progmune-runtime 3.7.13 → 3.7.15

package/dist/frameworks/fastify-detector.js

@@ -57,6 +57,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.analyzeFastifyApp = analyzeFastifyApp;
 exports.analyzeFastifyFile = analyzeFastifyFile;
 const fs = __importStar(require("fs"));
+const route_window_1 = require("./route-window");
 const MUTATION_METHODS = new Set(["post", "put", "patch", "delete"]);
 const AUTH_ENTRY_WORDS = [
     "login", "signin", "sign_in", "regist", "signup", "sign_up",
@@ -74,7 +75,50 @@ function isAuthFnName(name) {
     const lower = name.toLowerCase();
     return AUTH_FN_WORDS.some((w) => lower.includes(w));
 }
-// ── Analysis（代码串级，镜像 express-detector） ──
+// ── Analysis（代码串级） ──
+/** 自 openIdx（'{' 或 '('）取平衡块内文本（字符串感知） */
+function balancedBlock(code, openIdx) {
+    const open = code[openIdx];
+    const close = open === "{" ? "}" : ")";
+    let depth = 1;
+    let end = openIdx + 1;
+    let quote = null;
+    while (end < code.length && depth > 0) {
+        const ch = code[end];
+        if (quote) {
+            if (ch === quote && code[end - 1] !== "\\")
+                quote = null;
+        }
+        else if (ch === '"' || ch === "'" || ch === "`") {
+            quote = ch;
+        }
+        else if (ch === open) {
+            depth++;
+        }
+        else if (ch === close) {
+            depth--;
+        }
+        end++;
+    }
+    return code.slice(openIdx + 1, Math.max(openIdx + 1, end - 1));
+}
+/** 认证选项名：位置形态（options 对象）与 object-form 路由均可出现 */
+const AUTH_OPTION_NAMES = ["onRequest", "preHandler", "preValidation"];
+/** 选项数组里是否有 auth-like 名（支持点限定 server.authenticate） */
+function optionListHasAuth(listText) {
+    return listText.split(",").some((name) => isAuthFnName(name.trim()));
+}
+function hasAuthOptionInBlock(block) {
+    for (const opt of AUTH_OPTION_NAMES) {
+        const re = new RegExp(`\\b${opt}\\s*:\\s*\\[([^\\]]*)\\]`, "g");
+        let mm;
+        while ((mm = re.exec(block)) !== null) {
+            if (optionListHasAuth(mm[1]))
+                return true;
+        }
+    }
+    return false;
+}
 function analyzeFastifyApp(code) {
     const issues = [];
     const routes = [];
@@ -84,44 +128,60 @@ function analyzeFastifyApp(code) {
         return { hasFastify: false, routes, authHooks, issues };
     }
     // 全局认证钩子：addHook('preHandler'|'preValidation'|'onRequest', authFn)
-    const hookRe = /\.addHook\s*\(\s*['"](preHandler|preValidation|onRequest)['"]\s*,\s*([A-Za-z_$][\w$]*)/g;
+    const hookRe = /\.addHook\s*\(\s*['"](preHandler|preValidation|onRequest)['"]\s*,\s*([A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*)/g;
     let m;
     while ((m = hookRe.exec(code)) !== null) {
         if (isAuthFnName(m[2]))
             authHooks.push(m[2]);
     }
-    // 路由注册：fastify.post('/x', {...}, handler) —— 捕获到 options 窗口
-    const routeRe = /\.(get|post|put|patch|delete|route)\s*\(\s*['"]([^'"]+)['"]/g;
-    while ((m = routeRe.exec(code)) !== null) {
-        const method = m[1].toLowerCase();
-        const pathName = m[2];
-        // 从路由调用起点向后截取 400 字符窗口，查 preHandler/preValidation 选项
-        const windowStart = m.index;
-        const window = code.slice(windowStart, windowStart + 400);
-        const hasAuthOption = /\b(preHandler|preValidation)\s*:/g.test(window)
-            && (() => {
-                // 选项值里出现 auth-like 函数名才认（保守）
-                const optMatch = window.match(/\b(preHandler|preValidation)\s*:\s*\[([^\]]*)\]/);
-                if (!optMatch)
-                    return false;
-                return optMatch[2].split(",").some((name) => isAuthFnName(name.trim()));
-            })();
+    const pushRoute = (method, pathName, protected_, at) => {
         routes.push({
             method,
             path: pathName,
-            protected: hasAuthOption,
-            line: code.slice(0, m.index).split("\n").length,
+            protected: protected_,
+            line: code.slice(0, at).split("\n").length,
         });
-        if (MUTATION_METHODS.has(method) && !hasAuthOption
-            && authHooks.length === 0 && !isAuthEntryPath(pathName)) {
+    };
+    // ── object-form 路由：server.route({ method, path, onRequest:[auth], ... })
+    //    （fastify-realworld 20/20 用此形态——V2 recall 失明根因）
+    const objRe = /\.route\s*\(\s*\{/g;
+    while ((m = objRe.exec(code)) !== null) {
+        const block = balancedBlock(code, m.index + m[0].length - 1); // 自 '{'
+        const methodM = block.match(/method\s*:\s*['"]([^'"]+)['"]/);
+        if (!methodM)
+            continue;
+        const method = methodM[1].toLowerCase();
+        // path 可能是拼接 options.prefix + 'users/login'——取首个引号字面量
+        const pathM = block.match(/path\s*:\s*[^,'"\n]*['"]([^'"]+)['"]/);
+        const pathName = pathM ? pathM[1] : "";
+        const protected_ = hasAuthOptionInBlock(block);
+        pushRoute(method, pathName, protected_, m.index);
+    }
+    // ── 位置形态：fastify.post('/x', { preHandler: [auth] }, handler) ──
+    const posRe = /\.(get|post|put|patch|delete)\s*\(\s*['"]([^'"]+)['"]/g;
+    while ((m = posRe.exec(code)) !== null) {
+        const method = m[1].toLowerCase();
+        const pathName = m[2];
+        const window = code.slice(m.index, m.index + 400);
+        const protected_ = hasAuthOptionInBlock(window);
+        pushRoute(method, pathName, protected_, m.index);
+    }
+    // register 集合豁免（语义层，同 Koa/Gin）：有 <path>/login 姊妹佐证的
+    // 账户集合，其无认证 POST = 公开注册
+    const registerRoots = (0, route_window_1.collectRegisterRoots)(routes.map((r) => r.path));
+    for (const r of routes) {
+        if (MUTATION_METHODS.has(r.method) && !r.protected
+            && authHooks.length === 0
+            && !isAuthEntryPath(r.path)
+            && !(r.method === "post" && (0, route_window_1.isRegisterRoot)(r.path, registerRoots))) {
             issues.push({
                 severity: "medium",
                 rule: "FASTIFY_ROUTE_NO_AUTH",
-                message: `Route ${method.toUpperCase()} ${pathName} is registered without ` +
-                    `preHandler/preValidation auth and the app has no auth hook — ` +
+                message: `Route ${r.method.toUpperCase()} ${r.path} is registered without ` +
+                    `onRequest/preHandler/preValidation auth and the app has no auth hook — ` +
                     `any caller can reach it.`,
-                route: `${method.toUpperCase()} ${pathName}`,
-                line: code.slice(0, m.index).split("\n").length,
+                route: `${r.method.toUpperCase()} ${r.path}`,
+                line: r.line,
             });
         }
     }
@@ -131,7 +191,11 @@ function analyzeFastifyFile(filePath) {
     if (!fs.existsSync(filePath))
         return null;
     const code = fs.readFileSync(filePath, "utf-8");
-    if (!/from\s+['"]fastify['"]|require\(['"]fastify['"]\)/.test(code))
+    // 门：直接 import fastify（应用入口）或 fastify-plugin（真实插件模块——
+    // fastify-realworld 的路由模块是 fp(plugin) 包裹、接收 server 实例；
+    // 旧门只认 require('fastify') → 0/38 文件进门）
+    if (!/from\s+['"]fastify['"]|require\(['"]fastify['"]\)|fastify-plugin/.test(code)) {
         return null;
+    }
     return analyzeFastifyApp(code);
 }

package/dist/frameworks/fastify-detector.test.js

@@ -1,4 +1,37 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 /**
  * fastify-detector.test.ts — Fastify 框架适配器规则回归（纯函数，无文件 I/O）
@@ -8,6 +41,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
  */
 const vitest_1 = require("vitest");
 const fastify_detector_1 = require("./fastify-detector");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
 const app = (routes, hooks = "") => `
 import Fastify from "fastify";
 const fastify = Fastify();
@@ -60,3 +96,66 @@ fastify.post("/register", async (req, reply) => ({ ok: true }));
         (0, vitest_1.expect)(issues).toHaveLength(0);
     });
 });
+// ── V2 结构性重写回归：object-form / onRequest / plugin 门 / register 豁免 ──
+(0, vitest_1.describe)("fastify-detector object-form 路由（V2 修复回归）", () => {
+    (0, vitest_1.it)("server.route({method,path,onRequest:[server.authenticate]}) 受保护不报", () => {
+        const { issues, routes } = (0, fastify_detector_1.analyzeFastifyApp)(app(`
+server.route({
+  method: 'POST',
+  path: options.prefix + 'articles',
+  onRequest: [server.authenticate],
+  handler: onCreate
+});
+`));
+        (0, vitest_1.expect)(routes.find((r) => r.path === "articles").protected).toBe(true);
+        (0, vitest_1.expect)(issues).toHaveLength(0);
+    });
+    (0, vitest_1.it)("object-form 无认证 mutation → 报", () => {
+        const { issues } = (0, fastify_detector_1.analyzeFastifyApp)(app(`
+server.route({
+  method: 'POST',
+  path: options.prefix + 'payments',
+  handler: onPay
+});
+`));
+        (0, vitest_1.expect)(issues.map((i) => i.route)).toContain("POST payments");
+    });
+    (0, vitest_1.it)("点限定 server.authenticate 在 onRequest 数组被识别（词表含 auth）", () => {
+        const { routes } = (0, fastify_detector_1.analyzeFastifyApp)(app(`
+server.route({ method: 'DELETE', path: 'x', onRequest: [server.authenticate], handler: h });
+`));
+        (0, vitest_1.expect)(routes[0].protected).toBe(true);
+    });
+    (0, vitest_1.it)("register 集合豁免：POST users（有 users/login 姊妹）不报", () => {
+        const { issues } = (0, fastify_detector_1.analyzeFastifyApp)(app(`
+server.route({ method: 'POST', path: options.prefix + 'users/login', handler: onLogin });
+server.route({ method: 'POST', path: options.prefix + 'users', handler: onRegister });
+`));
+        (0, vitest_1.expect)(issues.map((i) => i.route)).not.toContain("POST users");
+        (0, vitest_1.expect)(issues.map((i) => i.route)).not.toContain("POST users/login");
+    });
+});
+(0, vitest_1.describe)("fastify-detector plugin 门（V2 修复回归）", () => {
+    (0, vitest_1.it)("fastify-plugin 模块（fp(plugin) 路由文件）现可被分析", () => {
+        const dir = fs.mkdtempSync(path.join(os.tmpdir(), "fastify-det-"));
+        try {
+            const fp = path.join(dir, "routes-users.js");
+            fs.writeFileSync(fp, `
+const fp = require('fastify-plugin')
+async function users (server, options, done) {
+  server.route({ method: 'POST', path: 'articles', onRequest: [server.authenticate], handler: h })
+  server.route({ method: 'POST', path: 'open', handler: h })
+}
+module.exports = fp(users)
+`);
+            const a = (0, fastify_detector_1.analyzeFastifyFile)(fp);
+            (0, vitest_1.expect)(a).not.toBeNull();
+            (0, vitest_1.expect)(a.routes.length).toBe(2);
+            (0, vitest_1.expect)(a.issues.map((i) => i.route)).toContain("POST open");
+            (0, vitest_1.expect)(a.issues.map((i) => i.route)).not.toContain("POST articles");
+        }
+        finally {
+            fs.rmSync(dir, { recursive: true, force: true });
+        }
+    });
+});

package/dist/frameworks/fiber-detector.js

@@ -53,7 +53,14 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.analyzeFiberApp = analyzeFiberApp;
 exports.analyzeFiberFile = analyzeFiberFile;
+exports.fiberFuncStarts = fiberFuncStarts;
+exports.fiberEnclosingFunc = fiberEnclosingFunc;
+exports.fiberProtectedRegisterFns = fiberProtectedRegisterFns;
+exports.analyzeFiberProject = analyzeFiberProject;
+exports.goFuncsOf = goFuncsOf;
+exports.fiberProjectProtectedFns = fiberProjectProtectedFns;
 const fs = __importStar(require("fs"));
+const route_window_1 = require("./route-window");
 const MUTATION_METHODS = new Set(["post", "put", "patch", "delete"]);
 const AUTH_ENTRY_WORDS = [
     "login", "signin", "sign_in", "regist", "signup", "sign_up",
@@ -81,19 +88,22 @@ function analyzeFiberApp(code) {
         return { hasFiber: false, routes, authMiddleware, issues };
     }
     // 全局/组级认证中间件：app.Use(authMW) / group.Use(authMW)
-    const useRe = /\.Use\s*\(\s*([A-Za-z_][\w]*)/g;
+    // 捕获支持点限定成员（jwtware.New 前的一般为 middleware.Protected 等）
+    const useRe = /\.Use\s*\(\s*([A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*)/g;
     let m;
     while ((m = useRe.exec(code)) !== null) {
         if (isAuthFnName(m[1]))
             authMiddleware.push(m[1]);
     }
     // 路由注册：app.Post("/x", mw1, mw2, handler)——Go 方法名大写（Post 惯例）
-    const routeRe = /\.(get|post|put|patch|delete)\s*\(\s*"([^"]+)"/gi;
+    // 空路径 "..." 允许
+    const routeRe = /\.(get|post|put|patch|delete)\s*\(\s*"([^"]*)"(\s*,\s*|\s*\))/gi;
     while ((m = routeRe.exec(code)) !== null) {
         const method = m[1].toLowerCase();
         const pathName = m[2];
-        const window = code.slice(m.index + m[0].length, m.index + m[0].length + 300);
-        const mwNames = window.match(/[A-Za-z_][\w]*/g) || [];
+        // 认证窗口 = 本次调用边界内（括号感知），不跨路由（V8 缺陷修复）
+        const window = (0, route_window_1.routeCallWindow)(code, m.index + m[0].length);
+        const mwNames = (0, route_window_1.middlewareNamesFromWindow)(window);
         const hasAuthMw = mwNames.some((name) => isAuthFnName(name));
         routes.push({
             method,
@@ -101,15 +111,21 @@ function analyzeFiberApp(code) {
             protected: hasAuthMw,
             line: code.slice(0, m.index).split("\n").length,
         });
-        if (MUTATION_METHODS.has(method) && !hasAuthMw
-            && authMiddleware.length === 0 && !isAuthEntryPath(pathName)) {
+    }
+    // register 集合豁免（语义层，同 Koa/Gin）
+    const registerRoots = (0, route_window_1.collectRegisterRoots)(routes.map((r) => r.path));
+    for (const r of routes) {
+        if (MUTATION_METHODS.has(r.method) && !r.protected
+            && authMiddleware.length === 0
+            && !isAuthEntryPath(r.path)
+            && !(r.method === "post" && (0, route_window_1.isRegisterRoot)(r.path, registerRoots))) {
             issues.push({
                 severity: "medium",
                 rule: "FIBER_ROUTE_NO_AUTH",
-                message: `Route ${method.toUpperCase()} ${pathName} has no auth middleware ` +
+                message: `Route ${r.method.toUpperCase()} ${r.path} has no auth middleware ` +
                     `and no auth Use middleware — any caller can reach it.`,
-                route: `${method.toUpperCase()} ${pathName}`,
-                line: code.slice(0, m.index).split("\n").length,
+                route: `${r.method.toUpperCase()} ${r.path}`,
+                line: r.line,
             });
         }
     }
@@ -123,3 +139,244 @@ function analyzeFiberFile(filePath) {
         return null;
     return analyzeFiberApp(code);
 }
+/** 顶层函数头（行号 1-based） */
+function fiberFuncStarts(text) {
+    const out = [];
+    const re = /^func\s+([A-Za-z_]\w*)\s*\(/gm;
+    let m;
+    while ((m = re.exec(text)) !== null) {
+        out.push({ name: m[1], line: text.slice(0, m.index).split("\n").length });
+    }
+    return out;
+}
+/** routeLine 所在顶层函数名 */
+function fiberEnclosingFunc(text, routeLine) {
+    let name = null;
+    for (const f of fiberFuncStarts(text)) {
+        if (f.line <= routeLine)
+            name = f.name;
+        else
+            break;
+    }
+    return name;
+}
+/** bootstrap 相位推导：认证 Use 之后调用的 Register fn（组编号 1,2|3,4|5,6|7,8） */
+function fiberProtectedRegisterFns(bootstrapText) {
+    const state = new Map();
+    const protectedFns = new Map();
+    const re = /(\w+)\s*(?::=|=)\s*fiber\.New\s*\(|(\w+)\.Use\s*\(\s*([A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*)|(\w+)\s*(?::=|=)\s*(?:[\w.]*\.)?([A-Za-z_]\w*)\.Group\s*\(|(?:[\w.]*\.)?([A-Z][A-Za-z0-9_]*)\s*\(\s*(?:[\w.]*\.)?([A-Za-z_]\w*)\.Group\s*\(/g;
+    let m;
+    while ((m = re.exec(bootstrapText)) !== null) {
+        if (m[1] !== undefined) {
+            state.set(m[1], false);
+        }
+        else if (m[2] !== undefined) {
+            if (isAuthFnName(m[3]))
+                state.set(m[2], true);
+        }
+        else if (m[4] !== undefined) {
+            state.set(m[4], !!state.get(m[5]));
+        }
+        else if (m[6] !== undefined) {
+            if (state.get(m[7]))
+                protectedFns.set(m[6], true);
+        }
+    }
+    return protectedFns;
+}
+/** 项目级分析：跨文件组认证传播（同 gin analyzeGinProject） */
+function analyzeFiberProject(projectRoot) {
+    const files = [];
+    const walk = (d) => {
+        for (const e of fs.readdirSync(d, { withFileTypes: true })) {
+            if (e.isDirectory()) {
+                if (["vendor", "node_modules", ".git"].includes(e.name))
+                    continue;
+                walk(`${d}/${e.name}`);
+            }
+            else if (e.name.endsWith(".go") && !e.name.endsWith("_test.go")) {
+                const fp = `${d}/${e.name}`;
+                try {
+                    files.push({ file: fp, text: fs.readFileSync(fp, "utf-8"), a: analyzeFiberFile(fp) });
+                }
+                catch { /* skip */ }
+            }
+        }
+    };
+    if (fs.existsSync(projectRoot))
+        walk(projectRoot.replace(/\/$/, ""));
+    // 多层 Register 链传播（journalist 式 main→api.Register(Group+Use)→…）
+    const protectedFns = fiberProjectProtectedFns(files);
+    const issues = [];
+    for (const { file, text, a } of files) {
+        if (!a || a.issues.length === 0)
+            continue;
+        const pkgM = text.match(/^package\s+(\w+)/m);
+        const filePkg = pkgM ? pkgM[1] : "";
+        for (const issue of a.issues) {
+            const fn = issue.line ? fiberEnclosingFunc(text, issue.line) : null;
+            if (fn && protectedFns.get(`${filePkg}:${fn}`))
+                continue;
+            issues.push({ ...issue });
+        }
+    }
+    return {
+        filesScanned: files.length,
+        protectedFunctions: [...protectedFns.keys()].filter((k) => protectedFns.get(k)),
+        issues,
+    };
+}
+/** 解析一个 Go 文件的顶层函数 */
+function goFuncsOf(text, file) {
+    const out = [];
+    const pkgM = text.match(/^package\s+(\w+)/m);
+    const pkg = pkgM ? pkgM[1] : "";
+    const headerRe = /^func\s+([A-Za-z_]\w*)\s*\(/gm;
+    let m;
+    while ((m = headerRe.exec(text)) !== null) {
+        const hStart = m.index;
+        // 平衡取参数
+        let depth = 1;
+        let end = m.index + m[0].length;
+        while (end < text.length && depth > 0) {
+            if (text[end] === "(")
+                depth++;
+            else if (text[end] === ")")
+                depth--;
+            end++;
+        }
+        const paramsText = text.slice(m.index + m[0].length, end - 1);
+        // 找下一个 func 头作为 body 终点
+        const nxt = out.length ? text.indexOf("func ", end) : text.indexOf("\nfunc ", end);
+        const bodyEnd = (() => {
+            const nextHeader = text.slice(end).search(/^func\s/m);
+            return nextHeader === -1 ? text.length : end + nextHeader;
+        })();
+        const body = text.slice(end, bodyEnd);
+        const routerParams = [];
+        // 参数切分（顶层逗号）
+        let d = 0;
+        let cur = "";
+        const parts = [];
+        for (const ch of paramsText) {
+            if (ch === "(")
+                d++;
+            else if (ch === ")")
+                d--;
+            if (ch === "," && d === 0) {
+                parts.push(cur.trim());
+                cur = "";
+            }
+            else
+                cur += ch;
+        }
+        if (cur.trim())
+            parts.push(cur.trim());
+        for (const p of parts) {
+            // name *pkg.fiber.Router | name fiber.App …
+            const pm = p.match(/^([A-Za-z_]\w*)\s+[\w./*]*(\bfiber\b[\w./]*(?:Router|App|Group))/);
+            if (pm && /Router|App|Group/.test(pm[2]))
+                routerParams.push(pm[1]);
+        }
+        out.push({ file, pkg, name: m[1], routerParams, body: text.slice(end, bodyEnd) });
+        headerRe.lastIndex = bodyEnd; // 跳过函数体
+    }
+    return out;
+}
+/**
+ * 项目级保护函数集（多层 Register 链，包限定键）：
+ * 队列自全部函数「参数未认证」种子起，凡函数体在「组已 Use 认证」后以
+ * 认证组调用项目内 Register 函数 → 该函数入队（参数认证）——支持
+ * journalist 式 main→api.Register(Group+Use)→v1.Register→模块 多层链。
+ * 键 = pkg:name，避免跨包同名函数（feeds.Register/tokens.Register…）串扰。
+ */
+function fiberProjectProtectedFns(files) {
+    const funcs = [];
+    for (const f of files)
+        funcs.push(...goFuncsOf(f.text, f.file));
+    const keyOf = (pkg, name) => `${pkg}:${name}`;
+    const byKey = new Map();
+    for (const fn of funcs) {
+        byKey.set(keyOf(fn.pkg, fn.name), [...(byKey.get(keyOf(fn.pkg, fn.name)) || []), fn]);
+    }
+    const protectedFns = new Map();
+    const done = new Set();
+    const queue = [];
+    for (const fn of funcs)
+        queue.push({ pkg: fn.pkg, name: fn.name, authed: false });
+    while (queue.length) {
+        const { pkg, name, authed } = queue.shift();
+        const dk = `${pkg}|${name}|${authed}`;
+        if (done.has(dk))
+            continue;
+        done.add(dk);
+        if (authed)
+            protectedFns.set(keyOf(pkg, name), true);
+        const candidates = byKey.get(keyOf(pkg, name)) || [];
+        for (const fn of candidates) {
+            const authedParams = new Set();
+            if (authed)
+                fn.routerParams.forEach((pp) => authedParams.add(pp));
+            const callees = fiberBodyProtectedCalls(fn.body, authedParams, funcs);
+            for (const c of callees)
+                queue.push({ pkg: c.pkg, name: c.name, authed: true });
+        }
+    }
+    return protectedFns;
+}
+/**
+ * 函数体内事件模拟 v2：返回在其认证相位被调用的项目函数（包限定）。
+ * 调用限定符 feeds.Register → pkg 匹配 feeds；同包调用按当前函数包。
+ */
+function fiberBodyProtectedCalls(body, authedParams, allFuncs) {
+    const calls = [];
+    const b = body.replace(/\(\s*\*\s*(\w+)\s*\)/g, "$1");
+    const curPkg = allFuncs.find((f) => f.body === body)?.pkg || "";
+    const state = new Map();
+    for (const p of authedParams)
+        state.set(p, true);
+    const re = /(\w+)\s*(?::=|=)\s*(?:[\w.]*\.)?([A-Za-z_]\w*)\.Group\s*\(|(\w+)\.Use\s*\(\s*([A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*)|(?:([A-Za-z_]\w*)\.)?([A-Z][A-Za-z0-9_]*)\s*\(/g;
+    let m;
+    while ((m = re.exec(b)) !== null) {
+        if (m[1] !== undefined) {
+            state.set(m[1], !!state.get(m[2]));
+        }
+        else if (m[3] !== undefined) {
+            if (isAuthFnName(m[4]))
+                state.set(m[3], true);
+        }
+        else if (m[5] !== undefined || m[6] !== undefined) {
+            const qual = m[5];
+            const fname = m[6];
+            // 项目内函数匹配：限定符 → pkg==qual；无限定符 → 同包
+            const matches = allFuncs.filter((f) => f.name === fname && (qual ? f.pkg === qual : f.pkg === curPkg));
+            if (matches.length === 0)
+                continue;
+            const openIdx = b.indexOf("(", m.index + m[0].length - 1);
+            if (openIdx < 0)
+                continue;
+            let depth = 1;
+            let i = openIdx + 1;
+            while (i < b.length && depth > 0) {
+                if (b[i] === "(")
+                    depth++;
+                else if (b[i] === ")")
+                    depth--;
+                i++;
+            }
+            const args = b.slice(openIdx + 1, i - 1).split(",").map((x) => x.trim().replace(/^[&*]+/, ""));
+            // 实参认证判定：直接组变量 或 内联组派生 X.Group(...)（X 已认证）
+            const argAuthed = (a) => {
+                if (state.get(a))
+                    return true;
+                const g = a.match(/^([A-Za-z_]\w*)\.Group\s*\(/);
+                return !!g && !!state.get(g[1]);
+            };
+            if (args.some(argAuthed)) {
+                for (const mm of matches)
+                    calls.push({ pkg: mm.pkg, name: mm.name });
+            }
+        }
+    }
+    return calls;
+}