@gate-forge/pack-fastapi 0.7.1 → 0.9.0

package/README.md

@@ -123,6 +123,34 @@ bounded and deterministic:
   invented). A parameter name shadowing a same-file instance variable
   keeps the module-level reading only (no double emission).
 
+
+## Prefixes that are provable, and routers nothing mounts
+
+- **Annotated definitions are definitions.** `router: APIRouter =
+  APIRouter(prefix="/api/v1")` is indexed exactly like `router =
+  APIRouter(prefix="/api/v1")`, prefix included. (It used to be ignored,
+  and every route behind it was published at the router's own prefix with
+  no typed outcome.)
+- **Constant prefixes fold.** A prefix that is a module-level string
+  constant — `API = "/api/v1"` with `APIRouter(prefix=API)` **or**
+  `app.include_router(router, prefix=API)` — is provable from the source,
+  so the route keeps its real path. An f-string, an attribute, or a call
+  is genuinely computed: the router yields a typed
+  `FASTAPI_PREFIX_UNRESOLVED` entry and no route is emitted.
+- **A router object built by an unmodeled expression** (`router =
+  build_router()`, a subscript, an attribute) has an unknown prefix, so
+  its routes are reported as `FASTAPI_PREFIX_UNRESOLVED` naming the
+  variable — never as prefix-less paths that no app serves.
+- **`FASTAPI_ROUTER_UNMOUNTED`.** A router that no scanned
+  `include_router` targets is served by no scanned app. Its routes keep
+  their standalone emission (the declared prefix is all the scan knows),
+  and one typed entry names the router, its file and every declared
+  route, so "the `/api/v1` prefix was not applied" is never the answer
+  when the real one is "nothing mounts this router". Reported only when
+  the scanned set shows an application and has no unresolvable include;
+  with a partial scan, or an include the scan cannot follow, the pack
+  says nothing it cannot prove.
+
 ## Output model (ADR 0004 D1)
 
 One `http.contract` resource per (effective mounted path, concrete
@@ -145,6 +173,45 @@ handler names these very facts carry, and blocks ambiguity with typed
 detection remains for genuinely stale authority signals (declaration
 markers, adapter bindings, read-only declarations).
 
+## Response-model wire names
+
+Each server-route fact carries `attributes.responseModelFields`: the wire
+names its response model answers to, in declaration order — every pydantic
+field name plus every `Field(alias=...)` it declares, including the fields
+it inherits from a base class the scanned set also proves. The model is
+the decorator's `response_model=` when it declares one and the handler's
+return annotation otherwise (FastAPI's own default), with the containers
+FastAPI unwraps peeled off: `list[InvoiceOut]`, `Optional[MoneyOut]` and
+`MoneyOut | None` all report the element model.
+
+`detail` is always among the names: FastAPI answers a failed request with
+`{"detail": ...}` (an `HTTPException`) or a `detail` list (request
+validation), so a frontend reading `detail` to report an error is never
+evidence of a dropped success-model field.
+
+The attribute is **absent** whenever the wire names are not statically
+computable, never partial:
+
+- a model configuring alias generation (`model_config = ConfigDict(...)`
+  or a pydantic v1 `class Config`) — every name differs;
+- a base class outside the scanned set — inherited fields unknown;
+- a shape that is not one model: `dict`, a union of two models, a
+  computed annotation, no annotation at all.
+
+The existing `responseModel` attribute keeps its exact previous meaning
+(the decorator declaration only) and its exact previous bytes; a return
+annotation is a new fact, never a change of the old one.
+
+`gateforge check` cross-checks these names against the fields a frontend
+actually reads (reported by `@gate-forge/pack-http` as `responseReads`)
+and emits one **non-blocking** `RESPONSE_FIELD_MISSING_FROM_MODEL`
+advisory per field a joined endpoint's model does not declare — naming the
+endpoint, the field, the frontend file and line, and the names the model
+does declare. A field counts as present under its own name, under the other
+case style (`due_date` ≡ `dueDate`) or under a declared alias. A
+repository whose routes declare no provable response model produces no
+advisory and a byte-identical report.
+
 ## Setup
 
 ```yaml

package/dist/detector.d.ts

@@ -37,7 +37,12 @@ export interface FastapiDetectorOptions {
     command?: readonly string[];
     /** Subprocess environment (default: {@link pythonEnvironment}). */
     env?: NodeJS.ProcessEnv;
-    /** Working directory the repo-relative paths resolve against. */
+    /**
+     * Working directory the repo-relative paths resolve against (default:
+     * `process.cwd()` AT DISCOVER TIME, not at factory time — the default
+     * export is created at module import and `check --staged` moves the
+     * process cwd to the candidate checkout before discovery).
+     */
     cwd?: string;
     /** Handshake-pinned plugin id (default: the pack id). */
     pluginId?: string;
@@ -49,9 +54,9 @@ export interface FastapiDetectorOptions {
      */
     importRoots?: readonly string[];
     /**
-     * Repo-relative path of a config document (JSON) read from `cwd` when
-     * `importRoots` is not given (default: `.gateforge/fastapi.json`;
-     * absence is normal, malformed throws).
+     * Repo-relative path of a config document (JSON) read from the root in
+     * force at discover time when `importRoots` is not given (default:
+     * `.gateforge/fastapi.json`; absence is normal, malformed throws).
      */
     importRootsConfigPath?: string;
 }

package/dist/detector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"detector.d.ts","sourceRoot":"","sources":["../src/detector.ts"],"names":[],"mappings":"AA4CA,2EAA2E;AAC3E,eAAO,MAAM,eAAe,UAAkD,CAAC;AAE/E;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,4BAA4B,CAAC;AAElE,iEAAiE;AACjE,MAAM,WAAW,iBAAiB;IAChC;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACjC;AAED,eAAO,MAAM,2BAA2B,EAAE,iBAAsB,CAAC;AAsBjE;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,iBAAiB,CAkClF;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,GAAE,SAAS,MAAM,EAAO,GAAG,MAAM,CAAC,UAAU,CAGlF;AAED,iDAAiD;AACjD,MAAM,WAAW,sBAAsB;IACrC,0EAA0E;IAC1E,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,mEAAmE;IACnE,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,iEAAiE;IACjE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,yDAAyD;IACzD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,oEAAoE;AACpE,MAAM,WAAW,eAAe;IAC9B,QAAQ,CACN,KAAK,EAAE,SAAS,MAAM,EAAE,GACvB,OAAO,CAAC;QACT,SAAS,EAAE,OAAO,EAAE,CAAC;QACrB,UAAU,EAAE,OAAO,EAAE,CAAC;QACtB,QAAQ,EAAE,OAAO,EAAE,CAAC;QACpB,qBAAqB,EAAE,OAAO,EAAE,CAAC;QACjC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;KACzB,CAAC,CAAC;CACJ;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,GAAE,sBAA2B,GAAG,eAAe,CAuC3F"}
+{"version":3,"file":"detector.d.ts","sourceRoot":"","sources":["../src/detector.ts"],"names":[],"mappings":"AA6CA,2EAA2E;AAC3E,eAAO,MAAM,eAAe,UAAkD,CAAC;AAE/E;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,4BAA4B,CAAC;AAElE,iEAAiE;AACjE,MAAM,WAAW,iBAAiB;IAChC;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACjC;AAED,eAAO,MAAM,2BAA2B,EAAE,iBAAsB,CAAC;AAsBjE;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,iBAAiB,CAkClF;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,GAAE,SAAS,MAAM,EAAO,GAAG,MAAM,CAAC,UAAU,CAOlF;AAED,iDAAiD;AACjD,MAAM,WAAW,sBAAsB;IACrC,0EAA0E;IAC1E,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,mEAAmE;IACnE,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB;;;;;OAKG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,yDAAyD;IACzD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,oEAAoE;AACpE,MAAM,WAAW,eAAe;IAC9B,QAAQ,CACN,KAAK,EAAE,SAAS,MAAM,EAAE,GACvB,OAAO,CAAC;QACT,SAAS,EAAE,OAAO,EAAE,CAAC;QACrB,UAAU,EAAE,OAAO,EAAE,CAAC;QACtB,QAAQ,EAAE,OAAO,EAAE,CAAC;QACpB,qBAAqB,EAAE,OAAO,EAAE,CAAC;QACjC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;KACzB,CAAC,CAAC;CACJ;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,GAAE,sBAA2B,GAAG,eAAe,CAiD3F"}

package/dist/detector.js

@@ -22,10 +22,11 @@
  * handler corroboration over the facts this pack emits).
  *
  * Determinism: the python scan is pure over (paths, file bytes). The
- * optional `.gateforge/fastapi.json` config (import roots for absolute
- * imports, the central-router-registry pattern) is read once at factory
- * time and passed to the scanner as an explicit `--import-roots` argv
- * flag — never environment state, never per-request mutation.
+ * The optional `.gateforge/fastapi.json` config (import roots for absolute
+ * imports, the central-router-registry pattern) is read from the root that
+ * is in force at DISCOVER time and passed to the scanner as an explicit
+ * `--import-roots` argv flag — never environment state, never per-request
+ * mutation.
  */
 import { readFileSync } from 'node:fs';
 import { delimiter, resolve } from 'node:path';
@@ -107,7 +108,11 @@ export function readFastapiScanConfigOrNull(path) {
  */
 export function pythonEnvironment(extra = []) {
     const entries = [...extra, PACK_PYTHON_DIR, PROTOCOL_PYTHON_DIR];
-    return { ...process.env, PYTHONPATH: entries.join(delimiter) };
+    return {
+        ...process.env,
+        PYTHONDONTWRITEBYTECODE: '1',
+        PYTHONPATH: entries.join(delimiter),
+    };
 }
 /**
  * Creates a discover-capable detector module. The default export of the
@@ -116,24 +121,35 @@ export function pythonEnvironment(extra = []) {
 export function createFastapiDetector(options = {}) {
     const command = options.command ?? DEFAULT_COMMAND;
     const env = options.env ?? pythonEnvironment();
-    const cwd = options.cwd ?? process.cwd();
     const pluginId = options.pluginId ?? PACK_PLUGIN_ID;
     const pluginVersion = options.pluginVersion ?? PACK_VERSION;
-    // Explicit roots win; otherwise the config document (absence normal,
-    // malformed throws). With no roots at all the spawned command is
-    // byte-identical to the pre-config surface.
-    const importRoots = options.importRoots ??
-        readFastapiScanConfigOrNull(resolve(cwd, options.importRootsConfigPath ?? FASTAPI_SCAN_CONFIG_PATH))
-            .importRoots ??
-        [];
-    const argv = importRoots.length > 0 ? [...command, '--import-roots', JSON.stringify(importRoots)] : [...command];
+    // The repo root is resolved at DISCOVER time unless the caller pinned one
+    // explicitly: the default export of this pack is created at module import
+    // (the CLI imports it at startup), and `gateforge check --staged` moves the
+    // process cwd to the staged candidate checkout before discovery runs. A
+    // root captured at factory time would pin the loader's cwd and read the
+    // user's worktree bytes instead of the gated ones. The same holds for the
+    // config document: `.gateforge/fastapi.json` is read from the root in
+    // force at this discover call. Explicit options always win.
+    const resolveRoot = () => options.cwd ?? process.cwd();
+    const resolveArgv = (cwd) => {
+        // Explicit roots win; otherwise the config document (absence normal,
+        // malformed throws). With no roots at all the spawned command is
+        // byte-identical to the pre-config surface.
+        const importRoots = options.importRoots ??
+            readFastapiScanConfigOrNull(resolve(cwd, options.importRootsConfigPath ?? FASTAPI_SCAN_CONFIG_PATH))
+                .importRoots ??
+            [];
+        return importRoots.length > 0 ? [...command, '--import-roots', JSON.stringify(importRoots)] : [...command];
+    };
     return {
         async discover(paths) {
             if (paths.length === 0) {
                 return { resources: [], unresolved: [], findings: [], classificationSignals: [] };
             }
+            const cwd = resolveRoot();
             const session = new PluginSession({
-                command: argv,
+                command: resolveArgv(cwd),
                 pluginId,
                 pluginVersion,
                 cwd,

package/dist/detector.js.map

@@ -1 +1 @@
-{"version":3,"file":"detector.js","sourceRoot":"","sources":["../src/detector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,aAAa,EAAyB,MAAM,6BAA6B,CAAC;AACnF,OAAO,EAAE,iBAAiB,EAAyB,MAAM,YAAY,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5D,yEAAyE;AACzE,MAAM,eAAe,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE7E,+EAA+E;AAC/E,MAAM,mBAAmB,GAAG,aAAa,CACvC,IAAI,GAAG,CAAC,iCAAiC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAC5D,CAAC;AAEF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,4BAA4B,CAAC,CAAC;AAE/E;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,yBAAyB,CAAC;AAelE,MAAM,CAAC,MAAM,2BAA2B,GAAsB,EAAE,CAAC;AAEjE,2EAA2E;AAC3E,SAAS,mBAAmB,CAAC,GAAY,EAAE,IAAY;IACrD,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,oEAAoE,IAAI,EAAE,CAC3E,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC7D,IAAI,UAAU,GAAG,QAAQ,CAAC;IAC1B,OAAO,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,UAAU,KAAK,EAAE,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,KAAK,CACb,4EAA4E;YAC1E,gBAAgB,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CACjD,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAAmB;IAC7D,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,2BAA2B,CAAC;IACtD,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,2BAA2B,CAAC,CAAC,8CAA8C;IACpF,CAAC;IACD,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,0DAA0D,IAAI,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,QAAQ,GAAG,MAAiC,CAAC;IACnD,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,aAAa,CAAC,CAAC;IACjF,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,uEAAuE;QACvE,iEAAiE;QACjE,MAAM,IAAI,KAAK,CACb,kDAAkD;YAChD,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAChD,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC;IACtC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,qEAAqE;gBACnE,qCAAqC,IAAI,EAAE,CAC9C,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAA2B,EAAE;IAC7D,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,EAAE,eAAe,EAAE,mBAAmB,CAAC,CAAC;IACjE,OAAO,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;AACjE,CAAC;AAwCD;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAAkC,EAAE;IACxE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,eAAe,CAAC;IACnD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,iBAAiB,EAAE,CAAC;IAC/C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,cAAc,CAAC;IACpD,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,YAAY,CAAC;IAC5D,qEAAqE;IACrE,iEAAiE;IACjE,4CAA4C;IAC5C,MAAM,WAAW,GACf,OAAO,CAAC,WAAW;QACnB,2BAA2B,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,qBAAqB,IAAI,wBAAwB,CAAC,CAAC;aACjG,WAAW;QACd,EAAE,CAAC;IACL,MAAM,IAAI,GACR,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,EAAE,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC;IAEtG,OAAO;QACL,KAAK,CAAC,QAAQ,CAAC,KAAK;YAClB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,qBAAqB,EAAE,EAAE,EAAE,CAAC;YACpF,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,aAAa,CAAC;gBAChC,OAAO,EAAE,IAAI;gBACb,QAAQ;gBACR,aAAa;gBACb,GAAG;gBACH,GAAG;gBACH,QAAQ,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE;aACzE,CAAC,CAAC;YACH,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;gBACtB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;gBACnD,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC;YAC9B,CAAC;oBAAS,CAAC;gBACT,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;YAC1B,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,OAAyB;IAC5C,MAAM,SAAS,GAAG,iBAAiB,CAAC,OAAO,CAAC,SAAwC,CAAC,CAAC;IACtF,MAAM,UAAU,GAAG;QACjB,GAAG,OAAO,CAAC,UAAU;QACrB,GAAG,SAAS,CAAC,UAAU;KACxB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACd,MAAM,SAAS,GAAG,CAAC,CAAC,UAAU,CAA+C,CAAC;QAC9E,MAAM,SAAS,GAAG,CAAC,CAAC,UAAU,CAA+C,CAAC;QAC9E,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACxC,IAAI,KAAK,KAAK,KAAK;YAAE,OAAO,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,KAAK,KAAK,KAAK;YAAE,OAAO,KAAK,GAAG,KAAK,CAAC;QAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACtC,IAAI,KAAK,KAAK,KAAK;YAAE,OAAO,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1C,IAAI,OAAO,KAAK,OAAO;YAAE,OAAO,CAAC,CAAC;QAClC,OAAO,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IACH,OAAO;QACL,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,UAAU;QACV,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,qBAAqB,EAAE,SAAS,CAAC,qBAAqB;QACtD,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"detector.js","sourceRoot":"","sources":["../src/detector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,aAAa,EAAyB,MAAM,6BAA6B,CAAC;AACnF,OAAO,EAAE,iBAAiB,EAAyB,MAAM,YAAY,CAAC;AACtE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5D,yEAAyE;AACzE,MAAM,eAAe,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE7E,+EAA+E;AAC/E,MAAM,mBAAmB,GAAG,aAAa,CACvC,IAAI,GAAG,CAAC,iCAAiC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAC5D,CAAC;AAEF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,4BAA4B,CAAC,CAAC;AAE/E;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,yBAAyB,CAAC;AAelE,MAAM,CAAC,MAAM,2BAA2B,GAAsB,EAAE,CAAC;AAEjE,2EAA2E;AAC3E,SAAS,mBAAmB,CAAC,GAAY,EAAE,IAAY;IACrD,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,oEAAoE,IAAI,EAAE,CAC3E,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC7D,IAAI,UAAU,GAAG,QAAQ,CAAC;IAC1B,OAAO,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,UAAU,KAAK,EAAE,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAI,KAAK,CACb,4EAA4E;YAC1E,gBAAgB,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CACjD,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAAmB;IAC7D,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,2BAA2B,CAAC;IACtD,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,2BAA2B,CAAC,CAAC,8CAA8C;IACpF,CAAC;IACD,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,0DAA0D,IAAI,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,QAAQ,GAAG,MAAiC,CAAC;IACnD,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,aAAa,CAAC,CAAC;IACjF,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,uEAAuE;QACvE,iEAAiE;QACjE,MAAM,IAAI,KAAK,CACb,kDAAkD;YAChD,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAChD,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC;IACtC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,qEAAqE;gBACnE,qCAAqC,IAAI,EAAE,CAC9C,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAA2B,EAAE;IAC7D,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,EAAE,eAAe,EAAE,mBAAmB,CAAC,CAAC;IACjE,OAAO;QACL,GAAG,OAAO,CAAC,GAAG;QACd,uBAAuB,EAAE,GAAG;QAC5B,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;KACpC,CAAC;AACJ,CAAC;AA6CD;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAAkC,EAAE;IACxE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,eAAe,CAAC;IACnD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,iBAAiB,EAAE,CAAC;IAC/C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,cAAc,CAAC;IACpD,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,YAAY,CAAC;IAC5D,0EAA0E;IAC1E,0EAA0E;IAC1E,4EAA4E;IAC5E,wEAAwE;IACxE,wEAAwE;IACxE,0EAA0E;IAC1E,sEAAsE;IACtE,4DAA4D;IAC5D,MAAM,WAAW,GAAG,GAAW,EAAE,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAC/D,MAAM,WAAW,GAAG,CAAC,GAAW,EAAY,EAAE;QAC5C,qEAAqE;QACrE,iEAAiE;QACjE,4CAA4C;QAC5C,MAAM,WAAW,GACf,OAAO,CAAC,WAAW;YACnB,2BAA2B,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,qBAAqB,IAAI,wBAAwB,CAAC,CAAC;iBACjG,WAAW;YACd,EAAE,CAAC;QACL,OAAO,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,EAAE,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC;IAC7G,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,QAAQ,CAAC,KAAK;YAClB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,qBAAqB,EAAE,EAAE,EAAE,CAAC;YACpF,CAAC;YACD,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;YAC1B,MAAM,OAAO,GAAG,IAAI,aAAa,CAAC;gBAChC,OAAO,EAAE,WAAW,CAAC,GAAG,CAAC;gBACzB,QAAQ;gBACR,aAAa;gBACb,GAAG;gBACH,GAAG;gBACH,QAAQ,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE;aACzE,CAAC,CAAC;YACH,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;gBACtB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;gBACnD,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC;YAC9B,CAAC;oBAAS,CAAC;gBACT,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;YAC1B,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,OAAyB;IAC5C,MAAM,SAAS,GAAG,iBAAiB,CAAC,OAAO,CAAC,SAAwC,CAAC,CAAC;IACtF,MAAM,UAAU,GAAG;QACjB,GAAG,OAAO,CAAC,UAAU;QACrB,GAAG,SAAS,CAAC,UAAU;KACxB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACd,MAAM,SAAS,GAAG,CAAC,CAAC,UAAU,CAA+C,CAAC;QAC9E,MAAM,SAAS,GAAG,CAAC,CAAC,UAAU,CAA+C,CAAC;QAC9E,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACxC,IAAI,KAAK,KAAK,KAAK;YAAE,OAAO,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,KAAK,KAAK,KAAK;YAAE,OAAO,KAAK,GAAG,KAAK,CAAC;QAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACtC,IAAI,KAAK,KAAK,KAAK;YAAE,OAAO,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1C,IAAI,OAAO,KAAK,OAAO;YAAE,OAAO,CAAC,CAAC;QAClC,OAAO,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IACH,OAAO;QACL,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,UAAU;QACV,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,qBAAqB,EAAE,SAAS,CAAC,qBAAqB;QACtD,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtF,CAAC;AACJ,CAAC"}

package/dist/facts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"facts.d.ts","sourceRoot":"","sources":["../src/facts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAGL,KAAK,gBAAgB,EACrB,KAAK,YAAY,EAClB,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAE7D,qEAAqE;AACrE,KAAK,QAAQ,GAAG,YAAY,CAAC;AAE7B,4EAA4E;AAC5E,MAAM,WAAW,gBAAgB;IAC/B,aAAa,EAAE,CAAC,CAAC;IACjB,IAAI,EAAE,eAAe,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,QAAQ,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,uBAAuB;IACtC,4EAA4E;IAC5E,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC1B,gEAAgE;IAChE,SAAS,EAAE,gBAAgB,EAAE,CAAC;IAC9B,0EAA0E;IAC1E,UAAU,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,QAAQ,CAAA;KAAE,CAAC,CAAC;IACxE,kEAAkE;IAClE,qBAAqB,EAAE,oBAAoB,EAAE,CAAC;CAC/C;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,SAAS,gBAAgB,EAAE,GACrC,uBAAuB,CA0EzB"}
+{"version":3,"file":"facts.d.ts","sourceRoot":"","sources":["../src/facts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAGL,KAAK,gBAAgB,EACrB,KAAK,YAAY,EAClB,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAE7D,qEAAqE;AACrE,KAAK,QAAQ,GAAG,YAAY,CAAC;AAE7B,4EAA4E;AAC5E,MAAM,WAAW,gBAAgB;IAC/B,aAAa,EAAE,CAAC,CAAC;IACjB,IAAI,EAAE,eAAe,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,QAAQ,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,uBAAuB;IACtC,4EAA4E;IAC5E,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC1B,gEAAgE;IAChE,SAAS,EAAE,gBAAgB,EAAE,CAAC;IAC9B,0EAA0E;IAC1E,UAAU,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,QAAQ,CAAA;KAAE,CAAC,CAAC;IACxE,kEAAkE;IAClE,qBAAqB,EAAE,oBAAoB,EAAE,CAAC;CAC/C;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,SAAS,gBAAgB,EAAE,GACrC,uBAAuB,CAqFzB"}

package/dist/facts.js

@@ -81,6 +81,16 @@ export function canonicalizeFacts(resources) {
         if (typeof responseModel === 'string' && responseModel.length > 0) {
             fact.responseSchemaSymbols = [responseModel];
         }
+        // Wire names the response model answers to (plan 2026-09-25 Phase 4b
+        // item 5). The python scanner emits them only for a provably
+        // concrete model, so anything else arrives absent here too and the
+        // shared fact carries no field list to compare frontend reads against.
+        const responseModelFields = attributes['responseModelFields'];
+        if (Array.isArray(responseModelFields) && responseModelFields.length > 0) {
+            const names = responseModelFields.filter((name) => typeof name === 'string' && name.length > 0);
+            if (names.length === responseModelFields.length)
+                fact.responseModelFields = names;
+        }
         const requestSchemas = attributes['requestSchemaSymbols'];
         if (Array.isArray(requestSchemas)) {
             const names = requestSchemas.filter((name) => typeof name === 'string' && name.length > 0);

package/dist/facts.js.map

@@ -1 +1 @@
-{"version":3,"file":"facts.js","sourceRoot":"","sources":["../src/facts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EACL,iBAAiB,EACjB,iBAAiB,GAGlB,MAAM,2BAA2B,CAAC;AA4BnC;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,SAAsC;IAEtC,MAAM,KAAK,GAAuB,EAAE,CAAC;IACrC,MAAM,aAAa,GAAuB,EAAE,CAAC;IAC7C,MAAM,UAAU,GAA0C,EAAE,CAAC;IAC7D,qEAAqE;IACrE,0DAA0D;IAC1D,MAAM,OAAO,GAA2B,EAAE,CAAC;IAE3C,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,QAAQ,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YACtC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC7B,SAAS;QACX,CAAC;QACD,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC;QACvC,MAAM,aAAa,GAAG,UAAU,CAAC,eAAe,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YACpE,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,iBAAiB;gBACvB,MAAM,EAAE,kBAAkB,QAAQ,CAAC,EAAE,sCAAsC;gBAC3E,QAAQ,EAAE,QAAQ,CAAC,QAAQ;aAC5B,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,MAAM,SAAS,GAAG,iBAAiB,CAAC,aAAa,CAAC,CAAC;QACnD,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAClB,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,iBAAiB;gBACvB,MAAM,EAAE,UAAU,aAAa,QAAQ,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,EAAE;gBAC7E,QAAQ,EAAE,QAAQ,CAAC,QAAQ;aAC5B,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAqB;YAC7B,aAAa,EAAE,CAAC;YAChB,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,MAAoC;YAC5C,cAAc,EAAE,SAAS,CAAC,SAAS;YACnC,OAAO,EAAE,aAAa;YACtB,SAAS,EAAE,OAAO,UAAU,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS;YAC5F,aAAa,EACX,OAAO,UAAU,CAAC,eAAe,CAAC,KAAK,QAAQ;gBAC7C,CAAC,CAAE,UAAU,CAAC,eAAe,CAAY;gBACzC,CAAC,CAAC,SAAS;YACf,MAAM,EAAE,QAAQ,CAAC,QAAQ;SAC1B,CAAC;QACF,MAAM,aAAa,GAAG,UAAU,CAAC,eAAe,CAAC,CAAC;QAClD,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClE,IAAI,CAAC,qBAAqB,GAAG,CAAC,aAAa,CAAC,CAAC;QAC/C,CAAC;QACD,MAAM,cAAc,GAAG,UAAU,CAAC,sBAAsB,CAAC,CAAC;QAC1D,IAAI,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CACjC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CACtE,CAAC;YACF,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,IAAI,CAAC,oBAAoB,GAAG,KAAK,CAAC;QAC1D,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,aAAa,CAAC,IAAI,CAAC;YACjB,GAAG,QAAQ;YACX,UAAU,EAAE,EAAE,GAAG,UAAU,EAAE,cAAc,EAAE,SAAS,CAAC,SAAS,EAAE;SACnE,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACtD,UAAU,CAAC,IAAI,CACb,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAC7C,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC;QAC/C,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;QAC3B,WAAW,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAClC,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,qBAAqB,EAAE,OAAO,EAAE,CAAC;AACzF,CAAC;AAED,SAAS,WAAW,CAAC,CAAS,EAAE,CAAS;IACvC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IACtB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACxB,CAAC"}
+{"version":3,"file":"facts.js","sourceRoot":"","sources":["../src/facts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EACL,iBAAiB,EACjB,iBAAiB,GAGlB,MAAM,2BAA2B,CAAC;AA4BnC;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,SAAsC;IAEtC,MAAM,KAAK,GAAuB,EAAE,CAAC;IACrC,MAAM,aAAa,GAAuB,EAAE,CAAC;IAC7C,MAAM,UAAU,GAA0C,EAAE,CAAC;IAC7D,qEAAqE;IACrE,0DAA0D;IAC1D,MAAM,OAAO,GAA2B,EAAE,CAAC;IAE3C,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,QAAQ,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YACtC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC7B,SAAS;QACX,CAAC;QACD,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC;QACvC,MAAM,aAAa,GAAG,UAAU,CAAC,eAAe,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YACpE,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,iBAAiB;gBACvB,MAAM,EAAE,kBAAkB,QAAQ,CAAC,EAAE,sCAAsC;gBAC3E,QAAQ,EAAE,QAAQ,CAAC,QAAQ;aAC5B,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,MAAM,SAAS,GAAG,iBAAiB,CAAC,aAAa,CAAC,CAAC;QACnD,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAClB,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,iBAAiB;gBACvB,MAAM,EAAE,UAAU,aAAa,QAAQ,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,EAAE;gBAC7E,QAAQ,EAAE,QAAQ,CAAC,QAAQ;aAC5B,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAqB;YAC7B,aAAa,EAAE,CAAC;YAChB,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,MAAoC;YAC5C,cAAc,EAAE,SAAS,CAAC,SAAS;YACnC,OAAO,EAAE,aAAa;YACtB,SAAS,EAAE,OAAO,UAAU,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS;YAC5F,aAAa,EACX,OAAO,UAAU,CAAC,eAAe,CAAC,KAAK,QAAQ;gBAC7C,CAAC,CAAE,UAAU,CAAC,eAAe,CAAY;gBACzC,CAAC,CAAC,SAAS;YACf,MAAM,EAAE,QAAQ,CAAC,QAAQ;SAC1B,CAAC;QACF,MAAM,aAAa,GAAG,UAAU,CAAC,eAAe,CAAC,CAAC;QAClD,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClE,IAAI,CAAC,qBAAqB,GAAG,CAAC,aAAa,CAAC,CAAC;QAC/C,CAAC;QACD,qEAAqE;QACrE,6DAA6D;QAC7D,mEAAmE;QACnE,uEAAuE;QACvE,MAAM,mBAAmB,GAAG,UAAU,CAAC,qBAAqB,CAAC,CAAC;QAC9D,IAAI,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzE,MAAM,KAAK,GAAG,mBAAmB,CAAC,MAAM,CACtC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CACtE,CAAC;YACF,IAAI,KAAK,CAAC,MAAM,KAAK,mBAAmB,CAAC,MAAM;gBAAE,IAAI,CAAC,mBAAmB,GAAG,KAAK,CAAC;QACpF,CAAC;QACD,MAAM,cAAc,GAAG,UAAU,CAAC,sBAAsB,CAAC,CAAC;QAC1D,IAAI,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CACjC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CACtE,CAAC;YACF,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,IAAI,CAAC,oBAAoB,GAAG,KAAK,CAAC;QAC1D,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,aAAa,CAAC,IAAI,CAAC;YACjB,GAAG,QAAQ;YACX,UAAU,EAAE,EAAE,GAAG,UAAU,EAAE,cAAc,EAAE,SAAS,CAAC,SAAS,EAAE;SACnE,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACtD,UAAU,CAAC,IAAI,CACb,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAC7C,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC;QAC/C,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;QAC3B,WAAW,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAClC,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,qBAAqB,EAAE,OAAO,EAAE,CAAC;AACzF,CAAC;AAED,SAAS,WAAW,CAAC,CAAS,EAAE,CAAS;IACvC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IACtB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACxB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gate-forge/pack-fastapi",
-  "version": "0.7.1",
+  "version": "0.9.0",
   "license": "Apache-2.0",
   "description": "FastAPI server-route detector: Python AST scanner served over GPP/3 (pack-sqlalchemy pattern), emitting http.contract evidence facts with canonical effective paths plus exposure/lifecycle signals (ADR 0004 D1, plan phase 2).",
   "type": "module",
@@ -19,7 +19,10 @@
   "files": [
     "README.md",
     "dist",
-    "python"
+    "python",
+    "!**/__pycache__",
+    "!**/*.pyc",
+    "!**/*.pyo"
   ],
   "scripts": {
     "build": "tsc -p tsconfig.build.json",
@@ -27,9 +30,9 @@
     "test": "vitest run"
   },
   "dependencies": {
-    "@gate-forge/core": "^0.7.1",
-    "@gate-forge/http-contract": "^0.7.1",
-    "@gate-forge/plugin-protocol": "^0.7.1",
+    "@gate-forge/core": "^0.9.0",
+    "@gate-forge/http-contract": "^0.9.0",
+    "@gate-forge/plugin-protocol": "^0.9.0",
     "zod": "^4.1.5"
   },
   "publishConfig": {

package/python/gateforge_fastapi_detector/scan.py

@@ -19,9 +19,26 @@ Detector vocabulary (frozen with the pack):
 - One fact per (effective mounted path, concrete method): an
   ``api_route(methods=[...])`` yields one fact per listed method, and a
   router mounted twice yields one fact per mount (plan phase 2.3).
-- Standalone routers (never the target of a resolvable ``include_router``)
-  emit their routes at their own prefix with ``mountProvenance``
-  ``standalone`` — matching the legacy wiring scanner's default mount.
+  ``Router creation that the AST pass cannot model`` (``build_router()``,
+  a subscript, an attribute, any expression that is not a plain
+  ``APIRouter(...)`` call) is a typed ``FASTAPI_PREFIX_UNRESOLVED``
+  outcome naming the variable and its file — NEVER a silently
+  prefix-less router: a route whose effective path cannot be proven is
+  never reported as served.
+- Literal prefixes: a prefix expression that is a module-level string
+  constant (``PREFIX = "/api/v1"``) is folded to its literal, for both
+  ``APIRouter(prefix=...)`` and ``include_router(prefix=...)``, so the
+  mount prefix reaches the effective path. Anything else computed stays
+  typed-unresolved.
+- Annotated router definitions (``router: APIRouter = APIRouter(...)``)
+  are router definitions exactly like ``router = APIRouter(...)``,
+  prefix included.
+- Unmounted routers: when the whole mount graph is provable (no
+  ``FASTAPI_PREFIX_UNRESOLVED`` anywhere in the scan), a router that no
+  include edge targets is dead code in the scanned set: its routes keep
+  their standalone emission, and one ``FASTAPI_ROUTER_UNMOUNTED`` entry
+  names the router, its file, and every declared route so the reader can
+  see that no scanned app serves those paths.
 - Registry functions (the ``def register_all_routers(app): ...
   app.include_router(r, prefix=...)`` pattern): a function whose body
   calls ``include_router`` on one of ITS OWN parameters collects those
@@ -65,10 +82,14 @@ Detector vocabulary (frozen with the pack):
   imports are unaffected. Without import roots every behavior is exactly
   as before (closed-world: back-compat).
 - ``unresolved`` entries: ``FASTAPI_PREFIX_UNRESOLVED`` for computed
-  router/include prefixes, unresolvable or ambiguous include
-  targets/imports/aliases, unresolvable registry-function call-site
-  arguments, include cycles, and registry chains beyond the helper-depth
-  bound; ``HTTP_PATH_DYNAMIC`` for non-literal route paths;
+  router/include prefixes, router creations the AST pass cannot model,
+  unresolvable or ambiguous include targets/imports/aliases,
+  unresolvable registry-function call-site arguments, include cycles,
+  and registry chains beyond the helper-depth bound;
+  ``FASTAPI_ROUTER_UNMOUNTED`` for a router no include edge targets —
+  reported only when the scanned set shows an application and no
+  unresolvable include, since "unmounted" is otherwise unprovable;
+  ``HTTP_PATH_DYNAMIC`` for non-literal route paths;
   ``HTTP_METHOD_DYNAMIC`` for decorator verbs outside the supported set.
   All are source-located and blocking — nothing disappears silently.
 - No app import, no route execution, no environment or network access
@@ -89,6 +110,10 @@ FRAMEWORK = "fastapi"
 
 # Typed outcome codes (mirrored in @gate-forge/http-contract codes.ts).
 FASTAPI_PREFIX_UNRESOLVED = "FASTAPI_PREFIX_UNRESOLVED"
+# A router no include edge targets, reported only when the mount graph
+# itself is provable: the paths the standalone fallback emits are served
+# by no scanned app, and the reader must be told which file declares them.
+FASTAPI_ROUTER_UNMOUNTED = "FASTAPI_ROUTER_UNMOUNTED"
 
 _DECORATOR_METHODS = {
     "get": "GET",
@@ -128,6 +153,11 @@ class RouteDef:
     handler: str                 # function name
     is_async: bool
     response_model: str | None
+    # The model FastAPI actually answers with: the decorator's explicit
+    # `response_model=` when present, else the handler's return annotation
+    # (FastAPI's own default). Additive: `response_model` above keeps its
+    # exact previous meaning and emission.
+    effective_response_model: str | None
     request_schemas: list[str]
     tags: list[str]
     operation_id: str | None
@@ -145,6 +175,13 @@ class RouterDef:
     # Set when the variable is an import alias bound to a router defined in
     # another scanned module: ``(raw_module, level, imported_name)``.
     alias_of: tuple[str | None, int, str] | None = None
+    # True when the router OBJECT comes from an expression this AST pass
+    # cannot model (``build_router()``, a subscript, an attribute, any
+    # expression that is not a plain ``APIRouter(...)`` call). Its own
+    # prefix and therefore every route's effective path are unprovable:
+    # the walk reports a typed outcome instead of emitting a fabricated
+    # prefix-less path.
+    creation_computed: bool = False
 
 
 @dataclass
@@ -222,6 +259,32 @@ class ImportRef:
     level: int                   # relative-import depth (0: absolute)
 
 
+@dataclass
+class ModelDef:
+    """One class definition whose response fields are statically provable.
+
+    Plan 2026-09-25 Phase 4b item 5: a dropped response-model field is
+    invisible from the frontend (every test mocks it), so the pack proves
+    the wire names a model answers to. ``proven`` is the fail-closed
+    switch: a model that configures alias generation (pydantic v1
+    ``class Config`` / v2 ``model_config``) has wire names this AST pass
+    cannot compute, so it is reported as NOT proven and contributes no
+    field list at all — silence, never a wrong answer.
+    """
+
+    name: str
+    fields: list[str] = field(default_factory=list)      # declared names, written order
+    aliases: dict[str, str] = field(default_factory=dict)  # field name -> declared alias
+    bases: list[str] = field(default_factory=list)      # base class names
+    proven: bool = True
+
+
+# Base classes that carry no response fields of their own. Any OTHER base
+# must resolve inside the scanned set: an unresolvable base means inherited
+# fields are unknown, so the model is not proven.
+_FIELDLESS_BASES = frozenset({"BaseModel", "BaseModelRoot", "RootModel", "object"})
+
+
 @dataclass
 class FileIndex:
     """Everything one parsed file contributes to the mount graph."""
@@ -234,6 +297,7 @@ class FileIndex:
     functions: dict[str, FunctionIncludes] = field(default_factory=dict)
     helper_calls: list[HelperCall] = field(default_factory=list)
     unsupported: list[tuple[ast.AST, list[str]]] = field(default_factory=list)
+    models: dict[str, ModelDef] = field(default_factory=dict)
 
 
 def loc(relpath: str, node: ast.AST) -> dict:
@@ -248,6 +312,41 @@ def _static_string(node: ast.AST | None) -> str | None:
     return None
 
 
+def _literal_prefix(node: ast.AST | None, constants: dict[str, str]) -> str | None:
+    """A mount prefix that provably is one literal string, else None.
+
+    Beyond a literal (``prefix="/api/v1"``) this folds a module-level
+    string CONSTANT (``PREFIX = "/api/v1"; APIRouter(prefix=PREFIX)``):
+    that value is fixed by the source, so the effective path is provable
+    and the route must not disappear behind a computed-prefix outcome.
+    Anything else (an f-string, an attribute, a call, a concatenation)
+    stays computed and is reported as typed-unresolved.
+    """
+    literal = _static_string(node)
+    if literal is not None:
+        return literal
+    if isinstance(node, ast.Name):
+        return constants.get(node.id)
+    return None
+
+
+def _module_string_constants(tree: ast.Module) -> dict[str, str]:
+    """Module-level string constants, for literal prefix folding."""
+    constants: dict[str, str] = {}
+    for statement in tree.body:
+        if isinstance(statement, ast.Assign):
+            literal = _static_string(statement.value)
+            if literal is not None:
+                for target in statement.targets:
+                    if isinstance(target, ast.Name):
+                        constants[target.id] = literal
+        elif isinstance(statement, ast.AnnAssign):
+            literal = _static_string(statement.value)
+            if literal is not None and isinstance(statement.target, ast.Name):
+                constants[statement.target.id] = literal
+    return constants
+
+
 def _dotted_name(node: ast.AST | None) -> str | None:
     """A dotted name for Name/Attribute chains, or None."""
     if isinstance(node, ast.Name):
@@ -258,6 +357,42 @@ def _dotted_name(node: ast.AST | None) -> str | None:
     return None
 
 
+# Containers whose single element type IS the response model
+# (``-> list[InvoiceOut]``); anything else (``dict[str, X]``, a union of
+# two models, a computed expression) is an unknown shape.
+_MODEL_CONTAINERS = frozenset({
+    "list", "List", "Sequence", "Iterable", "set", "Set", "frozenset",
+    "Optional", "Union", "tuple", "Tuple",
+})
+
+
+def _model_name(node: ast.AST | None) -> str | None:
+    """The model class a response annotation or ``response_model=`` names.
+
+    Unwraps the containers FastAPI itself unwraps (``list[X]``,
+    ``Optional[X]``, ``X | None``) and returns the dotted class name. Any
+    other shape — a dict, a union of different models, a computed
+    expression — returns None: an unknown shape has no field list, and the
+    advisory must never guess one.
+    """
+    if node is None:
+        return None
+    if isinstance(node, (ast.Name, ast.Attribute)):
+        return _dotted_name(node)
+    if isinstance(node, ast.Subscript):
+        base = _dotted_name(node.value)
+        if base is None or base.split(".")[-1] not in _MODEL_CONTAINERS:
+            return None
+        elements = _elements(node.slice) or [node.slice]
+        names = {_model_name(element) for element in elements}
+        names.discard(None)
+        return names.pop() if len(names) == 1 else None
+    if isinstance(node, ast.BinOp) and isinstance(node.op, ast.BitOr):
+        left, right = _model_name(node.left), _model_name(node.right)
+        return left if left is not None and left == right else None
+    return None
+
+
 def _keyword(call: ast.Call, name: str) -> ast.AST | None:
     for keyword in call.keywords:
         if keyword.arg == name:
@@ -271,6 +406,61 @@ def _elements(node: ast.AST | None) -> list[ast.AST] | None:
     return None
 
 
+def _declared_alias(value: ast.AST | None) -> str | None:
+    """The static alias a ``Field(alias=...)`` declaration carries."""
+    if not isinstance(value, ast.Call):
+        return None
+    for keyword in value.keywords:
+        if keyword.arg in {"alias", "validation_alias", "serialization_alias"}:
+            return _static_string(keyword.value)
+    return None
+
+
+def _is_class_var(annotation: ast.AST | None) -> bool:
+    """``ClassVar[...]`` annotations are not response fields."""
+    if not isinstance(annotation, ast.Subscript):
+        return False
+    base = _dotted_name(annotation.value)
+    return base is not None and base.split(".")[-1] == "ClassVar"
+
+
+def _model_def(node: ast.ClassDef) -> ModelDef:
+    """The statically provable field list of one class definition.
+
+    Alias generation (``model_config = ConfigDict(alias_generator=...)``
+    or a pydantic v1 ``class Config``) makes the wire names
+    uncomputable here, so the model is reported as NOT proven rather than
+    as a partial list. ``ClassVar`` members and private names are not
+    pydantic fields and are skipped.
+    """
+    model = ModelDef(name=node.name)
+    for base in node.bases:
+        name = _dotted_name(base)
+        model.bases.append(name if name is not None else "?")
+    for statement in node.body:
+        if isinstance(statement, ast.AnnAssign) and isinstance(statement.target, ast.Name):
+            name = statement.target.id
+            if name.startswith("_") or _is_class_var(statement.annotation):
+                continue
+            if name == "model_config":
+                model.proven = False
+                continue
+            model.fields.append(name)
+            alias = _declared_alias(statement.value)
+            if alias is not None:
+                model.aliases[name] = alias
+        elif isinstance(statement, ast.Assign):
+            for target in statement.targets:
+                if isinstance(target, ast.Name) and not target.id.startswith("_"):
+                    if target.id == "model_config":
+                        model.proven = False
+                    else:
+                        model.fields.append(target.id)
+        elif isinstance(statement, ast.ClassDef) and statement.name in {"Config", "model_config"}:
+            model.proven = False
+    return model
+
+
 class _ModuleVisitor(ast.NodeVisitor):
     """Collects routers, apps, imports, include edges, and route decorators.
 
@@ -279,13 +469,14 @@ class _ModuleVisitor(ast.NodeVisitor):
     its ``include_router`` calls still count for the outer parameter.
     """
 
-    def __init__(self, relpath: str) -> None:
+    def __init__(self, relpath: str, constants: dict[str, str] | None = None) -> None:
         self.index = FileIndex(relpath=relpath)
         # Current top-level function (registry-function context), or None
         # at module level.
         self._function: FunctionIncludes | None = None
-
-    # -- imports ------------------------------------------------------------
+        # Module-level string constants, for literal prefix folding
+        # (`PREFIX = "/api/v1"`; `APIRouter(prefix=PREFIX)`).
+        self._constants: dict[str, str] = constants or {}
 
     def visit_Import(self, node: ast.Import) -> None:
         for alias in node.names:
@@ -302,23 +493,47 @@ class _ModuleVisitor(ast.NodeVisitor):
     # -- router / app instances ---------------------------------------------
 
     def visit_Assign(self, node: ast.Assign) -> None:
-        if isinstance(node.value, ast.Call) and isinstance(node.value.func, ast.Name):
-            kind = node.value.func.id
-            if kind in {"FastAPI", "APIRouter"}:
-                for target in node.targets:
-                    if not isinstance(target, ast.Name):
-                        continue
-                    if kind == "FastAPI":
-                        self.index.apps.add(target.id)
-                    else:
-                        prefix_node = _keyword(node.value, "prefix")
-                        prefix: str | None = (
-                            "" if prefix_node is None else _static_string(prefix_node)
-                        )
-                        self.index.routers[target.id] = RouterDef(
-                            var=target.id, prefix=prefix,
-                            prefix_node=prefix_node if prefix_node is not None else node.value,
-                        )
+        for target in node.targets:
+            if isinstance(target, ast.Name):
+                self._record_instance(target.id, node.value)
+        self.generic_visit(node)
+
+    def visit_AnnAssign(self, node: ast.AnnAssign) -> None:
+        # `router: APIRouter = APIRouter(prefix="/api/v1")` defines a
+        # router exactly like the unannotated form; before this, the
+        # annotated shape produced a silently prefix-less route.
+        if node.value is not None and isinstance(node.target, ast.Name):
+            self._record_instance(node.target.id, node.value)
+        self.generic_visit(node)
+
+    def _record_instance(self, name: str, value: ast.AST) -> None:
+        """Indexes one ``FastAPI()`` / ``APIRouter()`` binding."""
+        if not (isinstance(value, ast.Call) and isinstance(value.func, ast.Name)):
+            return
+        kind = value.func.id
+        if kind == "FastAPI":
+            self.index.apps.add(name)
+            # Routes declared straight on the app (`@app.get("/health")`)
+            # belong to it with no router prefix of their own.
+            self.index.routers.setdefault(
+                name, RouterDef(var=name, prefix="", prefix_node=value),
+            )
+            return
+        if kind != "APIRouter":
+            return
+        prefix_node = _keyword(value, "prefix")
+        prefix: str | None = (
+            "" if prefix_node is None else _literal_prefix(prefix_node, self._constants)
+        )
+        self.index.routers[name] = RouterDef(
+            var=name, prefix=prefix,
+            prefix_node=prefix_node if prefix_node is not None else value,
+        )
+
+    # -- response models -----------------------------------------------------
+
+    def visit_ClassDef(self, node: ast.ClassDef) -> None:
+        self.index.models[node.name] = _model_def(node)
         self.generic_visit(node)
 
     # -- functions: route decorators -----------------------------------------
@@ -394,7 +609,8 @@ class _ModuleVisitor(ast.NodeVisitor):
             if owner_ref is not None:
                 owner_ref.routes.append(RouteDef(
                     methods=[], path=None, node=node, file=self.index.relpath, handler=fn.name,
-                    is_async=is_async, response_model=None, request_schemas=[],
+                    is_async=is_async, response_model=None,
+                    effective_response_model=None, request_schemas=[],
                     tags=[], operation_id=None,
                 ))
             return
@@ -414,6 +630,9 @@ class _ModuleVisitor(ast.NodeVisitor):
             handler=fn.name,
             is_async=is_async,
             response_model=_dotted_name(_keyword(node, "response_model")),
+            effective_response_model=(
+                _model_name(_keyword(node, "response_model")) or _model_name(fn.returns)
+            ),
             request_schemas=_request_schema_names(fn, path),
             tags=[
                 s for s in (
@@ -428,7 +647,19 @@ class _ModuleVisitor(ast.NodeVisitor):
             alias_of = None
             if ref is not None and ref.name is not None:
                 alias_of = (ref.module, ref.level, ref.name)
-            router = RouterDef(var=owner.id, prefix="", prefix_node=owner, alias_of=alias_of)
+            # No router definition and no import binding for this name: the
+            # router object comes from an expression this pass cannot model
+            # (`build_router()`, a subscript, a re-assignment). Its own
+            # prefix is therefore UNKNOWN — a synthetic `prefix=""` here
+            # would publish every one of its routes at a path no app serves,
+            # with no typed outcome at all.
+            router = RouterDef(
+                var=owner.id,
+                prefix="" if alias_of is not None else None,
+                prefix_node=owner,
+                alias_of=alias_of,
+                creation_computed=alias_of is None,
+            )
             self.index.routers[owner.id] = router
         router.routes.append(entry)
         out_of_set = [m for m in methods if m not in _DECORATOR_METHODS.values()]
@@ -467,7 +698,10 @@ class _ModuleVisitor(ast.NodeVisitor):
             target_var=target_var,
             target_alias=target_alias,
             target_attrs=target_attrs,
-            prefix="" if prefix_node is None else _static_string(prefix_node),
+            prefix=(
+                "" if prefix_node is None
+                else _literal_prefix(prefix_node, self._constants)
+            ),
             node=node,
             file=self.index.relpath,
         )
@@ -524,7 +758,7 @@ def _scan_file(relpath: str, root: Path) -> tuple[FileIndex | None, dict | None]
             "detail": f"{type(exc).__name__}: {msg}",
             "locations": [{"file": relpath, "line": max(line, 1), "col": 0}],
         }
-    visitor = _ModuleVisitor(relpath)
+    visitor = _ModuleVisitor(relpath, _module_string_constants(tree))
     visitor.visit(tree)
     return visitor.index, None
 
@@ -656,6 +890,94 @@ def _resolve_import(
     return ImportResolution(module=None)
 
 
+class _ModelIndex:
+    """Resolves a response-model symbol to the wire names it answers to.
+
+    Bounded like every other channel here: the defining class must be in
+    the scanned set, reachable as a same-file definition or through one
+    resolved import, and every base class must resolve too. Anything the
+    AST pass cannot compute (an alias generator, an unresolvable base, an
+    unknown shape) yields ``None`` — the caller then reports no fields at
+    all rather than a partial list.
+    """
+
+    def __init__(self, indexes: dict[str, FileIndex], import_roots: tuple[str, ...] = ()) -> None:
+        self.models: dict[str, dict[str, ModelDef]] = {
+            relpath: index.models for relpath, index in indexes.items()
+        }
+        self.indexes = indexes
+        self.import_roots = import_roots
+        self.scanned: frozenset[str] = frozenset(indexes)
+        self.module_map = {_module_of(rel): rel for rel in indexes}
+
+    def fields_for(self, relpath: str, model: str | None) -> list[str] | None:
+        """Every wire name one response model answers to, or None."""
+        if model is None or model == "":
+            return None
+        name = model
+        prefix = ""
+        if "." in model:
+            prefix, name = model.rsplit(".", 1)
+            if prefix not in self.module_map:
+                return None
+        located = self._locate(relpath, name)
+        if located is None:
+            return None
+        found = self._collect(relpath, name, set())
+        if found is None or not found:
+            return None
+        return found
+
+    def _locate(self, relpath: str, name: str) -> ModelDef | None:
+        """The class definition a name refers to, or None."""
+        own = self.models.get(relpath, {}).get(name)
+        if own is not None:
+            return own
+        ref = self.indexes.get(relpath)
+        if ref is None:
+            return None
+        imported = ref.imports.get(name)
+        if imported is None or imported.name is None:
+            return None
+        resolution = _resolve_import(
+            relpath,
+            (imported.module, imported.level, imported.name),
+            self.module_map,
+            self.import_roots,
+            self.scanned,
+        )
+        if resolution.module is None:
+            return None
+        target = self.module_map.get(resolution.module)
+        return None if target is None else self.models.get(target, {}).get(name)
+
+    def _collect(self, relpath: str, name: str, seen: set[tuple[str, str]]) -> list[str] | None:
+        """Field and alias names of one model plus its provable bases."""
+        key = (relpath, name)
+        if key in seen:
+            return None
+        seen.add(key)
+        located = self._locate(relpath, name)
+        if located is None or not located.proven:
+            return None
+        names: list[str] = []
+        for base in located.bases:
+            if base in _FIELDLESS_BASES:
+                continue
+            if base == "?":
+                return None
+            inherited = self._collect(relpath, base, seen)
+            if inherited is None:
+                return None
+            names.extend(inherited)
+        for field in located.fields:
+            alias = located.aliases.get(field)
+            for value in (alias, field) if alias is not None else (field,):
+                if value not in names:
+                    names.append(value)
+        return names
+
+
 class _Resolver:
     """Composes effective mounted paths over the cross-file mount graph."""
 
@@ -664,6 +986,7 @@ class _Resolver:
         self.import_roots = import_roots
         self.scanned: frozenset[str] = frozenset(indexes)
         self.module_map = {_module_of(rel): rel for rel in indexes}
+        self.models = _ModelIndex(indexes, import_roots)
         self.facts: list[dict] = []
         self.unresolved: list[dict] = []
 
@@ -671,6 +994,7 @@ class _Resolver:
         self._materialize_function_includes()
         self._merge_aliases()
         included = self._collect_included()
+        unmounted: list[tuple[str, str, RouterDef]] = []
         for relpath in sorted(self.indexes):
             index = self.indexes[relpath]
             for var in sorted(index.apps):
@@ -684,6 +1008,56 @@ class _Resolver:
                 if (relpath, name) in included:
                     continue
                 self._walk(relpath, name, "", (), "standalone", included)
+                if router.routes:
+                    unmounted.append((relpath, name, router))
+        self._report_unmounted_routers(
+            unmounted, apps_present=any(index.apps for index in self.indexes.values()),
+        )
+
+    def _report_unmounted_routers(
+        self,
+        unmounted: list[tuple[str, str, RouterDef]],
+        apps_present: bool,
+    ) -> None:
+        """Names routers no include edge mounts, when that is provable.
+
+        A router that no scanned include edge targets is served by no
+        scanned app: the standalone fallback still reports its routes (a
+        route's path is a claim, and its declared prefix is all this pass
+        knows), but the reader must see that nothing mounts them — the
+        routes appear at the router's OWN prefix, without whatever mount
+        prefix the sibling modules carry.
+
+        Reported ONLY when the scanned set actually shows the application
+        and its mount graph is otherwise fully proven. With no app
+        instance the mounting code may simply be outside the scan, and
+        with an unresolvable include this scan cannot say which routers
+        that include would have reached — in both cases "unmounted" would
+        be a claim about files nobody could see, or would bury the real
+        blocker (already reported) under unrelated entries.
+        """
+        if not apps_present:
+            return
+        if any(entry["code"] == FASTAPI_PREFIX_UNRESOLVED for entry in self.unresolved):
+            return
+        for relpath, name, router in unmounted:
+            routes = sorted(
+                f"{method} {router.prefix or ''}{route.path}"
+                for route in router.routes
+                if route.path is not None
+                for method in route.methods
+            )
+            self.unresolved.append({
+                "code": FASTAPI_ROUTER_UNMOUNTED,
+                "detail": (
+                    f"router '{name}' in {relpath} is never included by any app in the "
+                    f"scanned set; its {len(routes)} route(s) "
+                    f"({', '.join(routes)}) are reported at the router's own prefix, "
+                    "which no scanned app serves — mount the router, or delete it if it "
+                    "is dead code"
+                ),
+                "location": loc(relpath, router.prefix_node),
+            })
 
     def _materialize_function_includes(self) -> None:
         """Rewires registry-function includes onto real instances.
@@ -1159,10 +1533,17 @@ class _Resolver:
                 return
             if router.prefix is None:
                 self.unresolved.append({
-                    "code": "FASTAPI_PREFIX_UNRESOLVED",
+                    "code": FASTAPI_PREFIX_UNRESOLVED,
                     "detail": (
-                        f"router '{var}' in {relpath} declares a computed prefix; "
-                        "the effective path cannot be proven statically"
+                        (
+                            f"router '{var}' in {relpath} is created by an expression that "
+                            "cannot be modeled statically (its own prefix and routes are "
+                            "unknown), so its effective paths are not reported"
+                        )
+                        if router.creation_computed else (
+                            f"router '{var}' in {relpath} declares a computed prefix; "
+                            "the effective path cannot be proven statically"
+                        )
                     ),
                     "location": loc(relpath, router.prefix_node),
                 })
@@ -1257,33 +1638,56 @@ class _Resolver:
                 continue
             for method in route.methods:
                 self.facts.append(
-                    _fact(route.file, route, method, prefix + route.path, mount)
+                    _fact(route.file, route, method, prefix + route.path, mount, self.models)
                 )
 
 
-def _fact(relpath: str, route: RouteDef, method: str, effective_path: str, mount: str) -> dict:
+def _fact(
+    relpath: str,
+    route: RouteDef,
+    method: str,
+    effective_path: str,
+    mount: str,
+    models: _ModelIndex,
+) -> dict:
     handler_qname = f"{relpath[:-3].replace('/', '.')}:{route.handler}"
+    attributes = {
+        "role": "server-route",
+        "method": method,
+        "rawPath": route.path or "",
+        "normalizedPath": "",  # canonicalized by the TS wrapper (single impl)
+        "effectivePath": effective_path,
+        "framework": FRAMEWORK,
+        "handlerSymbol": handler_qname,
+        "isAsync": route.is_async,
+        "responseModel": route.response_model,
+        "requestSchemaSymbols": route.request_schemas,
+        "tags": route.tags,
+        "operationId": route.operation_id,
+        "mountProvenance": mount,
+    }
+    # Wire names the response model answers to (plan 2026-09-25 Phase 4b
+    # item 5). Absent whenever the model is not statically provable — an
+    # unresolvable symbol, an alias generator, an unprovable base, a
+    # non-model shape — so the frontend-read check has nothing to compare
+    # against and stays silent.
+    fields = models.fields_for(route.file, route.effective_response_model)
+    if fields is not None:
+        # FastAPI answers a FAILED request with ``{"detail": ...}``
+        # (HTTPException) or a ``detail`` list (request validation), and a
+        # frontend reads it to report the error. It is therefore a
+        # legitimate field of every route this pack reports, never
+        # evidence of a dropped success-model field.
+        if "detail" not in fields:
+            fields.append("detail")
+        attributes["responseModelFields"] = fields
     return {
         "schemaVersion": 1,
         "kind": CONTRACT_KIND,
         "source": relpath,
         "location": loc(relpath, route.node),
         "detectorVersion": VERSION,
-        "attributes": {
-            "role": "server-route",
-            "method": method,
-            "rawPath": route.path or "",
-            "normalizedPath": "",  # canonicalized by the TS wrapper (single impl)
-            "effectivePath": effective_path,
-            "framework": FRAMEWORK,
-            "handlerSymbol": handler_qname,
-            "isAsync": route.is_async,
-            "responseModel": route.response_model,
-            "requestSchemaSymbols": route.request_schemas,
-            "tags": route.tags,
-            "operationId": route.operation_id,
-            "mountProvenance": mount,
-        },
+        "attributes": attributes,
         "id": f"http.contract:{relpath}:{route.handler}:{method}:{effective_path}",
     }