hullproof 0.0.0-stage → 0.5.0

package/src/map/dotnet.ts

@@ -0,0 +1,205 @@
+// ASP.NET Core entry points (C#): controllers with [Route] and the [HttpGet] family, and minimal APIs (MapGet, MapPost and the others,
+// with MapGroup prefixes). What protects each one: [Authorize] (with Roles or Policy), [AllowAnonymous], RequireAuthorization() on an
+// endpoint or a group, a fallback policy that requires a sign in, and what the handler body does. [AllowAnonymous] anywhere on an
+// endpoint turns the authorization attributes off, as it does in ASP.NET Core. Pattern based, like the other extractors.
+import type { Protection } from '../types/index.ts';
+import type { FileView } from './analyze.ts';
+import { splitTop, strings } from './cblocks.ts';
+import { empty, joinPath, makeEntry, normPath, type Extracted } from './entry.ts';
+import { cMethod, type FnIndex } from './light-index.ts';
+import { analyzeLight, type LightDeco } from './light.ts';
+import { closeOf, splitArgs } from './lex.ts';
+import type { LocalVocab } from './local-vocab.ts';
+import type { Repo } from './repo.ts';
+
+const HTTP: Record<string, string> = { HttpGet: 'GET', HttpPost: 'POST', HttpPut: 'PUT', HttpDelete: 'DELETE', HttpPatch: 'PATCH', HttpHead: 'HEAD', HttpOptions: 'OPTIONS' };
+const SERVICE_TYPE = /^(?:I[A-Z]\w+|\w*(?:Db|DbContext|Context|Service|Repository|Logger|Options|Factory|Manager|Client|Provider|Handler)|CancellationToken|HttpContext|HttpRequest|HttpResponse|ClaimsPrincipal|IConfiguration|LinkGenerator|TokenService)\b/;
+const AUTH_KINDS = new Set(['session_read', 'role_check']);
+
+export function dotnetFiles(repo: Repo): string[] {
+  return repo.filesOf('cs').filter((f) => { const v = repo.view(f); return !!v && (/Controller\b|\[ApiController\]/.test(v.masked) || /\.\s*Map(?:Get|Post|Put|Delete|Patch|Methods|Group)\s*\(/.test(v.masked)); });
+}
+
+interface Attr { name: string; start: number; end: number; args: string }
+interface ABlock { attrs: Attr[]; start: number; end: number; declStart: number }
+
+// Attribute lists ([A], [A, B(1)], [A][B]) that stand alone at brace depth 0 of [from, to): the first thing on their line, or right after another list.
+function attributeBlocks(v: FileView, from: number, to: number): ABlock[] {
+  const m = v.masked;
+  const out: ABlock[] = [];
+  let depth = 0;
+  let cur: ABlock | null = null;
+  for (let i = from; i < to; i++) {
+    const c = m[i];
+    if (c === '{' || c === '(') { depth++; continue; }
+    if (c === '}' || c === ')') { depth--; continue; }
+    if (c === '[' && depth === 0) {
+      const lineStart = m.lastIndexOf('\n', i) + 1;
+      const first = /^[ \t]*$/.test(m.slice(Math.max(lineStart, from), i));
+      const chained = cur !== null && /^\s*$/.test(m.slice(cur.end, i));
+      if (!first && !chained) { const e = closeOf(m, i); if (e > 0) i = e - 1; continue; }
+      const close = closeOf(m, i);
+      if (close < 0) continue;
+      const attrs: Attr[] = splitTop(v.text.slice(i + 1, close - 1)).map((t) => {
+        const nm = /^(?:\w+\s*:\s*)?([\w.]+)\s*(?:\(([\s\S]*)\))?$/.exec(t);
+        const at = i + 1 + v.text.slice(i + 1, close - 1).indexOf(t);
+        return { name: (nm?.[1] ?? t).replace(/^.*\./, '').replace(/Attribute$/, ''), start: at, end: at + t.length, args: nm?.[2] ?? '' };
+      });
+      if (chained && cur) { cur.attrs.push(...attrs); cur.end = close; }
+      else { cur = { attrs, start: i, end: close, declStart: 0 }; out.push(cur); }
+      i = close - 1;
+    }
+  }
+  for (const b of out) { let d = b.end; while (/\s/.test(m[d] ?? '')) d++; b.declStart = d; }
+  return out;
+}
+
+const tokens = (route: string, controller: string, action: string): string => route.replace(/\[controller\]/gi, controller.toLowerCase()).replace(/\[action\]/gi, action.toLowerCase()).replace(/\[area\]/gi, '');
+const cleanPath = (p: string): string => normPath(p.replace(/\{(\w+)\?\}/g, '{$1}').replace(/\{\*{1,2}(\w+)\}/g, '{$1}'));
+
+function seedsOf(paramsText: string): string[] {
+  const seeds: string[] = [];
+  for (const part of splitTop(paramsText)) {
+    if (/\[FromServices\]/.test(part)) continue;
+    const bare = part.replace(/\[[^\]]*\]\s*/g, '').replace(/\s*=\s*.*$/, '').trim();
+    const mm = /^(?:this\s+)?(?:ref\s+|out\s+|in\s+)?([\w.<>?,\[\]]+)\s+(\w+)$/.exec(bare);
+    if (!mm || SERVICE_TYPE.test(mm[1])) continue;
+    seeds.push(mm[2]);
+  }
+  return seeds;
+}
+
+interface Group { prefix: string; chain: { start: number; end: number; view: FileView } | null; anonymous: boolean }
+
+export function extractDotnet(repo: Repo, fn: FnIndex, local: LocalVocab | null): Extracted {
+  const out = empty();
+  // A fallback policy that needs a sign in, set anywhere in the project, covers every endpoint that is not [AllowAnonymous].
+  let fallback: Protection | null = null;
+  let controllersAuthorized: Protection | null = null;
+  for (const file of repo.filesOf('cs')) {
+    const v = repo.view(file);
+    if (!v) continue;
+    const fb = /\bFallbackPolicy\s*=/.exec(v.masked);
+    if (fb && !fallback) fallback = { kind: 'session_read', scope: 'global', file, line: v.lines.at(fb.index), via: 'FallbackPolicy requires an authenticated user', enforced: true, confidence: 'high' };
+    const mc = /\.\s*MapControllers\s*\(\s*\)\s*\.\s*RequireAuthorization\b/.exec(v.masked);
+    if (mc && !controllersAuthorized) controllersAuthorized = { kind: 'session_read', scope: 'router', file, line: v.lines.at(mc.index), via: 'MapControllers().RequireAuthorization()', enforced: true, confidence: 'high' };
+  }
+
+  const analyse = (v: FileView, start: number, end: number, seeds: string[], decos: LightDeco[], extra: Protection[], anonymous: boolean) => {
+    const a = analyzeLight(v, { start, end, seeds, decorators: decos, extra, lookup: fn.find, local });
+    if (anonymous) a.protections = a.protections.filter((p) => !(AUTH_KINDS.has(p.kind) && (p.scope === 'router' || p.scope === 'wrapper' || p.scope === 'global' || p.scope === 'middleware')));
+    return a;
+  };
+
+  for (const file of dotnetFiles(repo)) {
+    const v = repo.view(file);
+    if (!v) continue;
+    const m = v.masked;
+
+    // ---- controllers (a class is at the top of the file, or inside a block scoped namespace)
+    const ranges: [number, number][] = [[0, m.length]];
+    for (const ns of m.matchAll(/\bnamespace\s+[\w.]+\s*\{/g)) { const open = ns.index! + ns[0].length - 1; const close = closeOf(m, open); if (close > 0) ranges.push([open + 1, close - 1]); }
+    for (const cls of ranges.flatMap(([a, b]) => attributeBlocks(v, a, b))) {
+      const decl = /^(?:(?:public|internal|abstract|sealed|partial)\s+)*class\s+(\w+)\s*(?:\((?:[^()]|\([^()]*\))*\))?\s*(?::\s*([^{]+?))?\s*\{/.exec(m.slice(cls.declStart, cls.declStart + 500));
+      if (!decl) continue;
+      const names = cls.attrs.map((a) => a.name);
+      if (!(names.includes('ApiController') || names.includes('Controller') || /\b(?:ControllerBase|Controller)\b/.test(decl[2] ?? '') || /\wController$/.test(decl[1]))) continue;
+      const className = decl[1];
+      const controller = className.replace(/Controller$/, '');
+      const bodyOpen = cls.declStart + decl[0].length - 1;
+      const bodyClose = closeOf(m, bodyOpen);
+      if (bodyClose < 0) continue;
+      const classRoute = cls.attrs.find((a) => a.name === 'Route');
+      const classTemplate = classRoute ? strings(classRoute.args)[0] ?? '' : '';
+      const classAnon = names.includes('AllowAnonymous');
+      const classDeco: LightDeco = { view: v, start: cls.start, end: cls.end, scope: 'router' };
+      for (const blk of attributeBlocks(v, bodyOpen + 1, bodyClose - 1)) {
+        const verbs = blk.attrs.filter((a) => HTTP[a.name] || a.name === 'AcceptVerbs');
+        const routeAttr = blk.attrs.find((a) => a.name === 'Route');
+        if (!verbs.length && !routeAttr) continue;
+        const nameAt = /(\w+)\s*(?:<[^>]*>)?\s*\(/.exec(m.slice(blk.declStart, blk.declStart + 400));
+        if (!nameAt) continue;
+        const f = cMethod(m, blk.declStart + nameAt.index);
+        if (!f) continue;
+        const action = nameAt[1];
+        const anonymous = classAnon || blk.attrs.some((a) => a.name === 'AllowAnonymous');
+        const decos: LightDeco[] = [{ view: v, start: blk.start, end: blk.end, scope: 'wrapper' }];
+        if (cls.attrs.length) decos.push(classDeco);
+        const extra: Protection[] = anonymous ? [] : [fallback, controllersAuthorized].filter((x): x is Protection => !!x);
+        const seeds = seedsOf(f.params);
+        const methodList = verbs.length ? verbs.flatMap((a) => (HTTP[a.name] ? [{ verb: HTTP[a.name], attr: a }] : [...a.args.matchAll(/"([A-Za-z]+)"/g)].map((x) => ({ verb: x[1].toUpperCase(), attr: a })))) : [{ verb: 'ANY', attr: routeAttr! }];
+        for (const { verb, attr } of methodList) {
+          const own = strings(attr.args)[0];
+          const template = own === undefined && routeAttr && attr !== routeAttr ? strings(routeAttr.args)[0] : own;
+          let full: string;
+          const tpl = template === undefined ? undefined : tokens(template, controller, action);
+          const ctpl = tokens(classTemplate, controller, action);
+          if (tpl !== undefined && /^~?\//.test(tpl)) full = tpl.replace(/^~/, '');
+          else full = joinPath(ctpl ? '/' + ctpl.replace(/^\//, '') : '', tpl ?? '') || '/';
+          const path = cleanPath(full);
+          const an = analyse(v, blk.declStart, f.end, seeds, decos, extra, anonymous);
+          out.entries.push(makeEntry(repo, {
+            kind: 'http_route', framework: 'aspnet', file, line: v.lines.at(attr.start), method: verb, path: path.startsWith('/') ? path : '/' + path, name: `${className}.${action}`,
+            confidence: classTemplate || template !== undefined ? 'high' : 'medium', handlerView: v, spec: { start: blk.declStart, end: f.end, seeds }, analysis: an,
+          }));
+        }
+      }
+    }
+
+    // ---- minimal APIs
+    const groups = new Map<string, Group>();
+    for (const g of m.matchAll(/\b(?:var|RouteGroupBuilder)\s+(\w+)\s*=\s*(\w+)\s*\.\s*MapGroup\s*\(/g)) {
+      const open = g.index! + g[0].length - 1;
+      const close = closeOf(m, open);
+      if (close < 0) continue;
+      const semi = m.indexOf(';', close);
+      const parent = groups.get(g[2]);
+      const lit = strings(v.text.slice(open, close))[0] ?? '';
+      const chainText = m.slice(close, semi < 0 ? close : semi);
+      groups.set(g[1], { prefix: joinPath(parent?.prefix ?? '', lit), chain: { start: close, end: semi < 0 ? close : semi, view: v }, anonymous: (parent?.anonymous ?? false) || /\.\s*AllowAnonymous\s*\(/.test(chainText) });
+    }
+    for (const mp of m.matchAll(/\b(\w+)\s*\.\s*Map(Get|Post|Put|Delete|Patch|Methods)\s*\(/g)) {
+      const recv = mp[1];
+      const grp = groups.get(recv);
+      if (!grp && recv !== 'app' && recv !== 'endpoints' && recv !== 'builder') continue;
+      const open = mp.index! + mp[0].length - 1;
+      const close = closeOf(m, open);
+      if (close < 0) continue;
+      const args = splitArgs(m, open);
+      if (!args.length) continue;
+      const pathLit = strings(v.text.slice(args[0].start, args[0].end))[0];
+      if (pathLit === undefined) continue;
+      const semi = m.indexOf(';', close);
+      const chain = { start: close, end: semi < 0 ? close : semi };
+      const chainText = m.slice(chain.start, chain.end);
+      const anonymous = /\.\s*AllowAnonymous\s*\(/.test(chainText) || !!grp?.anonymous;
+      const verbs = mp[2] === 'Methods' ? [...v.text.slice(args[1]?.start ?? 0, args[1]?.end ?? 0).matchAll(/"([A-Za-z]+)"/g)].map((x) => x[1].toUpperCase()) : [mp[2].toUpperCase()];
+      const handler = args[args.length - 1];
+      if (!handler || args.length < 2) continue;
+      const htext = m.slice(handler.start, handler.end);
+      let seeds: string[] = [];
+      let start = handler.start;
+      let end = handler.end;
+      let hv: FileView = v;
+      const lam = /^(?:static\s+)?(?:async\s+)?\(([^)]*)\)\s*=>/.exec(htext) ?? /^(?:static\s+)?(?:async\s+)?(\w+)\s*=>/.exec(htext);
+      if (lam) seeds = seedsOf(v.text.slice(handler.start + htext.indexOf(lam[1]), handler.start + htext.indexOf(lam[1]) + lam[1].length));
+      else {
+        const nm = /(\w+)\s*$/.exec(htext)?.[1];
+        const ref = nm ? fn.find(nm, file) : null;
+        if (ref) { hv = ref.view; start = ref.start; end = ref.end; const op = ref.view.masked.indexOf('(', ref.start); const pc = op >= 0 ? closeOf(ref.view.masked, op) : -1; if (pc > 0) seeds = seedsOf(ref.view.text.slice(op + 1, pc - 1)); }
+      }
+      const decos: LightDeco[] = [{ view: v, start: chain.start, end: chain.end, scope: 'wrapper' }];
+      if (grp?.chain) decos.push({ view: grp.chain.view, start: grp.chain.start, end: grp.chain.end, scope: 'router' });
+      const extra: Protection[] = anonymous ? [] : [fallback].filter((x): x is Protection => !!x);
+      for (const verb of verbs) {
+        const path = cleanPath(joinPath(grp?.prefix ?? '', pathLit));
+        const an = analyse(hv, start, end, seeds, decos, extra, anonymous);
+        out.entries.push(makeEntry(repo, {
+          kind: 'http_route', framework: 'aspnet', file, line: v.lines.at(mp.index!), method: verb, path, name: null,
+          confidence: 'high', handlerView: hv, spec: { start, end, seeds }, analysis: an,
+        }));
+      }
+    }
+  }
+  return out;
+}

package/src/map/entry.ts

@@ -0,0 +1,80 @@
+// Builds one EntryPoint from a registration: runs the body analysis and adds the tags and the stable id.
+import type { Confidence, EntryKind, EntryPoint } from '../types/index.ts';
+import { testCodeReason } from '../report/test-code.ts';
+import { analyze, type Analysis, type FileView, type Spec } from './analyze.ts';
+import type { Repo } from './repo.ts';
+import { ADMIN_PATH, AUTH_ENDPOINT, PUBLIC_PATH } from './vocab.ts';
+
+export interface Seed {
+  kind: EntryKind; framework: string;
+  file: string; line: number;               // where the entry point is declared (the registration)
+  method: string | null; path: string | null; name: string | null;
+  confidence: Confidence;
+  handlerView: FileView; spec: Spec;        // the handler body to read, and what to read it with
+  tags?: string[];
+  analysis?: Analysis;                      // the body already read (Go, Ruby and PHP use light.ts)
+}
+
+const STATE_METHODS = new Set(['POST', 'PUT', 'PATCH', 'DELETE']);
+const WEBHOOK_HEADER = /[xX]-[\w-]*[sS]ignature|stripe-signature|paystack-signature|svix-signature|webhook-signature|HTTP_X_\w*SIGNATURE|x-hub-signature/i;
+
+// Path text with every parameter style written :name, and catch-alls written *name.
+export function normPath(p: string): string {
+  return p
+    .replace(/\[\[?\.\.\.(\w+)\]?\]/g, '*$1').replace(/\[(\w+)\]/g, ':$1')
+    .replace(/<(?:[\w.]+:)?(\w+)>/g, ':$1').replace(/\{(\w+)(?::[^}]*)?\}/g, ':$1')
+    .replace(/\(\?P<(\w+)>[^)]*\)/g, ':$1')
+    .replace(/\/{2,}/g, '/');
+}
+export function joinPath(prefix: string, path: string): string {
+  const j = `${prefix.replace(/\/+$/, '')}/${path.replace(/^\/+/, '')}`;
+  return normPath(j === '/' ? '/' : j.replace(/\/+$/, '') || '/');
+}
+
+export function makeEntry(repo: Repo, s: Seed): EntryPoint {
+  const hv = s.handlerView;
+  const a = s.analysis ?? analyze(hv, s.spec, repo.helpers(hv.lang));
+  const pathText = `${s.path ?? ''} ${s.name ?? ''}`;
+  const handlerText = hv.text.slice(s.spec.start, s.spec.end);
+  const hasSig = a.protections.some((p) => p.kind === 'signature_verify' && p.confidence === 'high' && /signature verify|hmac|svix/.test(p.via));
+  const webhook = s.kind === 'webhook' || (s.kind === 'http_route' && (/webhook/i.test(pathText) || /(^|\/)webhooks?(\/|\.|$)/i.test(s.file) || WEBHOOK_HEADER.test(handlerText) || hasSig && /hook/i.test(`${s.file} ${pathText}`)));
+  const kind: EntryKind = webhook ? 'webhook' : s.kind;
+  const method = s.method;
+  const tags = new Set<string>(s.tags ?? []);
+  if (webhook) tags.add('webhook');
+  const nameIsHandler = s.path === null || ['flask', 'fastapi', 'django', 'nest', 'quart', 'sanic', 'next-app', 'next-pages'].includes(s.framework);
+  if (AUTH_ENDPOINT.test(s.path ?? '') || (nameIsHandler && s.framework !== 'next-app' && AUTH_ENDPOINT.test((s.name ?? '').replace(/([a-z])([A-Z])/g, '$1_$2')))) tags.add('auth_endpoint');
+  if (ADMIN_PATH.test(s.path ?? '') || ADMIN_PATH.test(s.file)) tags.add('admin');
+  if (PUBLIC_PATH.test(s.path ?? '')) tags.add('public');
+  if (a.reads.some((r) => r.source === 'file')) tags.add('upload');
+  const writes = a.data.some((d) => d.op === 'write' || d.op === 'delete');
+  if (kind === 'server_action' || (method && STATE_METHODS.has(method)) || ((method === 'ANY' || method === null) && (writes || a.reads.some((r) => r.source === 'body' || r.source === 'form')) && (kind === 'http_route' || kind === 'webhook'))) tags.add('state_changing');
+  const clientPage = s.kind === 'page' && /^\s*(?:\/\/[^\n]*\n\s*)*['"]use client['"]/.test(hv.text.slice(0, 400));
+  if (clientPage) tags.add('client_component');
+  const handler = hv.file === s.file && s.spec.start >= 0 && hv.lines.at(s.spec.start) === s.line ? null : { file: hv.file, line: hv.lines.at(s.spec.start) };
+  return {
+    id: `${s.file}:${s.line}:${kind}:${method ?? '-'}:${s.path ?? '-'}:${s.name ?? '-'}`,
+    kind, framework: s.framework, file: s.file, line: s.line,
+    end_line: hv.lines.at(Math.max(s.spec.start, s.spec.end - 1)),
+    method, path: s.path, name: s.name, handler, confidence: s.confidence,
+    test_code: testCodeReason(s.file) !== null, tags: [...tags].sort(),
+    protections: clientPage ? [] : a.protections, reads: clientPage ? [] : a.reads, data: clientPage ? [] : a.data, outbound: clientPage ? [] : a.outbound,
+  };
+}
+
+// Parameter names of the function whose "(" is at `open` in masked text: plain names and the names inside destructuring.
+export function paramNames(masked: string, open: number): string[] {
+  let depth = 0;
+  let end = open;
+  for (let i = open; i < masked.length; i++) { const c = masked[i]; if (c === '(') depth++; else if (c === ')') { depth--; if (depth === 0) { end = i; break; } } }
+  const inner = masked.slice(open + 1, end).replace(/:[^,={}()]*(?:<[^>]*>)?/g, ' ').replace(/=[^,}]*/g, ' ');
+  const out: string[] = [];
+  for (const m of inner.matchAll(/(?<![.\w$@])([A-Za-z_$][\w$]*)/g)) if (!['async', 'this', 'self', 'cls'].includes(m[1])) out.push(m[1]);
+  return out;
+}
+
+// What one extractor returns for one file. A mount says "routes registered in `target` live under `prefix`".
+import type { Gate, Protection } from '../types/index.ts';
+export interface Mount { from: string; line: number; prefix: string; target: string; protections: Protection[] }
+export interface Extracted { entries: EntryPoint[]; gates: Gate[]; mounts: Mount[] }
+export const empty = (): Extracted => ({ entries: [], gates: [], mounts: [] });

package/src/map/expo.ts

@@ -0,0 +1,171 @@
+// Expo and React Native entry points: Expo Router screens (the app/ folder), API routes (+api files), deep links declared
+// in app.json or app.config (scheme, universal links, Android intent filters) and deep links handled in code (Linking
+// listeners, useURL, a navigation linking config). The protections of a screen are the sign in guards in the layouts above
+// it. A layout guard is a client side redirect: it keeps a signed out user from seeing a screen, it does not stop a request
+// to your server, so a screen's own data calls still need a server side check (the report says "client side" in `via`).
+import type { EntryPoint, Protection } from '../types/index.ts';
+import { testCodeReason } from '../report/test-code.ts';
+import type { FileView } from './analyze.ts';
+import { empty, makeEntry, normPath, type Extracted } from './entry.ts';
+import { splitArgs } from './lex.ts';
+import { exportedFunctions, resolveFunction } from './js-next.ts';
+import type { Repo } from './repo.ts';
+
+const METHODS = ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS'];
+const SOURCE_EXT = /\.[cm]?[jt]sx?$/;
+// Session reads in mobile code: auth hooks and contexts, provider SDK calls, secure storage of a token.
+const EXPO_SESSION: { re: RegExp; via: string; conf: 'high' | 'medium' }[] = [
+  { re: /\b(?:useAuth|isSignedIn|useSession|useUser|useAuthContext|useAuthState|useSupabaseSession|useConvexAuth|useKindeAuth|useAuth0)\b/, via: 'auth hook', conf: 'medium' },
+  { re: /\bsupabase\.auth\.(?:getSession|getUser|onAuthStateChange)\b|\bonAuthStateChanged\s*\(|\bgetAuth\s*\(|\bfirebase\.auth\(\)|\bauth\(\)\.currentUser|\bClerkProvider\b|\bSignedIn\b|\bSignedOut\b/, via: 'auth provider', conf: 'high' },
+  { re: /\b(?:SecureStore|AsyncStorage|storage)\.(?:getItem|getItemAsync|get|getString)\s*\(\s*['"][\w.-]*(?:token|session|jwt|auth)[\w.-]*['"]/i, via: 'stored token', conf: 'medium' },
+  { re: /\b(?:isAuthenticated|isLoggedIn|isAuthed|signedIn|loggedIn)\b/, via: 'signed in flag', conf: 'medium' },
+];
+const GUARD_REDIRECT = /<Redirect\b[^>]*\bhref\b|\brouter\.(?:replace|push|navigate)\s*\(|\bnavigation\.(?:replace|navigate|reset)\s*\(|\bProtected\b[^>]*\bguard\s*=|\bredirect\s*\(/;
+const GUARD_CONDITION = /\bif\s*\(\s*!\s*\(?\s*\w*(?:session|user|token|signedIn|isSignedIn|isAuthenticated|isLoggedIn|authenticated|auth)\w*|\bguard\s*=\s*\{|[?&]{2}\s*<Redirect|:\s*<Redirect/i;
+// The status compared with a string, as in if (status === 'signOut'): the string is blank in the masked copy, so this reads the text.
+const GUARD_STATUS = /\bif\s*\([^)]*['"](?:signOut|signedOut|unauthenticated|loggedOut|logged_out|anonymous|guest)['"]/i;
+const PUBLIC_GROUP = /\((?:auth|public|login|sign-?in|sign-?up|onboarding|welcome|landing|guest|unauth\w*)\)/i;
+
+function roots(repo: Repo): string[] {
+  const out: string[] = [];
+  for (const f of repo.ctx.files) {
+    if (!/(?:^|\/)package\.json$/.test(f) || /node_modules\//.test(f)) continue;
+    if (/"expo-router"|"expo"\s*:/.test(repo.ctx.text(f))) out.push(f.replace(/package\.json$/, ''));
+  }
+  return out.sort();
+}
+
+const routePath = (rel: string): string => {
+  const segs = rel.replace(SOURCE_EXT, '').split('/').filter((s) => s && !/^\(.*\)$/.test(s) && !s.startsWith('@'));
+  if (segs[segs.length - 1] === 'index') segs.pop();
+  return normPath('/' + segs.join('/').replace(/\[\.\.\.(\w+)\]/g, '*$1').replace(/\[(\w+)\]/g, ':$1'));
+};
+
+function layoutGuard(v: FileView): { line: number; enforced: boolean | null } | null {
+  const session = EXPO_SESSION.some((s) => s.re.test(v.masked));
+  const redirect = GUARD_REDIRECT.exec(v.masked);
+  if (!session || !redirect) return null;
+  const cond = GUARD_CONDITION.test(v.masked) || GUARD_STATUS.test(v.text);
+  if (!cond && !/\bProtected\b/.test(v.masked)) return null;
+  return { line: v.lines.at(redirect.index), enforced: cond ? true : null };
+}
+
+export function extractExpo(repo: Repo): Extracted {
+  const out = empty();
+  for (const root of roots(repo)) {
+    const appDir = [`${root}app/`, `${root}src/app/`].find((d) => repo.ctx.files.some((f) => f.startsWith(d)));
+    const files = repo.ctx.files.filter((f) => f.startsWith(root) && !/node_modules\//.test(f) && SOURCE_EXT.test(f) && !/\.d\.ts$/.test(f));
+    if (appDir) {
+      // Layout guards, by directory.
+      const guards: { dir: string; file: string; fact: { line: number; enforced: boolean | null }; text: string }[] = [];
+      for (const f of files) {
+        if (!f.startsWith(appDir) || !/(?:^|\/)_layout\.[cm]?[jt]sx?$/.test(f)) continue;
+        const v = repo.view(f);
+        const g = v ? layoutGuard(v) : null;
+        if (v && g) guards.push({ dir: f.slice(0, f.lastIndexOf('/') + 1), file: f, fact: g, text: v.masked });
+      }
+      for (const f of files) {
+        if (!f.startsWith(appDir)) continue;
+        const rel = f.slice(appDir.length);
+        const base = rel.split('/').pop()!;
+        if (/^_layout\./.test(base) || /^\+(?:html|not-found|native-intent)\./.test(base)) continue;
+        const v = repo.view(f);
+        if (!v) continue;
+        if (/\+api\.[cm]?[jt]sx?$/.test(f)) {
+          const path = routePath(rel.replace(/\+api(\.[cm]?[jt]sx?)$/, '$1'));
+          for (const e of exportedFunctions(repo, v)) {
+            if (!METHODS.includes(e.exportName)) continue;
+            const r = e.r;
+            const seeds = [...(r.params.length ? r.params : ['request', 'req']), 'params'];
+            out.entries.push(makeEntry(repo, { kind: 'http_route', framework: 'expo-api', file: f, line: e.line, method: e.exportName, path, name: e.exportName, confidence: 'high', handlerView: r.view, spec: { start: r.start, end: r.end, seeds, decorators: r.wrapper ? [{ view: v, start: r.wrapper.from, end: r.wrapper.to, scope: 'wrapper' }] : [], extraCalls: r.wrapper ? [r.wrapper.name] : [], returnsJson: true } }));
+          }
+          continue;
+        }
+        // A screen: the file under app/ with a default export that is not a layout.
+        const DEFAULT_EXPORT = /\bexport\s+default\b|\bexport\s*\{[^}]*(?:\bas\s+default|\bdefault\b)[^}]*\}/;
+        if (!DEFAULT_EXPORT.test(v.masked)) continue;
+        const path = routePath(rel);
+        const seeds = ['params', 'searchParams'];
+        for (const m of v.masked.matchAll(/\b(?:const|let)\s+(\{[^}]*\}|\w+)\s*=\s*use(?:Local|Global)?SearchParams\b/g)) seeds.push(...[...m[1].matchAll(/\w+/g)].map((x) => x[0]));
+        const dm = /\bexport\s+default\s+(?:async\s+)?function\s+(\w+)/.exec(v.masked);
+        const ep = makeEntry(repo, { kind: 'page', framework: 'expo-router', file: f, line: v.lines.at(dm?.index ?? Math.max(0, v.masked.search(DEFAULT_EXPORT))), method: null, path, name: dm?.[1] ?? null, confidence: 'high', handlerView: v, spec: { start: 0, end: v.text.length, seeds, returnsJson: false }, tags: ['mobile_screen'] });
+        const extra: Protection[] = [];
+        for (const s of EXPO_SESSION) {
+          const m = s.re.exec(v.masked);
+          if (m) { extra.push({ kind: 'session_read', scope: 'handler', file: f, line: v.lines.at(m.index), via: s.via, enforced: null, confidence: s.conf === 'high' ? 'medium' : 'medium' }); break; }
+        }
+        const publicGroup = PUBLIC_GROUP.test(f.slice(appDir.length));
+        for (const g of guards) {
+          if (!f.startsWith(g.dir) || publicGroup) continue;
+          extra.push({ kind: 'session_read', scope: 'router', file: g.file, line: g.fact.line, via: 'expo layout guard (client side)', enforced: g.fact.enforced, confidence: 'medium' });
+        }
+        if (extra.length) {
+          ep.protections = [...ep.protections, ...extra].sort((a, b) => a.line - b.line || (a.kind < b.kind ? -1 : a.kind > b.kind ? 1 : 0) || (a.via < b.via ? -1 : 1));
+          if (guards.some((g) => f.startsWith(g.dir)) && !publicGroup) ep.tags = [...new Set([...ep.tags, 'guarded'])].sort();
+        }
+        if (publicGroup) ep.tags = [...new Set([...ep.tags, 'public'])].sort();
+        out.entries.push(ep);
+      }
+    }
+
+    // Deep links declared in the app config.
+    for (const cfg of [`${root}app.json`, `${root}app.config.json`]) {
+      const text = repo.ctx.text(cfg);
+      if (!text) continue;
+      let json: { expo?: Record<string, unknown> } | null = null;
+      try { json = JSON.parse(text) as { expo?: Record<string, unknown> }; } catch { json = null; }
+      const expo = (json?.expo ?? json ?? {}) as Record<string, unknown>;
+      const lineOf = (needle: string): number => { const i = text.indexOf(needle); return i < 0 ? 1 : text.slice(0, i).split('\n').length; };
+      const add = (path: string, name: string, needle: string, tags: string[]): void => {
+        const line = lineOf(needle);
+        out.entries.push(deepLink(cfg, line, path, name, 'high', tags));
+      };
+      const scheme = expo.scheme;
+      for (const s of Array.isArray(scheme) ? scheme : scheme ? [scheme] : []) if (typeof s === 'string') add(`${s}://`, 'custom scheme', `"${s}"`, ['deep_link', 'custom_scheme']);
+      const ios = (expo.ios ?? {}) as { associatedDomains?: unknown };
+      for (const d of Array.isArray(ios.associatedDomains) ? ios.associatedDomains : []) if (typeof d === 'string' && d.startsWith('applinks:')) add(`https://${d.slice(9)}/`, 'universal link', `"${d}"`, ['deep_link', 'universal_link']);
+      const android = (expo.android ?? {}) as { intentFilters?: { data?: { scheme?: string; host?: string; pathPrefix?: string }[]; autoVerify?: boolean }[] };
+      for (const f of android.intentFilters ?? []) for (const d of f.data ?? []) if (d.scheme) add(`${d.scheme}://${d.host ?? ''}${d.pathPrefix ?? ''}`, f.autoVerify ? 'android app link' : 'android intent filter', `"${d.host ?? d.scheme}"`, ['deep_link', ...(f.autoVerify ? ['universal_link'] : ['custom_scheme'])]);
+    }
+    for (const cfg of [`${root}app.config.js`, `${root}app.config.ts`]) {
+      const text = repo.ctx.text(cfg);
+      if (!text) continue;
+      for (const m of text.matchAll(/\bscheme\s*:\s*['"]([\w+.-]+)['"]/g)) out.entries.push(deepLink(cfg, text.slice(0, m.index).split('\n').length, `${m[1]}://`, 'custom scheme', 'high', ['deep_link', 'custom_scheme']));
+    }
+
+    // Deep links handled in code.
+    for (const f of files) {
+      const v = repo.view(f);
+      if (!v || !/\bLinking\b|\buseURL\b|\bprefixes\s*:/.test(v.masked)) continue;
+      for (const x of v.masked.matchAll(/\bLinking\.addEventListener\s*\(/g)) {
+        const open = x.index! + x[0].length - 1;
+        const args = splitArgs(v.masked, open);
+        if (args.length < 2 || !/^['"]url['"]$/.test(v.text.slice(args[0].start, args[0].end).trim())) continue;
+        const r = resolveFunction(repo, v, args[1].start, args[1].end);
+        const spec = r ? { start: r.start, end: r.end, seeds: r.params.length ? r.params : ['event', 'url'], returnsJson: false } : { start: x.index!, end: args[args.length - 1].end, seeds: ['event', 'url'], returnsJson: false };
+        out.entries.push(makeEntry(repo, { kind: 'deep_link', framework: 'react-native', file: f, line: v.lines.at(x.index!), method: null, path: null, name: 'Linking url listener', confidence: r ? 'high' : 'medium', handlerView: r?.view ?? v, spec, tags: ['deep_link'] }));
+      }
+      for (const x of v.masked.matchAll(/\b(?:Linking\.getInitialURL|useURL)\s*\(/g)) {
+        const at = x.index!;
+        const line = v.lines.at(at);
+        const end = Math.min(v.text.length, v.lines.start(line + 12));
+        out.entries.push(makeEntry(repo, { kind: 'deep_link', framework: 'react-native', file: f, line, method: null, path: null, name: x[0].replace(/\s*\($/, ''), confidence: 'medium', handlerView: v, spec: { start: at, end, seeds: ['url', 'initialUrl', 'event'], returnsJson: false }, tags: ['deep_link'] }));
+      }
+      for (const x of v.masked.matchAll(/\bprefixes\s*:\s*\[/g)) {
+        const line = v.lines.at(x.index!);
+        const prefixes = [...v.text.slice(x.index!, x.index! + 300).matchAll(/['"]([^'"]+:\/\/[^'"]*)['"]/g)].map((y) => y[1]);
+        const end = Math.min(v.text.length, v.lines.start(line + 25));
+        out.entries.push(makeEntry(repo, { kind: 'deep_link', framework: 'react-navigation', file: f, line, method: null, path: prefixes[0] ?? null, name: 'navigation linking config', confidence: 'medium', handlerView: v, spec: { start: x.index!, end, seeds: [], returnsJson: false }, tags: ['deep_link'] }));
+      }
+    }
+  }
+  return out;
+}
+
+function deepLink(file: string, line: number, path: string, name: string, confidence: EntryPoint['confidence'], tags: string[]): EntryPoint {
+  return {
+    id: `${file}:${line}:deep_link:-:${path}:${name}`, kind: 'deep_link', framework: 'expo', file, line, end_line: line, method: null, path, name, handler: null, confidence,
+    test_code: testCodeReason(file) !== null, tags: [...tags].sort(), protections: [], reads: [{ source: 'params', line }], data: [], outbound: [],
+  };
+}
+