@groma/scanner-csharp 0.1.2 → 0.1.4

package/README.md

@@ -1,65 +1,239 @@
 # C# scanner
 
-The optional `@groma/scanner-csharp` package uses a prebuilt Roslyn worker and the project's installed .NET SDK. Install the package in Groma, select the project, restore it with normal .NET tooling, then scan. Scanning never installs an SDK, builds the worker, or restores packages.
+The C# scanner installs Roslyn and a self-contained .NET runtime for the host
+platform. Install the scanner and scan source without a project SDK, NuGet restore, generated output
+or application build. `global.json` does not select the scanner's runtime.
 
-## Tooling and preparation
-
-The worker requires the .NET 10 runtime. Its Roslyn dependencies are 5.9.0 and MSBuild Locator is 1.11.2. The project separately requires the SDK and reference packs selected by its `global.json`. Both may be installed together: running the worker on .NET 10 does not select SDK 10 for the project.
-
-Use `dotnet` on PATH, or set `DOTNET_HOST_PATH` to the installed dotnet executable. The scanner uses the selected input directory for SDK lookup. [Microsoft's SDK selection documentation](https://learn.microsoft.com/en-us/dotnet/core/versions/selection) explains how `global.json` is found. An unavailable pinned SDK fails instead of using a different SDK.
-
-For a nested project, set `settings` on the existing `csharp` entry in the
-shared `scanners.json` inside `groma/` or `.groma/`. Preserve its installed source:
-
-```json
-{
-  "id": "csharp",
-  "source": "./tools/csharp-scanner-package",
-  "settings": { "input": "src/Library/Library.csproj" }
-}
+```sh
+groma scanner add @groma/scanner-csharp
+groma scan
 ```
 
-When `input` is omitted, the scanner selects a single root solution, or a
-single root project when no solution exists. Multiple candidates require an
-explicit `settings.input`. Paths are relative to the repository root. Run a
-new scan or restart the active viewer or watch session after editing settings.
-See the [shared configuration contract](../creating-a-plugin.md#scanner-settings).
-
-Run `dotnet restore Library.csproj` from that input directory, then run `groma scan` from the repository root. Restore uses the project's normal NuGet settings and credentials. On macOS, use a relative restore input from its directory so `/var` and `/private/var` aliases do not enter one restore graph as separate project paths.
-
-Install a prepared local package with `groma scanner add /path/to/csharp-scanner-package`. Release publication is separate from local qualification. The package also exports `checkCSharpReadiness(repositoryRoot, { input })`, used through the same input/tool checks as scanning. It returns the selected input and SDK version; successful readiness does not prove dependency restore or compilation. A missing worker means the package needs preparation; missing tooling or compilation errors must be fixed before scanning can replace architecture evidence.
-
-## Supported input and evidence
-
-The selected qualification example is FluentValidation 12.0.0, commit `5365d9294812c8a5c5a7f4d7447c9a65b79a025b`, selecting `src/FluentValidation/FluentValidation.csproj` with its original SDK selection. Minimal fixtures also exercise in-repository project references and the standard Web SDK header.
-
-Inputs are SDK-style `.csproj`, `.sln`, and `.slnx` files. When input is omitted, one root solution takes precedence over root projects. Multiple candidates require explicit selection. Standard .NET, Web and Worker SDK project headers are accepted, but this is not general framework qualification. Mixed-language graphs, legacy project formats, multiple target-framework contexts, and a file shared by multiple loaded project contexts are rejected.
-
-Each physical C# source inside the repository has one inventory record. Generated `bin` and `obj` sources are excluded. SDK and package source files outside the repository remain compiler context, including validation, but do not produce file or operation evidence. Project references must stay inside the repository. Roslyn resolves overloads, generic methods, extensions, partial implementations and direct calls. Virtual, interface and delegate dispatch retain uncertainty where the runtime provider is not established. Implicit calls, initializers, generated operations, receiver/delegate value flow, dependency injection and network protocols are not resolved.
-
-Solutions and projects are source roots, with each project linked to its solution
-when a solution is selected. File records identify their project root. A directly
-selected project and its loaded project references are top-level source roots.
-Root membership and operations are temporary evidence. They are not C4 components or proof of business collaborations. Core owns curated source membership and relationship selection; ordinary Markdown readers retain readable descriptions and links under the existing OKF application profile. This plugin introduces no architecture metadata or map level.
-
-`settings` also accepts `configuration` (default `Debug`), `maxProjects` (128), `maxFiles` (20000), and `timeoutSeconds` (120). Exceeded limits fail the scan; they never publish truncated evidence. A failed scanner preserves its saved evidence; other scanners can still update the map.
-
-## Contributor package build
-
-With .NET 10 SDK installed, restore `plugins/scanners/csharp/dotnet/Groma.CSharpScanner.csproj`, then run:
+Maintainers build the package with the .NET 10 SDK and Bun:
 
 ```sh
 bun scripts/package-csharp-scanner.ts
 ```
 
-The build bundles the adapter and publishes a framework-dependent worker into the package. It has no installation scripts and does not include a private SDK. Run the Roslyn tests with `dotnet test plugins/scanners/csharp/dotnet/test/Groma.CSharpScanner.Tests.csproj`.
-
-## Nested projects
-
-From the repository root, the scanner finds tracked and unignored `.sln`, `.slnx`
-and `.csproj` files. Solutions are loaded first. Project roots returned by Roslyn
-prevent a solution member or project reference from being scanned again as a
-standalone input. Independent projects are scanned as additional inputs. Each
-input selects its own installed SDK; all evidence paths stay relative to the
-repository. `settings.input` still selects one explicit solution or project.
-Any selected input failure fails the C# observation. Other scanners can still update the map.
+The public `@groma/scanner-csharp` package contains the adapter. Its exact
+optional dependencies select `@groma/scanner-csharp-<platform>-<architecture>`
+for the current host. Each runtime package contains the complete executable
+worker, .NET runtime and upstream notices. Consumers need optional dependencies
+enabled, but do not need `dotnet` or an installation script. Keeping host
+runtimes separate avoids npm's upload-size rejection of the combined package.
+
+The maintainer build installs its host runtime under the scanner's local
+`node_modules` and copies it into the staged package. Both source development
+and local package scans use normal module resolution. The release assembler
+emits one runtime package per built host and a small adapter referencing all
+of them; runtimes publish before the adapter. This changes package delivery
+only: scanner evidence, OKF records and C4 boundaries are unchanged.
+
+## Source inputs
+
+The scanner discovers tracked and unignored SDK-style `.csproj`, `.sln` and
+`.slnx` files. Solutions are selected before their projects; local project
+references are loaded once. Set `settings.input` on the existing C# scanner
+entry to select one project or solution relative to the repository root.
+
+An in-memory Roslyn workspace reads project XML and authored C# files.
+Unconditional language options, compile includes/removes, implicit usings and
+local project references supply context. The scanner's runtime supplies base
+.NET declarations. It does not run MSBuild, evaluate imported or conditional
+build settings, restore packages, or execute source generators. Standard .NET,
+Web and Worker SDK headers are accepted; this is not general framework analysis.
+
+Generated `bin` and `obj` files are excluded. A physical source file cannot
+belong to several selected project contexts. Project references must stay
+inside the repository. Mixed-language graphs and legacy projects are unsupported.
+Invalid syntax fails a scan. Missing external types produce diagnostics while
+local declarations and supported operations remain available.
+
+## Evidence
+
+Partial class declarations in separate authored files are proposed as one source
+unit when Roslyn identifies the same class in the same project. Each file must
+contain only that type, and every declaration must qualify. Same-name classes
+in other namespaces or projects are independent. Files containing additional
+types remain separate source evidence. This does not associate Razor, XAML, or
+generated source.
+
+Core creates one component with all member Code references, attaches newly
+discovered unowned partial files, and retains curated ownership on repeat scans.
+Conflicting owners produce review diagnostics.
+The existing C# source watcher includes new partial files. No project restore,
+build, or source-generator execution is needed.
+
+Roslyn resolves local overloads, generic methods, extensions, partial
+implementations and direct calls. Calls with type errors, virtual dispatch,
+interfaces and delegates retain uncertainty. Implicit calls, initializers,
+generated operations, receiver/delegate value flow, dependency injection and
+network protocols are not resolved.
+
+Solutions and projects supply source roots and file membership. They are not
+C4 components or proof of business collaborations. Core owns curated membership
+and relationship selection; ordinary Markdown readers see the existing OKF
+records and Code links. The scanner adds no map level or architecture metadata.
+
+Settings also accept `configuration` (default `Debug`), `maxProjects` (128),
+`maxFiles` (20000) and `timeoutSeconds` (120). Configuration selects the source
+DEBUG/TRACE symbols; it does not execute a build configuration. Limits fail
+rather than publish truncated evidence. Failed scanners retain their saved
+evidence while other scanners can update the map.
+
+Run `dotnet test plugins/scanners/csharp/dotnet/test/Groma.CSharpScanner.Tests.csproj`
+for Roslyn tests. Fixtures are scanned without restore. The packaged test
+removes language tools from PATH; see
+[fresh-checkout validation](../fresh-checkout-validation.md).
+
+## Source outline
+
+Components list the declarations of their C# files under the
+[shared outline contract](../creating-a-plugin.md#source-outline). The worker
+parses each requested file with Roslyn syntax alone, without loading its
+project, restoring packages or building.
+
+- Classes, structs, records, interfaces, enums and delegates declared directly
+  in the file or inside its namespaces are types. Enums and delegates have no
+  members.
+- A type's members are the methods, interface method signatures, constructors,
+  finalizers and operators declared in its body, each overload separately.
+  Constructors are named after the type and finalizers `~Type`; operators are
+  named like `operator +` or `implicit operator int`.
+
+Nested types, record and class primary constructors, fields, properties,
+indexers, events, accessors and top-level statements are not listed. Each file
+of a partial type lists the type with the members that file declares. A
+declaration's line is its name's line; an operator's line is its `operator`
+keyword's line. A member is an entry only when a Code link names it as
+`Type.Member`.
+
+The outline parses without preprocessor symbols, while a scan uses the
+project's. Code inside `#if DEBUG` is therefore skipped, and `#else` branches
+are listed.
+
+Visibility follows the contract's C# row: `protected internal` and
+`private protected` are `protected`, and a `file` type is `private`. Without an
+access modifier, top-level types are `internal`, interface members `public`
+and other members `private`. A partial declaration without a modifier reports
+that default, even when another part declares its access.
+
+## Compared operations
+
+`groma lint` and scan findings compare C# operations under the
+[shared rule](../../architecture-findings.md#compared-operations). The scanner
+attaches a source range and body tokens to every implemented:
+
+- method, constructor, finalizer and operator;
+- property, indexer and event accessor, including an expression-bodied getter;
+- local function, including one declared among top-level statements.
+
+Other lambdas and anonymous methods, such as those passed as arguments, are
+anonymous callbacks. Top-level statements and field and property initializers
+are not compared.
+
+These named operations are not compared:
+
+- lambdas and anonymous methods assigned to a variable, field or property, or
+  written in an object initializer.
+
+Parameter and local names become slots. Parameters, an indexer's included, are
+numbered in declaration order, so an indexer that swaps its parameters is a
+different body. Declared types remain tokens, so copies that differ only in
+those types are not identical.
+Operators remain. Parentheses that group an expression or a pattern remain
+unless they wrap a name, member access, element access, call, literal or `this`,
+so `(a + b) * c` and `a + b * c` are different bodies while `(a) + b` and
+`a + b` are not.
+
+## HTTP endpoints and requests
+
+The scanner reports the [HTTP facts](../evidence.md#http-endpoints-and-requests)
+that core joins into derived relationships. It reads attributes and calls from
+syntax, because ASP.NET Core and client packages are never restored.
+
+Endpoints:
+
+- attribute-routed controllers: `[Route]` on the class with `[HttpGet]`,
+  `[HttpPost]`, `[HttpPut]`, `[HttpDelete]`, `[HttpPatch]`, `[HttpHead]`,
+  `[HttpOptions]` or `[Route]` on an action. As in ASP.NET Core, each `[Route]`
+  and each verb attribute with a template, `Name` or `Order` is one route. A
+  verb attribute's route serves only its own method, so
+  `[HttpGet("a")] [HttpPost("b")]` serves GET `a` and POST `b`. A `[Route]`
+  serves the methods of the verb attributes without a template, or every method
+  when there are none. Verb attributes without a template that no `[Route]`
+  took serve the class prefix, so `[HttpPost] [HttpPut("{id?}")]` serves PUT
+  `{id?}` and POST on the prefix. An action without routing attributes
+  reports nothing. `[controller]` becomes the class name without its
+  `Controller` suffix, and `[action]` the literal `[ActionName]` or else the
+  method name without a trailing `Async`. When a source file may set
+  `SuppressAsyncSuffixInActionNames` to anything but `true`, the `[action]`
+  path of a method ending in `Async` reports nothing, and when the source names
+  `RouteTokenTransformerConvention`, every `[controller]` or `[action]` path
+  reports nothing. A class `[Route]` starting with `~/` starts at the root.
+- a controller is a public, top-level, non-generic, non-abstract class declared
+  in one place, named `*Controller`, marked `[Controller]` or deriving from
+  `ControllerBase` or `Controller`, and not `[NonController]`, counting the
+  attributes of its bases. A controller also serves the public methods and
+  `[Route]` prefixes of its bases, so one with a base between it and
+  `ControllerBase` that declares a public method or a `[Route]`, or that the
+  source does not declare, reports nothing. An action is a public, non-static,
+  non-generic method with a body and without `[NonAction]`.
+- minimal APIs: `MapGet`, `MapPost`, `MapPut`, `MapDelete`, `MapPatch`, and
+  `MapMethods` with literal methods, on a `MapGroup` chain or on the
+  application: the result of `Build()` or `WebApplication.Create()`, or any
+  name declared as `WebApplication`, such as a parameter. The handler is a
+  lambda or a method the call names.
+
+Requests:
+
+- `HttpClient` calls, recognized by the receiver's own type: the `GetAsync`,
+  `GetStringAsync`, `GetFromJsonAsync`, `PostAsync`, `PostAsJsonAsync`,
+  `PutAsync`, `PatchAsync` and `DeleteAsync` families, and `SendAsync` with a
+  `new HttpRequestMessage(HttpMethod.Get, url)`.
+- declarative client interfaces such as Refit: `[Get]`, `[Post]`, `[Put]`,
+  `[Delete]`, `[Patch]`, `[Head]` and `[Options]` on an interface method. Such
+  a method has no body, so its request declares the operation itself.
+
+Literal routes and URLs and values the compiler proves constant, such as a
+`const` field, become facts. A local, or a readonly field whose type is declared
+entirely in the file that uses it, stands for its initializer when that file
+never assigns it again. These report nothing: conventional routing; an action
+with `[AcceptVerbs]`; `[area]` and other route tokens; `IApplicationBuilder.Map`
+middleware branches; framework constants such as `HttpMethods.Get`; and a route
+on a group that is reassigned or carries a computed prefix, or on an
+`IEndpointRouteBuilder` that arrives as a parameter.
+
+The [producer checklist](../evidence.md#producer-checklist) for C#:
+
+1. **Which prefixes belong in the path.** The class `[Route]` prefix and every
+   `MapGroup` in the chain. A `~/` or leading `/` action template replaces the
+   class prefix, while a group prefix always stays. A group or prefix that is
+   not literal reports nothing.
+2. **Whether the construct is an endpoint.** Controller actions and mapped
+   handlers serve. Middleware branches, `MapControllers`, filters and
+   authorization policies do not, and a declarative client interface reports
+   requests instead.
+3. **Dynamic or unknown.** `$"/talks/{id}"` and `"/talks/" + id` fill one whole
+   segment, so they are dynamic. `$"/talks/find-{term}"` and a URL the source
+   computes as a whole are unknown.
+4. **The local helper.** Not supported. A request is reported at the operation
+   that calls the client, so a helper that receives the path reports an unknown
+   path and its callers report nothing.
+5. **The base.** A leading `/` has no base. A relative path such as
+   `"api/talks"`, which `HttpClient` resolves against its base address, and
+   every declarative template set `configured`, and so does a configuration
+   read followed by a path starting with `/`: an `IConfiguration` indexer,
+   `GetValue`, `GetConnectionString`, a section's `Value`, or
+   `Environment.GetEnvironmentVariable`. `"https://api.example.com/talks"`, a
+   parameter, a configuration read continued without `/`, and any other computed
+   URL report a leading `unknown` segment.
+6. **Which operation a file-location route names.** C# declares no routes by
+   file location, so the scanner names no operation that way.
+7. **Which segments are constrained.** A route constraint makes its parameter
+   or catch-all constrained: `{id:int}`, `{id:int?}` and
+   `{**path:regex(...)}`. A segment mixing text with placeholders, such as
+   `v{version}` or `{id}.{format}`, is one constrained parameter named after its
+   first placeholder. A default value or a final `?` makes a parameter optional.
+8. **Registration order.** ASP.NET Core prefers the most specific route, so the
+   scanner reports no `order`.

package/dist/index.js

@@ -1,5 +1,6 @@
 // @bun
 // plugins/scanners/csharp/src/index.ts
+import { readFile } from "fs/promises";
 import path4 from "path";
 
 // plugins/scanners/csharp/src/config.ts
@@ -28,9 +29,12 @@ var excluded = new Set([
   "groma",
   ".groma"
 ]);
-async function projectFiles(root, matches) {
+async function repositoryFiles(root, matches) {
   const { stdout } = await execute("git", ["-C", root, "ls-files", "-z", "--cached", "--others", "--exclude-standard"], { maxBuffer: 64 * 1024 * 1024 });
-  return [...new Set(stdout.split("\x00").filter((file) => file && matches(file) && !file.split("/").some((part) => excluded.has(part)) && existsSync(path.join(root, file))))].sort();
+  return [...new Set(stdout.split("\x00").filter((file) => file && matches(file) && existsSync(path.join(root, file))))].sort();
+}
+function projectFiles(root, matches) {
+  return repositoryFiles(root, (file) => matches(file) && !file.split("/").some((part) => excluded.has(part)));
 }
 
 // plugins/scanners/csharp/src/config.ts
@@ -82,6 +86,116 @@ async function csharpInputs(root, settings) {
   return [...files.filter((file) => /\.slnx?$/i.test(file)), ...files.filter((file) => /\.csproj$/i.test(file))].map((file) => path2.resolve(root, file));
 }
 
+// packages/scanner/src/values.ts
+function object(value, label) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`${label} must be an object`);
+  }
+  return value;
+}
+function string(value, label) {
+  if (typeof value !== "string")
+    throw new Error(`${label} must be a string`);
+  return value;
+}
+function array(value, label) {
+  if (!Array.isArray(value))
+    throw new Error(`${label} must be an array`);
+  return value;
+}
+
+// packages/scanner/src/http.ts
+var pathText = /^[A-Za-z0-9\-._~!$&'()*+,;=:@%]+$/;
+var methodToken = /^[A-Z][A-Z-]*$/;
+function fail(message) {
+  throw new Error(message);
+}
+function text(value, label) {
+  if (typeof value !== "string" || !pathText.test(value))
+    fail(`${label} must be nonempty URL path characters`);
+  return value;
+}
+function method(value, label, anyMethod) {
+  if (typeof value !== "string" || !(methodToken.test(value) || anyMethod && value === "*")) {
+    fail(`${label} must be an uppercase HTTP method${anyMethod ? " or *" : ""}`);
+  }
+  return value;
+}
+function operation(value, operations) {
+  if (typeof value !== "string" || !operations.has(value))
+    fail("HTTP fact references unknown operation");
+  return value;
+}
+function endpointSegment(value, last) {
+  const segment = object(value, "HTTP endpoint segment");
+  if (segment.kind === "literal")
+    return { kind: "literal", value: text(segment.value, "HTTP literal segment") };
+  if (segment.kind !== "parameter" && segment.kind !== "catch-all")
+    fail(`unknown HTTP endpoint segment kind: ${String(segment.kind)}`);
+  if (segment.kind === "catch-all" && !last)
+    fail("an HTTP catch-all segment must be last");
+  for (const flag of ["optional", "constrained"]) {
+    if (segment[flag] !== undefined && typeof segment[flag] !== "boolean")
+      fail(`HTTP segment ${flag} must be a boolean`);
+  }
+  return {
+    kind: segment.kind,
+    name: text(segment.name, "HTTP segment name"),
+    ...segment.optional ? { optional: true } : {},
+    ...segment.constrained ? { constrained: true } : {}
+  };
+}
+function requestSegment(value) {
+  const segment = object(value, "HTTP request segment");
+  if (segment.kind === "literal")
+    return { kind: "literal", value: text(segment.value, "HTTP literal segment") };
+  if (segment.kind === "dynamic" || segment.kind === "unknown")
+    return { kind: segment.kind };
+  return fail(`unknown HTTP request segment kind: ${String(segment.kind)}`);
+}
+function order(value) {
+  const fact = object(value, "HTTP endpoint order");
+  const application = string(fact.application, "HTTP endpoint order application");
+  if (application === "")
+    fail("HTTP endpoint order application must be nonempty");
+  const position = fact.position;
+  if (typeof position !== "number" || !Number.isInteger(position) || position < 0) {
+    fail("HTTP endpoint order position must be a nonnegative integer");
+  }
+  return { application, position };
+}
+function endpoint(value, operations) {
+  const fact = object(value, "HTTP endpoint");
+  const path = array(fact.path, "HTTP endpoint path");
+  return {
+    operation: operation(fact.operation, operations),
+    method: method(fact.method, "HTTP endpoint method", true),
+    path: path.map((segment, index) => endpointSegment(segment, index === path.length - 1)),
+    ...fact.order === undefined ? {} : { order: order(fact.order) }
+  };
+}
+function request(value, operations) {
+  const fact = object(value, "HTTP request");
+  if (fact.configured !== undefined && typeof fact.configured !== "boolean")
+    fail("HTTP request configured must be a boolean");
+  return {
+    operation: operation(fact.operation, operations),
+    ...fact.method === undefined ? {} : { method: method(fact.method, "HTTP request method", false) },
+    ...fact.configured ? { configured: true } : {},
+    path: array(fact.path, "HTTP request path").map(requestSegment)
+  };
+}
+function httpEvidence(endpoints, requests, operations) {
+  if (endpoints === undefined && requests === undefined)
+    return {};
+  if (operations === undefined)
+    fail("HTTP facts require operation declarations");
+  return {
+    ...endpoints === undefined ? {} : { httpEndpoints: array(endpoints, "httpEndpoints").map((fact) => endpoint(fact, operations)) },
+    ...requests === undefined ? {} : { httpRequests: array(requests, "httpRequests").map((fact) => request(fact, operations)) }
+  };
+}
+
 // packages/scanner/src/index.ts
 function compare(...values) {
   return values.join("\x00");
@@ -125,7 +239,9 @@ function createScanObservation(input) {
     scanner: input.scanner,
     roots,
     files,
+    ...sourceUnits(input.sourceUnits, filePaths),
     ...operationEvidence(input, filePaths),
+    ...httpEvidence(input.httpEndpoints, input.httpRequests, input.operations && new Set(input.operations.map((operation) => operation.id))),
     diagnostics: [...new Map(input.diagnostics.map((diagnostic) => [
       diagnosticKey(diagnostic),
       diagnostic
@@ -134,6 +250,23 @@ function createScanObservation(input) {
     })
   };
 }
+function sourceUnits(input, paths) {
+  if (input === undefined)
+    return {};
+  const units = array(input, "sourceUnits").map((entry) => {
+    const unit = object(entry, "source unit");
+    const primary = string(unit.primary, "source unit.primary");
+    const files = [...new Set(array(unit.files, "source unit.files").map((file) => string(file, "source unit.file")))].sort();
+    if (!files.includes(primary))
+      throw new Error(`source unit omits primary file: ${primary}`);
+    for (const file of files) {
+      if (!paths.has(file))
+        throw new Error(`source unit references unknown file: ${file}`);
+    }
+    return { primary, files };
+  });
+  return { sourceUnits: [...new Map(units.map((unit) => [compare(unit.primary, ...unit.files), unit])).values()].sort((a, b) => compare(a.primary, ...a.files).localeCompare(compare(b.primary, ...b.files))) };
+}
 function validateRoots(input) {
   const roots = uniqueBy(input, (root) => root.id, "root id");
   const byId = new Map(roots.map((root) => [root.id, root]));
@@ -164,22 +297,6 @@ function diagnosticLocation(value) {
     ...value.line === undefined ? {} : { line: Number(value.line) }
   };
 }
-function object(value, label) {
-  if (value === null || typeof value !== "object" || Array.isArray(value)) {
-    throw new Error(`${label} must be an object`);
-  }
-  return value;
-}
-function string(value, label) {
-  if (typeof value !== "string")
-    throw new Error(`${label} must be a string`);
-  return value;
-}
-function array(value, label) {
-  if (!Array.isArray(value))
-    throw new Error(`${label} must be an array`);
-  return value;
-}
 function parseScanObservation(source) {
   const value = object(JSON.parse(source), "observation");
   if (value.schemaVersion !== 1)
@@ -193,6 +310,9 @@ function parseScanObservation(source) {
       engineVersion: string(scanner.engineVersion, "scanner.engineVersion")
     },
     ...parseOperations(value),
+    httpEndpoints: value.httpEndpoints,
+    httpRequests: value.httpRequests,
+    ...sourceUnits(value.sourceUnits, new Set(array(value.files, "files").map((entry) => string(object(entry, "file").file, "file.file")))),
     roots: array(value.roots, "roots").map((entry) => {
       const root = object(entry, "root");
       return {
@@ -345,6 +465,9 @@ function combineObservations(parts) {
   const operations = [];
   const invocations = [];
   const diagnostics = [];
+  const sourceUnits = [];
+  const httpEndpoints = [];
+  const httpRequests = [];
   for (const { key, observation } of parts) {
     const id = (value) => JSON.stringify([key, value]);
     roots.push(...observation.roots.map((root) => ({ ...root, id: id(root.id), ...root.parent ? { parent: id(root.parent) } : {} })));
@@ -356,7 +479,10 @@ function combineObservations(parts) {
     }
     operations.push(...(observation.operations ?? []).map((operation) => ({ ...operation, id: id(operation.id) })));
     invocations.push(...(observation.invocations ?? []).map((call) => ({ ...call, source: id(call.source), targets: call.targets.map(id) })));
+    httpEndpoints.push(...(observation.httpEndpoints ?? []).map((endpoint) => ({ ...endpoint, operation: id(endpoint.operation) })));
+    httpRequests.push(...(observation.httpRequests ?? []).map((request) => ({ ...request, operation: id(request.operation) })));
     diagnostics.push(...observation.diagnostics);
+    sourceUnits.push(...observation.sourceUnits ?? []);
   }
   return createScanObservation({
     scanner: parts[0].observation.scanner,
@@ -364,14 +490,17 @@ function combineObservations(parts) {
     files: [...files.values()],
     operations,
     invocations,
-    diagnostics
+    diagnostics,
+    ...parts.some((part) => part.observation.sourceUnits !== undefined) ? { sourceUnits } : {},
+    ...parts.some((part) => part.observation.httpEndpoints !== undefined) ? { httpEndpoints } : {},
+    ...parts.some((part) => part.observation.httpRequests !== undefined) ? { httpRequests } : {}
   });
 }
 
 // plugins/scanners/csharp/src/adapter.ts
 import { access } from "fs/promises";
 import path3 from "path";
-import { fileURLToPath } from "url";
+import { createRequire } from "module";
 
 // plugins/scanners/csharp/src/process.ts
 import { spawn } from "child_process";
@@ -395,7 +524,7 @@ function run(command, args, options) {
     const child = spawn(script ? process.execPath : command, script ? [command, ...args] : [...args], {
       cwd: options.cwd,
       env: { ...process.env, DOTNET_CLI_TELEMETRY_OPTOUT: "1", DOTNET_CLI_WORKLOAD_UPDATE_NOTIFY_DISABLE: "1", ...options.env },
-      stdio: ["ignore", "pipe", "pipe"],
+      stdio: ["pipe", "pipe", "pipe"],
       detached: process.platform !== "win32",
       windowsHide: true
     });
@@ -429,6 +558,8 @@ function run(command, args, options) {
       clearTimeout(timer);
       reject(error);
     });
+    child.stdin.on("error", () => {});
+    child.stdin.end(options.input);
     child.on("close", (code) => {
       clearTimeout(timer);
       if (failure)
@@ -442,41 +573,32 @@ function run(command, args, options) {
 }
 
 // plugins/scanners/csharp/src/adapter.ts
-var workerDll = fileURLToPath(new URL("../dist/worker/Groma.CSharpScanner.dll", import.meta.url));
-async function requireWorker(file = workerDll) {
+async function requireWorker(file) {
   try {
-    await access(file);
+    const manifest = file ? undefined : createRequire(import.meta.url).resolve(`@groma/scanner-csharp-${process.platform}-${process.arch}/package.json`);
+    const worker = file ?? path3.join(path3.dirname(manifest), "worker", `Groma.CSharpScanner${process.platform === "win32" ? ".exe" : ""}`);
+    await access(worker);
+    return worker;
   } catch {
-    throw new Error("C# worker is not prepared. Install a prebuilt scanner package; contributors run bun scripts/package-csharp-scanner.ts.");
+    throw new Error("C# runtime package is missing. Reinstall the scanner with optional dependencies enabled; contributors run bun scripts/package-csharp-scanner.ts.");
   }
 }
-async function prepareCSharpScan(repositoryRoot, settings, dotnet, worker) {
+async function prepareCSharpScan(repositoryRoot, settings, worker) {
   const root = path3.resolve(repositoryRoot);
   const config = parseCSharpSettings(settings);
   if (!config.input)
     throw new Error("C# analysis requires a selected project or solution input.");
   const input = await validateInput(root, config.input);
-  await requireWorker(worker);
-  const options = { cwd: path3.dirname(input), timeoutSeconds: config.timeoutSeconds };
-  let sdkVersion;
-  try {
-    sdkVersion = (await run(dotnet, ["--version"], options)).stdout.trim();
-  } catch (error) {
-    throw new Error(`C# project SDK is unavailable. Install the SDK selected by global.json and ensure dotnet is on PATH (or set DOTNET_HOST_PATH). ${String(error)}`);
-  }
-  const runtimes = (await run(dotnet, ["--list-runtimes"], options)).stdout;
-  if (!/^Microsoft\.NETCore\.App 10\./m.test(runtimes))
-    throw new Error("The C# scanner worker requires the .NET 10 runtime alongside the project SDK.");
-  return { root, config, input, sdkVersion };
-}
-async function checkCSharpReadiness(repositoryRoot, settings = {}, dotnet = process.env.DOTNET_HOST_PATH ?? "dotnet", worker = workerDll) {
-  const { input, sdkVersion } = await prepareCSharpScan(repositoryRoot, settings, dotnet, worker);
-  return { input, sdkVersion };
-}
-async function scanCSharpSource(repositoryRoot, settings = {}, dotnet = process.env.DOTNET_HOST_PATH ?? "dotnet", worker = workerDll) {
-  const { root, config, input } = await prepareCSharpScan(repositoryRoot, settings, dotnet, worker);
-  const { stdout } = await run(dotnet, [
-    worker,
+  const executable = await requireWorker(worker);
+  return { root, config, input, executable };
+}
+async function checkCSharpReadiness(repositoryRoot, settings = {}, worker) {
+  const { input } = await prepareCSharpScan(repositoryRoot, settings, worker);
+  return { input };
+}
+async function scanCSharpSource(repositoryRoot, settings = {}, worker) {
+  const { root, config, input, executable } = await prepareCSharpScan(repositoryRoot, settings, worker);
+  const { stdout } = await run(executable, [
     input,
     "--root",
     root,
@@ -489,8 +611,24 @@ async function scanCSharpSource(repositoryRoot, settings = {}, dotnet = process.
   ], { cwd: path3.dirname(input), timeoutSeconds: config.timeoutSeconds });
   return parseScanObservation(stdout);
 }
+async function readCSharpOutline(repositoryRoot, references, settings = {}) {
+  const worker = await requireWorker();
+  const root = path3.resolve(repositoryRoot);
+  const { stdout } = await run(worker, ["--outline"], {
+    cwd: root,
+    timeoutSeconds: parseCSharpSettings(settings).timeoutSeconds,
+    input: JSON.stringify({ root, references })
+  });
+  return JSON.parse(stdout);
+}
 
 // plugins/scanners/csharp/src/index.ts
+async function solutionProjects(input) {
+  if (/\.csproj$/i.test(input))
+    return [input];
+  const source = await readFile(input, "utf8");
+  return [...source.matchAll(/"([^"]+\.csproj)"|Path="([^"]+\.csproj)"/gi)].map((match) => path4.resolve(path4.dirname(input), (match[1] ?? match[2]).split("\\").join("/")));
+}
 var scanner = {
   id: "csharp",
   watch: {
@@ -514,6 +652,16 @@ var scanner = {
     for (const input of inputs)
       await checkCSharpReadiness(root, { ...settings, input });
   },
+  readCodeStructure: readCSharpOutline,
+  listSourceFiles: async (root, settings = {}) => {
+    const directories = [];
+    for (const input of await csharpInputs(root, settings)) {
+      for (const project of await solutionProjects(input)) {
+        directories.push(path4.relative(root, path4.dirname(project)).split(path4.sep).join("/"));
+      }
+    }
+    return projectFiles(root, (file) => /\.cs$/i.test(file) && !file.split("/").some((part) => /^(?:bin|obj)$/i.test(part)) && directories.some((directory) => directory === "" || file.startsWith(`${directory}/`)));
+  },
   scan: async (root, settings = {}) => {
     const parts = [];
     const covered = new Set;