hullproof 0.0.0-stage → 0.5.0

package/dist/map/rails.js

@@ -0,0 +1,391 @@
+import { empty, joinPath, makeEntry } from './entry.js';
+import { analyzeLight } from './light.js';
+const CRUD = [
+    ['index', 'GET', '', false], ['create', 'POST', '', false], ['new', 'GET', '/new', false], ['show', 'GET', '/:id', true], ['edit', 'GET', '/:id/edit', true],
+    ['update', 'PATCH', '/:id', true], ['update', 'PUT', '/:id', true], ['destroy', 'DELETE', '/:id', true],
+];
+const sym = (s) => (/^%[iw]/.test(s) ? s.replace(/^%[iw]\[|\]$/g, '').split(/\s+/).filter(Boolean) : [...s.matchAll(/:(\w+)|['"](\w+)['"]/g)].map((m) => m[1] ?? m[2]));
+const listOpt = (line, key) => {
+    const m = new RegExp(`\\b${key}:\\s*(%[iw]\\[[^\\]]*\\]|\\[[^\\]]*\\]|:\\w+|['"]\\w+['"])`).exec(line);
+    return m ? sym(m[1]) : null;
+};
+const strOpt = (line, key) => new RegExp(`\\b${key}:\\s*(?::(\\w+)|['"]([^'"]*)['"])`).exec(line)?.slice(1).find((x) => x !== undefined) ?? null;
+const singular = (s) => (/ies$/.test(s) ? s.replace(/ies$/, 'y') : /ses$/.test(s) ? s.replace(/es$/, '') : s.replace(/s$/, ''));
+export function railsFiles(repo) {
+    return {
+        routes: repo.filesOf('rb').filter((f) => /(?:^|\/)config\/routes(?:\/[^/]+)?\.rb$/.test(f)),
+        controllers: repo.filesOf('rb').filter((f) => /(?:^|\/)app\/controllers\/.*\.rb$|(?:^|\/)app\/controllers\/concerns\/.*\.rb$/.test(f)),
+    };
+}
+function parseRoutes(v) {
+    const out = [];
+    const lines = v.masked.split('\n');
+    const orig = v.text.split('\n');
+    const stack = [{ kind: 'root', path: '', module: '', resource: null, auth: [], controller: null, only: null, except: null }];
+    const top = () => stack[stack.length - 1];
+    const authFacts = (ln, text) => (/\b(?:authenticate|authenticated)\b/.test(text) ? [{ kind: 'session_read', scope: 'router', file: v.file, line: ln, via: 'route authenticate block', enforced: true, confidence: 'high' }] : []);
+    const roleFacts = (ln, text) => (/\b(?:admin|role|staff|superuser|can\?)/i.test(text) ? [{ kind: 'role_check', scope: 'router', file: v.file, line: ln, via: 'route constraint', enforced: true, confidence: 'medium' }] : []);
+    const push = (verb, path, controller, action, ln, f, mount) => {
+        out.push({ verb, path: joinPath(f.path, path), controller, action, line: ln, auth: stack.flatMap((s) => s.auth), decoLine: ln, mount });
+    };
+    const ctrlOf = (f, name) => (name.includes('/') ? name : `${f.module}${name}`);
+    const nestedPrefix = (f, member) => {
+        const r = f.resource;
+        if (!r)
+            return '';
+        return `/${r.name}${r.singular || !member ? '' : '/:id'}`;
+    };
+    for (let i = 0; i < lines.length; i++) {
+        const raw = lines[i];
+        const l = raw.trim();
+        if (!l)
+            continue;
+        const ln = i + 1;
+        const o = orig[i] ?? '';
+        const f = top();
+        // Multi line route calls: join following lines while the line ends with a comma.
+        let full = o.trim();
+        let j = i;
+        while (/,\s*$/.test(lines[j]) && j + 1 < lines.length && j < i + 6) {
+            j++;
+            full += ' ' + (orig[j] ?? '').trim();
+        }
+        const opens = /\bdo(?:\s*\|[^|]*\|)?\s*$/.test(lines[j].trim());
+        const blockHead = (kind, fr) => { stack.push({ ...f, kind, auth: [], only: null, except: null, ...fr }); };
+        if (/^end\b/.test(l)) {
+            if (stack.length > 1)
+                stack.pop();
+            continue;
+        }
+        if (/^(?:if|unless|case|begin|while)\b/.test(l) && !/\bend\b/.test(l)) {
+            stack.push({ ...f, kind: 'other', auth: [] });
+            continue;
+        }
+        if (/^else\b|^elsif\b|^when\b/.test(l))
+            continue;
+        let m;
+        if ((m = /^namespace\s+(?::(\w+)|['"]([\w/]+)['"])/.exec(full))) {
+            const n = m[1] ?? m[2];
+            const p = strOpt(full, 'path');
+            if (opens)
+                blockHead('namespace', { path: joinPath(f.path, p ?? n), module: `${f.module}${n}/` });
+            i = j;
+            continue;
+        }
+        if ((m = /^scope\b(.*)$/.exec(full))) {
+            const rest = m[1];
+            const pos = /^\s*\(?\s*(?::(\w+)|['"]([^'"]*)['"])/.exec(rest);
+            const p = strOpt(rest, 'path') ?? (pos ? pos[1] ?? pos[2] : null);
+            const mod = strOpt(rest, 'module');
+            if (opens)
+                blockHead('scope', { path: p ? joinPath(f.path, p) : f.path, module: mod ? `${f.module}${mod}/` : f.module });
+            i = j;
+            continue;
+        }
+        if ((m = /^(authenticate|authenticated)\b(.*)$/.exec(full))) {
+            if (opens)
+                blockHead('authenticate', { auth: authFacts(ln, full) });
+            i = j;
+            continue;
+        }
+        if ((m = /^constraints\b(.*)$/.exec(full))) {
+            if (opens)
+                blockHead('constraints', { auth: [...authFacts(ln, full), ...roleFacts(ln, full)] });
+            i = j;
+            continue;
+        }
+        if ((m = /^controller\s+(?::(\w+)|['"]([\w/]+)['"])/.exec(full))) {
+            if (opens)
+                blockHead('controller', { controller: m[1] ?? m[2] });
+            i = j;
+            continue;
+        }
+        if ((m = /^(member|collection)\s+do\b/.exec(full))) {
+            blockHead(m[1], {});
+            continue;
+        }
+        if (/^(?:concern|devise_scope|defaults|with_options|resources_for_api|direct|draw)\b/.test(l) && opens) {
+            stack.push({ ...f, kind: 'concern', auth: [], controller: '\u0000skip' });
+            i = j;
+            continue;
+        }
+        if ((m = /^(resources|resource)\s+(.*)$/.exec(full))) {
+            const singularRes = m[1] === 'resource';
+            const names = [...m[2].split(/\b(?:only|except|controller|path|param|as|module|shallow|constraints|defaults|format)\s*:/)[0].matchAll(/:(\w+)/g)].map((x) => x[1]);
+            const only = listOpt(m[2], 'only');
+            const except = listOpt(m[2], 'except');
+            const ctrlOpt = strOpt(m[2], 'controller');
+            const pathOpt = strOpt(m[2], 'path');
+            for (const name of names) {
+                const base = f.resource ? `${nestedPrefix(f, true).replace(/:id$/, `:${singular(f.resource.name)}_id`)}` : '';
+                const urlName = pathOpt ?? name;
+                const controller = ctrlOf(f, ctrlOpt ?? name);
+                const acts = singularRes ? CRUD.filter(([a]) => a !== 'index') : CRUD;
+                for (const [act, verb, suffix, member] of acts) {
+                    if (only && !only.includes(act))
+                        continue;
+                    if (except && except.includes(act))
+                        continue;
+                    const sfx = singularRes ? suffix.replace(/^\/:id/, '') : suffix;
+                    if (singularRes && act === 'index')
+                        continue;
+                    push(verb, `${base}/${urlName}${sfx}`, controller, act, ln, f);
+                }
+                if (opens)
+                    stack.push({ ...f, kind: 'resources', path: f.path, resource: { name: urlName, singular: singularRes }, auth: [], controller: controller });
+            }
+            if (opens && !names.length)
+                stack.push({ ...f, kind: 'other', auth: [] });
+            i = j;
+            continue;
+        }
+        if ((m = /^(get|post|put|patch|delete|match)\s+(.*)$/.exec(full)) && !/^(?:get|post|put|patch|delete|match)\s*=/.test(full)) {
+            const verbWord = m[1];
+            const rest = m[2];
+            const first = /^\(?\s*(?::(\w+)|['"]([^'"]*)['"])/.exec(rest);
+            let target = strOpt(rest, 'to') ?? /=>\s*['"]([\w/]+#\w+)['"]/.exec(rest)?.[1] ?? null;
+            if (/\bto:\s*(?:redirect|->|lambda|proc)\b|=>\s*redirect\b/.test(rest) || /\bto:\s*[A-Z]/.test(rest)) {
+                if (opens)
+                    stack.push({ ...f, kind: 'other', auth: [] });
+                i = j;
+                continue;
+            }
+            let action = strOpt(rest, 'action');
+            let controller = null;
+            if (target && target.includes('#')) {
+                const [c, a] = target.split('#');
+                controller = ctrlOf(f, c);
+                action = a;
+            }
+            else if (!target && first && /=>\s*['"]?[\w/]+#\w+/.test(rest)) {
+                const t = /=>\s*['"]?([\w/]+)#(\w+)/.exec(rest);
+                controller = ctrlOf(f, t[1]);
+                action = t[2];
+            }
+            let path = first ? (first[1] ?? first[2]) : null;
+            if (!controller) {
+                const ctrlName = f.controller && f.controller !== '\u0000skip' ? f.controller : null;
+                if (ctrlName)
+                    controller = ctrlOf(f, ctrlName);
+                if (!action && path)
+                    action = path.replace(/^\//, '').split('/')[0].replace(/\W+/g, '_');
+                if (!controller && /^['"][\w/]+#\w+['"]$/.test(rest.split(',')[0].trim())) {
+                    const t = /['"]([\w/]+)#(\w+)['"]/.exec(rest);
+                    controller = ctrlOf(f, t[1]);
+                    action = t[2];
+                }
+            }
+            if (f.controller === '\u0000skip') {
+                if (opens)
+                    stack.push({ ...f, kind: 'other', auth: [] });
+                i = j;
+                continue;
+            }
+            if (!controller || !action || path === null) {
+                if (opens)
+                    stack.push({ ...f, kind: 'other', auth: [] });
+                i = j;
+                continue;
+            }
+            const on = strOpt(rest, 'on');
+            const inMember = f.kind === 'member' || on === 'member';
+            const inCollection = f.kind === 'collection' || on === 'collection';
+            let prefix = '';
+            if (f.resource && (inMember || inCollection))
+                prefix = nestedPrefix(f, inMember);
+            else if (f.resource && f.kind === 'resources')
+                prefix = nestedPrefix(f, true).replace(/:id$/, `:${singular(f.resource.name)}_id`);
+            const verbs = verbWord === 'match' ? (listOpt(rest, 'via') ?? ['any']).map((x) => (x === 'all' || x === 'any' ? 'ANY' : x.toUpperCase())) : [verbWord.toUpperCase()];
+            for (const verb of verbs)
+                push(verb === 'ANY' ? 'ANY' : verb, `${prefix}/${path.replace(/^\//, '')}`.replace(/\(\.:format\)/g, ''), controller, action, ln, f);
+            if (opens)
+                stack.push({ ...f, kind: 'other', auth: [] });
+            i = j;
+            continue;
+        }
+        if ((m = /^root\s+(.*)$/.exec(full))) {
+            const t = /['"]([\w/]+)#(\w+)['"]/.exec(m[1]);
+            if (t)
+                push('GET', '/', ctrlOf(f, t[1]), t[2], ln, f);
+            i = j;
+            continue;
+        }
+        if ((m = /^mount\s+(.*)$/.exec(full))) {
+            const t = /^([\w:]+)\s*(?:=>|,\s*at:)\s*['"]([^'"]+)['"]/.exec(m[1]);
+            if (t)
+                push('ANY', t[2], t[1], '\u0000mount', ln, f, t[1]);
+            i = j;
+            continue;
+        }
+        if (opens)
+            stack.push({ ...f, kind: 'other', auth: [] });
+        i = j;
+    }
+    return out.filter((r) => r.path !== undefined);
+}
+const snakeCase = (s) => s.replace(/([a-z0-9])([A-Z])/g, '$1_$2').toLowerCase();
+// app/controllers/admin/users_controller.rb -> admin/users ; app/controllers/concerns/authentication.rb -> concerns/authentication
+const keyOf = (file) => (/app\/controllers\/(.*)\.rb$/.exec(file)?.[1] ?? file).replace(/_controller$/, '');
+function parseControllers(repo, files) {
+    const ctrls = new Map();
+    const concerns = new Map();
+    for (const file of files) {
+        const v = repo.view(file);
+        if (!v)
+            continue;
+        const isConcern = /\/concerns\//.test(file);
+        const cl = /^[ \t]*class\s+([A-Z][\w:]*)(?:\s*<\s*([\w:]+))?/m.exec(v.masked);
+        const head = isConcern ? /^[ \t]*module\s+([A-Z][\w:]*)/m.exec(v.masked) : cl;
+        if (!head)
+            continue;
+        const info = { key: keyOf(file), name: head[1].split('::').pop(), file, view: v, parent: !isConcern && cl?.[2] ? cl[2] : null, includes: [...v.masked.matchAll(/^[ \t]*include\s+([\w:]+)/gm)].map((x) => x[1].split('::').pop()), filters: [] };
+        const lines = v.masked.split('\n');
+        const orig = v.text.split('\n');
+        let defIndent = -1;
+        for (let i = 0; i < lines.length; i++) {
+            const l = lines[i].trim();
+            const indent = /^[ \t]*/.exec(lines[i])[0].length;
+            // A filter inside a method or a class_methods block is a macro definition, not a filter of this class.
+            if (defIndent >= 0) {
+                if (indent <= defIndent && /^end\b/.test(l))
+                    defIndent = -1;
+                continue;
+            }
+            if (/^(?:def\b|class_methods\b)/.test(l) && !/\bend\s*$/.test(l)) {
+                defIndent = indent;
+                continue;
+            }
+            const m = /^(before_action|before_filter|prepend_before_action|append_before_action|skip_before_action|skip_before_filter|skip_forgery_protection|load_and_authorize_resource|authorize_resource|load_resource|rate_limit|allow_unauthenticated_access|require_authentication)\b/.exec(l);
+            if (!m)
+                continue;
+            let full = orig[i] ?? '';
+            let j = i;
+            while (/,\s*$/.test(lines[j]) && j + 1 < lines.length && j < i + 5) {
+                j++;
+                full += ' ' + (orig[j] ?? '').trim();
+            }
+            const only = listOpt(full, 'only');
+            const except = listOpt(full, 'except');
+            const kw = m[1];
+            const names = [...full.replace(/\b(?:only|except|if|unless|prepend|to|within|by|with)\s*:.*$/, '').matchAll(/:(\w+[?!]?)/g)].map((x) => x[1]);
+            const start = v.lines.start(i + 1);
+            let end = Math.min(v.lines.start(j + 2) - 1, v.text.length);
+            // The options (only, except, if, unless) name actions and methods, not filters: leave them out of the text that is read.
+            const cut = v.text.slice(start, end).search(/\b(?:only|except|if|unless)\s*:/);
+            if (cut > 0)
+                end = start + cut;
+            const add = (name, kind) => { info.filters.push({ name, line: i + 1, view: v, start, end, only, except, kind, text: full }); };
+            if (/^skip_/.test(kw))
+                for (const n of names)
+                    add(n, 'skip');
+            else if (kw === 'allow_unauthenticated_access')
+                add('require_authentication', 'skip');
+            else if (/before_action|before_filter/.test(kw)) {
+                if (names.length)
+                    for (const n of names)
+                        add(n, 'add');
+                else
+                    add('(block)', 'add');
+            }
+            else
+                add(kw, 'add');
+            i = j;
+        }
+        if (isConcern)
+            concerns.set(info.name, info);
+        else
+            ctrls.set(info.key, info);
+    }
+    return { ctrls, concerns };
+}
+export function extractRailsAll(repo, fn, local) {
+    const out = empty();
+    const { routes, controllers } = railsFiles(repo);
+    if (!routes.length)
+        return out;
+    const { ctrls, concerns } = parseControllers(repo, controllers);
+    const parentOf = (c) => {
+        if (!c.parent)
+            return undefined;
+        const dir = c.key.includes('/') ? c.key.slice(0, c.key.lastIndexOf('/')) : '';
+        const bare = c.parent.split('::').map(snakeCase).join('/').replace(/_controller$/, '');
+        return ctrls.get(dir ? `${dir}/${bare}` : bare) ?? ctrls.get(bare);
+    };
+    for (const rf of routes) {
+        const rv = repo.view(rf);
+        if (!rv)
+            continue;
+        for (const r of parseRoutes(rv)) {
+            if (r.action === '\u0000mount') {
+                const a = analyzeLight(rv, { start: rv.lines.start(r.line), end: rv.lines.start(r.line + 1) - 1, seeds: [], decorators: [], extra: r.auth, local });
+                out.entries.push(makeEntry(repo, { kind: 'http_route', framework: 'rails-mount', file: rf, line: r.line, method: 'ANY', path: r.path, name: r.mount ?? null, confidence: 'medium', handlerView: rv, spec: { start: rv.lines.start(r.line), end: rv.lines.start(r.line + 1) - 1, seeds: [] }, analysis: a }));
+                continue;
+            }
+            const ci = ctrls.get(r.controller);
+            const chain = [];
+            for (let cur = ci, n = 0; cur && n < 8; n++) {
+                chain.unshift(cur);
+                cur = parentOf(cur);
+            }
+            // Filters in the order they run: each ancestor's included concerns, then its own lines.
+            const active = [];
+            const applies = (fl) => (!fl.only || fl.only.includes(r.action)) && (!fl.except || !fl.except.includes(r.action));
+            for (const c of chain) {
+                const all = [...c.includes.flatMap((i) => concerns.get(i)?.filters ?? []), ...c.filters];
+                for (const fl of all) {
+                    if (!applies(fl))
+                        continue;
+                    if (fl.kind === 'skip') {
+                        for (let k = active.length - 1; k >= 0; k--)
+                            if (active[k].name === fl.name)
+                                active.splice(k, 1);
+                        continue;
+                    }
+                    active.push(fl);
+                }
+            }
+            // A filter named authenticate_user may only look the user up (@user = ...) and let a guest through, as in Lobsters. It protects nothing then.
+            const softLookup = (fl) => {
+                if (!/^authenticate_(?:user|member|account)$/.test(fl.name))
+                    return false;
+                const d = fn.defs(fl.name).find((x) => chain.some((c) => c.file === x.view.file) || concerns.size > 0);
+                if (!d)
+                    return false;
+                const body = d.view.masked.slice(d.start, d.end);
+                return /@(?:user|current_user)\s*(?:\|\|)?=/.test(body) && !/\b(?:redirect_to|redirect_back|render|head|raise|halt|deny_access|forbidden|unauthorized)\b|\bauthenticate!?\b(?!_user)|\brequire_\w+/.test(body);
+            };
+            const decorators = active.filter((fl) => !softLookup(fl)).map((fl) => ({ view: fl.view, start: fl.start, end: fl.end, scope: 'router' }));
+            const policyScoped = active.some((fl) => /load_and_authorize_resource|authorize_resource/.test(fl.name));
+            // The action itself.
+            let hv = rv;
+            let start = rv.lines.start(r.line);
+            let end = rv.lines.start(r.line + 1) - 1;
+            let found = false;
+            if (ci) {
+                const d = fn.defs(r.action).find((x) => x.view.file === ci.file);
+                if (d) {
+                    hv = d.view;
+                    start = d.start;
+                    end = d.end;
+                    found = true;
+                }
+            }
+            // A filter such as set_article loads the record before the action runs: @article = Article.find(params[:id]).
+            const bound = [];
+            for (const fl of active) {
+                const d = fn.defs(fl.name).find((x) => chain.some((c) => c.file === x.view.file));
+                if (!d)
+                    continue;
+                const body = d.view.text.slice(d.start, d.end);
+                for (const m of body.matchAll(/(@\w+)\s*=\s*(?:(@?current_\w+)\.(\w+)\.|([A-Z][\w:]*)\.)(?:find|find_by!?)\s*\(\s*(?:params\[\s*:\w+\s*\]|id:\s*params)/g))
+                    bound.push({ name: m[1], target: m[4] ?? m[3], owner: m[2] !== undefined });
+            }
+            const a = analyzeLight(hv, { start, end, seeds: [], decorators, extra: r.auth.slice(), lookup: fn.find, local, policyScoped, bound });
+            out.entries.push(makeEntry(repo, {
+                kind: 'http_route', framework: 'rails', file: rf, line: r.line, method: r.verb, path: r.path.replace(/\(\.:format\)/g, '') || '/', name: `${r.controller}#${r.action}`,
+                confidence: found ? 'high' : 'low', handlerView: hv, spec: { start, end, seeds: [] }, analysis: a,
+            }));
+        }
+    }
+    return out;
+}

package/dist/map/repo.js

@@ -0,0 +1,178 @@
+import { cmp } from '../util.js';
+import { jsFunction, Lines, mask, pyBlock } from './lex.js';
+import { loadLocalVocab } from './local-vocab.js';
+export const JS_EXT = /\.(?:[cm]?[jt]sx?)$/;
+export const PY_EXT = /\.py$/;
+export const langOf = (file) => (JS_EXT.test(file) && !/\.d\.ts$/.test(file) ? 'js' : PY_EXT.test(file) ? 'py' : /\.go$/.test(file) ? 'go' : /\.rb$/.test(file) ? 'rb' : /\.php$/.test(file) ? 'php' : /\.java$/.test(file) ? 'java' : /\.cs$/.test(file) ? 'cs' : /\.kts?$/.test(file) ? 'kt' : /\.swift$/.test(file) ? 'swift' : /\.rs$/.test(file) ? 'rs' : null);
+// The lines of a Go, Ruby or PHP file that name what it uses: import blocks, require lines, use statements.
+const IMPORTS_MORE = {
+    go: /^[ \t]*import\s*(?:\([\s\S]*?\)|(?:\w+\s+)?"[^"]*")/gm,
+    rb: /^[ \t]*(?:require(?:_relative)?|gem|include|extend)\s[^\n]*/gm,
+    php: /^[ \t]*(?:use|namespace)\s+[^;\n]*;/gm,
+    java: /^[ \t]*(?:import|package)\s+[^;\n]*;/gm,
+    cs: /^[ \t]*(?:global\s+)?(?:using|namespace)\s+[^;\n{]*[;{]?/gm,
+    kt: /^[ \t]*(?:import|package)\s+[^\n]*/gm,
+    swift: /^[ \t]*(?:@testable\s+)?import\s+[^\n]*/gm,
+    rs: /^[ \t]*(?:use|extern\s+crate|mod)\s+[^;\n]*;/gm,
+};
+// A file that is browser code or generated: no server entry points are looked for in it.
+const CLIENT_FILE = /^\s*["']use client["']|@Component\s*\(|@NgModule\s*\(|from\s+["']@angular\/|\.min\.[cm]?js$/;
+export class Repo {
+    views = new Map();
+    indexes = new Map();
+    fileSet;
+    ctx;
+    local;
+    constructor(ctx) { this.ctx = ctx; this.fileSet = new Set(ctx.files); this.local = loadLocalVocab(ctx.repo); }
+    view(file) {
+        if (this.views.has(file))
+            return this.views.get(file);
+        const lang = langOf(file);
+        let v = null;
+        if (lang) {
+            const text = this.ctx.text(file);
+            if (text) {
+                const masked = mask(text, lang);
+                const imports = lang !== 'js' && lang !== 'py' ? (text.match(IMPORTS_MORE[lang]) ?? []).join('\n') : (text.match(/\bimport\s[^;]*?from\s+['"][^'"]+['"]|\bimport\s+['"][^'"]+['"]|\b(?:const|let|var)\s+[^=;\n]+=\s*require\(\s*['"][^'"]+['"]\s*\)|^[ \t]*(?:from\s+\S+\s+import\b[^\n]*|import\s+\S+[^\n]*)/gm) ?? []).join('\n');
+                v = { file, text, masked, lang, lines: new Lines(text), imports };
+            }
+        }
+        this.views.set(file, v);
+        return v;
+    }
+    // Local name -> import specifier, for the default, named and namespace imports and require calls of a JavaScript file.
+    importMap(v) {
+        const out = new Map();
+        for (const m of v.imports.matchAll(/\bimport\s+(?:type\s+)?([^'"]*?)\s+from\s+['"]([^'"]+)['"]/g)) {
+            const clause = m[1];
+            const named = /\{([^}]*)\}/.exec(clause)?.[1] ?? '';
+            for (const part of named.split(',')) {
+                const n = part.trim().split(/\s+as\s+/).pop()?.trim();
+                if (n)
+                    out.set(n, m[2]);
+            }
+            const def = clause.replace(/\{[^}]*\}/, '').replace(/\*\s+as\s+/, '').split(',').map((x) => x.trim()).filter(Boolean);
+            for (const d of def)
+                out.set(d, m[2]);
+        }
+        for (const m of v.imports.matchAll(/\b(?:const|let|var)\s+(\{[^}]*\}|[\w$]+)\s*=\s*require\(\s*['"]([^'"]+)['"]/g)) {
+            if (m[1].startsWith('{')) {
+                for (const part of m[1].slice(1, -1).split(',')) {
+                    const n = part.trim().split(/\s*:\s*/).pop()?.trim();
+                    if (n)
+                        out.set(n, m[2]);
+                }
+            }
+            else
+                out.set(m[1], m[2]);
+        }
+        return out;
+    }
+    isClient(v) { return CLIENT_FILE.test(v.text.slice(0, 4000)) || (v.lang === 'js' && /\.[jt]sx$/.test(v.file) && /<\w+[^>]*>/.test(v.masked.slice(0, 20000)) && /\buseState\b|\buseEffect\b/.test(v.masked)); }
+    filesOf(lang) { return this.ctx.files.filter((f) => langOf(f) === lang); }
+    // Resolve a relative (or "@/" aliased) import specifier from a file to a repository file.
+    resolveImport(from, spec) {
+        let base;
+        if (spec.startsWith('.')) {
+            const parts = from.split('/').slice(0, -1);
+            for (const seg of spec.split('/')) {
+                if (seg === '..')
+                    parts.pop();
+                else if (seg !== '.')
+                    parts.push(seg);
+            }
+            base = parts.join('/');
+        }
+        else if (spec.startsWith('@/') || spec.startsWith('~/')) {
+            const rest = spec.slice(2);
+            for (const root of ['src/', '']) {
+                const r = this.tryFile(root + rest);
+                if (r)
+                    return r;
+            }
+            return null;
+        }
+        else
+            return null;
+        return this.tryFile(base);
+    }
+    tryFile(base) {
+        for (const ext of ['', '.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs', '.py', '/index.ts', '/index.js', '/index.mjs', '/__init__.py'])
+            if (this.fileSet.has(base + ext))
+                return base + ext;
+        return null;
+    }
+    index(lang) {
+        let idx = this.indexes.get(lang);
+        if (idx)
+            return idx;
+        idx = new Map();
+        if (lang !== 'js' && lang !== 'py') {
+            this.indexes.set(lang, idx);
+            return idx;
+        } // the other languages keep their own indexes (light-index.ts)
+        const put = (name, ref) => { const l = idx.get(name); if (l)
+            l.push(ref);
+        else
+            idx.set(name, [ref]); };
+        for (const file of this.filesOf(lang)) {
+            const v = this.view(file);
+            if (!v || this.isClient(v))
+                continue;
+            if (lang === 'js') {
+                const m = v.masked;
+                for (const x of m.matchAll(/(?<![.\w$])function\s*\*?\s*([A-Za-z_$][\w$]*)\s*[(<]/g)) {
+                    const at = /async\s+$/.test(m.slice(Math.max(0, x.index - 7), x.index)) ? x.index - 6 : x.index;
+                    const f = jsFunction(m, at);
+                    if (f)
+                        put(x[1], { view: v, start: f.start, end: f.end });
+                }
+                for (const x of m.matchAll(/\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*(?::[^=\n]+)?=\s*/g)) {
+                    const f = jsFunction(m, x.index + x[0].length);
+                    if (f)
+                        put(x[1], { view: v, start: f.start, end: f.end });
+                }
+                for (const x of m.matchAll(/\bexports\.([A-Za-z_$][\w$]*)\s*=\s*/g)) {
+                    const f = jsFunction(m, x.index + x[0].length);
+                    if (f)
+                        put(x[1], { view: v, start: f.start, end: f.end });
+                }
+                for (const x of m.matchAll(/(?:^|[{,\n])\s*([A-Za-z_$][\w$]*)\s*:\s*(?=async\b|function\b|\(|[A-Za-z_$][\w$]*\s*=>)/g)) {
+                    const f = jsFunction(m, x.index + x[0].length);
+                    if (f)
+                        put(x[1], { view: v, start: f.start, end: f.end });
+                }
+            }
+            else {
+                for (const x of v.masked.matchAll(/^([ \t]*)(?:async\s+)?def\s+([A-Za-z_]\w*)\s*\(/gm)) {
+                    const b = pyBlock(v.masked, v.lines, x.index);
+                    put(x[2], { view: v, start: x.index, end: b.end });
+                }
+            }
+        }
+        this.indexes.set(lang, idx);
+        return idx;
+    }
+    // Which repository file defines a function of this name: unique across the repository, else the one in the caller's file.
+    helpers(lang) {
+        return {
+            local: this.local,
+            find: (name, fromFile) => {
+                const refs = this.index(lang).get(name);
+                if (!refs)
+                    return null;
+                if (refs.length === 1)
+                    return refs[0];
+                const same = refs.filter((r) => r.view.file === fromFile);
+                if (same.length === 1)
+                    return same[0];
+                const sorted = refs.slice().sort((a, b) => cmp(a.view.file, b.view.file) || a.start - b.start);
+                return fromFile === undefined ? sorted[0] : null;
+            },
+        };
+    }
+    // Function definitions of a name, all of them (for resolving a handler reference).
+    defs(lang, name) {
+        return (this.index(lang).get(name) ?? []).slice().sort((a, b) => cmp(a.view.file, b.view.file) || a.start - b.start);
+    }
+}