hex-audit 0.6.3 → 0.8.0

package/dist/analysis/code-model.d.ts

@@ -0,0 +1,113 @@
+/**
+ * A per-file "code model" built in one AST pass: everything the differential
+ * analysis needs to (a) compare two versions of a file entity by entity and
+ * (b) build an intra-scope call / state-coupling graph on the head version.
+ *
+ * Deliberately separate from `parsers/solidity-parser.ts` (which feeds the
+ * per-file stats/access/state analyses): this one keeps character ranges,
+ * normalized bodies, call references and state reads/writes per function.
+ */
+export type ContractKind = 'contract' | 'interface' | 'library' | 'abstract' | 'free';
+export interface CallRef {
+    /**
+     * internal  — `foo(...)`             (resolved in the caller's hierarchy, then free functions)
+     * super     — `super.foo(...)`       (resolved in the caller's bases)
+     * this      — `this.foo(...)`        (resolved in the caller's hierarchy)
+     * qualified — `Lib.foo(...)` / `Base.foo(...)` where the qualifier is a known contract name
+     * typed     — `x.foo(...)` where `x` is declared with a contract/interface type in scope
+     * member    — `x.foo(...)` where the receiver type is unknown (name-only, low confidence)
+     * base_ctor — a base-constructor invocation in a constructor's modifier list
+     */
+    kind: 'internal' | 'super' | 'this' | 'qualified' | 'typed' | 'member' | 'base_ctor';
+    name: string;
+    /** Contract/interface/library name for `qualified` / `typed` / `base_ctor`. */
+    target?: string;
+    argCount: number;
+}
+export interface CodeUnit {
+    contract: string;
+    kind: 'function' | 'modifier';
+    name: string;
+    /** `name(type1,type2)`; constructor/fallback/receive use those names. */
+    signature: string;
+    visibility: string;
+    stateMutability: string | null;
+    isConstructor: boolean;
+    isFallback: boolean;
+    isReceive: boolean;
+    modifiers: string[];
+    paramCount: number;
+    lineStart: number;
+    lineEnd: number;
+    /** Raw source of the whole definition. */
+    raw: string;
+    /** Comment- and whitespace-insensitive form of `raw`, for change detection. */
+    normalized: string;
+    calls: CallRef[];
+    /** State variables (of the declaring hierarchy) read / written in the body. */
+    reads: string[];
+    writes: string[];
+}
+export interface StateVarModel {
+    name: string;
+    type: string;
+    mutability: 'mutable' | 'constant' | 'immutable';
+    visibility: string;
+    /** Normalized initializer source ('' when none). */
+    initial: string;
+    lineStart: number;
+}
+export interface NamedSigModel {
+    name: string;
+    /** `name(type1,type2)` */
+    signature: string;
+    lineStart: number;
+}
+export interface StructModel {
+    name: string;
+    /** `type name` per member, in order. */
+    members: string[];
+    lineStart: number;
+}
+export interface ContractModel {
+    name: string;
+    kind: ContractKind;
+    file: string;
+    bases: string[];
+    lineStart: number;
+    lineEnd: number;
+    units: CodeUnit[];
+    stateVars: StateVarModel[];
+    events: NamedSigModel[];
+    errors: NamedSigModel[];
+    structs: StructModel[];
+}
+export interface FileModel {
+    file: string;
+    contracts: ContractModel[];
+    parseError?: string;
+}
+export declare function typeToString(t: unknown): string;
+/**
+ * Strip comments (outside string literals) and collapse whitespace, so a
+ * re-indented or re-commented body compares equal to the original.
+ */
+export declare function normalizeSource(src: string): string;
+/**
+ * Build the code model of one file. `contractNames` (all contract-like names in
+ * scope) lets the body walker tell type conversions and typed receivers apart.
+ * `inheritedStateVars` maps a contract name to the state vars of its whole
+ * linearized hierarchy (name → type); pass an empty map for a first pass.
+ */
+export declare function buildFileModel(source: string, file: string, contractNames?: Set<string>, inheritedStateVars?: Map<string, Map<string, string>>): FileModel;
+/** Contract-like names declared in a source (cheap first pass for buildFileModel). */
+export declare function collectContractNames(source: string): string[];
+/** Linearized base list (C3-ish, most-base last), restricted to known contracts. */
+export declare function ancestorsOf(name: string, byName: Map<string, ContractModel>): string[];
+/**
+ * Build models for a whole set of sources with inherited state vars resolved:
+ * pass 1 collects contract names and own state vars, pass 2 rebuilds each file
+ * with every contract's full visible state (own + ancestors).
+ */
+export declare function buildScopeModel(sources: Map<string, string>): FileModel[];
+//# sourceMappingURL=code-model.d.ts.map

package/dist/analysis/code-model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"code-model.d.ts","sourceRoot":"","sources":["../../src/analysis/code-model.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AAEH,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,WAAW,GAAG,SAAS,GAAG,UAAU,GAAG,MAAM,CAAC;AAEtF,MAAM,WAAW,OAAO;IACtB;;;;;;;;OAQG;IACH,IAAI,EAAE,UAAU,GAAG,OAAO,GAAG,MAAM,GAAG,WAAW,GAAG,OAAO,GAAG,QAAQ,GAAG,WAAW,CAAC;IACrF,IAAI,EAAE,MAAM,CAAC;IACb,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,UAAU,GAAG,UAAU,CAAC;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,aAAa,EAAE,OAAO,CAAC;IACvB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,0CAA0C;IAC1C,GAAG,EAAE,MAAM,CAAC;IACZ,+EAA+E;IAC/E,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,OAAO,EAAE,CAAC;IACjB,+EAA+E;IAC/E,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,SAAS,GAAG,UAAU,GAAG,WAAW,CAAC;IACjD,UAAU,EAAE,MAAM,CAAC;IACnB,oDAAoD;IACpD,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,0BAA0B;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,wCAAwC;IACxC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,YAAY,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,SAAS,EAAE,aAAa,EAAE,CAAC;IAC3B,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,OAAO,EAAE,WAAW,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,aAAa,EAAE,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAwBD,wBAAgB,YAAY,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,CAsB/C;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAqCnD;AA4MD;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,aAAa,GAAE,GAAG,CAAC,MAAM,CAAa,EACtC,kBAAkB,GAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAa,GAC/D,SAAS,CA+KX;AAED,sFAAsF;AACtF,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAW7D;AAED,oFAAoF;AACpF,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GAAG,MAAM,EAAE,CAetF;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,EAAE,CAwBzE"}

package/dist/analysis/code-model.js

@@ -0,0 +1,532 @@
+import * as parser from '@solidity-parser/parser';
+const SKIP_KEYS = new Set(['loc', 'range', 'comments', 'tokens']);
+function isNode(v) {
+    return typeof v === 'object' && v !== null && typeof v.type === 'string';
+}
+/** Depth-first visit; `visit` returns false to stop descending into a node. */
+function walk(node, visit) {
+    if (Array.isArray(node)) {
+        for (const item of node)
+            walk(item, visit);
+        return;
+    }
+    if (!isNode(node))
+        return;
+    if (visit(node) === false)
+        return;
+    for (const [k, v] of Object.entries(node)) {
+        if (SKIP_KEYS.has(k))
+            continue;
+        if (Array.isArray(v) || isNode(v))
+            walk(v, visit);
+    }
+}
+export function typeToString(t) {
+    if (!isNode(t))
+        return 'unknown';
+    switch (t.type) {
+        case 'ElementaryTypeName':
+            return String(t.name ?? 'unknown');
+        case 'UserDefinedTypeName':
+            // Last segment, so `BaseVault.Position` and `Position` agree with the compiler facts.
+            return String(t.namePath ?? 'unknown')
+                .split('.')
+                .pop();
+        case 'ArrayTypeName': {
+            const len = t.length;
+            const lenStr = isNode(len) && len.type === 'NumberLiteral' ? String(len.number) : '';
+            return `${typeToString(t.baseTypeName)}[${lenStr}]`;
+        }
+        case 'Mapping':
+            return `mapping(${typeToString(t.keyType)}=>${typeToString(t.valueType)})`;
+        case 'FunctionTypeName':
+            return 'function';
+        default:
+            return 'unknown';
+    }
+}
+/**
+ * Strip comments (outside string literals) and collapse whitespace, so a
+ * re-indented or re-commented body compares equal to the original.
+ */
+export function normalizeSource(src) {
+    let out = '';
+    let i = 0;
+    const n = src.length;
+    while (i < n) {
+        const c = src[i];
+        const next = src[i + 1];
+        if (c === '"' || c === "'") {
+            const quote = c;
+            let j = i + 1;
+            while (j < n && src[j] !== quote) {
+                if (src[j] === '\\')
+                    j++;
+                j++;
+            }
+            out += src.slice(i, j + 1);
+            i = j + 1;
+            continue;
+        }
+        if (c === '/' && next === '/') {
+            while (i < n && src[i] !== '\n')
+                i++;
+            out += ' ';
+            continue;
+        }
+        if (c === '/' && next === '*') {
+            i += 2;
+            while (i < n && !(src[i] === '*' && src[i + 1] === '/'))
+                i++;
+            i += 2;
+            out += ' ';
+            continue;
+        }
+        out += c;
+        i++;
+    }
+    return out
+        .replace(/\s+/g, ' ')
+        .replace(/\s*([{}();,=+\-*/<>!&|^%?:[\]])\s*/g, '$1')
+        .trim();
+}
+function sliceRange(source, node) {
+    const range = node.range;
+    if (!range)
+        return '';
+    return source.slice(range[0], range[1] + 1);
+}
+function lineOf(node, which) {
+    const loc = node.loc;
+    return loc?.[which].line ?? 0;
+}
+const BUILTIN_CALLS = new Set([
+    'require',
+    'assert',
+    'revert',
+    'keccak256',
+    'sha256',
+    'ripemd160',
+    'ecrecover',
+    'addmod',
+    'mulmod',
+    'selfdestruct',
+    'blockhash',
+    'gasleft',
+    'type',
+    'abi',
+]);
+const ADDRESS_MEMBERS = new Set([
+    'call',
+    'delegatecall',
+    'staticcall',
+    'transfer',
+    'send',
+    'encode',
+    'encodePacked',
+    'encodeWithSelector',
+    'encodeWithSignature',
+    'encodeCall',
+    'decode',
+    'push',
+    'pop',
+    'concat',
+]);
+/** Walk down `a.b[c].d` style lvalues to the root identifier name. */
+function rootIdentifier(expr) {
+    let cur = expr;
+    for (let guard = 0; guard < 32 && isNode(cur); guard++) {
+        if (cur.type === 'Identifier')
+            return String(cur.name);
+        if (cur.type === 'IndexAccess')
+            cur = cur.base;
+        else if (cur.type === 'IndexRangeAccess')
+            cur = cur.base;
+        else if (cur.type === 'MemberAccess')
+            cur = cur.expression;
+        else
+            return null;
+    }
+    return null;
+}
+function analyzeBody(unitNode, ctx) {
+    const calls = [];
+    const reads = new Set();
+    const writes = new Set();
+    // Locals / params shadow state vars and give receiver types for typed calls.
+    const localTypes = new Map();
+    const declare = (decl) => {
+        if (!isNode(decl))
+            return;
+        const name = decl.name;
+        if (name)
+            localTypes.set(name, typeToString(decl.typeName));
+    };
+    for (const p of unitNode.parameters ?? [])
+        declare(p);
+    for (const p of unitNode.returnParameters ?? [])
+        declare(p);
+    walk(unitNode.body, (n) => {
+        if (n.type === 'VariableDeclarationStatement') {
+            for (const v of n.variables ?? [])
+                declare(v);
+        }
+    });
+    const receiverType = (name) => {
+        const t = localTypes.get(name) ?? ctx.stateVarTypes.get(name);
+        if (!t)
+            return null;
+        const base = t.replace(/\[\d*\]$/, '');
+        return ctx.contractNames.has(base) ? base : null;
+    };
+    const isState = (name) => !!name && !localTypes.has(name) && ctx.stateVarNames.has(name);
+    const recordCall = (call) => {
+        let callee = call.expression;
+        if (isNode(callee) && callee.type === 'NameValueExpression')
+            callee = callee.expression;
+        const argCount = (call.arguments ?? []).length;
+        if (!isNode(callee))
+            return;
+        if (callee.type === 'Identifier') {
+            const name = String(callee.name);
+            if (BUILTIN_CALLS.has(name))
+                return;
+            // `IERC20(x)` / `Vault(addr)` are type conversions, not calls.
+            if (ctx.contractNames.has(name))
+                return;
+            calls.push({ kind: 'internal', name, argCount });
+            return;
+        }
+        if (callee.type === 'MemberAccess') {
+            const name = String(callee.memberName);
+            const recv = callee.expression;
+            if (isNode(recv) && recv.type === 'Identifier') {
+                const rname = String(recv.name);
+                if (rname === 'super')
+                    return void calls.push({ kind: 'super', name, argCount });
+                if (rname === 'this')
+                    return void calls.push({ kind: 'this', name, argCount });
+                if (rname === 'abi' || rname === 'msg' || rname === 'block' || rname === 'tx')
+                    return;
+                if (ctx.contractNames.has(rname) && !localTypes.has(rname)) {
+                    return void calls.push({ kind: 'qualified', name, target: rname, argCount });
+                }
+                const t = receiverType(rname);
+                if (t)
+                    return void calls.push({ kind: 'typed', name, target: t, argCount });
+            }
+            // `IFoo(addr).bar()` — receiver is a type conversion call.
+            if (isNode(recv) && recv.type === 'FunctionCall') {
+                const conv = recv.expression;
+                if (isNode(conv) &&
+                    conv.type === 'Identifier' &&
+                    ctx.contractNames.has(String(conv.name))) {
+                    return void calls.push({ kind: 'typed', name, target: String(conv.name), argCount });
+                }
+            }
+            if (ADDRESS_MEMBERS.has(name))
+                return;
+            calls.push({ kind: 'member', name, argCount });
+        }
+    };
+    walk(unitNode.body, (n) => {
+        switch (n.type) {
+            case 'EmitStatement':
+                // Events are not calls; still record state reads inside the arguments.
+                walk(n.eventCall?.arguments, (m) => {
+                    if (m.type === 'Identifier' && isState(String(m.name)))
+                        reads.add(String(m.name));
+                    if (m.type === 'FunctionCall')
+                        recordCall(m);
+                });
+                return false;
+            case 'FunctionCall':
+                recordCall(n);
+                return;
+            case 'BinaryOperation': {
+                const op = String(n.operator);
+                if (op === '=' || (op.endsWith('=') && !['==', '!=', '<=', '>='].includes(op))) {
+                    const root = rootIdentifier(n.left);
+                    if (isState(root)) {
+                        writes.add(root);
+                        if (op !== '=')
+                            reads.add(root);
+                    }
+                }
+                return;
+            }
+            case 'UnaryOperation': {
+                const op = String(n.operator);
+                if (op === '++' || op === '--' || op === 'delete') {
+                    const root = rootIdentifier(n.subExpression);
+                    if (isState(root))
+                        writes.add(root);
+                }
+                return;
+            }
+            case 'Identifier': {
+                const name = String(n.name);
+                if (isState(name))
+                    reads.add(name);
+                return;
+            }
+            case 'MemberAccess': {
+                // `.push(...)` / `.pop()` on a state array is a write.
+                const member = String(n.memberName);
+                if (member === 'push' || member === 'pop') {
+                    const root = rootIdentifier(n.expression);
+                    if (isState(root))
+                        writes.add(root);
+                }
+                return;
+            }
+        }
+    });
+    // An identifier that is written is not also a "read" unless used elsewhere;
+    // the Identifier visitor above sees lvalues too, so reads ⊇ writes here. Keep
+    // it: a write site still depends on the variable's declared semantics.
+    return { calls, reads: [...reads].sort(), writes: [...writes].sort() };
+}
+function signatureOf(name, params) {
+    return `${name}(${(params ?? []).map((p) => (isNode(p) ? typeToString(p.typeName) : 'unknown')).join(',')})`;
+}
+/**
+ * Build the code model of one file. `contractNames` (all contract-like names in
+ * scope) lets the body walker tell type conversions and typed receivers apart.
+ * `inheritedStateVars` maps a contract name to the state vars of its whole
+ * linearized hierarchy (name → type); pass an empty map for a first pass.
+ */
+export function buildFileModel(source, file, contractNames = new Set(), inheritedStateVars = new Map()) {
+    let ast;
+    try {
+        ast = parser.parse(source, { loc: true, range: true, tolerant: true });
+    }
+    catch (err) {
+        return { file, contracts: [], parseError: err instanceof Error ? err.message : String(err) };
+    }
+    const contracts = [];
+    const free = {
+        name: '(free)',
+        kind: 'free',
+        file,
+        bases: [],
+        lineStart: 0,
+        lineEnd: 0,
+        units: [],
+        stateVars: [],
+        events: [],
+        errors: [],
+        structs: [],
+    };
+    const children = ast.children ?? [];
+    const buildUnit = (node, contract, ctx) => {
+        const isModifier = node.type === 'ModifierDefinition';
+        const isConstructor = Boolean(node.isConstructor);
+        const isFallback = Boolean(node.isFallback);
+        const isReceive = Boolean(node.isReceiveEther);
+        const name = isModifier
+            ? String(node.name)
+            : (node.name ??
+                (isConstructor ? 'constructor' : isFallback ? 'fallback' : 'receive'));
+        const params = node.parameters ?? [];
+        const raw = sliceRange(source, node);
+        const body = analyzeBody(node, ctx);
+        const modifierInvocations = (node.modifiers ?? []).map((m) => ({
+            name: String(m.name),
+            argCount: (m.arguments ?? []).length,
+        }));
+        // Base-constructor invocations show up as "modifiers" on constructors.
+        for (const m of modifierInvocations) {
+            if (contractNames.has(m.name)) {
+                body.calls.push({
+                    kind: 'base_ctor',
+                    name: 'constructor',
+                    target: m.name,
+                    argCount: m.argCount,
+                });
+            }
+        }
+        return {
+            contract,
+            kind: isModifier ? 'modifier' : 'function',
+            name,
+            signature: isConstructor || isFallback || isReceive ? `${name}()` : signatureOf(name, params),
+            visibility: isModifier ? 'modifier' : String(node.visibility ?? 'default'),
+            stateMutability: node.stateMutability ?? null,
+            isConstructor,
+            isFallback,
+            isReceive,
+            modifiers: modifierInvocations.filter((m) => !contractNames.has(m.name)).map((m) => m.name),
+            paramCount: params.length,
+            lineStart: lineOf(node, 'start'),
+            lineEnd: lineOf(node, 'end'),
+            raw,
+            normalized: normalizeSource(raw),
+            calls: body.calls,
+            reads: body.reads,
+            writes: body.writes,
+        };
+    };
+    for (const child of children) {
+        if (child.type === 'FunctionDefinition') {
+            const ctx = {
+                stateVarNames: new Set(),
+                stateVarTypes: new Map(),
+                contractNames,
+            };
+            free.units.push(buildUnit(child, '(free)', ctx));
+            continue;
+        }
+        if (child.type !== 'ContractDefinition')
+            continue;
+        const kindRaw = String(child.kind);
+        const kind = kindRaw === 'interface'
+            ? 'interface'
+            : kindRaw === 'library'
+                ? 'library'
+                : kindRaw === 'abstract'
+                    ? 'abstract'
+                    : 'contract';
+        const name = String(child.name);
+        const bases = (child.baseContracts ?? []).map((b) => String(b.baseName?.namePath ?? ''));
+        const subNodes = child.subNodes ?? [];
+        const stateVars = [];
+        const events = [];
+        const errors = [];
+        const structs = [];
+        for (const sub of subNodes) {
+            if (sub.type === 'StateVariableDeclaration') {
+                const init = sub.initialValue;
+                for (const v of sub.variables ?? []) {
+                    stateVars.push({
+                        name: String(v.name),
+                        type: typeToString(v.typeName),
+                        mutability: v.isDeclaredConst ? 'constant' : v.isImmutable ? 'immutable' : 'mutable',
+                        visibility: String(v.visibility ?? 'internal'),
+                        initial: init ? normalizeSource(sliceRange(source, init)) : '',
+                        lineStart: lineOf(sub, 'start'),
+                    });
+                }
+            }
+            else if (sub.type === 'EventDefinition') {
+                events.push({
+                    name: String(sub.name),
+                    signature: signatureOf(String(sub.name), sub.parameters),
+                    lineStart: lineOf(sub, 'start'),
+                });
+            }
+            else if (sub.type === 'CustomErrorDefinition') {
+                errors.push({
+                    name: String(sub.name),
+                    signature: signatureOf(String(sub.name), sub.parameters),
+                    lineStart: lineOf(sub, 'start'),
+                });
+            }
+            else if (sub.type === 'StructDefinition') {
+                structs.push({
+                    name: String(sub.name),
+                    members: (sub.members ?? []).map((m) => `${typeToString(m.typeName)} ${String(m.name ?? '')}`),
+                    lineStart: lineOf(sub, 'start'),
+                });
+            }
+        }
+        // State vars visible to this contract's bodies: inherited (if known) + own.
+        const visible = new Map(inheritedStateVars.get(name) ?? []);
+        for (const sv of stateVars)
+            visible.set(sv.name, sv.type);
+        const ctx = {
+            stateVarNames: new Set(visible.keys()),
+            stateVarTypes: visible,
+            contractNames,
+        };
+        const units = [];
+        for (const sub of subNodes) {
+            if (sub.type === 'FunctionDefinition' || sub.type === 'ModifierDefinition') {
+                units.push(buildUnit(sub, name, ctx));
+            }
+        }
+        contracts.push({
+            name,
+            kind,
+            file,
+            bases,
+            lineStart: lineOf(child, 'start'),
+            lineEnd: lineOf(child, 'end'),
+            units,
+            stateVars,
+            events,
+            errors,
+            structs,
+        });
+    }
+    if (free.units.length > 0)
+        contracts.push(free);
+    return { file, contracts };
+}
+/** Contract-like names declared in a source (cheap first pass for buildFileModel). */
+export function collectContractNames(source) {
+    const names = [];
+    try {
+        const ast = parser.parse(source, { tolerant: true });
+        for (const child of ast.children ?? []) {
+            if (child.type === 'ContractDefinition')
+                names.push(String(child.name));
+        }
+    }
+    catch {
+        /* unparseable — caller records the parse error on the full pass */
+    }
+    return names;
+}
+/** Linearized base list (C3-ish, most-base last), restricted to known contracts. */
+export function ancestorsOf(name, byName) {
+    const out = [];
+    const seen = new Set([name]);
+    const visit = (n) => {
+        const c = byName.get(n);
+        if (!c)
+            return;
+        for (const b of [...c.bases].reverse()) {
+            if (seen.has(b))
+                continue;
+            seen.add(b);
+            out.push(b);
+            visit(b);
+        }
+    };
+    visit(name);
+    return out;
+}
+/**
+ * Build models for a whole set of sources with inherited state vars resolved:
+ * pass 1 collects contract names and own state vars, pass 2 rebuilds each file
+ * with every contract's full visible state (own + ancestors).
+ */
+export function buildScopeModel(sources) {
+    const contractNames = new Set();
+    for (const src of sources.values())
+        for (const n of collectContractNames(src))
+            contractNames.add(n);
+    const first = [];
+    for (const [file, src] of sources)
+        first.push(buildFileModel(src, file, contractNames));
+    const byName = new Map();
+    for (const fm of first)
+        for (const c of fm.contracts)
+            if (c.kind !== 'free')
+                byName.set(c.name, c);
+    const inherited = new Map();
+    for (const c of byName.values()) {
+        const vis = new Map();
+        for (const anc of ancestorsOf(c.name, byName).reverse()) {
+            for (const sv of byName.get(anc)?.stateVars ?? [])
+                vis.set(sv.name, sv.type);
+        }
+        inherited.set(c.name, vis);
+    }
+    const out = [];
+    for (const [file, src] of sources)
+        out.push(buildFileModel(src, file, contractNames, inherited));
+    return out;
+}
+//# sourceMappingURL=code-model.js.map