hullproof 0.0.0-stage → 0.5.0

package/src/map/js-next.ts

@@ -0,0 +1,282 @@
+// Entry points of Next.js (app router route handlers and pages, pages router API routes, server actions, middleware),
+// Supabase edge functions and tRPC procedures.
+import type { Gate, Protection } from '../types/index.ts';
+import { analyze, type FileView, type Spec } from './analyze.ts';
+import { empty, joinPath, makeEntry, normPath, paramNames, type Extracted } from './entry.ts';
+import { closeOf, jsFunction, splitArgs, type Extent } from './lex.ts';
+import type { Repo } from './repo.ts';
+import { ADMIN_PATH } from './vocab.ts';
+
+const METHODS = ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS'];
+
+// A function-valued expression starting at `at`: a function itself, a call that wraps one (withAuth(handler)), or a name.
+export interface Resolved { view: FileView; start: number; end: number; wrapper: { name: string; from: number; to: number } | null; resolved: boolean; params: string[]; defName?: string }
+export function resolveFunction(repo: Repo, v: FileView, at: number, limit: number): Resolved | null {
+  const m = v.masked;
+  const direct = jsFunction(m, at);
+  if (direct && direct.end <= limit + 1) return { view: v, start: direct.start, end: direct.end, wrapper: null, resolved: false, params: paramsOf(m, direct) };
+  const call = /^\s*([A-Za-z_$][\w$.]*)\s*(?:<[^>(]*>)?\s*\(/.exec(m.slice(at, limit));
+  if (call) {
+    const open = at + call[0].length - 1;
+    const args = splitArgs(m, open);
+    for (const a of args) {
+      const f = jsFunction(m, a.start);
+      if (f && f.end <= a.end + 1) return { view: v, start: f.start, end: f.end, wrapper: { name: call[1], from: at, to: a.start }, resolved: false, params: paramsOf(m, f) };
+    }
+    for (const a of args) {
+      const id = /^([A-Za-z_$][\w$]*)(?:\s*\([\s\S]*\))?$/.exec(m.slice(a.start, a.end));
+      if (id) { const r = repo.defs('js', id[1]).filter((d) => d.view.file === v.file).concat(repo.defs('js', id[1]))[0]; if (r) return { view: r.view, start: r.start, end: r.end, wrapper: { name: call[1], from: at, to: a.start }, resolved: true, params: paramsOf(r.view.masked, { start: r.start, end: r.end, bodyStart: r.start }), defName: id[1] }; }
+    }
+    return null;
+  }
+  const id = /^\s*([A-Za-z_$][\w$]*)\s*[;,)]?\s*$/.exec(m.slice(at, limit)) ?? /^\s*(?:[A-Za-z_$][\w$]*\s*\.\s*)*([A-Za-z_$][\w$]*)\s*[;,)]?\s*$/.exec(m.slice(at, limit));
+  if (id) {
+    const defs = repo.defs('js', id[1]);
+    const r = defs.find((d) => d.view.file === v.file) ?? (defs.length === 1 ? defs[0] : null);
+    if (r) return { view: r.view, start: r.start, end: r.end, wrapper: null, resolved: true, params: paramsOf(r.view.masked, { start: r.start, end: r.end, bodyStart: r.start }), defName: id[1] };
+  }
+  return null;
+}
+
+export function paramsOf(masked: string, f: Extent): string[] {
+  const head = masked.slice(f.start, f.bodyStart);
+  const open = head.indexOf('(');
+  if (open >= 0 && (head.indexOf('=>') < 0 || open < head.indexOf('=>'))) return paramNames(masked, f.start + open);
+  const single = /^\s*(?:async\s+)?([A-Za-z_$][\w$]*)\s*=>/.exec(head);
+  return single ? [single[1]] : [];
+}
+
+export const nextRoutePath = (file: string, strip: RegExp): string | null => {
+  const m = /(?:^|\/)(?:src\/)?app\/(.*)$/.exec(file);
+  if (!m) return null;
+  const segs = m[1].replace(strip, '').split('/').filter((s) => s && !/^\(.*\)$/.test(s) && !s.startsWith('@'));
+  return normPath('/' + segs.join('/'));
+};
+
+// Exported names in a file with where their value starts: export function X, export const X = ..., export { a as X }.
+export function exportedFunctions(repo: Repo, v: FileView): { exportName: string; r: Resolved; line: number; at: number }[] {
+  const m = v.masked;
+  const out: { exportName: string; r: Resolved; line: number; at: number }[] = [];
+  for (const x of m.matchAll(/\bexport\s+(?:default\s+)?(?:async\s+)?function\s*\*?\s*([A-Za-z_$][\w$]*)/g)) {
+    const at = x.index! + (/\bexport\s+(?:default\s+)?/.exec(x[0])![0].length);
+    const f = jsFunction(m, at);
+    if (f) out.push({ exportName: x[1], r: { view: v, start: f.start, end: f.end, wrapper: null, resolved: false, params: paramsOf(m, f) }, line: v.lines.at(x.index!), at });
+  }
+  for (const x of m.matchAll(/\bexport\s+const\s+([A-Za-z_$][\w$]*)\s*(?::[^=\n]+)?=\s*/g)) {
+    const at = x.index! + x[0].length;
+    const limit = statementLimit(m, at);
+    const r = resolveFunction(repo, v, at, limit);
+    if (r) out.push({ exportName: x[1], r, line: v.lines.at(x.index!), at });
+  }
+  for (const x of m.matchAll(/\bexport\s*\{([^}]*)\}/g)) {
+    for (const part of x[1].split(',')) {
+      const [local, alias] = part.trim().split(/\s+as\s+/);
+      if (!local) continue;
+      const defs = repo.defs('js', local);
+      const d = defs.find((q) => q.view.file === v.file);
+      if (d) out.push({ exportName: alias ?? local, r: { view: d.view, start: d.start, end: d.end, wrapper: null, resolved: false, params: paramsOf(d.view.masked, { start: d.start, end: d.end, bodyStart: d.start }) }, line: v.lines.at(x.index!), at: x.index! });
+    }
+  }
+  return out;
+}
+
+function statementLimit(masked: string, from: number): number {
+  let depth = 0;
+  for (let i = from; i < masked.length; i++) {
+    const c = masked[i];
+    if (c === '(' || c === '[' || c === '{') depth++;
+    else if (c === ')' || c === ']' || c === '}') { if (depth === 0) return i; depth--; }
+    else if (c === ';' && depth === 0) return i;
+    else if (c === '\n' && depth === 0 && /\n\s*(?:export|const|let|var|function|async|import|type|interface|\/\/)/.test(masked.slice(i, i + 40))) return i;
+  }
+  return masked.length;
+}
+
+function spec(r: Resolved, decorators: Spec['decorators'], seeds: string[], extra: string[] = []): Spec {
+  const deco = decorators ?? [];
+  return { start: r.start, end: r.end, seeds, decorators: deco, extraCalls: extra, returnsJson: true };
+}
+
+const wrapperDeco = (v: FileView, r: Resolved): NonNullable<Spec['decorators']> => (r.wrapper ? [{ view: v, start: r.wrapper.from, end: r.wrapper.to, scope: 'wrapper' }] : []);
+
+export function extractNext(repo: Repo, v: FileView): Extracted {
+  const out = empty();
+  const file = v.file;
+  const text = v.text;
+
+  // App router route handlers.
+  if (/(?:^|\/)(?:src\/)?app\/(?:.*\/)?route\.[cm]?[jt]sx?$/.test(file)) {
+    const path = nextRoutePath(file, /\/?route\.[cm]?[jt]sx?$/);
+    for (const e of exportedFunctions(repo, v)) {
+      if (!METHODS.includes(e.exportName)) continue;
+      const r = e.r;
+      const seeds = r.params.length ? r.params : ['req', 'request', 'params'];
+      out.entries.push(makeEntry(repo, { kind: 'http_route', framework: 'next-app', file, line: e.line, method: e.exportName, path, name: e.exportName, confidence: 'high', handlerView: r.view, spec: spec(r, wrapperDeco(v, r), [...seeds, 'params', 'searchParams'], r.wrapper ? [r.wrapper.name.split('.').pop()!] : []) }));
+    }
+  }
+
+  // App router pages.
+  if (/(?:^|\/)(?:src\/)?app\/(?:.*\/)?page\.[cm]?[jt]sx?$/.test(file)) {
+    const path = nextRoutePath(file, /\/?page\.[cm]?[jt]sx?$/);
+    const ex = defaultExport(repo, v);
+    if (ex) {
+      const r = ex.r;
+      out.entries.push(makeEntry(repo, { kind: 'page', framework: 'next-app', file, line: v.lines.at(r.start), method: 'GET', path, name: ex.exportName, confidence: 'high', handlerView: r.view, spec: spec(r, [], ['params', 'searchParams', ...r.params]) }));
+    }
+  }
+
+  // Pages router API routes.
+  if (/(?:^|\/)(?:src\/)?pages\/api\/.+\.[cm]?[jt]sx?$/.test(file)) {
+    const path = normPath('/api/' + (/pages\/api\/(.*)$/.exec(file)![1]).replace(/\.[cm]?[jt]sx?$/, '').replace(/\/?index$/, ''));
+    const ex = defaultExport(repo, v);
+    if (ex) {
+      const r = ex.r;
+      const methods = [...new Set([...v.text.slice(r.start, r.end).matchAll(/\bmethod\s*(?:===?|!==?)\s*['"](\w+)['"]|\bcase\s+['"](GET|POST|PUT|PATCH|DELETE)['"]/g)].map((x) => (x[1] ?? x[2]).toUpperCase()))].filter((x) => METHODS.includes(x)).sort();
+      for (const method of methods.length ? methods : ['ANY']) {
+        out.entries.push(makeEntry(repo, { kind: 'http_route', framework: 'next-pages', file, line: v.lines.at(r.start), method, path, name: ex.exportName, confidence: 'high', handlerView: r.view, spec: spec(r, wrapperDeco(v, r), r.params.length ? r.params : ['req'], r.wrapper ? [r.wrapper.name.split('.').pop()!] : []) }));
+      }
+    }
+  }
+
+  // Server actions: a "use server" file, or the directive inside a function.
+  const fileDirective = /^\s*(?:\/\/[^\n]*\n\s*|\/\*[\s\S]*?\*\/\s*)*['"]use server['"]/.test(text);
+  if (fileDirective) {
+    for (const e of exportedFunctions(repo, v)) {
+      const r = e.r;
+      out.entries.push(makeEntry(repo, { kind: 'server_action', framework: 'next-app', file, line: v.lines.at(r.start), method: 'POST', path: null, name: e.exportName, confidence: 'high', handlerView: r.view, spec: spec(r, wrapperDeco(v, r), r.params, r.wrapper ? [r.wrapper.name.split('.').pop()!] : []) }));
+    }
+  } else if (/['"]use server['"]/.test(text)) {
+    for (const x of v.masked.matchAll(/(?:\basync\s+)?function\s+([A-Za-z_$][\w$]*)\s*\(|\b(?:const|let)\s+([A-Za-z_$][\w$]*)\s*=\s*async\s*\(/g)) {
+      const at = x.index!;
+      const f = jsFunction(v.masked, at);
+      if (!f || !/^\s*\{\s*['"]use server['"]/.test(text.slice(f.bodyStart, f.bodyStart + 60))) continue;
+      out.entries.push(makeEntry(repo, { kind: 'server_action', framework: 'next-app', file, line: v.lines.at(at), method: 'POST', path: null, name: x[1] ?? x[2], confidence: 'high', handlerView: v, spec: { start: f.start, end: f.end, seeds: paramsOf(v.masked, f), decorators: [], returnsJson: true } }));
+    }
+  }
+
+  // Middleware (a gate, not an entry point).
+  if (/(?:^|\/)(?:src\/)?(?:middleware|proxy)\.[cm]?[jt]s$/.test(file)) {
+    const named = exportedFunctions(repo, v).find((e) => e.exportName === 'middleware' || e.exportName === 'proxy');
+    const dflt = named ? null : defaultExport(repo, v);
+    const fn = named ? { r: named.r } : dflt ? { r: dflt.r } : null;
+    if (fn) {
+      const a = analyze(v, spec(fn.r, wrapperDeco(v, fn.r), fn.r.params.length ? fn.r.params : ['req', 'request']), repo.helpers('js'));
+      const matcher = /\bmatcher\s*:\s*(\[[^\]]*\]|['"][^'"]*['"])/.exec(text);
+      const matcherPaths = matcher ? [...matcher[1].matchAll(/['"]([^'"]*)['"]/g)].map((x) => gatePrefix(x[1])) : [];
+      // A check inside "if (pathname.startsWith('/admin'))" covers only those prefixes, not the whole matcher.
+      const blocks = [...v.masked.slice(fn.r.start, fn.r.end).matchAll(/\bif\s*\(/g)].map((x) => {
+        const open = fn.r.start + x.index! + x[0].length - 1;
+        const condEnd = closeOf(v.masked, open);
+        if (condEnd < 0) return null;
+        const prefixes = [...text.slice(open, condEnd).matchAll(/startsWith\(\s*['"](\/[^'"]*)['"]/g)].map((y) => normPath(y[1].replace(/\/$/, '') || '/'));
+        const b = v.masked.indexOf('{', condEnd);
+        const bEnd = b < 0 ? -1 : closeOf(v.masked, b);
+        return prefixes.length && b >= 0 && bEnd > 0 && /^\s*\{/.test(v.masked.slice(condEnd, b + 1)) ? { start: b, end: bEnd, prefixes } : null;
+      }).filter((x): x is { start: number; end: number; prefixes: string[] } => x !== null);
+      const groups = new Map<string, Protection[]>();
+      const blockAt = (pos: number): { start: number; end: number; prefixes: string[] } | undefined => blocks.filter((b) => pos >= b.start && pos <= b.end).sort((x, y) => (x.end - x.start) - (y.end - y.start))[0];
+      for (const p of a.protections.filter((q) => q.kind !== 'owner_filter')) {
+        const at = v.lines.start(p.line);
+        let prefixes = blockAt(at)?.prefixes ?? null;
+        if (!prefixes) {
+          // The value is stored in a variable and tested later: use the blocks that test it, when all of them are inside one.
+          const lineText = text.slice(at, text.indexOf('\n', at) < 0 ? text.length : text.indexOf('\n', at));
+          const name = /(?:const|let|var)\s+(\w+)\s*=/.exec(lineText)?.[1];
+          if (name) {
+            const uses = [...v.masked.slice(fn.r.start, fn.r.end).matchAll(new RegExp(`(?<![\\w$.])${name}\\b`, 'g'))].map((x) => fn.r.start + x.index!).filter((pos) => v.lines.at(pos) !== p.line);
+            const inBlocks = uses.map((pos) => blockAt(pos));
+            if (uses.length && inBlocks.every((b) => b)) prefixes = [...new Set(inBlocks.flatMap((b) => b!.prefixes))];
+          }
+        }
+        const key = prefixes ? [...new Set(prefixes)].sort().join('\u0000') : '*';
+        groups.set(key, [...(groups.get(key) ?? []), { ...p, scope: 'middleware' as const }]);
+      }
+      for (const [key, protections] of [...groups.entries()].sort()) {
+        const paths = key === '*' ? (matcherPaths.length ? [...new Set(matcherPaths)].sort() : ['*']) : key.split('\u0000');
+        const gate: Gate = {
+          id: `${file}:${v.lines.at(fn.r.start)}:middleware:${key === '*' ? 'all' : paths.join(',')}`, kind: 'middleware', framework: 'next-app', file, line: v.lines.at(fn.r.start),
+          paths, methods: [], protections, confidence: 'medium',
+        };
+        out.gates.push(gate);
+      }
+    }
+  }
+
+  // Supabase edge functions.
+  const edge = /(?:^|\/)supabase\/functions\/([^/_][^/]*)\/index\.[cm]?[jt]sx?$/.exec(file);
+  if (edge) {
+    const serve = /\b(?:Deno\.)?serve\s*\(/.exec(v.masked);
+    if (serve) {
+      const open = serve.index + serve[0].length - 1;
+      const args = splitArgs(v.masked, open);
+      const fa = args.map((a) => ({ a, r: resolveFunction(repo, v, a.start, a.end) })).find((x) => x.r);
+      if (fa?.r) {
+        const e = makeEntry(repo, { kind: 'http_route', framework: 'supabase-edge', file, line: v.lines.at(serve.index), method: 'ANY', path: `/functions/v1/${edge[1]}`, name: edge[1], confidence: 'high', handlerView: fa.r.view, spec: spec(fa.r, [], fa.r.params.length ? fa.r.params : ['req', 'request']) });
+        const cfg = repo.ctx.text('supabase/config.toml');
+        const sec = new RegExp(`\\[functions\\.${edge[1].replace(/[-\\^$*+?.()|[\]{}]/g, '\\$&')}\\]([^\\[]*)`).exec(cfg);
+        const off = sec ? /verify_jwt\s*=\s*false/.test(sec[1]) : false;
+        if (!off) e.protections.push({ kind: 'session_read', scope: 'global', file: cfg ? 'supabase/config.toml' : file, line: 1, via: 'supabase verify_jwt (default on)', enforced: true, confidence: cfg ? 'high' : 'medium' });
+        e.protections.sort((x, y) => x.line - y.line || (x.kind < y.kind ? -1 : 1));
+        out.entries.push(e);
+      }
+    }
+  }
+
+  // tRPC procedures.
+  if (/[pP]rocedure\b/.test(v.masked) && /trpc|Procedure/.test(v.imports + v.text.slice(0, 3000))) {
+    for (const x of v.masked.matchAll(/(?<![.\w$])([A-Za-z_$][\w$]*)\s*:\s*([A-Za-z_$][\w$]*[pP]rocedure)\b/g)) {
+      let i = x.index! + x[0].length;
+      let verb: string | null = null;
+      let handler: Extent | null = null;
+      const chain: string[] = [];
+      for (let guard = 0; guard < 12; guard++) {
+        while (/\s/.test(v.masked[i] ?? '')) i++;
+        if (v.masked[i] !== '.') break;
+        const call = /^\.\s*(\w+)\s*\(/.exec(v.masked.slice(i));
+        if (!call) break;
+        const open = i + call[0].length - 1;
+        const close = closeOf(v.masked, open);
+        if (close < 0) break;
+        chain.push(call[1]);
+        if (['query', 'mutation', 'subscription'].includes(call[1])) {
+          verb = call[1];
+          const a = splitArgs(v.masked, open)[0];
+          handler = a ? jsFunction(v.masked, a.start) : null;
+          i = close;
+          break;
+        }
+        i = close;
+      }
+      if (!verb || !handler) continue;
+      const procName = x[2];
+      const deco: NonNullable<Spec['decorators']> = [{ view: v, start: x.index! + x[1].length, end: handler.start, scope: 'router' }];
+      const e = makeEntry(repo, { kind: 'rpc', framework: 'trpc', file, line: v.lines.at(x.index!), method: verb.toUpperCase(), path: x[1], name: x[1], confidence: 'high', handlerView: v, spec: { start: handler.start, end: handler.end, seeds: ['input', 'ctx', ...paramsOf(v.masked, handler)], decorators: deco, returnsJson: true } });
+      if (/protected|auth|private|member|user|admin|session|staff/i.test(procName)) e.protections.push({ kind: 'session_read', scope: 'router', file, line: e.line, via: `procedure ${procName}`, enforced: true, confidence: 'medium' });
+      if (/admin|staff|owner/i.test(procName) || ADMIN_PATH.test(procName)) e.protections.push({ kind: 'role_check', scope: 'router', file, line: e.line, via: `procedure ${procName}`, enforced: true, confidence: 'medium' });
+      if (chain.includes('input')) e.protections.push({ kind: 'input_validation', scope: 'router', file, line: e.line, via: 'trpc .input()', enforced: true, confidence: 'high' });
+      e.protections.sort((a, b) => a.line - b.line || (a.kind < b.kind ? -1 : a.kind > b.kind ? 1 : 0) || (a.via < b.via ? -1 : 1));
+      out.entries.push(e);
+    }
+  }
+  return out;
+}
+
+function defaultExport(repo: Repo, v: FileView): { exportName: string | null; r: Resolved } | null {
+  const m = v.masked;
+  const x = /\bexport\s+default\s+/.exec(m);
+  if (!x) return null;
+  const at = x.index + x[0].length;
+  const limit = statementLimit(m, at);
+  const direct = jsFunction(m, at);
+  const named = /^(?:async\s+)?function\s*\*?\s*([A-Za-z_$][\w$]*)/.exec(m.slice(at, at + 80));
+  const r = direct ? { view: v, start: direct.start, end: direct.end, wrapper: null, resolved: false, params: paramsOf(m, direct) } : resolveFunction(repo, v, at, limit);
+  return r ? { exportName: named?.[1] ?? null, r } : null;
+}
+
+// A middleware matcher such as "/admin/:path*" or "/api/(.*)" as the path prefix it covers.
+function gatePrefix(matcher: string): string {
+  const p = matcher.replace(/\/?(?::\w+\*?|\(\.\*\)|\*)$/g, '').replace(/\/\(\.\*\)$/, '');
+  return normPath(p === '' ? '*' : p.startsWith('/') ? p : `/${p}`);
+}
+
+export { joinPath };

package/src/map/laravel.ts

@@ -0,0 +1,327 @@
+// PHP and Laravel entry points: routes/*.php (Route::get and the other verbs, match, any, resource, apiResource, controller
+// and middleware groups, prefix, closures and invokable controllers) joined to the controller methods they name, with the
+// middleware each route runs (the group chain, the route chain, the controller constructor, HasMiddleware, attributes and
+// authorizeResource) as its protections, and the api throttle group from bootstrap/app.php or the HTTP kernel.
+import type { Protection } from '../types/index.ts';
+import type { FileView } from './analyze.ts';
+import { empty, joinPath, makeEntry, type Extracted } from './entry.ts';
+import { phpFunc, type FnIndex } from './light-index.ts';
+import { analyzeLight, type LightDeco } from './light.ts';
+import { closeOf, splitArgs } from './lex.ts';
+import type { LocalVocab } from './local-vocab.ts';
+import type { Repo } from './repo.ts';
+
+interface Mw { view: FileView; start: number; end: number }
+interface Ctx { prefix: string; mws: Mw[]; controller: string | null; without: string[] }
+interface Call { name: string; open: number; close: number }
+interface CtrlFilter { view: FileView; start: number; end: number; only: string[] | null; except: string[] | null }
+
+const VERBS = new Set(['get', 'post', 'put', 'patch', 'delete', 'options', 'any']);
+const singular = (s: string): string => (/ies$/.test(s) ? s.replace(/ies$/, 'y') : s.replace(/s$/, ''));
+const phpPath = (p: string): string => p.replace(/\{(\w+)\??(?::[^}]*)?\}/g, ':$1');
+const strs = (s: string): string[] => [...s.matchAll(/['"]([^'"]*)['"]/g)].map((m) => m[1]);
+
+export function laravelFiles(repo: Repo): string[] {
+  return repo.filesOf('php').filter((f) => /(?:^|\/)routes\/(?!console|channels)[\w.-]+\.php$/.test(f));
+}
+
+function chainAt(v: FileView, at: number): { calls: Call[]; end: number } {
+  const m = v.masked;
+  const calls: Call[] = [];
+  let pos = at + 'Route::'.length;
+  for (let guard = 0; guard < 24; guard++) {
+    const id = /^\s*(\w+)\s*\(/.exec(m.slice(pos, pos + 800));
+    if (!id) break;
+    const open = pos + id[0].length - 1;
+    const close = closeOf(m, open);
+    if (close < 0) break;
+    calls.push({ name: id[1], open, close });
+    pos = close;
+    const arrow = /^\s*->\s*/.exec(m.slice(pos, pos + 800)); // comments are blank in the masked copy and can be long
+    if (!arrow) break;
+    pos += arrow[0].length;
+  }
+  return { calls, end: pos };
+}
+
+export function extractLaravelAll(repo: Repo, fn: FnIndex, local: LocalVocab | null): Extracted {
+  const out = empty();
+  const files = laravelFiles(repo);
+  if (!files.length) return out;
+
+  // Classes by short name: controllers, models and middleware.
+  const classes = new Map<string, FileView>();
+  for (const f of repo.filesOf('php')) {
+    if (/(?:^|\/)(?:vendor|node_modules)\//.test(f)) continue;
+    const v = repo.view(f);
+    if (!v) continue;
+    const m = /^[ \t]*(?:final\s+|abstract\s+)?class\s+(\w+)/m.exec(v.masked);
+    if (m && !classes.has(m[1])) classes.set(m[1], v);
+  }
+  const isModel = (cls: string): boolean => { const v = classes.get(cls); return !!v && (/\/Models\//.test(v.file) || /\bextends\s+(?:Model|Authenticatable|Pivot|\\?Illuminate\\Database\\Eloquent\\Model)\b/.test(v.masked)); };
+
+  // Aliases of route middleware: 'admin' => EnsureUserIsAdmin::class.
+  const aliases = new Map<string, string>();
+  const bootText = ['bootstrap/app.php', 'app/Http/Kernel.php', 'app/Providers/RouteServiceProvider.php'].map((f) => ({ f, t: repo.ctx.text(f) }));
+  for (const { t } of bootText) for (const m of t.matchAll(/['"]([\w.-]+)['"]\s*=>\s*\\?(?:[\w\\]*\\)?(\w+)::class/g)) aliases.set(m[1], m[2]);
+  let apiThrottle: Protection | null = null;
+  for (const { f, t } of bootText) {
+    const m = /throttleApi\s*\(|['"]throttle:api['"]|['"]api['"]\s*=>\s*\[[^\]]*throttle/.exec(t);
+    if (m && !apiThrottle) apiThrottle = { kind: 'rate_limit', scope: 'global', file: f, line: t.slice(0, m.index).split('\n').length, via: 'api middleware group throttle', enforced: true, confidence: 'medium' };
+  }
+
+  // Controller level middleware: constructor, HasMiddleware, attributes, authorizeResource.
+  const ctrlFilters = (cls: string): { filters: CtrlFilter[]; policy: boolean } => {
+    const v = classes.get(cls);
+    const filters: CtrlFilter[] = [];
+    let policy = false;
+    if (!v) return { filters, policy };
+    const m = v.masked;
+    const lists = (text: string): { only: string[] | null; except: string[] | null } => ({
+      only: /->\s*only\s*\(([^)]*)\)/.exec(text) ? strs(/->\s*only\s*\(([^)]*)\)/.exec(text)![1]) : null,
+      except: /->\s*except\s*\(([^)]*)\)/.exec(text) ? strs(/->\s*except\s*\(([^)]*)\)/.exec(text)![1]) : null,
+    });
+    for (const x of m.matchAll(/\$this->middleware\s*\(/g)) {
+      const open = x.index! + x[0].length - 1;
+      const close = closeOf(m, open);
+      if (close < 0) continue;
+      const stmtEnd = m.indexOf(';', close);
+      const tail = v.text.slice(close, stmtEnd < 0 ? close : stmtEnd);
+      filters.push({ view: v, start: x.index!, end: Math.max(close, stmtEnd < 0 ? close : stmtEnd), ...lists(tail) });
+    }
+    for (const x of m.matchAll(/\$this->authorizeResource\s*\(/g)) {
+      const open = x.index! + x[0].length - 1;
+      const close = closeOf(m, open);
+      policy = true;
+      filters.push({ view: v, start: x.index!, end: close < 0 ? open : close, only: null, except: null });
+    }
+    const sm = /static\s+function\s+middleware\s*\(/.exec(m);
+    if (sm) {
+      const f = phpFunc(m, sm.index);
+      if (f) {
+        const body = v.text.slice(f.bodyStart, f.end);
+        const bm = m.slice(f.bodyStart, f.end);
+        let covered = 0;
+        for (const x of bm.matchAll(/new\s+(?:\\?[\w\\]*\\)?Middleware\s*\(/g)) {
+          const open = f.bodyStart + x.index! + x[0].length - 1;
+          const close = closeOf(m, open);
+          if (close < 0) continue;
+          const t = v.text.slice(open, close);
+          filters.push({ view: v, start: open, end: close, only: /only:\s*\[([^\]]*)\]/.exec(t) ? strs(/only:\s*\[([^\]]*)\]/.exec(t)![1]) : null, except: /except:\s*\[([^\]]*)\]/.exec(t) ? strs(/except:\s*\[([^\]]*)\]/.exec(t)![1]) : null });
+          covered += close - open;
+        }
+        if (body.length) for (const x of body.matchAll(/(?<![\w(,]\s*)['"]([\w.:,-]+)['"]/g)) { void x; }
+        if (!filters.some((fl) => fl.view === v && fl.start >= f.bodyStart && fl.end <= f.end)) filters.push({ view: v, start: f.bodyStart, end: f.end, only: null, except: null });
+        void covered;
+      }
+    }
+    const cm = /^[ \t]*(?:#\[[^\n]*\]\s*)+(?=(?:final\s+|abstract\s+)?class\b)/m.exec(m);
+    if (cm) filters.push({ view: v, start: cm.index, end: cm.index + cm[0].length, only: null, except: null });
+    return { filters, policy };
+  };
+  const methodAttrs = (v: FileView, fnStart: number): LightDeco | null => {
+    const before = v.text.slice(Math.max(0, fnStart - 400), fnStart);
+    const am = /((?:^|\n)[ \t]*#\[[^\n]*\][ \t]*\n[ \t]*)+(?:(?:public|protected|private|static)\s+)*$/.exec(before);
+    return am ? { view: v, start: fnStart - am[0].length, end: fnStart, scope: 'router' } : null;
+  };
+
+  for (const rf of files) {
+    const v = repo.view(rf);
+    if (!v) continue;
+    const m = v.masked;
+    const isApi = /(?:^|\/)api\.php$/.test(rf);
+    const base: Ctx = { prefix: isApi ? '/api' : '', mws: [], controller: null, without: [] };
+    // Providers that load this file through a group: Route::prefix('api/v1')->middleware('api')->group(base_path('routes/api.php'))
+    const name = /([\w-]+)\.php$/.exec(rf)![1];
+    for (const { f, t } of bootText) {
+      const pm = new RegExp(`Route::([^;]*?)->group\\s*\\(\\s*base_path\\s*\\(\\s*['"]routes/${name}\\.php['"]`).exec(t);
+      if (pm) {
+        const bv = repo.view(f);
+        const pre = /prefix\s*\(\s*['"]([^'"]*)['"]/.exec(pm[1]);
+        if (pre) base.prefix = joinPath('', pre[1]);
+        if (bv && pm.index !== undefined) base.mws.push({ view: bv, start: pm.index, end: pm.index + pm[0].length });
+      }
+    }
+
+    const handle = (calls: Call[], ctx: Ctx, at: number): void => {
+      // Modifiers before the terminal call apply to everything under it; modifiers after it apply to the route.
+      let c: Ctx = { ...ctx, mws: ctx.mws.slice(), without: ctx.without.slice() };
+      const term = calls.findIndex((x) => VERBS.has(x.name) || ['match', 'resource', 'apiResource', 'resources', 'apiResources', 'singleton', 'group', 'webhooks'].includes(x.name));
+      const route: Mw[] = [];
+      const apply = (x: Call, into: Ctx, routeLevel: boolean): void => {
+        const a = splitArgs(m, x.open);
+        const range = { view: v, start: x.open - x.name.length - 2, end: x.close };
+        if (x.name === 'prefix' && a[0]) into.prefix = joinPath(into.prefix, strs(v.text.slice(a[0].start, a[0].end))[0] ?? '');
+        else if (x.name === 'middleware') (routeLevel ? route : into.mws).push(range);
+        else if (x.name === 'can') (routeLevel ? route : into.mws).push(range);
+        else if (x.name === 'withoutMiddleware') into.without.push(...strs(v.text.slice(x.open, x.close)));
+        else if (x.name === 'controller' && a[0]) into.controller = /(\w+)::class/.exec(v.text.slice(a[0].start, a[0].end))?.[1] ?? null;
+      };
+      const mods = term < 0 ? calls : calls.slice(0, term);
+      for (const x of mods) apply(x, c, false);
+      if (term < 0) return;
+      const t = calls[term];
+      const after = calls.slice(term + 1);
+      if (t.name === 'group') {
+        const a = splitArgs(m, t.open);
+        // Route::group(['prefix' => 'x', 'middleware' => ['auth']], function () { ... })
+        if (a.length === 2) {
+          const arr = v.text.slice(a[0].start, a[0].end);
+          const px = /['"]prefix['"]\s*=>\s*['"]([^'"]*)['"]/.exec(arr);
+          if (px) c.prefix = joinPath(c.prefix, px[1]);
+          const mw = /['"]middleware['"]\s*=>/.exec(arr);
+          if (mw) c.mws.push({ view: v, start: a[0].start + mw.index, end: a[0].end });
+        }
+        const closure = a.find((x) => /^(?:static\s+)?(?:function|fn)\b/.test(m.slice(x.start, x.end)));
+        if (closure) {
+          const body = /\{/.exec(m.slice(closure.start, closure.end));
+          if (body) {
+            const bs = closure.start + body.index;
+            const be = closeOf(m, bs);
+            for (const x of after) apply(x, c, false);
+            walk(bs + 1, be < 0 ? closure.end : be - 1, c);
+          } else if (/^(?:static\s+)?fn\b/.test(m.slice(closure.start, closure.end))) walk(closure.start, closure.end, c);
+        }
+        return;
+      }
+      for (const x of after) apply(x, c, true);
+      const args = splitArgs(m, t.open);
+      const line = v.lines.at(at);
+      const text = (a: { start: number; end: number }): string => v.text.slice(a.start, a.end);
+      const emit = (verb: string, path: string, handler: { start: number; end: number } | null, cls: string | null, method: string | null, extraName: string | null, ctrlOverride?: string | null): void => {
+        const full = joinPath(c.prefix, phpPath(path));
+        const cname = cls ?? ctrlOverride ?? null;
+        const cv = cname ? classes.get(cname) : undefined;
+        const fnDef = cv && method ? fn.defs(method).find((d) => d.view.file === cv.file) : undefined;
+        const mws = [...c.mws.filter((x) => !c.without.some((w) => v.text.slice(x.start, x.end).includes(w))), ...route];
+        const decos: LightDeco[] = [];
+        const extra: Protection[] = [];
+        for (const x of mws) {
+          decos.push({ view: x.view, start: x.start, end: x.end, scope: x.view === v && route.includes(x) ? 'wrapper' : 'router' });
+          // A middleware alias or class that lives in the repository: read the class.
+          for (const nm of [...strs(x.view.text.slice(x.start, x.end)), ...[...x.view.text.slice(x.start, x.end).matchAll(/(\w+)::class/g)].map((y) => y[1])]) {
+            const cls2 = aliases.get(nm.split(':')[0]) ?? nm;
+            const mv = classes.get(cls2);
+            if (mv && /Middleware\//.test(mv.file)) decos.push({ view: mv, start: 0, end: mv.text.length, scope: 'router' });
+          }
+        }
+        let policy = false;
+        let seeds: string[] = [];
+        const bound: { name: string; target: string }[] = [];
+        let hv: FileView = v;
+        let start = m.lastIndexOf('\n', at) + 1;
+        let end = t.close;
+        let params = '';
+        let found = false;
+        if (handler) {
+          const isClosure = /^(?:static\s+)?(?:function|fn)\b/.test(m.slice(handler.start, handler.end));
+          if (isClosure) {
+            const f = /^(?:static\s+)?function\b/.test(m.slice(handler.start, handler.end)) ? phpFunc(m, handler.start + m.slice(handler.start).indexOf('function')) : null;
+            if (f) { start = f.start; end = f.end; params = f.params; found = true; } else { start = handler.start; end = handler.end; params = /\(([^)]*)\)/.exec(m.slice(handler.start, handler.end))?.[1] ?? ''; found = true; }
+          }
+        } else if (fnDef && cv) {
+          hv = cv; start = fnDef.start; end = fnDef.end; found = true;
+          const f = phpFunc(cv.masked, fnDef.start);
+          params = f?.params ?? '';
+          const { filters, policy: pol } = ctrlFilters(cname!);
+          for (const fl of filters) {
+            if (fl.only && (!method || !fl.only.includes(method))) continue;
+            if (fl.except && method && fl.except.includes(method)) continue;
+            decos.push({ view: fl.view, start: fl.start, end: fl.end, scope: 'router' });
+          }
+          policy = pol;
+          const attr = methodAttrs(cv, fnDef.start);
+          if (attr) decos.push(attr);
+        }
+        for (const part of params.split(/,(?![^(]*\))/)) {
+          const pm = /^\s*(?:(?:public|protected|private|readonly)\s+)*(?:\??([\w\\]+)\s+)?(?:\.\.\.)?&?(\$\w+)/.exec(part);
+          if (!pm) continue;
+          const typ = pm[1]?.split('\\').pop() ?? null;
+          if (typ && /Request$/.test(typ)) continue;
+          if (typ && isModel(typ)) bound.push({ name: pm[2], target: typ });
+          else if (!typ || /^(?:int|string|float|bool|mixed|array)$/.test(typ)) seeds.push(pm[2]);
+        }
+        if (apiThrottle && isApi) extra.push(apiThrottle);
+        const a = analyzeLight(hv, { start, end, seeds, decorators: decos, extra, lookup: fn.find, local, policyScoped: policy, bound });
+        out.entries.push(makeEntry(repo, {
+          kind: 'http_route', framework: 'laravel', file: rf, line, method: verb, path: full || '/', name: extraName ?? (cname && method ? `${cname}@${method}` : null),
+          confidence: found ? 'high' : 'low', handlerView: hv, spec: { start, end, seeds }, analysis: a,
+        }));
+      };
+      const parseHandler = (a: { start: number; end: number } | undefined): { handler: { start: number; end: number } | null; cls: string | null; method: string | null } => {
+        if (!a) return { handler: null, cls: c.controller, method: null };
+        const t2 = text(a).trim();
+        const arr = /^\[\s*\\?(?:[\w\\]*\\)?(\w+)::class\s*,\s*['"](\w+)['"]\s*\]$/.exec(t2);
+        if (arr) return { handler: null, cls: arr[1], method: arr[2] };
+        const str = /^['"](?:[\w\\]*\\)?(\w+)@(\w+)['"]$/.exec(t2);
+        if (str) return { handler: null, cls: str[1], method: str[2] };
+        const inv = /^\\?(?:[\w\\]*\\)?(\w+)::class$/.exec(t2);
+        if (inv) return { handler: null, cls: inv[1], method: '__invoke' };
+        const mt = /^['"](\w+)['"]$/.exec(t2);
+        if (mt && c.controller) return { handler: null, cls: c.controller, method: mt[1] };
+        if (/^(?:static\s+)?(?:function|fn)\b/.test(m.slice(a.start, a.end).trim())) return { handler: a, cls: null, method: null };
+        return { handler: null, cls: null, method: null };
+      };
+      if (VERBS.has(t.name)) {
+        const p = strs(text(args[0] ?? { start: 0, end: 0 }))[0];
+        if (p === undefined) return;
+        const h = parseHandler(args[1]);
+        if (!h.handler && !h.cls && args[1] === undefined) return;
+        emit(t.name === 'any' ? 'ANY' : t.name.toUpperCase(), p, h.handler, h.cls, h.method, null);
+      } else if (t.name === 'match') {
+        const verbs = strs(text(args[0] ?? { start: 0, end: 0 })).map((x) => x.toUpperCase());
+        const p = strs(text(args[1] ?? { start: 0, end: 0 }))[0];
+        if (p === undefined) return;
+        const h = parseHandler(args[2]);
+        for (const verb of verbs.length ? verbs : ['ANY']) emit(verb, p, h.handler, h.cls, h.method, null);
+      } else if (t.name === 'resource' || t.name === 'apiResource' || t.name === 'singleton') {
+        const nm = strs(text(args[0] ?? { start: 0, end: 0 }))[0];
+        const cls = /(\w+)::class/.exec(text(args[1] ?? { start: 0, end: 0 }))?.[1] ?? null;
+        if (!nm || !cls) return;
+        const only = after.find((x) => x.name === 'only');
+        const except = after.find((x) => x.name === 'except');
+        const onlyL = only ? strs(v.text.slice(only.open, only.close)) : null;
+        const exceptL = except ? strs(v.text.slice(except.open, except.close)) : null;
+        const segs = nm.split('.');
+        const prefix = segs.slice(0, -1).map((s) => `/${s}/:${singular(s)}`).join('');
+        const last = segs[segs.length - 1];
+        const param = singular(last);
+        const acts: [string, string, string][] = t.name === 'singleton'
+          ? [['show', 'GET', ''], ['update', 'PUT', ''], ['update', 'PATCH', '']]
+          : [['index', 'GET', ''], ['create', 'GET', '/create'], ['store', 'POST', ''], ['show', 'GET', `/:${param}`], ['edit', 'GET', `/:${param}/edit`], ['update', 'PUT', `/:${param}`], ['update', 'PATCH', `/:${param}`], ['destroy', 'DELETE', `/:${param}`]];
+        for (const [act, verb, sfx] of acts) {
+          if (t.name === 'apiResource' && (act === 'create' || act === 'edit')) continue;
+          if (onlyL && !onlyL.includes(act)) continue;
+          if (exceptL && exceptL.includes(act)) continue;
+          emit(verb, `${prefix}/${last}${sfx}`, null, cls, act, null);
+        }
+      } else if (t.name === 'resources' || t.name === 'apiResources') {
+        for (const x of v.text.slice(t.open, t.close).matchAll(/['"]([\w.-]+)['"]\s*=>\s*(\w+)::class/g)) {
+          const param = singular(x[1]);
+          const acts: [string, string, string][] = [['index', 'GET', ''], ['store', 'POST', ''], ['show', 'GET', `/:${param}`], ['update', 'PUT', `/:${param}`], ['update', 'PATCH', `/:${param}`], ['destroy', 'DELETE', `/:${param}`]];
+          for (const [act, verb, sfx] of acts) emit(verb, `/${x[1]}${sfx}`, null, x[2], act, null);
+        }
+      } else if (t.name === 'webhooks') {
+        const p = strs(text(args[0] ?? { start: 0, end: 0 }))[0];
+        if (p) emit('POST', p, null, null, null, 'webhook-client');
+      }
+      void c;
+    };
+
+    const walk = (from: number, to: number, ctx: Ctx): void => {
+      let i = from;
+      while (i < to) {
+        const at = m.indexOf('Route::', i);
+        if (at < 0 || at >= to) break;
+        const prev = m.slice(Math.max(0, at - 1), at);
+        if (/[\w$>]/.test(prev)) { i = at + 7; continue; }
+        const ch = chainAt(v, at);
+        if (!ch.calls.length) { i = at + 7; continue; }
+        handle(ch.calls, ctx, at);
+        i = Math.max(ch.end, at + 7);
+      }
+    };
+    walk(0, m.length, base);
+  }
+  return out;
+}