@filipebraida/adonis-function-points 0.1.0 → 0.2.0

package/build/{pipeline-BzP-ITGN.js → pipeline-DySlMWcN.js}

@@ -1,34 +1,10 @@
-import { a as rootSymbolOf, i as hooksFiredBy, n as resolveCall, r as detectAccess, t as BUILTIN_CALL_RESOLVERS } from "./resolvers-CU9HKYpn.js";
+import { a as rootSymbolOf, c as toPosix, i as hooksFiredBy, n as resolveCall, o as collectEventBindings, r as detectAccess, s as samePath, t as BUILTIN_CALL_RESOLVERS } from "./resolvers-MFjRl2ef.js";
 import { Node, Project, SyntaxKind } from "ts-morph";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { createHash } from "node:crypto";
 import { execFileSync } from "node:child_process";
 import { readFileSync } from "node:fs";
-//#region src/inventory/paths.ts
-/**
-* One canonical spelling for every path the inventory emits.
-*
-* Two path styles meet in this package. ts-morph always returns forward
-* slashes, including on Windows; node's `path.join` returns backslashes there.
-* Both end up in `HandlerRef.file`, and the call graph uses that string as a
-* cache key:
-*
-*     const key = `${ref.file}#${ref.member ?? ref.line ?? '*'}`
-*
-* Two spellings of the same file are two keys, so the same body would be
-* analysed twice and pushed twice into the trace and the implementation scope
-* — and a repeated scope entry changes the hash `fp:diff` compares.
-*
-* Forward slashes win because ts-morph cannot be told otherwise, node's `fs`
-* accepts them on Windows, and `path.relative` normalises mixed input anyway.
-* Normalising at the boundary where a path is created costs one call; leaving
-* it to each comparison costs vigilance forever.
-*/
-const toPosix = (value) => value.split("\\").join("/");
-/** Compares two paths that may have come from different sources. */
-const samePath = (a, b) => a !== void 0 && b !== void 0 && toPosix(a) === toPosix(b);
-//#endregion
 //#region src/inventory/app_context.ts
 /** folders naming an artefact TYPE, in either layout */
 const ARTIFACT_KINDS = new Set([
@@ -1097,6 +1073,7 @@ const NEVER_DATA_METHODS = new Set([
 	"padEnd",
 	"toISO",
 	"toISODate",
+	"toISOString",
 	"toFormat",
 	"toUTC",
 	"toSQL",
@@ -1116,6 +1093,27 @@ const NEVER_DATA_METHODS = new Set([
 	"primitive"
 ]);
 /**
+* Array iteration, which is noise ONLY when a callback is passed.
+*
+* This is the one place a method name is allowed to matter, and it is guarded:
+* `repo.find(id)` is a data access while `rows.find((r) => r.id === id)` is a
+* predicate over a list already in memory. The callback is what separates them,
+* so the list alone decides nothing — `some`, `every` and `find` stay safe.
+*/
+const ITERATION_METHODS = new Set([
+	"map",
+	"filter",
+	"find",
+	"findIndex",
+	"findLast",
+	"some",
+	"every",
+	"forEach",
+	"flatMap",
+	"reduce",
+	"sort"
+]);
+/**
 * AdonisJS services, which reach the tracer through an application alias.
 *
 * `env` is imported from `#start/env`, an application module, so the symbol
@@ -1124,6 +1122,8 @@ const NEVER_DATA_METHODS = new Set([
 */
 const FRAMEWORK_SERVICES = new Set([
 	"env",
+	"redis",
+	"limiter",
 	"logger",
 	"health",
 	"hash",
@@ -1141,6 +1141,7 @@ function isNoise(call, owner) {
 	const expression = call.getExpression();
 	if (!Node.isPropertyAccessExpression(expression)) return false;
 	if (NEVER_DATA_METHODS.has(expression.getName())) return true;
+	if (isIteration(expression.getName(), call)) return true;
 	const receiver = expression.getExpression();
 	if (Node.isIdentifier(receiver) && FRAMEWORK_SERVICES.has(receiver.getText())) return true;
 	/**
@@ -1151,6 +1152,29 @@ function isNoise(call, owner) {
 	if (Node.isPropertyAccessExpression(receiver) && Node.isThisExpression(receiver.getExpression()) && FRAMEWORK_SERVICES.has(receiver.getName())) return true;
 	return isNativeReceiver(receiver, owner);
 }
+/**
+* Iteration over a list, checked BEFORE the resolvers run.
+*
+* `PAPEIS_CONCEDIVEIS.map((name) => …)` is `Identifier.method(args)`, the shape
+* `static-service` exists for, so the resolver claimed it, resolved the enum
+* module, found no `map` in it and reported a gap — noise never got asked,
+* because it is only consulted once every resolver has declined.
+*
+* No resolver's pattern is `X.map(callback)`, so refusing this shape up front
+* costs nothing and is not the same as silencing an unresolved call: nothing
+* was ever there to resolve.
+*/
+function isIterationCall(call) {
+	const expression = call.getExpression();
+	if (!Node.isPropertyAccessExpression(expression)) return false;
+	return isIteration(expression.getName(), call);
+}
+/** An iteration method whose first argument is an inline callback. */
+function isIteration(method, call) {
+	if (!ITERATION_METHODS.has(method)) return false;
+	const first = call.getArguments()[0];
+	return first !== void 0 && (Node.isArrowFunction(first) || Node.isFunctionExpression(first));
+}
 /** Does the receiver resolve to a built-in, by its declaration? */
 function isNativeReceiver(receiver, owner) {
 	if (Node.isArrayLiteralExpression(receiver) || Node.isStringLiteral(receiver)) return true;
@@ -1213,6 +1237,76 @@ function validatorFieldsIn(body, file, app) {
 	}
 	return fields;
 }
+/**
+* Fields read straight off the request, with no validator in between.
+*
+* `request.input('title')` is a user-recognisable field crossing the boundary —
+* §7.2's definition of a DET — and it was worth nothing, because input DETs came
+* only from VineJS. A transaction that reads six fields this way landed at 1 DET
+* and therefore at the floor of its complexity band.
+*
+* On four production applications about half the submitting transactions have no
+* validator, so this was not an edge case: it was a systematic undercount, and a
+* silent one.
+*
+* `all()`, `body()`, `except()` and `qs()` enumerate nothing — they read whatever
+* arrives. Those are the honest blind spot, reported rather than guessed, which
+* is why they come back as a flag and not as a field.
+*/
+const ENUMERATES_FIELDS = new Set(["input", "only"]);
+const READS_OPAQUELY = new Set([
+	"all",
+	"body",
+	"except",
+	"qs"
+]);
+function requestFieldsIn(body) {
+	const fields = /* @__PURE__ */ new Set();
+	let opaque = false;
+	for (const call of body.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+		const expression = call.getExpression();
+		if (!Node.isPropertyAccessExpression(expression)) continue;
+		if (!isRequest(expression.getExpression())) continue;
+		const method = expression.getName();
+		if (READS_OPAQUELY.has(method)) {
+			opaque = true;
+			continue;
+		}
+		if (!ENUMERATES_FIELDS.has(method)) continue;
+		const argument = call.getArguments()[0];
+		if (!argument) continue;
+		/** `request.input('title')` */
+		const single = argument.asKind(SyntaxKind.StringLiteral)?.getLiteralValue();
+		if (single) {
+			fields.add(single);
+			continue;
+		}
+		/** `request.only(['title', 'isbn'])` */
+		const list = argument.asKind(SyntaxKind.ArrayLiteralExpression);
+		if (!list) {
+			opaque = true;
+			continue;
+		}
+		for (const element of list.getElements()) {
+			const name = element.asKind(SyntaxKind.StringLiteral)?.getLiteralValue();
+			if (name) fields.add(name);
+			else opaque = true;
+		}
+	}
+	return {
+		fields: [...fields],
+		opaque
+	};
+}
+/**
+* `request` as an AdonisJS handler receives it: destructured from the context,
+* or reached through it. Resolved by shape, not by a name list — `ctx.request`
+* and `{ request }` are the same object.
+*/
+function isRequest(receiver) {
+	if (Node.isIdentifier(receiver)) return receiver.getText() === "request";
+	return Node.isPropertyAccessExpression(receiver) && receiver.getName() === "request";
+}
 /** validator declaration: in this file, or imported from the application */
 function findValidator(name, file, app) {
 	const local = file.getVariableDeclaration(name)?.getInitializer();
@@ -1259,6 +1353,7 @@ const DEFAULT_MAX_DEPTH = 3;
 * minutes and seconds on an application of a few hundred routes.
 */
 function createAnalyzer(app, stores, options = {}) {
+	const eventBindings = options.eventBindings ?? /* @__PURE__ */ new Map();
 	const project = new Project({
 		skipAddingFilesFromTsConfig: true,
 		skipFileDependencyResolution: true,
@@ -1287,7 +1382,7 @@ function createAnalyzer(app, stores, options = {}) {
 		const key = file.getFilePath();
 		let cached = importCache.get(key);
 		if (!cached) {
-			cached = importsOf(file, app);
+			cached = importMapsOf(file, app);
 			importCache.set(key, cached);
 		}
 		return cached;
@@ -1337,7 +1432,7 @@ function createAnalyzer(app, stores, options = {}) {
 		if (!file) return null;
 		const body = findBody(file, ref);
 		if (!body) return null;
-		const imports = importsFor(file);
+		const { imports, exportedAs } = importsFor(file);
 		/** the class this body belongs to: how `this.something` resolves */
 		const owner = body.getFirstAncestorByKind(SyntaxKind.ClassDeclaration);
 		const injected = injectedFor(owner, file, app);
@@ -1346,6 +1441,7 @@ function createAnalyzer(app, stores, options = {}) {
 		const followUps = [];
 		const unresolved = [];
 		const validators = validatorFieldsIn(body, file, app);
+		const request = requestFieldsIn(body);
 		for (const call of body.getDescendantsOfKind(SyntaxKind.CallExpression)) {
 			const access = detectAccess(call, symbols, relationsByStore);
 			if (access) {
@@ -1369,11 +1465,18 @@ function createAnalyzer(app, stores, options = {}) {
 				});
 				continue;
 			}
+			/**
+			* Asked before the resolvers, unlike the rest of the noise filter: this
+			* shape must not be CLAIMED, not merely not reported.
+			*/
+			if (isIterationCall(call)) continue;
 			const resolved = resolveCall(call, {
 				file,
 				depth: 0,
 				imports,
+				exportedAs,
 				injected,
+				eventBindings,
 				dataStoresBySymbol: storesByName,
 				resolveSpecifier: app.resolveSpecifier,
 				sourceFile
@@ -1397,17 +1500,49 @@ function createAnalyzer(app, stores, options = {}) {
 			followUps,
 			unresolved,
 			validators,
+			requestFields: request.fields,
+			opaqueRequest: request.opaque,
 			bodyHash: hashOf(body)
 		};
 	}
+	/**
+	* Stores written anywhere in the application's own code, reachable from an
+	* entry point or not.
+	*
+	* AFP §6.5.4 decides ILF vs EIF by whether the APPLICATION maintains the
+	* store. The graph only walks from HTTP routes, so a table written solely by a
+	* job or a seeder looked unmaintained and came out as an EIF — data held by
+	* another system. It is not: a job is this application. The misclassification
+	* costs 2 points per store and, worse, says the wrong thing about who owns the
+	* data.
+	*
+	* This is a separate pass because reachability is not the question. Whether a
+	* transaction reaches the store still decides if it is counted at all; this
+	* only decides who maintains it.
+	*/
+	const writtenAnywhere = () => {
+		const written = /* @__PURE__ */ new Set();
+		for (const file of project.getSourceFiles()) {
+			const symbols = storeSymbolsFor(file, file, app, storesByName);
+			if (symbols.size === 0) continue;
+			for (const call of file.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+				const access = detectAccess(call, symbols, relationsByStore);
+				if (access?.mode === "write") written.add(access.store);
+			}
+		}
+		return written;
+	};
 	return {
 		analyze: (handler) => run(handler),
+		writtenAnywhere,
 		/** how many files the project loaded — used to prove it does not grow */
 		fileCount: () => project.getSourceFiles().length
 	};
 	function run(handler) {
 		const touches = /* @__PURE__ */ new Set();
 		const inputFields = /* @__PURE__ */ new Set();
+		const requestFields = /* @__PURE__ */ new Set();
+		let opaqueRequest = false;
 		const trace = [];
 		const scope = [];
 		const unresolved = [];
@@ -1445,6 +1580,8 @@ function createAnalyzer(app, stores, options = {}) {
 			}
 			unresolved.push(...facts.unresolved);
 			for (const field of facts.validators) inputFields.add(field);
+			for (const field of facts.requestFields) requestFields.add(field);
+			if (facts.opaqueRequest) opaqueRequest = true;
 			trace.push({
 				file: ref.file,
 				member: ref.member,
@@ -1469,6 +1606,8 @@ function createAnalyzer(app, stores, options = {}) {
 			writes,
 			touches: [...touches].sort(),
 			inputFields: [...inputFields].sort(),
+			requestFields: [...requestFields].sort(),
+			opaqueRequest,
 			trace,
 			scope,
 			unresolved
@@ -1665,16 +1804,32 @@ function membersOfType(typeNode, file, app) {
 	}
 	return members;
 }
-function importsOf(file, app) {
-	const map = /* @__PURE__ */ new Map();
+/**
+* Both maps a file's imports produce: where a local name resolves, and what it
+* was called where it was exported.
+*
+* Exported because the tests need the same answer the pipeline gets: a second
+* implementation in the helpers drifted from this one and missed aliases.
+*/
+function importMapsOf(file, app) {
+	const imports = /* @__PURE__ */ new Map();
+	const exportedAs = /* @__PURE__ */ new Map();
 	for (const declaration of file.getImportDeclarations()) {
 		const target = app.resolveSpecifier(declaration.getModuleSpecifierValue());
 		if (!target) continue;
 		const defaultImport = declaration.getDefaultImport()?.getText();
-		if (defaultImport) map.set(defaultImport, target);
-		for (const named of declaration.getNamedImports()) map.set(named.getAliasNode()?.getText() ?? named.getName(), target);
+		if (defaultImport) imports.set(defaultImport, target);
+		for (const named of declaration.getNamedImports()) {
+			const alias = named.getAliasNode()?.getText();
+			const local = alias ?? named.getName();
+			imports.set(local, target);
+			if (alias) exportedAs.set(alias, named.getName());
+		}
 	}
-	return map;
+	return {
+		imports,
+		exportedAs
+	};
 }
 /**
 * Not every unfollowed call is an unresolved call — but the filter must err on
@@ -1691,12 +1846,27 @@ function isWorthReporting(call, symbols, imports) {
 	const expression = call.getExpression();
 	if (Node.isIdentifier(expression)) return imports.has(expression.getText());
 	if (!Node.isPropertyAccessExpression(expression)) return false;
+	/**
+	* A call ON THE RESULT of another call — `dispatch(job).waitResult()`,
+	* `load(id).unwrap()`. The receiver is a value this body already holds, and
+	* the call that produced it is a call site of this same body: it is visited
+	* too, and reports the gap if there is one. Reporting here as well charges
+	* the same unknown twice, and the second charge reads as a distinct defect.
+	*/
+	const receiver = unwrapAwait(expression.getExpression());
+	if (Node.isCallExpression(receiver)) return false;
 	const root = rootSymbolOf(expression.getExpression());
 	if (!root) return false;
 	if (symbols.has(root)) return false;
 	if (root === "this") return true;
 	return imports.has(root);
 }
+/** `(await x())` and `x()` are the same receiver for this purpose. */
+function unwrapAwait(node) {
+	let current = node;
+	while (Node.isAwaitExpression(current) || Node.isParenthesizedExpression(current) || Node.isNonNullExpression(current)) current = current.getExpression();
+	return current;
+}
 /**
 * Hash of the NORMALISED body: comments and whitespace removed.
 *
@@ -1802,7 +1972,15 @@ function countDataFunctions(stores, usage, options) {
 		const detAttributes = store.attributes.filter((attribute) => !attribute.isIdentifier);
 		const det = detAttributes.length;
 		const refs = options.retStrategy === "composition" ? 1 + store.subgroups.length : 1;
-		const type = options.externallyMaintained.has(store.name) || !use.written ? "EIF" : "ILF";
+		/**
+		* Maintained by the application, or by another system?
+		*
+		* A write reachable from an entry point is the common case. A write from a
+		* job or a seeder maintains the store just as much — AFP §6.5.4 asks who
+		* maintains it, not which route does.
+		*/
+		const maintained = use.written || options.writtenAnywhere.has(store.name);
+		const type = options.externallyMaintained.has(store.name) || !maintained ? "EIF" : "ILF";
 		const complexity = complexityOf(type, refs, det, options.tables);
 		counted.push({
 			id: `data:${store.name}`,
@@ -1814,7 +1992,7 @@ function countDataFunctions(stores, usage, options) {
 			complexity,
 			points: pointsOf(type, complexity, options.weights),
 			rationale: {
-				rule: options.externallyMaintained.has(store.name) ? "afp:6.5.4 externally maintained by boundary configuration -> EIF" : use.written ? "afp:6.5.4 maintained by an application transaction -> ILF" : "afp:6.5.4 used but not maintained -> EIF",
+				rule: options.externallyMaintained.has(store.name) ? "afp:6.5.4 externally maintained by boundary configuration -> EIF" : maintained ? "afp:6.5.4 maintained by an application transaction -> ILF" : "afp:6.5.4 used but not maintained -> EIF",
 				detSources: detAttributes.map((attribute) => `${store.columnSource}:${store.table ?? store.name}.${attribute.name}`),
 				refSources: options.retStrategy === "composition" ? ["1 (main group)", ...store.subgroups.map((s) => `composition:${s}`)] : ["1 (constant: a logical subgroup is not derivable from code)"]
 			}
@@ -1900,6 +2078,17 @@ function detsFor(entry, behavior, touched, type, options) {
 	};
 	for (const param of entry.signature.match(/:[A-Za-z_][\w]*/g) ?? []) add(param.slice(1), `param:${param}`);
 	for (const field of behavior.inputFields) add(field.split(".").pop(), `validator:${field}`);
+	/**
+	* §7.2 asks whether a user-recognisable field crosses the boundary, not how it
+	* was declared. `request.input('title')` does, and counted for nothing while
+	* input DETs came only from VineJS — so a transaction reading six fields this
+	* way sat at 1 DET, the floor of its band.
+	*
+	* After the validator, and deduplicated by field name: where both exist the
+	* validator is the better provenance to print, and the same field must not be
+	* paid for twice.
+	*/
+	for (const field of behavior.requestFields) add(field, `request:${field}`);
 	if (type === "EO" || type === "EQ") for (const store of touched) {
 		const columns = options.countedStores.get(store).attributes.filter((attribute) => !attribute.isIdentifier);
 		for (const column of columns) add(`${store}.${column.name}`, `output:${store}.${column.name}`);
@@ -1958,8 +2147,16 @@ function isTechnical(store, patterns = DEFAULT_TECHNICAL_PATTERNS) {
 * It appears in every report, and `fp:diff` refuses to compare counts produced
 * by different versions — otherwise the difference would measure the rule
 * change rather than the work.
+*
+* It must be bumped by ANY change that moves the number for unchanged code, and
+* that is easy to forget: four such changes landed in 1.1.0 — maintenance read
+* across the whole project rather than from routes alone, a job followed into
+* `process`, an event followed into its listeners, and `request.input(…)` counted
+* as a DET. Without the bump, a baseline saved by the previous version would have
+* compared cleanly against this one and billed the tool's own improvement as work
+* done. The guard exists for exactly that, and only this constant arms it.
 */
-const RULESET_VERSION = "1.0.0";
+const RULESET_VERSION = "1.1.0";
 function count(input, options = {}) {
 	const warnings = [];
 	const usage = usageOf(input);
@@ -1972,16 +2169,30 @@ function count(input, options = {}) {
 		...options.weights
 	};
 	const infrastructure = new Set(options.boundary?.infrastructure ?? []);
+	const business = new Set(options.boundary?.business ?? []);
 	const countable = input.stores.filter((store) => {
 		if (infrastructure.has(store.name) || infrastructure.has(store.table ?? "")) {
 			warnings.push(`excluded by boundary configuration: ${store.name}`);
 			return false;
 		}
 		const technical = isTechnical(store);
-		if (technical) warnings.push(`technical, excluded: ${store.name} (${technical})`);
-		return !technical;
+		if (!technical) return true;
+		/**
+		* The naming filter is a heuristic over names, so it catches business data
+		* whose name happens to match — a chat session the user manages, a document
+		* template they maintain. Only a person knows which, so a declaration wins
+		* over the pattern, and the report says it was overruled rather than
+		* quietly counting one more store.
+		*/
+		if (business.has(store.name) || business.has(store.table ?? "")) {
+			warnings.push(`kept by boundary configuration: ${store.name} — the AFP naming filter had excluded it (${technical})`);
+			return true;
+		}
+		warnings.push(`technical, excluded: ${store.name} (${technical})`);
+		return false;
 	});
 	const dataFunctions = countDataFunctions(countable, usage, {
+		writtenAnywhere: input.writtenAnywhere ?? /* @__PURE__ */ new Set(),
 		retStrategy: options.retStrategy ?? "constant",
 		externallyMaintained: new Set(options.boundary?.externallyMaintained ?? []),
 		tables,
@@ -1996,6 +2207,7 @@ function count(input, options = {}) {
 		weights
 	});
 	warnings.push(...opaqueColumnWarnings(countable, input));
+	warnings.push(...unreadableInputWarnings(input));
 	const functions = applyOverrides([...dataFunctions, ...transactionalFunctions], options.overrides ?? {}, input.jsonSchemas ?? /* @__PURE__ */ new Map(), tables, weights, warnings);
 	return {
 		ruleset: "afp",
@@ -2033,6 +2245,42 @@ function opaqueColumnWarnings(stores, input) {
 	if (found.length === 0) return [];
 	return [`${found.length} opaque column(s), each counted as 1 DET. If the user recognises fields inside one, declare the count with \`overrides\` — counting-decisions §8:`, ...found];
 }
+/**
+* Transactions that read the request in a way that enumerates nothing.
+*
+* `request.all()`, `request.body()`, `request.except([…])` — whatever arrives is
+* read, and no analysis can say how many fields that is. The transaction is
+* counted from its route parameters alone, which puts it at the floor of its
+* complexity band: an undercount, and a silent one until now.
+*
+* Two earlier versions of this warning were wrong and are worth recording,
+* because both looked like rigour. The first flagged every write with no
+* validator and named `users.destroy`, `DELETE /questions/:id` and
+* `notifications.markRead` — transactions that legitimately carry nothing beyond
+* the route parameter, exactly as counting-decisions §7 describes. The second
+* narrowed to POST, PUT and PATCH, and still named `POST /orders/:id/submit` and
+* `POST /orders/:id/clear`: in an AdonisJS application POST is how a state
+* transition is expressed, so the verb does not separate a submission from a
+* trigger.
+*
+* What separates them is whether the handler reads the request at all. A trigger
+* does not. So the enumerable reads are now COUNTED — `request.input('title')` is
+* a DET — and only what cannot be enumerated is reported. A warning that names
+* routes with nothing wrong with them is the noise that teaches people to stop
+* reading the confidence block.
+*/
+function unreadableInputWarnings(input) {
+	const blind = input.entryPoints.map((entry) => ({
+		entry,
+		behavior: input.behaviors.get(entry.id)
+	})).filter(({ behavior }) => behavior?.opaqueRequest && behavior.inputFields.length === 0);
+	if (blind.length === 0) return [];
+	return [
+		`${blind.length} transaction(s) read the request without enumerating fields (\`all()\`, \`body()\`, \`except()\`), so their input DETs could not be counted and each sits at the floor of its band. This UNDERSTATES the total — the fix is a validator, not a configuration:`,
+		...blind.slice(0, 10).map(({ entry }) => `  ${entry.trigger} ${entry.signature}`),
+		...blind.length > 10 ? [`  … and ${blind.length - 10} more`] : []
+	];
+}
 /** a column whose shape says nothing about what it holds */
 const OPAQUE_TYPE = /^(object|any|unknown|Record<|Json|JSON)/;
 /**
@@ -2248,7 +2496,8 @@ async function analyze(root, options = {}) {
 	const jsonSchemas = collectJsonSchemas(app);
 	const analyzer = createAnalyzer(app, stores, {
 		maxDepth: options.maxDepth,
-		callResolvers: options.resolvers?.call
+		callResolvers: options.resolvers?.call,
+		eventBindings: collectEventBindings(app)
 	});
 	const behaviors = new Map(entryPoints.filter((entry) => entry.handler).map((entry) => [entry.id, analyzer.analyze(entry.handler)]));
 	const resolved = [...behaviors.values()].filter((behavior) => behavior.unresolved.length === 0).length;
@@ -2275,6 +2524,14 @@ async function analyze(root, options = {}) {
 					by: "validator"
 				}
 			})),
+			requestFields: behavior.requestFields.map((name) => ({
+				name,
+				provenance: {
+					file: app.root,
+					by: "request"
+				}
+			})),
+			opaqueRequest: behavior.opaqueRequest,
 			outputFields: [],
 			trace: behavior.trace,
 			unresolved: behavior.unresolved
@@ -2296,11 +2553,12 @@ async function analyze(root, options = {}) {
 				stores,
 				entryPoints,
 				behaviors,
-				jsonSchemas
+				jsonSchemas,
+				writtenAnywhere: analyzer.writtenAnywhere()
 			}, options),
 			source: describeSource(root, options.configFile ?? null)
 		}
 	};
 }
 //#endregion
-export { analyze as n, toPosix as r, CoverageTooLowError as t };
+export { analyze as n, CoverageTooLowError as t };