forgedock 1.26.0 → 1.28.0

package/scripts/structure-delta.sh

@@ -0,0 +1,155 @@
+#!/usr/bin/env bash
+# SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+# SPDX-License-Identifier: AGPL-3.0-or-later
+#
+# structure-delta.sh — deterministic cross-package structure facts for one change (forge#4159). No LLM, no network:
+# git + jq only. Run from the repo root.
+#
+# Usage: structure-delta.sh <base>...<head> | <base> <head>      (the old side is git merge-base base head)
+# Output (stdout, one JSON object):
+#   {} when the repo declares no workspace packages (root package.json `workspaces` / pnpm-workspace.yaml), else
+#   {"package_edges_added":[{from,to,kind,manifest}], "package_edges_removed":[...],
+#    "import_pairs":[{from,to,files_added,files_removed,files[]}],
+#    "boundary_config_changed":{changed,files[],loosens,tightens}}
+# A package edge is a dependencies/devDependencies/peerDependencies key naming another workspace package. An import
+# pair counts changed non-test source files whose added (removed) lines quote an exact workspace name, optionally with
+# a subpath ('@s/x' or '@s/x/sub'); `import type` / `export type` lines are ignored. Counts only report. `files` names the
+# files that added the import (sorted, at most 20; forge#4165 telemetry and trajectory).
+# Exit: 0 ok | 2 usage or bad ref. bash 3.2 portable.
+set -uo pipefail
+
+die() { echo "structure-delta: $*" >&2; exit 2; }
+command -v jq >/dev/null 2>&1 || die "jq is required"
+case "${1:-}" in
+  *...*) BASE="${1%%...*}"; HEAD="${1#*...}" ;;
+  "") die "usage: structure-delta.sh <base>...<head>" ;;
+  *) BASE="$1"; HEAD="${2:-}" ;;
+esac
+[ -n "$BASE" ] && [ -n "$HEAD" ] || die "usage: structure-delta.sh <base>...<head>"
+git rev-parse --verify -q "$BASE^{commit}" >/dev/null || die "bad base ref: $BASE"
+git rev-parse --verify -q "$HEAD^{commit}" >/dev/null || die "bad head ref: $HEAD"
+OLD=$(git merge-base "$BASE" "$HEAD") || die "no merge base for $BASE and $HEAD"
+NEW=$(git rev-parse "$HEAD^{commit}")
+
+T=$(mktemp -d "${TMPDIR:-/tmp}/structure-delta.XXXXXX") || die "mktemp failed"
+trap 'rm -rf "$T"' EXIT
+
+# ---- workspace globs, from the repo only ----
+for ref in "$OLD" "$NEW"; do
+  git show "$ref:package.json" 2>/dev/null | jq -r '(.workspaces // empty) | if type == "array" then .[] elif type == "object" then (.packages // [])[] else empty end | strings' 2>/dev/null
+  git show "$ref:pnpm-workspace.yaml" 2>/dev/null | awk '
+    /^packages:/ { on = 1; next }
+    on && /^[^ \t#-]/ { on = 0 }
+    on && /^[ \t]*-[ \t]*/ { sub(/^[ \t]*-[ \t]*/, ""); sub(/[ \t]+#.*$/, ""); gsub(/["\047]/, ""); sub(/[ \t]+$/, ""); if ($0 != "") print }'
+done | sed 's#^\./##; s#/$##' | sort -u > "$T/globs"
+[ -s "$T/globs" ] || { echo '{}'; exit 0; }
+
+# glob -> anchored ERE (`**` any depth, `*` one segment); `!glob` excludes
+to_re() { printf '%s' "$1" | sed 's/[.+^$()|{}[]/\\&/g; s/\*\*/%%/g; s/\*/[^\/]*/g; s/%%/.*/g; s/?/[^\/]/g'; }
+: > "$T/inc"; : > "$T/exc"
+while IFS= read -r g; do
+  case "$g" in \!*) echo "^$(to_re "${g#!}")\$" >> "$T/exc" ;; *) echo "^$(to_re "$g")\$" >> "$T/inc" ;; esac
+done < "$T/globs"
+
+# ---- workspace manifests at each ref: lines "ref<TAB>dir<TAB>manifest" ----
+: > "$T/manifests"
+for side in old new; do
+  ref=$OLD; [ "$side" = new ] && ref=$NEW
+  git ls-tree -r --name-only "$ref" | grep -E '/package\.json$' | grep -v '(^|/)node_modules/' | while IFS= read -r m; do
+    d=${m%/package.json}
+    printf '%s\n' "$d" | grep -qE -f "$T/inc" || continue
+    if [ -s "$T/exc" ] && printf '%s\n' "$d" | grep -qE -f "$T/exc"; then continue; fi
+    printf '%s\t%s\t%s\n' "$side" "$d" "$m"
+  done >> "$T/manifests"
+done
+
+# ---- names and deps: lines "side<TAB>dir<TAB>manifest<TAB>name" and "side<TAB>manifest<TAB>kind<TAB>dep" ----
+: > "$T/names"; : > "$T/deps"
+while IFS="$(printf '\t')" read -r side d m; do
+  ref=$OLD; [ "$side" = new ] && ref=$NEW
+  git show "$ref:$m" 2>/dev/null > "$T/pj" || continue
+  n=$(jq -r '.name // empty | strings' "$T/pj" 2>/dev/null) || continue
+  [ -n "$n" ] || continue
+  printf '%s\t%s\t%s\t%s\n' "$side" "$d" "$m" "$n" >> "$T/names"
+  jq -r --arg s "$side" --arg m "$m" '["dependencies","devDependencies","peerDependencies"][] as $k | (.[$k] // {}) | objects | keys[] | [$s, $m, $k, .] | @tsv' "$T/pj" 2>/dev/null >> "$T/deps"
+done < "$T/manifests"
+[ -s "$T/names" ] || { echo '{}'; exit 0; }
+cut -f4 "$T/names" | sort -u > "$T/wsnames"
+
+# ---- package edges: "manifest<TAB>from<TAB>to<TAB>kind" per side, then set difference ----
+for side in old new; do
+  awk -F'\t' -v s="$side" '
+    FILENAME == ARGV[1] { ws[$1] = 1; next }
+    FILENAME == ARGV[2] { if ($1 == s) name[$3] = $4; next }
+    $1 == s && ($4 in ws) && ($2 in name) && name[$2] != $4 { print $2 "\t" name[$2] "\t" $4 "\t" $3 }
+  ' "$T/wsnames" "$T/names" "$T/deps" | sort -u > "$T/edges.$side"
+done
+edges_json() { jq -R -s -c 'split("\n") | map(select(length > 0) | split("\t") | {from: .[1], to: .[2], kind: .[3], manifest: .[0]})'; }
+ADDED=$(comm -13 "$T/edges.old" "$T/edges.new" | edges_json)
+REMOVED=$(comm -23 "$T/edges.old" "$T/edges.new" | edges_json)
+
+# ---- import pairs: one -U0 diff pass over source files ----
+# workspace dirs (both sides, longest first) for "which package owns this file"
+cut -f2,4 "$T/names" | sort -u | awk -F'\t' '{ print length($1) "\t" $0 }' | sort -t"$(printf '\t')" -k1,1nr | cut -f2- > "$T/dirs"
+git diff -U0 --no-color --no-renames --no-ext-diff "$OLD" "$NEW" -- \
+  '*.js' '*.jsx' '*.ts' '*.tsx' '*.mjs' '*.cjs' '*.mts' '*.cts' '*.vue' '*.svelte' '*.astro' 2>/dev/null > "$T/diff"
+IMPORTS=$(awk -F'\t' '
+  FILENAME == ARGV[1] { nd++; dir[nd] = $1; own[nd] = $2; next }
+  FILENAME == ARGV[2] { nw++; ws[nw] = $1; next }
+  function owner(f,   i) { for (i = 1; i <= nd; i++) if (index(f, dir[i] "/") == 1) return own[i]; return "" }
+  function istest(f) { return f ~ /(^|\/)(test|tests|__tests__|spec|specs)\// || f ~ /\.(test|spec)\.[A-Za-z0-9]+$/ }
+  # true when line quotes exactly name n: a quote, n, then a closing quote of the same kind or a "/" subpath
+  function quotes(line, n,   q, qi, rest, p, nx) {
+    for (qi = 1; qi <= 2; qi++) {
+      q = (qi == 1) ? "\"" : "\047"; rest = line
+      while ((p = index(rest, q n)) > 0) {
+        nx = substr(rest, p + 1 + length(n), 1)
+        if (nx == q || nx == "/") return 1
+        rest = substr(rest, p + 1)
+      }
+    }
+    return 0
+  }
+  /^diff --git / { f = $0; sub(/^diff --git a\/.* b\//, "", f); from = owner(f); skip = (from == "" || istest(f)); hdr = 1; next }
+  /^@@/ { hdr = 0; next }
+  hdr { next }
+  /^[+-]/ {
+    if (skip) next
+    s = substr($0, 1, 1); l = substr($0, 2)
+    if (l ~ /^[ \t]*(import|export)[ \t]+type([ \t{]|$)/) next
+    for (i = 1; i <= nw; i++) if (ws[i] != from && quotes(l, ws[i])) hit[f SUBSEP ws[i] SUBSEP s] = 1
+    fromof[f] = from
+  }
+  END {
+    for (k in hit) {
+      split(k, a, SUBSEP); f = a[1]; to = a[2]; s = a[3]
+      if (s == "+" && !((f SUBSEP to SUBSEP "-") in hit)) { add[fromof[f] SUBSEP to]++; files[fromof[f] SUBSEP to, add[fromof[f] SUBSEP to]] = f }
+      if (s == "-" && !((f SUBSEP to SUBSEP "+") in hit)) rem[fromof[f] SUBSEP to]++
+    }
+    for (k in add) pair[k] = 1
+    for (k in rem) pair[k] = 1
+    for (k in pair) {
+      split(k, a, SUBSEP); fl = ""
+      for (i = 1; i <= add[k] + 0; i++) fl = fl (i > 1 ? "\037" : "") files[k, i]
+      print a[1] "\t" a[2] "\t" (add[k] + 0) "\t" (rem[k] + 0) "\t" fl
+    }
+  }
+' "$T/dirs" "$T/wsnames" "$T/diff" | sort | jq -R -s -c 'split("\n") | map(select(length > 0) | split("\t") | {from: .[0], to: .[1], files_added: (.[2] | tonumber), files_removed: (.[3] | tonumber), files: ((.[4] // "") | split("\u001f") | map(select(length > 0)) | sort | .[:20])})')
+
+# ---- boundary config (eslint-plugin-boundaries, dependency-cruiser, Nx depConstraints) ----
+: > "$T/bfiles"; LOOSE=false; TIGHT=false
+git diff --name-only --no-renames "$OLD" "$NEW" | while IFS= read -r f; do
+  case "${f##*/}" in .eslintrc|.eslintrc.*|eslint.config.*|.dependency-cruiser.*|nx.json|project.json) printf '%s\n' "$f" ;; esac
+done > "$T/bcand"
+while IFS= read -r f; do
+  git diff -U0 --no-color --no-renames "$OLD" "$NEW" -- "$f" | grep -E '^[+-][^+-]' > "$T/bd" || true
+  grep -qE 'boundaries|allow|disallow|forbidden|depConstraints|DependOnLibsWithTags' "$T/bd" || continue
+  printf '%s\n' "$f" >> "$T/bfiles"
+  if grep -E '^\+' "$T/bd" | grep -iv 'disallow' | grep -qE 'allow|onlyDependOnLibsWithTags.*\*'; then LOOSE=true; fi
+  if grep -E '^-' "$T/bd" | grep -iv 'disallow' | grep -qE 'allow'; then TIGHT=true; fi
+  if grep -E '^\+' "$T/bd" | grep -qE 'disallow|forbidden|notDependOnLibsWithTags'; then TIGHT=true; fi
+done < "$T/bcand"
+BFILES=$(jq -R -s -c 'split("\n") | map(select(length > 0))' < "$T/bfiles")
+
+jq -n -c --argjson a "$ADDED" --argjson r "$REMOVED" --argjson i "$IMPORTS" --argjson b "$BFILES" --argjson lo "$LOOSE" --argjson ti "$TIGHT" \
+  '{package_edges_added: $a, package_edges_removed: $r, import_pairs: $i, boundary_config_changed: {changed: ($b | length > 0), files: $b, loosens: $lo, tightens: $ti}}'

package/scripts/structure-delta.test.sh

@@ -0,0 +1,136 @@
+#!/usr/bin/env bash
+# structure-delta.test.sh — cases for scripts/structure-delta.sh (forge#4159).
+# SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+# SPDX-License-Identifier: AGPL-3.0-or-later
+set -uo pipefail
+S="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/structure-delta.sh"
+PASS=0; FAILN=0
+TMP="$(mktemp -d "${TMPDIR:-/tmp}/structure-delta-test.XXXXXX")"; trap 'rm -rf "$TMP"' EXIT
+ok() { PASS=$((PASS+1)); }
+bad() { FAILN=$((FAILN+1)); echo "FAIL: $1"; }
+eq() { if [ "$2" = "$3" ]; then ok; else bad "$1 (got: $2 want: $3)"; fi }
+q() { printf '%s' "$OUT" | jq -c "$1"; }
+
+new_repo() {
+  rm -rf "$TMP/w"; mkdir -p "$TMP/w"; cd "$TMP/w" || exit 1
+  git init -q; git config user.email t@example.com; git config user.name t; git config commit.gpgsign false
+}
+commit() { git add -A; git commit -qm "$1"; }
+pj() { mkdir -p "$1"; printf '%s\n' "$2" > "$1/package.json"; }
+
+# ---- 1. single-package repo: {} and exit 0 ----
+new_repo
+printf '{"name":"solo","dependencies":{"left-pad":"1"}}\n' > package.json
+mkdir -p src; echo "import x from 'left-pad';" > src/a.ts; commit base
+git checkout -q -b feat; echo "import y from 'solo/x';" >> src/a.ts; commit change
+OUT="$(bash "$S" master...feat 2>/dev/null || bash "$S" main...feat)"; rc=$?
+eq "single-package rc" "$rc" 0
+eq "single-package empty JSON" "$OUT" "{}"
+# workspaces declared but no package matches: still {}
+printf '{"name":"solo","workspaces":["packages/*"]}\n' > package.json; commit ws
+OUT="$(bash "$S" HEAD~1 HEAD)"; eq "workspaces with no packages" "$OUT" "{}"
+
+# ---- 2. monorepo fixture ----
+new_repo
+printf '{"name":"root","private":true,"workspaces":["apps/*","packages/*"],"dependencies":{"@scope/db":"1"}}\n' > package.json
+pj apps/web '{"name":"@scope/web","dependencies":{"@scope/db":"workspace:*","@scope/old":"workspace:*","react":"18"}}'
+pj packages/db '{"name":"@scope/db","dependencies":{"pg":"8"}}'
+pj packages/x '{"name":"@scope/x"}'
+pj packages/old '{"name":"@scope/old"}'
+pj packages/core '{"name":"@scope/core"}'
+mkdir -p apps/web/src apps/web/test
+echo "export const a = 1;" > apps/web/src/existing.ts
+echo "import { db } from '@scope/old';" > apps/web/src/legacy.ts
+commit base
+BASE_SHA=$(git rev-parse HEAD)
+git checkout -q -b feat
+# edges: added (db -> core), dev-only (x -> db), removed (web -> old), non-workspace ignored (db -> zod), root ignored
+pj packages/db '{"name":"@scope/db","dependencies":{"pg":"8","zod":"3","@scope/core":"workspace:*"}}'
+pj packages/x '{"name":"@scope/x","devDependencies":{"@scope/db":"workspace:*"}}'
+pj apps/web '{"name":"@scope/web","dependencies":{"@scope/db":"workspace:*","react":"18"}}'
+# imports
+cat > apps/web/src/value.ts <<'EOF'
+import { db } from "@scope/db";
+import type { Row } from '@scope/core';
+EOF
+echo 'const m = await import("@scope/x");' > apps/web/src/dyn.ts
+echo "import { sub } from '@scope/x/sub';" > apps/web/src/sub.ts
+echo "import { o } from '@scope-other/x';" > apps/web/src/other.ts
+echo "export type { T } from '@scope/db';" > apps/web/src/typeonly.ts
+echo "import { db } from '@scope/db';" > apps/web/test/db.ts
+echo "import { db } from '@scope/db';" > apps/web/src/db.test.ts
+echo "// mentions @scope/db without quotes" > apps/web/src/comment.ts
+echo "import { db } from '@scope/db-extra';" > apps/web/src/prefix.ts
+rm apps/web/src/legacy.ts
+commit change
+OUT="$(bash "$S" "$BASE_SHA...feat")"; rc=$?
+eq "monorepo rc" "$rc" 0
+eq "edges added" "$(q '.package_edges_added | sort_by(.from)')" '[{"from":"@scope/db","to":"@scope/core","kind":"dependencies","manifest":"packages/db/package.json"},{"from":"@scope/x","to":"@scope/db","kind":"devDependencies","manifest":"packages/x/package.json"}]'
+eq "edges removed" "$(q '.package_edges_removed')" '[{"from":"@scope/web","to":"@scope/old","kind":"dependencies","manifest":"apps/web/package.json"}]'
+eq "non-workspace dep ignored" "$(q '[.package_edges_added[] | select(.to == "zod" or .to == "pg")] | length')" 0
+eq "import pairs" "$(q '.import_pairs | sort_by(.to)')" '[{"from":"@scope/web","to":"@scope/db","files_added":1,"files_removed":0,"files":["apps/web/src/value.ts"]},{"from":"@scope/web","to":"@scope/old","files_added":0,"files_removed":1,"files":[]},{"from":"@scope/web","to":"@scope/x","files_added":2,"files_removed":0,"files":["apps/web/src/dyn.ts","apps/web/src/sub.ts"]}]'
+eq "import type never counted" "$(q '[.import_pairs[] | select(.to == "@scope/core")] | length')" 0
+eq "no boundary change" "$(q '.boundary_config_changed')" '{"changed":false,"files":[],"loosens":false,"tightens":false}'
+# the two-arg form agrees
+eq "two-arg form" "$(bash "$S" "$BASE_SHA" feat | jq -c '.package_edges_added | length')" 2
+
+# moving an import within a file (- and + of the same target) is not growth
+git checkout -q -b move feat
+printf '// header\nimport { db } from "@scope/db";\nimport type { Row } from "@scope/core";\n' > apps/web/src/value.ts; commit move
+OUT="$(bash "$S" feat...move)"; eq "moved import not counted" "$(q '.import_pairs')" '[]'
+
+# ---- 3. boundary config: loosen, tighten ----
+git checkout -q -b eslint-base feat
+cat > eslint.config.mjs <<'EOF'
+export default [{ rules: { "boundaries/element-types": [2, { default: "disallow", rules: [
+  { from: ["app"], allow: ["core"] },
+] }] } }];
+EOF
+commit eslint
+git checkout -q -b loosen
+awk '{ print } /allow: \["core"\]/ { print "  { from: [\"app\"], allow: [\"package\"] }," }' eslint.config.mjs > "$TMP/e" && cat "$TMP/e" > eslint.config.mjs; commit loosen
+OUT="$(bash "$S" eslint-base...loosen)"
+eq "loosen" "$(q '.boundary_config_changed')" '{"changed":true,"files":["eslint.config.mjs"],"loosens":true,"tightens":false}'
+git checkout -q -b tighten eslint-base
+grep -v 'allow: \["core"\]' eslint.config.mjs > "$TMP/e" && cat "$TMP/e" > eslint.config.mjs; commit tighten
+OUT="$(bash "$S" eslint-base...tighten)"
+eq "tighten" "$(q '.boundary_config_changed')" '{"changed":true,"files":["eslint.config.mjs"],"loosens":false,"tightens":true}'
+
+# ---- 4. pnpm-workspace.yaml globs with a negation ----
+new_repo
+printf '{"name":"root","private":true}\n' > package.json
+printf "packages:\n  - 'packages/**'\n  - \"!packages/ignored\"\n" > pnpm-workspace.yaml
+pj packages/a '{"name":"a"}'
+pj packages/nested/b '{"name":"b"}'
+pj packages/ignored '{"name":"ignored"}'
+commit base
+git checkout -q -b feat
+pj packages/a '{"name":"a","dependencies":{"b":"workspace:*","ignored":"workspace:*"}}'
+commit edge
+OUT="$(bash "$S" HEAD~1...HEAD)"
+eq "pnpm globs, ** depth, negation" "$(q '[.package_edges_added[] | .to]')" '["b"]'
+
+# ---- 5. bad ref and usage exit 2 ----
+bash "$S" nope...HEAD >/dev/null 2>&1; eq "bad ref exit" "$?" 2
+bash "$S" >/dev/null 2>&1; eq "usage exit" "$?" 2
+
+# ---- 6. 300-file diff in under 2 s, no network tools invoked ----
+new_repo
+printf '{"name":"root","workspaces":["packages/*"]}\n' > package.json
+for p in a b c d e f; do pj "packages/$p" "{\"name\":\"@s/$p\"}"; done
+commit base
+git checkout -q -b big
+i=0; while [ $i -lt 300 ]; do printf "import { v } from '@s/b';\nexport const n$i = v;\n" > "packages/a/f$i.ts"; i=$((i+1)); done
+commit big
+mkdir -p "$TMP/bin"
+for t in gh curl wget npm npx pnpm yarn nc ssh; do printf '#!/bin/sh\necho "%s" >> "%s/net.log"\nexit 1\n' "$t" "$TMP" > "$TMP/bin/$t"; chmod +x "$TMP/bin/$t"; done
+start=$(date +%s%N 2>/dev/null)
+OUT="$(PATH="$TMP/bin:$PATH" bash "$S" master...big 2>/dev/null || PATH="$TMP/bin:$PATH" bash "$S" main...big)"
+end=$(date +%s%N 2>/dev/null)
+eq "300-file count" "$(q '.import_pairs | map(del(.files))')" '[{"from":"@s/a","to":"@s/b","files_added":300,"files_removed":0}]'
+eq "files capped at 20, sorted (forge#4165)" "$(q '.import_pairs[0].files | [length, .[0]]')" '[20,"packages/a/f0.ts"]'
+case "$start$end" in *N*|"") ok ;; *) ms=$(( (end - start) / 1000000 )); if [ "$ms" -lt 2000 ]; then ok; else bad "300-file diff took ${ms} ms (limit 2000)"; fi ;; esac
+if [ -e "$TMP/net.log" ]; then bad "network tool invoked: $(tr '\n' ' ' < "$TMP/net.log")"; else ok; fi
+
+echo "structure-delta.test.sh: $PASS passed, $FAILN failed"
+[ "$FAILN" -eq 0 ]

package/scripts/symbol-index.mjs

@@ -0,0 +1,253 @@
+#!/usr/bin/env node
+// SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+// SPDX-License-Identifier: AGPL-3.0-or-later
+//
+// symbol-index.mjs: JS/TS twin of scripts/symbol-index.py (forge#4208), same output schema.
+// No new dependencies: the `typescript` package is loaded from the target repo (resolved from the target path, then
+// cwd; NODE_PATH is honoured), else the TypeScript bundled with ts-morph (forge#4212). When neither is installed the
+// run prints only {"unsupported":"ts"|"js","reason":"no-parser"} and exits 0.
+// .py targets are handed to symbol-index.py. Never emits source text or literal values.
+//
+// Usage: node scripts/symbol-index.mjs <file | dir>...
+// Output: {"symbols":[{name,kind,start,end,lines,public[,file]}], "edges":[{from,to}],
+//          "imports":[{module,names,line[,file]}], "cycles":[[module,...],...]}
+//   kind: function|async_function|class|method|const|interface|type|enum. public = exported (methods: exported class
+//   and not private/#private). One file: bare names; otherwise `file` on entries and "<module>:<symbol>" edge ends,
+//   module = path relative to its root without extension (index files name their directory). cycles = strongly
+//   connected components of the relative-import graph between indexed modules (`import type` ignored).
+// Exit: 0 ok or unsupported | 2 usage or missing path.
+
+import { spawnSync } from "node:child_process";
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { createRequire } from "node:module";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const TS_EXT = [".ts", ".tsx", ".mts", ".cts"];
+const JS_EXT = [".js", ".jsx", ".mjs", ".cjs"];
+const SKIP_DIRS = new Set(["node_modules", "dist", "build", "coverage"]);
+const OTHER = { ".go": "go", ".rs": "rust", ".rb": "ruby", ".java": "java", ".sh": "shell", ".php": "php" };
+
+const emit = (o) => process.stdout.write(JSON.stringify(sortKeys(o)) + "\n");
+function sortKeys(v) {
+  if (Array.isArray(v)) return v.map(sortKeys);
+  if (v && typeof v === "object") return Object.fromEntries(Object.keys(v).sort().map((k) => [k, sortKeys(v[k])]));
+  return v;
+}
+const langOf = (ext) => (TS_EXT.includes(ext) ? "ts" : JS_EXT.includes(ext) ? "js" : ext === ".py" ? "python" : OTHER[ext] || ext.slice(1) || "unknown");
+const cmp = (a, b) => (a < b ? -1 : a > b ? 1 : 0);
+
+function loadTs(targets) {
+  const bases = [...targets.map((t) => path.resolve(statSync(t).isDirectory() ? t : path.dirname(t))), process.cwd()];
+  for (const b of bases) {
+    // typescript >= 7 (native port) ships no in-process compiler API at the package root: skip it.
+    try { const ts = createRequire(path.join(b, "noop.js"))("typescript"); if (typeof ts?.createSourceFile === "function") return ts; } catch { /* try next */ }
+  }
+  // forge#4212: a repo with only ts-morph (the refactor:split TS mover) has TypeScript bundled in @ts-morph/common.
+  for (const b of bases) {
+    try { const ts = createRequire(path.join(b, "noop.js"))("ts-morph").ts; if (typeof ts?.createSourceFile === "function") return ts; } catch { /* try next */ }
+  }
+  return null;
+}
+
+function collect(roots) {
+  const found = [];
+  for (const root of roots) {
+    if (statSync(root).isFile()) {
+      const ext = path.extname(root).toLowerCase();
+      found.push({ file: root, module: path.basename(root, path.extname(root)), ext });
+      continue;
+    }
+    const walk = (dir) => {
+      for (const ent of readdirSync(dir, { withFileTypes: true }).sort((a, b) => cmp(a.name, b.name))) {
+        const p = path.join(dir, ent.name);
+        if (ent.isDirectory()) { if (!ent.name.startsWith(".") && !SKIP_DIRS.has(ent.name)) walk(p); continue; }
+        const ext = path.extname(ent.name).toLowerCase();
+        if (![...TS_EXT, ...JS_EXT].includes(ext) || /\.d\.[cm]?ts$/.test(ent.name)) continue;
+        let mod = path.relative(root, p).slice(0, -ext.length).split(path.sep).join("/");
+        if (mod === "index" || mod.endsWith("/index")) mod = mod.slice(0, -"index".length).replace(/\/$/, "") || ".";
+        found.push({ file: p, module: mod, ext });
+      }
+    };
+    walk(root);
+  }
+  return found.sort((a, b) => cmp(a.file, b.file));
+}
+
+function tarjan(graph) {
+  let i = 0;
+  const index = new Map(), low = new Map(), on = new Set(), stack = [], comps = [];
+  const visit = (v) => {
+    index.set(v, i); low.set(v, i); i++; stack.push(v); on.add(v);
+    for (const w of [...(graph.get(v) || [])].sort()) {
+      if (!index.has(w)) { visit(w); low.set(v, Math.min(low.get(v), low.get(w))); }
+      else if (on.has(w)) low.set(v, Math.min(low.get(v), index.get(w)));
+    }
+    if (low.get(v) === index.get(v)) {
+      const comp = [];
+      let w;
+      do { w = stack.pop(); on.delete(w); comp.push(w); } while (w !== v);
+      comps.push(comp.sort());
+    }
+  };
+  for (const v of [...graph.keys()].sort()) if (!index.has(v)) visit(v);
+  return comps;
+}
+
+function index(ts, entries, multi) {
+  const K = ts.SyntaxKind;
+  const byFile = new Map(entries.map((e) => [path.resolve(e.file), e]));
+  const symbols = [], imports = [], edges = new Set(), graph = new Map(entries.map((e) => [e.module, new Set()]));
+  const tables = new Map(); // module -> Map(name -> node)
+  const parsed = entries.map((e) => {
+    const src = ts.createSourceFile(e.file, readFileSync(e.file, "utf8"), ts.ScriptTarget.Latest, true,
+      e.ext.endsWith("x") ? ts.ScriptKind.TSX : undefined);
+    if (src.parseDiagnostics?.length) throw { lang: langOf(e.ext), reason: `parse-error: ${e.file}` };
+    return { e, src };
+  });
+  const line = (src, pos) => src.getLineAndCharacterOfPosition(pos).line + 1;
+  const exported = (n) => (ts.getCombinedModifierFlags?.(n) ?? 0) & ts.ModifierFlags.Export;
+  const ref = (e, name) => (multi ? `${e.module}:${name}` : name);
+
+  for (const { e, src } of parsed) {
+    const table = new Map();
+    tables.set(e.module, table);
+    const add = (name, kind, node, pub, owner = null) => {
+      const start = line(src, node.getStart(src)), end = line(src, node.getEnd());
+      symbols.push({ name, kind, start, end, lines: end - start + 1, public: !!pub, ...(multi ? { file: e.file } : {}) });
+      table.set(name, { node, owner });
+    };
+    const exportNames = new Set();
+    for (const st of src.statements) {
+      if (ts.isExportDeclaration(st) && !st.moduleSpecifier && st.exportClause && ts.isNamedExports(st.exportClause)) {
+        for (const el of st.exportClause.elements) exportNames.add((el.propertyName || el.name).text);
+      } else if (ts.isExportAssignment(st) && ts.isIdentifier(st.expression)) exportNames.add(st.expression.text);
+    }
+    const pub = (n, name) => exported(n) || exportNames.has(name);
+    for (const st of src.statements) {
+      if (ts.isFunctionDeclaration(st) && st.name) {
+        const isAsync = (st.modifiers || []).some((m) => m.kind === K.AsyncKeyword);
+        add(st.name.text, isAsync ? "async_function" : "function", st, pub(st, st.name.text));
+      } else if (ts.isClassDeclaration(st) && st.name) {
+        const cname = st.name.text, cpub = pub(st, cname);
+        add(cname, "class", st, cpub);
+        for (const m of st.members) {
+          if (!(ts.isMethodDeclaration(m) || ts.isGetAccessor(m) || ts.isSetAccessor(m) || ts.isConstructorDeclaration(m))) continue;
+          const mname = ts.isConstructorDeclaration(m) ? "constructor" : m.name && (m.name.text ?? m.name.getText(src));
+          if (!mname || table.has(`${cname}.${mname}`)) continue;
+          const priv = (m.modifiers || []).some((x) => x.kind === K.PrivateKeyword) || String(mname).startsWith("#");
+          add(`${cname}.${mname}`, "method", m, cpub && !priv, cname);
+        }
+      } else if (ts.isVariableStatement(st)) {
+        for (const d of st.declarationList.declarations) {
+          if (ts.isIdentifier(d.name)) add(d.name.text, "const", d, exported(st) || exportNames.has(d.name.text));
+        }
+      } else if (ts.isInterfaceDeclaration(st)) add(st.name.text, "interface", st, pub(st, st.name.text));
+      else if (ts.isTypeAliasDeclaration(st)) add(st.name.text, "type", st, pub(st, st.name.text));
+      else if (ts.isEnumDeclaration(st)) add(st.name.text, "enum", st, pub(st, st.name.text));
+    }
+  }
+
+  const resolveSpec = (fromFile, spec) => {
+    if (!spec.startsWith(".")) return null;
+    const base = path.resolve(path.dirname(fromFile), spec);
+    const stem = base.replace(/\.(m|c)?js$/, "");
+    const cands = [base, ...[...TS_EXT, ...JS_EXT].flatMap((x) => [stem + x, path.join(base, "index" + x)])];
+    for (const c of cands) if (byFile.has(c)) return byFile.get(c).module;
+    return null;
+  };
+
+  for (const { e, src } of parsed) {
+    const table = tables.get(e.module), bindings = new Map();
+    for (const st of src.statements) {
+      const isImp = ts.isImportDeclaration(st), isRe = ts.isExportDeclaration(st) && st.moduleSpecifier;
+      if (!isImp && !isRe) continue;
+      const spec = st.moduleSpecifier.text, names = [];
+      const typeOnly = isImp ? !!st.importClause?.isTypeOnly : !!st.isTypeOnly;
+      const target = resolveSpec(e.file, spec);
+      const clause = isImp ? st.importClause : null;
+      if (clause?.name) { names.push("default"); bindings.set(clause.name.text, [target, "default"]); }
+      const nb = isImp ? clause?.namedBindings : st.exportClause;
+      if (nb && ts.isNamespaceImport(nb)) { names.push("*"); bindings.set(nb.name.text, [target, null]); }
+      else if (nb && (ts.isNamedImports(nb) || ts.isNamedExports(nb))) {
+        for (const el of nb.elements) {
+          const orig = (el.propertyName || el.name).text;
+          names.push(orig);
+          if (isImp) bindings.set(el.name.text, [target, orig]);
+        }
+      }
+      imports.push({ module: target ?? spec, names: names.sort(), line: line(src, st.getStart(src)), ...(multi ? { file: e.file } : {}) });
+      if (target !== null && !typeOnly) graph.get(e.module).add(target);
+    }
+    for (const [name, { node, owner }] of table) {
+      const from = ref(e, name);
+      const roots = ts.isClassDeclaration(node)
+        ? [...(node.heritageClauses || []), ...node.members.filter((m) => !(ts.isMethodDeclaration(m) || ts.isGetAccessor(m) || ts.isSetAccessor(m) || ts.isConstructorDeclaration(m)))]
+        : [node];
+      const visit = (n) => {
+        let to = null;
+        if (ts.isPropertyAccessExpression(n) && ts.isIdentifier(n.name)) {
+          const obj = n.expression;
+          if (owner && obj.kind === K.ThisKeyword && table.has(`${owner}.${n.name.text}`)) to = ref(e, `${owner}.${n.name.text}`);
+          else if (ts.isIdentifier(obj) && bindings.has(obj.text) && bindings.get(obj.text)[1] === null) {
+            const [mod] = bindings.get(obj.text);
+            if (mod !== null && tables.get(mod)?.has(n.name.text)) to = `${mod}:${n.name.text}`;
+          }
+        } else if (ts.isIdentifier(n) && !(n.parent && ts.isPropertyAccessExpression(n.parent) && n.parent.name === n)) {
+          if (n !== node.name && table.has(n.text)) to = ref(e, n.text);
+          else if (bindings.has(n.text)) {
+            const [mod, sym] = bindings.get(n.text);
+            if (mod !== null && sym !== null && tables.get(mod)?.has(sym)) to = `${mod}:${sym}`;
+          }
+        }
+        if (to && to !== from) edges.add(JSON.stringify([from, to]));
+        ts.forEachChild(n, visit);
+      };
+      for (const r of roots) visit(r);
+    }
+  }
+
+  const cycles = tarjan(graph).filter((c) => c.length > 1 || graph.get(c[0]).has(c[0])).sort((a, b) => cmp(a.join("\0"), b.join("\0")));
+  symbols.sort((a, b) => cmp(a.file || "", b.file || "") || a.start - b.start || cmp(a.name, b.name));
+  imports.sort((a, b) => cmp(a.file || "", b.file || "") || a.line - b.line || cmp(a.module, b.module));
+  return {
+    symbols,
+    edges: [...edges].sort().map((s) => { const [from, to] = JSON.parse(s); return { from, to }; }),
+    imports,
+    cycles,
+  };
+}
+
+function main(argv) {
+  if (!argv.length || argv[0] === "-h" || argv[0] === "--help") {
+    process.stderr.write("usage: symbol-index.mjs <file | dir>...\n");
+    return 2;
+  }
+  for (const p of argv) if (!existsSync(p)) { process.stderr.write(`symbol-index: no such path: ${p}\n`); return 2; }
+  const files = argv.filter((p) => statSync(p).isFile());
+  const exts = files.map((f) => path.extname(f).toLowerCase());
+  if (exts.includes(".py")) {
+    if (exts.some((x) => x !== ".py")) return emit({ unsupported: "mixed", reason: "mixed-languages" }), 0;
+    const py = path.join(path.dirname(fileURLToPath(import.meta.url)), "symbol-index.py");
+    const r = spawnSync("python3", [py, ...argv], { stdio: "inherit" });
+    if (r.error) return emit({ unsupported: "python", reason: "no-python3" }), 0;
+    return r.status ?? 2;
+  }
+  const bad = exts.find((x) => ![...TS_EXT, ...JS_EXT].includes(x));
+  if (bad !== undefined) return emit({ unsupported: langOf(bad), reason: "unknown-language" }), 0;
+  const entries = collect(argv);
+  if (!entries.length) return emit({ unsupported: "unknown", reason: "no-js-ts-files" }), 0;
+  const lang = entries.some((e) => TS_EXT.includes(e.ext)) ? "ts" : "js";
+  const ts = loadTs(argv);
+  if (!ts) return emit({ unsupported: lang, reason: "no-parser" }), 0;
+  const multi = !(argv.length === 1 && files.length === 1);
+  let out;
+  try { out = index(ts, entries, multi); } catch (err) {
+    if (err && err.reason) return emit({ unsupported: err.lang, reason: err.reason }), 0;
+    throw err;
+  }
+  emit(out);
+  return 0;
+}
+
+process.exitCode = main(process.argv.slice(2));