gitnexus 1.6.6-rc.99 → 1.6.6

package/dist/core/ingestion/vue-sfc-extractor.js

@@ -25,10 +25,22 @@
 // attribute axes; this expression closes both at once.
 const SCRIPT_RE = /<script(\s[^>]*)?>([^]*?)<\/script[^>]*>/gi;
 const TEMPLATE_COMPONENT_RE = /<([A-Z][A-Za-z0-9]+)/g;
+const TEMPLATE_KEBAB_COMPONENT_RE = /<([a-z][a-z0-9]*(?:-[a-z0-9]+)+)\b/g;
 // Greedy: matches from the first <template> to the *last* </template>.
 // This is intentional — nested <template v-slot:...> tags are valid Vue
 // syntax and we want the entire outermost template body.
 const TEMPLATE_RE = /<template(\s[^>]*)?>([^]*)<\/template>/;
+const VUE_BUILTIN_KEBAB_TAGS = new Set([
+    'router-view',
+    'router-link',
+    'transition',
+    'transition-group',
+    'keep-alive',
+    'teleport',
+    'suspense',
+    'component',
+    'slot',
+]);
 function countNewlines(text) {
     let count = 0;
     for (let i = 0; i < text.length; i++) {
@@ -37,6 +49,156 @@ function countNewlines(text) {
     }
     return count;
 }
+function kebabToPascal(name) {
+    return name
+        .split('-')
+        .filter((part) => part.length > 0)
+        .map((part) => part.charAt(0).toUpperCase() + part.slice(1))
+        .join('');
+}
+function isBuiltinKebabTag(tagName) {
+    return VUE_BUILTIN_KEBAB_TAGS.has(tagName);
+}
+/**
+ * Extract bare `emit('event')` / `$emit('event')` calls from script text.
+ *
+ * Uses a lightweight lexer state-machine (code vs comments/strings), so:
+ * - ignores `emit(...)` in comments and string literals
+ * - ignores property calls like `socket.emit(...)` / `this.$emit(...)`
+ * - captures only literal-string event names
+ */
+function collectBareEmitEventNames(input) {
+    let Mode;
+    (function (Mode) {
+        Mode[Mode["Code"] = 0] = "Code";
+        Mode[Mode["SingleQuote"] = 1] = "SingleQuote";
+        Mode[Mode["DoubleQuote"] = 2] = "DoubleQuote";
+        Mode[Mode["Template"] = 3] = "Template";
+        Mode[Mode["LineComment"] = 4] = "LineComment";
+        Mode[Mode["BlockComment"] = 5] = "BlockComment";
+    })(Mode || (Mode = {}));
+    const events = [];
+    const seen = new Set();
+    let mode = Mode.Code;
+    const isIdentChar = (c) => /[A-Za-z0-9_$]/.test(c);
+    const skipSpaces = (idx) => {
+        let i = idx;
+        while (i < input.length && /\s/.test(input[i]))
+            i++;
+        return i;
+    };
+    /**
+     * Return true if the token immediately before the `.` at `dotIdx` is the
+     * keyword `this` and is not itself a property access (e.g. not `foo.this`).
+     * Used to allow `this.$emit(...)` while blocking `socket.emit(...)`.
+     */
+    const lookbackIsThis = (dotIdx) => {
+        let j = dotIdx - 1; // step past the '.'
+        while (j >= 0 && /\s/.test(input[j]))
+            j--;
+        if (j < 3)
+            return false;
+        if (input.slice(j - 3, j + 1) !== 'this')
+            return false;
+        // Ensure 'this' is not itself a property target (e.g. foo.this)
+        const prevOfThis = j >= 4 ? input[j - 4] : '';
+        return !(prevOfThis.length > 0 && (isIdentChar(prevOfThis) || prevOfThis === '.'));
+    };
+    const tryConsumeEmitCall = (idx) => {
+        const hasDollar = input[idx] === '$';
+        const name = hasDollar ? '$emit' : 'emit';
+        if (!input.startsWith(name, idx))
+            return idx;
+        const prev = idx > 0 ? input[idx - 1] : '';
+        if (prev.length > 0 && isIdentChar(prev))
+            return idx;
+        if (prev === '.') {
+            // Allow `this.$emit(...)` / `this.emit(...)` but block `socket.emit(...)`.
+            if (!lookbackIsThis(idx - 1))
+                return idx;
+        }
+        const afterName = idx + name.length;
+        const next = afterName < input.length ? input[afterName] : '';
+        if (next.length > 0 && isIdentChar(next))
+            return idx;
+        let i = skipSpaces(afterName);
+        if (input[i] !== '(')
+            return idx;
+        i = skipSpaces(i + 1);
+        const quote = input[i];
+        if (quote !== "'" && quote !== '"')
+            return idx;
+        let eventName = '';
+        i++;
+        while (i < input.length) {
+            const ch = input[i];
+            if (ch === '\\') {
+                i += 2;
+                continue;
+            }
+            if (ch === quote)
+                break;
+            eventName += ch;
+            i++;
+        }
+        if (i >= input.length)
+            return idx;
+        // Allow simple names ("save"), hyphenated names ("user-loaded"), and
+        // update modifier patterns ("update:modelValue", "update:model-value").
+        if (/^[A-Za-z$_][A-Za-z0-9:_$-]*$/.test(eventName) && !seen.has(eventName)) {
+            seen.add(eventName);
+            events.push(eventName);
+        }
+        return i;
+    };
+    for (let i = 0; i < input.length; i++) {
+        const ch = input[i];
+        const next = i + 1 < input.length ? input[i + 1] : '';
+        if (mode === Mode.Code) {
+            const consumedAt = tryConsumeEmitCall(i);
+            if (consumedAt !== i) {
+                i = consumedAt;
+                continue;
+            }
+            if (ch === "'" || ch === '"' || ch === '`') {
+                mode = ch === "'" ? Mode.SingleQuote : ch === '"' ? Mode.DoubleQuote : Mode.Template;
+                continue;
+            }
+            if (ch === '/' && next === '/') {
+                mode = Mode.LineComment;
+                i++;
+            }
+            else if (ch === '/' && next === '*') {
+                mode = Mode.BlockComment;
+                i++;
+            }
+            continue;
+        }
+        if (mode === Mode.LineComment) {
+            if (ch === '\n') {
+                mode = Mode.Code;
+            }
+            continue;
+        }
+        if (mode === Mode.BlockComment) {
+            if (ch === '*' && next === '/') {
+                i++;
+                mode = Mode.Code;
+            }
+            continue;
+        }
+        if (ch === '\\') {
+            i++;
+            continue;
+        }
+        if ((mode === Mode.SingleQuote && ch === "'") ||
+            (mode === Mode.DoubleQuote && ch === '"') ||
+            (mode === Mode.Template && ch === '`')) {
+            mode = Mode.Code;
+        }
+    }
+    return events;
+}
 function parseScriptBlock(attrs, content, precedingText) {
     const isSetup = attrs != null && /\bsetup\b/.test(attrs);
     const langMatch = attrs?.match(/\blang\s*=\s*["']([^"']+)["']/);
@@ -48,11 +210,9 @@ function parseScriptBlock(attrs, content, precedingText) {
 /**
  * Extract script content from a Vue SFC.
  *
- * When both <script> and <script setup> are present, returns only the
- * <script setup> block (the dominant pattern — 94% of Vue files in real
- * projects use setup). The <script> (non-setup) block typically contains
- * only `defineOptions` or legacy option merges and is less important for
- * the knowledge graph.
+ * When both <script> and <script setup> are present, the content of all
+ * blocks is combined (non-setup first, then setup) so the full script
+ * surface is available to the knowledge graph.
  */
 export function extractVueScript(vueContent) {
     const blocks = [];
@@ -65,13 +225,21 @@ export function extractVueScript(vueContent) {
     }
     if (blocks.length === 0)
         return null;
-    // Prefer <script setup> if present
-    const setupBlock = blocks.find((b) => b.isSetup);
-    const primary = setupBlock ?? blocks[0];
+    // Merge all blocks: non-setup first, then setup, so content order is stable.
+    const nonSetupBlocks = blocks.filter((b) => !b.isSetup);
+    const setupBlocks = blocks.filter((b) => b.isSetup);
+    const ordered = [...nonSetupBlocks, ...setupBlocks];
+    const combinedContent = ordered.map((b) => b.content).join('\n');
+    const lineOffset = ordered[0].lineOffset;
+    // Only use JavaScript grammar when ALL blocks are explicitly lang="js"
+    // or lang="jsx". If any block omits lang or uses ts/tsx, TypeScript wins.
+    const allBlocksJs = blocks.length > 0 && blocks.every((b) => b.lang === 'js' || b.lang === 'jsx');
+    const lang = allBlocksJs ? 'js' : '';
     return {
-        scriptContent: primary.content,
-        lineOffset: primary.lineOffset,
-        isSetup: primary.isSetup,
+        scriptContent: combinedContent,
+        lineOffset,
+        isSetup: blocks.some((b) => b.isSetup),
+        lang,
     };
 }
 /**
@@ -107,5 +275,259 @@ export function extractTemplateComponents(vueContent) {
     while ((componentMatch = TEMPLATE_COMPONENT_RE.exec(templateContent)) !== null) {
         components.add(componentMatch[1]);
     }
+    TEMPLATE_KEBAB_COMPONENT_RE.lastIndex = 0;
+    while ((componentMatch = TEMPLATE_KEBAB_COMPONENT_RE.exec(templateContent)) !== null) {
+        if (isBuiltinKebabTag(componentMatch[1]))
+            continue;
+        components.add(kebabToPascal(componentMatch[1]));
+    }
     return [...components];
 }
+// ── Per-element event binding extraction ──────────────────────────────────
+//
+// Three sibling regexes capture opening tags distinguished by PascalCase
+// (Vue components), kebab-case (Vue components in kebab form), and simple
+// lowercase (native HTML elements). All stop their attribute-block capture
+// at the first `>` with a bounded span of at most 512 characters to avoid
+// pathological backtracking on large template files (ReDoS mitigation).
+// Multi-line tags whose attribute block contains a literal `>` are documented
+// as a known limitation (#1647).
+//
+// NATIVE_TAG_RE uses `(?![A-Za-z0-9-])` to prevent matching the `post` prefix
+// of a kebab-case component tag like `<post-list>` — such tags are handled by
+// KEBAB_COMPONENT_TAG_RE, not NATIVE_TAG_RE.
+const COMPONENT_TAG_RE = /<([A-Z][A-Za-z0-9]+)([^>]{0,512}?)(?:\/>|>)/g;
+const KEBAB_COMPONENT_TAG_RE = /<([a-z][a-z0-9]*(?:-[a-z0-9]+)+)([^>]{0,512}?)(?:\/>|>)/g;
+const NATIVE_TAG_RE = /<([a-z][a-z0-9]*)(?![A-Za-z0-9-])([^>]{0,512}?)(?:\/>|>)/g;
+// Within any tag's attribute block: matches Vue event bindings.
+//   @action="handleAction"
+//   @keyup.enter="submit"
+//   @user-loaded="onLoaded"        — hyphenated event names
+//   @update:model-value="onChange" — update modifier with colon
+//   v-on:click="onClick"
+const TAG_EVENT_RE = /(?:@|v-on:)([\w:.-]+)\s*=\s*["']([A-Za-z_$][A-Za-z0-9_$]*)["']/g;
+// ── Script emit() call extraction ─────────────────────────────────────────
+// Matches simple variable references in Vue bound-attribute values.
+// Captures only bare identifiers — not member-access (":key=\"post.id\""),
+// literals (":id=\"1\""), or expressions (":val=\"a + b\"").
+//
+//   :userId="currentUserId"      → "currentUserId"
+//   :posts="allPosts"            → "allPosts"
+//   v-bind:disabled="isLoading"  → "isLoading"
+//   :key="post.id"               — skipped (member access)
+//   :id="1"                      — skipped (literal)
+const BOUND_ATTR_RE = /(?::[\w-]+|v-bind:[\w-]+)\s*=\s*["']([A-Za-z_$][A-Za-z0-9_$]*)["']/g;
+/**
+ * Extract Vue component event bindings from a `<template>` block.
+ *
+ * Scans PascalCase component elements (e.g. `<PostList>`, `<UserCard>`) and
+ * returns each `@event="handler"` binding found in the element's attribute
+ * block. Native HTML element event handlers (`@click` on `<button>`, etc.)
+ * are intentionally excluded — only component-to-component event bindings
+ * that go through Vue's `emit()` / `defineEmits` system are included.
+ *
+ * **Limitation:** component tags whose attribute block spans multiple lines
+ * and contains a `>` inside an attribute value are not captured (the regex
+ * stops at the first `>`). Full template AST parsing would be required for
+ * those edge cases (tracked in #1647).
+ */
+export function extractComponentEventBindings(vueContent) {
+    const templateMatch = TEMPLATE_RE.exec(vueContent);
+    if (!templateMatch)
+        return [];
+    const templateContent = templateMatch[2];
+    const bindings = [];
+    const seen = new Set();
+    COMPONENT_TAG_RE.lastIndex = 0;
+    let tagMatch;
+    while ((tagMatch = COMPONENT_TAG_RE.exec(templateContent)) !== null) {
+        const componentName = tagMatch[1];
+        const attrs = tagMatch[2];
+        TAG_EVENT_RE.lastIndex = 0;
+        let eventMatch;
+        while ((eventMatch = TAG_EVENT_RE.exec(attrs)) !== null) {
+            const eventName = eventMatch[1];
+            const handlerName = eventMatch[2];
+            const key = `${componentName}::${eventName}::${handlerName}`;
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            bindings.push({ componentName, eventName, handlerName });
+        }
+    }
+    KEBAB_COMPONENT_TAG_RE.lastIndex = 0;
+    while ((tagMatch = KEBAB_COMPONENT_TAG_RE.exec(templateContent)) !== null) {
+        if (isBuiltinKebabTag(tagMatch[1]))
+            continue;
+        const componentName = kebabToPascal(tagMatch[1]);
+        const attrs = tagMatch[2];
+        TAG_EVENT_RE.lastIndex = 0;
+        let eventMatch;
+        while ((eventMatch = TAG_EVENT_RE.exec(attrs)) !== null) {
+            const eventName = eventMatch[1];
+            const handlerName = eventMatch[2];
+            const key = `${componentName}::${eventName}::${handlerName}`;
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            bindings.push({ componentName, eventName, handlerName });
+        }
+    }
+    return bindings;
+}
+/**
+ * Extract event handler names bound to native HTML elements in the template.
+ *
+ * Only processes lowercase-named elements (`<button>`, `<input>`, `<div>`,
+ * etc.) — PascalCase component elements are handled by
+ * `extractComponentEventBindings`. Returns bare handler identifiers only;
+ * inline expressions with arguments or arrow functions are excluded.
+ *
+ * These handlers represent direct DOM-event→function relationships and
+ * are emitted as `CALLS` edges (not `BINDS_EVENT_HANDLER`), because native
+ * events are synchronous browser callbacks, not Vue's component-event system.
+ */
+export function extractNativeElementEventHandlers(vueContent) {
+    const templateMatch = TEMPLATE_RE.exec(vueContent);
+    if (!templateMatch)
+        return [];
+    const templateContent = templateMatch[2];
+    const handlers = [];
+    NATIVE_TAG_RE.lastIndex = 0;
+    let tagMatch;
+    while ((tagMatch = NATIVE_TAG_RE.exec(templateContent)) !== null) {
+        const attrs = tagMatch[2];
+        TAG_EVENT_RE.lastIndex = 0;
+        let eventMatch;
+        while ((eventMatch = TAG_EVENT_RE.exec(attrs)) !== null) {
+            handlers.push(eventMatch[2]);
+        }
+    }
+    return handlers;
+}
+/**
+ * Extract `emit('eventName', ...)` calls from a Vue SFC's `<script>` block.
+ *
+ * Scans the raw SFC source (full `.vue` file), extracts the script content,
+ * then finds bare `emit('...')` calls. Only captures literal string event
+ * names — dynamic expressions (`emit(eventName)`) are excluded.
+ *
+ * Returns deduplicated emit declarations.
+ */
+export function extractScriptEmitCalls(vueContent, options = {}) {
+    const sourceKind = options.sourceKind ?? 'full-sfc';
+    const scriptText = sourceKind === 'pre-extracted-script'
+        ? vueContent
+        : (extractVueScript(vueContent)?.scriptContent ?? null);
+    if (!scriptText)
+        return [];
+    return collectBareEmitEventNames(scriptText).map((eventName) => ({ eventName }));
+}
+/**
+ * Extract variable identifiers from Vue template bound-attribute values.
+ *
+ * Covers `:prop="varName"` and `v-bind:prop="varName"` patterns where
+ * the value is a single plain identifier.  Member-access expressions
+ * (`:key="post.id"`) and literals are excluded by design.
+ *
+ * Returns deduplicated identifier names.
+ */
+export function extractTemplateAttributeBindings(vueContent) {
+    const templateMatch = TEMPLATE_RE.exec(vueContent);
+    if (!templateMatch)
+        return [];
+    const templateContent = templateMatch[2];
+    const vars = new Set();
+    let match;
+    BOUND_ATTR_RE.lastIndex = 0;
+    while ((match = BOUND_ATTR_RE.exec(templateContent)) !== null) {
+        vars.add(match[1]);
+    }
+    return [...vars];
+}
+/**
+ * Extract all template-derived edge data from a Vue SFC in a single pass.
+ *
+ * Parses the `<template>` block once and the `<script>` block once, then
+ * runs all five extractors on the pre-parsed content rather than repeating
+ * the regex on every individual call.  Used by `emitPostResolutionEdges`
+ * to avoid multiple full-file scans per `.vue` file.
+ */
+export function extractVueTemplateEdgeData(vueContent, options = {}) {
+    // Extract template content once.
+    const templateMatch = TEMPLATE_RE.exec(vueContent);
+    const tmpl = templateMatch ? templateMatch[2] : '';
+    // Template components (PascalCase + kebab-case).
+    const componentSet = new Set();
+    if (tmpl) {
+        TEMPLATE_COMPONENT_RE.lastIndex = 0;
+        let m;
+        while ((m = TEMPLATE_COMPONENT_RE.exec(tmpl)) !== null)
+            componentSet.add(m[1]);
+        TEMPLATE_KEBAB_COMPONENT_RE.lastIndex = 0;
+        while ((m = TEMPLATE_KEBAB_COMPONENT_RE.exec(tmpl)) !== null) {
+            if (!isBuiltinKebabTag(m[1]))
+                componentSet.add(kebabToPascal(m[1]));
+        }
+    }
+    // Native element event handlers.
+    const nativeHandlers = [];
+    if (tmpl) {
+        NATIVE_TAG_RE.lastIndex = 0;
+        let tagM;
+        while ((tagM = NATIVE_TAG_RE.exec(tmpl)) !== null) {
+            TAG_EVENT_RE.lastIndex = 0;
+            let evM;
+            while ((evM = TAG_EVENT_RE.exec(tagM[2])) !== null)
+                nativeHandlers.push(evM[2]);
+        }
+    }
+    // Component event bindings.
+    const componentBindings = [];
+    const bindingSeen = new Set();
+    const processComponentAttrs = (componentName, attrs) => {
+        TAG_EVENT_RE.lastIndex = 0;
+        let evM;
+        while ((evM = TAG_EVENT_RE.exec(attrs)) !== null) {
+            const key = `${componentName}::${evM[1]}::${evM[2]}`;
+            if (!bindingSeen.has(key)) {
+                bindingSeen.add(key);
+                componentBindings.push({ componentName, eventName: evM[1], handlerName: evM[2] });
+            }
+        }
+    };
+    if (tmpl) {
+        COMPONENT_TAG_RE.lastIndex = 0;
+        let tagM;
+        while ((tagM = COMPONENT_TAG_RE.exec(tmpl)) !== null)
+            processComponentAttrs(tagM[1], tagM[2]);
+        KEBAB_COMPONENT_TAG_RE.lastIndex = 0;
+        while ((tagM = KEBAB_COMPONENT_TAG_RE.exec(tmpl)) !== null) {
+            if (!isBuiltinKebabTag(tagM[1]))
+                processComponentAttrs(kebabToPascal(tagM[1]), tagM[2]);
+        }
+    }
+    // Script emit() calls.
+    const sourceKind = options.sourceKind ?? 'full-sfc';
+    const scriptText = sourceKind === 'pre-extracted-script'
+        ? vueContent
+        : (extractVueScript(vueContent)?.scriptContent ?? null);
+    const scriptEmitCalls = scriptText
+        ? collectBareEmitEventNames(scriptText).map((eventName) => ({ eventName }))
+        : [];
+    // Bound attribute bindings.
+    const attrVars = new Set();
+    if (tmpl) {
+        BOUND_ATTR_RE.lastIndex = 0;
+        let m;
+        while ((m = BOUND_ATTR_RE.exec(tmpl)) !== null)
+            attrVars.add(m[1]);
+    }
+    return {
+        templateComponents: [...componentSet],
+        nativeEventHandlers: nativeHandlers,
+        componentEventBindings: componentBindings,
+        scriptEmitCalls,
+        templateAttributeBindings: [...attrVars],
+    };
+}

package/dist/core/ingestion/workers/parse-worker.d.ts

@@ -1,9 +1,7 @@
 import { SupportedLanguages } from '../../../_shared/index.js';
-import type { ExtractedHeritage } from '../model/heritage-map.js';
 import type { ExtractedRouterInclude, ExtractedRouterImport, ExtractedRouterModuleAlias } from '../route-extractors/fastapi-router-bindings.js';
 import { type MixedChainStep } from '../utils/call-analysis.js';
 import type { ConstructorBinding } from '../type-env.js';
-import type { NamedBinding } from '../named-bindings/types.js';
 import type { NodeLabel, ParameterTypeClass } from '../../../_shared/index.js';
 import type { ParsedFile } from '../../../_shared/index.js';
 import { type ExtractedRoute } from '../route-extractors/laravel.js';
@@ -53,13 +51,6 @@ interface ParsedSymbol {
     isFinal?: boolean;
     annotations?: string[];
 }
-export interface ExtractedImport {
-    filePath: string;
-    rawImportPath: string;
-    language: SupportedLanguages;
-    /** Named bindings from the import (e.g., import {User as U} → [{local:'U', exported:'User'}]) */
-    namedBindings?: NamedBinding[];
-}
 export interface ExtractedCall {
     filePath: string;
     calledName: string;
@@ -178,10 +169,8 @@ export interface ParseWorkerResult {
     nodes: ParsedNode[];
     relationships: ParsedRelationship[];
     symbols: ParsedSymbol[];
-    imports: ExtractedImport[];
     calls: ExtractedCall[];
     assignments: ExtractedAssignment[];
-    heritage: ExtractedHeritage[];
     routes: ExtractedRoute[];
     fetchCalls: ExtractedFetchCall[];
     fetchWrapperDefs: FetchWrapperDef[];