@groma/scanner-javascript 0.1.0 → 0.2.0

package/README.md

@@ -1,7 +1,7 @@
 # JavaScript scanner
 
-The JavaScript scanner reads tracked and unignored `.js`, `.mjs`, `.cjs` and
-`.jsx` files, covering ECMAScript modules, CommonJS modules and browser scripts.
+The JavaScript scanner reads the `.js`, `.mjs`, `.cjs` and `.jsx` files
+groma.md hands it, covering ECMAScript modules, CommonJS modules and browser scripts.
 It does not require Node.js, installed packages, a bundler, a project build or a
 `tsconfig.json`. Discovery matches JavaScript source directly, even without a
 package manifest.
@@ -17,7 +17,7 @@ groma scanner add /absolute/path/to/groma/plugins/scanners/javascript/dist/packa
 groma scan
 ```
 
-The package bundles the TypeScript 6.0.3 compiler, whose parser reads
+The package bundles the TypeScript 6.0 compiler, whose parser reads
 JavaScript, including JSX in `.js` and `.jsx` files, and includes its license
 notices. Every file is parsed on its own, so no project configuration, module
 resolution or other file changes what a file reports. The compiler's declaration
@@ -31,28 +31,21 @@ TypeScript-style type annotations, as in many Flow-typed files, still parse, and
 octal literals and escapes that only strict mode rejects, such as `0755`, are not
 parse errors.
 
-## Excluded files
+## Included and excluded files
 
-Minified output is not authored source, so it is left out of the scan and the
-source outline:
+The package declares the default
+[include and exclude lists](../index.md#selecting-source-files). It includes
+the four source extensions and the `package.json`, HTML, `project.json` and
+`nx.json` files the entry reader reads. It excludes names that state minified
+output, such as `jquery-ui.min.js`, and `node_modules`, `dist`, `build` and
+`coverage` folders. The scan and the readiness check read only the files the
+lists select.
 
-- a name that states minified output, such as `jquery-ui.min.js`;
-- text whose lines average 500 characters or more, the shape of a bundle a build
-  produced under an ordinary name such as `vendor.js`.
+A bundle under an ordinary name, such as `vendor.js`, is read like any other
+source; a project that keeps it out adds a pattern to `scanners.json`.
 
-The shared Git boundary omits ignored files and dependency or build directories
-such as `node_modules`, `vendor`, `dist` and `build`. Core applies the source
-exclusions configured in `scanners.json`.
-
-Test sources are treated like any other JavaScript source, as in the PHP and
-Swift scanners: a project excludes them explicitly in `scanners.json`. The
-TypeScript scanner instead omits `test` directories and `.test` and `.spec` names
-by default.
-
-Discovery counts any `.js`, `.mjs`, `.cjs` or `.jsx` name, minified files
-included, because it reads file names without opening them. A repository whose
-only JavaScript is minified can therefore be recommended this scanner, and
-readiness then reports that no authored JavaScript source was found.
+Test sources are treated like any other JavaScript source: the defaults name
+none, so a project that keeps them out adds a pattern to `scanners.json`.
 
 TypeScript sources belong to the [TypeScript scanner](../typescript/index.md)
 and single-file components to the [Vue scanner](../vue/index.md). This scanner
@@ -66,6 +59,8 @@ and methods and constructors with a body produce operation evidence with UTF-16
 source offsets.
 Code outside every function is the module's own work, so a browser script's
 top-level calls keep an operation to belong to, without inventing a function.
+Calls inside accessors belong to an anonymous accessor operation; accessors are
+not compared for duplicate logic.
 
 Calls remain unresolved. One parsed file proves no call target: an imported name,
 a `require` result and a method on a value are all decided elsewhere, so core
@@ -77,6 +72,13 @@ JavaScript file belongs to one C4 runtime boundary. Core owns architecture
 identity and curation, and repeated scans preserve one physical owner and the
 authored architecture. JavaScript edits and new files refresh through the shared
 scanner watcher.
+Each literal local `node`, `bun`, `tsx` or `ts-node` command in an unquoted
+`&&`-chained package script can supply an execution entry. Environment
+assignments or `cross-env` may come before the runtime, and runtime options and
+a `run` or `watch` subcommand before the script; the first remaining word must
+name the script, so a preloaded module or `bun build` supplies none. An HTML
+page's script supplies one too, named after the page, or after its folder for
+an `index.html`.
 
 ## Source outline
 
@@ -86,7 +88,8 @@ parses the file alone and lists what it declares at the top level:
 
 - functions, and arrow functions or function expressions assigned directly to a
   `const`, `let` or `var` name;
-- classes, with every method and the constructor as members.
+- classes, including a named class expression assigned to `module.exports`,
+  with every method and the constructor as members.
 
 Fields, accessors, and declarations inside a function, method or block are not
 listed. A declaration is marked as an entry when the component's Code names it,
@@ -96,12 +99,12 @@ Visibility follows how the file publishes a name:
 
 | Value | JavaScript |
 | --- | --- |
-| `public` | An `export`, a name in the file's own `export { name }` list or `export default name`, a name a CommonJS `module.exports` or `exports.name` assignment publishes, and every top-level declaration of a file that states no module boundary, because those names are globals |
+| `public` | An `export`, a name in the file's own `export { name }` list or `export default name`, a name a CommonJS `module.exports` or `exports.name` assignment publishes, including through a chained assignment, and every top-level declaration of a file that states no module boundary, because those names are globals |
 | `private` | Every other top-level declaration, and a `#name` member |
 
 A `.mjs` or `.cjs` file is a module whatever it contains, so its unpublished
 declarations stay private. A `.js` file is a module when it states an `import`,
-an `export` or a CommonJS export; otherwise it is a browser script whose
+an `export`, a CommonJS export or a `require` call; otherwise it is a browser script whose
 declarations any other script on the page may use. Members are `public` unless
 their name is private.
 
@@ -125,8 +128,8 @@ that file states it and a value from another file is one the scanner cannot see.
 
 | Construct | Reported |
 | --- | --- |
-| `fetch(url, init)`, including a `node-fetch` default import | Request; a literal `method` gives the method, no options means `GET`, and options the scanner cannot read, or an input that is not a URL, such as a `Request`, leave it out |
-| `axios.get`, `.post`, `.put`, `.patch`, `.delete`, `.head`, `.options` | Request with that method |
+| `fetch(url, init)`, including a `node-fetch` default import or a named `undici` import | Request; a literal `method` gives the method, no options means `GET`, and options the scanner cannot read, or an input that is neither URL text nor typed as a primitive such as a string, for example a `Request`, leave it out |
+| `axios.get`, `.post`, `.put`, `.patch`, `.delete`, `.head`, `.options`, `.postForm`, `.putForm`, `.patchForm` | Request with that method; form helpers use their matching HTTP method |
 | `axios(config)`, `axios.request(config)` | Request from the config's `url`; its `method`, else the client's, else `GET` |
 | `axios.create(config)` instances | Request whose path follows the config's `baseURL`, and whose method defaults to the config's |
 | `$.get`, `$.post`, `$.getJSON`, `$.getScript` | Request with that helper's method |
@@ -209,21 +212,29 @@ The [producer decisions](../evidence.md#producer-checklist) for this ecosystem:
 7. **Constrained segments.** Route patterns are literal text, `:name`, `:name?`,
    Express 5's trailing optional group `{/:name}`, and a trailing `*`, `*name`,
    `(.*)` or `:name(.*)` catch-all, which needs at least one segment because a
-   request path cannot tell `/files` from `/files/`; Hono's trailing `*` also
-   matches the path without it. A pattern parameter, such as `:id(\d+)`, and
+   request path cannot tell `/files` from `/files/`; Hono's trailing `*` and
+   Express 5's trailing `{/*name}` or `/{*name}` also match the path without it.
+   A pattern parameter, such as `:id(\d+)`, and
    text mixed with a placeholder, such as `talk-:id`, are constrained
    parameters. A pattern that may span segments or that the scanner cannot
    state, such as a regular expression, another optional group or a catch-all
    that is not last, becomes a constrained optional catch-all in place of itself
-   and the rest of the route, so no route is omitted.
+   and the rest of the route, so no route is omitted; the whole segments before
+   it stand.
 8. **Registration order.** Express, Hono and Koa routers take the first
    registered match, so their endpoints carry `order`: the application, named by
    the file that creates it and the variable that holds it, such as
-   `server/app.js#app`, and a position. The routing model has six rules:
+   `server/app.js#app`, and a position. Same-named local applications in one
+   file also carry their declaration position to keep their order separate.
+   The routing model has six rules:
    1. A registrar's entries are its registrations and the references that hand
       it off to other code, such as `registerRoutes(app)`. Serving it with
       `listen`, Node's `createServer(app)` or an imported `serve(app)` registers
-      nothing. The scanner never sees the files that import this one, which run
+      nothing, and neither does a route method called with fewer than two
+      arguments, such as the setting read `app.get('env')`. A `use` that only
+      adds middleware, which takes no place (rule 5), is no entry either, so
+      `if (app.get('env') === 'development') app.use(logger)` leaves the order
+      of the other entries known. The scanner never sees the files that import this one, which run
       after all of it and may add any route, so an export, `export default app`,
       `export const app` or an assignment to `module.exports` or `exports`,
       hands the registrar off at the end of its order; a circular require is the
@@ -244,9 +255,9 @@ The [producer decisions](../evidence.md#producer-checklist) for this ecosystem:
       prefix followed by a constrained optional catch-all, with method `*`
       unless the call states one, named by the registering operation: a route
       with a computed path, a mount under a computed prefix, a path mounted to
-      something other than a recognized router, such as
-      `app.use('/static', express.static('public'))`, a router the scan cannot
-      follow, mounted with or without a path, such as
+      something other than a recognized router or a function the scan sees,
+      such as `app.use('/static', express.static('public'))`, a router the
+      scan cannot follow, mounted with or without a path, such as
       `app.use(require('./routes'))`, a Koa router's `routes()` from another
       file, or a function imported from one, which the scanner cannot see, a
       route builder such as `app.route('/reports')`, Hono's `on`, `mount` and
@@ -255,7 +266,11 @@ The [producer decisions](../evidence.md#producer-checklist) for this ecosystem:
       registrar's root.
    5. Middleware takes no place: a package's handler, such as `express.json()`,
       and any handler before or beside a recognized router in one call, as in
-      `app.use(requireAuth, api)`, which then states no path.
+      `app.use(requireAuth, api)`, which then states no path. Hono's `use`
+      never mounts a router, so it takes no place with or without a path,
+      whatever its handlers. Under a path, an Express or Koa `use` takes none
+      when the scan sees that every handler is a function, as in
+      `app.use('/api', requireAuth)`.
    6. Fastify and Bun.serve prefer the most specific route and carry no order; a
       Fastify plugin, whose routes the scan does not read, blocks its prefix
       without one.
@@ -263,7 +278,7 @@ The [producer decisions](../evidence.md#producer-checklist) for this ecosystem:
 ## Validation
 
 Independent fixtures cover ECMAScript modules, CommonJS, JSX, browser scripts,
-minified files excluded by name and by line length, exact source positions,
+minified names excluded by the default exclusions, exact source positions,
 unresolved calls, the source outline with its visibility rules, one body that
 tokenizes identically in JavaScript and in TypeScript, identical and
 near-duplicate bodies found by `groma lint`, a file that does not parse next to

package/dist/index.js

@@ -1,6 +1,6 @@
 // @bun
 // plugins/scanners/javascript/src/index.ts
-import path4 from "path";
+import path7 from "path";
 
 // packages/scanner/src/values.ts
 function object(value, label) {
@@ -156,6 +156,7 @@ function createScanObservation(input) {
     roots,
     files,
     ...sourceUnits(input.sourceUnits, filePaths),
+    ...entryPoints(input.entryPoints, filePaths),
     ...operationEvidence(input, filePaths),
     ...httpEvidence(input.httpEndpoints, input.httpRequests, input.operations && new Set(input.operations.map((operation) => operation.id))),
     diagnostics: [...new Map(input.diagnostics.map((diagnostic) => [
@@ -166,6 +167,29 @@ function createScanObservation(input) {
     })
   };
 }
+function entryPoints(input, paths) {
+  if (input === undefined)
+    return {};
+  const entries = array(input, "entryPoints").map((value) => {
+    const entry = object(value, "entry point");
+    const files = [...new Set(array(entry.files, "entry point.files").map((file) => string(file, "entry point.file")))].sort();
+    for (const file of files) {
+      if (!paths.has(file))
+        throw new Error(`entry point references unknown file: ${file}`);
+    }
+    const file = string(entry.file, "entry point.file");
+    if (!files.includes(file))
+      throw new Error(`entry point must include its own source file: ${file}`);
+    return {
+      file,
+      declaration: string(entry.declaration, "entry point.declaration"),
+      name: string(entry.name, "entry point.name"),
+      files
+    };
+  });
+  const key = (entry) => compare(entry.file, entry.declaration, entry.name, ...entry.files);
+  return { entryPoints: [...new Map(entries.map((entry) => [key(entry), entry])).values()].sort((a, b) => key(a).localeCompare(key(b))) };
+}
 function sourceUnits(input, paths) {
   if (input === undefined)
     return {};
@@ -284,7 +308,7 @@ function sourcePosition(position) {
 }
 
 // plugins/scanners/javascript/src/index.ts
-import ts6 from "./typescript.cjs";
+import ts7 from "./typescript.cjs";
 
 // plugins/scanners/javascript/src/evidence.ts
 import ts2 from "./typescript.cjs";
@@ -577,12 +601,40 @@ import ts from "./typescript.cjs";
 function isFunctionValue(node) {
   return node !== undefined && (ts.isArrowFunction(node) || ts.isFunctionExpression(node));
 }
+function isExportsReference(node) {
+  if (ts.isIdentifier(node))
+    return node.text === "exports";
+  return ts.isPropertyAccessExpression(node) && ts.isIdentifier(node.expression) && node.expression.text === "module" && node.name.text === "exports";
+}
+function commonJsExport(statement) {
+  if (!ts.isExpressionStatement(statement))
+    return;
+  let expression = statement.expression;
+  while (ts.isBinaryExpression(expression) && expression.operatorToken.kind === ts.SyntaxKind.EqualsToken) {
+    const { left } = expression;
+    if (ts.isPropertyAccessExpression(left) && (isExportsReference(left) || isExportsReference(left.expression)))
+      return expression;
+    expression = expression.right;
+  }
+  return;
+}
+function assignedValue(expression) {
+  return ts.isBinaryExpression(expression) && expression.operatorToken.kind === ts.SyntaxKind.EqualsToken ? assignedValue(expression.right) : expression;
+}
+function exportedClass(statement) {
+  const assignment = commonJsExport(statement);
+  const value = assignment && assignedValue(assignment.right);
+  return value && ts.isClassExpression(value) && value.name ? [{ name: value.name.text, kind: "class" }] : [];
+}
 function topLevelDeclarations(source) {
   return source.statements.flatMap((statement) => {
     if (ts.isFunctionDeclaration(statement))
       return statement.name ? [{ name: statement.name.text, kind: "function" }] : [];
     if (ts.isClassDeclaration(statement))
       return statement.name ? [{ name: statement.name.text, kind: "class" }] : [];
+    const published = exportedClass(statement);
+    if (published.length)
+      return published;
     if (!ts.isVariableStatement(statement))
       return [];
     return statement.declarationList.declarations.flatMap((declaration) => ts.isIdentifier(declaration.name) && isFunctionValue(declaration.initializer) ? [{ name: declaration.name.text, kind: "function" }] : []);
@@ -624,7 +676,7 @@ function javaScriptEvidence(file, source) {
     });
   }
   function visit(node, owner) {
-    const inside = executable(node) ? operation(node) : owner;
+    const inside = executable(node) || ts2.isGetAccessorDeclaration(node) || ts2.isSetAccessorDeclaration(node) ? operation(node) : owner;
     if (ts2.isCallExpression(node)) {
       calls.push(node);
       invocation(node, inside ?? moduleOperation());
@@ -648,6 +700,12 @@ function javaScriptEvidence(file, source) {
 import ts4 from "./typescript.cjs";
 
 // plugins/scanners/http-checker.ts
+async function inBatches(items, ask) {
+  const answers = [];
+  for (let offset = 0;offset < items.length; offset += 256)
+    answers.push(...await Promise.all(items.slice(offset, offset + 256).map(ask)));
+  return answers;
+}
 function primitive(ts, type) {
   if (type.isUnion())
     return (type.types ?? []).every((member) => primitive(ts, member));
@@ -806,6 +864,8 @@ var PLACEHOLDER = /^:([A-Za-z_]\w*)(?:\((.*)\)|\{(.*)\})?(\?)?$/;
 var FIRST_PLACEHOLDER = /:([A-Za-z_]\w*)/;
 var WILDCARD = /^\*([A-Za-z_]\w*)?$/;
 var OPTIONAL_GROUP = /\{\/:([A-Za-z_]\w*)\}$/;
+var OPTIONAL_WILDCARD = /(?:\{\/\*|\/\{\*)([A-Za-z_]\w*)\}$/;
+var SEGMENT_GROUP = "{/";
 var SYNTAX = /[:*(){}?+]/;
 var ONE_SEGMENT = /^(?:\^|\$|\\[dw]|[A-Za-z0-9_-]|\[(?:\\[dw]|[A-Za-z0-9_]-[A-Za-z0-9_]|[A-Za-z0-9_-])+\]|[+*?|]|\{\d+(?:,\d*)?\}|\(\?:|[()])+$/;
 var REMAINDER = new Set([".*", ".+"]);
@@ -840,10 +900,16 @@ function segment(part, last, bareWildcard) {
   return { kind: "parameter", name: first[1], constrained: true };
 }
 function endpointPath(pattern, bareWildcard = false) {
-  const group = OPTIONAL_GROUP.exec(pattern);
+  const group = OPTIONAL_GROUP.exec(pattern) ?? OPTIONAL_WILDCARD.exec(pattern);
   if (group !== null) {
     const path = endpointPath(pattern.slice(0, group.index), bareWildcard);
-    return path.at(-1)?.kind === "catch-all" ? path : [...path, { kind: "parameter", name: group[1], optional: true }];
+    const optional = group[0].includes("*") ? { kind: "catch-all", name: group[1], optional: true } : { kind: "parameter", name: group[1], optional: true };
+    return path.at(-1)?.kind === "catch-all" ? path : [...path, optional];
+  }
+  const opening = pattern.indexOf(SEGMENT_GROUP);
+  if (opening >= 0) {
+    const path = endpointPath(pattern.slice(0, opening), bareWildcard);
+    return path.at(-1)?.kind === "catch-all" ? path : [...path, remainder()];
   }
   const pieces = pattern.split("/").filter((part) => part !== "");
   const path = [];
@@ -888,8 +954,10 @@ function ownProperty(ts, object, name) {
   let found = "absent";
   for (const property of object.properties) {
     const key = propertyKey(ts, property);
-    if (key === undefined || ts.isGetAccessorDeclaration(property) || ts.isSetAccessorDeclaration(property))
-      return "unknown";
+    if (key === undefined || ts.isGetAccessorDeclaration(property) || ts.isSetAccessorDeclaration(property)) {
+      found = "unknown";
+      continue;
+    }
     if (key === name)
       found = ts.isPropertyAssignment(property) ? { node: property.initializer } : "unknown";
   }
@@ -1338,6 +1406,10 @@ async function variableHeld(context, name, path, depth) {
     return "unseen";
   if (path.length === 0 && ts.isFunctionDeclaration(declaration))
     return { node: declaration };
+  if (path.length === 1 && ts.isEnumDeclaration(declaration)) {
+    const member = declaration.members.find((entry) => ts.isIdentifier(entry.name) && entry.name.text === path[0]);
+    return member?.initializer === undefined ? "unknown" : held(context, member.initializer, [], depth + 1);
+  }
   if (!ts.isVariableDeclaration(declaration) || declaration.initializer === undefined)
     return "unknown";
   if (!ts.isIdentifier(declaration.name) || !await unassigned(context, declaration))
@@ -1547,12 +1619,14 @@ async function collectRegistrars(context, sources) {
       }
     });
   }
-  const registrars = new Map;
-  for (const declaration of declarations) {
+  const found = await inBatches(declarations, async (declaration) => {
     const registrar = await registrarOf(context, declaration.initializer, declaration.name.text);
-    if (registrar !== undefined && await unassigned(context, declaration))
-      registrars.set(declaration, registrar);
-  }
+    return registrar !== undefined && await unassigned(context, declaration) ? registrar : undefined;
+  });
+  const registrars = new Map;
+  for (const [index, registrar] of found.entries())
+    if (registrar !== undefined)
+      registrars.set(declarations[index], registrar);
   return registrars;
 }
 function candidate(member) {
@@ -1570,11 +1644,15 @@ function registers(member, framework) {
     return framework === "fastify";
   if (member === "route")
     return framework !== "koa";
-  return routeMembers.has(member) || member === "use";
+  if (member === "use")
+    return framework !== "hono";
+  return routeMembers.has(member);
 }
 function returnsRegistrar(member, framework) {
   if (framework === "express" && expressSettings.has(member))
     return true;
+  if (framework === "hono" && member === "use")
+    return true;
   if (framework === "koa" && member === "prefix")
     return true;
   const builder = member === "route" && framework === "express" || member === "basePath";
@@ -1596,17 +1674,19 @@ async function receiverDeclaration(context, call, registrars) {
   return declaration !== undefined && registrars.has(declaration) ? declaration : undefined;
 }
 async function collectRegistrations(context, calls, registrars) {
-  const registrations = [];
-  for (const call of calls) {
+  const candidates = calls.flatMap((call) => {
     const member = memberOf(context.ts, call);
-    if (member === undefined || !candidate(member))
-      continue;
-    const declaration = await receiverDeclaration(context, call, registrars);
-    if (declaration !== undefined && registers(member, registrars.get(declaration).framework)) {
-      registrations.push({ call, declaration, member });
-    }
-  }
-  return registrations;
+    return member !== undefined && candidate(member) ? [{ call, member }] : [];
+  });
+  const declarations = await inBatches(candidates, ({ call }) => receiverDeclaration(context, call, registrars));
+  return candidates.flatMap(({ call, member }, index) => {
+    const declaration = declarations[index];
+    if (declaration === undefined)
+      return [];
+    const framework = registrars.get(declaration).framework;
+    const incomplete = routeMethod(member, framework) !== undefined && call.arguments.length < 2;
+    return registers(member, framework) && !incomplete ? [{ call, declaration, member }] : [];
+  });
 }
 async function applyPrefixes(context, calls, registrars) {
   for (const call of calls) {
@@ -1642,7 +1722,7 @@ function exportOf(ts, reference) {
   const parent = reference.parent;
   if (ts.isExportAssignment(parent) || ts.isExportSpecifier(parent))
     return "last";
-  const assigned = ts.isBinaryExpression(parent) && parent.right === reference && parent.operatorToken.kind === ts.SyntaxKind.EqualsToken && commonJsExport(ts, parent.left);
+  const assigned = ts.isBinaryExpression(parent) && parent.right === reference && parent.operatorToken.kind === ts.SyntaxKind.EqualsToken && commonJsExport2(ts, parent.left);
   if (!assigned)
     return;
   return atTopLevel(ts, parent) ? "last" : "anywhere";
@@ -1653,12 +1733,12 @@ function exportedDeclaration(ts, declaration) {
   return declaration.parent.parent.modifiers?.some((modifier) => modifier.kind === ts.SyntaxKind.ExportKeyword) === true;
 }
 var httpModules = new Set(["http", "https", "node:http", "node:https"]);
-function commonJsExport(ts, node) {
+function commonJsExport2(ts, node) {
   if (!ts.isPropertyAccessExpression(node))
     return false;
   const root = node.expression;
   if (!ts.isIdentifier(root))
-    return commonJsExport(ts, root);
+    return commonJsExport2(ts, root);
   return root.text === "exports" || root.text === "module" && node.name.text === "exports";
 }
 async function serving(context, reference) {
@@ -1708,39 +1788,12 @@ async function collectHandOffs(context, registrars, registrations) {
   }
   return handOffs;
 }
-function entryStart(ts, node) {
-  return ts.isCallExpression(node) && ts.isPropertyAccessExpression(node.expression) ? node.expression.name.getStart() : node.getStart();
-}
-function orderIndices(ts, registrations, handOffs) {
-  const entries = [
-    ...registrations.map(({ call, declaration }) => ({ node: call, declaration, start: entryStart(ts, call), last: false })),
-    ...handOffs.map(({ reference, declaration, last }) => ({
-      node: reference,
-      declaration,
-      start: last ? Number.POSITIVE_INFINITY : reference.getStart(),
-      last
-    }))
-  ];
-  const byRegistrar = new Map;
-  for (const entry of entries)
-    byRegistrar.set(entry.declaration, [...byRegistrar.get(entry.declaration) ?? [], entry]);
-  const indices = new Map;
-  for (const list of byRegistrar.values()) {
-    const files = new Set(list.map(({ node }) => node.getSourceFile()));
-    if (files.size !== 1 || !list.every(({ node, last }) => last || atTopLevel(ts, node)))
-      continue;
-    const sorted = [...list].sort((left, right) => left.start - right.start);
-    for (const [index, { node }] of sorted.entries())
-      indices.set(node, index);
-  }
-  return indices;
-}
 async function routerRegistrations(context, sources, calls) {
   const registrars = await collectRegistrars(context, sources);
   await applyPrefixes(context, calls, registrars);
   const registrations = await collectRegistrations(context, calls, registrars);
   const handOffs = await collectHandOffs(context, registrars, registrations);
-  return { registrars, registrations, handOffs, indices: orderIndices(context.ts, registrations, handOffs) };
+  return { registrars, registrations, handOffs };
 }
 
 // plugins/scanners/http-routes.ts
@@ -1763,25 +1816,35 @@ async function foreignRouter(reading, argument) {
   const origin = await importOrigin(context, argument);
   if (origin?.module.startsWith(".") !== true)
     return false;
+  return !await seenFunction(context, argument);
+}
+async function seenFunction(context, argument) {
   const held = await heldAt(context, argument);
-  return typeof held !== "object" || !ts.isFunctionLike(held.node);
+  return typeof held === "object" && context.ts.isFunctionLike(held.node);
 }
 async function middleware(context, argument) {
   const { ts } = context;
-  const held = await heldAt(context, argument);
-  if (typeof held === "object" && ts.isFunctionLike(held.node))
+  if (await seenFunction(context, argument))
     return true;
   const callee = ts.isCallExpression(argument) ? argument.expression : argument;
   const holder = ts.isPropertyAccessExpression(callee) ? callee.expression : callee;
   const origin = await importOrigin(context, holder);
   return origin !== undefined && !origin.module.startsWith(".");
 }
+async function onlyMiddleware(reading, registration, handlers) {
+  if (registration.member !== "use")
+    return false;
+  return (await Promise.all(handlers.map((handler) => seenFunction(reading.context, handler)))).every(Boolean);
+}
 async function readMount(reading, registration) {
   const [first, ...rest] = registration.call.arguments;
+  const nothing = { children: [], prefix: "", blocks: false };
   if (first === undefined)
-    return { children: [], prefix: "", pathless: true, foreign: false };
+    return nothing;
   const leading = await registrarArgument(reading, first);
   const pathless = leading !== undefined || await foreignRouter(reading, first) || await middleware(reading.context, first);
+  if (!pathless && await onlyMiddleware(reading, registration, rest))
+    return nothing;
   const children = leading === undefined ? [] : [leading];
   for (const argument of rest) {
     const child = await registrarArgument(reading, argument);
@@ -1790,7 +1853,9 @@ async function readMount(reading, registration) {
   }
   const prefix = pathless ? "" : await literalText(reading.context, first);
   const foreign = children.length === 0 && (await Promise.all(registration.call.arguments.map((argument) => foreignRouter(reading, argument)))).some(Boolean);
-  return { children, pathless, foreign, ...prefix === undefined ? {} : { prefix } };
+  const hidden = children.some((child) => reading.registrars.get(child).prefix === undefined);
+  const unfollowed = prefix === undefined ? children.length > 0 : !pathless && children.length === 0;
+  return { children, blocks: foreign || hidden || unfollowed, ...prefix === undefined ? {} : { prefix } };
 }
 async function collectMounts(reading) {
   const mounts = new Map;
@@ -1807,20 +1872,59 @@ async function collectMounts(reading) {
   }
   return { mounts, calls };
 }
+function entryStart(ts, node) {
+  return ts.isCallExpression(node) && ts.isPropertyAccessExpression(node.expression) ? node.expression.name.getStart() : node.getStart();
+}
+function orderIndices(reading, calls) {
+  const { ts } = reading.context;
+  const places = (registration) => {
+    const mount = calls.get(registration);
+    return mount === undefined || mount.children.length > 0 || mount.blocks;
+  };
+  const entries = [
+    ...reading.registrations.filter(places).map(({ call, declaration }) => ({ node: call, declaration, start: entryStart(ts, call), last: false })),
+    ...reading.handOffs.map(({ reference, declaration, last }) => ({
+      node: reference,
+      declaration,
+      start: last ? Number.POSITIVE_INFINITY : reference.getStart(),
+      last
+    }))
+  ];
+  const byRegistrar = new Map;
+  for (const entry of entries)
+    byRegistrar.set(entry.declaration, [...byRegistrar.get(entry.declaration) ?? [], entry]);
+  const indices = new Map;
+  for (const list of byRegistrar.values()) {
+    const files = new Set(list.map(({ node }) => node.getSourceFile()));
+    if (files.size !== 1 || !list.every(({ node, last }) => last || atTopLevel(ts, node)))
+      continue;
+    const sorted = [...list].sort((left, right) => left.start - right.start);
+    for (const [index, { node }] of sorted.entries())
+      indices.set(node, index);
+  }
+  return indices;
+}
 function withPrefix(placement, registrar) {
   return registrar.prefix === "" ? placement : { ...placement, prefix: `${placement.prefix}/${registrar.prefix}` };
 }
-function underMount(routing, mount, entry) {
+function underMount(routing, mount, entry, child) {
   const { ts } = routing.context;
   const parent = routing.registrars.get(mount.declaration);
   const copies = parent.framework === "hono" && mount.member === "route" || parent.framework === "koa" && parent.kind === "router" && mount.member === "use";
   if (!copies)
     return "yes";
-  const ordered = mount.call.getSourceFile() === entry.getSourceFile() && atTopLevel(ts, mount.call) && atTopLevel(ts, entry);
-  if (!ordered)
+  if (mount.call.getSourceFile() !== entry.getSourceFile()) {
+    return entry.getSourceFile() === child.getSourceFile() && atTopLevel(ts, entry) ? "yes" : "unknown";
+  }
+  if (!atTopLevel(ts, mount.call) || !atTopLevel(ts, entry))
     return "unknown";
   return entryStart(ts, entry) < entryStart(ts, mount.call) ? "yes" : "no";
 }
+function applicationId(routing, declaration, variable) {
+  const file = routing.context.file(declaration);
+  const namesakes = [...routing.registrars].filter(([node, registrar]) => registrar.kind === "app" && registrar.variable === variable && routing.context.file(node) === file);
+  return `${file}#${variable}${namesakes.length > 1 ? `@${declaration.getStart()}` : ""}`;
+}
 function placements(routing, declaration, entry, seen = new Set) {
   const registrar = routing.registrars.get(declaration);
   if (seen.has(declaration) || registrar.prefix === undefined)
@@ -1829,12 +1933,12 @@ function placements(routing, declaration, entry, seen = new Set) {
   if (entries.length === 0) {
     if (registrar.kind === "router")
       return [];
-    const application = `${routing.context.file(declaration)}#${registrar.variable}`;
+    const application = applicationId(routing, declaration, registrar.variable);
     const ordered = orderedFrameworks.has(registrar.framework);
     return [withPrefix({ prefix: "", application, rank: [], known: true, ordered, certain: true }, registrar)];
   }
   return entries.flatMap(({ registration, prefix, position }) => {
-    const under = prefix === undefined ? "no" : underMount(routing, registration, entry);
+    const under = prefix === undefined ? "no" : underMount(routing, registration, entry, declaration);
     if (under === "no")
       return [];
     return placements(routing, registration.declaration, registration.call, new Set([...seen, declaration])).map((parent) => {
@@ -1916,7 +2020,7 @@ async function routeCall(routing, registration, placement) {
   if (member === "route" && call.arguments.length === 1)
     return routeOptions(routing, registration, placement);
   const method = routeMethod(member, framework);
-  if (method === undefined || call.arguments.length < 2)
+  if (method === undefined)
     return [];
   const parts = await urlParts(routing.context, await pathArgument(routing, registration));
   const route = parts.length === 1 && parts[0].kind === "text" ? parts[0].text : undefined;
@@ -1929,9 +2033,7 @@ async function routeCall(routing, registration, placement) {
 async function mountCall(routing, registration, placement) {
   const { call } = registration;
   const mount = routing.calls.get(registration);
-  const hidden = mount.children.some((child) => routing.registrars.get(child).prefix === undefined);
-  const unfollowed = mount.prefix === undefined ? mount.children.length > 0 : !mount.pathless && mount.children.length === 0 && call.arguments.length > 1;
-  if (!hidden && !mount.foreign && !unfollowed)
+  if (!mount.blocks)
     return [];
   const parts = await urlParts(routing.context, call.arguments[0]);
   return blocked(routing, placement, mount.prefix ?? readablePrefix(parts), "*", call);
@@ -1945,7 +2047,8 @@ async function registrationEndpoints(routing, registration) {
 }
 async function routerEndpoints(context, sources, calls) {
   const reading = { ...await routerRegistrations(context, sources, calls), context };
-  const routing = { ...reading, ...await collectMounts(reading) };
+  const mounted = await collectMounts(reading);
+  const routing = { ...reading, ...mounted, indices: orderIndices(reading, mounted.calls) };
   const placed = routing.handOffs.flatMap(({ reference, declaration }) => placements(routing, declaration, reference).flatMap((placement) => blocked(routing, placement, "", "*", reference)));
   for (const registration of routing.registrations)
     placed.push(...await registrationEndpoints(routing, registration));
@@ -1969,9 +2072,7 @@ async function serveRoute(context, route, value, call) {
   const path = endpointPath(route);
   const byMethod = await objectEntries(context, value);
   if (byMethod === undefined) {
-    const held = await heldAt(context, value);
-    const handler = typeof held === "object" && context.ts.isFunctionLike(held.node);
-    return handler ? [{ operation: await context.handlerOperation(value, call), method: "*", path }] : [];
+    return await seenFunction(context, value) ? [{ operation: await context.handlerOperation(value, call), method: "*", path }] : [];
   }
   const endpoints = [];
   for (const [key, handler] of byMethod) {
@@ -2014,19 +2115,32 @@ async function optionsBase(context, config, fallback) {
   return base === "absent" ? fallback : heldParts(context, base);
 }
 async function runtimeFetch(context, callee) {
-  if (!context.ts.isIdentifier(callee) || callee.text !== "fetch")
+  if (!context.ts.isIdentifier(callee))
     return;
   const origin = await importOrigin(context, callee);
-  const fetch = origin === undefined ? await runtimeGlobal(context, callee) : origin.module === "node-fetch" && origin.name === "default";
+  const fetch = origin === undefined ? callee.text === "fetch" && await runtimeGlobal(context, callee) : origin.module === "node-fetch" && origin.name === "default" || origin.module === "undici" && origin.name === "fetch";
   return fetch ? "fetch" : undefined;
 }
+async function urlWithoutMethod(context, url, input) {
+  if (input === "unseen")
+    return true;
+  if (typeof input === "object") {
+    const value = unwrapped(context.ts, input.node);
+    if (urlText(context.ts, value))
+      return true;
+    const urlObject = context.ts.isNewExpression(value) && context.ts.isIdentifier(value.expression) && value.expression.text === "URL" && await runtimeGlobal(context, value.expression);
+    if (urlObject)
+      return true;
+  }
+  return context.checker.primitiveAt(url);
+}
 async function fetchRequest(context, call, client) {
   const [url, options] = call.arguments;
   const kind = url === undefined ? undefined : await client(call.expression);
   if (url === undefined || kind === undefined)
     return;
   const input = await heldAt(context, url);
-  const method = input === "unseen" || typeof input === "object" && urlText(context.ts, input.node) ? await declaredMethod(context, options, "GET") : undefined;
+  const method = await urlWithoutMethod(context, url, input) ? await declaredMethod(context, options, "GET") : undefined;
   const parts = await urlParts(context, url);
   const target = kind === "ofetch" ? withBase(await optionsBase(context, options, []), parts) : parts;
   return { ...method === undefined ? {} : { method }, ...requestUrl(target) };
@@ -2065,9 +2179,12 @@ var SHORTHAND = new Map([
   ["patch", "PATCH"],
   ["delete", "DELETE"],
   ["head", "HEAD"],
-  ["options", "OPTIONS"]
+  ["options", "OPTIONS"],
+  ["postForm", "POST"],
+  ["putForm", "PUT"],
+  ["patchForm", "PATCH"]
 ]);
-var WITH_BODY = new Set(["post", "put", "patch"]);
+var WITH_BODY = new Set(["post", "put", "patch", "postForm", "putForm", "patchForm"]);
 async function isAxios(context, node) {
   const origin = await importOrigin(context, node);
   return origin?.module === "axios" && origin.name === "default";
@@ -2093,20 +2210,25 @@ async function axiosClient(context, node) {
     return;
   return await isAxios(context, node) ? defaultClient(context) : createdClient(context, node);
 }
+async function memberRequest(context, receiver, member, call) {
+  const method = SHORTHAND.get(member);
+  if (method === undefined && member !== "request")
+    return;
+  const client = await axiosClient(context, receiver);
+  if (client === undefined)
+    return;
+  const [first, second, third] = call.arguments;
+  if (method !== undefined && first !== undefined) {
+    return sent(context, client, await urlParts(context, first), method, WITH_BODY.has(member) ? third : second);
+  }
+  return member === "request" ? configRequest(context, client, first) : undefined;
+}
 async function axiosRequest(context, call) {
   const { ts } = context;
   const callee = call.expression;
-  const [first, second, third] = call.arguments;
+  const [first, second] = call.arguments;
   if (ts.isPropertyAccessExpression(callee) && ts.isIdentifier(callee.name)) {
-    const client = await axiosClient(context, callee.expression);
-    if (client === undefined)
-      return;
-    const member = callee.name.text;
-    const method = SHORTHAND.get(member);
-    if (method !== undefined && first !== undefined) {
-      return sent(context, client, await urlParts(context, first), method, WITH_BODY.has(member) ? third : second);
-    }
-    return member === "request" ? configRequest(context, client, first) : undefined;
+    return memberRequest(context, callee.expression, callee.name.text, call);
   }
   const client = await axiosClient(context, callee);
   if (client === undefined || first === undefined)
@@ -2288,7 +2410,7 @@ function typeMember(scope, member) {
   return name === undefined ? [] : [symbolAt(scope, name.text, name, memberVisibility(scope, member))];
 }
 function typeMembers(k, statement) {
-  if (is2(statement, k.ClassDeclaration) || is2(statement, k.InterfaceDeclaration))
+  if (is2(statement, k.ClassDeclaration) || is2(statement, k.ClassExpression) || is2(statement, k.InterfaceDeclaration))
     return statement.members;
   return statement.kind === k.EnumDeclaration ? [] : undefined;
 }
@@ -2317,23 +2439,35 @@ function declarationsIn(scope, statements) {
     return [...functionDeclarations(scope, statement), ...typeDeclaration(scope, statement)];
   });
 }
+function listedExportNames(ts, source) {
+  return new Set(source.statements.flatMap((statement) => listedExports(ts.SyntaxKind, statement)));
+}
 function outlineSource(ts, source, context) {
   const k = ts.SyntaxKind;
-  const exported = new Set([...source.statements.flatMap((statement) => listedExports(k, statement)), ...context.exported ?? []]);
+  const exported = new Set([...listedExportNames(ts, source), ...context.exported ?? []]);
   const scope = { k, source, symbols: context.symbols, exported, topLevelPrivate: context.topLevelPrivate ?? false };
   return declarationsIn(scope, source.statements);
 }
+function outlineClassExpression(ts, source, value, context) {
+  if (value.kind !== ts.SyntaxKind.ClassExpression)
+    return [];
+  const scope = {
+    k: ts.SyntaxKind,
+    source,
+    symbols: context.symbols,
+    exported: new Set(context.exported ?? []),
+    topLevelPrivate: context.topLevelPrivate ?? false
+  };
+  return typeDeclaration(scope, value);
+}
 
 // plugins/scanners/javascript/src/outline.ts
 var MODULE_EXTENSION = /\.(?:mjs|cjs)$/;
-function isExportsReference(node) {
-  if (ts5.isIdentifier(node))
-    return node.text === "exports";
-  return ts5.isPropertyAccessExpression(node) && ts5.isIdentifier(node.expression) && node.expression.text === "module" && node.name.text === "exports";
-}
 function assignedNames(value) {
   if (ts5.isIdentifier(value))
     return [value.text];
+  if (ts5.isClassExpression(value) && value.name)
+    return [value.name.text];
   if (!ts5.isObjectLiteralExpression(value))
     return [];
   return value.properties.flatMap((property) => {
@@ -2342,29 +2476,31 @@ function assignedNames(value) {
     return ts5.isPropertyAssignment(property) && ts5.isIdentifier(property.initializer) ? [property.initializer.text] : [];
   });
 }
-function commonJsExport2(statement) {
-  if (!ts5.isExpressionStatement(statement))
-    return;
-  const assignment = statement.expression;
-  if (!ts5.isBinaryExpression(assignment) || assignment.operatorToken.kind !== ts5.SyntaxKind.EqualsToken)
-    return;
-  const { left } = assignment;
-  const target = ts5.isPropertyAccessExpression(left) && isExportsReference(left.expression) ? left.expression : left;
-  return isExportsReference(target) ? assignment : undefined;
-}
 function publishedBy(assignment) {
-  const { left, right } = assignment;
-  if (ts5.isPropertyAccessExpression(left) && isExportsReference(left.expression)) {
+  const { left } = assignment;
+  const right = assignedValue(assignment.right);
+  if (ts5.isPropertyAccessExpression(left) && !(ts5.isIdentifier(left.expression) && left.expression.text === "module" && left.name.text === "exports")) {
     return ts5.isIdentifier(right) ? [right.text] : [];
   }
   return assignedNames(right);
 }
-function statesEcmaScriptModule(source) {
-  return source.statements.some((statement) => ts5.isImportDeclaration(statement) || ts5.isExportDeclaration(statement) || ts5.isExportAssignment(statement) || ts5.canHaveModifiers(statement) && (ts5.getModifiers(statement) ?? []).some((modifier) => modifier.kind === ts5.SyntaxKind.ExportKeyword));
+function usesRequire(source) {
+  let found = false;
+  const visit = (node) => {
+    if (ts5.isCallExpression(node) && ts5.isIdentifier(node.expression) && node.expression.text === "require")
+      found = true;
+    else if (!found)
+      ts5.forEachChild(node, visit);
+  };
+  ts5.forEachChild(source, visit);
+  return found;
+}
+function statesModuleBoundary(source) {
+  return usesRequire(source) || source.statements.some((statement) => ts5.isImportDeclaration(statement) || ts5.isExportDeclaration(statement) || ts5.isExportAssignment(statement) || ts5.canHaveModifiers(statement) && (ts5.getModifiers(statement) ?? []).some((modifier) => modifier.kind === ts5.SyntaxKind.ExportKeyword));
 }
 function publishedNames(file, source) {
-  const exports = source.statements.flatMap((statement) => commonJsExport2(statement) ?? []);
-  if (exports.length > 0 || MODULE_EXTENSION.test(file) || statesEcmaScriptModule(source)) {
+  const exports = source.statements.flatMap((statement) => commonJsExport(statement) ?? []);
+  if (exports.length > 0 || MODULE_EXTENSION.test(file) || statesModuleBoundary(source)) {
     return exports.flatMap(publishedBy);
   }
   return topLevelDeclarations(source).map((declaration) => declaration.name);
@@ -2375,7 +2511,13 @@ async function readJavaScriptOutline(repositoryRoot, references) {
     const fileName = path.join(repositoryRoot, reference.file);
     const text = await readFile(fileName, "utf8");
     const source = ts5.createSourceFile(fileName, text, ts5.ScriptTarget.Latest, true);
-    const declarations = outlineSource(ts5, source, { symbols: reference.symbols, exported: publishedNames(reference.file, source) });
+    const exported = publishedNames(reference.file, source);
+    const classes = source.statements.flatMap((statement) => {
+      const assignment = commonJsExport(statement);
+      const value = assignment && assignedValue(assignment.right);
+      return value && ts5.isClassExpression(value) ? outlineClassExpression(ts5, source, value, { symbols: reference.symbols, exported }) : [];
+    });
+    const declarations = [...outlineSource(ts5, source, { symbols: reference.symbols, exported }), ...classes].sort((left, right) => left.line - right.line);
     if (declarations.length > 0)
       files.push({ file: reference.file, declarations });
   }
@@ -2384,67 +2526,268 @@ async function readJavaScriptOutline(repositoryRoot, references) {
 
 // plugins/scanners/javascript/src/sources.ts
 import { readFile as readFile2 } from "fs/promises";
-import path3 from "path";
-
-// plugins/scanners/projects.ts
-import { execFile } from "child_process";
-import { existsSync } from "fs";
 import path2 from "path";
-import { promisify } from "util";
-var execute = promisify(execFile);
-var excluded = new Set([
-  ".git",
-  "node_modules",
-  "vendor",
-  "target",
-  "dist",
-  "build",
-  "bin",
-  "obj",
-  ".gradle",
-  ".angular",
-  "coverage",
-  "generated",
-  "groma",
-  ".groma"
-]);
-async function repositoryFiles(root, matches) {
-  const { stdout } = await execute("git", ["-C", root, "ls-files", "-z", "--cached", "--others", "--exclude-standard"], { maxBuffer: 64 * 1024 * 1024 });
-  return [...new Set(stdout.split("\x00").filter((file) => file && matches(file) && existsSync(path2.join(root, file))))].sort();
+var SOURCE = /\.(?:js|mjs|cjs|jsx)$/;
+function javaScriptFiles(files) {
+  return files.filter((file) => SOURCE.test(file));
 }
-function projectFiles(root, matches) {
-  return repositoryFiles(root, (file) => matches(file) && !file.split("/").some((part) => excluded.has(part)));
+async function javaScriptSources(root, files) {
+  const sources = [];
+  for (const file of javaScriptFiles(files))
+    sources.push({ file, text: await readFile2(path2.join(root, file), "utf8") });
+  return sources;
 }
 
-// plugins/scanners/javascript/src/sources.ts
-var SOURCE = /\.(?:js|mjs|cjs|jsx)$/;
-var MINIFIED_NAME = /\.min\.(?:js|mjs|cjs|jsx)$/;
-var MINIFIED_LINE_LENGTH = 500;
-function isJavaScriptFile(file) {
-  return SOURCE.test(file);
+// plugins/scanners/entry-points/javascript.ts
+import { readFile as readFile3 } from "fs/promises";
+import path4 from "path";
+
+// plugins/scanners/workspace-packages.ts
+import path3 from "path";
+function inRootDir(file, outputs) {
+  const output = outputs.find(({ outDir }) => file.startsWith(`${outDir}/`));
+  return output === undefined ? undefined : path3.posix.join(output.rootDir, file.slice(output.outDir.length + 1));
 }
-function hasMinifiedName(file) {
-  return MINIFIED_NAME.test(path3.posix.basename(file));
+function sourceOf(file, outputs, files) {
+  const stem = inRootDir(file, outputs)?.replace(/\.(?:d\.[cm]?ts|[cm]?jsx?)$/, "");
+  return stem === undefined ? undefined : [".ts", ".tsx"].map((extension) => `${stem}${extension}`).find((candidate) => files.has(candidate));
 }
-function isMinifiedText(text) {
-  const code = text.trimEnd();
-  return code.length / code.split(`
-`).length >= MINIFIED_LINE_LENGTH;
+var conditions = new Set(["types", "import", "default", "require"]);
+
+// plugins/scanners/entry-points/javascript.ts
+function packageFor(file, packages) {
+  let directory = path4.posix.dirname(file);
+  while (directory !== "." && !packages.has(directory))
+    directory = path4.posix.dirname(directory);
+  return directory;
+}
+function declaredBins(declaration, manifest) {
+  const bins = typeof manifest.bin === "string" ? { [String(manifest.name ?? "main")]: manifest.bin } : manifest.bin;
+  if (!bins || typeof bins !== "object")
+    return [];
+  return Object.entries(bins).flatMap(([name, target]) => typeof target === "string" ? [{ declaration, name, file: path4.posix.join(path4.posix.dirname(declaration), target) }] : []);
+}
+var RUNTIMES = new Set(["node", "bun", "tsx", "ts-node"]);
+var VALUE_OPTIONS = new Set(["-r", "--require", "--import", "--tsconfig"]);
+var SCRIPT = /^[\w./-]+\.[cm]?[jt]sx?$/;
+function runtimeAt(words) {
+  let index = words[0] === "cross-env" ? 1 : 0;
+  while (/^[A-Za-z_]\w*=/.test(words[index] ?? ""))
+    index += 1;
+  return index;
 }
-async function javaScriptSources(root) {
-  const files = await projectFiles(root, (file) => isJavaScriptFile(file) && !hasMinifiedName(file));
-  const sources = [];
-  for (const file of files) {
-    const text = await readFile2(path3.join(root, file), "utf8");
-    if (!isMinifiedText(text))
-      sources.push({ file, text });
+function commandScript(command) {
+  const words = command.trim().split(/\s+/);
+  let index = runtimeAt(words);
+  if (!RUNTIMES.has(words[index] ?? ""))
+    return;
+  let subcommand = true;
+  for (index += 1;index < words.length; index += 1) {
+    const word = words[index];
+    if (VALUE_OPTIONS.has(word))
+      index += 1;
+    else if (subcommand && (word === "run" || word === "watch"))
+      subcommand = false;
+    else if (!word.startsWith("-"))
+      return SCRIPT.test(word) ? word : undefined;
+  }
+  return;
+}
+function declaredScripts(declaration, scripts) {
+  return Object.entries(scripts ?? {}).flatMap(([name, script]) => {
+    if (typeof script !== "string")
+      return [];
+    const commands = /["'`]/.test(script) ? [script] : script.split(/\s+&&\s+/);
+    return commands.flatMap((command) => {
+      const file = commandScript(command);
+      return file === undefined ? [] : [{ declaration, name, file: path4.posix.join(path4.posix.dirname(declaration), file) }];
+    });
+  });
+}
+var isString = (value) => typeof value === "string";
+function buildEntry(declaration, workspace, name, project) {
+  const build = (project.architect ?? project.targets)?.build;
+  const main = build?.options?.browser ?? build?.options?.main;
+  if (!isString(main))
+    return [];
+  const replacements = Object.values(build?.configurations ?? {}).flatMap((configuration) => Array.isArray(configuration.fileReplacements) ? configuration.fileReplacements.map((replacement) => replacement?.with) : []);
+  const at = (file) => path4.posix.join(workspace, file);
+  return [{ declaration, name, file: at(main), compiled: [build?.options?.polyfills, ...replacements].flat().filter(isString).map(at) }];
+}
+function angularEntries(declaration, source) {
+  const projects = JSON.parse(source).projects ?? {};
+  return Object.entries(projects).flatMap(([name, project]) => buildEntry(declaration, path4.posix.dirname(declaration), name, project));
+}
+function nxEntries(declaration, source, workspaces) {
+  const workspace = packageFor(declaration, workspaces);
+  if (!workspaces.has(workspace))
+    return [];
+  const project = JSON.parse(source);
+  return buildEntry(declaration, workspace, project.name ?? path4.posix.basename(path4.posix.dirname(declaration)), project);
+}
+function browserEntries(declaration, source, packages) {
+  const scripts = [...source.matchAll(/<script\b[^>]*\bsrc\s*=\s*["']([^"']+)["'][^>]*>/gi)];
+  const folder = path4.posix.dirname(declaration);
+  const page = path4.posix.basename(declaration, ".html");
+  const name = page === "index" && folder !== "." ? path4.posix.basename(folder) : page;
+  return scripts.flatMap((match) => {
+    const src = match[1];
+    if (/^(?:[a-z]+:|\/\/)/i.test(src))
+      return [];
+    const base = src.startsWith("/") ? packageFor(declaration, packages) : folder;
+    return [{ file: path4.posix.join(base, src.replace(/^\//, "")), declaration, name }];
+  });
+}
+function reachedFiles(entry, compiled, imports, packages, units) {
+  const owner = packageFor(entry, packages), found = new Set;
+  const pending = [entry, ...compiled];
+  while (pending.length) {
+    const file = pending.pop();
+    if (found.has(file) || packageFor(file, packages) !== owner)
+      continue;
+    found.add(file);
+    pending.push(...imports.get(file) ?? []);
   }
-  return sources;
+  for (const unit of units)
+    if (found.has(unit.primary))
+      for (const file of unit.files)
+        found.add(file);
+  return found;
+}
+async function declaredEntries(root, declarations, packages, workspaces) {
+  const entries = [];
+  for (const file of declarations) {
+    const text = await readFile3(path4.join(root, file), "utf8");
+    const name = path4.posix.basename(file);
+    if (name === "package.json") {
+      const manifest = JSON.parse(text);
+      entries.push(...declaredBins(file, manifest), ...declaredScripts(file, manifest.scripts));
+    } else if (name === "angular.json")
+      entries.push(...angularEntries(file, text));
+    else if (name === "project.json")
+      entries.push(...nxEntries(file, text, workspaces));
+    else if (file.endsWith(".html"))
+      entries.push(...browserEntries(file, text, packages));
+  }
+  return entries;
+}
+function sourced(entry, files, outputs = []) {
+  const file = sourceOf(entry.file, outputs, files);
+  return file === undefined ? entry : { ...entry, file };
+}
+async function withJavaScriptEntries(root, observation, inputs, files) {
+  if (!observation)
+    return;
+  const inventory = files.filter((file) => ["package.json", "angular.json", "project.json", "nx.json"].includes(path4.posix.basename(file)) || file.endsWith(".html"));
+  const workspaces = new Set(inventory.filter((file) => path4.posix.basename(file) === "nx.json").map((file) => path4.posix.dirname(file)));
+  const packages = new Set(inventory.filter((file) => path4.posix.basename(file) === "package.json").map((file) => path4.posix.dirname(file)));
+  const active = new Set(observation.files.map((file) => packageFor(file.file, packages)));
+  const declarations = inventory.filter((file) => path4.posix.basename(file) !== "nx.json" && active.has(packageFor(file, packages)));
+  const entries = [...inputs.entries, ...await declaredEntries(root, declarations, packages, workspaces)];
+  const inventoryFiles = [...observation.files];
+  const visible = new Set(inventoryFiles.map((file) => file.file));
+  const readable = new Set(files);
+  const entryPoints = entries.map((entry) => sourced(entry, readable, inputs.buildOutputs)).flatMap(({ compiled = [], ...entry }) => {
+    if (!inputs.imports.has(entry.file))
+      return [];
+    const reached = reachedFiles(entry.file, compiled, inputs.imports, packages, observation.sourceUnits ?? []);
+    const members = observation.files.filter((file) => reached.has(file.file));
+    if (!members.length)
+      return [];
+    if (!visible.has(entry.file)) {
+      inventoryFiles.push({ file: entry.file, symbols: [], roots: [...new Set(members.flatMap((file) => file.roots))] });
+      visible.add(entry.file);
+    }
+    return [{ ...entry, files: [...new Set([entry.file, ...members.map((file) => file.file)])] }];
+  });
+  return createScanObservation({ ...observation, files: inventoryFiles, entryPoints });
+}
+
+// plugins/scanners/javascript/src/entries.ts
+import path6 from "path";
+import ts6 from "./typescript.cjs";
+
+// plugins/scanners/entry-points/source.ts
+import path5 from "path";
+var relative = (root, file) => path5.relative(root, path5.resolve(root, file)).split(path5.sep).join("/");
+async function text2(context, node) {
+  if (!node)
+    return;
+  const parts = await urlParts(context, node);
+  return parts.every((part) => part.kind === "text") ? parts.map((part) => part.kind === "text" ? part.text : "").join("") : undefined;
+}
+async function entryPath(root, context, node) {
+  const { ts } = context;
+  const direct = await text2(context, node);
+  if (direct !== undefined)
+    return relative(root, direct);
+  if (!ts.isCallExpression(node))
+    return;
+  const origin = await importOrigin(context, node.expression);
+  if (origin?.name !== "fileURLToPath" || !["node:url", "url"].includes(origin.module))
+    return;
+  const url = node.arguments[0];
+  if (!url || !ts.isNewExpression(url) || !ts.isIdentifier(url.expression) || url.expression.text !== "URL" || !await runtimeGlobal(context, url.expression))
+    return;
+  const base = url.arguments?.[1];
+  if (!base || !ts.isPropertyAccessExpression(base) || base.name.text !== "url" || !ts.isMetaProperty(base.expression))
+    return;
+  const value = await text2(context, url.arguments?.[0]);
+  return value === undefined ? undefined : relative(root, path5.resolve(root, path5.dirname(node.getSourceFile().fileName), value));
+}
+async function buildEntries(root, context, call) {
+  const { ts } = context;
+  const callee = call.expression;
+  if (!ts.isPropertyAccessExpression(callee) || callee.name.text !== "build" || !ts.isIdentifier(callee.expression) || callee.expression.text !== "Bun" || !await runtimeGlobal(context, callee.expression))
+    return [];
+  const fields = await objectEntries(context, call.arguments[0]);
+  if (!fields)
+    return [];
+  const compile = fields.get("compile"), entrypoints = fields.get("entrypoints");
+  const executable = compile && await heldAt(context, compile);
+  const native = typeof executable === "object" && (executable.node.kind === ts.SyntaxKind.TrueKeyword || ts.isObjectLiteralExpression(executable.node));
+  if (!native && await literalText(context, fields.get("target")) !== "browser")
+    return [];
+  const array = entrypoints && await heldAt(context, entrypoints);
+  if (typeof array !== "object" || !ts.isArrayLiteralExpression(array.node))
+    return [];
+  const declaration = relative(root, call.getSourceFile().fileName);
+  const files = await Promise.all(array.node.elements.map((node) => entryPath(root, context, node)));
+  return files.flatMap((file) => file === undefined ? [] : [{ file, declaration, name: path5.posix.basename(file).replace(/\.[^.]+$/, "") }]);
+}
+async function sourceBuildEntries(root, ts, checker, sources) {
+  const context = urlContext(ts, checker, sources);
+  const calls = [];
+  const visit = (node) => {
+    if (ts.isCallExpression(node))
+      calls.push(node);
+    ts.forEachChild(node, visit);
+  };
+  for (const source of sources)
+    visit(source);
+  return (await Promise.all(calls.map((call) => buildEntries(root, context, call)))).flat();
+}
+
+// plugins/scanners/javascript/src/entries.ts
+async function javaScriptEntries(root, sources) {
+  const files = new Set(sources.map((source) => source.fileName));
+  const imports = new Map(sources.map((source) => {
+    const targets = ts6.preProcessFile(source.text, true, true).importedFiles.flatMap((imported) => {
+      if (!imported.fileName.startsWith("."))
+        return [];
+      const base = path6.posix.normalize(path6.posix.join(path6.posix.dirname(source.fileName), imported.fileName));
+      const candidates = [base, ...[".js", ".mjs", ".cjs", ".jsx"].flatMap((extension) => [base + extension, `${base}/index${extension}`])];
+      return candidates.find((file) => files.has(file)) ?? [];
+    });
+    return [source.fileName, targets];
+  }));
+  const entries = (await Promise.all(sources.map((source) => sourceBuildEntries(root, ts6, classicChecker(ts6, fileChecker(source)), [source])))).flat();
+  return { imports, entries };
 }
 
 // plugins/scanners/javascript/src/index.ts
 function parse(source) {
-  return ts6.createSourceFile(source.file, source.text, ts6.ScriptTarget.Latest, true);
+  return ts7.createSourceFile(source.file, source.text, ts7.ScriptTarget.Latest, true);
 }
 var SLOPPY_MODE_ONLY = new Set([1121, 1487, 1488, 1489]);
 function parseWarning(source) {
@@ -2457,23 +2800,19 @@ function parseWarning(source) {
     code: "JAVASCRIPT_SOURCE_INVALID",
     file: source.fileName,
     line: source.getLineAndCharacterOfPosition(first.start).line + 1,
-    message: `The file does not parse, so it contributes no evidence: ${ts6.flattenDiagnosticMessageText(first.messageText, " ")}`
+    message: `The file does not parse, so it contributes no evidence: ${ts7.flattenDiagnosticMessageText(first.messageText, " ")}`
   };
 }
 var src_default = {
   id: "javascript",
-  watch: {
-    include: ["**/*.js", "**/*.mjs", "**/*.cjs", "**/*.jsx"],
-    exclude: ["**/*.min.js", "**/*.min.mjs", "**/*.min.cjs", "**/*.min.jsx"]
-  },
-  listSourceFiles: async (root) => (await javaScriptSources(root)).map((source) => source.file),
-  async checkReadiness(root) {
-    if (!(await javaScriptSources(root)).length) {
-      throw new Error("javascript: No authored JavaScript source files were found in the Git repository.");
+  listSourceFiles: async (_root, _settings, candidates) => javaScriptFiles(candidates),
+  async checkReadiness(_root, _settings, files) {
+    if (!javaScriptFiles(files).length) {
+      throw new Error("javascript: No JavaScript source files were found in the Git repository.");
     }
   },
-  async scan(root) {
-    const sources = await javaScriptSources(root);
+  async scan(root, _settings, files) {
+    const sources = await javaScriptSources(root, files);
     if (!sources.length)
       return;
     const parsed = sources.map(parse);
@@ -2484,9 +2823,9 @@ var src_default = {
       return { file: source.fileName, evidence, facts: await javaScriptHttpFacts(source, evidence) };
     }));
     const symbols = new Map(scanned.map(({ file, evidence }) => [file, evidence.symbols]));
-    return createScanObservation({
-      scanner: { id: "javascript", technology: "javascript", engine: "typescript-sdk", engineVersion: ts6.version },
-      roots: [{ id: "javascript-source", kind: "source-group", name: path4.basename(root) }],
+    return withJavaScriptEntries(root, createScanObservation({
+      scanner: { id: "javascript", technology: "javascript", engine: "typescript-sdk", engineVersion: ts7.version },
+      roots: [{ id: "javascript-source", kind: "source-group", name: path7.basename(root) }],
       files: parsed.map(({ fileName: file }) => ({ file, symbols: symbols.get(file) ?? [], roots: ["javascript-source"] })),
       operations: scanned.flatMap(({ evidence }) => evidence.operations),
       invocations: scanned.flatMap(({ evidence }) => evidence.invocations),
@@ -2500,7 +2839,7 @@ var src_default = {
         },
         ...warnings.filter((warning) => warning !== undefined)
       ]
-    });
+    }), await javaScriptEntries(root, readable), files);
   },
   readCodeStructure: readJavaScriptOutline
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@groma/scanner-javascript",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "JavaScript source declarations, outlines and operation bodies without project dependencies.",
   "private": false,
   "type": "module",
@@ -9,6 +9,26 @@
     "scanner": {
       "id": "javascript",
       "entry": "./dist/index.js",
+      "include": [
+        "**/*.js",
+        "**/*.mjs",
+        "**/*.cjs",
+        "**/*.jsx",
+        "**/package.json",
+        "**/*.html",
+        "**/project.json",
+        "**/nx.json"
+      ],
+      "exclude": [
+        "*.min.js",
+        "*.min.mjs",
+        "*.min.cjs",
+        "*.min.jsx",
+        "node_modules/",
+        "dist/",
+        "build/",
+        "coverage/"
+      ],
       "discovery": {
         "technologies": [
           "javascript"
@@ -28,7 +48,7 @@
           }
         ],
         "compatibility": {
-          "groma": "^0.3.0"
+          "groma": ">=0.5.0"
         }
       }
     }

package/validation.md

@@ -9,7 +9,7 @@ project build were installed or run.
   manifest rule.
 - 47 authored files were inventoried with 122 declarations, 1,249 operations,
   758 of them carrying body tokens, and 4,762 calls, every one unresolved.
-- 579 files under `vendor/` stayed out through the shared Git boundary.
+- 579 files under `vendor/` stayed out of the scan.
 - Repeating the scan produced identical evidence. The first fold created 49
   elements; folding the same evidence again created none and refreshed the same
   47 files.
@@ -22,16 +22,10 @@ project build were installed or run.
   no HTTP row was derived there.
 - Each scan of the whole project finished in under a second.
 
-The minified rules were measured against 137 authored candidate files in four
-JavaScript repositories. The longest-lined authored file averaged 57 characters
-per line. Exactly one file reached the 500-character average: a built asset under
-an ordinary `.js` name, which the rule excluded. Vendored and built directories
-are already outside the shared Git boundary.
-
 The independent `javascript-source` fixture verifies ECMAScript modules,
 CommonJS, JSX, a browser script whose top-level calls belong to the module,
 exact source positions, tokens on named bodies only, and the exclusion of a
-`.min.js` name, of a long-lined bundle, and of the TypeScript file beside them.
+`.min.js` name by the default exclusions and of the TypeScript file beside it.
 `javascript-outline` verifies the declaration list and the module, CommonJS and
 script visibility rules, including a CommonJS file that publishes a function value
 and keeps its own helpers private; `javascript-parity` verifies that one body