canship 0.7.0 → 0.7.1

package/dist/cli.js

@@ -3180,9 +3180,32 @@ function synchronousLocal(file, expr) {
   const code = noiseMaskedOf(file);
   const escaped = name.replace(/\$/g, "\\$");
   const declared = new RegExp(`(?:^|[^\\w$])(async\\s+)?function\\s*\\*?\\s*${escaped}\\s*\\(`).exec(code);
-  if (declared) return !declared[1];
+  if (declared?.[1]) return false;
   const assigned = new RegExp(`\\b(?:const|let|var)\\s+${escaped}\\s*(?::[^=;]{0,200})?=\\s*(async\\b)?\\s*(?:function\\b|\\([^()]*\\)\\s*(?::[^=;{]{0,200})?=>|[A-Za-z_$][\\w$]*\\s*=>)`).exec(code);
-  return assigned !== null && !assigned[1];
+  if (!declared && (!assigned || assigned[1])) return false;
+  const declaration = declared ?? assigned;
+  const pairedEnd = (open, left, right) => {
+    let depth = 0;
+    for (let i = open; i < Math.min(code.length, open + 65536); i++) {
+      if (code[i] === left) depth++;
+      else if (code[i] === right && --depth === 0) return i;
+    }
+    return -1;
+  };
+  let start = declaration.index + declaration[0].length;
+  if (declared) start = pairedEnd(start - 1, "(", ")") + 1;
+  else if (/function\b$/.test(declaration[0])) {
+    const open = code.indexOf("(", start);
+    start = open < 0 ? 0 : pairedEnd(open, "(", ")") + 1;
+  }
+  if (start === 0) return false;
+  start += /^\s*(?::[\w\s.<>,[\]|?]+)?\s*/.exec(code.slice(start))[0].length;
+  const close = code[start] === "{" ? pairedEnd(start, "{", "}") : -1;
+  if (code[start] === "{" && close < 0) return false;
+  const body = close >= 0 ? code.slice(start, close + 1) : `return ${code.slice(start).split(/[;\n]/)[0] ?? ""}`;
+  if (/\b(?:Promise|then|await|new|function|async)\b|=>|\.\.\./.test(body)) return false;
+  if ([...body.matchAll(/([\w$]+)\s*\(/g)].some((m) => !/^(?:if|switch)$/.test(m[1]))) return false;
+  return /\breturn\s+(?:null|false|true|\{|[\w$]+\s*\?)/.test(body);
 }
 var limited = /* @__PURE__ */ new WeakSet();
 var cache2 = /* @__PURE__ */ new WeakMap();
@@ -3618,11 +3641,13 @@ function usePrefixes(a, arg) {
   if (arg.text.startsWith("[")) {
     const close = a.pairs.get(arg.at);
     const items = close === void 0 ? [] : argsOf(a, arg.at, close);
-    if (items.length === 0 || !items.every((item) => /^['"`]/.test(item.source))) return null;
+    if (items.length === 0 || !items.some((item) => /^['"`]/.test(item.source))) return null;
     return items.map((item) => pathOf(a, item)).filter((path) => path !== null);
   }
   const prefix = pathOf(a, arg);
-  return prefix === null ? null : [prefix];
+  if (prefix !== null) return [prefix];
+  if (/^['"`/]|^new\s+RegExp\b|^(?:process\s*\.\s*env|import\s*\.\s*meta\s*\.\s*env|(?:[\w$]+\s*\.\s*)?env)\s*[.[]/.test(arg.source)) return [];
+  return null;
 }
 function pathOf(a, arg) {
   if (arg.text.startsWith("[")) return null;
@@ -4088,7 +4113,7 @@ function opsOf(site) {
   return result;
 }
 function generalMiddleware(site, before, files) {
-  const args = opsOf(site).uses.filter((use) => !use.mount && use.at < before && (use.prefix === null || use.prefix === "/" || /^\/?\*$/.test(use.prefix))).flatMap((use) => use.args).filter((arg) => site.framework !== "express" || mountedFile(site.a, arg, files) === null);
+  const args = opsOf(site).uses.filter((use) => !use.mount && use.at < before && (use.prefix === null || site.framework !== "hono" && use.prefix === "/" || /^\/?\*$/.test(use.prefix))).flatMap((use) => use.args).filter((arg) => site.framework !== "express" || mountedFile(site.a, arg, files) === null);
   return toRefs(site.a, args);
 }
 function passedSites(site, files) {
@@ -4276,8 +4301,7 @@ function serverIndex(files) {
       };
       add2(handler, callbacks);
       callbacks.forEach((callback, index2) => {
-        if (!FUNCTION_EXPRESSION.test(callback.text)) return;
-        const range = functionAt(a, callback.at, callback.at + callback.text.length);
+        const range = handlerOf(a, callback, files);
         if (range) add2(range, callbacks.slice(0, index2));
       });
     }
@@ -4330,25 +4354,37 @@ function serverRoutesOf(file, files) {
   const actions = serverActionRoutes(file);
   return actions.length ? actions : nodeRoutesFor(file, files);
 }
-var decoratorCache = /* @__PURE__ */ new WeakMap();
-function decoratorOf(name, files) {
-  let cache3 = decoratorCache.get(files);
+function decoratorOf(ref, receiver, name, files) {
+  const a = analyse(ref.file);
+  const owner = (at) => a.bodies.filter((b) => b.start < at && at < b.end).sort((x, y) => y.start - x.start)[0];
+  const pattern = new RegExp(`(?<![\\w$.])${receiver.replace(/\$/g, "\\$")}\\s*\\.\\s*decorate\\s*\\(\\s*['"]${name.replace(/\$/g, "\\$")}['"]\\s*,`, "g");
+  let result = null;
+  for (const m of a.source.matchAll(pattern)) {
+    if (m.index >= ref.at || owner(m.index) !== owner(ref.at)) continue;
+    const open = a.source.indexOf("(", m.index);
+    const close = a.pairs.get(open);
+    const value = close === void 0 ? void 0 : argsOf(a, open, close)[1];
+    result = value ? handlerOf(a, value, files) : null;
+  }
+  return result;
+}
+var authPluginCache = /* @__PURE__ */ new WeakMap();
+function registeredAuthPlugin(ref, pkg) {
+  const a = analyse(ref.file);
+  const receiver = /^([A-Za-z_$][\w$]*)\s*\./.exec(ref.text)?.[1];
+  if (!receiver) return false;
+  let cache3 = authPluginCache.get(ref.file);
   if (!cache3) {
     cache3 = /* @__PURE__ */ new Map();
-    for (const file of files) {
-      if (!/\.[mc]?[jt]sx?$/.test(file.path) || !file.content.includes("decorate")) continue;
-      const a = analyse(file);
-      for (const m of a.source.matchAll(/\.\s*decorate\s*\(\s*['"]([A-Za-z_$][\w$]*)['"]\s*,/g)) {
-        if (cache3.has(m[1])) continue;
-        const open = a.source.indexOf("(", m.index);
-        const close = a.pairs.get(open);
-        const value = close === void 0 ? void 0 : argsOf(a, open, close)[1];
-        cache3.set(m[1], value ? handlerOf(a, value, files) : null);
-      }
-    }
-    decoratorCache.set(files, cache3);
+    authPluginCache.set(ref.file, cache3);
+  }
+  let registers = cache3.get(receiver);
+  if (!registers) {
+    registers = fastifyOps(a, receiver).registers;
+    cache3.set(receiver, registers);
   }
-  return cache3.get(name) ?? null;
+  const owner = (at) => a.bodies.filter((b) => b.start < at && at < b.end).sort((x, y) => y.start - x.start)[0];
+  return registers.some((reg) => reg.at < ref.at && owner(reg.at) === owner(ref.at) && /^[A-Za-z_$][\w$]*$/.test(reg.target.text) && packageOf(a, reg.target.text) === pkg);
 }
 function authCompositionOf(ref) {
   const a = analyse(ref.file);
@@ -4382,7 +4418,7 @@ function middlewareDefinition(ref, files) {
   const callee = member ?? root;
   const spec = packageOf(a, root);
   if (member && (spec === null || spec === "fastify")) {
-    const decorated = decoratorOf(member, files);
+    const decorated = decoratorOf(ref, root, member, files);
     if (decorated) return { name: callee, range: decorated, spec: null, inline };
   }
   if (spec) return { name: callee, range: null, spec, inline };
@@ -4399,6 +4435,181 @@ function propertyValue(a, name) {
   return { file: a.file, start: from, end: expressionEnd(a, from) - 1 };
 }
 
+// src/rules/verification.ts
+var LocalVerification = class {
+  constructor(file, responseExits = false) {
+    this.responseExits = responseExits;
+    this.code = noiseMaskedOf(file);
+    this.source = commentsMaskedOf(file);
+    this.pairs = delimiterPairs(this.code);
+    this.bodies = functionBodies(this.code, this.pairs);
+  }
+  responseExits;
+  code;
+  source;
+  pairs;
+  bodies;
+  owner(at) {
+    return this.bodies.filter((b) => b.start < at && at < b.end).sort((a, b) => b.start - a.start)[0];
+  }
+  skipSpace(at) {
+    while (/\s/.test(this.code[at] ?? "")) at++;
+    return at;
+  }
+  endOf(at, limit = this.code.length) {
+    if (this.code[at] === "{") return (this.pairs.get(at) ?? limit - 1) + 1;
+    for (let i = at; i < limit; i++) {
+      if (/[;\n}]/.test(this.code[i])) return i;
+      const end = this.pairs.get(i);
+      if (end !== void 0) i = end;
+    }
+    return limit;
+  }
+  /**
+   * 块的顶层有无条件退出即算退出，前面可以有记录日志等语句；
+   * 嵌套分支、函数中的 return 以及无花括号 if/else/循环控制的 return 不算。
+   */
+  exits(from, to) {
+    let at = this.skipSpace(from);
+    if (this.code[at] !== "{") return /^(?:return|throw)\b|^(?:redirect|notFound)\s*\(/.test(this.code.slice(at, to));
+    const end = Math.min(to, this.pairs.get(at) ?? to);
+    at = this.skipSpace(at + 1);
+    while (at < end) {
+      const statement = this.code.slice(at, this.statementEnd(at, end));
+      if (/^return\b/.test(statement) && this.responseExits) {
+        if (/^return\s+(?:(?:await\s+)?(?:reply|res|response)\s*\.[\s\S]*\b(?:send|end|json|sendStatus)\s*\(|(?:c|ctx|context)\s*\.\s*(?:json|text|body|html|redirect|newResponse)\s*\(|new\s+Response\s*\(|next\s*\(\s*[^)\s])/.test(statement)) return true;
+        return false;
+      }
+      if (/^(?:return|throw)\b|^(?:redirect|notFound)\s*\(/.test(statement)) return true;
+      if (this.responseExits && /^reply\s*\.\s*(?:(?:code|status)\s*\([^)]*\)\s*\.\s*)?send\s*\(/.test(this.code.slice(at, end))) return true;
+      const next = this.statementEnd(at, end);
+      if (next <= at) return false;
+      at = this.skipSpace(next);
+    }
+    return false;
+  }
+  /** 跳过完整语句；分支、循环和函数内的退出不提升为外层退出。 */
+  statementEnd(at, limit, depth = 0) {
+    if (depth >= 64) return limit;
+    if (this.code[at] === "{") return (this.pairs.get(at) ?? limit - 1) + 1;
+    const control = /^(if|for(?:\s+await)?|while|with|switch)\s*\(/.exec(this.code.slice(at, at + 80));
+    if (control) {
+      const close = this.pairs.get(at + control[0].length - 1);
+      if (close === void 0) return limit;
+      let end = this.statementEnd(this.skipSpace(close + 1), limit, depth + 1);
+      const next = this.skipSpace(end);
+      if (control[1] === "if" && /^else\b/.test(this.code.slice(next, next + 5))) {
+        end = this.statementEnd(this.skipSpace(next + 4), limit, depth + 1);
+      }
+      return end;
+    }
+    if (/^(?:try|do)\b/.test(this.code.slice(at, at + 8))) return limit;
+    for (let i = at; i < limit; i++) {
+      if (this.code[i] === ";") return i + 1;
+      const close = this.pairs.get(i);
+      if (close !== void 0) {
+        i = close;
+        continue;
+      }
+      if (this.code[i] !== "\n") continue;
+      const before = this.code.slice(at, i).trimEnd();
+      const after = this.code.slice(i + 1, limit).trimStart();
+      if (!before || /[=+\-*/%&|^!?:,.([{<>]$/.test(before)) continue;
+      if (/^[.?+\-*/%&|^,:<>=([{`]/.test(after)) continue;
+      if (/\b(?:const|let|var|function|async|await|new|yield)$/.test(before)) continue;
+      return i + 1;
+    }
+    return limit;
+  }
+  /** 验证与使用须在同一函数，且不能依赖可选分支或被吞掉的异常。 */
+  enforcedBefore(from, to) {
+    const owner = this.owner(from);
+    if (from >= to || owner !== this.owner(to)) return false;
+    const start = owner ? owner.start + 1 : 0;
+    for (let i = start; i < from; i++) {
+      const conditional = /^(?:if|for|while|switch)\s*\(/.exec(this.code.slice(i, i + 32));
+      if (conditional && !/[\w$]/.test(this.code[i - 1] ?? "")) {
+        const close = this.pairs.get(i + conditional[0].length - 1);
+        if (close !== void 0) {
+          const body = this.skipSpace(close + 1);
+          const end2 = this.endOf(body);
+          if (from < end2 && to >= end2) return false;
+        }
+      }
+      const end = this.pairs.get(i);
+      if (end === void 0) continue;
+      if (end < from) {
+        i = end;
+        continue;
+      }
+      if (end >= to) continue;
+      if (this.code[i] === "(" && !/(?:\?\.|\b(?:if|for|while|switch|catch))\s*$/.test(this.code.slice(Math.max(start, i - 20), i))) continue;
+      if (this.code[i] !== "{" || !/\btry\s*$/.test(this.code.slice(Math.max(start, i - 16), i))) return false;
+      let next = this.skipSpace(end + 1);
+      if (/^catch\b/.test(this.code.slice(next))) {
+        next = this.skipSpace(next + 5);
+        if (this.code[next] === "(") next = this.skipSpace((this.pairs.get(next) ?? next) + 1);
+        const caughtEnd = this.endOf(next);
+        if (!this.exits(next, caughtEnd)) return false;
+        next = this.skipSpace(caughtEnd);
+      }
+      if (/^finally\b/.test(this.code.slice(next))) return false;
+    }
+    let boundary = start;
+    for (const [open, close] of this.pairs) {
+      if (this.code[open] === "{" && open < from && close > from) boundary = Math.max(boundary, open + 1);
+    }
+    while (boundary < from) {
+      const next = this.statementEnd(this.skipSpace(boundary), this.code.length);
+      if (next <= boundary || next > from) break;
+      boundary = next;
+    }
+    return !/[?]|&&|\|\||=>/.test(this.code.slice(boundary, from));
+  }
+  /** 找出当前函数中最后一次赋值；未知或条件覆盖同样会使旧证明失效。 */
+  assignment(name, at) {
+    const escaped = name.replace(/\$/g, "\\$");
+    const pattern = new RegExp(`(?<![\\w$.])(?:const\\s+|let\\s+|var\\s+)?${escaped}((?:\\s*\\.[\\w$]+|\\s*\\[[^\\]]*\\])*)\\s*(?::[^=;{}\\n]{0,100})?=(?![=>])`, "g");
+    let result = null;
+    for (const m of this.code.slice(0, at).matchAll(pattern)) {
+      if (this.owner(m.index) !== this.owner(at)) continue;
+      const from = this.skipSpace(m.index + m[0].length);
+      const end = this.endOf(from);
+      if (end <= at) result = { at: m.index, from, end, expression: this.code.slice(from, end).trim(), member: m[1].length > 0 };
+    }
+    return result;
+  }
+};
+function enforcedVerification(source, pattern, synchronous = /(?!)/) {
+  const fragment = new LocalVerification({ path: "middleware.ts", content: source, lines: source.split("\n"), isExampleContext: false });
+  const first = fragment.code.search(/\S/);
+  let body = fragment.code[first] === "{" ? { start: first, end: fragment.pairs.get(first) ?? fragment.code.length - 1 } : fragment.bodies.find((b) => b.declaration >= first);
+  if (body) {
+    const returned = fragment.bodies.find((b) => b.declaration > body.start && b.end < body.end && /^\s*return\s+(?:createMiddleware\s*\(\s*)?(?:async\s*)?(?:\([^)]*\)\s*)?$/.test(fragment.code.slice(body.start + 1, b.declaration)));
+    if (returned) body = returned;
+  }
+  const inner = body ? source.slice(body.start + 1, body.end) : source;
+  const content = `async function __guard__(){
+${inner}
+__continuation__();
+}`;
+  const context = new LocalVerification({ path: "middleware.ts", content, lines: content.split("\n"), isExampleContext: false }, true);
+  const owner = context.bodies[0];
+  let end = content.lastIndexOf("__continuation__");
+  for (const m of context.code.matchAll(/(?<![\w$.])next\s*\(\s*\)/g)) {
+    if (context.owner(m.index) === owner) end = Math.min(end, m.index);
+  }
+  const calls = new RegExp(pattern.source, pattern.flags.includes("g") ? pattern.flags : `${pattern.flags}g`);
+  for (const m of context.code.matchAll(calls)) {
+    if (context.owner(m.index) !== owner || !context.enforcedBefore(m.index, end)) continue;
+    const close = context.pairs.get(m.index + m[0].length - 1);
+    if (close === void 0 || /^[.[]|^\?\./.test(context.code.slice(context.skipSpace(close + 1)))) continue;
+    const before = context.code.slice(Math.max(owner?.start ?? 0, m.index - 300), m.index).replace(/(?:[A-Za-z_$][\w$]*(?:\s*\([^()]*\))?\s*\??\.\s*)*$/, "").trimEnd();
+    if (/(?:^|[^\w$.])(?:await|return)$/.test(before) || synchronous.test(m[0])) return true;
+  }
+  return false;
+}
+
 // src/rules/apiauth.ts
 var APP_ROUTER = /(?:^|\/)app\/api\/(?:.+\/)?route\.[mc]?[jt]sx?$/;
 var PAGES_ROUTER = /(?:^|\/)pages\/api\/.+\.[mc]?[jt]sx?$/;
@@ -6018,13 +6229,6 @@ function passesOnlyAuthenticated(code) {
   }
   return false;
 }
-function awaitedCall(code, pattern) {
-  for (const m of code.matchAll(new RegExp(pattern.source, pattern.flags.includes("g") ? pattern.flags : `${pattern.flags}g`))) {
-    const before = code.slice(Math.max(0, m.index - 300), m.index).replace(/(?:[A-Za-z_$][\w$]*(?:\s*\([^()]*\))?\s*\??\.\s*)*$/, "").trimEnd();
-    if (/(?:^|[^\w$.])(?:await|return)$/.test(before)) return true;
-  }
-  return false;
-}
 function maskUnusedFunctions(code) {
   let out = code;
   const definitions = /\b(?:(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*(?::[^=;]{0,200})?=\s*(?:async\b\s*)?(?:function\b[^(]{0,80}\([^()]*\)|\([^()]*\)\s*(?::[^=;{]{0,200})?=>|[A-Za-z_$][\w$]*\s*=>)|(?:async\s+)?function\s*\*?\s*([A-Za-z_$][\w$]*)\s*\([^()]*\))\s*/g;
@@ -6052,7 +6256,7 @@ function maskUnusedFunctions(code) {
   return out;
 }
 function jwtVerifyRejects(code) {
-  if (!awaitedCall(code, /\bjwtVerify\s*\(/)) return false;
+  if (!enforcedVerification(code, /\bjwtVerify\s*\(/)) return false;
   const handlers = [...code.matchAll(/\bcatch\s*(?:\([^()]*\))?\s*\{/g)].map((m) => {
     const open = m.index + m[0].length - 1;
     return code.slice(open, closingDelimiter(code, open, "{", "}") ?? open);
@@ -6079,7 +6283,8 @@ function catchDenies(code) {
     const tryOpen = m.index + m[0].length - 1;
     const tryClose = closingDelimiter(code, tryOpen, "{", "}");
     if (tryClose === null) continue;
-    if (!/\b\w*(?:auth|valid|verify|session|token|user|client|key|secret|permission|access)\w*\s*\(/i.test(code.slice(tryOpen, tryClose))) continue;
+    const calls = /\b\w*(?:auth|valid|verify|session|token|user|client|key|secret|permission|access)\w*\s*\(/i;
+    if (!enforcedVerification(code, calls, /^(?:assertAuth(?:enticated)?|constructEvent)\b/i)) continue;
     const handler = /^\s*catch\s*(?:\([^()]*\))?\s*\{/.exec(code.slice(tryClose + 1));
     if (!handler) continue;
     const open = tryClose + handler[0].length;
@@ -6115,8 +6320,8 @@ function rejectsMissingCredential(code) {
 }
 function middlewareRejects(source) {
   const code = maskUnusedFunctions(source);
-  if (hasConditionalAuthGuard(code) || rejectsMissingCredential(code) || passesOnlyAuthenticated(code) || rejectsSecretMismatch(code) || catchDenies(code) || AUTH_ENFORCING_CALL.test(code) || jwtVerifyRejects(code)) return true;
-  return (/\b(?:jwt\s*\.\s*verify|verifyToken|verifyJwt|verifyIdToken|verifyAccessToken)\s*\(/.test(code) || awaitedCall(code, /\bjwtVerify\s*\(/)) && DENIED_RESPONSE.test(code);
+  if (hasConditionalAuthGuard(code) || rejectsMissingCredential(code) || passesOnlyAuthenticated(code) || rejectsSecretMismatch(code) || catchDenies(code) || enforcedVerification(code, AUTH_ENFORCING_CALL, /^(?:assertAuth(?:enticated)?|constructEvent)\b/i) || jwtVerifyRejects(code)) return true;
+  return false;
 }
 function middlewareStatus(ref, files, depth = 0) {
   const composition = depth < 3 ? authCompositionOf(ref) : null;
@@ -6142,7 +6347,7 @@ function middlewareStatus(ref, files, depth = 0) {
       if (inner.status === "guard") return { status: "guard", name };
     }
   } else if (/^[A-Za-z_$][\w$]*\s*\.\s*[A-Za-z_$][\w$]*$/.test(ref.text)) {
-    const plugin = FASTIFY_AUTH_DECORATORS.find(([pkg, decorator]) => decorator === name && files.some((file) => file.content.includes(`'${pkg}'`) || file.content.includes(`"${pkg}"`)));
+    const plugin = FASTIFY_AUTH_DECORATORS.find(([pkg, decorator]) => decorator === name && registeredAuthPlugin(ref, pkg));
     if (plugin) return { status: "guard", name };
   }
   return { status: AUTH_HELPER_NAME.test(name) ? "unconfirmed" : "none", name };
@@ -6989,12 +7194,13 @@ function fixedTablesOf(code, source, pairs) {
   return result;
 }
 var InputFlow = class {
-  constructor(code, source, span, pairs, roles, fixedTables) {
+  constructor(code, source, span, pairs, roles, fixedTables, definition) {
     this.code = code;
     this.source = source;
     this.span = span;
     this.pairs = pairs;
     this.fixedTables = fixedTables;
+    this.definition = definition;
     for (const [name, at] of roles.values) this.parameters.set(name, { level: "direct", origin: at, names: /* @__PURE__ */ new Set([name]), ownUrl: false });
     this.sourcePattern = sourceRegex(roles);
     this.contextRead = roles.contexts.size > 0 ? new RegExp(String.raw`(?<![\w$.])(?:${namePattern(roles.contexts.keys())})\s*\??\.\s*req(?:\s*\??\.\s*raw)?\s*\??\.\s*(${HONO_READ_CALLS})\s*\(`) : null;
@@ -7039,6 +7245,7 @@ var InputFlow = class {
   span;
   pairs;
   fixedTables;
+  definition;
   parameters = /* @__PURE__ */ new Map();
   limited = false;
   assignmentList = /* @__PURE__ */ new Map();
@@ -7148,7 +7355,8 @@ var InputFlow = class {
     if (!new RegExp(`^(?:(?:await|new)\\s+)*${escaped}\\s*\\(`).test(expression)) return false;
     const cached = this.mirrors.get(callee);
     if (cached !== void 0) return cached;
-    const code = this.code;
+    let code = this.code;
+    let pairs = this.pairs;
     let params = "";
     let after = -1;
     const declared = new RegExp(`(?:^|[^\\w$.])(?:async\\s+)?function\\s*\\*?\\s*${escaped}\\s*\\(`).exec(code);
@@ -7159,21 +7367,31 @@ var InputFlow = class {
       after = match.index + match[0].length;
     } else if (match) {
       const open = match.index + match[0].length - 1;
-      const close = this.pairs.get(open);
+      const close = pairs.get(open);
       if (close !== void 0) {
         params = code.slice(open + 1, close);
         after = close + 1;
       }
     }
+    if (!match) {
+      const target = this.definition?.(callee);
+      if (target) {
+        code = noiseMaskedOf(target.file);
+        pairs = delimiterPairs(code);
+        params = functionParams(target).join(",");
+        after = code[target.start] === "{" ? target.start : code.indexOf("=>", target.start) + 2;
+        if (after < target.start || after > target.end) after = -1;
+      }
+    }
     let result = false;
     if (after !== -1) {
       const names = params.split(",").flatMap((part) => part.replace(/[:=][\s\S]*$/, "").match(/[A-Za-z_$][\w$]*/g) ?? []);
       const head = /^\s*(?::[^={]{0,200})?(?:=>)?\s*/.exec(code.slice(after, after + 260));
       const start = after + head[0].length;
-      const end = (from, limit) => expressionEnd2(code, from, limit, this.pairs, () => {
+      const end = (from, limit) => expressionEnd2(code, from, limit, pairs, () => {
         this.limited = true;
       });
-      const bodyEnd = this.pairs.get(start) ?? start;
+      const bodyEnd = pairs.get(start) ?? start;
       const returns = code[start] === "{" ? [...code.slice(start, bodyEnd).matchAll(/\breturn\b/g)].map((m) => {
         const from = start + m.index + m[0].length;
         return code.slice(from, end(from, bodyEnd));
@@ -7454,12 +7672,13 @@ function lowerBound(values, value) {
   return low;
 }
 var HandlerFile = class {
-  constructor(code, source, pairs, lineStarts, candidates) {
+  constructor(code, source, pairs, lineStarts, candidates, definition) {
     this.code = code;
     this.source = source;
     this.pairs = pairs;
     this.lineStarts = lineStarts;
     this.candidates = candidates;
+    this.definition = definition;
     this.fixedTables = fixedTablesOf(code, source, pairs);
   }
   code;
@@ -7467,6 +7686,7 @@ var HandlerFile = class {
   pairs;
   lineStarts;
   candidates;
+  definition;
   flows = /* @__PURE__ */ new Map();
   fixedTables;
   get limited() {
@@ -7483,7 +7703,7 @@ var HandlerFile = class {
       if (first >= positions.length || positions[first] >= body.end) continue;
       let flow = this.flows.get(candidate);
       if (!flow) {
-        flow = new InputFlow(this.code, this.source, { start: body.start, end: body.end }, this.pairs, candidate.roles, this.fixedTables);
+        flow = new InputFlow(this.code, this.source, { start: body.start, end: body.end }, this.pairs, candidate.roles, this.fixedTables, this.definition);
         this.flows.set(candidate, flow);
       }
       result.push({ route: candidate.route, body, flow });
@@ -7528,7 +7748,14 @@ function handlerFileOf(file, files) {
           if (hasInput(roles)) candidates.push({ route: r, body, roles });
         }
       }
-      if (candidates.length > 0) result = new HandlerFile(code, source, pairs, lineStartsOf(file.content), candidates);
+      if (candidates.length > 0) result = new HandlerFile(
+        code,
+        source,
+        pairs,
+        lineStartsOf(file.content),
+        candidates,
+        (name) => calleeDefinition(file, name, null, files)
+      );
     }
   }
   handlerCache.set(file, result);
@@ -8050,140 +8277,6 @@ function check(ctx, kind) {
 var ssrfRule = { id: "ssrf/request-url", severity: "P1", check: (ctx) => check(ctx, "ssrf") };
 var redirectRule = { id: "redirect/open", severity: "P2", check: (ctx) => check(ctx, "redirect") };
 
-// src/rules/verification.ts
-var LocalVerification = class {
-  code;
-  source;
-  pairs;
-  bodies;
-  constructor(file) {
-    this.code = noiseMaskedOf(file);
-    this.source = commentsMaskedOf(file);
-    this.pairs = delimiterPairs(this.code);
-    this.bodies = functionBodies(this.code, this.pairs);
-  }
-  owner(at) {
-    return this.bodies.filter((b) => b.start < at && at < b.end).sort((a, b) => b.start - a.start)[0];
-  }
-  skipSpace(at) {
-    while (/\s/.test(this.code[at] ?? "")) at++;
-    return at;
-  }
-  endOf(at, limit = this.code.length) {
-    if (this.code[at] === "{") return (this.pairs.get(at) ?? limit - 1) + 1;
-    for (let i = at; i < limit; i++) {
-      if (/[;\n}]/.test(this.code[i])) return i;
-      const end = this.pairs.get(i);
-      if (end !== void 0) i = end;
-    }
-    return limit;
-  }
-  /**
-   * 块的顶层有无条件退出即算退出，前面可以有记录日志等语句；
-   * 嵌套分支、函数中的 return 以及无花括号 if/else/循环控制的 return 不算。
-   */
-  exits(from, to) {
-    let at = this.skipSpace(from);
-    if (this.code[at] !== "{") return /^(?:return|throw)\b|^(?:redirect|notFound)\s*\(/.test(this.code.slice(at, to));
-    const end = Math.min(to, this.pairs.get(at) ?? to);
-    at = this.skipSpace(at + 1);
-    while (at < end) {
-      if (/^(?:return|throw)\b|^(?:redirect|notFound)\s*\(/.test(this.code.slice(at, at + 32))) return true;
-      const next = this.statementEnd(at, end);
-      if (next <= at) return false;
-      at = this.skipSpace(next);
-    }
-    return false;
-  }
-  /** 跳过完整语句；分支、循环和函数内的退出不提升为外层退出。 */
-  statementEnd(at, limit, depth = 0) {
-    if (depth >= 64) return limit;
-    if (this.code[at] === "{") return (this.pairs.get(at) ?? limit - 1) + 1;
-    const control = /^(if|for(?:\s+await)?|while|with|switch)\s*\(/.exec(this.code.slice(at, at + 80));
-    if (control) {
-      const close = this.pairs.get(at + control[0].length - 1);
-      if (close === void 0) return limit;
-      let end = this.statementEnd(this.skipSpace(close + 1), limit, depth + 1);
-      const next = this.skipSpace(end);
-      if (control[1] === "if" && /^else\b/.test(this.code.slice(next, next + 5))) {
-        end = this.statementEnd(this.skipSpace(next + 4), limit, depth + 1);
-      }
-      return end;
-    }
-    if (/^(?:try|do)\b/.test(this.code.slice(at, at + 8))) return limit;
-    for (let i = at; i < limit; i++) {
-      if (this.code[i] === ";") return i + 1;
-      const close = this.pairs.get(i);
-      if (close !== void 0) {
-        i = close;
-        continue;
-      }
-      if (this.code[i] !== "\n") continue;
-      const before = this.code.slice(at, i).trimEnd();
-      const after = this.code.slice(i + 1, limit).trimStart();
-      if (!before || /[=+\-*/%&|^!?:,.([{<>]$/.test(before)) continue;
-      if (/^[.?+\-*/%&|^,:<>=([{`]/.test(after)) continue;
-      if (/\b(?:const|let|var|function|async|await|new|yield)$/.test(before)) continue;
-      return i + 1;
-    }
-    return limit;
-  }
-  /** 验证与使用须在同一函数，且不能依赖可选分支或被吞掉的异常。 */
-  enforcedBefore(from, to) {
-    const owner = this.owner(from);
-    if (from >= to || owner !== this.owner(to)) return false;
-    const start = owner ? owner.start + 1 : 0;
-    for (let i = start; i < from; i++) {
-      const conditional = /^(?:if|for|while|switch)\s*\(/.exec(this.code.slice(i, i + 32));
-      if (conditional && !/[\w$]/.test(this.code[i - 1] ?? "")) {
-        const close = this.pairs.get(i + conditional[0].length - 1);
-        if (close !== void 0) {
-          const body = this.skipSpace(close + 1);
-          const end2 = this.endOf(body);
-          if (from < end2 && to >= end2) return false;
-        }
-      }
-      const end = this.pairs.get(i);
-      if (end === void 0) continue;
-      if (end < from) {
-        i = end;
-        continue;
-      }
-      if (end >= to) continue;
-      if (this.code[i] !== "{" || !/\btry\s*$/.test(this.code.slice(Math.max(start, i - 16), i))) return false;
-      let next = this.skipSpace(end + 1);
-      if (/^catch\b/.test(this.code.slice(next))) {
-        next = this.skipSpace(next + 5);
-        if (this.code[next] === "(") next = this.skipSpace((this.pairs.get(next) ?? next) + 1);
-        const caughtEnd = this.endOf(next);
-        if (!this.exits(next, caughtEnd)) return false;
-        next = this.skipSpace(caughtEnd);
-      }
-      if (/^finally\b/.test(this.code.slice(next))) return false;
-    }
-    const boundary = Math.max(
-      start,
-      this.code.lastIndexOf(";", from - 1) + 1,
-      this.code.lastIndexOf("\n", from - 1) + 1,
-      this.code.lastIndexOf("{", from - 1) + 1
-    );
-    return !/[?]|&&|\|\|/.test(this.code.slice(boundary, from));
-  }
-  /** 找出当前函数中最后一次赋值；未知或条件覆盖同样会使旧证明失效。 */
-  assignment(name, at) {
-    const escaped = name.replace(/\$/g, "\\$");
-    const pattern = new RegExp(`(?<![\\w$.])(?:const\\s+|let\\s+|var\\s+)?${escaped}((?:\\s*\\.[\\w$]+|\\s*\\[[^\\]]*\\])*)\\s*(?::[^=;{}\\n]{0,100})?=(?![=>])`, "g");
-    let result = null;
-    for (const m of this.code.slice(0, at).matchAll(pattern)) {
-      if (this.owner(m.index) !== this.owner(at)) continue;
-      const from = this.skipSpace(m.index + m[0].length);
-      const end = this.endOf(from);
-      if (end <= at) result = { at: m.index, from, end, expression: this.code.slice(from, end).trim(), member: m[1].length > 0 };
-    }
-    return result;
-  }
-};
-
 // src/rules/session.ts
 var GET_SESSION = /\.auth\s*\.\s*getSession\s*\(/g;
 function verifiedSession(file, context, sessionAt, names) {
@@ -8321,7 +8414,7 @@ var READS_BODY = /(?<![\w$])(?:req|request)\s*(?:\.\s*raw\s*)?\.\s*(?:json|text|
 var SIGNATURE_HEADER = /['"]stripe-signature['"]/i;
 function middlewareVerifies(code) {
   const masked = maskUnusedFunctions(code);
-  const verifies = /\bconstructEvent\s*\(/.test(masked) || awaitedCall(masked, /\bconstructEventAsync\s*\(/);
+  const verifies = enforcedVerification(masked, /\bconstructEvent(?:Async)?\s*\(/, /^constructEvent\s*\(/);
   if (!verifies) return false;
   for (const m of masked.matchAll(/\bcatch\s*(?:\([^()]*\))?\s*\{/g)) {
     const open = m.index + m[0].length - 1;
@@ -8347,6 +8440,8 @@ function verifiedByMiddleware(route, files) {
     const masked = maskUnusedFunctions(code);
     const calls = [...masked.matchAll(/(?<![\w$.])([A-Za-z_$][\w$]*)\s*(?:\.\s*([A-Za-z_$][\w$]*)\s*)?\(/g)].slice(0, 16);
     return calls.some((m) => {
+      const call = new RegExp(`(?<![\\w$.])${m[1].replace(/\$/g, "\\$")}${m[2] ? `\\s*\\.\\s*${m[2].replace(/\$/g, "\\$")}` : ""}\\s*\\(`);
+      if (!enforcedVerification(masked, call)) return false;
       const definition = calleeDefinition(file, m[1], m[2] ?? null, files);
       return definition !== null && middlewareVerifies(commentsMaskedOf(definition.file).slice(definition.start, definition.end + 1));
     });
@@ -10250,7 +10345,7 @@ function openReport(path, onError, options = {}) {
 }
 
 // src/cli.ts
-var VERSION = true ? "0.7.0" : "0.0.0-dev";
+var VERSION = true ? "0.7.1" : "0.0.0-dev";
 function finish(code) {
   process.exitCode = code;
 }