hullproof 0.0.0-stage → 0.5.0

package/dist/map/js-misc.js

@@ -0,0 +1,295 @@
+import { empty, joinPath, makeEntry, paramNames } from './entry.js';
+import { closeOf, jsFunction, splitArgs } from './lex.js';
+import { paramsOf, resolveFunction } from './js-next.js';
+const NEST_VERBS = /@(Get|Post|Put|Patch|Delete|All|Options|Head)\s*\(/g;
+const NEST_OTHER = /@(Query|Mutation|Subscription|ResolveField|MessagePattern|EventPattern|SubscribeMessage|Cron|Interval|Timeout|Process)\s*\(/g;
+const PUBLIC_MARK = /@(?:Public|AllowAnonymous|SkipAuth|IsPublic|NoAuth|AllowUnauthenticated)\s*\(/;
+const dtoCache = new WeakMap();
+// Whether a class of this name in the repository carries class-validator decorators.
+function dtoValidated(repo, name) {
+    let cache = dtoCache.get(repo);
+    if (!cache) {
+        cache = new Map();
+        dtoCache.set(repo, cache);
+    }
+    const hit = cache.get(name);
+    if (hit !== undefined)
+        return hit;
+    let ok = false;
+    for (const f of repo.filesOf('js')) {
+        const t = repo.ctx.text(f);
+        const m = new RegExp(`class\\s+${name}\\b[^{]*\\{`).exec(t);
+        if (!m)
+            continue;
+        const body = t.slice(m.index, m.index + 4000);
+        if (/@(?:Is[A-Z]\w*|Min|Max|Length|MinLength|MaxLength|Matches|Validate\w*|Allow|ArrayMaxSize|ArrayMinSize|Contains|NotEquals|Equals|IsOptional)\s*\(/.test(body)) {
+            ok = true;
+            break;
+        }
+    }
+    cache.set(name, ok);
+    return ok;
+}
+export function extractNest(repo, v) {
+    const out = empty();
+    if (!/@(?:Controller|Resolver|Cron|Interval|Timeout|MessagePattern|EventPattern|SubscribeMessage|Process|Processor)\s*\(|APP_GUARD|useGlobalPipes|consumer\s*\.\s*apply\s*\(/.test(v.text))
+        return out;
+    const { masked, text } = v;
+    // Global guards and pipes become gates.
+    for (const m of masked.matchAll(/provide\s*:\s*APP_GUARD/g)) {
+        const seg = text.slice(m.index, m.index + 160);
+        const cls = /useClass\s*:\s*([A-Za-z_$][\w$]*)/.exec(seg)?.[1] ?? 'APP_GUARD';
+        const protections = [];
+        const line = v.lines.at(m.index);
+        if (/auth|jwt|session|firebase|supabase/i.test(cls))
+            protections.push({ kind: 'session_read', scope: 'global', file: v.file, line, via: `APP_GUARD ${cls}`, enforced: true, confidence: 'medium' });
+        if (/role|permission|admin|abac|casl/i.test(cls))
+            protections.push({ kind: 'role_check', scope: 'global', file: v.file, line, via: `APP_GUARD ${cls}`, enforced: true, confidence: 'medium' });
+        if (/throttl|rate/i.test(cls))
+            protections.push({ kind: 'rate_limit', scope: 'global', file: v.file, line, via: `APP_GUARD ${cls}`, enforced: true, confidence: 'high' });
+        if (protections.length)
+            out.gates.push({ id: `${v.file}:${line}:APP_GUARD:${cls}`, kind: 'guard', framework: 'nest', file: v.file, line, paths: ['*'], methods: [], protections, confidence: 'medium' });
+    }
+    // Module middleware: consumer.apply(AuthMiddleware).forRoutes('path', { path: 'x', method: RequestMethod.GET }). One gate per route spec.
+    for (const m of masked.matchAll(/\.\s*apply\s*\(([^)]*)\)/g)) {
+        const statementEnd = masked.indexOf(';', m.index);
+        const chain = text.slice(m.index, statementEnd < 0 ? m.index + 600 : statementEnd);
+        const fr = /\.\s*forRoutes\s*\(/.exec(chain);
+        if (!fr)
+            continue;
+        const names = [...m[1].matchAll(/[A-Za-z_$][\w$]*/g)].map((x) => x[0]).filter((x) => !/^(?:new|function|req|res|next)$/.test(x));
+        const line = v.lines.at(m.index);
+        const protections = [];
+        for (const n of names) {
+            if (/auth|jwt|session|firebase|supabase|login|token/i.test(n))
+                protections.push({ kind: 'session_read', scope: 'middleware', file: v.file, line, via: `module middleware ${n}`, enforced: null, confidence: 'medium' });
+            if (/role|permission|admin|abac|casl/i.test(n))
+                protections.push({ kind: 'role_check', scope: 'middleware', file: v.file, line, via: `module middleware ${n}`, enforced: null, confidence: 'medium' });
+            if (/throttl|rate/i.test(n))
+                protections.push({ kind: 'rate_limit', scope: 'middleware', file: v.file, line, via: `module middleware ${n}`, enforced: null, confidence: 'medium' });
+        }
+        if (!protections.length)
+            continue;
+        const open = m.index + chain.indexOf('forRoutes') + 'forRoutes'.length;
+        const args = text.slice(text.indexOf('(', open - 1) + 1, text.indexOf(')', open - 1 + chain.slice(chain.indexOf('forRoutes')).length)).trim();
+        const specs = [];
+        for (const o of args.matchAll(/\{\s*path\s*:\s*['"`]([^'"`]*)['"`]\s*,\s*method\s*:\s*RequestMethod\.(\w+)\s*\}/g))
+            specs.push({ path: o[1], methods: o[2] === 'ALL' ? [] : [o[2]] });
+        const rest = args.replace(/\{[^}]*\}/g, ' ');
+        for (const sx of rest.matchAll(/['"`]([^'"`]*)['"`]/g))
+            specs.push({ path: sx[1], methods: [] });
+        if (!specs.length && /^\s*\*\s*$|['"`]\*['"`]/.test(args))
+            specs.push({ path: '*', methods: [] });
+        specs.forEach((sp, i) => {
+            const star = sp.path.replace(/\/?\*.*$/, '');
+            const gp = sp.path === '*' ? '*' : joinPath('/', star);
+            out.gates.push({ id: `${v.file}:${line}:forRoutes:${i}`, kind: 'middleware', framework: 'nest', file: v.file, line, paths: [gp], methods: sp.methods, protections, confidence: 'medium' });
+        });
+    }
+    for (const m of masked.matchAll(/useGlobalPipes\s*\(\s*new\s+ValidationPipe/g)) {
+        const line = v.lines.at(m.index);
+        const g = { id: `${v.file}:${line}:ValidationPipe`, kind: 'global_pipe', framework: 'nest', file: v.file, line, paths: ['*'], methods: [], protections: [{ kind: 'input_validation', scope: 'global', file: v.file, line, via: 'global ValidationPipe', enforced: true, confidence: 'medium' }], confidence: 'medium' };
+        out.gates.push(g);
+    }
+    for (const cm of masked.matchAll(/(?<![\w$])class\s+([A-Za-z_$][\w$]*)\b/g)) {
+        const classKw = cm.index;
+        let ds = classKw;
+        for (let k = classKw - 1; k >= 0 && classKw - k < 900; k--) {
+            const c = masked[k];
+            if (c === '}' || c === ';')
+                break;
+            ds = k;
+        }
+        const classDeco = text.slice(ds, classKw);
+        const bodyOpen = masked.indexOf('{', classKw);
+        if (bodyOpen < 0)
+            continue;
+        const bodyClose = closeOf(masked, bodyOpen);
+        if (bodyClose < 0)
+            continue;
+        const isController = /@Controller\s*\(/.test(classDeco);
+        const isResolver = /@Resolver\s*\(/.test(classDeco);
+        const prefix = isController ? (/@Controller\s*\(\s*(?:['"`]([^'"`]*)['"`]|\{[^}]*?path\s*:\s*['"`]([^'"`]*)['"`])/.exec(classDeco)?.slice(1).find((x) => x !== undefined) ?? '') : '';
+        const body = masked.slice(bodyOpen, bodyClose);
+        const verbRe = isController ? NEST_VERBS : NEST_OTHER;
+        verbRe.lastIndex = 0;
+        const hits = [...body.matchAll(isController ? NEST_VERBS : new RegExp(NEST_OTHER.source, 'g'))];
+        if (!hits.length)
+            continue;
+        for (const h of hits) {
+            const at = bodyOpen + h.index;
+            const decoOpen = at + h[0].length - 1;
+            const decoClose = closeOf(masked, decoOpen);
+            if (decoClose < 0)
+                continue;
+            // Skip further decorators, then read the method name and signature.
+            let i = decoClose;
+            for (;;) {
+                const nxt = /^\s*@[\w$.]+\s*(?:\()?/.exec(masked.slice(i, i + 80));
+                if (!nxt)
+                    break;
+                const o = i + nxt[0].length - 1;
+                if (masked[o] === '(') {
+                    const c = closeOf(masked, o);
+                    if (c < 0)
+                        break;
+                    i = c;
+                }
+                else
+                    i += nxt[0].length;
+            }
+            const sig = /^\s*(?:(?:public|private|protected|async|static|override)\s+)*([A-Za-z_$][\w$]*)\s*(?:<[^>(]*>)?\s*\(/.exec(masked.slice(i, i + 200));
+            if (!sig)
+                continue;
+            const parenIdx = i + sig[0].length - 1;
+            const f = jsFunction(masked, parenIdx, true);
+            if (!f)
+                continue;
+            let ms = at;
+            for (let k = at - 1; k > bodyOpen && at - k < 700; k--) {
+                const c = masked[k];
+                if (c === '}' || c === ';' || c === '{')
+                    break;
+                ms = k;
+            }
+            const methodDeco = text.slice(ms, at + (decoClose - at));
+            const argText = text.slice(decoOpen + 1, decoClose - 1);
+            const litPath = /^\s*['"`]([^'"`]*)['"`]/.exec(argText)?.[1] ?? '';
+            const deco = [{ view: v, start: ds, end: classKw, scope: 'router' }, { view: v, start: ms, end: i, scope: 'handler' }];
+            const name = sig[1];
+            const params = paramNames(masked, parenIdx);
+            let kind = 'http_route';
+            let method = h[1].toUpperCase();
+            let path = null;
+            if (isController) {
+                method = h[1] === 'All' ? 'ANY' : h[1].toUpperCase();
+                path = joinPath('/' + prefix, litPath);
+                if (path === '')
+                    path = '/';
+            }
+            else if (/^(?:Query|Mutation|Subscription|ResolveField)$/.test(h[1])) {
+                kind = 'graphql_resolver';
+                method = h[1] === 'ResolveField' ? 'FIELD' : h[1].toUpperCase();
+                path = name;
+            }
+            else if (/^(?:MessagePattern|EventPattern)$/.test(h[1])) {
+                kind = 'message_consumer';
+                method = null;
+                path = litPath || argText.trim().slice(0, 60) || name;
+            }
+            else if (h[1] === 'SubscribeMessage') {
+                kind = 'websocket';
+                method = null;
+                path = litPath || name;
+            }
+            else {
+                kind = 'job';
+                method = null;
+                path = litPath || (argText.trim().slice(0, 40) || name);
+            }
+            if (!isController && !isResolver && kind === 'graphql_resolver')
+                continue;
+            const e = makeEntry(repo, { kind, framework: 'nest', file: v.file, line: v.lines.at(at), method, path, name, confidence: 'high', handlerView: v, spec: { start: f.start, end: f.end, seeds: params, decorators: deco, extraCalls: [], returnsJson: true }, tags: PUBLIC_MARK.test(classDeco) || PUBLIC_MARK.test(methodDeco) ? ['public'] : [] });
+            // Parameter decorators are request reads; a typed @Body() is checked against class-validator decorators on the DTO.
+            const sigText = text.slice(parenIdx, f.bodyStart);
+            const reads = [['body', /@Body\s*\(/], ['query', /@Query\s*\(/], ['params', /@Param\s*\(/], ['headers', /@Headers?\s*\(/], ['file', /@(?:UploadedFiles?|UploadedFile)\s*\(/]];
+            for (const [source, re] of reads) {
+                const rm = re.exec(sigText);
+                if (rm && !e.reads.some((r) => r.source === source))
+                    e.reads.push({ source, line: v.lines.at(parenIdx + rm.index) });
+            }
+            if (e.reads.some((r) => r.source === 'file') && !e.tags.includes('upload'))
+                e.tags = [...e.tags, 'upload'].sort();
+            if (/@(?:UseInterceptors\s*\(\s*(?:FileInterceptor|FilesInterceptor))/.test(methodDeco) && !e.reads.some((r) => r.source === 'file'))
+                e.reads.push({ source: 'file', line: e.line });
+            for (const dm of sigText.matchAll(/@Body\s*\([^)]*\)\s*[A-Za-z_$][\w$]*\s*:\s*([A-Z][\w$]*)/g)) {
+                if (dtoValidated(repo, dm[1]))
+                    e.protections.push({ kind: 'input_validation', scope: 'handler', file: v.file, line: v.lines.at(parenIdx + dm.index), via: `DTO ${dm[1]}`, enforced: null, confidence: 'medium' });
+            }
+            e.protections.sort((a, b) => a.line - b.line || (a.kind < b.kind ? -1 : a.kind > b.kind ? 1 : 0) || (a.via < b.via ? -1 : a.via > b.via ? 1 : 0));
+            e.reads.sort((a, b) => (a.source < b.source ? -1 : 1));
+            out.entries.push(e);
+        }
+    }
+    return out;
+}
+const JOB_CALL = /(?<![\w$])(cron\.schedule|schedule\.scheduleJob|scheduleJob|new\s+CronJob|agenda\.define|new\s+Worker|\w*[qQ]ueue\w*\.process|boss\.work|inngest\.createFunction|\w+\.addRepeatableJob|setInterval)\s*\(/g;
+export function extractJobs(repo, v) {
+    const out = empty();
+    if (!/cron|schedule|agenda|Worker|[qQ]ueue|boss|inngest/.test(v.text))
+        return out;
+    for (const m of v.masked.matchAll(JOB_CALL)) {
+        if (m[1] === 'setInterval')
+            continue;
+        const open = m.index + m[0].length - 1;
+        const args = splitArgs(v.masked, open);
+        const first = args[0];
+        const lit = first && /^['"`]/.test(v.masked[first.start]) ? v.text.slice(first.start + 1, first.end - 1) : null;
+        const fa = args.map((a) => ({ a, r: resolveFunction(repo, v, a.start, a.end) })).find((x) => x.r);
+        if (!fa?.r)
+            continue;
+        const framework = /cron|schedule/i.test(m[1]) ? 'node-cron' : /Worker|process|work/.test(m[1]) ? 'queue' : m[1];
+        out.entries.push(makeEntry(repo, { kind: 'job', framework, file: v.file, line: v.lines.at(m.index), method: null, path: lit, name: lit && !/[\s*]/.test(lit) ? lit : null, confidence: 'high', handlerView: fa.r.view, spec: { start: fa.r.start, end: fa.r.end, seeds: fa.r.params, decorators: [], returnsJson: false } }));
+    }
+    return out;
+}
+const TOOL_OBJECT = /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*(?::[^=\n]+)?=\s*\{/g;
+const TOOLISH = /tool|function|handler|action|capabilit/i;
+export function extractAiTools(repo, v) {
+    const out = empty();
+    if (!/tool|function_call|mcp|[aA]gent|llm|openai|anthropic|generateText|assistant/.test(v.text))
+        return out;
+    const seen = new Set();
+    const push = (name, f, line, framework) => {
+        if (seen.has(f.start))
+            return;
+        seen.add(f.start);
+        out.entries.push(makeEntry(repo, { kind: 'ai_tool', framework, file: v.file, line, method: null, path: null, name, confidence: 'medium', handlerView: v, spec: { start: f.start, end: f.end, seeds: paramsOf(v.masked, f).slice(0, 1), decorators: [], returnsJson: false } }));
+    };
+    // 1. An object of functions named like tools: { read_note: (args) => ..., send: async (args) => ... }
+    for (const m of v.masked.matchAll(TOOL_OBJECT)) {
+        if (!TOOLISH.test(m[1]) || !/\b(?:tool|function|openai|anthropic|llm|assistant|agent|model)/i.test(v.text))
+            continue;
+        const open = m.index + m[0].length - 1;
+        const close = closeOf(v.masked, open);
+        if (close < 0)
+            continue;
+        for (const seg of splitArgs(v.masked, open)) {
+            const head = /^(?:async\s+)?\[?['"]?([\w$-]+)['"]?\]?\s*(:|\()/.exec(v.text.slice(seg.start, seg.end).replace(/^async\s+/, 'async '));
+            if (!head)
+                continue;
+            const name = head[1];
+            let at = seg.start + head[0].length - 1;
+            if (head[2] === ':')
+                at = seg.start + head[0].length;
+            const f = jsFunction(v.masked, head[2] === '(' ? at : at);
+            if (f && f.end <= seg.end + 1)
+                push(name, f, v.lines.at(seg.start), 'ai-tools');
+        }
+    }
+    // 2. tool({ description, parameters, execute })
+    for (const m of v.masked.matchAll(/(?<![\w$])tool\s*\(\s*\{/g)) {
+        const open = v.masked.indexOf('{', m.index);
+        for (const seg of splitArgs(v.masked, open)) {
+            const ex = /^execute\s*(:|\()/.exec(v.masked.slice(seg.start, seg.end));
+            if (!ex)
+                continue;
+            const f = jsFunction(v.masked, seg.start + (ex[1] === ':' ? ex[0].length : ex[0].length - 1));
+            if (!f)
+                continue;
+            const before = v.text.slice(Math.max(0, m.index - 80), m.index);
+            const nm = /([A-Za-z_$][\w$]*)\s*(?::|=)\s*$/.exec(before)?.[1] ?? null;
+            push(nm, f, v.lines.at(m.index), 'ai-sdk');
+        }
+    }
+    // 3. MCP: server.tool('name', schema, handler)
+    for (const m of v.masked.matchAll(/\.\s*(?:tool|registerTool)\s*\(\s*(['"])/g)) {
+        const open = v.masked.indexOf('(', m.index);
+        const args = splitArgs(v.masked, open);
+        const nm = v.text.slice(args[0].start + 1, args[0].end - 1);
+        const fa = args.map((a) => jsFunction(v.masked, a.start)).filter((x) => x).pop();
+        if (fa)
+            push(nm, fa, v.lines.at(m.index), 'mcp');
+    }
+    return out;
+}

package/dist/map/js-next.js

@@ -0,0 +1,292 @@
+import { analyze } from './analyze.js';
+import { empty, joinPath, makeEntry, normPath, paramNames } from './entry.js';
+import { closeOf, jsFunction, splitArgs } from './lex.js';
+import { ADMIN_PATH } from './vocab.js';
+const METHODS = ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS'];
+export function resolveFunction(repo, v, at, limit) {
+    const m = v.masked;
+    const direct = jsFunction(m, at);
+    if (direct && direct.end <= limit + 1)
+        return { view: v, start: direct.start, end: direct.end, wrapper: null, resolved: false, params: paramsOf(m, direct) };
+    const call = /^\s*([A-Za-z_$][\w$.]*)\s*(?:<[^>(]*>)?\s*\(/.exec(m.slice(at, limit));
+    if (call) {
+        const open = at + call[0].length - 1;
+        const args = splitArgs(m, open);
+        for (const a of args) {
+            const f = jsFunction(m, a.start);
+            if (f && f.end <= a.end + 1)
+                return { view: v, start: f.start, end: f.end, wrapper: { name: call[1], from: at, to: a.start }, resolved: false, params: paramsOf(m, f) };
+        }
+        for (const a of args) {
+            const id = /^([A-Za-z_$][\w$]*)(?:\s*\([\s\S]*\))?$/.exec(m.slice(a.start, a.end));
+            if (id) {
+                const r = repo.defs('js', id[1]).filter((d) => d.view.file === v.file).concat(repo.defs('js', id[1]))[0];
+                if (r)
+                    return { view: r.view, start: r.start, end: r.end, wrapper: { name: call[1], from: at, to: a.start }, resolved: true, params: paramsOf(r.view.masked, { start: r.start, end: r.end, bodyStart: r.start }), defName: id[1] };
+            }
+        }
+        return null;
+    }
+    const id = /^\s*([A-Za-z_$][\w$]*)\s*[;,)]?\s*$/.exec(m.slice(at, limit)) ?? /^\s*(?:[A-Za-z_$][\w$]*\s*\.\s*)*([A-Za-z_$][\w$]*)\s*[;,)]?\s*$/.exec(m.slice(at, limit));
+    if (id) {
+        const defs = repo.defs('js', id[1]);
+        const r = defs.find((d) => d.view.file === v.file) ?? (defs.length === 1 ? defs[0] : null);
+        if (r)
+            return { view: r.view, start: r.start, end: r.end, wrapper: null, resolved: true, params: paramsOf(r.view.masked, { start: r.start, end: r.end, bodyStart: r.start }), defName: id[1] };
+    }
+    return null;
+}
+export function paramsOf(masked, f) {
+    const head = masked.slice(f.start, f.bodyStart);
+    const open = head.indexOf('(');
+    if (open >= 0 && (head.indexOf('=>') < 0 || open < head.indexOf('=>')))
+        return paramNames(masked, f.start + open);
+    const single = /^\s*(?:async\s+)?([A-Za-z_$][\w$]*)\s*=>/.exec(head);
+    return single ? [single[1]] : [];
+}
+export const nextRoutePath = (file, strip) => {
+    const m = /(?:^|\/)(?:src\/)?app\/(.*)$/.exec(file);
+    if (!m)
+        return null;
+    const segs = m[1].replace(strip, '').split('/').filter((s) => s && !/^\(.*\)$/.test(s) && !s.startsWith('@'));
+    return normPath('/' + segs.join('/'));
+};
+// Exported names in a file with where their value starts: export function X, export const X = ..., export { a as X }.
+export function exportedFunctions(repo, v) {
+    const m = v.masked;
+    const out = [];
+    for (const x of m.matchAll(/\bexport\s+(?:default\s+)?(?:async\s+)?function\s*\*?\s*([A-Za-z_$][\w$]*)/g)) {
+        const at = x.index + (/\bexport\s+(?:default\s+)?/.exec(x[0])[0].length);
+        const f = jsFunction(m, at);
+        if (f)
+            out.push({ exportName: x[1], r: { view: v, start: f.start, end: f.end, wrapper: null, resolved: false, params: paramsOf(m, f) }, line: v.lines.at(x.index), at });
+    }
+    for (const x of m.matchAll(/\bexport\s+const\s+([A-Za-z_$][\w$]*)\s*(?::[^=\n]+)?=\s*/g)) {
+        const at = x.index + x[0].length;
+        const limit = statementLimit(m, at);
+        const r = resolveFunction(repo, v, at, limit);
+        if (r)
+            out.push({ exportName: x[1], r, line: v.lines.at(x.index), at });
+    }
+    for (const x of m.matchAll(/\bexport\s*\{([^}]*)\}/g)) {
+        for (const part of x[1].split(',')) {
+            const [local, alias] = part.trim().split(/\s+as\s+/);
+            if (!local)
+                continue;
+            const defs = repo.defs('js', local);
+            const d = defs.find((q) => q.view.file === v.file);
+            if (d)
+                out.push({ exportName: alias ?? local, r: { view: d.view, start: d.start, end: d.end, wrapper: null, resolved: false, params: paramsOf(d.view.masked, { start: d.start, end: d.end, bodyStart: d.start }) }, line: v.lines.at(x.index), at: x.index });
+        }
+    }
+    return out;
+}
+function statementLimit(masked, from) {
+    let depth = 0;
+    for (let i = from; i < masked.length; i++) {
+        const c = masked[i];
+        if (c === '(' || c === '[' || c === '{')
+            depth++;
+        else if (c === ')' || c === ']' || c === '}') {
+            if (depth === 0)
+                return i;
+            depth--;
+        }
+        else if (c === ';' && depth === 0)
+            return i;
+        else if (c === '\n' && depth === 0 && /\n\s*(?:export|const|let|var|function|async|import|type|interface|\/\/)/.test(masked.slice(i, i + 40)))
+            return i;
+    }
+    return masked.length;
+}
+function spec(r, decorators, seeds, extra = []) {
+    const deco = decorators ?? [];
+    return { start: r.start, end: r.end, seeds, decorators: deco, extraCalls: extra, returnsJson: true };
+}
+const wrapperDeco = (v, r) => (r.wrapper ? [{ view: v, start: r.wrapper.from, end: r.wrapper.to, scope: 'wrapper' }] : []);
+export function extractNext(repo, v) {
+    const out = empty();
+    const file = v.file;
+    const text = v.text;
+    // App router route handlers.
+    if (/(?:^|\/)(?:src\/)?app\/(?:.*\/)?route\.[cm]?[jt]sx?$/.test(file)) {
+        const path = nextRoutePath(file, /\/?route\.[cm]?[jt]sx?$/);
+        for (const e of exportedFunctions(repo, v)) {
+            if (!METHODS.includes(e.exportName))
+                continue;
+            const r = e.r;
+            const seeds = r.params.length ? r.params : ['req', 'request', 'params'];
+            out.entries.push(makeEntry(repo, { kind: 'http_route', framework: 'next-app', file, line: e.line, method: e.exportName, path, name: e.exportName, confidence: 'high', handlerView: r.view, spec: spec(r, wrapperDeco(v, r), [...seeds, 'params', 'searchParams'], r.wrapper ? [r.wrapper.name.split('.').pop()] : []) }));
+        }
+    }
+    // App router pages.
+    if (/(?:^|\/)(?:src\/)?app\/(?:.*\/)?page\.[cm]?[jt]sx?$/.test(file)) {
+        const path = nextRoutePath(file, /\/?page\.[cm]?[jt]sx?$/);
+        const ex = defaultExport(repo, v);
+        if (ex) {
+            const r = ex.r;
+            out.entries.push(makeEntry(repo, { kind: 'page', framework: 'next-app', file, line: v.lines.at(r.start), method: 'GET', path, name: ex.exportName, confidence: 'high', handlerView: r.view, spec: spec(r, [], ['params', 'searchParams', ...r.params]) }));
+        }
+    }
+    // Pages router API routes.
+    if (/(?:^|\/)(?:src\/)?pages\/api\/.+\.[cm]?[jt]sx?$/.test(file)) {
+        const path = normPath('/api/' + (/pages\/api\/(.*)$/.exec(file)[1]).replace(/\.[cm]?[jt]sx?$/, '').replace(/\/?index$/, ''));
+        const ex = defaultExport(repo, v);
+        if (ex) {
+            const r = ex.r;
+            const methods = [...new Set([...v.text.slice(r.start, r.end).matchAll(/\bmethod\s*(?:===?|!==?)\s*['"](\w+)['"]|\bcase\s+['"](GET|POST|PUT|PATCH|DELETE)['"]/g)].map((x) => (x[1] ?? x[2]).toUpperCase()))].filter((x) => METHODS.includes(x)).sort();
+            for (const method of methods.length ? methods : ['ANY']) {
+                out.entries.push(makeEntry(repo, { kind: 'http_route', framework: 'next-pages', file, line: v.lines.at(r.start), method, path, name: ex.exportName, confidence: 'high', handlerView: r.view, spec: spec(r, wrapperDeco(v, r), r.params.length ? r.params : ['req'], r.wrapper ? [r.wrapper.name.split('.').pop()] : []) }));
+            }
+        }
+    }
+    // Server actions: a "use server" file, or the directive inside a function.
+    const fileDirective = /^\s*(?:\/\/[^\n]*\n\s*|\/\*[\s\S]*?\*\/\s*)*['"]use server['"]/.test(text);
+    if (fileDirective) {
+        for (const e of exportedFunctions(repo, v)) {
+            const r = e.r;
+            out.entries.push(makeEntry(repo, { kind: 'server_action', framework: 'next-app', file, line: v.lines.at(r.start), method: 'POST', path: null, name: e.exportName, confidence: 'high', handlerView: r.view, spec: spec(r, wrapperDeco(v, r), r.params, r.wrapper ? [r.wrapper.name.split('.').pop()] : []) }));
+        }
+    }
+    else if (/['"]use server['"]/.test(text)) {
+        for (const x of v.masked.matchAll(/(?:\basync\s+)?function\s+([A-Za-z_$][\w$]*)\s*\(|\b(?:const|let)\s+([A-Za-z_$][\w$]*)\s*=\s*async\s*\(/g)) {
+            const at = x.index;
+            const f = jsFunction(v.masked, at);
+            if (!f || !/^\s*\{\s*['"]use server['"]/.test(text.slice(f.bodyStart, f.bodyStart + 60)))
+                continue;
+            out.entries.push(makeEntry(repo, { kind: 'server_action', framework: 'next-app', file, line: v.lines.at(at), method: 'POST', path: null, name: x[1] ?? x[2], confidence: 'high', handlerView: v, spec: { start: f.start, end: f.end, seeds: paramsOf(v.masked, f), decorators: [], returnsJson: true } }));
+        }
+    }
+    // Middleware (a gate, not an entry point).
+    if (/(?:^|\/)(?:src\/)?(?:middleware|proxy)\.[cm]?[jt]s$/.test(file)) {
+        const named = exportedFunctions(repo, v).find((e) => e.exportName === 'middleware' || e.exportName === 'proxy');
+        const dflt = named ? null : defaultExport(repo, v);
+        const fn = named ? { r: named.r } : dflt ? { r: dflt.r } : null;
+        if (fn) {
+            const a = analyze(v, spec(fn.r, wrapperDeco(v, fn.r), fn.r.params.length ? fn.r.params : ['req', 'request']), repo.helpers('js'));
+            const matcher = /\bmatcher\s*:\s*(\[[^\]]*\]|['"][^'"]*['"])/.exec(text);
+            const matcherPaths = matcher ? [...matcher[1].matchAll(/['"]([^'"]*)['"]/g)].map((x) => gatePrefix(x[1])) : [];
+            // A check inside "if (pathname.startsWith('/admin'))" covers only those prefixes, not the whole matcher.
+            const blocks = [...v.masked.slice(fn.r.start, fn.r.end).matchAll(/\bif\s*\(/g)].map((x) => {
+                const open = fn.r.start + x.index + x[0].length - 1;
+                const condEnd = closeOf(v.masked, open);
+                if (condEnd < 0)
+                    return null;
+                const prefixes = [...text.slice(open, condEnd).matchAll(/startsWith\(\s*['"](\/[^'"]*)['"]/g)].map((y) => normPath(y[1].replace(/\/$/, '') || '/'));
+                const b = v.masked.indexOf('{', condEnd);
+                const bEnd = b < 0 ? -1 : closeOf(v.masked, b);
+                return prefixes.length && b >= 0 && bEnd > 0 && /^\s*\{/.test(v.masked.slice(condEnd, b + 1)) ? { start: b, end: bEnd, prefixes } : null;
+            }).filter((x) => x !== null);
+            const groups = new Map();
+            const blockAt = (pos) => blocks.filter((b) => pos >= b.start && pos <= b.end).sort((x, y) => (x.end - x.start) - (y.end - y.start))[0];
+            for (const p of a.protections.filter((q) => q.kind !== 'owner_filter')) {
+                const at = v.lines.start(p.line);
+                let prefixes = blockAt(at)?.prefixes ?? null;
+                if (!prefixes) {
+                    // The value is stored in a variable and tested later: use the blocks that test it, when all of them are inside one.
+                    const lineText = text.slice(at, text.indexOf('\n', at) < 0 ? text.length : text.indexOf('\n', at));
+                    const name = /(?:const|let|var)\s+(\w+)\s*=/.exec(lineText)?.[1];
+                    if (name) {
+                        const uses = [...v.masked.slice(fn.r.start, fn.r.end).matchAll(new RegExp(`(?<![\\w$.])${name}\\b`, 'g'))].map((x) => fn.r.start + x.index).filter((pos) => v.lines.at(pos) !== p.line);
+                        const inBlocks = uses.map((pos) => blockAt(pos));
+                        if (uses.length && inBlocks.every((b) => b))
+                            prefixes = [...new Set(inBlocks.flatMap((b) => b.prefixes))];
+                    }
+                }
+                const key = prefixes ? [...new Set(prefixes)].sort().join('\u0000') : '*';
+                groups.set(key, [...(groups.get(key) ?? []), { ...p, scope: 'middleware' }]);
+            }
+            for (const [key, protections] of [...groups.entries()].sort()) {
+                const paths = key === '*' ? (matcherPaths.length ? [...new Set(matcherPaths)].sort() : ['*']) : key.split('\u0000');
+                const gate = {
+                    id: `${file}:${v.lines.at(fn.r.start)}:middleware:${key === '*' ? 'all' : paths.join(',')}`, kind: 'middleware', framework: 'next-app', file, line: v.lines.at(fn.r.start),
+                    paths, methods: [], protections, confidence: 'medium',
+                };
+                out.gates.push(gate);
+            }
+        }
+    }
+    // Supabase edge functions.
+    const edge = /(?:^|\/)supabase\/functions\/([^/_][^/]*)\/index\.[cm]?[jt]sx?$/.exec(file);
+    if (edge) {
+        const serve = /\b(?:Deno\.)?serve\s*\(/.exec(v.masked);
+        if (serve) {
+            const open = serve.index + serve[0].length - 1;
+            const args = splitArgs(v.masked, open);
+            const fa = args.map((a) => ({ a, r: resolveFunction(repo, v, a.start, a.end) })).find((x) => x.r);
+            if (fa?.r) {
+                const e = makeEntry(repo, { kind: 'http_route', framework: 'supabase-edge', file, line: v.lines.at(serve.index), method: 'ANY', path: `/functions/v1/${edge[1]}`, name: edge[1], confidence: 'high', handlerView: fa.r.view, spec: spec(fa.r, [], fa.r.params.length ? fa.r.params : ['req', 'request']) });
+                const cfg = repo.ctx.text('supabase/config.toml');
+                const sec = new RegExp(`\\[functions\\.${edge[1].replace(/[-\\^$*+?.()|[\]{}]/g, '\\$&')}\\]([^\\[]*)`).exec(cfg);
+                const off = sec ? /verify_jwt\s*=\s*false/.test(sec[1]) : false;
+                if (!off)
+                    e.protections.push({ kind: 'session_read', scope: 'global', file: cfg ? 'supabase/config.toml' : file, line: 1, via: 'supabase verify_jwt (default on)', enforced: true, confidence: cfg ? 'high' : 'medium' });
+                e.protections.sort((x, y) => x.line - y.line || (x.kind < y.kind ? -1 : 1));
+                out.entries.push(e);
+            }
+        }
+    }
+    // tRPC procedures.
+    if (/[pP]rocedure\b/.test(v.masked) && /trpc|Procedure/.test(v.imports + v.text.slice(0, 3000))) {
+        for (const x of v.masked.matchAll(/(?<![.\w$])([A-Za-z_$][\w$]*)\s*:\s*([A-Za-z_$][\w$]*[pP]rocedure)\b/g)) {
+            let i = x.index + x[0].length;
+            let verb = null;
+            let handler = null;
+            const chain = [];
+            for (let guard = 0; guard < 12; guard++) {
+                while (/\s/.test(v.masked[i] ?? ''))
+                    i++;
+                if (v.masked[i] !== '.')
+                    break;
+                const call = /^\.\s*(\w+)\s*\(/.exec(v.masked.slice(i));
+                if (!call)
+                    break;
+                const open = i + call[0].length - 1;
+                const close = closeOf(v.masked, open);
+                if (close < 0)
+                    break;
+                chain.push(call[1]);
+                if (['query', 'mutation', 'subscription'].includes(call[1])) {
+                    verb = call[1];
+                    const a = splitArgs(v.masked, open)[0];
+                    handler = a ? jsFunction(v.masked, a.start) : null;
+                    i = close;
+                    break;
+                }
+                i = close;
+            }
+            if (!verb || !handler)
+                continue;
+            const procName = x[2];
+            const deco = [{ view: v, start: x.index + x[1].length, end: handler.start, scope: 'router' }];
+            const e = makeEntry(repo, { kind: 'rpc', framework: 'trpc', file, line: v.lines.at(x.index), method: verb.toUpperCase(), path: x[1], name: x[1], confidence: 'high', handlerView: v, spec: { start: handler.start, end: handler.end, seeds: ['input', 'ctx', ...paramsOf(v.masked, handler)], decorators: deco, returnsJson: true } });
+            if (/protected|auth|private|member|user|admin|session|staff/i.test(procName))
+                e.protections.push({ kind: 'session_read', scope: 'router', file, line: e.line, via: `procedure ${procName}`, enforced: true, confidence: 'medium' });
+            if (/admin|staff|owner/i.test(procName) || ADMIN_PATH.test(procName))
+                e.protections.push({ kind: 'role_check', scope: 'router', file, line: e.line, via: `procedure ${procName}`, enforced: true, confidence: 'medium' });
+            if (chain.includes('input'))
+                e.protections.push({ kind: 'input_validation', scope: 'router', file, line: e.line, via: 'trpc .input()', enforced: true, confidence: 'high' });
+            e.protections.sort((a, b) => a.line - b.line || (a.kind < b.kind ? -1 : a.kind > b.kind ? 1 : 0) || (a.via < b.via ? -1 : 1));
+            out.entries.push(e);
+        }
+    }
+    return out;
+}
+function defaultExport(repo, v) {
+    const m = v.masked;
+    const x = /\bexport\s+default\s+/.exec(m);
+    if (!x)
+        return null;
+    const at = x.index + x[0].length;
+    const limit = statementLimit(m, at);
+    const direct = jsFunction(m, at);
+    const named = /^(?:async\s+)?function\s*\*?\s*([A-Za-z_$][\w$]*)/.exec(m.slice(at, at + 80));
+    const r = direct ? { view: v, start: direct.start, end: direct.end, wrapper: null, resolved: false, params: paramsOf(m, direct) } : resolveFunction(repo, v, at, limit);
+    return r ? { exportName: named?.[1] ?? null, r } : null;
+}
+// A middleware matcher such as "/admin/:path*" or "/api/(.*)" as the path prefix it covers.
+function gatePrefix(matcher) {
+    const p = matcher.replace(/\/?(?::\w+\*?|\(\.\*\)|\*)$/g, '').replace(/\/\(\.\*\)$/, '');
+    return normPath(p === '' ? '*' : p.startsWith('/') ? p : `/${p}`);
+}
+export { joinPath };