@hoanghainh/komagu 2.0.1 → 2.1.0

package/CHANGELOG.md

@@ -2,6 +2,19 @@
 
 All notable changes to `@hoanghainh/komagu` (published as `komainu-guard` up to v1.7.0) are documented here. From v1.2.2 on, entries are generated by [release-please](https://github.com/googleapis/release-please) from [Conventional Commits](https://www.conventionalcommits.org/). Earlier entries are copied from the [GitHub Releases](https://github.com/hoanghainh1188/komainu/releases).
 
+## [2.1.0](https://github.com/hoanghainh1188/komagu/compare/v2.0.1...v2.1.0) (2026-11-01)
+
+
+### Features
+
+* **assess:** detect Next.js and map App Router routes and server actions ([#330](https://github.com/hoanghainh1188/komagu/issues/330)) ([d494891](https://github.com/hoanghainh1188/komagu/commit/d494891218d0f2c7961c325271daa82950d06923))
+
+
+### Bug Fixes
+
+* **assess:** exclude framework build output from default scan scope ([#327](https://github.com/hoanghainh1188/komagu/issues/327)) ([317049e](https://github.com/hoanghainh1188/komagu/commit/317049ee4c50c0e6a64ba004d87f214c7299d646))
+* **assess:** stop flagging parameterizing sql tagged templates as injection ([#329](https://github.com/hoanghainh1188/komagu/issues/329)) ([3456655](https://github.com/hoanghainh1188/komagu/commit/3456655c7bd62f7a68d6b8d3499d0b06268d7db8))
+
 ## [2.0.1](https://github.com/hoanghainh1188/komagu/compare/v2.0.0...v2.0.1) (2026-10-31)
 
 

package/assess/lsa/knowledge/injection-patterns.md

@@ -57,7 +57,9 @@ Parameterization Cheat Sheet; CWE-89, CWE-564, CWE-943.
   `selectall_arrayref`, `selectrow_*`.
 - **ColdFusion**: `<cfquery>` body, `queryExecute("..." & x)`.
 - **Node**: `connection.query`, `pool.query`, `sequelize.query`,
-  `knex.raw`, `db.collection(...).find/aggregate/$where`.
+  `knex.raw`, `db.collection(...).find/aggregate/$where`, Prisma
+  `$queryRawUnsafe` / `$executeRawUnsafe`, and raw fragments inside tagged
+  templates: Drizzle / postgres.js `sql.raw(x)`, `sql.unsafe(x)`, `Prisma.raw(x)`.
 - **Python**: `cursor.execute`, `executemany`, `engine.execute`,
   `Model.objects.raw`, `extra(where=...)`.
 - **Ruby**: `find_by_sql`, `where("...#{}")`, `order(params[:sort])`,
@@ -80,6 +82,7 @@ Parameterization Cheat Sheet; CWE-89, CWE-564, CWE-943.
 | Regex "no quotes" / blacklist (`select`, `union`) | No | Treat as unsanitized; mention in notes. |
 | `magic_quotes_gpc` | No | Removed in PHP 5.4; never rely on it. |
 | ORM entity methods (`find($id)`, `Where(x => x.Id == id)`) | Yes | Not raw. |
+| JS tagged templates: Drizzle / postgres.js / Slonik `` sql`... ${x}` ``, `` Prisma.sql`...` ``, `` prisma.$queryRaw`...` `` | Yes | `${x}` is sent as a bound parameter. Not the same as an untagged template passed to `db.execute(...)` or `$queryRawUnsafe(...)`, and not `sql.raw(x)` / `Prisma.raw(x)` inside the template, which insert raw text. |
 
 ## 4. NoSQL specifics
 
@@ -115,6 +118,10 @@ A string that is built but **never sent to any sink** is not a finding: verdict
   (`"IN (" + String.join(",", Collections.nCopies(n, "?")) + ")"`) — safe if
   values are bound afterwards.
 - Log or error messages that contain SQL keywords.
+- `sql-raw-fragment` whose argument is a schema object or constant
+  (`sql.raw(`'${seq.seqName}'`)` with `seq = pgSequence("customer_code_seq")`)
+  — not attacker-controlled. The pre-scan marks these `priority: low` when no
+  request input is in the file.
 - MyBatis `#{}` (safe) vs `${}` (unsafe) — do not confuse.
 - Session-only values (`$_SESSION['uid']` set by the server at login) — not
   attacker-controlled, but note if the session value itself came from an

package/assess/lsa/knowledge/stacks/nextjs.md

@@ -0,0 +1,62 @@
+# Next.js Knowledge Profile (App Router, Pages Router, Server Actions)
+
+## Stack Identification
+- **Markers:** `next.config.(js|mjs|ts)`, `"next"` in `package.json`, an `app/` or `src/app/` tree with
+  `route.ts` / `page.tsx`, a `pages/api/` tree, imports from `next/server`, `next/navigation`, `next/headers`.
+- **Auth libraries:** Auth.js / NextAuth (`auth()`, `getServerSession`), Better Auth (`getSession`,
+  `getSessionCookie`), Clerk (`auth()`, `currentUser()`), Lucia, iron-session, or a project wrapper such as
+  `withAuth(handler, { permission })`.
+- **Data access:** Drizzle (`db.query.x.findFirst`, `db.select().from(x).where(...)`), Prisma
+  (`prisma.x.findUnique`), postgres.js, `@vercel/postgres`, Mongoose.
+
+## Entry points (what the pre-scan inventories)
+| Kind | File | URL | Notes |
+|---|---|---|---|
+| Route handler | `app/**/route.ts` | folder path; `(group)` and `@slot` dropped, `[id]` → `{id}`, `[...x]` / `[[...x]]` → `{x*}` | One route per exported `GET`/`POST`/... function or `export const GET = wrap(...)`. `_folder` is private (not routed). |
+| Pages API | `pages/api/**.ts` | `/api/...`, `index` dropped | One handler for all methods; method from `req.method` checks. |
+| Server action | file starting with `"use server"`, or a function whose body starts with `"use server"` | `action:<file>#<name>` | **Every exported function is a public POST endpoint**, callable with any arguments, even if the UI never calls it that way. |
+| Page | `app/**/page.tsx` with a dynamic segment or `searchParams` | folder path | A GET that renders data loaded by id. |
+
+## Where the guard lives
+1. **`middleware.ts` / `proxy.ts` (Next.js 16):** runs before routes listed in `config.matcher`. Usually only
+   checks that a session cookie exists; it rarely checks roles or ownership, and a matcher gap leaves routes
+   open. Never accept middleware alone as an ownership check.
+2. **Per handler:** `const session = await auth(); if (!session) return 401`, or a wrapper (`withAuth`).
+   Check the wrapper once and reuse the result for every route that uses it.
+3. **Server actions:** need their own check inside the action. Layout or page checks do **not** protect an
+   action, because the action can be called directly.
+
+## BOLA / IDOR Patterns
+- **Vulnerable:** id from `params` / `searchParams` / action argument / JSON body used without the user or
+  tenant in the query:
+  ```ts
+  export async function GET(_req: Request, { params }: { params: Promise<{ id: string }> }) {
+    const { id } = await params;
+    const order = await db.query.orders.findFirst({ where: eq(orders.id, id) }); // any user's order
+    return Response.json(order);
+  }
+
+  "use server";
+  export async function cancelOrder(orderId: number) {
+    const session = await auth();          // authenticated, but...
+    await db.update(orders).set({ status: "cancelled" }).where(eq(orders.id, orderId)); // ...not owner-scoped
+  }
+  ```
+- **Protected:** the session user or tenant is part of the lookup, or the loaded row is compared to it, and
+  a miss returns 404:
+  ```ts
+  const order = await db.query.orders.findFirst({
+    where: and(eq(orders.id, id), eq(orders.tenantId, session.user.tenantId)),
+  });
+  if (!order) return new Response(null, { status: 404 });
+  ```
+- **Mass assignment:** `db.update(users).set(await req.json())` or spreading `formData` into `.set({...})`
+  lets a user write `role`, `tenantId`, `ownerId`.
+- **BFLA:** admin routes guarded only by "is logged in" (middleware cookie check, `auth()` without a role or
+  permission check).
+
+## SQL Injection Patterns
+- **Safe:** Drizzle query builder, Drizzle / postgres.js / Prisma tagged templates (`` sql`... ${x}` ``,
+  `` prisma.$queryRaw`...` ``): `${x}` is a bound parameter.
+- **Vulnerable:** `sql.raw(x)`, `sql.unsafe(x)`, `Prisma.raw(x)`, `$queryRawUnsafe(`...${x}`)`, or an untagged
+  template passed to `db.execute(...)`, with `x` from the request.

package/assess/lsa/prompts/_shared-rules.md

@@ -84,6 +84,7 @@ Batch files list the right files in `knowledge_files`. If they do not:
 | `classic-asp` | `knowledge/stacks/classic-asp.md` |
 | `perl` | `knowledge/stacks/perl-cgi.md` |
 | `coldfusion` | `knowledge/stacks/coldfusion.md` |
+| `node-nextjs` | `knowledge/stacks/nextjs.md` |
 | `node`, `python`, `ruby` | `knowledge/stacks/node-python-ruby.md` |
 | `sql-procedures` | `knowledge/injection-patterns.md` §1 (stored procedures) |
 

package/assess/lsa/scripts/detect_stack.py

@@ -61,6 +61,8 @@ RULES = [
     ("go-gorilla", "go", "go.md", [("text", r"github\.com/gorilla/mux|mux\.NewRouter")]),
     ("python-fastapi", "python", "node-python-ruby.md", [("text", r"from\s+fastapi\s+import|import\s+fastapi|FastAPI\s*\(")]),
     ("node-nestjs", "typescript", "node-python-ruby.md", [("text", r"@nestjs/(common|core|swagger)")]),
+    ("node-nextjs", "typescript", "nextjs.md", [("name", r"(^|/)next\.config\.(js|mjs|cjs|ts|mts)$"),
+                                                ("text", r"from\s+['\"]next/(server|navigation|headers|cache)['\"]")]),
 ]
 
 DATA_ACCESS = [
@@ -85,6 +87,8 @@ DATA_ACCESS = [
     ("SQLAlchemy (Python)", r"sqlalchemy\.|create_engine|SessionLocal"),
     ("Prisma (Node/TS)", r"PrismaClient|@prisma/client"),
     ("TypeORM (Node/TS)", r"typeorm|@Entity|getRepository"),
+    ("Drizzle ORM (Node/TS)", r"drizzle-orm"),
+    ("postgres.js (Node/TS)", r"from\s+['\"]postgres['\"]|require\(\s*['\"]postgres['\"]\s*\)"),
 ]
 
 DB_HINTS = [
@@ -94,7 +98,7 @@ DB_HINTS = [
 ]
 
 TEXT_SAMPLE_EXTS = {".sql", ".php", ".inc", ".java", ".jsp", ".xml", ".cs", ".vb", ".aspx", ".asax", ".config", ".asp",
-                    ".pl", ".pm", ".cgi", ".cfm", ".cfc", ".js", ".mjs", ".ts", ".py", ".rb", ".kt", ".kts",
+                    ".pl", ".pm", ".cgi", ".cfm", ".cfc", ".js", ".mjs", ".ts", ".tsx", ".jsx", ".py", ".rb", ".kt", ".kts",
                     ".rs", ".go", ".toml", ".mod"}
 
 

package/assess/lsa/scripts/find_injection.py

@@ -28,7 +28,7 @@ LANG_BY_EXT = {
     ".asp": "vb", ".asa": "vb",
     ".pl": "perl", ".pm": "perl", ".cgi": "perl",
     ".cfm": "cfml", ".cfc": "cfml", ".cfml": "cfml",
-    ".js": "js", ".mjs": "js", ".ts": "js", ".py": "python", ".rb": "ruby",
+    ".js": "js", ".mjs": "js", ".cjs": "js", ".mts": "js", ".ts": "js", ".tsx": "js", ".jsx": "js", ".py": "python", ".rb": "ruby",
     ".rs": "rust", ".go": "go",
     ".xml": "xml", ".sql": "sql",
 }
@@ -108,6 +108,28 @@ ASSIGN = {
     "rust": re.compile(r"\b(\w+)\s*(\+=|=)(?!=)"), "go": re.compile(r"\b(\w+)\s*(\+=|=)(?!=)"),
 }
 APPEND_CALL = re.compile(r"\b(\w+)\s*\.\s*(append|Append|AppendLine|concat)\s*\(")
+# JS/TS tagged templates that bind ${...} as parameters: Drizzle / postgres.js / Slonik `sql`, Prisma.sql, $queryRaw
+SQL_TAG = re.compile(r"(?:(?<![\w$])(?:[\w$]+\.)*sql|\$queryRaw|\$executeRaw)\s*(?:<[^`]*>)?\s*$")
+# escape hatches that put raw text into a tagged template
+RAW_FRAGMENT = re.compile(r"\b(?:sql\.raw|sql\.unsafe|Prisma\.raw)\s*\(")
+
+
+def untagged(line: str, lits: List[re.Match], lang: str) -> List[re.Match]:
+    """Drop JS template literals whose tag binds interpolations as query parameters."""
+    if lang != "js":
+        return lits
+    return [m for m in lits if not (m.group(0).startswith("`") and SQL_TAG.search(line[:m.start()]))]
+
+
+def raw_fragment_arg_is_constant(arg: str) -> bool:
+    """True when sql.raw(...) gets a plain string literal (no ${...})."""
+    arg = arg.lstrip()
+    if arg[:1] in ("'", '"'):
+        return True
+    if arg[:1] == "`":
+        end = arg.find("`", 1)
+        return end != -1 and "${" not in arg[1:end]
+    return False
 
 
 def strip_literals(line: str, lit: re.Pattern) -> str:
@@ -188,7 +210,8 @@ class Finder:
         self.seen = set()
         self.suppressed: List[Dict] = []
 
-    def add(self, lang, rel, lineno, lines, rule, subtype, category, sql_var=None, file_has_input=False):
+    def add(self, lang, rel, lineno, lines, rule, subtype, category, sql_var=None, file_has_input=False,
+            low_without_input=False):
         key = (rel, lineno)
         if key in self.seen:
             return
@@ -209,7 +232,8 @@ class Finder:
             "file": rel, "line": lineno, "snippet": redact(snippet(lines, lineno)),
             "sql_var": sql_var, "input_hint": hint,
             "sanitizer_hints": sorted(set(m.group(0)[:30] for m in SANITIZER_RE.finditer(ctx)))[:5],
-            "priority": "high" if hint in ("request_input_on_line", "request_input_nearby") else "normal",
+            "priority": "high" if hint in ("request_input_on_line", "request_input_nearby")
+            else "low" if low_without_input and hint == "none" else "normal",
         })
 
     # ----------------------------------------------------------------------------------
@@ -224,7 +248,7 @@ class Finder:
         for i, line in enumerate(lines, 1):
             if com and com.search(line):
                 continue
-            lits = literals(line, lit)
+            lits = untagged(line, literals(line, lit), lang)
             if not any(STRONG_SQL.search(m.group(0)) for m in lits):
                 continue
             if assign_rx:
@@ -258,7 +282,7 @@ class Finder:
                     if heredoc_sql and INTERP[lang].search(line):
                         self.add(lang, rel, i, lines, "heredoc-interpolation", "string_interpolation", "sql", None, file_has_input)
                     continue
-            lits = literals(line, lit)
+            lits = untagged(line, literals(line, lit), lang)
             sql_lits = [m for m in lits if STRONG_SQL.search(m.group(0))]
             target_var = None
             if assign_rx:
@@ -300,6 +324,11 @@ class Finder:
         for i, line in enumerate(lines, 1):
             if com and com.search(line):
                 continue
+            if lang == "js":
+                fm = RAW_FRAGMENT.search(line)
+                if fm and not raw_fragment_arg_is_constant(line[fm.end():]):
+                    self.add(lang, rel, i, lines, "sql-raw-fragment", "raw_fragment", "sql", None, file_has_input,
+                             low_without_input=True)
             rm = RAW_APIS.search(line)
             if rm:
                 arg = line[rm.end():].strip()

package/assess/lsa/scripts/lsa_common.py

@@ -15,7 +15,14 @@ DEFAULT_CONFIG: Dict = {
         "include": [],
         "exclude": ["vendor/", "node_modules/", "bower_components/", "packages/", "bin/", "obj/",
                     "target/", "build/", "dist/", ".git/", ".svn/", ".hg/", "test/", "tests/", "spec/", "docs/",
-                    "*.min.js", "*jquery*.js"],
+                    # framework build output and caches
+                    ".next/", ".nuxt/", ".output/", ".svelte-kit/", ".vercel/", ".netlify/", ".turbo/",
+                    ".parcel-cache/", ".cache/", "out/", "storybook-static/",
+                    # test and coverage output
+                    "coverage/", "test-results/", "playwright-report/", ".nyc_output/",
+                    # Python environments and caches
+                    "__pycache__/", ".venv/", "venv/", ".tox/", ".mypy_cache/", ".pytest_cache/",
+                    "*.min.js", "*jquery*.js", "*.map"],
         "web_roots": [],
         "file_endpoints": "all",
         "max_file_kb": 1024,
@@ -41,7 +48,7 @@ SOURCE_EXTS = {
     ".asp", ".asa",
     ".pl", ".pm", ".cgi",
     ".cfm", ".cfc", ".cfml",
-    ".js", ".mjs", ".ts", ".py", ".rb", ".erb", ".sql",
+    ".js", ".mjs", ".cjs", ".mts", ".ts", ".tsx", ".jsx", ".py", ".rb", ".erb", ".sql",
     ".rs", ".go", ".toml", ".mod",
 }
 

package/assess/lsa/scripts/make_batches.py

@@ -22,7 +22,8 @@ sys.path.insert(0, str(Path(__file__).resolve().parent))
 from lsa_common import load_config, read_json, write_json  # noqa: E402
 
 STACK_KNOWLEDGE = [("php", "php.md"), ("java", "java.md"), ("dotnet", "dotnet.md"), ("classic-asp", "classic-asp.md"),
-                   ("perl", "perl-cgi.md"), ("coldfusion", "coldfusion.md"), ("node", "node-python-ruby.md"),
+                   ("perl", "perl-cgi.md"), ("coldfusion", "coldfusion.md"), ("node-nextjs", "nextjs.md"),
+                   ("node", "node-python-ruby.md"),
                    ("python", "node-python-ruby.md"), ("ruby", "node-python-ruby.md")]
 LANG_KNOWLEDGE = {"php": "php.md", "java": "java.md", "xml": "java.md", "cs": "dotnet.md", "vb": "dotnet.md",
                   "aspx": "dotnet.md", "perl": "perl-cgi.md", "cfml": "coldfusion.md", "js": "node-python-ruby.md",

package/assess/lsa/scripts/map_routes.py

@@ -21,6 +21,7 @@ from typing import Dict, List, Optional, Tuple
 sys.path.insert(0, str(Path(__file__).resolve().parent))
 from lsa_common import (KIT_VERSION, compile_id_patterns, is_id_name, iter_source_files,  # noqa: E402
                         line_of, load_config, read_text, write_json)
+from nextjs_routes import middleware_note, nextjs_declared  # noqa: E402
 from privilege import annotate_privilege  # noqa: E402
 
 # --------------------------------------------------------------------------------------
@@ -138,7 +139,7 @@ LANG_BY_EXT = {
     ".asp": "asp", ".asa": "asp",
     ".pl": "perl", ".pm": "perl", ".cgi": "perl",
     ".cfm": "cfml", ".cfc": "cfml", ".cfml": "cfml",
-    ".js": "js", ".mjs": "js", ".ts": "js", ".py": "python", ".rb": "ruby",
+    ".js": "js", ".mjs": "js", ".cjs": "js", ".mts": "js", ".ts": "js", ".tsx": "js", ".jsx": "js", ".py": "python", ".rb": "ruby",
     ".rs": "rust", ".go": "go",
 }
 
@@ -764,7 +765,9 @@ def _scan_route_file_batch(args: Tuple[List[Tuple[str, str]], Dict, set, str]) -
             declared = dotnet_declared(c, rel, t)
         elif lang == "cfml" and ext == ".cfc":
             declared = cfml_declared(c, rel, t)
-        elif lang in ("js", "python", "ruby"):
+        elif lang == "js":
+            declared = nextjs_declared(c, rel, t) or js_py_rb_declared(c, rel, t, lang)
+        elif lang in ("python", "ruby"):
             declared = js_py_rb_declared(c, rel, t, lang)
         elif lang == "rust":
             declared = rust_declared(c, rel, t)
@@ -881,6 +884,11 @@ def map_routes(target: Path, config: Dict, stack_ids: Optional[set] = None, work
     for n, it in enumerate(keep, 1):
         it["route_id"] = f"R-{n:04d}"
     c.items = keep
+    mw_note = middleware_note(target, [rel for _, rel in files], enc) \
+        if any(it["stack"] == "node-nextjs" for it in c.items) else None
+    for it in c.items:
+        if mw_note and it["stack"] == "node-nextjs":
+            it["notes"] = f"{it['notes']}; {mw_note}" if it["notes"] else mw_note
     for it in c.items:
         it["needs_audit_hint"] = bool(any(i.get("is_id_like") for i in it["id_params"]) or it["kind"] == "declared_route")
     c.items = annotate_privilege(c.items, target, config)

package/assess/lsa/scripts/nextjs_routes.py

@@ -0,0 +1,236 @@
+"""Next.js route inventory for map_routes.py. Python 3.8+, standard library only.
+
+Covers App Router route handlers (app/**/route.ts), dynamic server-component pages
+(app/**/page.tsx), Pages Router API routes (pages/api/**), and server actions
+(files that start with "use server", and inline "use server" functions).
+The file path is the URL, so routes come from folder names, not from declarations.
+"""
+from __future__ import annotations
+
+import re
+from pathlib import Path
+from typing import Dict, List, Optional
+
+from lsa_common import is_id_name, line_of, read_text
+
+JS_EXT = r"(?:[cm]?[jt]s|[jt]sx)"
+APP_FILE = re.compile(r"(?:^|/)app/(?:(.+)/)?(route|page)\." + JS_EXT + "$")
+PAGES_API = re.compile(r"(?:^|/)pages/(api(?:/.+)?)\." + JS_EXT + "$")
+METHODS = "GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS"
+HANDLER_DECL = re.compile(r"^export\s+(?:async\s+)?function\s+(" + METHODS + r")\b|^export\s+const\s+(" + METHODS + r")\s*=", re.M)
+HANDLER_REEXPORT = re.compile(r"\b\w+\s+as\s+(" + METHODS + r")\b")
+TOP_LEVEL = re.compile(r"^(?:export|function|async|const|let|var|class)\b", re.M)
+ACTION_EXPORT = re.compile(r"^export\s+(?:default\s+)?async\s+function\s+(\w+)\s*\(|^export\s+const\s+(\w+)\s*=\s*async\s*\(", re.M)
+INLINE_ACTION = re.compile(r"\basync\s+function\s+(\w+)\s*\(|\b(?:const|let)\s+(\w+)\s*=\s*async\s*\(")
+USE_SERVER_STMT = re.compile(r"\s*['\"]use server['\"]")
+REQ_METHOD = re.compile(r"req\.method\s*===?\s*['\"](\w+)['\"]|case\s+['\"](" + METHODS + r")['\"]\s*:")
+MIDDLEWARE_FILE = re.compile(r"^(?:src/)?(middleware|proxy)\." + JS_EXT + "$")
+MATCHER = re.compile(r"matcher\s*:\s*(\[[^\]]*\]|['\"][^'\"]*['\"])")
+
+QUERY_INPUT = re.compile(r"searchParams\??\.get(?:All)?\(\s*['\"]([\w-]+)['\"]")
+FORM_INPUT = re.compile(r"\b\w*[fF]orm\w*\??\.get(?:All)?\(\s*['\"]([\w-]+)['\"]")
+JSON_DESTRUCT = re.compile(r"\{([^{}]*)\}\s*=\s*(?:await\s+)?[\w.]+\.(?:json|formData)\(\)")
+DESTRUCT_NAME = re.compile(r"(?:^|,)\s*(?:\.\.\.)?(\w+)")
+
+GUARD_HINTS = [re.compile(p) for p in [
+    r"\bauth\s*\(\s*\)", r"\bgetServerSession\s*\(", r"\bget(?:Session|User|Auth|CurrentUser)\s*\(", r"\bcurrentUser\s*\(",
+    r"\b(?:with|require|ensure|assert)\w*(?:Auth|User|Session|Role|Permission|Admin)\w*\s*\(",
+    r"\bpermission\s*:\s*['\"][^'\"]+['\"]", r"\bhas(?:Role|Permission)\s*\(",
+    r"redirect\s*\(\s*['\"]/(?:login|signin|sign-in)",
+]]
+
+
+def route_path(folder: Optional[str], prefix: str = "") -> Optional[str]:
+    """URL path for an app/ or pages/ folder; None for private (_folder) segments."""
+    parts = [prefix] if prefix else []
+    for seg in (folder or "").split("/"):
+        if not seg or seg.startswith("@") or (seg.startswith("(") and seg.endswith(")")):
+            continue  # route group or parallel-route slot: not part of the URL
+        if seg.startswith("_"):
+            return None
+        seg = re.sub(r"^(?:\(\.+\))+", "", seg)  # interception marker (.) (..) (...)
+        catch = re.fullmatch(r"\[\[?\.\.\.(\w+)\]\]?", seg)
+        dyn = re.fullmatch(r"\[(\w+)\]", seg)
+        parts.append("{" + catch.group(1) + "*}" if catch else "{" + dyn.group(1) + "}" if dyn else seg)
+    return "/" + "/".join(p for p in parts if p)
+
+
+def _close(text: str, idx: int, open_ch: str, close_ch: str) -> int:
+    """Index of the bracket that closes text[idx] (or len(text))."""
+    depth = 0
+    for j in range(idx, len(text)):
+        if text[j] == open_ch:
+            depth += 1
+        elif text[j] == close_ch:
+            depth -= 1
+            if depth == 0:
+                return j
+    return len(text)
+
+
+def _starts_with_use_server(text: str) -> bool:
+    """True when the first statement of the file is the "use server" directive (comments may come first)."""
+    i, n = 0, len(text)
+    while i < n:
+        if text[i].isspace():
+            i += 1
+        elif text.startswith("//", i):
+            nl = text.find("\n", i)
+            i = n if nl == -1 else nl + 1
+        elif text.startswith("/*", i):
+            end = text.find("*/", i + 2)
+            i = n if end == -1 else end + 2
+        else:
+            break
+    return bool(USE_SERVER_STMT.match(text, i))
+
+
+def _segment_end(text: str, start: int) -> int:
+    nxt = TOP_LEVEL.search(text, text.find("\n", start) + 1 if "\n" in text[start:] else len(text))
+    return nxt.start() if nxt else len(text)
+
+
+def _signature_params(sig: str) -> List[str]:
+    """Parameter names of an action signature; FormData parameters are read through .get() instead."""
+    names: List[str] = []
+    depth, cur, parts = 0, "", []
+    for ch in sig:
+        depth += ch in "({[<"
+        depth -= ch in ")}]>"
+        if ch == "," and depth == 0:
+            parts.append(cur)
+            cur = ""
+        else:
+            cur += ch
+    parts.append(cur)
+    for part in (p.strip() for p in parts):
+        if not part or re.search(r":\s*FormData\b", part):
+            continue
+        if part.startswith("{"):
+            names += DESTRUCT_NAME.findall(part[1:_close(part, 0, "{", "}")])
+        else:
+            m = re.match(r"(?:\.\.\.)?(\w+)", part)
+            if m:
+                names.append(m.group(1))
+    return names
+
+
+class NextRoutes:
+    def __init__(self, c, rel: str, text: str):
+        self.c, self.rel, self.text = c, rel, text
+        self.found = False
+
+    def _param(self, name: str, source: str, line: Optional[int]) -> Dict:
+        return {"name": name, "source": source, "line": line, "is_id_like": is_id_name(name, self.c.idp)}
+
+    def inputs(self, path: str, body: str, base_line: int, args: Optional[List[str]] = None) -> List[Dict]:
+        out = list(self.c.path_params(path)) if path.startswith("/") else []
+        out += [self._param(n, "body", base_line) for n in args or []]
+        for rx, src in ((QUERY_INPUT, "query"), (FORM_INPUT, "form")):
+            out += [self._param(m.group(1), src, base_line + line_of(body, m.start()) - 1) for m in rx.finditer(body)]
+        for m in JSON_DESTRUCT.finditer(body):
+            line = base_line + line_of(body, m.start()) - 1
+            out += [self._param(n, "body", line) for n in DESTRUCT_NAME.findall(m.group(1))]
+        out += self.c.inputs("js", body, base_line)
+        seen, dedup = set(), []
+        for p in out:
+            if p["name"] not in seen:
+                seen.add(p["name"])
+                dedup.append(p)
+        return dedup
+
+    def guards(self, body: str, base_line: int) -> List[Dict]:
+        out = self.c.guards(body, base_line)
+        for rx in GUARD_HINTS:
+            m = rx.search(body)
+            if m:
+                out.append({"hint": m.group(0)[:80], "line": base_line + line_of(body, m.start()) - 1})
+        seen, dedup = set(), []
+        for g in sorted(out, key=lambda g: g["line"]):
+            if (g["hint"], g["line"]) not in seen:
+                seen.add((g["hint"], g["line"]))
+                dedup.append(g)
+        return dedup[:8]
+
+    def add(self, kind: str, method: List[str], path: str, start: int, end: int, notes: str,
+            symbol: Optional[str] = None, args: Optional[List[str]] = None) -> None:
+        body = self.text[start:end]
+        line = line_of(self.text, start)
+        self.c.add(stack="node-nextjs", kind=kind, method=method, path=path,
+                   handler={"file": self.rel, "line": line, "symbol": symbol},
+                   id_params=self.inputs(path, body, line, args), guard_hints=self.guards(body, line),
+                   data_hints=self.c.data_ops(body, line), notes=notes)
+        self.found = True
+
+    def route_handlers(self, path: str) -> None:
+        decls = list(HANDLER_DECL.finditer(self.text))
+        for i, m in enumerate(decls):
+            end = decls[i + 1].start() if i + 1 < len(decls) else len(self.text)
+            self.add("declared_route", [m.group(1) or m.group(2)], path, m.start(), end, "next.js route handler",
+                     symbol=m.group(1) or m.group(2))
+        if not decls:
+            for m in HANDLER_REEXPORT.finditer(self.text):
+                self.add("declared_route", [m.group(1)], path, 0, len(self.text), "next.js route handler (re-exported)",
+                         symbol=m.group(1))
+
+    def page(self, path: str) -> None:
+        if "{" in path or QUERY_INPUT.search(self.text) or "searchParams" in self.text:
+            self.add("file_endpoint", ["GET"], path, 0, len(self.text),
+                     "next.js server component page: check data loaded for params/searchParams")
+
+    def pages_api(self, folder: str) -> None:
+        folder = re.sub(r"(?:^|/)index$", "", folder) or "api"
+        path = route_path(folder)
+        if path is None:
+            return
+        methods = sorted({(m.group(1) or m.group(2)).upper() for m in REQ_METHOD.finditer(self.text)}) or ["ANY"]
+        self.add("declared_route", methods, path, 0, len(self.text), "next.js pages/api route")
+
+    def server_actions(self) -> None:
+        if _starts_with_use_server(self.text):
+            for m in ACTION_EXPORT.finditer(self.text):
+                name = m.group(1) or m.group(2)
+                paren = m.end() - 1
+                args = _signature_params(self.text[paren + 1:_close(self.text, paren, "(", ")")])
+                self.add("declared_route", ["POST"], f"action:{self.rel}#{name}", m.start(),
+                         _segment_end(self.text, m.start()), "next.js server action (callable by any client with its id)",
+                         symbol=name, args=args)
+            return
+        for m in INLINE_ACTION.finditer(self.text):
+            paren = m.end() - 1
+            close = _close(self.text, paren, "(", ")")
+            brace = self.text.find("{", close)
+            if brace == -1 or not USE_SERVER_STMT.match(self.text, brace + 1):
+                continue
+            name = m.group(1) or m.group(2)
+            self.add("declared_route", ["POST"], f"action:{self.rel}#{name}", m.start(),
+                     _close(self.text, brace, "{", "}") + 1, "next.js inline server action (closure values are sent to the client encrypted; arguments are not trusted)",
+                     symbol=name, args=_signature_params(self.text[paren + 1:close]))
+
+
+def nextjs_declared(c, rel: str, text: str) -> bool:
+    """Add Next.js routes found in one JS/TS file. Returns True when the file is a Next.js entry point."""
+    r = NextRoutes(c, rel, text)
+    am = APP_FILE.search(rel)
+    if am:
+        path = route_path(am.group(1))
+        if path is not None:
+            if am.group(2) == "route":
+                r.route_handlers(path)
+            else:
+                r.page(path)
+    pm = PAGES_API.search(rel)
+    if pm:
+        r.pages_api(pm.group(1))
+    r.server_actions()
+    return r.found or bool(am or pm)
+
+
+def middleware_note(target: Path, rels: List[str], enc) -> Optional[str]:
+    """Describe middleware.ts / proxy.ts (Next.js 16) so the auditor checks it covers each route."""
+    for rel in rels:
+        if MIDDLEWARE_FILE.match(rel):
+            m = MATCHER.search(read_text(target / rel, enc))
+            scope = f"matcher: {m.group(1)[:120]}" if m else "no matcher: runs on every route"
+            return f"{rel} runs before this route ({scope}); confirm it enforces auth here"
+    return None

package/assess/lsa/templates/audit-config.json

@@ -8,7 +8,7 @@
   },
   "scope": {
     "include": [],
-    "exclude": ["vendor/", "node_modules/", "bower_components/", "packages/", "bin/", "obj/", "target/", "build/", "dist/", ".git/", "test/", "tests/", "spec/", "docs/", "*.min.js", "*jquery*.js"],
+    "exclude": ["vendor/", "node_modules/", "bower_components/", "packages/", "bin/", "obj/", "target/", "build/", "dist/", ".git/", ".svn/", ".hg/", "test/", "tests/", "spec/", "docs/", ".next/", ".nuxt/", ".output/", ".svelte-kit/", ".vercel/", ".netlify/", ".turbo/", ".parcel-cache/", ".cache/", "out/", "storybook-static/", "coverage/", "test-results/", "playwright-report/", ".nyc_output/", "__pycache__/", ".venv/", "venv/", ".tox/", ".mypy_cache/", ".pytest_cache/", "*.min.js", "*jquery*.js", "*.map"],
     "web_roots": [],
     "_file_endpoints": "all = every reachable page file is a candidate (recommended); with_inputs = only pages with request input or data access",
     "file_endpoints": "all",

package/assess/lsa/tests/test_default_scope.py

@@ -0,0 +1,86 @@
+#!/usr/bin/env python3
+"""Default scan scope skips framework build output, caches and source maps (Issue #325)."""
+
+from __future__ import annotations
+
+import json
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+
+REPO_ROOT = Path(__file__).resolve().parents[3]
+LSA_SCRIPTS = REPO_ROOT / "assess" / "lsa" / "scripts"
+sys.path.insert(0, str(LSA_SCRIPTS))
+
+from find_injection import find_injection  # noqa: E402
+from lsa_common import DEFAULT_CONFIG, deep_merge, iter_source_files, load_config  # noqa: E402
+
+TEMPLATE = REPO_ROOT / "assess" / "lsa" / "templates" / "audit-config.json"
+
+VULN_JS = (
+    "const id = req.query.id;\n"
+    "db.query(`SELECT * FROM orders WHERE id = ${id}`);\n"
+)
+
+GENERATED = [
+    ".next/server/chunks/x.js",
+    ".next/dev/server/chunks/y.js",
+    ".nuxt/dist/server/a.js",
+    ".output/server/index.mjs",
+    ".svelte-kit/output/server/b.js",
+    ".vercel/output/functions/c.js",
+    ".turbo/cache/d.js",
+    "out/_next/e.js",
+    "coverage/lcov-report/f.js",
+    "test-results/g.js",
+    "playwright-report/h.js",
+    "storybook-static/i.js",
+    ".venv/lib/site.py",
+    "__pycache__/m.py",
+    "src/app/page.js.map",
+]
+
+
+def _write(root: Path, rel: str, text: str) -> None:
+    p = root / rel
+    p.parent.mkdir(parents=True, exist_ok=True)
+    p.write_text(text, encoding="utf-8")
+
+
+class TestDefaultScope(unittest.TestCase):
+    def _repo(self, td: str) -> Path:
+        root = Path(td)
+        for rel in GENERATED:
+            _write(root, rel, VULN_JS)
+        _write(root, "src/lib/orders.js", VULN_JS)
+        return root
+
+    def test_generated_output_not_scanned(self) -> None:
+        with tempfile.TemporaryDirectory() as td:
+            root = self._repo(td)
+            rels = {rel for _, rel in iter_source_files(root, load_config(None))}
+            self.assertEqual(rels, {"src/lib/orders.js"})
+
+    def test_injection_candidates_only_from_source(self) -> None:
+        with tempfile.TemporaryDirectory() as td:
+            root = self._repo(td)
+            res = find_injection(root, load_config(None))
+            files = {c["file"] for c in res["candidates"]}
+            self.assertEqual(files, {"src/lib/orders.js"})
+
+    def test_user_exclude_override_brings_folder_back(self) -> None:
+        with tempfile.TemporaryDirectory() as td:
+            root = self._repo(td)
+            excludes = [e for e in DEFAULT_CONFIG["scope"]["exclude"] if e != ".next/"]
+            cfg = deep_merge(DEFAULT_CONFIG, {"scope": {"exclude": excludes}})
+            rels = {rel for _, rel in iter_source_files(root, cfg)}
+            self.assertIn(".next/server/chunks/x.js", rels)
+
+    def test_template_matches_default(self) -> None:
+        template = json.loads(TEMPLATE.read_text(encoding="utf-8"))
+        self.assertEqual(template["scope"]["exclude"], DEFAULT_CONFIG["scope"]["exclude"])
+
+
+if __name__ == "__main__":
+    unittest.main()

package/assess/lsa/tests/test_js_tagged_sql.py

@@ -0,0 +1,112 @@
+#!/usr/bin/env python3
+"""Parameterizing JS/TS sql tagged templates are not injection candidates (Issue #326).
+
+Drizzle, postgres.js, @vercel/postgres, Slonik and Prisma ($queryRaw, Prisma.sql) send ${...}
+inside a tagged template as a bound parameter. Raw-text escape hatches (sql.raw, Prisma.raw,
+sql.unsafe, $queryRawUnsafe) and untagged templates are still flagged.
+"""
+
+from __future__ import annotations
+
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+from typing import Dict, List
+
+SCRIPTS_DIR = Path(__file__).resolve().parents[1] / "scripts"
+if str(SCRIPTS_DIR) not in sys.path:
+    sys.path.insert(0, str(SCRIPTS_DIR))
+
+from detect_stack import detect  # noqa: E402
+from find_injection import find_injection  # noqa: E402
+from lsa_common import load_config  # noqa: E402
+
+SAFE_TAGGED = '''\
+import { sql } from "drizzle-orm";
+import { Prisma } from "@prisma/client";
+
+export async function counts(db, prisma, orderId, req) {
+  const id = req.query.id;
+  const lineCount = sql<number>`(select count(*)::int from ${orderLine} where ${orderLine.orderId} = ${orderId})`;
+  const rows = await db.execute(sql`select * from orders where id = ${id}`);
+  const p = await prisma.$queryRaw`SELECT * FROM users WHERE id = ${id}`;
+  await prisma.$executeRaw`UPDATE users SET name = ${req.body.name} WHERE id = ${id}`;
+  const frag = Prisma.sql`SELECT * FROM users WHERE email = ${req.body.email}`;
+  const pg = await pool.sql`select * from items where owner_id = ${id}`;
+  return [lineCount, rows, p, frag, pg];
+}
+'''
+
+UNSAFE = '''\
+import { sql } from "drizzle-orm";
+
+export async function unsafe(db, prisma, req) {
+  const id = req.query.id;
+  const a = await db.execute(`SELECT * FROM orders WHERE id = ${id}`);
+  const b = await prisma.$queryRawUnsafe(`SELECT * FROM users WHERE id = ${id}`);
+  const c = await db.execute(sql`select * from orders order by ${sql.raw(req.query.sort)}`);
+  const d = await db.execute(sql`select nextval(${sql.raw(`'${customerSeq.seqName}'`)}) as value`);
+  const e = await db.execute(sql`select * from t order by ${sql.raw("created_at")}`);
+  const f = await prisma.$queryRaw`SELECT * FROM t ORDER BY ${Prisma.raw(req.query.sort)}`;
+  return [a, b, c, d, e, f];
+}
+'''
+
+NO_INPUT = '''\
+import { sql } from "drizzle-orm";
+
+export async function nextCode(tx, sequence) {
+  return tx.execute(sql`select nextval(${sql.raw(`'${sequence.seqName}'`)}) as value`);
+}
+'''
+
+
+def _scan(files: Dict[str, str]) -> List[Dict]:
+    with tempfile.TemporaryDirectory() as td:
+        root = Path(td)
+        for rel, text in files.items():
+            p = root / rel
+            p.parent.mkdir(parents=True, exist_ok=True)
+            p.write_text(text, encoding="utf-8")
+        return find_injection(root, load_config(None))["candidates"]
+
+
+def _by_line(cands: List[Dict]) -> Dict[int, Dict]:
+    return {c["line"]: c for c in cands}
+
+
+class TestJsTaggedSql(unittest.TestCase):
+    def test_parameterizing_tags_not_flagged(self) -> None:
+        self.assertEqual(_scan({"src/safe.ts": SAFE_TAGGED}), [])
+
+    def test_untagged_and_unsafe_calls_flagged(self) -> None:
+        got = _by_line(_scan({"src/unsafe.ts": UNSAFE}))
+        self.assertEqual(got[5]["rule"], "sql-interpolation")  # untagged template to db.execute
+        self.assertEqual(got[6]["rule"], "sql-interpolation")  # $queryRawUnsafe
+
+    def test_raw_fragments(self) -> None:
+        got = _by_line(_scan({"src/unsafe.ts": UNSAFE}))
+        self.assertEqual(got[7]["rule"], "sql-raw-fragment")  # sql.raw(req.query.sort)
+        self.assertEqual(got[7]["priority"], "high")
+        self.assertEqual(got[8]["rule"], "sql-raw-fragment")  # sql.raw of a schema property
+        self.assertNotIn(9, got)  # sql.raw("literal") is a constant
+        self.assertEqual(got[10]["rule"], "sql-raw-fragment")  # Prisma.raw(req.query.sort)
+        self.assertEqual(got[10]["priority"], "high")
+
+    def test_raw_fragment_without_request_input_is_low(self) -> None:
+        got = _scan({"src/seq.ts": NO_INPUT})
+        self.assertEqual([(c["rule"], c["priority"]) for c in got], [("sql-raw-fragment", "low")])
+
+    def test_data_access_names_library(self) -> None:
+        with tempfile.TemporaryDirectory() as td:
+            root = Path(td)
+            (root / "a.ts").write_text('import { sql } from "drizzle-orm";\n', encoding="utf-8")
+            (root / "b.ts").write_text('import postgres from "postgres";\n', encoding="utf-8")
+            da = detect(root, load_config(None))["data_access"]
+            self.assertIn("Drizzle ORM (Node/TS)", da)
+            self.assertIn("postgres.js (Node/TS)", da)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/assess/lsa/tests/test_nextjs.py

@@ -0,0 +1,198 @@
+#!/usr/bin/env python3
+"""Next.js stack detection and route inventory (Issue #324).
+
+Covers App Router route handlers (route groups, dynamic and catch-all segments, `export const`
+handlers), Pages Router API routes, server actions (file-level and inline "use server"), dynamic
+server-component pages, and middleware / proxy notes.
+"""
+
+from __future__ import annotations
+
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+from typing import Dict, List
+
+SCRIPTS_DIR = Path(__file__).resolve().parents[1] / "scripts"
+if str(SCRIPTS_DIR) not in sys.path:
+    sys.path.insert(0, str(SCRIPTS_DIR))
+
+from detect_stack import detect  # noqa: E402
+from lsa_common import load_config  # noqa: E402
+from map_routes import map_routes  # noqa: E402
+
+FILES: Dict[str, str] = {
+    "next.config.ts": "const nextConfig = {};\nexport default nextConfig;\n",
+    "src/proxy.ts": (
+        'import { NextResponse } from "next/server";\n'
+        "export async function proxy(request) { return NextResponse.next(); }\n"
+        'export const config = { matcher: ["/((?!_next|login).*)"] };\n'
+    ),
+    # unguarded BOLA: id from the path, no owner filter
+    "src/app/api/orders/[id]/route.ts": (
+        'import { db } from "@/db";\n'
+        "export async function GET(request, { params }) {\n"
+        "  const { id } = await params;\n"
+        "  return Response.json(await db.query.orders.findFirst({ where: eq(orders.id, id) }));\n"
+        "}\n"
+        "\n"
+        "export async function DELETE(request, { params }) {\n"
+        "  const session = await auth();\n"
+        "  await db.delete(orders).where(eq(orders.id, params.id));\n"
+        "  return new Response(null, { status: 204 });\n"
+        "}\n"
+    ),
+    # route group, export const with a guard wrapper, query + JSON body inputs
+    "src/app/(admin)/api/users/[userId]/route.ts": (
+        'import { withAuth } from "@/lib/auth/guard";\n'
+        "export const PATCH = withAuth(async (request, { actor, params }) => {\n"
+        "  const { role, tenantId } = await request.json();\n"
+        '  const dry = request.nextUrl.searchParams.get("dryRun");\n'
+        "  return changeRole(actor, params.userId, role);\n"
+        '}, { permission: "users.manage" });\n'
+    ),
+    "app/api/files/[...path]/route.js": "export async function GET(req, ctx) { return serve(ctx.params.path); }\n",
+    "app/api/health/route.ts": "export function GET() { return Response.json({ ok: true }); }\n",
+    # private folder: not routable
+    "app/_lib/route.ts": "export function GET() {}\n",
+    "pages/api/invoices/[invoiceId].ts": (
+        "export default async function handler(req, res) {\n"
+        '  if (req.method === "DELETE") { await removeInvoice(req.query.invoiceId); }\n'
+        '  if (req.method === "GET") { res.json(await getInvoice(req.query.invoiceId)); }\n'
+        "}\n"
+    ),
+    "pages/api/index.ts": "export default function handler(req, res) { res.json({}); }\n",
+    "src/app/orders/actions.ts": (
+        '"use server";\n'
+        'import { auth } from "@/auth";\n'
+        "export async function cancelOrder(orderId: number, reason: string) {\n"
+        "  const session = await auth();\n"
+        "  await db.update(orders).set({ status: 'cancelled' }).where(eq(orders.id, orderId));\n"
+        "}\n"
+        "export const archiveOrder = async (formData: FormData) => {\n"
+        '  const id = formData.get("orderId");\n'
+        "  await db.delete(orders).where(eq(orders.id, id));\n"
+        "};\n"
+        "function helper() {}\n"
+    ),
+    "src/app/orders/[code]/page.tsx": (
+        "export default async function OrderPage({ params }) {\n"
+        "  const { code } = await params;\n"
+        "  const order = await getOrderByCode(code);\n"
+        "  async function approve() {\n"
+        '    "use server";\n'
+        "    await approveOrder(order.id);\n"
+        "  }\n"
+        "  return <form action={approve}><p>{order.code}</p></form>;\n"
+        "}\n"
+    ),
+    "src/app/about/page.tsx": "export default function About() { return <p>about</p>; }\n",
+}
+
+
+def _write(root: Path) -> None:
+    for rel, text in FILES.items():
+        p = root / rel
+        p.parent.mkdir(parents=True, exist_ok=True)
+        p.write_text(text, encoding="utf-8")
+
+
+def _routes(root: Path) -> List[Dict]:
+    cfg = load_config(None)
+    stacks = {s["id"] for s in detect(root, cfg)["stacks"]}
+    return map_routes(root, cfg, stacks)["candidates"]
+
+
+def _find(routes: List[Dict], method: str, path: str) -> Dict:
+    hits = [r for r in routes if r["path"] == path and method in r["method"]]
+    if len(hits) != 1:
+        raise AssertionError(f"{method} {path}: {len(hits)} hits in {[(r['method'], r['path']) for r in routes]}")
+    return hits[0]
+
+
+def _names(route: Dict) -> Dict[str, str]:
+    return {p["name"]: p["source"] for p in route["id_params"]}
+
+
+class TestNextjs(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls) -> None:
+        cls._td = tempfile.TemporaryDirectory()
+        cls.root = Path(cls._td.name)
+        _write(cls.root)
+        cls.routes = _routes(cls.root)
+
+    @classmethod
+    def tearDownClass(cls) -> None:
+        cls._td.cleanup()
+
+    def test_stack_detected(self) -> None:
+        prof = detect(self.root, load_config(None))
+        self.assertIn("node-nextjs", {s["id"] for s in prof["stacks"]})
+        self.assertIn("knowledge/stacks/nextjs.md", prof["knowledge_files"])
+
+    def test_all_routes_are_nextjs(self) -> None:
+        self.assertEqual({r["stack"] for r in self.routes}, {"node-nextjs"})
+
+    def test_route_handlers_per_method(self) -> None:
+        get = _find(self.routes, "GET", "/api/orders/{id}")
+        self.assertEqual(get["kind"], "declared_route")
+        self.assertEqual(get["handler"]["file"], "src/app/api/orders/[id]/route.ts")
+        self.assertEqual(get["handler"]["line"], 2)
+        self.assertEqual(_names(get), {"id": "path"})
+        self.assertTrue(get["needs_audit_hint"])
+        self.assertEqual(get["guard_hints"], [])
+        delete = _find(self.routes, "DELETE", "/api/orders/{id}")
+        self.assertTrue(any("auth()" in g["hint"] for g in delete["guard_hints"]))
+
+    def test_route_group_and_export_const(self) -> None:
+        patch = _find(self.routes, "PATCH", "/api/users/{userId}")
+        self.assertEqual(_names(patch), {"userId": "path", "role": "body", "tenantId": "body", "dryRun": "query"})
+        hints = " ".join(g["hint"] for g in patch["guard_hints"])
+        self.assertIn("withAuth", hints)
+        self.assertIn("users.manage", hints)
+
+    def test_catch_all_and_static(self) -> None:
+        _find(self.routes, "GET", "/api/files/{path*}")
+        self.assertEqual(_find(self.routes, "GET", "/api/health")["id_params"], [])
+
+    def test_private_folder_skipped(self) -> None:
+        self.assertFalse(any(r["handler"]["file"] == "app/_lib/route.ts" for r in self.routes))
+
+    def test_pages_api(self) -> None:
+        inv = _find(self.routes, "DELETE", "/api/invoices/{invoiceId}")
+        self.assertEqual(sorted(inv["method"]), ["DELETE", "GET"])
+        self.assertEqual(_names(inv)["invoiceId"], "path")
+        self.assertEqual(_find(self.routes, "ANY", "/api")["handler"]["file"], "pages/api/index.ts")
+
+    def test_server_actions(self) -> None:
+        cancel = _find(self.routes, "POST", "action:src/app/orders/actions.ts#cancelOrder")
+        self.assertEqual(_names(cancel), {"orderId": "body", "reason": "body"})
+        self.assertTrue(any("auth" in g["hint"] for g in cancel["guard_hints"]))
+        archive = _find(self.routes, "POST", "action:src/app/orders/actions.ts#archiveOrder")
+        self.assertEqual(_names(archive), {"orderId": "form"})
+        self.assertFalse(any(r["path"].endswith("#helper") for r in self.routes))
+
+    def test_inline_server_action_and_page(self) -> None:
+        _find(self.routes, "POST", "action:src/app/orders/[code]/page.tsx#approve")
+        page = _find(self.routes, "GET", "/orders/{code}")
+        self.assertEqual(page["kind"], "file_endpoint")
+        self.assertEqual(_names(page), {"code": "path"})
+        self.assertFalse(any(r["path"] == "/about" for r in self.routes))
+
+    def test_use_server_after_comments(self) -> None:
+        from nextjs_routes import _starts_with_use_server
+
+        self.assertTrue(_starts_with_use_server('// x\n/* y */\n  "use server";\nexport async function a() {}'))
+        self.assertFalse(_starts_with_use_server('import x from "y";\n"use server";'))
+        self.assertFalse(_starts_with_use_server("/*" + "*//*" * 5000))
+
+    def test_proxy_noted(self) -> None:
+        get = _find(self.routes, "GET", "/api/orders/{id}")
+        self.assertIn("src/proxy.ts", get["notes"])
+        self.assertIn("matcher", get["notes"])
+
+
+if __name__ == "__main__":
+    unittest.main()

package/operate/cli/__init__.py

@@ -2,4 +2,4 @@
 
 from __future__ import annotations
 
-__version__ = "2.0.1"  # x-release-please-version
+__version__ = "2.1.0"  # x-release-please-version

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hoanghainh/komagu",
-  "version": "2.0.1",
+  "version": "2.1.0",
   "description": "Security-First Legacy Modernization Platform CLI (LSA Kit, IAM Perimeter, Cross-User Testing)",
   "main": "remediate/authz/nodejs/src/index.js",
   "types": "remediate/authz/nodejs/src/index.d.ts",