hullproof 0.0.0-stage → 0.5.0

package/src/map/build.ts

@@ -0,0 +1,206 @@
+// Builds codemap.json: runs the extractors over every file, joins router mounts and gates, adds the Supabase and Firebase
+// maps, and writes the per language coverage that says what the map did not read. Deterministic: sorted, no clock.
+import type { CheckContext } from '../checks/context.ts';
+import type { CodeMap, Coverage, EntryPoint, Gate, Protection } from '../types/index.ts';
+import { cmp } from '../util.ts';
+import { ENGINE_VERSION } from '../version.ts';
+import { firebaseMap, supabaseMap } from './config.ts';
+import { joinPath, type Extracted, type Mount } from './entry.ts';
+import { extractExpress } from './js-express.ts';
+import { extractAiTools, extractJobs, extractNest } from './js-misc.ts';
+import { extractNext } from './js-next.ts';
+import { extractExpo } from './expo.ts';
+import { extractGoAll, goFiles } from './go.ts';
+import { extractLaravelAll, laravelFiles } from './laravel.ts';
+import { FnIndex } from './light-index.ts';
+import { extractRailsAll, railsFiles } from './rails.ts';
+import { extractSpring, springFiles } from './spring.ts';
+import { dotnetFiles, extractDotnet } from './dotnet.ts';
+import { extractMobile, mobileFacts } from './mobile.ts';
+import { cargoConfig, extractRust, rustFiles } from './rust.ts';
+import { authHelperCandidates } from './candidates.ts';
+import { extractPython } from './py.ts';
+import { extractDjango } from './py-django.ts';
+import { langOf, Repo } from './repo.ts';
+
+// Web frameworks a built extractor reads, and ones it does not, by language group (stack.json framework ids).
+const READ_BY: Record<string, string[]> = { 'node-ts': ['nextjs', 'express', 'fastify', 'koa', 'hono', 'nestjs', 'trpc', 'react', 'expo'], python: ['flask', 'fastapi', 'django', 'quart', 'sanic', 'starlette'], go: ['chi', 'echo', 'fiber', 'gin', 'gorilla-mux'], ruby: ['rails'], php: ['laravel'], java: ['spring', 'spring-boot'], csharp: ['aspnet-core'] };
+const UNREAD: Record<string, string[]> = {
+  'node-ts': ['adonisjs', 'apollo-server', 'hapi', 'loopback', 'remix', 'sveltekit', 'nuxt', 'astro', 'socket.io', 'graphql'],
+  python: ['aiohttp', 'bottle', 'falcon', 'litestar', 'pyramid', 'tornado', 'gradio', 'streamlit'],
+  go: [], ruby: ['sinatra', 'grape', 'hanami', 'roda'],
+  php: ['symfony', 'slim', 'codeigniter', 'cakephp', 'yii', 'drupal', 'wordpress'],
+  java: ['quarkus', 'micronaut', 'javalin'], kotlin: ['ktor', 'spring', 'spring-boot'],
+  csharp: [], rust: ['actix-web', 'axum', 'rocket', 'warp'], elixir: ['phoenix', 'ecto'],
+  dart: ['dart-frog', 'shelf'], swift: ['vapor'],
+};
+const SERVER_LANGS = new Set(['java', 'kotlin', 'csharp', 'rust', 'scala', 'elixir', 'swift', 'dart', 'perl', 'c', 'cpp', 'lua', 'haskell', 'clojure', 'groovy', 'erlang', 'fsharp', 'ocaml', 'julia', 'r', 'visual-basic', 'zig', 'nim']);
+
+const inPrefix = (path: string, prefix: string): boolean => prefix === '*' || prefix === '/' || path === prefix || path.startsWith(prefix.replace(/\/$/, '') + '/') || path.startsWith(prefix.replace(/\/$/, '') + '*');
+const ROUTE_FW = new Set(['express', 'flask', 'fastapi', 'quart', 'sanic', 'flask-restful']);
+const WEB_KINDS = new Set(['http_route', 'webhook', 'page']);
+
+const confOf = (c: Protection['confidence'], cap: Protection['confidence']): Protection['confidence'] => (c === 'low' || cap === 'low' ? 'low' : c === 'medium' || cap === 'medium' ? 'medium' : 'high');
+
+function addProtections(ep: EntryPoint, ps: Protection[]): void {
+  const have = new Set(ep.protections.map((p) => `${p.kind}|${p.scope}|${p.file}|${p.line}|${p.via}`));
+  for (const p of ps) { const k = `${p.kind}|${p.scope}|${p.file}|${p.line}|${p.via}`; if (!have.has(k)) { have.add(k); ep.protections.push(p); } }
+  ep.protections.sort((a, b) => cmp(a.file, b.file) || a.line - b.line || cmp(a.kind, b.kind) || cmp(a.via, b.via) || cmp(a.scope, b.scope));
+}
+
+function prefixChain(mounts: Mount[]): Map<string, { prefix: string; protections: Protection[] }> {
+  const byTarget = new Map<string, Mount[]>();
+  for (const m of mounts) byTarget.set(m.target, [...(byTarget.get(m.target) ?? []), m]);
+  const resolve = (file: string, depth: number): { prefix: string; protections: Protection[] } | null => {
+    const ms = (byTarget.get(file) ?? []).slice().sort((a, b) => cmp(a.from, b.from) || a.line - b.line);
+    if (!ms.length || depth > 5) return null;
+    const m = ms[0];
+    const up = resolve(m.from, depth + 1);
+    return { prefix: joinPath(up?.prefix ?? '', m.prefix), protections: [...(up?.protections ?? []), ...m.protections] };
+  };
+  const out = new Map<string, { prefix: string; protections: Protection[] }>();
+  for (const t of byTarget.keys()) { const r = resolve(t, 0); if (r) out.set(t, r); }
+  return out;
+}
+
+export function buildCodeMap(ctx: CheckContext): CodeMap {
+  const repo = new Repo(ctx);
+  const all: Extracted = { entries: [], gates: [], mounts: [] };
+  const merge = (x: Extracted): void => { all.entries.push(...x.entries); all.gates.push(...x.gates); all.mounts.push(...x.mounts); };
+  // A file the extractor throws on is skipped and counted, so the coverage row can say so.
+  const failed: { file: string; message: string }[] = [];
+  const guard = (file: string, f: () => Extracted): void => { try { merge(f()); } catch (e) { failed.push({ file, message: (e as Error).message }); } };
+  for (const file of ctx.files) {
+    const lang = langOf(file);
+    if (!lang) continue;
+    const v = repo.view(file);
+    if (!v) continue;
+    if (lang === 'js') {
+      if (repo.isClient(v)) { if (/(?:^|\/)page\.[cm]?[jt]sx?$/.test(file)) guard(file, () => extractNext(repo, v)); continue; }
+      guard(file, () => extractNext(repo, v));
+      guard(file, () => extractExpress(repo, v));
+      guard(file, () => extractNest(repo, v));
+      guard(file, () => extractJobs(repo, v));
+      guard(file, () => extractAiTools(repo, v));
+    } else if (lang === 'py') guard(file, () => extractPython(repo, v));
+  }
+  guard('(django url configuration)', () => extractDjango(repo));
+  if (goFiles(repo).length) guard('(go routes)', () => extractGoAll(repo, new FnIndex(repo, 'go'), repo.local));
+  if (railsFiles(repo).routes.length) guard('(rails routes)', () => extractRailsAll(repo, new FnIndex(repo, 'rb'), repo.local));
+  if (laravelFiles(repo).length) guard('(laravel routes)', () => extractLaravelAll(repo, new FnIndex(repo, 'php'), repo.local));
+  if (springFiles(repo).length) guard('(spring controllers)', () => extractSpring(repo, new FnIndex(repo, 'java'), repo.local));
+  if (dotnetFiles(repo).length) guard('(aspnet routes)', () => extractDotnet(repo, new FnIndex(repo, 'cs'), repo.local));
+  guard('(android and ios configuration)', () => extractMobile(repo));
+  if (rustFiles(repo).length) guard('(rust routes)', () => extractRust(repo));
+  guard('(expo router)', () => extractExpo(repo));
+
+  // Router mounts: routes registered in a mounted file live under the mount prefix and inherit its protections.
+  const chains = prefixChain(all.mounts);
+  for (const ep of all.entries) {
+    const c = chains.get(ep.file);
+    if (!c || !ROUTE_FW.has(ep.framework) || ep.path === null) continue;
+    ep.path = joinPath(c.prefix, ep.path);
+    if (ep.confidence === 'high') ep.confidence = 'medium';
+    addProtections(ep, c.protections.map((p) => ({ ...p, scope: 'router' as const })));
+  }
+
+  // Gates: middleware and guards that cover an entry point by path, file order or framework.
+  const gates: Gate[] = all.gates.slice().sort((a, b) => cmp(a.file, b.file) || a.line - b.line || cmp(a.id, b.id));
+  for (const ep of all.entries) {
+    if (!WEB_KINDS.has(ep.kind) && ep.kind !== 'server_action' && ep.kind !== 'graphql_resolver' && ep.kind !== 'rpc') continue;
+    for (const g of gates) {
+      if (g.framework === 'spring' || g.framework === 'aspnet') continue; // the extractor applied these rules itself, in order, first match wins
+      if (g.framework === 'express' && (g.file !== ep.file || g.line > ep.line)) continue;
+      if (g.framework === 'next-app' && !(ep.framework === 'next-app' || ep.framework === 'next-pages') || (g.framework === 'next-app' && ep.kind === 'server_action')) continue;
+      if (g.framework === 'flask' && ep.framework !== 'flask' && ep.framework !== 'quart') continue;
+      if (g.framework === 'nest' && ep.framework !== 'nest') continue;
+      if (g.framework === 'django' && ep.framework !== 'django') continue;
+      if (g.methods.length && ep.method && ep.method !== 'ANY' && !g.methods.includes(ep.method)) continue;
+      if (ep.path === null && !g.paths.includes('*')) continue;
+      if (!g.paths.some((p) => ep.path === null ? p === '*' : inPrefix(ep.path!, p))) continue;
+      const cap = g.paths.includes('*') || g.kind === 'guard' || g.kind === 'global_pipe' ? g.confidence : 'medium';
+      addProtections(ep, g.protections.map((p) => ({ ...p, scope: g.kind === 'guard' || g.kind === 'global_pipe' ? 'global' as const : p.scope === 'router' ? 'router' as const : 'middleware' as const, confidence: confOf(p.confidence, cap) })));
+    }
+  }
+
+  // Vercel cron paths: an entry point called by the platform scheduler.
+  try {
+    const vj = JSON.parse(ctx.text('vercel.json') || '{}') as { crons?: { path?: string }[] };
+    for (const c of vj.crons ?? []) for (const ep of all.entries) if (c.path && ep.path && ep.path === joinPath('', c.path.split('?')[0])) ep.tags = [...new Set([...ep.tags, 'cron'])].sort();
+  } catch { /* a vercel.json that does not parse adds no cron tags */ }
+
+  const seen = new Map<string, EntryPoint>();
+  for (const ep of all.entries) if (!seen.has(ep.id)) seen.set(ep.id, ep);
+  const entries = [...seen.values()].sort((a, b) => cmp(a.file, b.file) || a.line - b.line || cmp(a.method ?? '', b.method ?? '') || cmp(a.path ?? '', b.path ?? '') || cmp(a.name ?? '', b.name ?? '') || cmp(a.kind, b.kind));
+
+  const by = (key: (e: EntryPoint) => string): Record<string, number> => { const o: Record<string, number> = {}; for (const e of entries) o[key(e)] = (o[key(e)] ?? 0) + 1; return Object.fromEntries(Object.entries(o).sort(([a], [b]) => cmp(a, b))); };
+  const facts = mobileFacts(repo);
+  return {
+    schema_version: '1.0.0', engine_version: ENGINE_VERSION, commit: ctx.stack.commit,
+    coverage: coverage(ctx, entries, failed, facts, repo), entry_points: entries,
+    gates: gates.map((g) => ({ ...g, protections: g.protections.slice().sort((a, b) => a.line - b.line || cmp(a.kind, b.kind) || cmp(a.via, b.via)) })),
+    config: { supabase: supabaseMap(repo), firebase: firebaseMap(repo), android: facts.android, ios: facts.ios, cargo: cargoConfig(repo), secrets: facts.secrets, local_vocab: { auth_helpers: repo.local.auth_helpers, role_helpers: repo.local.role_helpers }, auth_helper_candidates: authHelperCandidates(repo, entries) },
+    counts: { entry_points: entries.length, by_kind: by((e) => e.kind), by_framework: by((e) => e.framework) },
+  };
+}
+
+function coverage(ctx: CheckContext, entries: EntryPoint[], failed: { file: string; message: string }[], facts: ReturnType<typeof mobileFacts>, repo: Repo): Coverage[] {
+  const frameworks = new Set([...ctx.stack.frameworks.map((f) => f.id), ...(ctx.stack.mobile ?? []).map((f) => f.id)]);
+  const rows: Coverage[] = [];
+  const nodeTotal = entries.filter((e) => /\.[cm]?[jt]sx?$/.test(e.file)).length;
+  const count = (re: RegExp): number => entries.filter((e) => re.test(e.file)).length;
+  for (const l of ctx.stack.languages) {
+    const files = l.file_count ?? 0;
+    if (l.id === 'javascript' || l.id === 'typescript') {
+      const n = count(l.id === 'typescript' ? /\.[cm]?tsx?$/ : /\.[cm]?jsx?$/);
+      const unread = UNREAD['node-ts'].filter((f) => frameworks.has(f));
+      rows.push({ language: l.id, files, extractor: 'node-ts', status: unread.length ? 'partial' : 'mapped', entry_points: n, note: unread.length ? `Frameworks seen that this extractor does not read: ${unread.join(', ')}. Entry points they register may be missing.` : n === 0 && nodeTotal === 0 && READ_BY['node-ts'].some((f) => frameworks.has(f) && f !== 'react') ? 'A web framework was detected and no entry point was found. The routes may be registered in a way the extractor does not read.' : frameworks.has('expo') ? 'Next.js, Express family, NestJS, tRPC, Expo Router screens, API routes and deep links, jobs and AI tools are read.' : 'Next.js, Express family, NestJS, tRPC, jobs and AI tools are read.' });
+    } else if (l.id === 'python') {
+      const n = count(/\.py$/);
+      const unread = UNREAD.python.filter((f) => frameworks.has(f));
+      rows.push({ language: l.id, files, extractor: 'python', status: unread.length ? 'partial' : 'mapped', entry_points: n, note: unread.length ? `Frameworks seen that this extractor does not read: ${unread.join(', ')}. Entry points they register may be missing.` : n === 0 && READ_BY.python.some((f) => frameworks.has(f)) ? 'A web framework was detected and no entry point was found. The routes may be registered in a way the extractor does not read.' : 'Flask, FastAPI, Django and REST framework, Celery and scheduler jobs, and AI tools are read.' });
+    } else if (l.id === 'go' || l.id === 'ruby' || l.id === 'php') {
+      const ext = l.id === 'go' ? /\.go$/ : l.id === 'ruby' ? /\.rb$/ : /\.php$/;
+      const n = count(ext);
+      const unread = UNREAD[l.id].filter((f) => frameworks.has(f));
+      const readSeen = READ_BY[l.id].filter((f) => frameworks.has(f));
+      const name = l.id === 'go' ? 'go' : l.id === 'ruby' ? 'rails' : 'laravel';
+      const what = l.id === 'go' ? 'net/http, chi, gin, echo, fiber and gorilla/mux routes' : l.id === 'ruby' ? 'Rails routes (config/routes.rb) and controller filters' : 'Laravel routes (routes/*.php) and controller middleware';
+      let status: Coverage['status'] = unread.length ? 'partial' : 'mapped';
+      let note = unread.length ? `Frameworks seen that this extractor does not read: ${unread.join(', ')}. Entry points they register may be missing.` : `${what[0].toUpperCase()}${what.slice(1)} are read.`;
+      if (l.id !== 'go' && !readSeen.length && n === 0 && !unread.length) { status = 'partial'; note = `No ${l.id === 'ruby' ? 'Rails' : 'Laravel'} project was found, so no routes were read. Web code in ${l.id} files is not in this map.`; }
+      else if (readSeen.length && n === 0) note = 'A web framework was detected and no entry point was found. The routes may be registered in a way the extractor does not read.';
+      rows.push({ language: l.id, files, extractor: name, status, entry_points: n, note });
+    } else if (l.id === 'java') {
+      const n = count(/\.java$/);
+      const unread = UNREAD.java.filter((f) => frameworks.has(f));
+      const springSeen = READ_BY.java.some((f) => frameworks.has(f));
+      rows.push({ language: 'java', files, extractor: 'spring', status: unread.length || !springSeen ? 'partial' : 'mapped', entry_points: n,
+        note: unread.length ? `Frameworks seen that this extractor does not read: ${unread.join(', ')}. Entry points they register may be missing.` : !springSeen ? 'No Spring project was found, so no routes were read. Web code in Java files is not in this map.' : n === 0 ? 'A web framework was detected and no entry point was found. The routes may be registered in a way the extractor does not read.' : 'Spring MVC controllers (@RestController, @Controller and the mapping annotations) are read, with method security annotations and the Spring Security filter chain rules.' });
+    } else if (l.id === 'csharp') {
+      const n = count(/\.cs$/);
+      const aspSeen = READ_BY.csharp.some((f) => frameworks.has(f));
+      rows.push({ language: 'csharp', files, extractor: 'aspnet', status: aspSeen ? 'mapped' : 'partial', entry_points: n,
+        note: !aspSeen ? 'No ASP.NET Core project was found, so no routes were read. Web code in C# files is not in this map.' : n === 0 ? 'A web framework was detected and no entry point was found. The routes may be registered in a way the extractor does not read.' : 'ASP.NET Core controllers ([Route] and the [HttpGet] family) and minimal APIs (MapGet and the others, with MapGroup) are read, with [Authorize], [AllowAnonymous], RequireAuthorization and a fallback policy.' });
+    } else if (l.id === 'kotlin' || l.id === 'swift' || l.id === 'rust') {
+      const fw = l.id === 'kotlin' ? 'android' : l.id === 'swift' ? 'ios' : 'axum|actix-web';
+      const n = entries.filter((e) => new RegExp(`^(?:${fw})$`).test(e.framework)).length;
+      const what = l.id === 'kotlin' ? 'AndroidManifest.xml (exported components and deep links) and the network security configuration' : l.id === 'swift' ? 'Info.plist (URL schemes, App Transport Security) and the entitlements (associated domains)' : 'Cargo.toml, and axum and actix web routes';
+      const read = l.id === 'rust' ? rustFiles(repo).length > 0 || (cargoConfig(repo)?.manifests.length ?? 0) > 0 : l.id === 'kotlin' ? (facts.android?.manifests.length ?? 0) > 0 : (facts.ios?.plists.length ?? 0) > 0;
+      rows.push(read
+        ? { language: l.id, files, extractor: l.id === 'kotlin' ? 'android' : l.id === 'swift' ? 'ios' : 'rust', status: 'partial', entry_points: n, note: `${what[0].toUpperCase()}${what.slice(1)} are read. ${l.id === 'rust' ? 'Handler bodies are not read.' : 'The source files are not read, so what a handler does with an incoming intent or URL is not in this map.'}` }
+        : { language: l.id, files, extractor: null, status: 'not_mapped', entry_points: 0, note: `No extractor input found for ${l.id}${(UNREAD[l.id] ?? []).filter((f) => frameworks.has(f)).length ? ` (frameworks seen: ${(UNREAD[l.id] ?? []).filter((f) => frameworks.has(f)).join(', ')})` : ''}. Entry points in ${l.id} files are not in this map.` });
+    } else if (SERVER_LANGS.has(l.id)) {
+      const seen = (UNREAD[l.id] ?? []).filter((f) => frameworks.has(f));
+      rows.push({ language: l.id, files, extractor: null, status: 'not_mapped', entry_points: 0, note: `No extractor for ${l.id} yet${seen.length ? ` (frameworks seen: ${seen.join(', ')})` : ''}. Entry points in ${l.id} files are not in this map.` });
+    }
+  }
+  // Files an extractor threw on: the language they belong to is only partly mapped.
+  const langOfFailed = (file: string): string => (/\.py$/.test(file) || /django/.test(file) ? 'python' : /\.go$|\(go /.test(file) ? 'go' : /\.rb$|\(rails /.test(file) ? 'ruby' : /\.php$|\(laravel /.test(file) ? 'php' : /\.tsx?$/.test(file) ? 'typescript' : 'javascript');
+  for (const f of failed) {
+    const lang = langOfFailed(f.file);
+    const row = rows.find((r) => r.language === lang) ?? rows[0];
+    if (row && !row.note.includes('could not be read')) { row.status = 'partial'; row.note += ` ${failed.filter((x) => langOfFailed(x.file) === lang).length} file(s) could not be read by the extractor, first: ${f.file}.`; }
+  }
+  return rows.sort((a, b) => cmp(a.language, b.language));
+}

package/src/map/candidates.ts

@@ -0,0 +1,47 @@
+// Names in entry points that look like sign in helpers and that the vocabulary did not recognise. The owner reads the list
+// and copies the real ones into auth_helpers in .hullproof/kit.local.json (see local-vocab.ts). Only entry points that
+// change state or read data and show no session read are looked at, so a list on a repository the map already understands
+// is short or empty. The list is sorted by how many entry points use the name, then by name.
+import type { AuthHelperCandidate, EntryPoint } from '../types/index.ts';
+import type { Repo } from './repo.ts';
+
+const AUTHISH = /auth|login|logged|session|token|jwt|bearer|guard|protect|permission|member|tenant|signed|credential|principal|identity|viewer|whoami|current|require|ensure|verify|owner|account|user/i;
+const SKIP = /^(?:console|log|logger|status|json|send|redirect|render|parse|stringify|then|catch|require|import|function|return|if|for|while|switch|await|async|new|super|print|puts|len|str|int|dict|list|set|get|post|put|patch|delete|use|map|filter|reduce|find|from|select|where|insert|update|create|emit|on|once|next|type|isinstance|self|this|params|param|query|body|request|response|req|res|ctx|c|r|w|id|name|email|password|user|users|account|accounts|session|token|userId|user_id|accountId|find_by|find_by_id|findOne|findById|first|last|all|count|exists|save|destroy|build|new_record|dispatch|useState|useEffect|useMemo|useCallback|useRef|useRouter|useParams|useSearchParams|useLocalSearchParams|useNavigation|useRoute|useContext|useQuery|useMutation|useTranslation|useForm|useWatch|useTheme|useColorScheme|useWindowDimensions)$/;
+const MAX = 25;
+
+export function authHelperCandidates(repo: Repo, entries: EntryPoint[]): AuthHelperCandidate[] {
+  const seen = new Map<string, { n: number; file: string; line: number }>();
+  const judged = entries.filter((e) => !e.test_code && ['http_route', 'server_action', 'graphql_resolver', 'rpc'].includes(e.kind) && e.kind !== 'webhook' && (e.tags.includes('state_changing') || e.data.length > 0)
+    && !e.tags.includes('auth_endpoint') && !e.tags.includes('public') && !e.protections.some((p) => p.kind === 'session_read' && p.confidence !== 'low' && p.enforced !== false));
+  for (const e of judged) {
+    const file = e.handler?.file ?? e.file;
+    const first = e.handler?.line ?? e.line;
+    const lines = repo.ctx.text(file).split('\n').slice(Math.max(0, first - 4), Math.max(first, e.end_line));
+    const names = new Set<string>();
+    const ruby = /\.rb$/.test(file);
+    if (ruby) {
+      // Class level filters of the controller that run before this action.
+      const action = e.name?.split('#')[1];
+      for (const fl of repo.ctx.text(file).matchAll(/^[ \t]*(?:prepend_)?before_action\b([^\n]*)$/gm)) {
+        const only = /\bonly:\s*(%i\[([^\]]*)\]|\[([^\]]*)\]|:(\w+))/.exec(fl[1]);
+        const except = /\bexcept:\s*(%i\[([^\]]*)\]|\[([^\]]*)\]|:(\w+))/.exec(fl[1]);
+        const list = (m: RegExpExecArray | null): string[] => (m ? (m[2] ?? m[3] ?? m[4] ?? '').split(/[\s,]+/).map((x) => x.replace(/^:/, '')).filter(Boolean) : []);
+        if (action && ((only && !list(only).includes(action)) || (except && list(except).includes(action)))) continue;
+        for (const n of fl[1].replace(/\b(?:only|except|if|unless)\s*:.*$/, '').matchAll(/:(\w+[?!]?)/g)) names.add(n[1]);
+      }
+    }
+    for (const l of lines) {
+      if (/^\s*(?:func|def|function|public|private|protected|class|module|before_action|prepend_before_action|skip_before_action|skip_before_filter|allow_unauthenticated_access)\b/.test(l)) continue;
+      const code = l.replace(/\/\/.*$|#(?!\[).*$/, '');
+      for (const m of code.matchAll(ruby ? /(?:@|->|::|\.|\b)([A-Za-z_$][\w$]*[!?]?)\s*(?:\(|\b(?=\s*$)|(?=\s*,|\s*\)))/g : /(?:@|->|::|\.|\b)([A-Za-z_$][\w$]*[!?]?)\s*(?:\(|(?=\s*,|\s*\)))/g)) names.add(m[1]);
+      for (const m of code.matchAll(/:(\w+[!?]?)/g)) if (/^\s*(?:before_action|skip_before_action)/.test(code)) names.add(m[1]);
+    }
+    for (const n of names) {
+      if (n.length < 4 || SKIP.test(n) || !AUTHISH.test(n)) continue;
+      const cur = seen.get(n);
+      if (cur) cur.n++; else seen.set(n, { n: 1, file: e.file, line: e.line });
+    }
+  }
+  return [...seen.entries()].map(([name, v]) => ({ name, entry_points: v.n, file: v.file, line: v.line }))
+    .sort((a, b) => b.entry_points - a.entry_points || (a.name < b.name ? -1 : a.name > b.name ? 1 : 0)).slice(0, MAX);
+}

package/src/map/cblocks.ts

@@ -0,0 +1,55 @@
+// Shared reading helpers for the annotation based languages (Java and Kotlin in Spring, C# attributes): split a class body into
+// declaration blocks, each with the annotations in front of it, and read string literals out of annotation arguments. Works on masked
+// text for structure and on the original text for the string values, which sit at the same positions.
+import { closeOf } from './lex.ts';
+
+export interface Anno { name: string; start: number; end: number; args: { start: number; end: number } | null }
+export interface Block { annos: Anno[]; start: number; end: number; declStart: number }
+
+// Annotations of the form @Name or @Name(...) at brace depth 0 of the range [from, to), grouped into blocks of consecutive annotations.
+// `declStart` is the first character after the last annotation of the block (the declaration the annotations belong to).
+export function annotationBlocks(masked: string, from: number, to: number): Block[] {
+  const out: Block[] = [];
+  let depth = 0;
+  let cur: Block | null = null;
+  for (let i = from; i < to; i++) {
+    const c = masked[i];
+    if (c === '{' || c === '(' || c === '[') { depth++; continue; }
+    if (c === '}' || c === ')' || c === ']') { depth--; continue; }
+    if (depth !== 0 || c !== '@') continue;
+    const m = /^@([A-Za-z_][\w.]*)/.exec(masked.slice(i, i + 80));
+    if (!m) continue;
+    let end = i + m[0].length;
+    let args: Anno['args'] = null;
+    let k = end;
+    while (/[ \t]/.test(masked[k] ?? '')) k++;
+    if (masked[k] === '(') {
+      const close = closeOf(masked, k);
+      if (close > 0) { args = { start: k + 1, end: close - 1 }; end = close; }
+    }
+    const gap = cur ? masked.slice(cur.annos[cur.annos.length - 1].end, i) : '';
+    if (cur && /^\s*$/.test(gap)) cur.annos.push({ name: m[1], start: i, end, args });
+    else { cur = { annos: [{ name: m[1], start: i, end, args }], start: i, end: 0, declStart: 0 }; out.push(cur); }
+    i = end - 1;
+  }
+  for (const b of out) { b.end = b.annos[b.annos.length - 1].end; let d = b.end; while (/\s/.test(masked[d] ?? '')) d++; b.declStart = d; }
+  return out;
+}
+
+// All "string" literals in the text, with the escapes of a quoted string left as written.
+export const strings = (text: string): string[] => [...text.matchAll(/"((?:[^"\\\n]|\\.)*)"/g)].map((m) => m[1]);
+
+// Top level comma split of a parameter or argument list (commas inside (), [], {} and <> do not split).
+export function splitTop(text: string): string[] {
+  const out: string[] = [];
+  let depth = 0;
+  let from = 0;
+  for (let i = 0; i < text.length; i++) {
+    const c = text[i];
+    if (c === '(' || c === '[' || c === '{' || c === '<') depth++;
+    else if (c === ')' || c === ']' || c === '}' || (c === '>' && text[i - 1] !== '=' && text[i - 1] !== '-')) depth = Math.max(0, depth - 1);
+    else if (c === ',' && depth === 0) { out.push(text.slice(from, i)); from = i + 1; }
+  }
+  if (text.slice(from).trim()) out.push(text.slice(from));
+  return out.map((x) => x.trim()).filter(Boolean);
+}

package/src/map/config.ts

@@ -0,0 +1,207 @@
+// Configuration maps: Supabase tables from migration SQL (row level security, policies, grants, columns) and Firebase rules
+// (Firestore, Storage and Realtime Database) as one record per match path.
+import type { FirebaseRule, SupabaseTable } from '../types/index.ts';
+import { cmp } from '../util.ts';
+import { Lines } from './lex.ts';
+import type { Repo } from './repo.ts';
+
+interface Stmt { text: string; line: number }
+
+// SQL statements with their start line. Comments are dropped, and ";" inside quotes, dollar quoted bodies and brackets does not split.
+export function sqlStatements(sql: string): Stmt[] {
+  const lines = new Lines(sql);
+  const out: Stmt[] = [];
+  let i = 0;
+  let start = 0;
+  let depth = 0;
+  const n = sql.length;
+  let buf = '';
+  const flush = (end: number): void => {
+    const t = buf.trim();
+    if (t) out.push({ text: t, line: lines.at(start + (buf.length - buf.trimStart().length)) });
+    buf = '';
+    start = end;
+  };
+  while (i < n) {
+    const c = sql[i];
+    if (c === '-' && sql[i + 1] === '-') { while (i < n && sql[i] !== '\n') i++; continue; }
+    if (c === '/' && sql[i + 1] === '*') { const e = sql.indexOf('*/', i + 2); i = e < 0 ? n : e + 2; continue; }
+    if (c === "'") { let j = i + 1; while (j < n && !(sql[j] === "'" && sql[j + 1] !== "'")) { if (sql[j] === "'" ) j++; j++; } buf += sql.slice(i, j + 1); i = j + 1; continue; }
+    if (c === '$') {
+      const tag = /^\$[A-Za-z_]*\$/.exec(sql.slice(i, i + 40));
+      if (tag) { const e = sql.indexOf(tag[0], i + tag[0].length); const end = e < 0 ? n : e + tag[0].length; buf += sql.slice(i, end); i = end; continue; }
+    }
+    if (c === '(') depth++;
+    else if (c === ')') depth--;
+    if (c === ';' && depth <= 0) { i++; flush(i); depth = 0; continue; }
+    buf += c;
+    i++;
+  }
+  flush(n);
+  return out;
+}
+
+const IDENT = String.raw`(?:"[^"]+"|[A-Za-z_][\w$]*)`;
+const QNAME = String.raw`(${IDENT}(?:\s*\.\s*${IDENT})?)`;
+const unq = (s: string): string => s.replace(/"/g, '').replace(/\s+/g, '').replace(/^public\./i, '');
+
+function splitTop(s: string, sep = ','): string[] {
+  const out: string[] = [];
+  let depth = 0;
+  let cur = '';
+  for (const c of s) {
+    if (c === '(') depth++;
+    else if (c === ')') depth--;
+    if (c === sep && depth === 0) { out.push(cur); cur = ''; } else cur += c;
+  }
+  if (cur.trim()) out.push(cur);
+  return out;
+}
+function parenBody(s: string, from: number): string | null {
+  const open = s.indexOf('(', from);
+  if (open < 0) return null;
+  let depth = 0;
+  for (let i = open; i < s.length; i++) { if (s[i] === '(') depth++; else if (s[i] === ')') { depth--; if (depth === 0) return s.slice(open + 1, i); } }
+  return null;
+}
+
+export function supabaseMap(repo: Repo): { tables: SupabaseTable[] } | null {
+  const files = repo.ctx.files.filter((f) => /(?:^|\/)supabase\/(?:migrations\/.*|schema|seed)\.sql$|(?:^|\/)migrations\/.*\.sql$|(?:^|\/)schema\.sql$/i.test(f) && !/seed/i.test(f)).sort(cmp);
+  if (!files.length) return null;
+  const tables = new Map<string, SupabaseTable>();
+  const get = (name: string, file: string, line: number): SupabaseTable => {
+    let t = tables.get(name);
+    if (!t) { t = { name, file, line, rls_enabled: null, columns: [], policies: [], grants: [] }; tables.set(name, t); }
+    return t;
+  };
+  for (const file of files) {
+    for (const st of sqlStatements(repo.ctx.text(file))) {
+      const s = st.text;
+      let m: RegExpExecArray | null;
+      if ((m = new RegExp(String.raw`^create\s+(?:unlogged\s+)?table\s+(?:if\s+not\s+exists\s+)?${QNAME}`, 'i').exec(s))) {
+        const name = unq(m[1]);
+        const t = get(name, file, st.line);
+        t.file = file; t.line = st.line; t.policies = []; t.grants = []; t.rls_enabled = null;
+        const body = parenBody(s, m[0].length) ?? '';
+        t.columns = splitTop(body).map((c) => c.trim()).filter((c) => c && !/^(?:primary\s+key|foreign\s+key|unique|constraint|check|like|exclude)\b/i.test(c)).map((c) => unq(/^(?:"[^"]+"|[A-Za-z_][\w$]*)/.exec(c)?.[0] ?? '')).filter(Boolean).sort();
+      } else if ((m = new RegExp(String.raw`^alter\s+table\s+(?:if\s+exists\s+)?(?:only\s+)?${QNAME}\s+(enable|disable|force|no\s+force)\s+row\s+level\s+security`, 'i').exec(s))) {
+        const t = get(unq(m[1]), file, st.line);
+        const w = m[2].toLowerCase();
+        if (w === 'enable') t.rls_enabled = true; else if (w === 'disable') t.rls_enabled = false;
+      } else if ((m = new RegExp(String.raw`^alter\s+table\s+(?:if\s+exists\s+)?(?:only\s+)?${QNAME}\s+add\s+column\s+(?:if\s+not\s+exists\s+)?(${IDENT})`, 'i').exec(s))) {
+        const t = get(unq(m[1]), file, st.line);
+        t.columns = [...new Set([...t.columns, unq(m[2])])].sort();
+      } else if ((m = new RegExp(String.raw`^create\s+policy\s+(${IDENT}|'[^']*')\s+on\s+${QNAME}`, 'i').exec(s))) {
+        const t = get(unq(m[2]), file, st.line);
+        const rest = s.slice(m[0].length);
+        const op = /\bfor\s+(all|select|insert|update|delete)\b/i.exec(rest)?.[1]?.toLowerCase() ?? 'all';
+        const rolesText = /\bto\s+([\w",\s]+?)(?=\s+(?:using|with)\b|$)/i.exec(rest)?.[1] ?? 'public';
+        const roles = rolesText.split(',').map((r) => r.trim().replace(/"/g, '').toLowerCase()).filter(Boolean);
+        const u = /\busing\s*\(/i.exec(rest);
+        const c = /\bwith\s+check\s*\(/i.exec(rest);
+        t.policies.push({
+          name: m[1].replace(/["']/g, ''), op, roles: roles.sort(), using: u ? (parenBody(rest, u.index) ?? '').replace(/\s+/g, ' ').trim() : null,
+          check: c ? (parenBody(rest, c.index) ?? '').replace(/\s+/g, ' ').trim() : null, line: st.line, permissive: !/\bas\s+restrictive\b/i.test(rest),
+        });
+      } else if ((m = new RegExp(String.raw`^drop\s+policy\s+(?:if\s+exists\s+)?(${IDENT}|'[^']*')\s+on\s+${QNAME}`, 'i').exec(s))) {
+        const t = tables.get(unq(m[2]));
+        if (t) t.policies = t.policies.filter((p) => p.name !== m![1].replace(/["']/g, ''));
+      } else if ((m = new RegExp(String.raw`^drop\s+table\s+(?:if\s+exists\s+)?${QNAME}`, 'i').exec(s))) {
+        tables.delete(unq(m[1]));
+      } else if ((m = /^grant\s+([\s\S]+?)\s+on\s+(?:table\s+)?([\s\S]+?)\s+to\s+([\s\S]+?)(?:\s+with\s+grant\s+option)?$/i.exec(s)) && !/^grant\s+\w+\s+to\s/i.test(s) && !/\bon\s+(?:function|sequence|schema|type|all\s+functions|all\s+sequences)/i.test(s)) {
+        const all = /^all\s+tables\s+in\s+schema/i.test(m[2]);
+        const targets = all ? ['*'] : splitTop(m[2]).map((x) => unq(x.trim().replace(/^table\s+/i, '')));
+        const privs = splitTop(m[1]).map((p) => p.trim()).filter(Boolean).map((p) => {
+          const pm = /^(all(?:\s+privileges)?|select|insert|update|delete|truncate|references|trigger)\s*(?:\(([^)]*)\))?$/i.exec(p);
+          return pm ? { priv: pm[1].toLowerCase().replace(/\s+privileges/, ''), cols: pm[2] ? pm[2].split(',').map((c) => c.trim().replace(/"/g, '')).sort() : null } : null;
+        }).filter((x): x is { priv: string; cols: string[] | null } => x !== null);
+        const roles = splitTop(m[3]).map((r) => r.trim().replace(/"/g, '').toLowerCase());
+        for (const tn of targets) {
+          const t = get(tn, file, st.line);
+          for (const role of roles) {
+            for (const p of privs) t.grants.push({ role, privileges: [p.priv], columns: p.cols, line: st.line });
+          }
+        }
+      } else if ((m = /^revoke\s+([\s\S]+?)\s+on\s+(?:table\s+)?([\s\S]+?)\s+from\s+([\s\S]+)$/i.exec(s))) {
+        const targets = splitTop(m[2]).map((x) => unq(x.trim().replace(/^table\s+/i, '')));
+        const roles = splitTop(m[3]).map((r) => r.trim().replace(/"/g, '').toLowerCase());
+        const privs = splitTop(m[1]).map((p) => p.trim().toLowerCase().replace(/\s+privileges/, '').replace(/\s*\(.*\)/, ''));
+        for (const tn of targets) {
+          const t = tables.get(tn);
+          if (!t) continue;
+          t.grants = t.grants.filter((g) => !(roles.includes(g.role) && (privs.includes('all') || g.privileges.some((p) => privs.includes(p)))));
+        }
+      }
+    }
+  }
+  // Default privileges and schema wide grants ("*") apply to every table.
+  const star = tables.get('*');
+  tables.delete('*');
+  const list = [...tables.values()].filter((t) => t.name !== '').sort((a, b) => cmp(a.name, b.name));
+  if (star) for (const t of list) t.grants = [...t.grants, ...star.grants.map((g) => ({ ...g }))];
+  for (const t of list) {
+    t.policies.sort((a, b) => a.line - b.line || cmp(a.name, b.name));
+    t.grants.sort((a, b) => cmp(a.role, b.role) || cmp(a.privileges[0], b.privileges[0]) || a.line - b.line);
+  }
+  return { tables: list };
+}
+
+const OWNER_VAR = /uid|user_?id|owner|account|author|member|tenant/i;
+
+export function firebaseMap(repo: Repo): { rules: FirebaseRule[] } | null {
+  const files = repo.ctx.files.filter((f) => /(?:^|\/)[^/]*\.rules$|(?:^|\/)database\.rules\.json$|(?:^|\/)[^/]*\.rules\.json$/.test(f)).sort(cmp);
+  if (!files.length) return null;
+  const rules: FirebaseRule[] = [];
+  for (const file of files) {
+    const text = repo.ctx.text(file);
+    if (/\.json$/.test(file)) { realtimeRules(file, text, rules); continue; }
+    const service: FirebaseRule['service'] = /storage/i.test(file) || /service\s+firebase\.storage/.test(text) ? 'storage' : 'firestore';
+    // Rules files have // and /* */ comments and paths with slashes, which the JavaScript masker would read as regular expressions.
+    const masked = text.replace(/\/\/[^\n]*|\/\*[\s\S]*?\*\//g, (c) => c.replace(/[^\n]/g, ' '));
+    const lines = new Lines(text);
+    const stack: { path: string; close: number }[] = [];
+    const re = /\bmatch\s+((?:\/(?:\{[^}]*\}|[^\s{/])*)+)\s*\{|\ballow\s+([\w,\s]+?)\s*(?::\s*if\s+([^;]*?))?\s*;/g;
+    for (let m = re.exec(masked); m; m = re.exec(masked)) {
+      while (stack.length && m.index >= stack[stack.length - 1].close) stack.pop();
+      if (m[1] !== undefined) {
+        const open = m.index + m[0].length - 1;
+        let depth = 0;
+        let close = masked.length;
+        for (let i = open; i < masked.length; i++) { if (masked[i] === '{') depth++; else if (masked[i] === '}') { depth--; if (depth === 0) { close = i; break; } } }
+        stack.push({ path: m[1].trim(), close });
+      } else {
+        const ops = m[2].split(',').map((o) => o.trim()).filter(Boolean).sort();
+        const cond = (text.slice(m.index, m.index + m[0].length).replace(/^allow\s+[\w,\s]+?\s*(?::\s*if\s+)?/, '').replace(/;$/, '')).replace(/\s+/g, ' ').trim();
+        const fullPath = stack.map((s) => s.path).join('').replace(/\/+/g, '/');
+        const wild = [...fullPath.matchAll(/\{(\w+)(?:=\*\*)?\}/g)].map((x) => x[1]);
+        const uidWild = wild.filter((w) => OWNER_VAR.test(w));
+        const ownerBound = new RegExp(`request\\.auth\\.uid\\s*==\\s*(?:${wild.join('|') || '@@'})\\b|\\b(?:${wild.join('|') || '@@'})\\s*==\\s*request\\.auth\\.uid|resource(?:\\.data)?\\.\\w+\\s*==\\s*request\\.auth\\.uid|request\\.resource\\.data\\.\\w+\\s*==\\s*request\\.auth\\.uid|request\\.auth\\.uid\\s+in\\s|\\b(?:isOwner|owns|isUser|isOwnerOf|belongsToUser)\\s*\\(`).test(cond)
+          || (/\b[a-z]\w*\s*\(/i.test(cond) && !/request\.auth\s*!=\s*null|request\.auth\s*==\s*null/.test(cond) && /owner|isUser|uid/i.test(cond));
+        const open = cond === '' || /^true$/.test(cond) || /^request\.time\s*<\s*timestamp\.date\(/.test(cond);
+        rules.push({ service, file, line: lines.at(m.index), path: fullPath || '/', ops, condition: cond.slice(0, 200), uses_auth: /request\.auth/.test(cond), owner_bound: ownerBound, always_true: open, owner_wildcard: uidWild.length > 0 });
+      }
+    }
+  }
+  return { rules: rules.sort((a, b) => cmp(a.file, b.file) || a.line - b.line || cmp(a.ops.join(), b.ops.join())) };
+}
+
+function realtimeRules(file: string, text: string, out: FirebaseRule[]): void {
+  let json: unknown;
+  try { json = JSON.parse(text); } catch { return; }
+  const lines = new Lines(text);
+  let cursor = 0;
+  const walkNode = (node: unknown, path: string[]): void => {
+    if (!node || typeof node !== 'object') return;
+    for (const [k, v] of Object.entries(node as Record<string, unknown>)) {
+      if ((k === '.read' || k === '.write') && (typeof v === 'string' || typeof v === 'boolean')) {
+        const cond = String(v);
+        const at = text.indexOf(`"${k}"`, cursor);
+        if (at >= 0) cursor = at + 1;
+        const wild = path.filter((p) => p.startsWith('$'));
+        const ownerBound = /\$\w+\s*===?\s*auth\.uid|auth\.uid\s*===?\s*\$\w+|\.val\(\)\s*===?\s*auth\.uid|auth\.uid\s*===?\s*(?:data|newData)/.test(cond);
+        out.push({ service: 'realtime', file, line: at >= 0 ? lines.at(at) : 1, path: '/' + path.join('/'), ops: [k.slice(1)], condition: cond.slice(0, 200), uses_auth: /\bauth\b/.test(cond), owner_bound: ownerBound, always_true: cond.trim() === 'true', owner_wildcard: wild.some((w) => OWNER_VAR.test(w)) });
+      } else if (!k.startsWith('.')) walkNode(v, [...path, k]);
+    }
+  };
+  walkNode((json as { rules?: unknown }).rules, []);
+}