.imported, source: binding.imported, at: a.code.length }, files, depth + 1);
+  if (name !== "default" && bindings.stars.length === 1) {
+    const module = moduleFor(bindings.stars[0], a.file, files);
+    if (module) return openapiExportValue(analyse(module), name, files, depth + 1);
+  }
+  return null;
+}
+function honoOps(a, name, chainFrom, files, openapi = false) {
   const registrations = [];
   const uses = [];
+  const batchGaps = /* @__PURE__ */ new Set();
+  const addOpenapi = (config, handler, handlerRange, at, batch = false) => {
+    const entries = openapiEntries(config.file ? analyse(config.file) : a, config, files);
+    const path = entries.get("path")?.value;
+    const resolved = path ? literalOf(path) : null;
+    const routingPath = resolved?.replace(/\/\{(.+?)\}/g, "/:$1") ?? null;
+    const middleware = entries.get("middleware")?.value;
+    const owner = middleware?.file ? analyse(middleware.file) : a;
+    registrations.push({
+      path: routingPath,
+      middleware: middleware ? openapiMiddleware(owner, middleware).map((arg) => ({ ...arg, file: owner.file })) : [],
+      handler,
+      handlerRange,
+      at,
+      batch
+    });
+    return [routingPath];
+  };
   const visit = (method, open, close, at, previous) => {
     const args = argsOf(a, open, close);
+    if (method === "openapiRoutes") {
+      if (!openapi) return previous;
+      let paths2 = previous;
+      let inspected = 0;
+      const gap = () => {
+        batchGaps.add(at);
+        paths2 = [null];
+      };
+      const walk = (origin, list, depth) => {
+        if (!list || depth >= 8) {
+          gap();
+          return;
+        }
+        const value = openapiValue(origin, list, files);
+        if (!value || !value.text.startsWith("[")) {
+          gap();
+          return;
+        }
+        const owner = analyse(value.file);
+        for (const item of argsOf(owner, value.at, owner.pairs.get(value.at))) {
+          if (++inspected > 256) {
+            gap();
+            return;
+          }
+          if (item.text.startsWith("...")) {
+            const lead = 3 + item.text.slice(3).length - item.text.slice(3).trimStart().length;
+            walk(owner, { at: item.at + lead, text: item.text.slice(lead), source: item.source.slice(lead) }, depth + 1);
+            continue;
+          }
+          const entries = openapiEntries(owner, item, files);
+          if (entries.get("addRoute")?.value?.text === "false") continue;
+          const config = entries.get("route")?.value;
+          const handler = entries.get("handler");
+          if (!config || !handler || !handler.value && !handler.range) {
+            gap();
+            continue;
+          }
+          paths2 = addOpenapi(config, handler.value, handler.range, at, true);
+        }
+      };
+      walk(a, args[0], 0);
+      return paths2;
+    }
+    if (method === "openapi") {
+      if (!openapi || !args[0] || !args[1]) return previous;
+      return addOpenapi(args[0], args[1], null, at);
+    }
     if (method === "use") {
       const prefixes = args[0] ? usePrefixes(a, args[0]) : null;
       const middleware = flatten(a, prefixes === null ? args : args.slice(1));
@@ -3762,7 +4491,7 @@ function honoOps(a, name, chainFrom) {
   }
   registrations.sort((x, y) => x.at - y.at);
   uses.sort((x, y) => x.at - y.at);
-  return { registrations, uses };
+  return { registrations, uses, batchGaps: [...batchGaps] };
 }
 function fastifyOps(a, name) {
   const registrations = [];
@@ -4044,7 +4773,7 @@ function exportedPlugin(t, files, depth) {
   const text = t.code.slice(from, end).trimEnd();
   return pluginOf(t, { text, source: t.source.slice(from, from + text.length), at: from }, files, depth);
 }
-var toRefs = (a, args) => args.map((arg) => ({ text: arg.source, at: arg.at, file: a.file }));
+var toRefs = (a, args) => args.map((arg) => ({ text: arg.source, at: arg.at, file: arg.file ?? a.file }));
 function mountedFile(a, arg, files) {
   const inline = /^require\s*\(\s*['"]([^'"]+)['"]\s*\)$/.exec(arg.source);
   if (inline) return moduleFor(inline[1], a.file, files);
@@ -4096,31 +4825,42 @@ function paramNamesOf(a, range) {
 }
 var within = (site, at) => site.range === null || site.range.start <= at && at <= site.range.end;
 var opsCache = /* @__PURE__ */ new WeakMap();
-function opsOf(site) {
+var contextCache = /* @__PURE__ */ new WeakMap();
+function contextOf(a) {
+  let context = contextCache.get(a.file);
+  if (!context) {
+    context = registrationContext(a.code, a.pairs, a.bodies);
+    contextCache.set(a.file, context);
+  }
+  return context;
+}
+function opsOf(site, files) {
   const cached = opsCache.get(site);
   if (cached) return cached;
   const { a, name } = site;
   let ops;
   if (site.framework === "express") ops = { registrations: expressRegistrations(a, name), uses: expressUses(a, name), registers: [] };
-  else if (site.framework === "hono") ops = { ...honoOps(a, name, site.chainFrom), registers: [] };
+  else if (site.framework === "hono") ops = { ...honoOps(a, name, site.chainFrom, files, site.openapi), registers: [] };
   else ops = fastifyOps(a, name);
+  const context = contextOf(a);
   const result = {
-    registrations: ops.registrations.filter((reg) => within(site, reg.at)),
-    uses: ops.uses.filter((use) => within(site, use.at)),
-    registers: ops.registers.filter((reg) => within(site, reg.at))
+    registrations: ops.registrations.filter((reg) => within(site, reg.at) && context.reachable(reg.at)),
+    uses: ops.uses.filter((use) => within(site, use.at) && context.reachable(use.at)),
+    registers: ops.registers.filter((reg) => within(site, reg.at) && context.reachable(reg.at)),
+    batchGaps: (ops.batchGaps ?? []).filter((at) => within(site, at))
   };
   opsCache.set(site, result);
   return result;
 }
 function generalMiddleware(site, before, files) {
-  const args = opsOf(site).uses.filter((use) => !use.mount && use.at < before && (use.prefix === null || site.framework !== "hono" && use.prefix === "/" || /^\/?\*$/.test(use.prefix))).flatMap((use) => use.args).filter((arg) => site.framework !== "express" || mountedFile(site.a, arg, files) === null);
+  const args = opsOf(site, files).uses.filter((use) => !use.mount && use.at < before && contextOf(site.a).covers(use.at, Number.isFinite(before) ? before : (site.range?.end ?? site.a.code.length) - 1) && (use.prefix === null || site.framework !== "hono" && use.prefix === "/" || /^\/?\*$/.test(use.prefix))).flatMap((use) => use.args).filter((arg) => site.framework !== "express" || mountedFile(site.a, arg, files) === null);
   return toRefs(site.a, args);
 }
 function passedSites(site, files) {
   const { a } = site;
   const found = [];
   const receive = (range, index, at) => {
-    if (!range) return;
+    if (!range || !contextOf(a).reachable(at)) return;
     const target = analyse(range.file);
     const name = paramNamesOf(target, range)[index];
     if (!name) return;
@@ -4128,6 +4868,7 @@ function passedSites(site, files) {
       a: target,
       name,
       framework: site.framework,
+      openapi: Boolean(site.openapi),
       range: { start: range.start, end: range.end },
       prefix: site.prefix,
       root: site.root ?? site,
@@ -4177,7 +4918,7 @@ function normalizePath(path) {
 function registeredSites(site, files) {
   const { a } = site;
   const found = [];
-  for (const reg of opsOf(site).registers) {
+  for (const reg of opsOf(site, files).registers) {
     const options = entriesOf(a, reg.options);
     const prefixArg = options.get("prefix")?.value;
     const prefix = joinPath(site.prefix, (prefixArg && pathOf(a, prefixArg)) ?? "");
@@ -4236,24 +4977,50 @@ function serverIndex(files) {
   const cached = indexCache.get(files);
   if (cached) return cached;
   const sites = [];
+  const registrationGaps = /* @__PURE__ */ new Set();
+  const factoryGaps = /* @__PURE__ */ new Map();
+  const factories = projectFactoryResolver(files, factoryGaps);
   const seen = /* @__PURE__ */ new Set();
   const add = (site) => {
-    const key = `${site.a.file.path}\0${site.name}\0${site.range?.start ?? -1}\0${site.prefix}`;
+    if (site.inherited.length > 256) {
+      registrationGaps.add(site.a.file);
+      site.inherited = [];
+    }
+    const root = site.root ?? site;
+    const identity2 = createHash2("sha256").update(JSON.stringify([
+      site.a.file.path,
+      site.name,
+      site.framework,
+      site.range?.start ?? -1,
+      site.prefix,
+      Boolean(site.openapi),
+      root.a.file.path,
+      root.name,
+      root.range?.start ?? -1,
+      root.prefix
+    ]));
+    for (const ref of site.inherited) identity2.update(JSON.stringify([ref.file.path, ref.at]));
+    const key = identity2.digest("hex");
     if (seen.has(key)) return false;
+    if (sites.length >= 4096) {
+      registrationGaps.add(site.a.file);
+      return false;
+    }
     seen.add(key);
     sites.push(site);
     return true;
   };
   for (const file of files) {
-    if (!/\.[mc]?[jt]sx?$/.test(file.path) || !/\b(?:express|hono|fastify)\b/.test(file.content)) continue;
+    if (!/\.[mc]?[jt]sx?$/.test(file.path)) continue;
     const a = analyse(file);
     const names = frameworkNamesOf(a);
-    if (!names) continue;
-    for (const instance of instancesOf(a, names)) {
+    const direct = names ? instancesOf(a, names) : [];
+    for (const instance of [...direct, ...factories(a, new Set(direct.map((item) => item.name)))]) {
       add({
         a,
         name: instance.name,
         framework: instance.framework,
+        openapi: Boolean(instance.openapi),
         range: null,
         prefix: instance.prefix,
         inherited: [],
@@ -4274,15 +5041,22 @@ function serverIndex(files) {
   const shadowed = (site, at) => Boolean(site.weak) && sites.some((other) => other !== site && !other.weak && other.a === site.a && other.name === site.name && other.range !== null && within(other, at));
   const byRouterFile = /* @__PURE__ */ new Map();
   const byRoot = /* @__PURE__ */ new Map();
+  const batchGaps = /* @__PURE__ */ new Map();
   for (const site of sites) {
     const { a } = site;
-    const { registrations, uses } = opsOf(site);
+    const { registrations, uses, batchGaps: gaps } = opsOf(site, files);
+    for (const at of gaps ?? []) if (!shadowed(site, at) && !batchGaps.has(a.file)) batchGaps.set(a.file, at);
     const routes = byRouterFile.get(a.file) ?? [];
     for (const reg of registrations) {
       if (shadowed(site, reg.at)) continue;
-      const handler = reg.handlerRange ?? (reg.handler ? handlerOf(a, reg.handler, files) : null);
-      if (!handler) continue;
-      const before = uses.filter((use) => !use.mount && use.at < reg.at && pathMatches(use.prefix, reg.path, site.framework)).flatMap((use) => use.args.filter((arg) => site.framework !== "express" || mountedFile(a, arg, files) === null));
+      const handler = reg.handlerRange ?? (reg.handler ? handlerOf(reg.handler.file ? analyse(reg.handler.file) : a, reg.handler, files) : null);
+      const handlerSource = handler ? analyse(handler.file) : null;
+      const knownBatchHandler = !reg.batch || reg.handlerRange !== null || handler && handlerSource && (handler.arrow || FUNCTION_EXPRESSION.test(handlerSource.code.slice(handler.start, handler.end)) || handlerSource.bodies.some((body) => handler.start <= body.start && body.end <= handler.end));
+      if (!handler || !knownBatchHandler) {
+        if (reg.batch && !batchGaps.has(a.file)) batchGaps.set(a.file, reg.at);
+        continue;
+      }
+      const before = uses.filter((use) => !use.mount && use.at < reg.at && contextOf(a).covers(use.at, reg.at) && pathMatches(use.prefix, reg.path, site.framework)).flatMap((use) => use.args.filter((arg) => site.framework !== "express" || mountedFile(a, arg, files) === null));
       const url = reg.path === null ? "(dynamic path)" : joinPath(site.prefix, reg.path);
       const callbacks = flatten(a, reg.middleware);
       const root = site.root ?? site;
@@ -4301,7 +5075,7 @@ function serverIndex(files) {
       };
       add2(handler, callbacks);
       callbacks.forEach((callback, index2) => {
-        const range = handlerOf(a, callback, files);
+        const range = handlerOf(callback.file ? analyse(callback.file) : a, callback, files);
         if (range) add2(range, callbacks.slice(0, index2));
       });
     }
@@ -4311,19 +5085,23 @@ function serverIndex(files) {
     const root = sites.find((other) => other.a === a && other.range === null && other.name === arg.text && !other.root);
     return root ? byRoot.get(root) : void 0;
   };
+  const fileRoutes = (file) => [.../* @__PURE__ */ new Set([
+    ...byRouterFile.get(file) ?? [],
+    ...sites.filter((other) => other.a.file === file && other.range === null && !other.root).flatMap((other) => byRoot.get(other) ?? [])
+  ])];
   for (const site of sites) {
     if (site.framework === "fastify") continue;
     const { a } = site;
-    const uses = opsOf(site).uses;
+    const uses = opsOf(site, files).uses;
     for (const use of uses) {
       if (site.framework === "hono" && !use.mount) continue;
       use.args.forEach((arg, index2) => {
         const target = mountedFile(a, arg, files);
-        const routes = target && target !== a.file ? byRouterFile.get(target) : localRoutes(a, arg);
+        const routes = target && target !== a.file ? fileRoutes(target) : localRoutes(a, arg);
         if (!routes || routes.length === 0) return;
         const isMiddleware = (x) => mountedFile(a, x, files) === null && localRoutes(a, x) === void 0;
         const covers2 = (other) => site.framework === "hono" ? other.prefix === null || /\*$/.test(other.prefix) && pathMatches(other.prefix, use.prefix, "hono") : pathMatches(other.prefix, use.prefix, site.framework);
-        const earlier = uses.filter((other) => !other.mount && other.at < use.at && covers2(other)).flatMap((other) => site.framework === "hono" ? other.args : other.args.filter(isMiddleware));
+        const earlier = uses.filter((other) => !other.mount && other.at < use.at && contextOf(a).covers(other.at, use.at) && covers2(other)).flatMap((other) => site.framework === "hono" ? other.args : other.args.filter(isMiddleware));
         const middleware = [...site.inherited, ...toRefs(a, earlier), ...toRefs(a, use.args.slice(0, index2).filter(isMiddleware))];
         const prefix = joinPath(site.prefix, use.prefix ?? "/");
         for (const route of routes) {
@@ -4341,13 +5119,27 @@ function serverIndex(files) {
       byHandlerFile.set(route.file, list);
     }
   }
-  const index = { byHandlerFile };
+  for (const site of sites) if (contextOf(site.a).limited) registrationGaps.add(site.a.file);
+  const index = { byHandlerFile, batchGaps, factoryGaps, registrationGaps };
   indexCache.set(files, index);
   return index;
 }
 function nodeRoutesFor(file, files) {
   return serverIndex(files).byHandlerFile.get(file) ?? [];
 }
+function reportOpenapiBatchCoverage(ctx) {
+  for (const file of serverIndex(ctx.files).registrationGaps) {
+    ctx.reportIncomplete("engine/route-registration", `${file.path}: Route registration context reached a documented scope or graph limit. Conditional or truncated inherited middleware was not accepted as protection.`);
+  }
+  for (const [file, at] of serverIndex(ctx.files).factoryGaps) {
+    const line = file.content.slice(0, at).split("\n").length;
+    ctx.reportIncomplete("engine/router-factories", `${file.path}:${line}: Project router-factory analysis reached a resolution, expression, candidate or module-configuration limit. See the documented bounds; simplify the wrapper or scan its direct route entry separately.`);
+  }
+  for (const [file, at] of serverIndex(ctx.files).batchGaps) {
+    const line = file.content.slice(0, at).split("\n").length;
+    ctx.reportIncomplete("engine/openapi-routes", `${file.path}:${line}: OpenAPI batch routes were not fully resolved. Use static entries and resolvable handlers; limits are 8 spread levels and 256 entries per call.`);
+  }
+}
 function serverRoutesOf(file, files) {
   const route = routeOf(file);
   if (route) return [route];
@@ -4425,7 +5217,8 @@ function middlewareDefinition(ref, files) {
   const local = member === null ? findFunction(a, root) : null;
   if (local) return { name: callee, range: local, spec: null, inline };
   const target = importOf(a, root, files);
-  const range = target ? importedFunction(target, member) ?? (member ? propertyValue(analyse(target.file), member) : null) : null;
+  const exported = member ?? (target && target.name !== "default" ? target.name : null);
+  const range = target ? importedFunction(target, member) ?? (member ? propertyValue(analyse(target.file), member) : null) ?? (exported ? exportedMember(target.file, exported, files, 0) : null) : null;
   return { name: callee, range, spec: null, inline };
 }
 function propertyValue(a, name) {
@@ -5381,7 +6174,7 @@ var IMPORT_SPEC = /(?:from|import|require)\s*\(?\s*['"]([^'"]+)['"]/g;
 function normalizeSpec(spec, fromPath) {
   if (spec.startsWith(".")) {
     return {
-      key: moduleKey(posix.normalize(posix.join(posix.dirname(fromPath), spec))),
+      key: moduleKey(posix2.normalize(posix2.join(posix2.dirname(fromPath), spec))),
       alias: false
     };
   }
@@ -6008,13 +6801,13 @@ function quotedValue(text) {
 function matcherEntry(text) {
   const trimmed = text.trimStart();
   if (trimmed.startsWith("{")) {
-    const object = sliceDelimited(trimmed, "{", "}");
-    if (object === null) return null;
-    if (topLevelPropertyStart(object, "has") !== null || topLevelPropertyStart(object, "missing") !== null) {
+    const object2 = sliceDelimited(trimmed, "{", "}");
+    if (object2 === null) return null;
+    if (topLevelPropertyStart(object2, "has") !== null || topLevelPropertyStart(object2, "missing") !== null) {
       return { conditional: true };
     }
-    const source = topLevelPropertyStart(object, "source");
-    const pattern2 = source === null ? null : quotedValue(object.slice(source));
+    const source = topLevelPropertyStart(object2, "source");
+    const pattern2 = source === null ? null : quotedValue(object2.slice(source));
     return pattern2 === null ? null : { pattern: pattern2 };
   }
   const pattern = quotedValue(trimmed);
@@ -8552,7 +9345,106 @@ function shouldRunRule(id, only, skip) {
 }
 
 // src/engine.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash3 } from "crypto";
+
+// src/diagnostics.ts
+var ScanInputError = class extends TypeError {
+  code = "INVALID_ARGUMENT";
+};
+function diagnosticCodeOf(error) {
+  if (error.kind === "crashed") return "RULE_EXECUTION_FAILED";
+  if (["engine/openapi-routes", "engine/router-factories", "engine/route-registration"].includes(error.ruleId)) return "ROUTE_UNRESOLVED";
+  if (error.ruleId === "engine/findings-limit") return "FINDINGS_LIMIT";
+  if (error.ruleId.startsWith("gitleak/")) return "GIT_CHECK_INCOMPLETE";
+  return "ANALYSIS_INCOMPLETE";
+}
+
+// src/scan-control.ts
+var ScanCancelledError = class extends Error {
+  code = "SCAN_CANCELLED";
+  constructor() {
+    super("Scan cancelled.");
+    this.name = "AbortError";
+  }
+};
+var ScanProgressError = class extends Error {
+  code = "PROGRESS_CALLBACK_FAILED";
+  constructor(cause) {
+    super("Scan progress callback failed.", { cause });
+  }
+};
+function checkScanCancelled(signal) {
+  if (signal?.aborted) throw new ScanCancelledError();
+}
+async function waitForProgress(value, signal) {
+  if (!signal) {
+    await value;
+    return;
+  }
+  let onAbort = () => {
+  };
+  const aborted = new Promise((_, reject) => {
+    onAbort = () => reject(new ScanCancelledError());
+    signal.addEventListener("abort", onAbort, { once: true });
+    if (signal.aborted) onAbort();
+  });
+  try {
+    await Promise.race([Promise.resolve(value), aborted]);
+  } finally {
+    signal.removeEventListener("abort", onAbort);
+  }
+}
+function createScanControl(options) {
+  const { signal, onProgress } = options;
+  return {
+    active: signal !== void 0 || onProgress !== void 0,
+    check: () => checkScanCancelled(signal),
+    async checkpoint(progress) {
+      checkScanCancelled(signal);
+      await new Promise((resolve3) => setImmediate(resolve3));
+      checkScanCancelled(signal);
+      if (onProgress) {
+        try {
+          await waitForProgress(onProgress(Object.freeze({ ...progress })), signal);
+        } catch (error) {
+          if (signal?.aborted || error instanceof ScanCancelledError) throw new ScanCancelledError();
+          throw new ScanProgressError(error);
+        }
+      }
+      checkScanCancelled(signal);
+    }
+  };
+}
+
+// src/exclusions.ts
+var MAX_EXCLUSIONS = 64;
+var MAX_EXCLUSION_LENGTH = 512;
+var SEGMENT = String.raw`[^\s/\\](?:[^/\\]*[^\s/\\])?`;
+var EXCLUSION_PATH_PATTERN = String.raw`^(?![!])(?!.*[:*?\[\]{}\u0000-\u001f\u007f-\u009f\u2028\u2029])(?!(?:.*[/\\])?\.{1,2}(?:[/\\]|$))` + SEGMENT + String.raw`(?:[/\\]` + SEGMENT + String.raw`)*[/\\]?$`;
+var PATH = new RegExp(EXCLUSION_PATH_PATTERN);
+function isExclusionPath(value) {
+  return typeof value === "string" && value.length > 0 && value.length <= MAX_EXCLUSION_LENGTH && PATH.test(value);
+}
+function createExclusions(values = []) {
+  if (values.length > MAX_EXCLUSIONS || !values.every(isExclusionPath)) throw new TypeError("Exclusions must be at most 64 literal relative paths without traversal, wildcards or control characters.");
+  const requested = [...new Set(values.map((value) => value.replace(/\\/g, "/").replace(/\/$/, "")))];
+  const matched = /* @__PURE__ */ new Set();
+  return {
+    requested,
+    matches(path) {
+      const normalized = path.replace(/\\/g, "/").replace(/\/$/, "");
+      let excluded = false;
+      for (const prefix of requested) if (normalized === prefix || normalized.startsWith(prefix + "/")) {
+        matched.add(prefix);
+        excluded = true;
+      }
+      return excluded;
+    },
+    matched: () => [...matched].sort()
+  };
+}
+
+// src/engine.ts
 var SEVERITY_ORDER = { P0: 0, P1: 1, P2: 2 };
 var CONFIDENCE_ORDER = { certain: 0, likely: 1 };
 function dedupe(findings) {
@@ -8581,7 +9473,7 @@ function sanitize(findings, files) {
     const file = f.file === null ? void 0 : byPath.get(f.file);
     const source = f.line === null ? file?.content : file?.lines[f.line - 1];
     return source === void 0 ? {} : {
-      sourceFingerprint: createHash2("sha256").update(source.trim(), "utf8").digest("hex")
+      sourceFingerprint: createHash3("sha256").update(source.trim(), "utf8").digest("hex")
     };
   };
   return findings.map((f) => ({
@@ -8616,9 +9508,9 @@ function sanitizeSkippedForOutput(items) {
   }));
 }
 function downgradeExampleContext(findings, files) {
-  const examples = new Set(files.filter((f) => f.isExampleContext).map((f) => f.path));
+  const examples2 = new Set(files.filter((f) => f.isExampleContext).map((f) => f.path));
   return findings.map(
-    (f) => f.file !== null && examples.has(f.file) ? { ...f, confidence: "likely" } : f
+    (f) => f.file !== null && examples2.has(f.file) ? { ...f, confidence: "likely" } : f
   );
 }
 function suppressIgnoredLines(findings, files) {
@@ -8671,20 +9563,36 @@ function sortFindings(findings) {
 }
 async function scan(root, options = {}) {
   const started = Date.now();
+  const exclusions = createExclusions(options.exclude);
+  const control = createScanControl(options);
+  control.check();
+  const progress = {
+    phase: "discovery",
+    filesCompleted: 0,
+    filesTotal: null,
+    projectRulesCompleted: 0,
+    projectRulesTotal: null
+  };
+  if (control.active) await control.checkpoint(progress);
   const gitExecutable = resolveGitExecutable(root);
   const git2 = detectGitRepo(root, gitExecutable);
   const honorIgnoreMarkers = options.honorIgnoreMarkers !== false;
-  const { files, skipped, ignored, vendored } = collectFiles(root, git2 === "repo", gitExecutable, {}, honorIgnoreMarkers);
+  const { files, skipped, ignored, vendored } = collectFiles(root, git2 === "repo", gitExecutable, {}, honorIgnoreMarkers, exclusions.matches);
   const findings = [];
   const errors = [];
   const fileRules = FILE_RULES.filter((rule2) => shouldRunRule(rule2.id, options.only ?? [], options.skip ?? []));
   const projectRules = PROJECT_RULES.filter((rule2) => shouldRunRule(rule2.id, options.only ?? [], options.skip ?? []));
+  progress.filesTotal = files.length;
+  progress.projectRulesTotal = projectRules.length;
+  progress.phase = "files";
+  if (control.active) await control.checkpoint(progress);
   const incompleteSeen = /* @__PURE__ */ new Set();
   const ctx = {
     root,
     files,
     git: git2,
     gitExecutable,
+    excludePath: exclusions.matches,
     // 统一记录不完整状态，避免重复提示。
     reportIncomplete: (ruleId, message) => {
       if (incompleteSeen.has(`${ruleId} ${message}`)) return;
@@ -8693,6 +9601,7 @@ async function scan(root, options = {}) {
     }
   };
   for (const file of files) {
+    control.check();
     for (const rule2 of fileRules) {
       try {
         if (!rule2.appliesTo(file)) continue;
@@ -8701,13 +9610,29 @@ async function scan(root, options = {}) {
         errors.push({ ruleId: rule2.id, file: file.path, message: messageOf(err), kind: "crashed" });
       }
     }
+    progress.filesCompleted++;
+    if (control.active && progress.filesCompleted % 32 === 0) await control.checkpoint(progress);
   }
+  if (control.active) await control.checkpoint(progress);
   for (const rule2 of projectRules) {
+    progress.phase = rule2.id.startsWith("gitleak/") ? "history" : "project";
+    if (control.active) await control.checkpoint(progress);
     try {
       findings.push(...await rule2.check(ctx));
     } catch (err) {
       errors.push({ ruleId: rule2.id, file: null, message: messageOf(err), kind: "crashed" });
     }
+    control.check();
+    progress.projectRulesCompleted++;
+  }
+  progress.phase = "finalize";
+  if (control.active) await control.checkpoint(progress);
+  if ([...fileRules, ...projectRules].some((rule2) => /^(?:api|auth|injection|ssrf|redirect|webhook)\//.test(rule2.id))) {
+    try {
+      reportOpenapiBatchCoverage(ctx);
+    } catch (err) {
+      errors.push({ ruleId: "engine/openapi-routes", file: null, message: messageOf(err), kind: "crashed" });
+    }
   }
   const deduped = dedupe(downgradeExampleContext(findings, files));
   const { kept, ignored: ignoredFindings } = honorIgnoreMarkers ? suppressIgnoredLines(deduped, files) : { kept: deduped, ignored: [] };
@@ -8723,12 +9648,14 @@ async function scan(root, options = {}) {
     );
     return false;
   });
-  return {
+  const result = {
+    ...exclusions.requested.length ? { exclusions: { requested: exclusions.requested.map(clean), matched: exclusions.matched().map(clean) } } : {},
     findings: sanitize(bounded, files),
     filesScanned: files.length,
     durationMs: Date.now() - started,
     errors: errors.map((e) => ({
       ...e,
+      code: e.code ?? diagnosticCodeOf(e),
       file: e.file === null ? null : clean(e.file),
       message: clean(e.message)
     })),
@@ -8746,14 +9673,113 @@ async function scan(root, options = {}) {
     // 主动忽略不影响完整性；错误、跳过或零文件扫描均标记为未完成。
     partial: errors.length > 0 || skipped.length > 0 || files.length === 0
   };
+  progress.phase = "complete";
+  if (control.active) await control.checkpoint(progress);
+  return result;
 }
 function messageOf(err) {
   if (err instanceof Error) return err.message;
   return String(err);
 }
 
+// src/rules/examples.ts
+var publicEnv = {
+  context: "Server-only environment value",
+  before: "NEXT_PUBLIC_SERVER_TOKEN=<private value>",
+  after: "SERVER_TOKEN=<server-only value>",
+  limitation: "Use the value only in server code. Rotate any exposed credential; renaming does not revoke it."
+};
+var auth = {
+  context: "Supabase route with a request-scoped session client and a separate admin client",
+  before: "await admin.from('items').delete().eq('id', id);",
+  after: "const { data: { user }, error } = await sessionClient.auth.getUser();\nif (error || !user) return new Response(null, { status: 401 });\nif (!await canDelete(user.id, id)) return new Response(null, { status: 403 });\nawait admin.from('items').delete().eq('id', id);",
+  limitation: "Bind sessionClient to the caller. Implement canDelete with actual resource ownership or permissions; authentication alone is insufficient."
+};
+var firestore = {
+  context: "Firestore document ownership",
+  before: "match /users/{uid} { allow read, write: if true; }",
+  after: "match /users/{uid} {\n  allow read, write: if request.auth != null && request.auth.uid == uid;\n}",
+  limitation: "Firestore syntax only. Review field validation and overlapping rules; adapt ownership to the data model."
+};
+var cors = {
+  context: "Express cors middleware with credentialed access from one trusted site",
+  before: "app.use(cors({ origin: true, credentials: true }));",
+  after: "app.use(cors({ origin: 'https://app.example.com', credentials: true }));",
+  limitation: "Replace the example origin with an exact trusted origin. CORS does not replace authentication, authorization or CSRF controls."
+};
+var examples = {
+  "api/admin-db-access-without-auth": auth,
+  "api/db-write-without-auth": auth,
+  "exposure/private-name-in-public-env": publicEnv,
+  "exposure/secret-in-public-env": publicEnv,
+  "exposure/supabase-service-role-in-client": {
+    ...publicEnv,
+    context: "Supabase admin credential",
+    limitation: "Never ship an admin key to the client. Use a publishable/anon key with appropriate RLS for client access; rotate exposed admin credentials."
+  },
+  "cors/reflected-origin-with-credentials": cors,
+  "cors/wildcard-with-credentials": { ...cors, before: "app.use(cors({ origin: '*', credentials: true }));" },
+  "firebase/open-rules": firestore,
+  "firebase/test-mode-rules": { ...firestore, before: "allow read, write: if request.time < timestamp.date(2030, 1, 1);" },
+  "supabase/rls-not-enabled": {
+    context: "Supabase table with a UUID owner_id column",
+    before: "CREATE TABLE public.notes (id uuid PRIMARY KEY, owner_id uuid NOT NULL, body text);",
+    after: "ALTER TABLE public.notes ENABLE ROW LEVEL SECURITY;\nCREATE POLICY owner_access ON public.notes TO authenticated\nUSING ((SELECT auth.uid()) = owner_id)\nWITH CHECK ((SELECT auth.uid()) = owner_id);",
+    limitation: "Apply ownership checks appropriate to the application. Review grants and other policies; service-role access bypasses RLS."
+  },
+  "auth/unverified-session": {
+    context: "Server-side Supabase identity verification",
+    before: "const { data: { session } } = await supabase.auth.getSession();\nif (!session) return new Response(null, { status: 401 });",
+    after: "const { data: { user }, error } = await supabase.auth.getUser();\nif (error || !user) return new Response(null, { status: 401 });",
+    limitation: "Use a client bound to the current request. Verified identity still requires resource-specific authorization."
+  },
+  "injection/sql": {
+    context: "PostgreSQL driver with bound parameters",
+    before: 'await db.query("SELECT * FROM users WHERE id = " + id);',
+    after: "await db.query('SELECT * FROM users WHERE id = $1', [id]);",
+    limitation: "Use the parameter syntax of your actual driver. Parameters do not substitute table names or authorize access."
+  },
+  "injection/command": {
+    context: "A fixed executable with separately validated arguments",
+    before: "exec('tool --input ' + requestValue);",
+    after: "execFile(TRUSTED_EXECUTABLE, ['--input', validatedValue], { shell: false });",
+    limitation: "Set TRUSTED_EXECUTABLE to a trusted absolute path. Validate argument meaning and filesystem access; never let the caller choose the executable."
+  },
+  "redirect/open": {
+    context: "Named destinations on a fixed application origin",
+    before: "return Response.redirect(requestedUrl);",
+    after: "const path = destination === 'settings' ? '/settings' : '/dashboard';\nreturn Response.redirect(new URL(path, APP_ORIGIN));",
+    limitation: "APP_ORIGIN must be trusted configuration, not a request header. Do not replace the fixed paths with caller-controlled URLs."
+  },
+  "ssrf/request-url": {
+    context: "Named server resources instead of caller-provided hosts",
+    before: "return fetch(requestedUrl);",
+    after: "if (resource !== 'status') return new Response(null, { status: 400 });\nreturn fetch('https://api.example.com/status', { redirect: 'error' });",
+    limitation: "Use a destination you control. Review DNS and egress restrictions; a URL allowlist alone is not a complete SSRF defense."
+  },
+  "webhook/unverified-signature": {
+    context: "Stripe webhook using the original request-body bytes",
+    before: "const event = JSON.parse(rawBody);\nawait handle(event);",
+    after: "let event;\ntry { event = stripe.webhooks.constructEvent(rawBody, signature, SERVER_SIGNING_SECRET); }\ncatch { return new Response(null, { status: 400 }); }\nawait handle(event);",
+    limitation: "Preserve raw bytes and use the endpoint signing secret. Verification must finish before side effects; implement replay/idempotency handling separately."
+  }
+};
+function fixExampleFor(ruleId) {
+  if (SECRET_PATTERNS.some((pattern) => !pattern.publicByDesign && ruleId === `secrets/hardcoded/${pattern.id}`)) return {
+    context: "A credential used only by a server runtime",
+    before: "const apiKey = '<private value>';",
+    after: "const apiKey = process.env.SERVICE_API_KEY;\nif (!apiKey) throw new Error('Server credential is missing');",
+    limitation: "Use trusted server-side configuration, never a public/client environment prefix. Rotate the old credential and review history and deployed bundles."
+  };
+  if (!Object.hasOwn(examples, ruleId)) return null;
+  return { ...examples[ruleId] };
+}
+
 // src/rules/catalog.ts
-var rule = (id, name, severity, confidence, scope, limitation) => ({ id, name, severity, confidence, scope, limitation, reportsFindings: true });
+var rule = (id, name, severity, confidence, scope, limitation) => {
+  const example = fixExampleFor(id);
+  return { id, name, severity, confidence, scope, limitation, reportsFindings: true, ...example ? { example } : {} };
+};
 var RULE_CATALOG = [
   rule(
     "api/admin-db-access-without-auth",
@@ -8768,8 +9794,8 @@ var RULE_CATALOG = [
     "Database write without a recognized auth guard",
     "P1",
     "likely",
-    "Server routes and Next.js Server Functions in Next.js, SvelteKit (endpoints and form actions), Nuxt, Remix/React Router, Astro, Express, Hono, and Fastify.",
-    "Session-scoped clients and indirect guards may need manual review. In Express, Hono, and Fastify routes, writes in called project functions are followed two levels deep; file-based routes report writes in the route file only. Hono app.openapi() routes are not analysed."
+    "Server routes and Next.js Server Functions in Next.js, SvelteKit (endpoints and form actions), Nuxt, Remix/React Router, Astro, Express, Hono (including OpenAPIHono.openapi and openapiRoutes), and Fastify.",
+    "Session-scoped clients and indirect guards may need manual review. In Express, Hono, and Fastify routes, writes in called project functions are followed two levels deep; file-based routes report writes in the route file only. OpenAPI configuration follows constants and static ESM imports/re-exports within eight resolution steps. Unresolved configuration does not suppress findings; unresolved batch entries or handlers mark coverage incomplete. OpenAPI security declarations are not authentication, and arbitrary module side effects are not modelled."
   ),
   rule(
     "auth/unverified-session",
@@ -8945,10 +9971,7 @@ function verdictOf(findings) {
   return { blocking, minor, unsure };
 }
 
-// src/index.ts
-function listRules() {
-  return RULE_CATALOG.map((rule2) => ({ ...rule2 }));
-}
+// src/summary.ts
 function summarize(result) {
   const verdict = verdictOf(result.findings);
   const findings = result.changeView?.totalFindings ?? result.findings.length;
@@ -8962,37 +9985,69 @@ function summarize(result) {
     exitCode: blocking > 0 ? 1 : findings > 0 ? 2 : partial ? 3 : 0
   };
 }
+
+// src/build-info.ts
+var VERSION = true ? "0.8.0" : "0.0.0-dev";
+var identity = typeof define_CANSHIP_BUILD_INFO_default === "object" ? define_CANSHIP_BUILD_INFO_default : { version: VERSION, channel: "development", revision: null, dirty: null };
+function getBuildInfo() {
+  return { ...identity };
+}
+function getCapabilities() {
+  return {
+    staticScan: { network: false, projectCodeExecution: false, projectWrites: false },
+    fileOutputs: "explicit-only",
+    onlineValidation: true,
+    onlineValidationPolicy: { cliOnly: true, defaultEnabled: false, confirmation: "plan-digest", credentials: false, responseBodiesRetained: false }
+  };
+}
+
+// src/index.ts
+function listRules() {
+  return RULE_CATALOG.map((rule2) => ({ ...rule2, ...rule2.example ? { example: { ...rule2.example } } : {} }));
+}
 async function scan2(root, options = {}) {
-  if (typeof root !== "string" || root.length === 0) throw new TypeError("Scan root must be a non-empty path.");
+  if (typeof root !== "string" || root.length === 0) throw new ScanInputError("Scan root must be a non-empty path.");
   if (options === null || typeof options !== "object" || Array.isArray(options)) {
-    throw new TypeError("Scan options must be an object.");
+    throw new ScanInputError("Scan options must be an object.");
   }
-  const allowed = /* @__PURE__ */ new Set(["only", "skip", "honorIgnoreMarkers", "noExcerpts"]);
-  if (Object.keys(options).some((key) => !allowed.has(key))) throw new TypeError("Unknown scan option.");
+  const allowed = /* @__PURE__ */ new Set(["only", "skip", "honorIgnoreMarkers", "noExcerpts", "signal", "onProgress", "exclude"]);
+  if (Object.keys(options).some((key) => !allowed.has(key))) throw new ScanInputError("Unknown scan option.");
+  if (options.signal !== void 0 && (options.signal === null || typeof options.signal !== "object" || typeof options.signal.aborted !== "boolean" || typeof options.signal.addEventListener !== "function" || typeof options.signal.removeEventListener !== "function")) throw new ScanInputError("Expected an AbortSignal.");
+  if (options.onProgress !== void 0 && typeof options.onProgress !== "function") throw new ScanInputError("Expected a progress callback.");
+  if (options.exclude !== void 0 && (!Array.isArray(options.exclude) || options.exclude.length > MAX_EXCLUSIONS || !options.exclude.every(isExclusionPath))) throw new ScanInputError("Expected at most 64 literal relative exclusion paths.");
   for (const name of ["honorIgnoreMarkers", "noExcerpts"]) {
-    if (options[name] !== void 0 && typeof options[name] !== "boolean") throw new TypeError("Expected a boolean scan option.");
+    if (options[name] !== void 0 && typeof options[name] !== "boolean") throw new ScanInputError("Expected a boolean scan option.");
   }
   for (const name of ["only", "skip"]) {
     const values = options[name];
     if (values !== void 0 && (!Array.isArray(values) || [...values].some((value) => typeof value !== "string" || !isKnownSelector(value)))) {
-      throw new TypeError("Rule selectors must be an array of known IDs or namespaces.");
+      throw new ScanInputError("Rule selectors must be an array of known IDs or namespaces.");
     }
   }
-  if (options.only?.length && options.skip?.length) throw new TypeError("only and skip are mutually exclusive.");
+  if (options.only?.length && options.skip?.length) throw new ScanInputError("only and skip are mutually exclusive.");
+  checkScanCancelled(options.signal);
   const directory = resolve2(root);
   try {
     if (!statSync3(directory).isDirectory()) throw new Error("not a directory");
   } catch {
-    throw new Error("Scan root must be an accessible directory.");
+    throw Object.assign(new Error("Scan root must be an accessible directory."), { code: "SCAN_ROOT_UNAVAILABLE" });
   }
+  const omitExcerpts = options.noExcerpts === true;
   const result = await scan(directory, {
     only: [...options.only ?? []],
     skip: [...options.skip ?? []],
-    honorIgnoreMarkers: options.honorIgnoreMarkers ?? true
+    honorIgnoreMarkers: options.honorIgnoreMarkers ?? true,
+    exclude: [...options.exclude ?? []],
+    ...options.signal === void 0 ? {} : { signal: options.signal },
+    ...options.onProgress === void 0 ? {} : { onProgress: options.onProgress }
   });
-  return options.noExcerpts ? { ...result, findings: result.findings.map((finding) => ({ ...finding, excerpt: null })) } : result;
+  return omitExcerpts ? { ...result, findings: result.findings.map((finding) => ({ ...finding, excerpt: null })) } : result;
 }
 export {
+  ScanCancelledError,
+  ScanProgressError,
+  getBuildInfo,
+  getCapabilities,
   listRules,
   scan2 as scan,
   summarize