hullproof 0.0.0-stage → 0.5.0

package/dist/map/config.js

@@ -0,0 +1,291 @@
+import { cmp } from '../util.js';
+import { Lines } from './lex.js';
+// SQL statements with their start line. Comments are dropped, and ";" inside quotes, dollar quoted bodies and brackets does not split.
+export function sqlStatements(sql) {
+    const lines = new Lines(sql);
+    const out = [];
+    let i = 0;
+    let start = 0;
+    let depth = 0;
+    const n = sql.length;
+    let buf = '';
+    const flush = (end) => {
+        const t = buf.trim();
+        if (t)
+            out.push({ text: t, line: lines.at(start + (buf.length - buf.trimStart().length)) });
+        buf = '';
+        start = end;
+    };
+    while (i < n) {
+        const c = sql[i];
+        if (c === '-' && sql[i + 1] === '-') {
+            while (i < n && sql[i] !== '\n')
+                i++;
+            continue;
+        }
+        if (c === '/' && sql[i + 1] === '*') {
+            const e = sql.indexOf('*/', i + 2);
+            i = e < 0 ? n : e + 2;
+            continue;
+        }
+        if (c === "'") {
+            let j = i + 1;
+            while (j < n && !(sql[j] === "'" && sql[j + 1] !== "'")) {
+                if (sql[j] === "'")
+                    j++;
+                j++;
+            }
+            buf += sql.slice(i, j + 1);
+            i = j + 1;
+            continue;
+        }
+        if (c === '$') {
+            const tag = /^\$[A-Za-z_]*\$/.exec(sql.slice(i, i + 40));
+            if (tag) {
+                const e = sql.indexOf(tag[0], i + tag[0].length);
+                const end = e < 0 ? n : e + tag[0].length;
+                buf += sql.slice(i, end);
+                i = end;
+                continue;
+            }
+        }
+        if (c === '(')
+            depth++;
+        else if (c === ')')
+            depth--;
+        if (c === ';' && depth <= 0) {
+            i++;
+            flush(i);
+            depth = 0;
+            continue;
+        }
+        buf += c;
+        i++;
+    }
+    flush(n);
+    return out;
+}
+const IDENT = String.raw `(?:"[^"]+"|[A-Za-z_][\w$]*)`;
+const QNAME = String.raw `(${IDENT}(?:\s*\.\s*${IDENT})?)`;
+const unq = (s) => s.replace(/"/g, '').replace(/\s+/g, '').replace(/^public\./i, '');
+function splitTop(s, sep = ',') {
+    const out = [];
+    let depth = 0;
+    let cur = '';
+    for (const c of s) {
+        if (c === '(')
+            depth++;
+        else if (c === ')')
+            depth--;
+        if (c === sep && depth === 0) {
+            out.push(cur);
+            cur = '';
+        }
+        else
+            cur += c;
+    }
+    if (cur.trim())
+        out.push(cur);
+    return out;
+}
+function parenBody(s, from) {
+    const open = s.indexOf('(', from);
+    if (open < 0)
+        return null;
+    let depth = 0;
+    for (let i = open; i < s.length; i++) {
+        if (s[i] === '(')
+            depth++;
+        else if (s[i] === ')') {
+            depth--;
+            if (depth === 0)
+                return s.slice(open + 1, i);
+        }
+    }
+    return null;
+}
+export function supabaseMap(repo) {
+    const files = repo.ctx.files.filter((f) => /(?:^|\/)supabase\/(?:migrations\/.*|schema|seed)\.sql$|(?:^|\/)migrations\/.*\.sql$|(?:^|\/)schema\.sql$/i.test(f) && !/seed/i.test(f)).sort(cmp);
+    if (!files.length)
+        return null;
+    const tables = new Map();
+    const get = (name, file, line) => {
+        let t = tables.get(name);
+        if (!t) {
+            t = { name, file, line, rls_enabled: null, columns: [], policies: [], grants: [] };
+            tables.set(name, t);
+        }
+        return t;
+    };
+    for (const file of files) {
+        for (const st of sqlStatements(repo.ctx.text(file))) {
+            const s = st.text;
+            let m;
+            if ((m = new RegExp(String.raw `^create\s+(?:unlogged\s+)?table\s+(?:if\s+not\s+exists\s+)?${QNAME}`, 'i').exec(s))) {
+                const name = unq(m[1]);
+                const t = get(name, file, st.line);
+                t.file = file;
+                t.line = st.line;
+                t.policies = [];
+                t.grants = [];
+                t.rls_enabled = null;
+                const body = parenBody(s, m[0].length) ?? '';
+                t.columns = splitTop(body).map((c) => c.trim()).filter((c) => c && !/^(?:primary\s+key|foreign\s+key|unique|constraint|check|like|exclude)\b/i.test(c)).map((c) => unq(/^(?:"[^"]+"|[A-Za-z_][\w$]*)/.exec(c)?.[0] ?? '')).filter(Boolean).sort();
+            }
+            else if ((m = new RegExp(String.raw `^alter\s+table\s+(?:if\s+exists\s+)?(?:only\s+)?${QNAME}\s+(enable|disable|force|no\s+force)\s+row\s+level\s+security`, 'i').exec(s))) {
+                const t = get(unq(m[1]), file, st.line);
+                const w = m[2].toLowerCase();
+                if (w === 'enable')
+                    t.rls_enabled = true;
+                else if (w === 'disable')
+                    t.rls_enabled = false;
+            }
+            else if ((m = new RegExp(String.raw `^alter\s+table\s+(?:if\s+exists\s+)?(?:only\s+)?${QNAME}\s+add\s+column\s+(?:if\s+not\s+exists\s+)?(${IDENT})`, 'i').exec(s))) {
+                const t = get(unq(m[1]), file, st.line);
+                t.columns = [...new Set([...t.columns, unq(m[2])])].sort();
+            }
+            else if ((m = new RegExp(String.raw `^create\s+policy\s+(${IDENT}|'[^']*')\s+on\s+${QNAME}`, 'i').exec(s))) {
+                const t = get(unq(m[2]), file, st.line);
+                const rest = s.slice(m[0].length);
+                const op = /\bfor\s+(all|select|insert|update|delete)\b/i.exec(rest)?.[1]?.toLowerCase() ?? 'all';
+                const rolesText = /\bto\s+([\w",\s]+?)(?=\s+(?:using|with)\b|$)/i.exec(rest)?.[1] ?? 'public';
+                const roles = rolesText.split(',').map((r) => r.trim().replace(/"/g, '').toLowerCase()).filter(Boolean);
+                const u = /\busing\s*\(/i.exec(rest);
+                const c = /\bwith\s+check\s*\(/i.exec(rest);
+                t.policies.push({
+                    name: m[1].replace(/["']/g, ''), op, roles: roles.sort(), using: u ? (parenBody(rest, u.index) ?? '').replace(/\s+/g, ' ').trim() : null,
+                    check: c ? (parenBody(rest, c.index) ?? '').replace(/\s+/g, ' ').trim() : null, line: st.line, permissive: !/\bas\s+restrictive\b/i.test(rest),
+                });
+            }
+            else if ((m = new RegExp(String.raw `^drop\s+policy\s+(?:if\s+exists\s+)?(${IDENT}|'[^']*')\s+on\s+${QNAME}`, 'i').exec(s))) {
+                const t = tables.get(unq(m[2]));
+                if (t)
+                    t.policies = t.policies.filter((p) => p.name !== m[1].replace(/["']/g, ''));
+            }
+            else if ((m = new RegExp(String.raw `^drop\s+table\s+(?:if\s+exists\s+)?${QNAME}`, 'i').exec(s))) {
+                tables.delete(unq(m[1]));
+            }
+            else if ((m = /^grant\s+([\s\S]+?)\s+on\s+(?:table\s+)?([\s\S]+?)\s+to\s+([\s\S]+?)(?:\s+with\s+grant\s+option)?$/i.exec(s)) && !/^grant\s+\w+\s+to\s/i.test(s) && !/\bon\s+(?:function|sequence|schema|type|all\s+functions|all\s+sequences)/i.test(s)) {
+                const all = /^all\s+tables\s+in\s+schema/i.test(m[2]);
+                const targets = all ? ['*'] : splitTop(m[2]).map((x) => unq(x.trim().replace(/^table\s+/i, '')));
+                const privs = splitTop(m[1]).map((p) => p.trim()).filter(Boolean).map((p) => {
+                    const pm = /^(all(?:\s+privileges)?|select|insert|update|delete|truncate|references|trigger)\s*(?:\(([^)]*)\))?$/i.exec(p);
+                    return pm ? { priv: pm[1].toLowerCase().replace(/\s+privileges/, ''), cols: pm[2] ? pm[2].split(',').map((c) => c.trim().replace(/"/g, '')).sort() : null } : null;
+                }).filter((x) => x !== null);
+                const roles = splitTop(m[3]).map((r) => r.trim().replace(/"/g, '').toLowerCase());
+                for (const tn of targets) {
+                    const t = get(tn, file, st.line);
+                    for (const role of roles) {
+                        for (const p of privs)
+                            t.grants.push({ role, privileges: [p.priv], columns: p.cols, line: st.line });
+                    }
+                }
+            }
+            else if ((m = /^revoke\s+([\s\S]+?)\s+on\s+(?:table\s+)?([\s\S]+?)\s+from\s+([\s\S]+)$/i.exec(s))) {
+                const targets = splitTop(m[2]).map((x) => unq(x.trim().replace(/^table\s+/i, '')));
+                const roles = splitTop(m[3]).map((r) => r.trim().replace(/"/g, '').toLowerCase());
+                const privs = splitTop(m[1]).map((p) => p.trim().toLowerCase().replace(/\s+privileges/, '').replace(/\s*\(.*\)/, ''));
+                for (const tn of targets) {
+                    const t = tables.get(tn);
+                    if (!t)
+                        continue;
+                    t.grants = t.grants.filter((g) => !(roles.includes(g.role) && (privs.includes('all') || g.privileges.some((p) => privs.includes(p)))));
+                }
+            }
+        }
+    }
+    // Default privileges and schema wide grants ("*") apply to every table.
+    const star = tables.get('*');
+    tables.delete('*');
+    const list = [...tables.values()].filter((t) => t.name !== '').sort((a, b) => cmp(a.name, b.name));
+    if (star)
+        for (const t of list)
+            t.grants = [...t.grants, ...star.grants.map((g) => ({ ...g }))];
+    for (const t of list) {
+        t.policies.sort((a, b) => a.line - b.line || cmp(a.name, b.name));
+        t.grants.sort((a, b) => cmp(a.role, b.role) || cmp(a.privileges[0], b.privileges[0]) || a.line - b.line);
+    }
+    return { tables: list };
+}
+const OWNER_VAR = /uid|user_?id|owner|account|author|member|tenant/i;
+export function firebaseMap(repo) {
+    const files = repo.ctx.files.filter((f) => /(?:^|\/)[^/]*\.rules$|(?:^|\/)database\.rules\.json$|(?:^|\/)[^/]*\.rules\.json$/.test(f)).sort(cmp);
+    if (!files.length)
+        return null;
+    const rules = [];
+    for (const file of files) {
+        const text = repo.ctx.text(file);
+        if (/\.json$/.test(file)) {
+            realtimeRules(file, text, rules);
+            continue;
+        }
+        const service = /storage/i.test(file) || /service\s+firebase\.storage/.test(text) ? 'storage' : 'firestore';
+        // Rules files have // and /* */ comments and paths with slashes, which the JavaScript masker would read as regular expressions.
+        const masked = text.replace(/\/\/[^\n]*|\/\*[\s\S]*?\*\//g, (c) => c.replace(/[^\n]/g, ' '));
+        const lines = new Lines(text);
+        const stack = [];
+        const re = /\bmatch\s+((?:\/(?:\{[^}]*\}|[^\s{/])*)+)\s*\{|\ballow\s+([\w,\s]+?)\s*(?::\s*if\s+([^;]*?))?\s*;/g;
+        for (let m = re.exec(masked); m; m = re.exec(masked)) {
+            while (stack.length && m.index >= stack[stack.length - 1].close)
+                stack.pop();
+            if (m[1] !== undefined) {
+                const open = m.index + m[0].length - 1;
+                let depth = 0;
+                let close = masked.length;
+                for (let i = open; i < masked.length; i++) {
+                    if (masked[i] === '{')
+                        depth++;
+                    else if (masked[i] === '}') {
+                        depth--;
+                        if (depth === 0) {
+                            close = i;
+                            break;
+                        }
+                    }
+                }
+                stack.push({ path: m[1].trim(), close });
+            }
+            else {
+                const ops = m[2].split(',').map((o) => o.trim()).filter(Boolean).sort();
+                const cond = (text.slice(m.index, m.index + m[0].length).replace(/^allow\s+[\w,\s]+?\s*(?::\s*if\s+)?/, '').replace(/;$/, '')).replace(/\s+/g, ' ').trim();
+                const fullPath = stack.map((s) => s.path).join('').replace(/\/+/g, '/');
+                const wild = [...fullPath.matchAll(/\{(\w+)(?:=\*\*)?\}/g)].map((x) => x[1]);
+                const uidWild = wild.filter((w) => OWNER_VAR.test(w));
+                const ownerBound = new RegExp(`request\\.auth\\.uid\\s*==\\s*(?:${wild.join('|') || '@@'})\\b|\\b(?:${wild.join('|') || '@@'})\\s*==\\s*request\\.auth\\.uid|resource(?:\\.data)?\\.\\w+\\s*==\\s*request\\.auth\\.uid|request\\.resource\\.data\\.\\w+\\s*==\\s*request\\.auth\\.uid|request\\.auth\\.uid\\s+in\\s|\\b(?:isOwner|owns|isUser|isOwnerOf|belongsToUser)\\s*\\(`).test(cond)
+                    || (/\b[a-z]\w*\s*\(/i.test(cond) && !/request\.auth\s*!=\s*null|request\.auth\s*==\s*null/.test(cond) && /owner|isUser|uid/i.test(cond));
+                const open = cond === '' || /^true$/.test(cond) || /^request\.time\s*<\s*timestamp\.date\(/.test(cond);
+                rules.push({ service, file, line: lines.at(m.index), path: fullPath || '/', ops, condition: cond.slice(0, 200), uses_auth: /request\.auth/.test(cond), owner_bound: ownerBound, always_true: open, owner_wildcard: uidWild.length > 0 });
+            }
+        }
+    }
+    return { rules: rules.sort((a, b) => cmp(a.file, b.file) || a.line - b.line || cmp(a.ops.join(), b.ops.join())) };
+}
+function realtimeRules(file, text, out) {
+    let json;
+    try {
+        json = JSON.parse(text);
+    }
+    catch {
+        return;
+    }
+    const lines = new Lines(text);
+    let cursor = 0;
+    const walkNode = (node, path) => {
+        if (!node || typeof node !== 'object')
+            return;
+        for (const [k, v] of Object.entries(node)) {
+            if ((k === '.read' || k === '.write') && (typeof v === 'string' || typeof v === 'boolean')) {
+                const cond = String(v);
+                const at = text.indexOf(`"${k}"`, cursor);
+                if (at >= 0)
+                    cursor = at + 1;
+                const wild = path.filter((p) => p.startsWith('$'));
+                const ownerBound = /\$\w+\s*===?\s*auth\.uid|auth\.uid\s*===?\s*\$\w+|\.val\(\)\s*===?\s*auth\.uid|auth\.uid\s*===?\s*(?:data|newData)/.test(cond);
+                out.push({ service: 'realtime', file, line: at >= 0 ? lines.at(at) : 1, path: '/' + path.join('/'), ops: [k.slice(1)], condition: cond.slice(0, 200), uses_auth: /\bauth\b/.test(cond), owner_bound: ownerBound, always_true: cond.trim() === 'true', owner_wildcard: wild.some((w) => OWNER_VAR.test(w)) });
+            }
+            else if (!k.startsWith('.'))
+                walkNode(v, [...path, k]);
+        }
+    };
+    walkNode(json.rules, []);
+}

package/dist/map/dotnet.js

@@ -0,0 +1,242 @@
+import { splitTop, strings } from './cblocks.js';
+import { empty, joinPath, makeEntry, normPath } from './entry.js';
+import { cMethod } from './light-index.js';
+import { analyzeLight } from './light.js';
+import { closeOf, splitArgs } from './lex.js';
+const HTTP = { HttpGet: 'GET', HttpPost: 'POST', HttpPut: 'PUT', HttpDelete: 'DELETE', HttpPatch: 'PATCH', HttpHead: 'HEAD', HttpOptions: 'OPTIONS' };
+const SERVICE_TYPE = /^(?:I[A-Z]\w+|\w*(?:Db|DbContext|Context|Service|Repository|Logger|Options|Factory|Manager|Client|Provider|Handler)|CancellationToken|HttpContext|HttpRequest|HttpResponse|ClaimsPrincipal|IConfiguration|LinkGenerator|TokenService)\b/;
+const AUTH_KINDS = new Set(['session_read', 'role_check']);
+export function dotnetFiles(repo) {
+    return repo.filesOf('cs').filter((f) => { const v = repo.view(f); return !!v && (/Controller\b|\[ApiController\]/.test(v.masked) || /\.\s*Map(?:Get|Post|Put|Delete|Patch|Methods|Group)\s*\(/.test(v.masked)); });
+}
+// Attribute lists ([A], [A, B(1)], [A][B]) that stand alone at brace depth 0 of [from, to): the first thing on their line, or right after another list.
+function attributeBlocks(v, from, to) {
+    const m = v.masked;
+    const out = [];
+    let depth = 0;
+    let cur = null;
+    for (let i = from; i < to; i++) {
+        const c = m[i];
+        if (c === '{' || c === '(') {
+            depth++;
+            continue;
+        }
+        if (c === '}' || c === ')') {
+            depth--;
+            continue;
+        }
+        if (c === '[' && depth === 0) {
+            const lineStart = m.lastIndexOf('\n', i) + 1;
+            const first = /^[ \t]*$/.test(m.slice(Math.max(lineStart, from), i));
+            const chained = cur !== null && /^\s*$/.test(m.slice(cur.end, i));
+            if (!first && !chained) {
+                const e = closeOf(m, i);
+                if (e > 0)
+                    i = e - 1;
+                continue;
+            }
+            const close = closeOf(m, i);
+            if (close < 0)
+                continue;
+            const attrs = splitTop(v.text.slice(i + 1, close - 1)).map((t) => {
+                const nm = /^(?:\w+\s*:\s*)?([\w.]+)\s*(?:\(([\s\S]*)\))?$/.exec(t);
+                const at = i + 1 + v.text.slice(i + 1, close - 1).indexOf(t);
+                return { name: (nm?.[1] ?? t).replace(/^.*\./, '').replace(/Attribute$/, ''), start: at, end: at + t.length, args: nm?.[2] ?? '' };
+            });
+            if (chained && cur) {
+                cur.attrs.push(...attrs);
+                cur.end = close;
+            }
+            else {
+                cur = { attrs, start: i, end: close, declStart: 0 };
+                out.push(cur);
+            }
+            i = close - 1;
+        }
+    }
+    for (const b of out) {
+        let d = b.end;
+        while (/\s/.test(m[d] ?? ''))
+            d++;
+        b.declStart = d;
+    }
+    return out;
+}
+const tokens = (route, controller, action) => route.replace(/\[controller\]/gi, controller.toLowerCase()).replace(/\[action\]/gi, action.toLowerCase()).replace(/\[area\]/gi, '');
+const cleanPath = (p) => normPath(p.replace(/\{(\w+)\?\}/g, '{$1}').replace(/\{\*{1,2}(\w+)\}/g, '{$1}'));
+function seedsOf(paramsText) {
+    const seeds = [];
+    for (const part of splitTop(paramsText)) {
+        if (/\[FromServices\]/.test(part))
+            continue;
+        const bare = part.replace(/\[[^\]]*\]\s*/g, '').replace(/\s*=\s*.*$/, '').trim();
+        const mm = /^(?:this\s+)?(?:ref\s+|out\s+|in\s+)?([\w.<>?,\[\]]+)\s+(\w+)$/.exec(bare);
+        if (!mm || SERVICE_TYPE.test(mm[1]))
+            continue;
+        seeds.push(mm[2]);
+    }
+    return seeds;
+}
+export function extractDotnet(repo, fn, local) {
+    const out = empty();
+    // A fallback policy that needs a sign in, set anywhere in the project, covers every endpoint that is not [AllowAnonymous].
+    let fallback = null;
+    let controllersAuthorized = null;
+    for (const file of repo.filesOf('cs')) {
+        const v = repo.view(file);
+        if (!v)
+            continue;
+        const fb = /\bFallbackPolicy\s*=/.exec(v.masked);
+        if (fb && !fallback)
+            fallback = { kind: 'session_read', scope: 'global', file, line: v.lines.at(fb.index), via: 'FallbackPolicy requires an authenticated user', enforced: true, confidence: 'high' };
+        const mc = /\.\s*MapControllers\s*\(\s*\)\s*\.\s*RequireAuthorization\b/.exec(v.masked);
+        if (mc && !controllersAuthorized)
+            controllersAuthorized = { kind: 'session_read', scope: 'router', file, line: v.lines.at(mc.index), via: 'MapControllers().RequireAuthorization()', enforced: true, confidence: 'high' };
+    }
+    const analyse = (v, start, end, seeds, decos, extra, anonymous) => {
+        const a = analyzeLight(v, { start, end, seeds, decorators: decos, extra, lookup: fn.find, local });
+        if (anonymous)
+            a.protections = a.protections.filter((p) => !(AUTH_KINDS.has(p.kind) && (p.scope === 'router' || p.scope === 'wrapper' || p.scope === 'global' || p.scope === 'middleware')));
+        return a;
+    };
+    for (const file of dotnetFiles(repo)) {
+        const v = repo.view(file);
+        if (!v)
+            continue;
+        const m = v.masked;
+        // ---- controllers (a class is at the top of the file, or inside a block scoped namespace)
+        const ranges = [[0, m.length]];
+        for (const ns of m.matchAll(/\bnamespace\s+[\w.]+\s*\{/g)) {
+            const open = ns.index + ns[0].length - 1;
+            const close = closeOf(m, open);
+            if (close > 0)
+                ranges.push([open + 1, close - 1]);
+        }
+        for (const cls of ranges.flatMap(([a, b]) => attributeBlocks(v, a, b))) {
+            const decl = /^(?:(?:public|internal|abstract|sealed|partial)\s+)*class\s+(\w+)\s*(?:\((?:[^()]|\([^()]*\))*\))?\s*(?::\s*([^{]+?))?\s*\{/.exec(m.slice(cls.declStart, cls.declStart + 500));
+            if (!decl)
+                continue;
+            const names = cls.attrs.map((a) => a.name);
+            if (!(names.includes('ApiController') || names.includes('Controller') || /\b(?:ControllerBase|Controller)\b/.test(decl[2] ?? '') || /\wController$/.test(decl[1])))
+                continue;
+            const className = decl[1];
+            const controller = className.replace(/Controller$/, '');
+            const bodyOpen = cls.declStart + decl[0].length - 1;
+            const bodyClose = closeOf(m, bodyOpen);
+            if (bodyClose < 0)
+                continue;
+            const classRoute = cls.attrs.find((a) => a.name === 'Route');
+            const classTemplate = classRoute ? strings(classRoute.args)[0] ?? '' : '';
+            const classAnon = names.includes('AllowAnonymous');
+            const classDeco = { view: v, start: cls.start, end: cls.end, scope: 'router' };
+            for (const blk of attributeBlocks(v, bodyOpen + 1, bodyClose - 1)) {
+                const verbs = blk.attrs.filter((a) => HTTP[a.name] || a.name === 'AcceptVerbs');
+                const routeAttr = blk.attrs.find((a) => a.name === 'Route');
+                if (!verbs.length && !routeAttr)
+                    continue;
+                const nameAt = /(\w+)\s*(?:<[^>]*>)?\s*\(/.exec(m.slice(blk.declStart, blk.declStart + 400));
+                if (!nameAt)
+                    continue;
+                const f = cMethod(m, blk.declStart + nameAt.index);
+                if (!f)
+                    continue;
+                const action = nameAt[1];
+                const anonymous = classAnon || blk.attrs.some((a) => a.name === 'AllowAnonymous');
+                const decos = [{ view: v, start: blk.start, end: blk.end, scope: 'wrapper' }];
+                if (cls.attrs.length)
+                    decos.push(classDeco);
+                const extra = anonymous ? [] : [fallback, controllersAuthorized].filter((x) => !!x);
+                const seeds = seedsOf(f.params);
+                const methodList = verbs.length ? verbs.flatMap((a) => (HTTP[a.name] ? [{ verb: HTTP[a.name], attr: a }] : [...a.args.matchAll(/"([A-Za-z]+)"/g)].map((x) => ({ verb: x[1].toUpperCase(), attr: a })))) : [{ verb: 'ANY', attr: routeAttr }];
+                for (const { verb, attr } of methodList) {
+                    const own = strings(attr.args)[0];
+                    const template = own === undefined && routeAttr && attr !== routeAttr ? strings(routeAttr.args)[0] : own;
+                    let full;
+                    const tpl = template === undefined ? undefined : tokens(template, controller, action);
+                    const ctpl = tokens(classTemplate, controller, action);
+                    if (tpl !== undefined && /^~?\//.test(tpl))
+                        full = tpl.replace(/^~/, '');
+                    else
+                        full = joinPath(ctpl ? '/' + ctpl.replace(/^\//, '') : '', tpl ?? '') || '/';
+                    const path = cleanPath(full);
+                    const an = analyse(v, blk.declStart, f.end, seeds, decos, extra, anonymous);
+                    out.entries.push(makeEntry(repo, {
+                        kind: 'http_route', framework: 'aspnet', file, line: v.lines.at(attr.start), method: verb, path: path.startsWith('/') ? path : '/' + path, name: `${className}.${action}`,
+                        confidence: classTemplate || template !== undefined ? 'high' : 'medium', handlerView: v, spec: { start: blk.declStart, end: f.end, seeds }, analysis: an,
+                    }));
+                }
+            }
+        }
+        // ---- minimal APIs
+        const groups = new Map();
+        for (const g of m.matchAll(/\b(?:var|RouteGroupBuilder)\s+(\w+)\s*=\s*(\w+)\s*\.\s*MapGroup\s*\(/g)) {
+            const open = g.index + g[0].length - 1;
+            const close = closeOf(m, open);
+            if (close < 0)
+                continue;
+            const semi = m.indexOf(';', close);
+            const parent = groups.get(g[2]);
+            const lit = strings(v.text.slice(open, close))[0] ?? '';
+            const chainText = m.slice(close, semi < 0 ? close : semi);
+            groups.set(g[1], { prefix: joinPath(parent?.prefix ?? '', lit), chain: { start: close, end: semi < 0 ? close : semi, view: v }, anonymous: (parent?.anonymous ?? false) || /\.\s*AllowAnonymous\s*\(/.test(chainText) });
+        }
+        for (const mp of m.matchAll(/\b(\w+)\s*\.\s*Map(Get|Post|Put|Delete|Patch|Methods)\s*\(/g)) {
+            const recv = mp[1];
+            const grp = groups.get(recv);
+            if (!grp && recv !== 'app' && recv !== 'endpoints' && recv !== 'builder')
+                continue;
+            const open = mp.index + mp[0].length - 1;
+            const close = closeOf(m, open);
+            if (close < 0)
+                continue;
+            const args = splitArgs(m, open);
+            if (!args.length)
+                continue;
+            const pathLit = strings(v.text.slice(args[0].start, args[0].end))[0];
+            if (pathLit === undefined)
+                continue;
+            const semi = m.indexOf(';', close);
+            const chain = { start: close, end: semi < 0 ? close : semi };
+            const chainText = m.slice(chain.start, chain.end);
+            const anonymous = /\.\s*AllowAnonymous\s*\(/.test(chainText) || !!grp?.anonymous;
+            const verbs = mp[2] === 'Methods' ? [...v.text.slice(args[1]?.start ?? 0, args[1]?.end ?? 0).matchAll(/"([A-Za-z]+)"/g)].map((x) => x[1].toUpperCase()) : [mp[2].toUpperCase()];
+            const handler = args[args.length - 1];
+            if (!handler || args.length < 2)
+                continue;
+            const htext = m.slice(handler.start, handler.end);
+            let seeds = [];
+            let start = handler.start;
+            let end = handler.end;
+            let hv = v;
+            const lam = /^(?:static\s+)?(?:async\s+)?\(([^)]*)\)\s*=>/.exec(htext) ?? /^(?:static\s+)?(?:async\s+)?(\w+)\s*=>/.exec(htext);
+            if (lam)
+                seeds = seedsOf(v.text.slice(handler.start + htext.indexOf(lam[1]), handler.start + htext.indexOf(lam[1]) + lam[1].length));
+            else {
+                const nm = /(\w+)\s*$/.exec(htext)?.[1];
+                const ref = nm ? fn.find(nm, file) : null;
+                if (ref) {
+                    hv = ref.view;
+                    start = ref.start;
+                    end = ref.end;
+                    const op = ref.view.masked.indexOf('(', ref.start);
+                    const pc = op >= 0 ? closeOf(ref.view.masked, op) : -1;
+                    if (pc > 0)
+                        seeds = seedsOf(ref.view.text.slice(op + 1, pc - 1));
+                }
+            }
+            const decos = [{ view: v, start: chain.start, end: chain.end, scope: 'wrapper' }];
+            if (grp?.chain)
+                decos.push({ view: grp.chain.view, start: grp.chain.start, end: grp.chain.end, scope: 'router' });
+            const extra = anonymous ? [] : [fallback].filter((x) => !!x);
+            for (const verb of verbs) {
+                const path = cleanPath(joinPath(grp?.prefix ?? '', pathLit));
+                const an = analyse(hv, start, end, seeds, decos, extra, anonymous);
+                out.entries.push(makeEntry(repo, {
+                    kind: 'http_route', framework: 'aspnet', file, line: v.lines.at(mp.index), method: verb, path, name: null,
+                    confidence: 'high', handlerView: hv, spec: { start, end, seeds }, analysis: an,
+                }));
+            }
+        }
+    }
+    return out;
+}

package/dist/map/entry.js

@@ -0,0 +1,78 @@
+import { testCodeReason } from '../report/test-code.js';
+import { analyze } from './analyze.js';
+import { ADMIN_PATH, AUTH_ENDPOINT, PUBLIC_PATH } from './vocab.js';
+const STATE_METHODS = new Set(['POST', 'PUT', 'PATCH', 'DELETE']);
+const WEBHOOK_HEADER = /[xX]-[\w-]*[sS]ignature|stripe-signature|paystack-signature|svix-signature|webhook-signature|HTTP_X_\w*SIGNATURE|x-hub-signature/i;
+// Path text with every parameter style written :name, and catch-alls written *name.
+export function normPath(p) {
+    return p
+        .replace(/\[\[?\.\.\.(\w+)\]?\]/g, '*$1').replace(/\[(\w+)\]/g, ':$1')
+        .replace(/<(?:[\w.]+:)?(\w+)>/g, ':$1').replace(/\{(\w+)(?::[^}]*)?\}/g, ':$1')
+        .replace(/\(\?P<(\w+)>[^)]*\)/g, ':$1')
+        .replace(/\/{2,}/g, '/');
+}
+export function joinPath(prefix, path) {
+    const j = `${prefix.replace(/\/+$/, '')}/${path.replace(/^\/+/, '')}`;
+    return normPath(j === '/' ? '/' : j.replace(/\/+$/, '') || '/');
+}
+export function makeEntry(repo, s) {
+    const hv = s.handlerView;
+    const a = s.analysis ?? analyze(hv, s.spec, repo.helpers(hv.lang));
+    const pathText = `${s.path ?? ''} ${s.name ?? ''}`;
+    const handlerText = hv.text.slice(s.spec.start, s.spec.end);
+    const hasSig = a.protections.some((p) => p.kind === 'signature_verify' && p.confidence === 'high' && /signature verify|hmac|svix/.test(p.via));
+    const webhook = s.kind === 'webhook' || (s.kind === 'http_route' && (/webhook/i.test(pathText) || /(^|\/)webhooks?(\/|\.|$)/i.test(s.file) || WEBHOOK_HEADER.test(handlerText) || hasSig && /hook/i.test(`${s.file} ${pathText}`)));
+    const kind = webhook ? 'webhook' : s.kind;
+    const method = s.method;
+    const tags = new Set(s.tags ?? []);
+    if (webhook)
+        tags.add('webhook');
+    const nameIsHandler = s.path === null || ['flask', 'fastapi', 'django', 'nest', 'quart', 'sanic', 'next-app', 'next-pages'].includes(s.framework);
+    if (AUTH_ENDPOINT.test(s.path ?? '') || (nameIsHandler && s.framework !== 'next-app' && AUTH_ENDPOINT.test((s.name ?? '').replace(/([a-z])([A-Z])/g, '$1_$2'))))
+        tags.add('auth_endpoint');
+    if (ADMIN_PATH.test(s.path ?? '') || ADMIN_PATH.test(s.file))
+        tags.add('admin');
+    if (PUBLIC_PATH.test(s.path ?? ''))
+        tags.add('public');
+    if (a.reads.some((r) => r.source === 'file'))
+        tags.add('upload');
+    const writes = a.data.some((d) => d.op === 'write' || d.op === 'delete');
+    if (kind === 'server_action' || (method && STATE_METHODS.has(method)) || ((method === 'ANY' || method === null) && (writes || a.reads.some((r) => r.source === 'body' || r.source === 'form')) && (kind === 'http_route' || kind === 'webhook')))
+        tags.add('state_changing');
+    const clientPage = s.kind === 'page' && /^\s*(?:\/\/[^\n]*\n\s*)*['"]use client['"]/.test(hv.text.slice(0, 400));
+    if (clientPage)
+        tags.add('client_component');
+    const handler = hv.file === s.file && s.spec.start >= 0 && hv.lines.at(s.spec.start) === s.line ? null : { file: hv.file, line: hv.lines.at(s.spec.start) };
+    return {
+        id: `${s.file}:${s.line}:${kind}:${method ?? '-'}:${s.path ?? '-'}:${s.name ?? '-'}`,
+        kind, framework: s.framework, file: s.file, line: s.line,
+        end_line: hv.lines.at(Math.max(s.spec.start, s.spec.end - 1)),
+        method, path: s.path, name: s.name, handler, confidence: s.confidence,
+        test_code: testCodeReason(s.file) !== null, tags: [...tags].sort(),
+        protections: clientPage ? [] : a.protections, reads: clientPage ? [] : a.reads, data: clientPage ? [] : a.data, outbound: clientPage ? [] : a.outbound,
+    };
+}
+// Parameter names of the function whose "(" is at `open` in masked text: plain names and the names inside destructuring.
+export function paramNames(masked, open) {
+    let depth = 0;
+    let end = open;
+    for (let i = open; i < masked.length; i++) {
+        const c = masked[i];
+        if (c === '(')
+            depth++;
+        else if (c === ')') {
+            depth--;
+            if (depth === 0) {
+                end = i;
+                break;
+            }
+        }
+    }
+    const inner = masked.slice(open + 1, end).replace(/:[^,={}()]*(?:<[^>]*>)?/g, ' ').replace(/=[^,}]*/g, ' ');
+    const out = [];
+    for (const m of inner.matchAll(/(?<![.\w$@])([A-Za-z_$][\w$]*)/g))
+        if (!['async', 'this', 'self', 'cls'].includes(m[1]))
+            out.push(m[1]);
+    return out;
+}
+export const empty = () => ({ entries: [], gates: [], mounts: [] });