@massu/core 1.12.1 → 1.12.2

package/CHANGELOG.md

@@ -4,6 +4,37 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [1.12.2] - 2026-05-18
+
+**Security MEDIUM sweep (`plan-2026-05-18-security-medium-sweep`)**. Closes the 5 MEDIUM findings from the post-1.12.0 `massu-security-reviewer` audit-loop with structural drift-guards for each. M-1 IP_HASH_PEPPER consistency (silent-fallback vs throw class), M-2 webhook POST schema symmetry, M-3 Lemon Squeezy webhook idempotency parity with Stripe, M-4 v1 audit UUID echo redaction, M-5 SSO IdP host allowlist (precondition for SSO re-enable). New CR-51 + VR-PEPPER-GUARD + pattern-scanner Check 27.
+
+### Added
+
+- **M-1 / CR-51 / VR-PEPPER-GUARD** — `website/src/lib/ip/pepper-guard.ts` exporting `requireIpHashPepper()` + `hashIpWithPepper(ip, { length: 16 | 32 })` as the SOLE allowed reader of the IP hash pepper env var. Production fail-closed via `MissingPepperError`; documented test override via `MASSU_TEST_ALLOW_EMPTY_PEPPER=1`. Closes the structural drift class where `evidence/[id]/download/route.ts:21` silent-fallback diverged from `license/activate/route.ts:34-40` throw.
+- **M-2 / VR-SCHEMA-SYMMETRY** — `webhookCreateSchema` in `src/lib/validations.ts`, symmetric to `webhookUpdateSchema`. `description` capped at 500 chars on BOTH schemas (CR-9 bypass-prevention). `route-schema-symmetry.test.ts` drift-guard scans every `app/api/v1/**/route.ts` POST/PATCH/PUT handler for `*Schema.safeParse` invocation.
+- **M-3 / VR-LS-IDEMPOTENCY** — migration `042_lemon_squeezy_webhook_events.sql` + `lemon_squeezy_event_apply(p_event_id, p_event_type, p_payload, ...)` RPC returning TEXT `processing_status` (`processed_ok` | `duplicate_ignored` | `permanent_failure` | `transient_failure`). Route handler maps each status to HTTP 200/200/422/500 — 422 stops LS retries on permanent failures (Stripe's BOOLEAN return can't carry this contract). Down migration shipped alongside (`.down.sql`) per §6.5 Rollback Plan.
+- **M-4 / VR-V1-NO-UUID-LEAK** — `v1-error-response-no-uuid-leak.test.ts` drift-guard scanning every `app/api/v1/**/route.ts` source for caller-controlled UUID interpolation in error/note response surfaces (`apiError`, `note =`, etc.). `${auth.orgId}` self-echo explicitly permitted (caller's auth context already binds them).
+- **M-5 / VR-SSO-IDP-ALLOWLIST** — `website/src/lib/sso/idp-allowlist.ts` with `SSO_IDP_HOSTS_BY_PROVIDER` constant + `validateSsoUrlAgainstProvider(provider, ssoUrl)` + `inferSsoProviderFromUrl(ssoUrl)`. TLD-aware wildcard host match (`*.okta.com` does NOT match `evil-okta.com`); HTTPS-only scheme enforcement. Covers Okta, Auth0, Azure AD (microsoftonline.com + .us), Google Workspace. Generic OIDC deferred to `plan-B.3-followup` SSO re-enable.
+- **`MASSU_SSO_ALLOWLIST_LOG_ONLY` env-flag** for the M-5 staged rollout — `isSsoAllowlistLogOnly()` in `sso-flag.ts`. Operator runs 24h log-only post-deploy to monitor false-positives before flipping to enforcing.
+- **`scripts/massu-pattern-scanner.sh` Check 27** — bash drift-guard for security-sensitive env-var patterns. 27a flags raw `process.env.<NAME>_PEPPER` outside `lib/<purpose>/<purpose>-guard.ts`; 27b flags any `process.env.<NAME>_(PEPPER|SECRET|KEY) ?? <literal>` silent-fallback adjacent to such reads (framework-platform keys exempt).
+- **CR-51** canonical rule in `.claude/CLAUDE.md`: security-sensitive env vars must use a dedicated guard helper. Three-layer enforcement: pattern-scanner Check 27 + vitest drift-guard + the guard helper is the ONLY allowed reader.
+- 5 new vitest drift-guards: `ip-pepper-guard-usage.test.ts`, `route-schema-symmetry.test.ts`, `lemon-squeezy-event-atomic.test.ts`, `v1-error-response-no-uuid-leak.test.ts`, `sso-idp-allowlist.test.ts` (+23 happy/negative/integration cases for M-5 alone).
+
+### Changed
+
+- **Lemon Squeezy webhook route (`src/app/api/lemon-squeezy/webhook/route.ts`)** — 4 handlers (`handleOrderCreated`, `handleLicenseKeyCreated`, `handleOrderRefunded`, `handleSubscriptionCancelled`) refactored to dispatch through `lemon_squeezy_event_apply` RPC. Direct `from('book_purchases').insert` / `from('organizations').update` calls REMOVED from the route. Pre-RPC test-mode mismatch rejection now returns `permanent_failure` (HTTP 422) instead of throwing.
+- **`src/app/api/v1/audit/route.ts:66`** — `${actor}` UUID echo dropped from non-empty-org-no-rows note. New message: "No audit entries for the actor filter in this org. Verify the user is a member of org ${auth.orgId}." Eliminates the UUID-existence-probe side-channel for authenticated API-key holders.
+- **`src/app/api/sso/route.ts`** — invokes `inferSsoProviderFromUrl(ssoConfig.sso_url)` before constructing `redirect_url`. Non-allowlisted host returns 502 with `X-SSO-Validation-Failure: idp-host-not-allowlisted` (or logs-only under `MASSU_SSO_ALLOWLIST_LOG_ONLY=1`).
+- **`src/app/api/sso/callback/route.ts:exchangeOidcCode`** — same allowlist guard applied BEFORE any outbound `fetch()` to the IdP token endpoint. Closes the SSRF-to-IdP vector at the callback layer (P5-007).
+- **`scripts/massu-security-scanner.sh` Check 6** — RLS coverage scanner now excludes `*.down.sql` rollback scripts (CR-46 structural fix; the literal "CREATE TABLE" only appears in their explanatory comments).
+- **`website/src/data/stats.ts`** — Database Tables 44 → 45 (new `lemon_squeezy_webhook_events`), Canonical Rules 16 → 17 (new CR-51). Marketing count drift-guard covers both.
+- **`website/src/__tests__/changelog-parse.test.ts:EXPECTED_COUNT`** bumped 40 → 41.
+- **`website/src/__tests__/migration-grant-discipline.test.ts:SERVICE_ROLE_ONLY_TABLES`** adds `lemon_squeezy_webhook_events: '042_lemon_squeezy_webhook_events.sql'`.
+
+### Fixed
+
+- Pre-existing `plan-token-changelog-coverage.test.ts` PTCC-03 failure surfaced during the loop — 3 post-tag chore-commit plan-tokens (`plan-stage-d-medium-sweep`, `plan-stage-e-low-info-sweep`, `plan-2026-05-16-prelaunch-audit`) added to the documented-divergence allowlist with the same rationale pattern as the existing `plan-stage-c-high-batch` entry.
+
 ## [1.12.1] - 2026-05-18
 
 **Pre-push ↔ CI parity (`plan-2026-05-18-pre-push-ci-parity`)**. Closes the structural drift class surfaced 2026-05-18 when SHA `b26fbb1` passed `pre-push-light` locally but failed CI on 4 distinct gates spread across 3 separate workflow YAMLs (`@massu/types/dist` missing → `ci.yml`, `eslint-rules/` missing from `PUBLIC_DIRS` → `sync-check.yml`, `diff-commands-vs-docs.sh` hardcoded path → `sync-check.yml`, Tarball E2E adapter list stale → `ci.yml`). The two operator-pushed fix attempts `8c6b843` + `d3164f7` fixed the specific instances but left the bug class wide open. This release closes the CLASS via three-layer enforcement.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@massu/core",
-  "version": "1.12.1",
+  "version": "1.12.2",
   "type": "module",
   "description": "AI Engineering Governance MCP Server - Session memory, knowledge system, feature registry, code intelligence, rule enforcement, tiered tooling (12 free / 73 total), 59 workflow commands, 11 agents, 20+ patterns",
   "main": "./dist/cli.js",

package/dist/detect/adapters/aspnet.js

@@ -1,577 +0,0 @@
-// ../adapter-aspnet/dist/index.js
-import { Parser as Parser2 } from "web-tree-sitter";
-
-// src/detect/adapters/query-helpers.ts
-import { Query } from "web-tree-sitter";
-var InvalidQueryError = class extends Error {
-  queryName;
-  querySource;
-  cause;
-  constructor(queryName, querySource, cause) {
-    const causeMsg = cause instanceof Error ? cause.message : String(cause);
-    super(
-      `[query-helpers] Invalid Tree-sitter query "${queryName}": ${causeMsg}
-Query source:
-${querySource}`
-    );
-    this.name = "InvalidQueryError";
-    this.queryName = queryName;
-    this.querySource = querySource;
-    this.cause = cause;
-  }
-};
-var queryCache = /* @__PURE__ */ new WeakMap();
-function compileQuery(language, source, queryName) {
-  let perLang = queryCache.get(language);
-  if (!perLang) {
-    perLang = /* @__PURE__ */ new Map();
-    queryCache.set(language, perLang);
-  }
-  const cached = perLang.get(source);
-  if (cached) return cached;
-  let q;
-  try {
-    q = new Query(language, source);
-  } catch (e) {
-    throw new InvalidQueryError(queryName, source, e);
-  }
-  perLang.set(source, q);
-  return q;
-}
-function runQuery(parser, source, queryText, queryName, filePath) {
-  const language = parser.language;
-  if (!language) {
-    throw new InvalidQueryError(
-      queryName,
-      queryText,
-      new Error("Parser has no language assigned")
-    );
-  }
-  const query = compileQuery(language, queryText, queryName);
-  const tree = parser.parse(source);
-  if (!tree) return [];
-  let matches;
-  try {
-    matches = query.matches(tree.rootNode);
-  } catch (e) {
-    throw new InvalidQueryError(queryName, queryText, e);
-  }
-  const out = [];
-  for (const match of matches) {
-    if (!match.captures || match.captures.length === 0) continue;
-    const captures = {};
-    let earliestLine = Number.POSITIVE_INFINITY;
-    for (const cap of match.captures) {
-      const node = cap.node;
-      captures[cap.name] = node.text;
-      if (node.startPosition.row + 1 < earliestLine) {
-        earliestLine = node.startPosition.row + 1;
-      }
-    }
-    out.push({
-      captures,
-      file: filePath,
-      line: Number.isFinite(earliestLine) ? earliestLine : 1,
-      queryName
-    });
-  }
-  try {
-    tree.delete();
-  } catch {
-  }
-  return out;
-}
-
-// src/detect/adapters/tree-sitter-loader.ts
-import { createHash } from "crypto";
-import {
-  mkdirSync,
-  readdirSync,
-  readFileSync,
-  writeFileSync,
-  renameSync,
-  unlinkSync,
-  lstatSync,
-  chmodSync,
-  utimesSync
-} from "fs";
-import { homedir } from "os";
-import { dirname, join } from "path";
-import { Language, Parser } from "web-tree-sitter";
-var GrammarSHAMismatchError = class extends Error {
-  language;
-  expected;
-  actual;
-  constructor(language, expected, actual) {
-    super(
-      `[tree-sitter-loader] SHA-256 mismatch for grammar "${language}". Expected ${expected}, got ${actual}. REFUSING to load \u2014 see Phase 3.5 audit attack vector #3.`
-    );
-    this.name = "GrammarSHAMismatchError";
-    this.language = language;
-    this.expected = expected;
-    this.actual = actual;
-  }
-};
-var GrammarUnavailableError = class extends Error {
-  language;
-  cause;
-  constructor(language, cause) {
-    const causeMsg = cause instanceof Error ? cause.message : cause ? String(cause) : "no cached grammar and download failed";
-    super(
-      `[tree-sitter-loader] Grammar for "${language}" is unavailable: ${causeMsg}. Falling back to regex introspection for files in ${language}.`
-    );
-    this.name = "GrammarUnavailableError";
-    this.language = language;
-    this.cause = cause;
-  }
-};
-var GrammarCacheSymlinkError = class extends Error {
-  cachePath;
-  constructor(cachePath) {
-    super(
-      `[tree-sitter-loader] Refusing to load grammar \u2014 cache path "${cachePath}" is a symlink or non-regular file. (Phase 3.5 finding #3 \u2014 symlink attack vector.)`
-    );
-    this.name = "GrammarCacheSymlinkError";
-    this.cachePath = cachePath;
-  }
-};
-var GrammarUrlNotHttpsError = class extends Error {
-  url;
-  constructor(url) {
-    super(
-      `[tree-sitter-loader] Refusing to download grammar from non-HTTPS URL: ${url}. Only https:// URLs are accepted. (Phase 3.5 finding #3.)`
-    );
-    this.name = "GrammarUrlNotHttpsError";
-    this.url = url;
-  }
-};
-var GRAMMAR_MANIFEST = {
-  python: {
-    url: "https://unpkg.com/tree-sitter-wasms@0.1.13/out/tree-sitter-python.wasm",
-    sha256: "9056d0fb0c337810d019fae350e8167786119da98f0f282aceae7ab89ee8253b",
-    version: "0.1.13"
-  },
-  typescript: {
-    url: "https://unpkg.com/tree-sitter-wasms@0.1.13/out/tree-sitter-typescript.wasm",
-    sha256: "8515404dceed38e1ed86aa34b09fcf3379fff1b4ff9dd3967bcd6d1eb5ac3d8f",
-    version: "0.1.13"
-  },
-  javascript: {
-    url: "https://unpkg.com/tree-sitter-wasms@0.1.13/out/tree-sitter-javascript.wasm",
-    sha256: "63812b9e275d26851264734868d27a1656bd44a2ef6eb3e85e6b03728c595ab5",
-    version: "0.1.13"
-  },
-  swift: {
-    url: "https://unpkg.com/tree-sitter-wasms@0.1.13/out/tree-sitter-swift.wasm",
-    sha256: "41c4fdb2249a3aa6d87eed0d383081ff09725c2248b4977043a43825980ffcc7",
-    version: "0.1.13"
-  },
-  // ----------------------------------------------------------------
-  // Plan 3c Phase 7 expansion (2026-05-07):
-  //
-  // Six additional grammars to support the registry-verified framework
-  // adapters (go-chi, rails, aspnet, spring, ktor, phoenix) plus the
-  // bundled adapters in the same language families (gin/echo/fiber,
-  // sinatra, etc.). All entries use the SAME pinned tree-sitter-wasms
-  // version (0.1.13) as the v1 four to keep the dependency surface
-  // single-source.
-  //
-  // SHA-256s computed 2026-05-07 via:
-  //   curl -fsSL <url> | shasum -a 256
-  //
-  // The unpkg filename for C# uses an underscore (`c_sharp`) while the
-  // TreeSitterLanguage identifier uses no separator (`csharp`); the map
-  // key is the type identifier, the URL is the storage path — they do
-  // NOT need to match, the same as how `python` maps to `tree-sitter-
-  // python.wasm`. This is intentional and validated by the manifest
-  // shape test in tree-sitter-loader-manifest.test.ts.
-  // ----------------------------------------------------------------
-  go: {
-    url: "https://unpkg.com/tree-sitter-wasms@0.1.13/out/tree-sitter-go.wasm",
-    sha256: "9963ca89b616eaf04b08a43bc1fb0f07b85395bec313330851f1f1ead2f755b6",
-    version: "0.1.13"
-  },
-  ruby: {
-    url: "https://unpkg.com/tree-sitter-wasms@0.1.13/out/tree-sitter-ruby.wasm",
-    sha256: "93a5022855314cdb45458c7bb026a24a0ebc3a5ff6439e542e881f14dfa13a39",
-    version: "0.1.13"
-  },
-  csharp: {
-    url: "https://unpkg.com/tree-sitter-wasms@0.1.13/out/tree-sitter-c_sharp.wasm",
-    sha256: "6266a7e32d68a3459104d994dc848df15d5672b0ea8e86d327274b694f8e6991",
-    version: "0.1.13"
-  },
-  java: {
-    url: "https://unpkg.com/tree-sitter-wasms@0.1.13/out/tree-sitter-java.wasm",
-    sha256: "637aac4415fb39a211a4f4292d63c66b5ce9c32fa2cd35464af4f681d91b9a1f",
-    version: "0.1.13"
-  },
-  kotlin: {
-    url: "https://unpkg.com/tree-sitter-wasms@0.1.13/out/tree-sitter-kotlin.wasm",
-    sha256: "b5cb00c8d06ed0f10f1dbe497205b437809d7e87db1f638721a8cfb30e044449",
-    version: "0.1.13"
-  },
-  elixir: {
-    url: "https://unpkg.com/tree-sitter-wasms@0.1.13/out/tree-sitter-elixir.wasm",
-    sha256: "82e91b9759ddca30d8978ebbfa8e347b4451b64c931f9ae62112e6db9b8fac20",
-    version: "0.1.13"
-  }
-};
-function getCacheDir() {
-  return process.env.MASSU_WASM_CACHE_DIR ?? join(homedir(), ".massu", "wasm-cache");
-}
-function getCachedPath(language, sha) {
-  return join(getCacheDir(), `${language}-${sha}.wasm`);
-}
-var DEFAULT_CACHE_RETAIN_COUNT = 16;
-function getCacheRetainCount() {
-  const env = process.env.MASSU_WASM_CACHE_RETAIN;
-  if (env) {
-    const n = Number(env);
-    if (Number.isFinite(n) && n >= 1 && n <= 1024) return Math.floor(n);
-  }
-  return DEFAULT_CACHE_RETAIN_COUNT;
-}
-function touchCacheFile(path) {
-  try {
-    const now = /* @__PURE__ */ new Date();
-    utimesSync(path, now, now);
-  } catch {
-  }
-}
-function evictBeyondRetainCount(retain = getCacheRetainCount()) {
-  const dir = getCacheDir();
-  let entries;
-  try {
-    entries = readdirSync(dir);
-  } catch {
-    return;
-  }
-  const candidates = [];
-  for (const name of entries) {
-    if (!name.endsWith(".wasm")) continue;
-    const path = join(dir, name);
-    let stat;
-    try {
-      stat = lstatSync(path);
-    } catch {
-      continue;
-    }
-    if (stat.isSymbolicLink() || !stat.isFile()) {
-      console.error(
-        `[tree-sitter-loader] cache eviction skipped non-regular file: ${path} (possible symlink attack \u2014 see Phase 3.5 finding F-008).`
-      );
-      continue;
-    }
-    candidates.push({ path, mtimeMs: stat.mtimeMs });
-  }
-  if (candidates.length <= retain) return;
-  candidates.sort((a, b) => b.mtimeMs - a.mtimeMs);
-  for (const victim of candidates.slice(retain)) {
-    try {
-      unlinkSync(victim.path);
-    } catch {
-    }
-  }
-}
-function sha256(bytes) {
-  return createHash("sha256").update(bytes).digest("hex");
-}
-var parserInitPromise = null;
-async function ensureParserInitialized() {
-  if (parserInitPromise) return parserInitPromise;
-  parserInitPromise = Parser.init();
-  return parserInitPromise;
-}
-var loadedGrammars = /* @__PURE__ */ new Map();
-async function loadGrammar(language, options = {}) {
-  await ensureParserInitialized();
-  const cached = loadedGrammars.get(language);
-  if (cached) return cached;
-  const manifest = options.manifestOverride?.[language] ?? GRAMMAR_MANIFEST[language];
-  if (!manifest) {
-    throw new GrammarUnavailableError(
-      language,
-      new Error(`No manifest entry for language "${language}". v1 supports: ${Object.keys(GRAMMAR_MANIFEST).join(", ")}.`)
-    );
-  }
-  const cachePath = getCachedPath(language, manifest.sha256);
-  let cacheLstat;
-  try {
-    cacheLstat = lstatSync(cachePath);
-  } catch {
-    cacheLstat = null;
-  }
-  if (cacheLstat) {
-    if (cacheLstat.isSymbolicLink() || !cacheLstat.isFile()) {
-      throw new GrammarCacheSymlinkError(cachePath);
-    }
-    let bytes;
-    try {
-      bytes = readFileSync(cachePath);
-    } catch (e) {
-      bytes = new Uint8Array(0);
-    }
-    if (bytes.byteLength > 0) {
-      const actualSha = sha256(bytes);
-      if (actualSha !== manifest.sha256) {
-        throw new GrammarSHAMismatchError(language, manifest.sha256, actualSha);
-      }
-      const lang2 = await Language.load(bytes);
-      loadedGrammars.set(language, lang2);
-      touchCacheFile(cachePath);
-      return lang2;
-    }
-  }
-  if (!/^https:\/\//i.test(manifest.url)) {
-    throw new GrammarUrlNotHttpsError(manifest.url);
-  }
-  const fetchImpl = options.fetchImpl ?? globalThis.fetch;
-  if (!fetchImpl) {
-    throw new GrammarUnavailableError(
-      language,
-      new Error("No fetch implementation available (Node < 18?)")
-    );
-  }
-  let body;
-  try {
-    const res = await fetchImpl(manifest.url);
-    if (!res.ok) {
-      throw new Error(`HTTP ${res.status ?? "unknown"} from ${manifest.url}`);
-    }
-    body = new Uint8Array(await res.arrayBuffer());
-  } catch (e) {
-    throw new GrammarUnavailableError(language, e);
-  }
-  const downloadedSha = sha256(body);
-  if (downloadedSha !== manifest.sha256) {
-    throw new GrammarSHAMismatchError(language, manifest.sha256, downloadedSha);
-  }
-  try {
-    mkdirSync(dirname(cachePath), { recursive: true, mode: 448 });
-    try {
-      chmodSync(dirname(cachePath), 448);
-    } catch {
-    }
-    const tmpPath = `${cachePath}.tmp.${process.pid}`;
-    writeFileSync(tmpPath, body, { mode: 384 });
-    try {
-      chmodSync(tmpPath, 384);
-    } catch {
-    }
-    try {
-      renameSync(tmpPath, cachePath);
-      try {
-        chmodSync(cachePath, 384);
-      } catch {
-      }
-    } catch (e) {
-      try {
-        unlinkSync(tmpPath);
-      } catch {
-      }
-      throw e;
-    }
-    evictBeyondRetainCount();
-  } catch (e) {
-    console.error(
-      `[tree-sitter-loader] cache write failed for ${language}: ${e instanceof Error ? e.message : String(e)} \u2014 loading directly from memory.`
-    );
-  }
-  const lang = await Language.load(body);
-  loadedGrammars.set(language, lang);
-  return lang;
-}
-
-// src/detect/adapters/parse-guard.ts
-var MAX_AST_FILE_BYTES = 1 * 1024 * 1024;
-var MAX_AST_PARSE_DEPTH = 5e3;
-function isParsableSource(source, sizeBytes) {
-  const bytes = sizeBytes ?? Buffer.byteLength(source, "utf-8");
-  if (bytes > MAX_AST_FILE_BYTES) {
-    return {
-      reason: "size-cap",
-      detail: `${bytes} bytes > ${MAX_AST_FILE_BYTES} cap`
-    };
-  }
-  let depth = 0;
-  let maxDepth = 0;
-  for (let i = 0; i < source.length; i++) {
-    const c = source.charCodeAt(i);
-    if (c === 0) {
-      return { reason: "control-bytes", detail: "NUL byte at offset " + i };
-    }
-    if (c === 40 || c === 91 || c === 123) {
-      depth++;
-      if (depth > maxDepth) maxDepth = depth;
-      if (depth > MAX_AST_PARSE_DEPTH) {
-        return {
-          reason: "depth-cap",
-          detail: `nesting depth exceeded ${MAX_AST_PARSE_DEPTH}`
-        };
-      }
-    } else if (c === 41 || c === 93 || c === 125) {
-      depth = depth > 0 ? depth - 1 : 0;
-    }
-  }
-  return null;
-}
-
-// ../adapter-aspnet/dist/index.js
-var MAP_VERB_QUERY = `
-(invocation_expression
-  function: (member_access_expression
-    name: (identifier) @method (#match? @method "^Map(Get|Post|Put|Patch|Delete|Head|Options)$"))
-  arguments: (argument_list
-    .
-    (argument (string_literal) @route_path)))
-`;
-var HTTP_ATTR_QUERY = `
-(attribute
-  name: (identifier) @attr_name (#match? @attr_name "^Http(Get|Post|Put|Patch|Delete|Head|Options)$"))
-`;
-var ROUTE_ATTR_QUERY = `
-(attribute
-  name: (identifier) @_attr_name (#eq? @_attr_name "Route")
-  (attribute_argument_list
-    (attribute_argument (string_literal) @route_template)))
-`;
-var CONTROLLER_CLASS_QUERY = `
-(class_declaration
-  name: (identifier) @class_name (#match? @class_name "Controller$"))
-`;
-var aspnetAdapter = {
-  id: "aspnet",
-  languages: ["csharp"],
-  matches(signals) {
-    if (!signals.csproj)
-      return false;
-    if (/Sdk\s*=\s*["']Microsoft\.NET\.Sdk\.Web["']/i.test(signals.csproj))
-      return true;
-    if (/Microsoft\.AspNetCore\.App/i.test(signals.csproj))
-      return true;
-    return false;
-  },
-  async introspect(files, _rootDir) {
-    if (files.length === 0) {
-      return { conventions: {}, provenance: [], confidence: "none" };
-    }
-    let language;
-    try {
-      language = await loadGrammar("csharp");
-    } catch (e) {
-      return { conventions: {}, provenance: [], confidence: "none" };
-    }
-    const parser = new Parser2();
-    parser.setLanguage(language);
-    const routeMethods = /* @__PURE__ */ new Map();
-    const prefixBases = /* @__PURE__ */ new Map();
-    const controllerClasses = /* @__PURE__ */ new Map();
-    try {
-      for (const file of files) {
-        const skip = isParsableSource(file.content, file.size);
-        if (skip) {
-          process.stderr.write(`[massu/ast] WARN: aspnet skipping ${file.path}: ${skip.reason} (${skip.detail}). Cap=${MAX_AST_FILE_BYTES}. (Phase 3.5 mitigation)
-`);
-          continue;
-        }
-        try {
-          for (const hit of runQuery(parser, file.content, MAP_VERB_QUERY, "aspnet-map-verb", file.path)) {
-            const methodRaw = hit.captures.method;
-            if (!methodRaw)
-              continue;
-            const verb = methodRaw.replace(/^Map/, "");
-            if (!routeMethods.has(verb)) {
-              routeMethods.set(verb, { line: hit.line, file: file.path });
-            }
-            const pathRaw = hit.captures.route_path;
-            if (pathRaw) {
-              const literal = pathRaw.replace(/^["']/, "").replace(/["']$/, "");
-              const base = extractPrefixBase(literal);
-              if (base && !prefixBases.has(base)) {
-                prefixBases.set(base, { line: hit.line, file: file.path });
-              }
-            }
-          }
-          for (const hit of runQuery(parser, file.content, HTTP_ATTR_QUERY, "aspnet-http-attr", file.path)) {
-            const attrRaw = hit.captures.attr_name;
-            if (!attrRaw)
-              continue;
-            const verb = attrRaw.replace(/^Http/, "");
-            if (!routeMethods.has(verb)) {
-              routeMethods.set(verb, { line: hit.line, file: file.path });
-            }
-          }
-          for (const hit of runQuery(parser, file.content, ROUTE_ATTR_QUERY, "aspnet-route-attr", file.path)) {
-            const tplRaw = hit.captures.route_template;
-            if (!tplRaw)
-              continue;
-            const literal = tplRaw.replace(/^["']/, "").replace(/["']$/, "");
-            const base = extractPrefixBase(literal);
-            if (base && !prefixBases.has(base)) {
-              prefixBases.set(base, { line: hit.line, file: file.path });
-            }
-          }
-          for (const hit of runQuery(parser, file.content, CONTROLLER_CLASS_QUERY, "aspnet-controller-class", file.path)) {
-            const name = hit.captures.class_name;
-            if (name && !controllerClasses.has(name)) {
-              controllerClasses.set(name, { line: hit.line, file: file.path });
-            }
-          }
-        } catch (e) {
-          if (e instanceof InvalidQueryError) {
-            throw e;
-          }
-          continue;
-        }
-      }
-    } finally {
-      try {
-        parser.delete();
-      } catch {
-      }
-    }
-    const conventions = {};
-    const provenance = [];
-    if (routeMethods.size === 1) {
-      const [name, { line, file }] = routeMethods.entries().next().value;
-      conventions.route_method = name;
-      provenance.push({ field: "route_method", sourceFile: file, line, query: "aspnet-map-verb" });
-    } else if (routeMethods.size >= 2) {
-      const [name, { line, file }] = routeMethods.entries().next().value;
-      conventions.route_method = name;
-      provenance.push({ field: "route_method", sourceFile: file, line, query: "aspnet-map-verb" });
-    }
-    if (prefixBases.size >= 1) {
-      const [base, { line, file }] = prefixBases.entries().next().value;
-      conventions.route_prefix_base = base;
-      provenance.push({ field: "route_prefix_base", sourceFile: file, line, query: "aspnet-route-prefix" });
-    }
-    if (controllerClasses.size >= 1) {
-      const [name, { line, file }] = controllerClasses.entries().next().value;
-      conventions.controller_class = name;
-      provenance.push({ field: "controller_class", sourceFile: file, line, query: "aspnet-controller-class" });
-    }
-    let confidence;
-    if (Object.keys(conventions).length === 0) {
-      confidence = "none";
-    } else if (routeMethods.size === 1) {
-      confidence = "high";
-    } else if (routeMethods.size >= 2) {
-      confidence = "low";
-    } else {
-      confidence = "medium";
-    }
-    return { conventions, provenance, confidence };
-  }
-};
-function extractPrefixBase(prefix) {
-  const stripped = prefix.replace(/^\/+/, "");
-  const firstSeg = stripped.split("/")[0];
-  if (!firstSeg)
-    return null;
-  return "/" + firstSeg;
-}
-export {
-  aspnetAdapter
-};