@suss/adapter-ruby 0.22.4 → 0.24.0

package/dist/index.cjs

@@ -288,9 +288,21 @@ var PATH_CONVENTIONS = {
   railsUnderscore: underscoreConstantPath
 };
 function resolveConstantFile(root, qualifiedName, convention) {
-  const relative = PATH_CONVENTIONS[convention](qualifiedName);
-  const file = import_node_path.default.join(root, `${relative}.rb`);
-  return import_node_fs.default.existsSync(file) ? file : null;
+  const relative = `${PATH_CONVENTIONS[convention](qualifiedName)}.rb`;
+  for (const candidate of [root, ...autoloadDirectories(root)]) {
+    const file = import_node_path.default.join(candidate, relative);
+    if (import_node_fs.default.existsSync(file)) {
+      return file;
+    }
+  }
+  return null;
+}
+function autoloadDirectories(root) {
+  try {
+    return import_node_fs.default.readdirSync(root, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => import_node_path.default.join(root, entry.name)).sort();
+  } catch {
+    return [];
+  }
 }
 
 // src/scope.ts
@@ -595,112 +607,15 @@ function inheritedStatements(ancestry, blockConfigures) {
 }
 
 // src/discovery.ts
-var import_behavioral_ir2 = require("@suss/behavioral-ir");
+var import_behavioral_ir3 = require("@suss/behavioral-ir");
 var import_extractor5 = require("@suss/extractor");
 
-// src/envReads.ts
+// src/clientCalls.ts
 var import_behavioral_ir = require("@suss/behavioral-ir");
-var import_extractor2 = require("@suss/extractor");
-var RUBY_ENV_RECOGNITION = "ruby-env";
-var DEFERRED_BODY_TYPES = /* @__PURE__ */ new Set(["method", "singleton_method", "lambda"]);
-function envReadEffects(root) {
-  const effects = [];
-  (0, import_extractor2.walkDescendants)(root, null, {
-    at: (node) => {
-      const read = envReadAt(node);
-      if (read !== null) {
-        effects.push(configReadEffect(read));
-      }
-    },
-    into: (node) => DEFERRED_BODY_TYPES.has(node.type) ? import_extractor2.SKIP_CHILDREN : null
-  });
-  return effects;
-}
-function configReadEffect(read) {
-  return {
-    type: "interaction",
-    binding: (0, import_behavioral_ir.runtimeConfigBinding)({
-      recognition: RUBY_ENV_RECOGNITION,
-      deploymentTarget: "lambda",
-      instanceName: "<unknown>"
-    }),
-    callee: `ENV["${read.name}"]`,
-    interaction: {
-      class: "config-read",
-      name: read.name,
-      defaulted: read.defaulted
-    }
-  };
-}
-function envReadAt(node) {
-  if (node.type === "element_reference") {
-    return elementRead(node);
-  }
-  if (node.type === "call") {
-    return fetchRead(node);
-  }
-  return null;
-}
-function elementRead(node) {
-  const object = field(node, "object");
-  if (object === null || !isEnv(object) || isAssignedTo(node)) {
-    return null;
-  }
-  const index = node.namedChildren.find(
-    (child) => child !== null && child.id !== object.id
-  );
-  const name = index === void 0 ? null : stringLiteralValue(index);
-  if (name === null) {
-    return null;
-  }
-  return { name, defaulted: isDefaultedAt(node) };
-}
-function fetchRead(node) {
-  const receiver = field(node, "receiver");
-  if (receiver === null || !isEnv(receiver) || field(node, "method")?.text !== "fetch") {
-    return null;
-  }
-  const { positional } = readCallArgs(field(node, "arguments"));
-  const name = positional[0] === void 0 ? null : stringLiteralValue(positional[0]);
-  if (name === null) {
-    return null;
-  }
-  const hasDefault = positional.length > 1 || field(node, "block") !== null;
-  return { name, defaulted: hasDefault || isDefaultedAt(node) };
-}
-function isEnv(node) {
-  if (node.type === "constant") {
-    return node.text === "ENV";
-  }
-  return node.type === "scope_resolution" && field(node, "scope") === null && field(node, "name")?.text === "ENV";
-}
-function isAssignedTo(node) {
-  const parent = node.parent;
-  return parent !== null && (parent.type === "assignment" || parent.type === "operator_assignment") && field(parent, "left")?.id === node.id;
-}
-function isDefaultedAt(node) {
-  let child = node;
-  let parent = node.parent;
-  while (parent !== null) {
-    if (parent.type === "parenthesized_statements") {
-      child = parent;
-      parent = parent.parent;
-      continue;
-    }
-    if (parent.type !== "binary" || field(parent, "operator")?.text !== "||") {
-      return false;
-    }
-    if (field(parent, "left")?.id === child.id) {
-      return true;
-    }
-    child = parent;
-    parent = parent.parent;
-  }
-  return false;
-}
+var import_values5 = require("@suss/values");
 
 // src/paths/effects.ts
-var import_extractor3 = require("@suss/extractor");
+var import_extractor2 = require("@suss/extractor");
 
 // src/paths/bareCalls.ts
 var PARAMETER_LIST_TYPES = [
@@ -1219,7 +1134,7 @@ function invocationEffects(definitionNode, inherited = NO_INHERITED_METHODS) {
     statements.push(statement);
   }
   const lowered = lowerRubyBody(body, statements);
-  const enumerated = (0, import_extractor3.enumerateOrDegrade)(
+  const enumerated = (0, import_extractor2.enumerateOrDegrade)(
     {
       statements: lowered.statements,
       terminalsByStmt: lowered.terminalsByStmt
@@ -1228,7 +1143,7 @@ function invocationEffects(definitionNode, inherited = NO_INHERITED_METHODS) {
   );
   return calls.map((call) => {
     const statement = statementOf2.get(call.id);
-    const conditions = (0, import_extractor3.sharedGatingConditions)(
+    const conditions = (0, import_extractor2.sharedGatingConditions)(
       statement === void 0 ? void 0 : enumerated.byTerminal.get(statement)
     );
     return {
@@ -1242,9 +1157,120 @@ function invocationEffects(definitionNode, inherited = NO_INHERITED_METHODS) {
 }
 
 // src/responseStatus.ts
-var import_extractor4 = require("@suss/extractor");
+var import_extractor3 = require("@suss/extractor");
 var import_values4 = require("@suss/values");
 
+// src/paths/predicates.ts
+var OPERATORS = {
+  "==": "eq",
+  "!=": "neq",
+  ">": "gt",
+  ">=": "gte",
+  "<": "lt",
+  "<=": "lte"
+};
+var CONVERSIONS = /* @__PURE__ */ new Set(["to_i", "to_s", "to_sym"]);
+var opaqueOf = (node) => ({
+  type: "opaque",
+  sourceText: node.text,
+  reason: "complexExpression"
+});
+function predicateOf(node) {
+  if (node.type === "parenthesized_statements") {
+    const inner = node.namedChildren[0];
+    return inner == null ? opaqueOf(node) : predicateOf(inner);
+  }
+  if (node.type === "unary" && field(node, "operator")?.text === "!") {
+    const operand2 = field(node, "operand") ?? node.namedChildren[0];
+    return operand2 == null ? opaqueOf(node) : { type: "negation", operand: predicateOf(operand2) };
+  }
+  if (node.type === "binary") {
+    return binaryOf(node);
+  }
+  const asked = calledMethod(node);
+  if (asked === "nil?") {
+    const receiver = field(node, "receiver");
+    return receiver === null ? opaqueOf(node) : { type: "nullCheck", subject: valueRefOf(receiver), negated: false };
+  }
+  if (node.type === "identifier" || memberChain(node) !== null) {
+    return {
+      type: "truthinessCheck",
+      subject: valueRefOf(node),
+      negated: false
+    };
+  }
+  return opaqueOf(node);
+}
+function binaryOf(node) {
+  const operator = field(node, "operator")?.text ?? "";
+  const left = field(node, "left");
+  const right = field(node, "right");
+  if (left === null || right === null) {
+    return opaqueOf(node);
+  }
+  const op = OPERATORS[operator];
+  if (op !== void 0) {
+    return {
+      type: "comparison",
+      left: valueRefOf(left),
+      op,
+      right: valueRefOf(right)
+    };
+  }
+  if (operator === "&&" || operator === "||" || operator === "and" || operator === "or") {
+    return {
+      type: "compound",
+      op: operator === "&&" || operator === "and" ? "and" : "or",
+      operands: [predicateOf(left), predicateOf(right)]
+    };
+  }
+  return opaqueOf(node);
+}
+function valueRefOf(node) {
+  const literal = literalOf(node);
+  if (literal !== null) {
+    return literal;
+  }
+  const chain = memberChain(node);
+  if (chain !== null) {
+    const [name, ...accessChain] = chain;
+    if (name !== void 0 && accessChain.length > 0) {
+      return { type: "dependency", name, accessChain };
+    }
+  }
+  return { type: "unresolved", sourceText: node.text };
+}
+function literalOf(node) {
+  if (node.type === "integer") {
+    const value = Number.parseInt(node.text, 10);
+    return Number.isNaN(value) ? null : { type: "literal", value };
+  }
+  const string = stringLiteralValue(node);
+  if (string !== null) {
+    return { type: "literal", value: string };
+  }
+  const boolean = booleanLiteralValue(node);
+  return boolean === null ? null : { type: "literal", value: boolean };
+}
+function memberChain(node, tail = []) {
+  if (node.type === "identifier") {
+    return [node.text, ...tail];
+  }
+  const called = calledMethod(node);
+  const receiver = field(node, "receiver");
+  if (called === null || receiver === null || field(node, "arguments") !== null) {
+    return null;
+  }
+  const rest = CONVERSIONS.has(called) && tail.length === 0 ? tail : [called, ...tail];
+  return memberChain(receiver, rest);
+}
+function calledMethod(node) {
+  if (node.type !== "call" || field(node, "block") !== null) {
+    return null;
+  }
+  return field(node, "method")?.text ?? null;
+}
+
 // src/values/evaluator.ts
 var import_resolution2 = require("@suss/resolution");
 var import_values2 = require("@suss/values");
@@ -2561,6 +2587,18 @@ var calleeRows = [
     kind: "callee",
     origin: { module: "Kernel", name: "String" },
     apply: ({ args }) => ({ result: (0, import_values.concat)([(0, import_values.operand)(args[0])]) })
+  },
+  // A URI is the string it was parsed from, as far as a reader of paths
+  // is concerned, and both spellings are the standard library's own.
+  {
+    kind: "callee",
+    origin: { module: "Kernel", name: "URI" },
+    apply: ({ args }) => ({ result: (0, import_values.concat)([(0, import_values.operand)(args[0])]) })
+  },
+  {
+    kind: "callee",
+    origin: { module: "URI", name: "parse" },
+    apply: ({ args }) => ({ result: (0, import_values.concat)([(0, import_values.operand)(args[0])]) })
   }
 ];
 var rubyRows = [
@@ -2726,20 +2764,20 @@ function collectReturns(node, found) {
 function readingOfCall(call, declaration, names) {
   const argument = statusArgumentOf(call, declaration);
   if (argument === null) {
-    return declaration.defaultStatusCode === void 0 ? import_extractor4.absentReading : (0, import_extractor4.writtenReading)(declaration.defaultStatusCode, rangeOf(call));
+    return declaration.defaultStatusCode === void 0 ? import_extractor3.absentReading : (0, import_extractor3.writtenReading)(declaration.defaultStatusCode, rangeOf(call));
   }
   const status = statusNumberOf(argument, names);
   if (status === null) {
-    return (0, import_extractor4.unreadableReading)(
+    return (0, import_extractor3.unreadableReading)(
       "This response writes a status that does not settle on a number here, so this outcome claims none",
       rangeOf(argument)
     );
   }
-  return (0, import_extractor4.writtenReading)(status, rangeOf(argument));
+  return (0, import_extractor3.writtenReading)(status, rangeOf(argument));
 }
 function effectsReaching(effects, conditions) {
   return effects.filter(
-    (effect) => (0, import_extractor4.guardsHoldOn)(
+    (effect) => (0, import_extractor3.guardsHoldOn)(
       effect.type === "invocation" ? effect.preconditions : void 0,
       conditions
     )
@@ -2748,12 +2786,15 @@ function effectsReaching(effects, conditions) {
 function conditionOf(condition) {
   return {
     sourceText: condition.sourceText,
-    structured: null,
+    structured: condition.expression === null ? null : predicateOf(condition.expression),
     polarity: condition.polarity,
     source: condition.source
   };
 }
-function branchOf(outcome, pattern, effects, extraEffects) {
+function branchOf(outcome, pattern, effects, extraEffects, options) {
+  if (outcome.fellThrough === true && options.fallthrough === "handOn") {
+    return handsOnBranch(outcome, effects, extraEffects);
+  }
   return {
     conditions: outcome.conditions,
     terminal: {
@@ -2778,7 +2819,72 @@ function branchOf(outcome, pattern, effects, extraEffects) {
     isDefault: outcome.conditions.length === 0
   };
 }
-function responseBranches(method, pattern, effects, extraEffects) {
+function handsOnBranch(outcome, effects, extraEffects) {
+  return {
+    conditions: outcome.conditions,
+    terminal: {
+      kind: "delegate",
+      statusCode: null,
+      body: null,
+      exceptionType: null,
+      message: null,
+      component: null,
+      renderTree: null,
+      delegateTarget: null,
+      emitEvent: null,
+      location: outcome.location
+    },
+    effects: effectsReaching(effects, outcome.conditions),
+    ...extraEffects === void 0 ? {} : { extraEffects },
+    location: outcome.location,
+    isDefault: outcome.conditions.length === 0
+  };
+}
+function returnPathBranches(method, effects) {
+  const body = field(method, "body");
+  if (body === null) {
+    return null;
+  }
+  const returns = collectReturns(body, []);
+  const lowered = lowerRubyBody(body, returns, []);
+  const enumerated = (0, import_extractor3.enumerateOrDegrade)(
+    {
+      statements: lowered.statements,
+      terminalsByStmt: lowered.terminalsByStmt
+    },
+    returns
+  );
+  const branches = [];
+  const push = (paths, at) => {
+    for (const path7 of paths) {
+      const conditions = path7.map(conditionOf);
+      branches.push({
+        conditions,
+        terminal: {
+          kind: "return",
+          statusCode: null,
+          body: null,
+          exceptionType: null,
+          message: null,
+          component: null,
+          renderTree: null,
+          delegateTarget: null,
+          emitEvent: null,
+          location: at
+        },
+        effects: effectsReaching(effects, conditions),
+        location: at,
+        isDefault: conditions.length === 0
+      });
+    }
+  };
+  for (const statement of returns) {
+    push(enumerated.byTerminal.get(statement) ?? [], rangeOf(statement));
+  }
+  push(enumerated.fallthrough, rangeOf(method));
+  return branches.length === 0 ? null : branches;
+}
+function responseBranches(method, pattern, effects, extraEffects, options = {}) {
   const declarations = pattern.responseStatusCalls ?? [];
   const body = field(method, "body");
   if (declarations.length === 0 || body === null) {
@@ -2793,7 +2899,7 @@ function responseBranches(method, pattern, effects, extraEffects) {
     (node) => lowered.terminalHome.has(node) && collectResponseCalls(node, byName, locals, []).length === 0
   );
   const terminals = [...responses, ...bareReturns];
-  const enumerated = (0, import_extractor4.enumerateOrDegrade)(
+  const enumerated = (0, import_extractor3.enumerateOrDegrade)(
     {
       statements: lowered.statements,
       terminalsByStmt: lowered.terminalsByStmt
@@ -2804,7 +2910,7 @@ function responseBranches(method, pattern, effects, extraEffects) {
   const outcomes = [];
   for (const terminal of terminals) {
     const declaration = declarationOf(terminal, byName, locals);
-    const reading = declaration === void 0 ? import_extractor4.absentReading : readingOfCall(terminal, declaration, statusNames);
+    const reading = declaration === void 0 ? import_extractor3.absentReading : readingOfCall(terminal, declaration, statusNames);
     for (const path7 of enumerated.byTerminal.get(terminal) ?? []) {
       outcomes.push({
         conditions: path7.map(conditionOf),
@@ -2816,40 +2922,541 @@ function responseBranches(method, pattern, effects, extraEffects) {
   for (const path7 of enumerated.fallthrough) {
     outcomes.push({
       conditions: path7.map(conditionOf),
-      reading: import_extractor4.absentReading,
-      location: rangeOf(method)
+      reading: import_extractor3.absentReading,
+      location: rangeOf(method),
+      fellThrough: true
     });
   }
   if (outcomes.length === 0) {
     return null;
   }
   return outcomes.map(
-    (outcome) => branchOf(outcome, pattern, effects, extraEffects)
+    (outcome) => branchOf(outcome, pattern, effects, extraEffects, options)
   );
 }
 
-// src/storage.ts
-var import_datalog2 = require("@suss/datalog");
-var import_ir_core = require("@suss/ir-core");
-var import_resolution3 = require("@suss/resolution");
-function children3(node) {
-  return node.namedChildren.filter((child) => child !== null);
+// src/clientCalls.ts
+function clientCallUnits(root, pack, pattern, options) {
+  const units = [];
+  for (const method of methodDefinitions(root)) {
+    const name = field(method, "name")?.text;
+    if (name === void 0) {
+      continue;
+    }
+    for (const call of callsUnder(method)) {
+      const request = requestCall(call, method, pattern, options);
+      if (request === null) {
+        continue;
+      }
+      units.push(clientUnit(method, name, request, pattern, pack, options));
+    }
+  }
+  return units;
 }
-function receiverOf(node) {
-  return node.type === "call" ? field(node, "receiver") : null;
+function methodDefinitions(node, found = []) {
+  for (const child of node.namedChildren) {
+    if (child === null) {
+      continue;
+    }
+    if (child.type === "method" || child.type === "singleton_method") {
+      found.push(child);
+    }
+    methodDefinitions(child, found);
+  }
+  return found;
 }
-function methodOf(node) {
-  return field(node, "method")?.text ?? "";
+function callsUnder(node, found = []) {
+  for (const child of node.namedChildren) {
+    if (child === null) {
+      continue;
+    }
+    if (child.type === "call") {
+      found.push(child);
+    }
+    callsUnder(child, found);
+  }
+  return found;
 }
-function rootConstant(node) {
-  const receiver = receiverOf(node);
-  if (receiver === null) {
+function requestCall(call, method, pattern, options) {
+  const receiver = field(call, "receiver");
+  const called = field(call, "method")?.text;
+  if (receiver === null || called === void 0) {
     return null;
   }
-  if (receiver.type === "constant" || receiver.type === "scope_resolution") {
-    return receiver;
+  const prefix = receiverPrefix(receiver, method, pattern, options);
+  if (prefix === null) {
+    return null;
   }
-  return rootConstant(receiver);
+  const args = readCallArgs(field(call, "arguments"));
+  const verb = pattern.verbMethodNames[called];
+  if (verb !== void 0) {
+    const path8 = urlIn(args, pattern, options);
+    return path8 === null ? null : { method: verb, path: prefix + path8 };
+  }
+  const sent = pattern.requestObject;
+  if (sent === void 0 || sent.attribute !== called) {
+    return null;
+  }
+  const built = requestBuilt(args.positional[0], method, sent);
+  if (built === null) {
+    return null;
+  }
+  const path7 = pathAt(built.url, options);
+  return path7 === null ? null : { method: built.method, path: prefix + path7 };
+}
+function requestBuilt(argument, method, sent) {
+  const written = argument === void 0 ? null : assignedCall(argument, method) ?? argument;
+  if (written === null || written.type !== "call") {
+    return null;
+  }
+  const requestClass = field(written, "receiver")?.text;
+  const verb = requestClass === void 0 ? void 0 : sent.constructors[requestClass];
+  if (verb === void 0) {
+    return null;
+  }
+  const args = readCallArgs(field(written, "arguments"));
+  return { method: verb, url: args.positional[sent.urlPosition] };
+}
+function assignedCall(node, method) {
+  if (node.type !== "identifier") {
+    return null;
+  }
+  const value = assignedValue(node.text, method);
+  return value !== null && value.type === "call" ? value : null;
+}
+function receiverPrefix(receiver, method, pattern, options) {
+  if (namesConstant(receiver, pattern.constantName)) {
+    return "";
+  }
+  if (receiver.type !== "identifier") {
+    return null;
+  }
+  const built = builtBy(receiver.text, method, pattern);
+  if (built === null) {
+    return null;
+  }
+  const keyword = pattern.builderUrlKeyword;
+  if (keyword === void 0) {
+    return "";
+  }
+  const base = readCallArgs(field(built, "arguments")).keyword[keyword];
+  const path7 = base === void 0 ? null : (0, import_values5.pathOf)(evaluatedValue(base, options.facts));
+  return path7 === void 0 || path7 === null ? "" : trimmed(path7);
+}
+function trimmed(path7) {
+  return path7 === "/" ? "" : path7.replace(/\/+$/, "");
+}
+function namesConstant(receiver, constantName) {
+  return (receiver.type === "constant" || receiver.type === "scope_resolution") && receiver.text === constantName;
+}
+function builtBy(name, method, pattern) {
+  const builders = pattern.receiverBuilders ?? [];
+  const value = builders.length === 0 ? null : assignedValue(name, method);
+  if (value === null || value.type !== "call" || !builders.includes(field(value, "method")?.text ?? "")) {
+    return null;
+  }
+  const receiver = field(value, "receiver");
+  return receiver !== null && namesConstant(receiver, pattern.constantName) ? value : null;
+}
+function assignedValue(name, method) {
+  const body = field(method, "body");
+  if (body === null) {
+    return null;
+  }
+  for (const statement of runStatements(body)) {
+    if (statement.type !== "assignment") {
+      continue;
+    }
+    if (field(statement, "left")?.text === name) {
+      return field(statement, "right");
+    }
+  }
+  return null;
+}
+function urlIn(args, pattern, options) {
+  const keyword = pattern.url.keyword;
+  const written = (keyword === void 0 ? void 0 : args.keyword[keyword]) ?? args.positional[pattern.url.position];
+  return pathAt(written, options);
+}
+function pathAt(written, options) {
+  if (written === void 0) {
+    return null;
+  }
+  const path7 = (0, import_values5.pathOf)(evaluatedValue(written, options.facts));
+  return path7 === void 0 || (0, import_behavioral_ir.namesNothing)(path7) ? null : path7;
+}
+function clientUnit(method, name, request, pattern, pack, options) {
+  const range = rangeOf(method);
+  return {
+    identity: {
+      name,
+      nameKind: "binding",
+      kind: "client",
+      file: options.filePath,
+      range,
+      span: spanOf(method),
+      exportName: name,
+      exportPath: [name]
+    },
+    boundaryBinding: (0, import_behavioral_ir.restBinding)({
+      transport: pack.protocol,
+      method: request.method,
+      path: request.path,
+      recognition: pack.name
+    }),
+    parameters: [],
+    branches: callerBranches(method, range),
+    ...responseAccessors(pattern),
+    bodyContent: "statements",
+    dependencyCalls: [],
+    declaredContract: null
+  };
+}
+function callerBranches(method, range) {
+  const effects = invocationEffects(method);
+  return returnPathBranches(method, effects) ?? [returnBranch(range, effects)];
+}
+function responseAccessors(pattern) {
+  const response = pattern.response;
+  if (response === void 0) {
+    return {};
+  }
+  return {
+    ...response.body === void 0 ? {} : { bodyAccessors: response.body },
+    ...response.statusCode === void 0 ? {} : { statusAccessors: response.statusCode },
+    ...response.success === void 0 ? {} : { successAccessors: response.success },
+    ...response.failureDelivery === void 0 ? {} : { failureDelivery: response.failureDelivery }
+  };
+}
+function returnBranch(range, effects) {
+  return {
+    conditions: [],
+    terminal: {
+      kind: "return",
+      statusCode: null,
+      body: null,
+      exceptionType: null,
+      message: null,
+      component: null,
+      renderTree: null,
+      delegateTarget: null,
+      emitEvent: null,
+      location: range
+    },
+    effects,
+    location: range,
+    isDefault: true
+  };
+}
+
+// src/envReads.ts
+var import_behavioral_ir2 = require("@suss/behavioral-ir");
+var import_extractor4 = require("@suss/extractor");
+var RUBY_ENV_RECOGNITION = "ruby-env";
+var DEFERRED_BODY_TYPES = /* @__PURE__ */ new Set(["method", "singleton_method", "lambda"]);
+function envReadEffects(root) {
+  const effects = [];
+  (0, import_extractor4.walkDescendants)(root, null, {
+    at: (node) => {
+      const read = envReadAt(node);
+      if (read !== null) {
+        effects.push(configReadEffect(read));
+      }
+    },
+    into: (node) => DEFERRED_BODY_TYPES.has(node.type) ? import_extractor4.SKIP_CHILDREN : null
+  });
+  return effects;
+}
+function configReadEffect(read) {
+  return {
+    type: "interaction",
+    binding: (0, import_behavioral_ir2.runtimeConfigBinding)({
+      recognition: RUBY_ENV_RECOGNITION,
+      deploymentTarget: "lambda",
+      instanceName: "<unknown>"
+    }),
+    callee: `ENV["${read.name}"]`,
+    interaction: {
+      class: "config-read",
+      name: read.name,
+      defaulted: read.defaulted
+    }
+  };
+}
+function envReadAt(node) {
+  if (node.type === "element_reference") {
+    return elementRead(node);
+  }
+  if (node.type === "call") {
+    return fetchRead(node);
+  }
+  return null;
+}
+function elementRead(node) {
+  const object = field(node, "object");
+  if (object === null || !isEnv(object) || isAssignedTo(node)) {
+    return null;
+  }
+  const index = node.namedChildren.find(
+    (child) => child !== null && child.id !== object.id
+  );
+  const name = index === void 0 ? null : stringLiteralValue(index);
+  if (name === null) {
+    return null;
+  }
+  return { name, defaulted: isDefaultedAt(node) };
+}
+function fetchRead(node) {
+  const receiver = field(node, "receiver");
+  if (receiver === null || !isEnv(receiver) || field(node, "method")?.text !== "fetch") {
+    return null;
+  }
+  const { positional } = readCallArgs(field(node, "arguments"));
+  const name = positional[0] === void 0 ? null : stringLiteralValue(positional[0]);
+  if (name === null) {
+    return null;
+  }
+  const hasDefault = positional.length > 1 || field(node, "block") !== null;
+  return { name, defaulted: hasDefault || isDefaultedAt(node) };
+}
+function isEnv(node) {
+  if (node.type === "constant") {
+    return node.text === "ENV";
+  }
+  return node.type === "scope_resolution" && field(node, "scope") === null && field(node, "name")?.text === "ENV";
+}
+function isAssignedTo(node) {
+  const parent = node.parent;
+  return parent !== null && (parent.type === "assignment" || parent.type === "operator_assignment") && field(parent, "left")?.id === node.id;
+}
+function isDefaultedAt(node) {
+  let child = node;
+  let parent = node.parent;
+  while (parent !== null) {
+    if (parent.type === "parenthesized_statements") {
+      child = parent;
+      parent = parent.parent;
+      continue;
+    }
+    if (parent.type !== "binary" || field(parent, "operator")?.text !== "||") {
+      return false;
+    }
+    if (field(parent, "left")?.id === child.id) {
+      return true;
+    }
+    child = parent;
+    parent = parent.parent;
+  }
+  return false;
+}
+
+// src/filters.ts
+function controllerFilters(pattern, ancestry) {
+  const forms = pattern.filters ?? [];
+  if (forms.length === 0) {
+    return [];
+  }
+  const byName = new Map(forms.map((form) => [form.name, form]));
+  const skipNames = /* @__PURE__ */ new Map();
+  for (const form of forms) {
+    if (form.skippedBy !== void 0) {
+      skipNames.set(form.skippedBy, form.name);
+    }
+  }
+  const declared = [];
+  const skips = [];
+  for (const { statement } of inheritedStatements(ancestry)) {
+    const called = calledName(statement);
+    if (called === null) {
+      continue;
+    }
+    const form = byName.get(called);
+    if (form !== void 0) {
+      declared.push(...declarationsOf(statement, form));
+      continue;
+    }
+    const skipped = skipNames.get(called);
+    if (skipped !== void 0) {
+      skips.push(...skipsOf(statement, skipped));
+    }
+  }
+  const resolved = [];
+  for (const declaration of applySkips(declared, skips)) {
+    const found = methodInAncestry(ancestry, declaration.methodName);
+    if (found.type !== "found") {
+      continue;
+    }
+    resolved.push({
+      filter: declaration.filter,
+      methodName: declaration.methodName,
+      method: found.method,
+      file: found.block.file,
+      enclosingQualifiedName: found.block.info.qualifiedName,
+      only: declaration.only,
+      except: declaration.except
+    });
+  }
+  return [
+    ...resolved.filter((one) => one.filter.onThrow !== true),
+    ...resolved.filter((one) => one.filter.onThrow === true)
+  ];
+}
+function filterCoversAction(filter, actionName) {
+  if (filter.except.has(actionName)) {
+    return false;
+  }
+  return filter.only === null || filter.only.has(actionName);
+}
+function filterReference(filter, displayPath) {
+  return {
+    file: displayPath,
+    name: filter.methodName,
+    ...filter.filter.onThrow === true ? { onThrow: true } : {}
+  };
+}
+function filterUnit(filter, pattern, displayPath, body) {
+  const range = rangeOf(filter.method);
+  const branches = responseBranches(
+    filter.method,
+    pattern,
+    body.effects ?? [],
+    body.extraEffects,
+    { fallthrough: "handOn" }
+  );
+  return {
+    identity: {
+      name: filter.methodName,
+      nameKind: "binding",
+      kind: "middleware",
+      file: displayPath,
+      range,
+      span: spanOf(filter.method),
+      exportName: filter.methodName,
+      exportPath: [filter.enclosingQualifiedName, filter.methodName]
+    },
+    boundaryBinding: null,
+    parameters: [],
+    branches: branches ?? [handsOn(range, body)],
+    bodyContent: body.bodyContent ?? "absent",
+    dependencyCalls: [],
+    declaredContract: null
+  };
+}
+function handsOn(range, body) {
+  return {
+    conditions: [],
+    terminal: {
+      kind: "delegate",
+      statusCode: null,
+      body: null,
+      exceptionType: null,
+      message: null,
+      component: null,
+      renderTree: null,
+      delegateTarget: null,
+      emitEvent: null,
+      location: range
+    },
+    effects: body.effects ?? [],
+    ...body.extraEffects === void 0 ? {} : { extraEffects: body.extraEffects },
+    location: range,
+    isDefault: true
+  };
+}
+function calledName(statement) {
+  if (statement.type !== "call" || field(statement, "receiver") !== null) {
+    return null;
+  }
+  return field(statement, "method")?.text ?? null;
+}
+function declarationsOf(statement, filter) {
+  const args = readCallArgs(field(statement, "arguments"));
+  const keywords = filter.actionKeywords;
+  const only = keywords === void 0 ? null : namesUnder(args.keyword[keywords.include]);
+  const except = keywords === void 0 ? null : namesUnder(args.keyword[keywords.exclude]);
+  return methodNamesOf(args, filter).map((methodName) => ({
+    filter,
+    methodName,
+    only,
+    except: except ?? /* @__PURE__ */ new Set()
+  }));
+}
+function methodNamesOf(args, filter) {
+  if (filter.methodFrom === "withKeyword") {
+    const named2 = args.keyword.with;
+    const value = named2 === void 0 ? null : symbolValue(named2);
+    return value === null ? [] : [value];
+  }
+  return args.positional.map((arg) => symbolValue(arg)).filter((name) => name !== null);
+}
+function skipsOf(statement, filterName) {
+  const args = readCallArgs(field(statement, "arguments"));
+  const actions = namesUnder(args.keyword.only);
+  return args.positional.map((arg) => symbolValue(arg)).filter((name) => name !== null).map((methodName) => ({ filterName, methodName, actions }));
+}
+function applySkips(declared, skips) {
+  const left = [];
+  for (const declaration of declared) {
+    const reaching = skips.filter(
+      (skip) => skip.filterName === declaration.filter.name && skip.methodName === declaration.methodName
+    );
+    if (reaching.some((skip) => skip.actions === null)) {
+      continue;
+    }
+    const except = new Set(declaration.except);
+    for (const skip of reaching) {
+      for (const action of skip.actions ?? []) {
+        except.add(action);
+      }
+    }
+    left.push({ ...declaration, except });
+  }
+  return left;
+}
+function namesUnder(node) {
+  if (node === void 0) {
+    return null;
+  }
+  const single = symbolValue(node);
+  if (single !== null) {
+    return /* @__PURE__ */ new Set([single]);
+  }
+  if (node.type !== "array" && node.type !== "symbol_array") {
+    return null;
+  }
+  const names = /* @__PURE__ */ new Set();
+  for (const child of bodyStatements(node)) {
+    const bare = child.type === "bare_symbol" ? child.text : null;
+    const name = symbolValue(child) ?? bare;
+    if (name !== null) {
+      names.add(name);
+    }
+  }
+  return names;
+}
+
+// src/storage.ts
+var import_datalog2 = require("@suss/datalog");
+var import_ir_core = require("@suss/ir-core");
+var import_resolution3 = require("@suss/resolution");
+function children3(node) {
+  return node.namedChildren.filter((child) => child !== null);
+}
+function receiverOf(node) {
+  return node.type === "call" ? field(node, "receiver") : null;
+}
+function methodOf(node) {
+  return field(node, "method")?.text ?? "";
+}
+function rootConstant(node) {
+  const receiver = receiverOf(node);
+  if (receiver === null) {
+    return null;
+  }
+  if (receiver.type === "constant" || receiver.type === "scope_resolution") {
+    return receiver;
+  }
+  return rootConstant(receiver);
 }
 var ANCESTRY_PROGRAM = (0, import_datalog2.deriveOnDemand)(
   [...import_resolution3.RESOLUTION_RULES, ...import_resolution3.RESOLUTION_QUESTIONS],
@@ -3046,6 +3653,16 @@ async function discoverUnits(root, options) {
     file: options.absoluteFile ?? options.filePath
   }));
   const units = [];
+  for (const pack of options.packs) {
+    for (const pattern of pack.clients ?? []) {
+      units.push(
+        ...clientCallUnits(root, pack, pattern, {
+          filePath: options.filePath,
+          ...options.facts === void 0 ? {} : { facts: options.facts }
+        })
+      );
+    }
+  }
   for (const info of classes) {
     const ownBlocks = fileBlocks.filter(
       (block) => block.info.qualifiedName === info.qualifiedName
@@ -3077,7 +3694,7 @@ function unitsFor(pattern, pack, info, ownBlocks, fileBlocks, options) {
     graphqlObjectFields: (p) => graphqlObjectFieldUnits(p, pack, info, ownBlocks, fileBlocks, options),
     controllerActions: (p) => controllerActionUnits(p, pack, info, ownBlocks, fileBlocks, options)
   };
-  return (0, import_behavioral_ir2.dispatchByType)(table, pattern);
+  return (0, import_behavioral_ir3.dispatchByType)(table, pattern);
 }
 async function graphqlObjectFieldUnits(pattern, pack, info, ownBlocks, fileBlocks, options) {
   if (info.bodyNode === null || pattern.baseClassNames.includes(info.qualifiedName)) {
@@ -3127,7 +3744,23 @@ async function controllerActionUnits(pattern, pack, info, ownBlocks, fileBlocks,
   if (!reachesConfiguredBase(ancestry, info.qualifiedName, pattern.baseClassNames)) {
     return [];
   }
+  const filters = controllerFilters(pattern, ancestry);
   const units = [];
+  for (const filter of filters) {
+    const displayPath = options.displayPathOf?.(filter.file) ?? filter.file;
+    const raw = filterUnit(
+      filter,
+      pattern,
+      displayPath,
+      bodyOfMethod(filter.method, options)
+    );
+    units.push(raw);
+    options.onReachSeed?.(raw, {
+      file: filter.file,
+      node: filter.method,
+      enclosingQualifiedName: filter.enclosingQualifiedName
+    });
+  }
   for (const block of ownBlocks) {
     if (block.info.bodyNode === null) {
       continue;
@@ -3139,6 +3772,12 @@ async function controllerActionUnits(pattern, pack, info, ownBlocks, fileBlocks,
       if ((visibility.get(actionName) ?? "public") !== "public") {
         continue;
       }
+      const around = filters.filter((filter) => filterCoversAction(filter, actionName)).map(
+        (filter) => filterReference(
+          filter,
+          options.displayPathOf?.(filter.file) ?? filter.file
+        )
+      );
       const raw = buildControllerActionUnit(
         pack,
         pattern,
@@ -3146,7 +3785,8 @@ async function controllerActionUnits(pattern, pack, info, ownBlocks, fileBlocks,
         actionName,
         method,
         options.filePath,
-        options
+        options,
+        around
       );
       units.push(raw);
       options.onReachSeed?.(raw, {
@@ -3158,7 +3798,7 @@ async function controllerActionUnits(pattern, pack, info, ownBlocks, fileBlocks,
   }
   return units;
 }
-function buildControllerActionUnit(pack, pattern, controllerQualifiedName, actionName, method, filePath, bodyRead) {
+function buildControllerActionUnit(pack, pattern, controllerQualifiedName, actionName, method, filePath, bodyRead, wrappers = []) {
   const range = rangeOf(method);
   const route = pattern.routeFor(controllerQualifiedName, actionName);
   const body = bodyOfMethod(method, bodyRead);
@@ -3179,7 +3819,7 @@ function buildControllerActionUnit(pack, pattern, controllerQualifiedName, actio
       exportName: actionName,
       exportPath: [controllerQualifiedName, actionName]
     },
-    boundaryBinding: route === null ? null : (0, import_behavioral_ir2.restBinding)({
+    boundaryBinding: route === null ? null : (0, import_behavioral_ir3.restBinding)({
       transport: pack.protocol,
       method: route.method,
       path: route.path,
@@ -3213,7 +3853,8 @@ function buildControllerActionUnit(pack, pattern, controllerQualifiedName, actio
     ],
     bodyContent: body.bodyContent ?? "absent",
     dependencyCalls: [],
-    declaredContract: null
+    declaredContract: null,
+    ...wrappers.length > 0 ? { wrappers: [...wrappers] } : {}
   };
 }
 function routingGapUnit(pattern, gaps) {
@@ -3296,7 +3937,7 @@ function bodyOfMethod(method, bodyRead = {}) {
   const storage = bodyRead.storage;
   const extra = [
     ...envReadEffects(method),
-    ...storage === void 0 ? [] : storageEffects(callsUnder(method), storage)
+    ...storage === void 0 ? [] : storageEffects(callsUnder2(method), storage)
   ];
   return {
     bodyContent: methodHasStatements(method) ? "statements" : "empty",
@@ -3305,7 +3946,7 @@ function bodyOfMethod(method, bodyRead = {}) {
     ...extra.length > 0 ? { extraEffects: extra } : {}
   };
 }
-function callsUnder(node, found = []) {
+function callsUnder2(node, found = []) {
   for (const child of node.namedChildren) {
     if (child === null) {
       continue;
@@ -3313,7 +3954,7 @@ function callsUnder(node, found = []) {
     if (child.type === "call") {
       found.push(child);
     }
-    callsUnder(child, found);
+    callsUnder2(child, found);
   }
   return found;
 }
@@ -3340,7 +3981,7 @@ function bodyFromLookup(found, range, subject, nothingThere, bodyRead) {
     ),
     none: () => nothingThere
   };
-  return (0, import_behavioral_ir2.dispatchByType)(table, found);
+  return (0, import_behavioral_ir3.dispatchByType)(table, found);
 }
 async function readFieldCall(stmt, scope, ctx, ancestry) {
   if (stmt.type !== "call" || field(stmt, "receiver") !== null) {
@@ -3609,7 +4250,7 @@ function buildFieldUnit(pack, typeName, decl, filePath) {
       exportName: null,
       exportPath: null
     },
-    boundaryBinding: decl.namedOnTheWire ? (0, import_behavioral_ir2.graphqlResolverBinding)({
+    boundaryBinding: decl.namedOnTheWire ? (0, import_behavioral_ir3.graphqlResolverBinding)({
       transport: pack.protocol,
       recognition: pack.name,
       typeName,
@@ -3807,7 +4448,7 @@ function parseWith(language, source) {
 // src/project.ts
 var import_node_fs3 = __toESM(require("fs"), 1);
 var import_node_path4 = __toESM(require("path"), 1);
-var import_behavioral_ir4 = require("@suss/behavioral-ir");
+var import_behavioral_ir5 = require("@suss/behavioral-ir");
 var import_datalog4 = require("@suss/datalog");
 var import_extractor10 = require("@suss/extractor");
 
@@ -3862,7 +4503,7 @@ function requiredRelativePath(node) {
 }
 
 // src/reach/closure.ts
-var import_behavioral_ir3 = require("@suss/behavioral-ir");
+var import_behavioral_ir4 = require("@suss/behavioral-ir");
 var import_datalog3 = require("@suss/datalog");
 var import_extractor8 = require("@suss/extractor");
 
@@ -4086,14 +4727,14 @@ async function reachedFunctions(seeds, options) {
       gapHandling: "permissive"
     });
     summary.confidence = { source: "inferred_static", level: "low" };
-    summary.gaps.push(...(stopsByKey.get(key) ?? []).map(import_behavioral_ir3.unfollowedCallGap));
-    (0, import_behavioral_ir3.placeCalls)(summary, targetsByKey.get(key));
-    (0, import_behavioral_ir3.placeArgTargets)(summary, argTargetsByKey.get(key));
-    (0, import_behavioral_ir3.placeCalleeParameters)(summary, parameterCallsByKey.get(key));
+    summary.gaps.push(...(stopsByKey.get(key) ?? []).map(import_behavioral_ir4.unfollowedCallGap));
+    (0, import_behavioral_ir4.placeCalls)(summary, targetsByKey.get(key));
+    (0, import_behavioral_ir4.placeArgTargets)(summary, argTargetsByKey.get(key));
+    (0, import_behavioral_ir4.placeCalleeParameters)(summary, parameterCallsByKey.get(key));
     summariesByKey.set(key, [summary]);
     summaries.push(summary);
   }
-  (0, import_behavioral_ir3.recordParameterGaps)(parameterCallsByKey, summariesByKey, passedPositions);
+  (0, import_behavioral_ir4.recordParameterGaps)(parameterCallsByKey, summariesByKey, passedPositions);
   return {
     summaries,
     targetsByKey,
@@ -4203,7 +4844,7 @@ async function scanBody(source, ctx, options) {
   };
   const followed2 = [];
   const stops = [];
-  const placements = new import_behavioral_ir3.TargetPlacements();
+  const placements = new import_behavioral_ir4.TargetPlacements();
   const parameterCalls = [];
   const passedPositions = /* @__PURE__ */ new Set();
   const seen = /* @__PURE__ */ new Set();
@@ -4256,7 +4897,7 @@ async function scanBody(source, ctx, options) {
     );
     if (outcome.kind === "stopped") {
       const stopKey = `${outcome.reason}:${callee}`;
-      if (!seen.has(stopKey) && (0, import_behavioral_ir3.worthRecording)(outcome.reason)) {
+      if (!seen.has(stopKey) && (0, import_behavioral_ir4.worthRecording)(outcome.reason)) {
         seen.add(stopKey);
         stops.push({ callee, reason: outcome.reason });
       }
@@ -4300,7 +4941,7 @@ function libraryUnit(target, options) {
       exportName: exportPath[0] ?? name,
       exportPath
     },
-    boundaryBinding: (0, import_behavioral_ir3.functionCallBinding)({
+    boundaryBinding: (0, import_behavioral_ir4.functionCallBinding)({
       transport: "in-process",
       recognition: "reachable"
     }),
@@ -4379,6 +5020,14 @@ function inheritedMethodsIn(packs) {
   }
   return found;
 }
+function alreadyDiscovered(seen, raw) {
+  const key = `${raw.identity.file}::${raw.identity.name}::${raw.identity.range.start}`;
+  if (seen.has(key)) {
+    return true;
+  }
+  seen.add(key);
+  return false;
+}
 async function extractRubyProject(options) {
   const timer = options.onTiming !== void 0 ? (0, import_extractor10.createTimer)() : (0, import_extractor10.noopTimer)();
   const cacheDir = adapterStamp.declineWhenRunFromSource(
@@ -4440,6 +5089,7 @@ async function extractRubyProject(options) {
   const displayPathOf = (file) => options.workspaceRoot !== void 0 ? import_node_path4.default.relative(options.workspaceRoot, file) : file;
   const seeds = [];
   const summariesBySeed = /* @__PURE__ */ new Map();
+  const discovered = /* @__PURE__ */ new Set();
   for (const { file, root } of parsed) {
     const displayPath = displayPathOf(file);
     const seedByRaw = /* @__PURE__ */ new Map();
@@ -4452,10 +5102,15 @@ async function extractRubyProject(options) {
         cache,
         ...storagePatterns.length > 0 ? { storage: { facts: db, patterns: storagePatterns } } : {},
         inheritedMethods,
+        displayPathOf,
+        facts: db,
         onReachSeed: (raw, seed) => seedByRaw.set(raw, seed)
       })
     );
     for (const raw of rawUnits) {
+      if (alreadyDiscovered(discovered, raw)) {
+        continue;
+      }
       const summary = timer.time(
         "summarize",
         () => (0, import_extractor10.assembleSummary)(raw, { gapHandling: "permissive" })
@@ -4531,14 +5186,14 @@ async function extractRubyProject(options) {
   for (const [key, owners] of summariesBySeed) {
     for (const summary of owners) {
       summary.gaps.push(
-        ...(reached.stopsByKey.get(key) ?? []).map(import_behavioral_ir4.unfollowedCallGap)
+        ...(reached.stopsByKey.get(key) ?? []).map(import_behavioral_ir5.unfollowedCallGap)
       );
-      (0, import_behavioral_ir4.placeCalls)(summary, reached.targetsByKey.get(key));
-      (0, import_behavioral_ir4.placeArgTargets)(summary, reached.argTargetsByKey.get(key));
-      (0, import_behavioral_ir4.placeCalleeParameters)(summary, reached.parameterCallsByKey.get(key));
+      (0, import_behavioral_ir5.placeCalls)(summary, reached.targetsByKey.get(key));
+      (0, import_behavioral_ir5.placeArgTargets)(summary, reached.argTargetsByKey.get(key));
+      (0, import_behavioral_ir5.placeCalleeParameters)(summary, reached.parameterCallsByKey.get(key));
     }
   }
-  (0, import_behavioral_ir4.recordParameterGaps)(
+  (0, import_behavioral_ir5.recordParameterGaps)(
     reached.parameterCallsByKey,
     summariesBySeed,
     reached.passedPositions
@@ -4549,21 +5204,27 @@ async function extractRubyProject(options) {
   const idRoot = options.projectRoot ?? options.workspaceRoot;
   for (const summary of summaries) {
     const absoluteFile = options.workspaceRoot === void 0 ? summary.location.file : import_node_path4.default.resolve(options.workspaceRoot, summary.location.file);
-    summary.identity.id = (0, import_behavioral_ir4.summaryIdFromParts)({
+    summary.identity.id = (0, import_behavioral_ir5.summaryIdFromParts)({
       workspace: void 0,
       file: idRoot === void 0 ? absoluteFile : import_node_path4.default.relative(idRoot, absoluteFile),
       name: summary.identity.name,
       exportPath: summary.identity.exportPath
     });
   }
-  (0, import_behavioral_ir4.disambiguateSummaryIds)(summaries);
-  (0, import_behavioral_ir4.linkCallsToSummaries)(summaries);
+  (0, import_behavioral_ir5.disambiguateSummaryIds)(summaries);
+  (0, import_behavioral_ir5.linkCallsToSummaries)(summaries);
+  const composed = timer.time(
+    "summarize",
+    () => (0, import_extractor10.composeWrappers)(summaries, {
+      gapHandling: options.gapHandling ?? "permissive"
+    })
+  );
   await timer.timeAsync("cache.write", async () => {
-    if (cacheDir === null || summaries.length === 0) {
+    if (cacheDir === null || composed.length === 0) {
       return;
     }
     try {
-      await extractionCache.write(cacheInput, summaries);
+      await extractionCache.write(cacheInput, composed);
     } catch {
     }
   });
@@ -4572,11 +5233,11 @@ async function extractRubyProject(options) {
       packs: options.packs,
       tallies,
       filesWalked: options.files.length,
-      summaries
+      summaries: composed
     })
   );
   options.onTiming?.(timer.report());
-  return { summaries, facts: db };
+  return { summaries: composed, facts: db };
 }
 function fileDependenciesOf(db, displayPathOf) {
   const byFile = /* @__PURE__ */ new Map();