@descent-vtt/spec-guard 0.25.0 → 0.27.0

package/dist/polyglot.js

@@ -134,11 +134,12 @@ export function literalValue(raw) {
 /* ------------------------------------------------------------------ reading */
 const IDENTIFIER = /[A-Za-z_][A-Za-z0-9_]*/y;
 /**
- * Whitespace-skipping cursor over masked code.
+ * Whitespace-skipping cursor over masked code, which a Go import and a Python
+ * dynamic import are read with.
  *
  * Exported so its edges can be pinned directly. Reaching "what does peek() do
- * at the end of the file" through a C# source string is possible but says
- * nothing about C#.
+ * at the end of the file" through a Go source string is possible but says
+ * nothing about Go.
  */
 export class Reader {
     text;
@@ -160,26 +161,6 @@ export class Reader {
     peek() {
         return this.text[this.index] ?? '';
     }
-    eat(token) {
-        if (!this.text.startsWith(token, this.index))
-            return false;
-        this.index += token.length;
-        return true;
-    }
-    /**
-     * Eats a word only when it really is the whole word.
-     *
-     * `eat('static')` also matches the first six characters of a namespace called
-     * `staticfiles`, and would then read the dependency as `files`.
-     */
-    keyword(word) {
-        if (!this.text.startsWith(word, this.index))
-            return false;
-        if (/[A-Za-z0-9_]/.test(this.text[this.index + word.length] ?? ''))
-            return false;
-        this.index += word.length;
-        return true;
-    }
     identifier() {
         IDENTIFIER.lastIndex = this.index;
         const match = IDENTIFIER.exec(this.text);
@@ -188,49 +169,6 @@ export class Reader {
         this.index += match[0].length;
         return match[0];
     }
-    /**
-     * Reads `a.b.c`, leaving out a C# alias qualifier.
-     *
-     * `global::A.B` and `Legacy::A.B` both name the namespace `A.B`: what comes
-     * before `::` says where to look it up - the global namespace, or the
-     * assembly an extern alias names - and is not part of the name. Until 0.10.2
-     * this read `global.A.B`, and no pattern written for `A.B` matched it.
-     */
-    dotted() {
-        let parts = [];
-        for (;;) {
-            const part = this.identifier();
-            if (!part)
-                break;
-            parts.push(part);
-            if (this.eat('::'))
-                parts = [];
-            else if (!this.eat('.'))
-                break;
-        }
-        return parts.join('.');
-    }
-    /**
-     * Skips a generic argument list, so an alias target's `<...>` does not end
-     * the read.
-     *
-     * No bracket counting. A `using` directive ends at the first `;` or newline
-     * whatever is nested inside its angle brackets, and the caller's only
-     * question is whether the next non-space character is that `;` - so `A<B>`
-     * and `A<B<C>>` are both passed over by the same rule. The depth counter
-     * that used to be here could not change an answer for any input C# accepts,
-     * which is another way of saying no test could hold it in place.
-     */
-    skipGenerics() {
-        if (this.peek() !== '<')
-            return;
-        while (this.index < this.text.length) {
-            const char = this.text[this.index];
-            if (char === ';' || char === '\n')
-                return;
-            this.index += 1;
-        }
-    }
 }
 /** Offset of the matching close, given the depth-tracking characters. */
 export function matchingClose(text, open, opener, closer) {
@@ -268,20 +206,27 @@ function note(collector, kind, offset, detail) {
  *
  * A line ends where Python ends one: at LF, at CRLF and at a lone CR. Only
  * LF ended one here, so every line of a file with CRLF endings kept its
- * carriage return. The pattern that reads a `from` statement cannot reach
+ * carriage return. The pattern that read a `from` statement could not reach
  * the end of such a line, and read none in the file, and a backslash before
  * the carriage return continued nothing (ADR-0008, amended 2026-10-12).
+ *
+ * `starts` is where each physical line begins, in the text and in the
+ * source. A statement after a `;` stands on a line of its own where the
+ * statement before it ran over several, and is reported there (ADR-0008,
+ * amended 2026-10-14).
  */
 export function logicalLines(code) {
     const lines = [];
     let text = '';
     let offset = 0;
+    let starts = [];
     let depth = 0;
     let start = 0;
     const flush = () => {
         if (text.trim())
-            lines.push({ text, offset });
+            lines.push({ text, offset, starts });
         text = '';
+        starts = [];
     };
     for (let index = 0; index <= code.length; index++) {
         const char = code[index];
@@ -295,7 +240,10 @@ export function logicalLines(code) {
         const physical = code.slice(start, index);
         if (!text)
             offset = start;
-        text += (text ? ' ' : '') + physical.replace(/\\$/, ' ');
+        else
+            text += ' ';
+        starts.push([text.length, start]);
+        text += physical.replace(/\\$/, ' ');
         if (depth === 0 && !/\\$/.test(physical))
             flush();
         // The two characters of a CRLF end one line. Read as two, the empty
@@ -307,12 +255,122 @@ export function logicalLines(code) {
     flush();
     return lines;
 }
-/** `import` / `from` at a statement position: line start, or after `;` or `:`. */
-const PYTHON_STATEMENT = /(?:^|[;:])[ \t]*(import|from)[ \t]+/g;
-// One blank after `import` where this has one or more is an equivalent
-// mutant: the names that follow are each trimmed before they are read, so the
-// blanks left at their head change nothing.
-const PYTHON_FROM = /^(\.*)([A-Za-z_][\w.]*)?[ \t]*import[ \t]+(.*)$/;
+/**
+ * Where an import statement may start: at the head of a logical line, or
+ * after `;` or `:`. What separates tokens is a blank, a tab or a form feed,
+ * as Python has it, and `lazy` before the keyword is Python 3.15's lazy
+ * import. The keyword is a whole word, and nothing need follow it but its
+ * next token: `from.a import(b)` is an import Python reads.
+ */
+const PYTHON_STATEMENT = /(^|[;:])([ \t\f]*)(lazy[ \t\f]+)?(import|from)(?!\p{XID_Continue})/gu;
+/** One token of an import statement, after any blanks: a name, one of its marks, or its end at a `;` or at the end of the line. */
+const PYTHON_TOKEN = /[ \t\f]*(?:([\p{XID_Start}_]\p{XID_Continue}*)|([.,()*])|;|$)/uy;
+/** What is no name: the marks of an import statement, and the `;` that ends it. */
+const PYTHON_MARKS = '.,()*;';
+/**
+ * The tokens of the statement that goes on from `from`, with `;` for its
+ * end whichever way it ended, or null where a character is no part of an
+ * import statement.
+ */
+function pythonTokens(text, from) {
+    const tokens = [];
+    PYTHON_TOKEN.lastIndex = from;
+    for (;;) {
+        const match = PYTHON_TOKEN.exec(text);
+        if (match === null)
+            return null;
+        const token = match[1] ?? match[2];
+        if (token === undefined)
+            return [...tokens, ';'];
+        tokens.push(token);
+    }
+}
+/**
+ * The modules one import statement names, read as Python's grammar has it,
+ * or null for a statement Python refuses: an import it reads is read here,
+ * and what it refuses stays unread (ADR-0008, amended 2026-10-14).
+ *
+ *   import a.b as c, d
+ *   from ..a.b import c as d, e      from . import (a, b,)      from a import *
+ *
+ * A name is not held to Python's keywords, and a statement to nothing but
+ * its own grammar: what scope it stands in, and whether the rest of its file
+ * parses, are not asked.
+ */
+function pythonImports(tokens, from, lazy) {
+    let at = 0;
+    const eat = (mark) => {
+        if (tokens[at] !== mark)
+            return false;
+        at += 1;
+        return true;
+    };
+    // A name, or nothing where a mark stands. The place is never past the `;`
+    // a statement ends with, which is a mark too.
+    const name = () => {
+        const token = tokens[at];
+        if (PYTHON_MARKS.includes(token))
+            return '';
+        at += 1;
+        return token;
+    };
+    const dotted = () => {
+        const parts = [];
+        do {
+            const part = name();
+            if (part === '')
+                return '';
+            parts.push(part);
+        } while (eat('.'));
+        return parts.join('.');
+    };
+    // `as` and the name after it, where there is one.
+    const renamed = () => !eat('as') || name() !== '';
+    if (!from) {
+        const modules = [];
+        do {
+            const module = dotted();
+            if (module === '' || !renamed())
+                return null;
+            modules.push(module);
+        } while (eat(','));
+        return eat(';') ? modules : null;
+    }
+    let dots = '';
+    while (eat('.'))
+        dots += '.';
+    // Dots, a module or both stand before `import`. A module that is no name
+    // leaves the place at what it could not read, which is not `import`.
+    const module = tokens[at] === 'import' ? '' : dotted();
+    if (`${dots}${module}` === '' || !eat('import'))
+        return null;
+    const names = [];
+    if (eat('*')) {
+        // Python 3.15 refuses a star import that is lazy.
+        if (lazy)
+            return null;
+    }
+    else {
+        const open = eat('(');
+        do {
+            const imported = name();
+            if (imported === '' || !renamed())
+                return null;
+            names.push(imported);
+            // A comma before `)` is the last, which only parentheses take: where
+            // none was opened the `)` is left standing, and ends no statement.
+        } while (eat(',') && tokens[at] !== ')');
+        if (open && !eat(')'))
+            return null;
+    }
+    if (!eat(';'))
+        return null;
+    if (module !== '')
+        return [`${dots}${module}`];
+    // `from . import a, b` - here the imported names are themselves modules,
+    // which `from .pkg import name` cannot assume.
+    return names.slice(0, MAX_EXPANSION).map((imported) => `${dots}${imported}`);
+}
 const PYTHON_DYNAMIC = /\b(__import__|import_module)[ \t]*\(/g;
 function readPython(collector) {
     const { code } = collector.masked;
@@ -320,36 +378,23 @@ function readPython(collector) {
         PYTHON_STATEMENT.lastIndex = 0;
         let match;
         while ((match = PYTHON_STATEMENT.exec(line.text)) !== null) {
-            const rest = line.text.slice(match.index + match[0].length).split(';')[0];
-            if (match[1] === 'import') {
-                // `import a.b as x, c.d` - one statement, two dependencies. A name is
-                // what stands before the first white space, which is the same text
-                // whether the split takes that one character or the run it begins:
-                // `/\s/` is an equivalent mutant here, and for `from . import` below.
-                for (const clause of rest.split(',')) {
-                    const name = clause.trim().split(/\s+/)[0];
-                    if (name)
-                        emit(collector, name, 'import', line.offset);
-                }
-                continue;
-            }
-            const from = PYTHON_FROM.exec(rest);
-            if (!from)
-                continue;
-            const dots = from[1];
-            const module = from[2] ?? '';
-            if (module || !dots) {
-                emit(collector, `${dots}${module}`, 'import', line.offset);
+            const tokens = pythonTokens(line.text, PYTHON_STATEMENT.lastIndex);
+            const modules = tokens === null ? null : pythonImports(tokens, match[4] === 'from', match[3] !== undefined);
+            // Reported on the line its first word stands on, at that line's head,
+            // as an import at the head of a logical line always was.
+            const first = match.index + match[1].length + match[2].length;
+            const [, offset] = line.starts.findLast(([at]) => at <= first);
+            // A statement that starts as an import and that Python refuses names no
+            // module, and is said, as everything that could not be read is: a rule
+            // that passes over it under --strict fails (ADR-0008, amended
+            // 2026-10-18).
+            if (modules === null) {
+                note(collector, 'refused', offset, 'a statement that starts as an import is one Python refuses, and no module is read from it');
                 continue;
             }
-            // `from . import a, b` - here the imported names are themselves modules,
-            // which `from .pkg import name` cannot assume.
-            const names = from[3].replace(/[()]/g, '');
-            for (const clause of names.split(',').slice(0, MAX_EXPANSION)) {
-                const name = clause.trim().split(/\s+/)[0];
-                if (name && name !== '*')
-                    emit(collector, `${dots}${name}`, 'import', line.offset);
-            }
+            // Python reads a name in the form NFKC gives it.
+            for (const module of modules)
+                emit(collector, module.normalize('NFKC'), 'import', offset);
         }
     }
     PYTHON_DYNAMIC.lastIndex = 0;
@@ -395,58 +440,148 @@ function readGo(collector) {
     }
 }
 /* --------------------------------------------------------------------- rust */
-const RUST_USE = /\b(?:use|extern[ \t\r\n]+crate)\b/g;
+/** Rust's white space, Unicode's Pattern_White_Space, which a masked comment is too. */
+const RUST_SPACE = String.raw `\t\n\v\f\r \u{85}\u{200e}\u{200f}\u{2028}\u{2029}`;
+/**
+ * Where a use declaration or an extern crate starts. The keyword is a whole
+ * word, so not the tail of `r#use`, a raw identifier.
+ */
+const RUST_USE = new RegExp(String.raw `(?<![\p{XID_Continue}#])(?:use|extern[${RUST_SPACE}]+crate)(?!\p{XID_Continue})`, 'gu');
 /**
- * Expands one `use` path into the module paths it actually names.
+ * One token of a use declaration, after any white space: a name, raw or not,
+ * `$crate` or another of a macro's names, or a mark. Nothing need separate two
+ * tokens that cannot be read as one.
+ */
+const RUST_TOKEN = new RegExp(String.raw `[${RUST_SPACE}]*(?:(r#)?([\p{XID_Start}_]\p{XID_Continue}*)|(\$[\p{XID_Start}_]\p{XID_Continue}*|::|[{},*;]))`, 'uy');
+/** Nothing but white space, to the end of the text. */
+const RUST_BLANK = new RegExp(String.raw `^[${RUST_SPACE}]*$`, 'u');
+/** What `r#` cannot make a raw identifier of. */
+const RUST_NOT_RAW = new Set(['_', 'crate', 'self', 'Self', 'super']);
+/** What no segment of a path is unless written raw: `_`, and the keywords a declaration starts with. */
+const RUST_NOT_SEGMENT = new Set(['_', 'use', 'extern']);
+/** The token at `index`, or null where none starts. */
+function rustToken(text, index) {
+    RUST_TOKEN.lastIndex = index;
+    const match = RUST_TOKEN.exec(text);
+    if (match === null)
+        return null;
+    const [, raw, word, mark] = match;
+    // `r#` stands only before a name.
+    if (raw !== undefined && RUST_NOT_RAW.has(word))
+        return null;
+    return { text: word?.normalize('NFC') ?? mark, name: word !== undefined, raw: raw !== undefined, end: RUST_TOKEN.lastIndex };
+}
+/**
+ * The paths one use tree names, segment by segment, read as the Rust
+ * Reference's grammar has it:
+ *
+ *   (path ::)? *    (path ::)? { tree, ... }    path (as name)?
  *
- * `a::{b, c::{d, e}}` is three dependencies written as one statement, and a
- * rule about `a::c` has to see them. Returns null when the expansion would
- * exceed MAX_EXPANSION, which the caller reports rather than truncating.
+ * `refused` where rustc would refuse the text, and `overflow` past
+ * MAX_EXPANSION paths or groups nested that deep. `end` is where reading
+ * stopped, past the tree or at the token it could not read.
  */
-export function expandUsePath(input) {
-    const text = input.trim();
-    const open = text.indexOf('{');
-    if (open === -1) {
-        // `a::b as c` and `a::b;` both name `a::b`. Only what stands before the
-        // alias is read, and white space left at its end is taken off on the next
-        // line: one space on either side of `as` splits at a place that reads the
-        // same, so the pattern without either `+` is an equivalent mutant.
-        const leaf = text.split(/\s+as\s+/)[0];
-        const trimmed = leaf.replace(/[;\s]+$/, '').replace(/^::/, '');
-        return trimmed ? [trimmed] : [];
-    }
-    const close = matchingClose(text, open, '{', '}');
-    const prefix = text.slice(0, open).replace(/::\s*$/, '').trim();
-    const inner = text.slice(open + 1, close);
-    const parts = [];
-    let depth = 0;
-    let current = '';
-    for (const char of inner) {
-        if (char === '{')
-            depth += 1;
-        if (char === '}')
-            depth -= 1;
-        if (char === ',' && depth === 0) {
-            parts.push(current);
-            current = '';
-            continue;
-        }
-        current += char;
-    }
-    parts.push(current);
-    const results = [];
-    for (const part of parts) {
-        const expanded = expandUsePath(part);
-        if (expanded === null)
+function readUseTree(text, from) {
+    let index = from;
+    const take = (accept) => {
+        const token = rustToken(text, index);
+        if (token === null || !accept(token))
             return null;
-        for (const item of expanded) {
-            // `use a::{self, b}` names `a` itself alongside `a::b`.
-            results.push(item === 'self' || !prefix ? prefix || item : `${prefix}::${item}`);
-            if (results.length > MAX_EXPANSION)
-                return null;
+        index = token.end;
+        return token;
+    };
+    // No name is written as a mark is.
+    const mark = (text) => take((token) => token.text === text) !== null;
+    // A name, or `$crate` or another name of a macro's, which rustc reads
+    // where the macro is expanded.
+    const named = (token) => token.name || token.text.startsWith('$');
+    // `_` is a token of its own, and stands in a path only after `as`. A
+    // segment is never the keyword a declaration starts with, so that a
+    // declaration left open is never read on into the next.
+    const segment = () => take((token) => named(token) && (token.raw || !RUST_NOT_SEGMENT.has(token.text)))?.text ?? null;
+    const paths = [];
+    const tree = (head, depth) => {
+        if (depth > MAX_EXPANSION)
+            return 'overflow';
+        const path = [...head];
+        mark('::');
+        for (let name = segment(); name !== null; name = segment()) {
+            path.push(name);
+            if (mark('::'))
+                continue;
+            if (take((token) => !token.raw && token.text === 'as') !== null && take(named) === null)
+                return 'refused';
+            paths.push(path);
+            return 'read';
+        }
+        // A separator was the last token read, or nothing was.
+        if (mark('*')) {
+            paths.push([...path, '*']);
+            return 'read';
+        }
+        if (!mark('{'))
+            return 'refused';
+        if (mark('}')) {
+            // An empty group imports nothing, and rustc still reads the path before
+            // it as an import: its lint names `use a::{};` an unused one.
+            paths.push(path);
+            return 'read';
         }
+        do {
+            const read = tree(path, depth + 1);
+            if (read !== 'read')
+                return read;
+            if (paths.length > MAX_EXPANSION)
+                return 'overflow';
+        } while (mark(',') && rustToken(text, index)?.text !== '}');
+        return mark('}') ? 'read' : 'refused';
+    };
+    const read = tree([], 0);
+    return { paths: read === 'read' ? paths : read, end: index };
+}
+/** The module a path of a use tree names, in the notation a rule writes, or nothing. */
+function usePath(segments) {
+    // `a::b::self` names `a::b`, as `a::{self}` names `a`. A glob of nothing,
+    // the one path a `*` starts, names no module.
+    const named = segments.length > 1 && segments.at(-1) === 'self' ? segments.slice(0, -1) : segments;
+    return named[0] === '*' ? '' : named.join('::');
+}
+/**
+ * Expands one use tree, with its `;` or without, into the module paths it
+ * names.
+ *
+ * `a::{b, c::{d, e}}` is three dependencies written as one declaration, and a
+ * rule about `a::c` has to see them. A tree is read as rustc reads it: white
+ * space and comments between its tokens, a raw identifier without its `r#`, a
+ * name in its NFC form, and `self` at the end of a path naming what is before
+ * it. Text that is no use tree, which rustc refuses, names nothing (ADR-0008,
+ * amended 2026-10-18). Returns null when the tree would name more than
+ * MAX_EXPANSION paths, or nest its groups deeper than that, which the caller
+ * reports rather than truncating.
+ */
+export function expandUsePath(input) {
+    const { paths, end } = readUseTree(input, 0);
+    if (paths === 'overflow')
+        return null;
+    const semicolon = rustToken(input, end);
+    const rest = input.slice(semicolon?.text === ';' ? semicolon.end : end);
+    return paths !== 'refused' && RUST_BLANK.test(rest) ? paths.map(usePath).filter((path) => path !== '') : [];
+}
+/**
+ * The crate an extern crate declaration names, read from after `crate`, or
+ * null where rustc refuses it: `extern crate name (as alias)? ;`, the name an
+ * identifier or `self`.
+ */
+function externCrate(text, from) {
+    const crate = rustToken(text, from);
+    if (crate === null || !crate.name || crate.text === '_')
+        return null;
+    let next = rustToken(text, crate.end);
+    if (next !== null && !next.raw && next.text === 'as') {
+        const alias = rustToken(text, next.end);
+        next = alias !== null && alias.name ? rustToken(text, alias.end) : null;
     }
-    return results;
+    return next?.text === ';' ? crate.text : null;
 }
 function readRust(collector) {
     const { code } = collector.masked;
@@ -454,35 +589,206 @@ function readRust(collector) {
     let match;
     while ((match = RUST_USE.exec(code)) !== null) {
         const start = match.index + match[0].length;
-        let end = start;
-        let depth = 0;
-        while (end < code.length) {
-            const char = code[end];
-            if (char === '{')
+        if (match[0] !== 'use') {
+            const crate = externCrate(code, start);
+            if (crate !== null)
+                emit(collector, crate, 'use', match.index);
+            continue;
+        }
+        const { paths, end } = readUseTree(code, start);
+        if (paths === 'overflow') {
+            note(collector, 'truncated', match.index, `a use declaration expands to more than ${MAX_EXPANSION} module paths, or nests its groups deeper than that`);
+        }
+        else if (paths !== 'refused' && rustToken(code, end)?.text === ';') {
+            for (const path of paths)
+                emit(collector, usePath(path), 'use', match.index);
+        }
+        // On from where reading stopped, past the tree or at the token rustc
+        // would refuse, so that no token is read twice. No segment is `use` or
+        // `extern`, so no declaration is read into the next.
+        RUST_USE.lastIndex = end;
+    }
+}
+/* -------------------------------------------------------------------- c-sharp */
+/** What C# lets continue an identifier beside a letter: a mark, a digit, a connector, a formatting character. */
+const CSHARP_PART = String.raw `\p{L}\p{Nl}\p{Mn}\p{Mc}\p{Nd}\p{Pc}\p{Cf}`;
+/** C#'s white space, and what ends a line. */
+const CSHARP_BLANK = String.raw `\p{Zs}\t\v\f`;
+const CSHARP_BREAK = String.raw `\r\n\u{85}\u{2028}\u{2029}`;
+/**
+ * Everything the C# reader stops at: a using, a namespace, or a brace. Each
+ * keyword is a whole word, so neither the identifier `@using` nor a word an
+ * escape goes on with.
+ */
+const CSHARP_TOKEN = new RegExp(String.raw `(?<![${CSHARP_PART}@\\])(?:using|namespace)(?![${CSHARP_PART}\\])|[{}]`, 'gu');
+/**
+ * A pre-processing directive, which takes the whole of its line, so that the
+ * message of a `#region` is no code.
+ */
+const CSHARP_DIRECTIVE = new RegExp(String.raw `^[${CSHARP_BLANK}]*#[^${CSHARP_BREAK}]*`, 'gmu');
+/**
+ * One token of a using directive or a namespace declaration, after any white
+ * space or end of a line, which a masked comment is too: a word, as an
+ * identifier and a keyword are both written, or a mark.
+ */
+const CSHARP_WORD = new RegExp(String.raw `[${CSHARP_BLANK}${CSHARP_BREAK}]*(?:(@?(?:[${CSHARP_PART}]|\\u[\dA-Fa-f]{4}|\\U[\dA-Fa-f]{8})+)|(::|[.;=<>,?*\[\](){}]))`, 'uy');
+const CSHARP_ESCAPE = /\\u([\dA-Fa-f]{4})|\\U([\dA-Fa-f]{8})/g;
+const CSHARP_IDENTIFIER = new RegExp(String.raw `^[\p{L}\p{Nl}_][${CSHARP_PART}]*$`, 'u');
+/**
+ * The identifier a word is, as C# compares two: with no `@`, each escape the
+ * character it stands for, and no formatting character. Null for a word that
+ * is no identifier: a digit first, or an escape of what no identifier holds.
+ */
+function csharpIdentifier(word) {
+    // A word holds an `@` only as its first character.
+    const decoded = word.replace('@', '').replace(CSHARP_ESCAPE, (_, short, long) => {
+        try {
+            return String.fromCodePoint(Number.parseInt(short ?? long, 16));
+        }
+        catch {
+            // \U can write a number no character has. A dot is no part of a name.
+            return '.';
+        }
+    });
+    return CSHARP_IDENTIFIER.test(decoded) ? decoded.replace(/\p{Cf}/gu, '') : null;
+}
+/** What a type argument list holds beside names and angle brackets: no pointer, which no type argument is. */
+const TYPE_MARKS = ['.', ',', '?', '[', ']', '(', ')', '::'];
+/** A cursor over the tokens of one directive or declaration. */
+class CsharpTokens {
+    text;
+    index;
+    constructor(text, index) {
+        this.text = text;
+        this.index = index;
+    }
+    next() {
+        CSHARP_WORD.lastIndex = this.index;
+        const match = CSHARP_WORD.exec(this.text);
+        return match === null ? null : { word: match[1], mark: match[2], end: CSHARP_WORD.lastIndex };
+    }
+    mark(mark) {
+        const token = this.next();
+        if (token?.mark !== mark)
+            return false;
+        this.index = token.end;
+        return true;
+    }
+    /** A keyword, as it is written: `@static`, and `static` with an escape in it, are identifiers. */
+    keyword(word) {
+        const token = this.next();
+        if (token?.word !== word)
+            return false;
+        this.index = token.end;
+        return true;
+    }
+    /**
+     * An identifier, which is never the keyword `using` or `namespace`: so a
+     * directive left open is never read on into the next.
+     */
+    identifier() {
+        const token = this.next();
+        const name = token?.word === undefined || token.word === 'using' || token.word === 'namespace' ? null : csharpIdentifier(token.word);
+        if (name !== null)
+            this.index = token.end;
+        return name;
+    }
+    /** `name (. name)*`, the name of a namespace declaration. */
+    qualified() {
+        const parts = [];
+        for (let part = this.identifier(); part !== null; part = this.identifier()) {
+            parts.push(part);
+            if (!this.mark('.'))
+                return parts.join('.');
+        }
+        return null;
+    }
+    /**
+     * A namespace or type name, `(alias ::)? name (. name)*`, or null. What
+     * stands before `::` says where to look the name up, the global namespace
+     * or an extern alias, and is no part of it. Where `generic` allows them, a
+     * type argument list after a name is passed over.
+     */
+    name(generic) {
+        let part = this.identifier();
+        if (part !== null && this.mark('::'))
+            part = this.identifier();
+        const parts = [];
+        for (; part !== null; part = this.identifier()) {
+            parts.push(part);
+            if (generic && !this.typeArguments())
+                return null;
+            if (!this.mark('.'))
+                return parts.join('.');
+        }
+        return null;
+    }
+    /**
+     * Passes over a type argument list, `<` to the `>` that closes it, and is
+     * false where something no type holds comes first. Token by token, so it
+     * never reads past a `;`, a brace or the next directive.
+     */
+    typeArguments() {
+        if (!this.mark('<'))
+            return true;
+        for (let depth = 1; depth > 0;) {
+            if (this.mark('<'))
                 depth += 1;
-            else if (char === '}') {
-                if (depth === 0)
-                    break;
+            else if (this.mark('>'))
                 depth -= 1;
-            }
-            else if (char === ';' && depth === 0)
-                break;
-            end += 1;
+            else if (this.identifier() === null && !TYPE_MARKS.some((mark) => this.mark(mark)))
+                return false;
+        }
+        return true;
+    }
+    /** The array, nullable and pointer marks after a type, `[]`, `[,]`, `?` and `*`, and false for `[` left open. */
+    suffixes() {
+        for (;;) {
+            if (this.mark('?') || this.mark('*'))
+                continue;
+            if (!this.mark('['))
+                return true;
+            while (this.mark(','))
+                continue;
+            if (!this.mark(']'))
+                return false;
+        }
+    }
+}
+/**
+ * The namespace or type a using directive names, read from after `using`,
+ * or null where C# would refuse it:
+ *
+ *   using static unsafe? type ;    using unsafe? alias = name-or-type ;    using namespace ;
+ *
+ * `global` before `using` changes nothing of it. A using statement and a
+ * using declaration are none of these, and are read as nothing.
+ */
+function usingDirective(tokens) {
+    let target;
+    if (tokens.keyword('static')) {
+        tokens.keyword('unsafe');
+        target = tokens.name(true);
+    }
+    else {
+        const unsafe = tokens.keyword('unsafe');
+        const start = tokens.index;
+        if (tokens.identifier() !== null && tokens.mark('=')) {
+            target = tokens.name(true);
+            // An alias may name an array, a nullable or a pointer of a type.
+            if (!tokens.suffixes())
+                return null;
         }
-        const expanded = expandUsePath(code.slice(start, end));
-        if (expanded === null) {
-            note(collector, 'truncated', match.index, `a use declaration expands to more than ${MAX_EXPANSION} module paths`);
+        else if (unsafe) {
+            return null;
         }
         else {
-            for (const specifier of expanded)
-                emit(collector, specifier, 'use', match.index);
+            tokens.index = start;
+            target = tokens.name(false);
         }
-        RUST_USE.lastIndex = end;
     }
+    return tokens.mark(';') ? target : null;
 }
-/* -------------------------------------------------------------------- c-sharp */
-/** Everything the C# reader stops at: a using, a namespace, or a brace. */
-const CSHARP_TOKEN = /\b(?:using|namespace)\b|[{}]/g;
 /**
  * Reads using directives and the namespaces a file declares, in one pass.
  *
@@ -496,10 +802,17 @@ const CSHARP_TOKEN = /\b(?:using|namespace)\b|[{}]/g;
  * the brace depth falls below its body's, so nothing here compares an offset
  * with the offset of a delimiter - which no keyword can ever sit on, and which
  * would leave `<` and `<=` meaning the same thing to every test. The code is
- * masked, so no brace in a string or a comment counts.
+ * masked, so no brace in a string, a comment or a pre-processing directive
+ * counts.
+ *
+ * A directive and a declaration are read token by token, as the C#
+ * specification has them (ADR-0008, amended 2026-10-18): white space and
+ * comments between the tokens, an identifier as C# compares two, and what
+ * C# refuses read as nothing.
  */
 function readCsharp(collector) {
-    const { code } = collector.masked;
+    // A byte order mark at the head of a file is no character of its text.
+    const code = collector.masked.code.replace(/^\u{feff}/u, ' ').replace(CSHARP_DIRECTIVE, (line) => ' '.repeat(line.length));
     const declared = new Set();
     const open = [];
     let fileScoped;
@@ -518,52 +831,33 @@ function readCsharp(collector) {
                 open.pop();
             continue;
         }
-        const reader = new Reader(code);
-        reader.index = match.index + token.length;
-        reader.skipSpace();
+        const tokens = new CsharpTokens(code, CSHARP_TOKEN.lastIndex);
         if (token === 'namespace') {
-            // `@namespace` is an identifier rather than the keyword, and no name
-            // follows it.
-            const name = reader.dotted();
-            if (name === '')
-                continue;
-            reader.skipSpace();
-            const outer = open.at(-1);
-            const full = outer === undefined ? name : `${outer.name}.${name}`;
-            // A file-scoped namespace covers the rest of the file, and C# allows
-            // neither a second one nor a block beside it.
-            if (reader.peek() === ';')
-                fileScoped = full;
-            else if (reader.peek() === '{')
-                open.push({ name: full, depth: depth + 1 });
-            else
-                continue;
-            declared.add(full);
-            continue;
+            const name = tokens.qualified();
+            if (name !== null) {
+                const scoped = tokens.mark(';');
+                if (scoped || tokens.mark('{')) {
+                    const outer = open.at(-1);
+                    const full = outer === undefined ? name : `${outer.name}.${name}`;
+                    // A file-scoped namespace covers the rest of the file, and C# allows
+                    // neither a second one nor a block beside it. A block's brace is
+                    // read here, and counted.
+                    if (scoped)
+                        fileScoped = full;
+                    else
+                        open.push({ name: full, depth: (depth += 1) });
+                    declared.add(full);
+                }
+            }
         }
-        if (reader.keyword('static'))
-            reader.skipSpace();
-        let target = reader.dotted();
-        reader.skipSpace();
-        // `using Alias = System.Text.Json;` - the dependency is the right-hand side.
-        if (reader.eat('=')) {
-            reader.skipSpace();
-            target = reader.dotted();
-            reader.skipSpace();
-            reader.skipGenerics();
-            reader.skipSpace();
+        else {
+            const target = usingDirective(tokens);
+            if (target !== null)
+                emit(collector, target, 'using', match.index, open.at(-1)?.name ?? fileScoped);
         }
-        // The whole of what separates a directive from a resource statement, and
-        // it is one condition on purpose. `using (var s = ...)` reads no name at
-        // all and stops on `(`; `using var s = ...` reads `var` and then finds `s`
-        // where a terminator has to be. Earlier versions guarded those two shapes
-        // explicitly, and a third time against an empty name - none of the three
-        // changed an outcome, which mutation testing established by leaving the
-        // tests green with each of them defeated. `emit` refuses an empty
-        // specifier, so this line is the only check that has to be right.
-        if (reader.peek() !== ';')
-            continue;
-        emit(collector, target, 'using', match.index, open.at(-1)?.name ?? fileScoped);
+        // On from where reading stopped, so that no token is read twice. No name
+        // is `using` or `namespace`, so no directive is read into the next.
+        CSHARP_TOKEN.lastIndex = tokens.index;
     }
     collector.namespaces = [...declared];
 }