includes:
    - phpstan-baseline.neon

parameters:
    level: 8
    # Analyse against the minimum supported PHP (composer.json require), not
    # the runtime default, so 8.5-only APIs are flagged.
    phpVersion: 80400
    parallel:
        maximumNumberOfProcesses: 1
    paths:
        - src
    excludePaths:
        - src/index.php
    ignoreErrors:
        # RedBeanPHP's stubs type Facade::find()'s $sql as literal-string to
        # discourage interpolating user input into SQL. Our listing queries
        # assemble the clause from constant SQL fragments (SQL_PUBLISHED, the
        # visibility/pagination helpers) with every value bound as a parameter,
        # so they are safe but not a single literal — accept the non-literal SQL.
        -
            message: '#expects literal-string\|null, non-falsy-string given#'
            identifier: argument.type
            paths:
                - src/response.php
                - src/response/feeds.php
                - src/theme.php
    bootstrapFiles:
        - vendor/autoload.php
        - phpstan-bootstrap.php
    universalObjectCratesClasses:
        - RedBeanPHP\OODBBean
    # ROOT_URL is derived from site config at runtime; don't constant-fold the
    # placeholder value defined in phpstan-bootstrap.php.
    #
    # LOGIN_PASSWORD is derived from LAMB_LOGIN_PASSWORD at runtime via
    # Bootstrap\login_password(). Routing it through a named function (rather
    # than the inline `getenv(...) ?: ''` this replaced) makes PHPStan actually
    # call it while resolving the define() value — unset in the analysis
    # environment, so it folds to the literal '', which makes auth.php's
    # `LOGIN_PASSWORD === ''` misconfiguration check look like dead code.
    dynamicConstantNames:
        - ROOT_URL
        - LOGIN_PASSWORD