@oculum/scanner 1.0.12 → 1.0.13

package/dist/model/route-discovery/nextjs.js

@@ -0,0 +1,179 @@
+"use strict";
+/**
+ * Next.js Route Extractor
+ *
+ * Detects routes from Next.js App Router and Pages Router conventions.
+ * Derives route paths from the filesystem structure.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.extractNextJSRoutes = extractNextJSRoutes;
+const route_hierarchy_1 = require("../route-hierarchy");
+// ============================================================================
+// Constants
+// ============================================================================
+const APP_ROUTER_ROUTE_FILE = /\/app\/(.+)\/route\.(ts|js|tsx|jsx)$/;
+const PAGES_API_FILE = /\/pages\/api\/(.+)\.(ts|js|tsx|jsx)$/;
+const PUBLIC_ENDPOINT_PATTERN = /^\/(health|healthz|ready|readyz|ping|status|favicon\.ico|robots\.txt|sitemap\.xml|\.well-known)\/?$/i;
+const DEFAULT_HANDLER_EXPORT = /export\s+default\s+(?:async\s+)?function\s*(\w*)/;
+// Input source patterns for Next.js handlers
+const NEXTJS_INPUT_PATTERNS = [
+    { pattern: /request\.json\(\)|req\.body|await\s+request\.json/i, source: 'body' },
+    { pattern: /searchParams|nextUrl\.searchParams|url\.searchParams|req\.query/i, source: 'query' },
+    { pattern: /params\.|context\.params|props\.params/i, source: 'params' },
+    { pattern: /request\.headers|req\.headers|headers\(\)/i, source: 'headers' },
+    { pattern: /cookies\(\)|request\.cookies|req\.cookies/i, source: 'cookies' },
+    { pattern: /formData\(\)|request\.formData/i, source: 'files' },
+];
+// ============================================================================
+// Route Extraction
+// ============================================================================
+/**
+ * Extract Next.js routes from scanned files.
+ *
+ * Detects App Router (export function GET/POST in route files)
+ * and Pages Router (export default in pages/api files).
+ */
+function extractNextJSRoutes(files, frameworkPrimary) {
+    // Only run for Next.js projects (or if framework not detected, try anyway)
+    if (frameworkPrimary && frameworkPrimary !== 'nextjs')
+        return [];
+    const routes = [];
+    for (const file of files) {
+        // App Router route files
+        const appMatch = file.path.match(APP_ROUTER_ROUTE_FILE);
+        if (appMatch) {
+            const routePath = deriveAppRouterPath(appMatch[1]);
+            const methods = extractExportedMethods(file.content);
+            const protection = (0, route_hierarchy_1.getRouteProtectionContext)(file.path);
+            const inputs = detectNextJSInputSources(file.content);
+            if (methods.length === 0)
+                continue;
+            for (const method of methods) {
+                routes.push({
+                    filePath: file.path,
+                    methods: [method.name],
+                    path: routePath,
+                    handler: method.name,
+                    handlerLine: method.line,
+                    framework: 'nextjs_app',
+                    authMiddleware: protection.isInProtectedHierarchy ? protection.protectionSource : [],
+                    rateLimiting: false,
+                    isPublic: PUBLIC_ENDPOINT_PATTERN.test(routePath),
+                    inputs,
+                });
+            }
+            continue;
+        }
+        // Pages Router API files
+        const pagesMatch = file.path.match(PAGES_API_FILE);
+        if (pagesMatch) {
+            const routePath = derivePagesRouterPath(pagesMatch[1]);
+            const handlerLine = findDefaultExportLine(file.content);
+            const inputs = detectNextJSInputSources(file.content);
+            const methods = detectPagesRouterMethods(file.content);
+            routes.push({
+                filePath: file.path,
+                methods,
+                path: routePath,
+                handler: 'default',
+                handlerLine,
+                framework: 'nextjs_pages',
+                authMiddleware: [],
+                rateLimiting: false,
+                isPublic: PUBLIC_ENDPOINT_PATTERN.test(routePath),
+                inputs,
+            });
+        }
+    }
+    return routes;
+}
+// ============================================================================
+// Path Derivation
+// ============================================================================
+/**
+ * Derive API path from App Router filesystem path.
+ * e.g., "api/users/[id]/route.ts" → "/api/users/:id"
+ *
+ * - Dynamic segments [id] → :id
+ * - Catch-all [...slug] → :slug*
+ * - Optional catch-all [[...slug]] → :slug*
+ * - Route groups (dashboard) are stripped
+ */
+function deriveAppRouterPath(relativePath) {
+    let path = '/' + relativePath
+        // Strip route groups like (dashboard), (auth)
+        .replace(/\([^)]+\)\//g, '')
+        // Optional catch-all [[...param]]
+        .replace(/\[\[\.\.\.(\w+)\]\]/g, ':$1*')
+        // Catch-all [...param]
+        .replace(/\[\.\.\.(\w+)\]/g, ':$1*')
+        // Dynamic segments [param]
+        .replace(/\[(\w+)\]/g, ':$1');
+    // Clean up double slashes
+    path = path.replace(/\/+/g, '/');
+    // Remove trailing slash
+    if (path.length > 1 && path.endsWith('/')) {
+        path = path.slice(0, -1);
+    }
+    return path;
+}
+/**
+ * Derive API path from Pages Router filesystem path.
+ * e.g., "users/[id]" → "/api/users/:id"
+ */
+function derivePagesRouterPath(relativePath) {
+    let path = '/api/' + relativePath
+        .replace(/\[\.\.\.(\w+)\]/g, ':$1*')
+        .replace(/\[(\w+)\]/g, ':$1');
+    // Remove /index suffix
+    path = path.replace(/\/index$/, '');
+    // Clean up
+    path = path.replace(/\/+/g, '/');
+    if (path.length > 1 && path.endsWith('/')) {
+        path = path.slice(0, -1);
+    }
+    return path;
+}
+function extractExportedMethods(content) {
+    const methods = [];
+    const lines = content.split('\n');
+    for (let i = 0; i < lines.length; i++) {
+        const match = lines[i].match(/export\s+(?:async\s+)?function\s+(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS)\s*\(/);
+        if (match) {
+            methods.push({ name: match[1], line: i + 1 });
+        }
+    }
+    return methods;
+}
+function findDefaultExportLine(content) {
+    const lines = content.split('\n');
+    for (let i = 0; i < lines.length; i++) {
+        if (DEFAULT_HANDLER_EXPORT.test(lines[i])) {
+            return i + 1;
+        }
+    }
+    return 1;
+}
+function detectPagesRouterMethods(content) {
+    // Check for explicit method checks in the handler
+    const methodChecks = content.match(/req\.method\s*===?\s*['"`](GET|POST|PUT|PATCH|DELETE)['"`]/gi);
+    if (methodChecks) {
+        return [...new Set(methodChecks.map(m => {
+                const match = m.match(/['"`](GET|POST|PUT|PATCH|DELETE)['"`]/i);
+                return match ? match[1].toUpperCase() : 'ALL';
+            }))];
+    }
+    return ['ALL'];
+}
+function detectNextJSInputSources(content) {
+    const inputs = [];
+    const seen = new Set();
+    for (const { pattern, source } of NEXTJS_INPUT_PATTERNS) {
+        if (pattern.test(content) && !seen.has(source)) {
+            seen.add(source);
+            inputs.push({ source });
+        }
+    }
+    return inputs;
+}
+//# sourceMappingURL=nextjs.js.map

package/dist/model/route-discovery/nextjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nextjs.js","sourceRoot":"","sources":["../../../src/model/route-discovery/nextjs.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;AAqCH,kDA6DC;AA9FD,wDAA8D;AAE9D,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E;AAE/E,MAAM,qBAAqB,GAAG,sCAAsC,CAAA;AACpE,MAAM,cAAc,GAAG,sCAAsC,CAAA;AAE7D,MAAM,uBAAuB,GAAG,sGAAsG,CAAA;AAEtI,MAAM,sBAAsB,GAAG,kDAAkD,CAAA;AAEjF,6CAA6C;AAC7C,MAAM,qBAAqB,GAA6D;IACtF,EAAE,OAAO,EAAE,oDAAoD,EAAE,MAAM,EAAE,MAAM,EAAE;IACjF,EAAE,OAAO,EAAE,kEAAkE,EAAE,MAAM,EAAE,OAAO,EAAE;IAChG,EAAE,OAAO,EAAE,yCAAyC,EAAE,MAAM,EAAE,QAAQ,EAAE;IACxE,EAAE,OAAO,EAAE,4CAA4C,EAAE,MAAM,EAAE,SAAS,EAAE;IAC5E,EAAE,OAAO,EAAE,4CAA4C,EAAE,MAAM,EAAE,SAAS,EAAE;IAC5E,EAAE,OAAO,EAAE,iCAAiC,EAAE,MAAM,EAAE,OAAO,EAAE;CAChE,CAAA;AAED,+EAA+E;AAC/E,mBAAmB;AACnB,+EAA+E;AAE/E;;;;;GAKG;AACH,SAAgB,mBAAmB,CACjC,KAAiB,EACjB,gBAAoC;IAEpC,2EAA2E;IAC3E,IAAI,gBAAgB,IAAI,gBAAgB,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAA;IAEhE,MAAM,MAAM,GAAsB,EAAE,CAAA;IAEpC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,yBAAyB;QACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAA;QACvD,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,SAAS,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;YAClD,MAAM,OAAO,GAAG,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YACpD,MAAM,UAAU,GAAG,IAAA,2CAAyB,EAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACvD,MAAM,MAAM,GAAG,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YAErD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAQ;YAElC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,MAAM,CAAC,IAAI,CAAC;oBACV,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,OAAO,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC;oBACtB,IAAI,EAAE,SAAS;oBACf,OAAO,EAAE,MAAM,CAAC,IAAI;oBACpB,WAAW,EAAE,MAAM,CAAC,IAAI;oBACxB,SAAS,EAAE,YAAY;oBACvB,cAAc,EAAE,UAAU,CAAC,sBAAsB,CAAC,CAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE;oBACpF,YAAY,EAAE,KAAK;oBACnB,QAAQ,EAAE,uBAAuB,CAAC,IAAI,CAAC,SAAS,CAAC;oBACjD,MAAM;iBACP,CAAC,CAAA;YACJ,CAAC;YACD,SAAQ;QACV,CAAC;QAED,yBAAyB;QACzB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAA;QAClD,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,SAAS,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAA;YACtD,MAAM,WAAW,GAAG,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YACvD,MAAM,MAAM,GAAG,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YACrD,MAAM,OAAO,GAAG,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YAEtD,MAAM,CAAC,IAAI,CAAC;gBACV,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,OAAO;gBACP,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,SAAS;gBAClB,WAAW;gBACX,SAAS,EAAE,cAAc;gBACzB,cAAc,EAAE,EAAE;gBAClB,YAAY,EAAE,KAAK;gBACnB,QAAQ,EAAE,uBAAuB,CAAC,IAAI,CAAC,SAAS,CAAC;gBACjD,MAAM;aACP,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED,+EAA+E;AAC/E,kBAAkB;AAClB,+EAA+E;AAE/E;;;;;;;;GAQG;AACH,SAAS,mBAAmB,CAAC,YAAoB;IAC/C,IAAI,IAAI,GAAG,GAAG,GAAG,YAAY;QAC3B,8CAA8C;SAC7C,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;QAC5B,kCAAkC;SACjC,OAAO,CAAC,sBAAsB,EAAE,MAAM,CAAC;QACxC,uBAAuB;SACtB,OAAO,CAAC,kBAAkB,EAAE,MAAM,CAAC;QACpC,2BAA2B;SAC1B,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC,CAAA;IAE/B,0BAA0B;IAC1B,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAChC,wBAAwB;IACxB,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1C,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAC1B,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;GAGG;AACH,SAAS,qBAAqB,CAAC,YAAoB;IACjD,IAAI,IAAI,GAAG,OAAO,GAAG,YAAY;SAC9B,OAAO,CAAC,kBAAkB,EAAE,MAAM,CAAC;SACnC,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC,CAAA;IAE/B,uBAAuB;IACvB,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;IAEnC,WAAW;IACX,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAChC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1C,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAC1B,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAWD,SAAS,sBAAsB,CAAC,OAAe;IAC7C,MAAM,OAAO,GAAqB,EAAE,CAAA;IACpC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAEjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,gFAAgF,CAAC,CAAA;QAC9G,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC/C,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,SAAS,qBAAqB,CAAC,OAAe;IAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1C,OAAO,CAAC,GAAG,CAAC,CAAA;QACd,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC;AAED,SAAS,wBAAwB,CAAC,OAAe;IAC/C,kDAAkD;IAClD,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,8DAA8D,CAAC,CAAA;IAClG,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;gBACtC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAA;gBAC/D,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAA;YAC/C,CAAC,CAAC,CAAC,CAAC,CAAA;IACN,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,CAAA;AAChB,CAAC;AAED,SAAS,wBAAwB,CAAC,OAAe;IAC/C,MAAM,MAAM,GAAiB,EAAE,CAAA;IAC/B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,KAAK,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,qBAAqB,EAAE,CAAC;QACxD,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/C,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YAChB,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;QACzB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/model/route-discovery/python.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Python Route Extractor (Flask + Django)
+ *
+ * Detects route definitions from Flask decorators and Django URL patterns.
+ */
+import type { RouteDefinition } from './types';
+/**
+ * Extract Flask/Django routes from Python file content.
+ *
+ * Detects:
+ * - Flask: @app.route('/path', methods=['GET'])
+ * - Flask: @blueprint.route(...)
+ * - Django: path('api/search/', views.search_view) in urlpatterns
+ */
+export declare function extractPythonRoutes(content: string, filePath: string): RouteDefinition[];
+//# sourceMappingURL=python.d.ts.map

package/dist/model/route-discovery/python.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"python.d.ts","sourceRoot":"","sources":["../../../src/model/route-discovery/python.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,eAAe,EAA8B,MAAM,SAAS,CAAA;AAyB1E;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,eAAe,EAAE,CAgBxF"}

package/dist/model/route-discovery/python.js

@@ -0,0 +1,181 @@
+"use strict";
+/**
+ * Python Route Extractor (Flask + Django)
+ *
+ * Detects route definitions from Flask decorators and Django URL patterns.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.extractPythonRoutes = extractPythonRoutes;
+// ============================================================================
+// Constants
+// ============================================================================
+const PUBLIC_ENDPOINT_PATTERN = /^\/(health|healthz|ready|readyz|ping|status)\/?$/i;
+const AUTH_DECORATOR_PATTERN = /login_required|auth_required|requires_auth|permission_required|jwt_required|token_required/i;
+const RATE_LIMIT_PATTERN = /rate_limit|ratelimit|throttle|limiter/i;
+const PYTHON_INPUT_PATTERNS = [
+    { pattern: /request\.json|request\.get_json|request\.data|request\.form|request\.POST|request\.body/i, source: 'body' },
+    { pattern: /request\.args|request\.GET|request\.query_params/i, source: 'query' },
+    { pattern: /request\.view_args|kwargs\[|self\.kwargs/i, source: 'params' },
+    { pattern: /request\.headers|request\.META/i, source: 'headers' },
+    { pattern: /request\.cookies|request\.COOKIES/i, source: 'cookies' },
+    { pattern: /request\.files|request\.FILES/i, source: 'files' },
+];
+// ============================================================================
+// Route Extraction
+// ============================================================================
+/**
+ * Extract Flask/Django routes from Python file content.
+ *
+ * Detects:
+ * - Flask: @app.route('/path', methods=['GET'])
+ * - Flask: @blueprint.route(...)
+ * - Django: path('api/search/', views.search_view) in urlpatterns
+ */
+function extractPythonRoutes(content, filePath) {
+    const routes = [];
+    const ext = filePath.substring(filePath.lastIndexOf('.'));
+    if (ext !== '.py')
+        return routes;
+    const lines = content.split('\n');
+    // Detect Flask routes
+    const flaskRoutes = extractFlaskRoutes(lines, filePath);
+    routes.push(...flaskRoutes);
+    // Detect Django URL patterns
+    const djangoRoutes = extractDjangoRoutes(lines, filePath, content);
+    routes.push(...djangoRoutes);
+    return routes;
+}
+// ============================================================================
+// Flask Extraction
+// ============================================================================
+function extractFlaskRoutes(lines, filePath) {
+    const routes = [];
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        // @app.route('/path', methods=['GET', 'POST'])
+        // @blueprint.route('/path')
+        const routeMatch = line.match(/@\s*(?:\w+)\s*\.route\s*\(\s*['"]([^'"]+)['"](?:\s*,\s*methods\s*=\s*\[([^\]]*)\])?\s*\)/);
+        if (routeMatch) {
+            const path = routeMatch[1];
+            const methodsStr = routeMatch[2];
+            const methods = methodsStr
+                ? methodsStr.replace(/['"]/g, '').split(',').map(m => m.trim().toUpperCase()).filter(Boolean)
+                : ['GET'];
+            // Scan decorators above the route for auth/rate-limiting
+            const decorators = collectDecorators(lines, i);
+            const authDecorators = decorators.filter(d => AUTH_DECORATOR_PATTERN.test(d));
+            const hasRateLimit = decorators.some(d => RATE_LIMIT_PATTERN.test(d));
+            // Find the function definition below the decorator
+            const handlerInfo = findFunctionBelow(lines, i);
+            const handlerBody = handlerInfo
+                ? extractPythonFunctionBody(lines, handlerInfo.line - 1)
+                : '';
+            const inputs = detectPythonInputSources(handlerBody);
+            routes.push({
+                filePath,
+                methods,
+                path: normalizeFlaskPath(path),
+                handler: handlerInfo?.name || 'unknown',
+                handlerLine: handlerInfo?.line || i + 1,
+                framework: 'flask',
+                authMiddleware: authDecorators,
+                rateLimiting: hasRateLimit,
+                isPublic: PUBLIC_ENDPOINT_PATTERN.test(path),
+                inputs,
+            });
+        }
+    }
+    return routes;
+}
+// ============================================================================
+// Django Extraction
+// ============================================================================
+function extractDjangoRoutes(lines, filePath, fullContent) {
+    const routes = [];
+    // Only look in files that contain urlpatterns
+    if (!fullContent.includes('urlpatterns'))
+        return routes;
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        // path('api/search/', views.search_view, name='search')
+        // path('api/users/<int:pk>/', UserViewSet.as_view())
+        const pathMatch = line.match(/path\s*\(\s*['"]([^'"]*)['"]\s*,\s*([^,)]+)/);
+        if (pathMatch) {
+            const routePath = '/' + pathMatch[1].replace(/^\//, '');
+            const viewRef = pathMatch[2].trim();
+            routes.push({
+                filePath,
+                methods: ['ALL'], // Django views handle all methods by default
+                path: normalizeDjangoPath(routePath),
+                handler: viewRef.replace(/\.as_view\(\)/, ''),
+                handlerLine: i + 1,
+                framework: 'django',
+                authMiddleware: [],
+                rateLimiting: false,
+                isPublic: PUBLIC_ENDPOINT_PATTERN.test(routePath),
+                inputs: [],
+            });
+        }
+    }
+    return routes;
+}
+// ============================================================================
+// Internal Helpers
+// ============================================================================
+function collectDecorators(lines, routeDecoratorLine) {
+    const decorators = [];
+    // Look backwards from the route decorator for other decorators
+    for (let j = routeDecoratorLine - 1; j >= Math.max(0, routeDecoratorLine - 10); j--) {
+        const trimmed = lines[j].trim();
+        if (trimmed.startsWith('@')) {
+            decorators.push(trimmed);
+        }
+        else if (trimmed.length > 0) {
+            break; // Stop at first non-decorator, non-empty line
+        }
+    }
+    // Also look at lines between route decorator and function def
+    for (let j = routeDecoratorLine + 1; j < Math.min(lines.length, routeDecoratorLine + 5); j++) {
+        const trimmed = lines[j].trim();
+        if (trimmed.startsWith('@')) {
+            decorators.push(trimmed);
+        }
+        else if (trimmed.startsWith('def ') || trimmed.startsWith('async def ')) {
+            break;
+        }
+    }
+    return decorators;
+}
+function findFunctionBelow(lines, decoratorLine) {
+    for (let j = decoratorLine + 1; j < Math.min(lines.length, decoratorLine + 10); j++) {
+        const match = lines[j].match(/(?:async\s+)?def\s+(\w+)\s*\(/);
+        if (match) {
+            return { name: match[1], line: j + 1 };
+        }
+    }
+    return null;
+}
+function extractPythonFunctionBody(lines, defLineIndex) {
+    const end = Math.min(defLineIndex + 30, lines.length);
+    return lines.slice(defLineIndex, end).join('\n');
+}
+function normalizeFlaskPath(path) {
+    // Convert Flask path params <type:name> or <name> to :name
+    return path.replace(/<(?:\w+:)?(\w+)>/g, ':$1');
+}
+function normalizeDjangoPath(path) {
+    // Convert Django path params <int:pk> or <str:slug> to :pk / :slug
+    return path.replace(/<(?:\w+:)?(\w+)>/g, ':$1');
+}
+function detectPythonInputSources(body) {
+    const inputs = [];
+    const seen = new Set();
+    for (const { pattern, source } of PYTHON_INPUT_PATTERNS) {
+        if (pattern.test(body) && !seen.has(source)) {
+            seen.add(source);
+            inputs.push({ source });
+        }
+    }
+    return inputs;
+}
+//# sourceMappingURL=python.js.map

package/dist/model/route-discovery/python.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"python.js","sourceRoot":"","sources":["../../../src/model/route-discovery/python.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;AAmCH,kDAgBC;AA/CD,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E;AAE/E,MAAM,uBAAuB,GAAG,mDAAmD,CAAA;AAEnF,MAAM,sBAAsB,GAAG,6FAA6F,CAAA;AAE5H,MAAM,kBAAkB,GAAG,wCAAwC,CAAA;AAEnE,MAAM,qBAAqB,GAA6D;IACtF,EAAE,OAAO,EAAE,0FAA0F,EAAE,MAAM,EAAE,MAAM,EAAE;IACvH,EAAE,OAAO,EAAE,mDAAmD,EAAE,MAAM,EAAE,OAAO,EAAE;IACjF,EAAE,OAAO,EAAE,2CAA2C,EAAE,MAAM,EAAE,QAAQ,EAAE;IAC1E,EAAE,OAAO,EAAE,iCAAiC,EAAE,MAAM,EAAE,SAAS,EAAE;IACjE,EAAE,OAAO,EAAE,oCAAoC,EAAE,MAAM,EAAE,SAAS,EAAE;IACpE,EAAE,OAAO,EAAE,gCAAgC,EAAE,MAAM,EAAE,OAAO,EAAE;CAC/D,CAAA;AAED,+EAA+E;AAC/E,mBAAmB;AACnB,+EAA+E;AAE/E;;;;;;;GAOG;AACH,SAAgB,mBAAmB,CAAC,OAAe,EAAE,QAAgB;IACnE,MAAM,MAAM,GAAsB,EAAE,CAAA;IACpC,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAA;IACzD,IAAI,GAAG,KAAK,KAAK;QAAE,OAAO,MAAM,CAAA;IAEhC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAEjC,sBAAsB;IACtB,MAAM,WAAW,GAAG,kBAAkB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IACvD,MAAM,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,CAAA;IAE3B,6BAA6B;IAC7B,MAAM,YAAY,GAAG,mBAAmB,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAA;IAClE,MAAM,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAA;IAE5B,OAAO,MAAM,CAAA;AACf,CAAC;AAED,+EAA+E;AAC/E,mBAAmB;AACnB,+EAA+E;AAE/E,SAAS,kBAAkB,CAAC,KAAe,EAAE,QAAgB;IAC3D,MAAM,MAAM,GAAsB,EAAE,CAAA;IAEpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QAErB,+CAA+C;QAC/C,4BAA4B;QAC5B,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAC3B,0FAA0F,CAC3F,CAAA;QAED,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,CAAA;YAC1B,MAAM,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,CAAA;YAChC,MAAM,OAAO,GAAG,UAAU;gBACxB,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;gBAC7F,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;YAEX,yDAAyD;YACzD,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;YAC9C,MAAM,cAAc,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;YAC7E,MAAM,YAAY,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;YAErE,mDAAmD;YACnD,MAAM,WAAW,GAAG,iBAAiB,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;YAC/C,MAAM,WAAW,GAAG,WAAW;gBAC7B,CAAC,CAAC,yBAAyB,CAAC,KAAK,EAAE,WAAW,CAAC,IAAI,GAAG,CAAC,CAAC;gBACxD,CAAC,CAAC,EAAE,CAAA;YACN,MAAM,MAAM,GAAG,wBAAwB,CAAC,WAAW,CAAC,CAAA;YAEpD,MAAM,CAAC,IAAI,CAAC;gBACV,QAAQ;gBACR,OAAO;gBACP,IAAI,EAAE,kBAAkB,CAAC,IAAI,CAAC;gBAC9B,OAAO,EAAE,WAAW,EAAE,IAAI,IAAI,SAAS;gBACvC,WAAW,EAAE,WAAW,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC;gBACvC,SAAS,EAAE,OAAO;gBAClB,cAAc,EAAE,cAAc;gBAC9B,YAAY,EAAE,YAAY;gBAC1B,QAAQ,EAAE,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC5C,MAAM;aACP,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED,+EAA+E;AAC/E,oBAAoB;AACpB,+EAA+E;AAE/E,SAAS,mBAAmB,CAAC,KAAe,EAAE,QAAgB,EAAE,WAAmB;IACjF,MAAM,MAAM,GAAsB,EAAE,CAAA;IAEpC,8CAA8C;IAC9C,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,aAAa,CAAC;QAAE,OAAO,MAAM,CAAA;IAEvD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QAErB,wDAAwD;QACxD,qDAAqD;QACrD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAC1B,6CAA6C,CAC9C,CAAA;QAED,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,SAAS,GAAG,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;YACvD,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;YAEnC,MAAM,CAAC,IAAI,CAAC;gBACV,QAAQ;gBACR,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,6CAA6C;gBAC/D,IAAI,EAAE,mBAAmB,CAAC,SAAS,CAAC;gBACpC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC;gBAC7C,WAAW,EAAE,CAAC,GAAG,CAAC;gBAClB,SAAS,EAAE,QAAQ;gBACnB,cAAc,EAAE,EAAE;gBAClB,YAAY,EAAE,KAAK;gBACnB,QAAQ,EAAE,uBAAuB,CAAC,IAAI,CAAC,SAAS,CAAC;gBACjD,MAAM,EAAE,EAAE;aACX,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED,+EAA+E;AAC/E,mBAAmB;AACnB,+EAA+E;AAE/E,SAAS,iBAAiB,CAAC,KAAe,EAAE,kBAA0B;IACpE,MAAM,UAAU,GAAa,EAAE,CAAA;IAC/B,+DAA+D;IAC/D,KAAK,IAAI,CAAC,GAAG,kBAAkB,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,kBAAkB,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACpF,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QAC/B,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAC1B,CAAC;aAAM,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAK,CAAC,8CAA8C;QACtD,CAAC;IACH,CAAC;IACD,8DAA8D;IAC9D,KAAK,IAAI,CAAC,GAAG,kBAAkB,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,kBAAkB,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7F,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QAC/B,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAC1B,CAAC;aAAM,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC1E,MAAK;QACP,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAA;AACnB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAe,EAAE,aAAqB;IAC/D,KAAK,IAAI,CAAC,GAAG,aAAa,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,aAAa,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACpF,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAA;QAC7D,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAA;QACxC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAe,EAAE,YAAoB;IACtE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,GAAG,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;IACrD,OAAO,KAAK,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAClD,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY;IACtC,2DAA2D;IAC3D,OAAO,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAA;AACjD,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY;IACvC,mEAAmE;IACnE,OAAO,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAA;AACjD,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAY;IAC5C,MAAM,MAAM,GAAiB,EAAE,CAAA;IAC/B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,KAAK,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,qBAAqB,EAAE,CAAC;QACxD,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5C,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YAChB,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;QACzB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/model/route-discovery/types.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Route Discovery Types
+ *
+ * Type definitions for route extraction, mapping, and auth resolution.
+ * Used by CE Phase 2 to provide route context to scoring and AI validation.
+ */
+export type RouteFramework = 'express' | 'nextjs_app' | 'nextjs_pages' | 'fastify' | 'hono' | 'koa' | 'nestjs' | 'django' | 'flask' | 'rails';
+export interface RouteDefinition {
+    filePath: string;
+    methods: string[];
+    path: string;
+    handler: string;
+    handlerLine: number;
+    framework: RouteFramework;
+    authMiddleware: string[];
+    rateLimiting: boolean;
+    isPublic: boolean;
+    inputs: RouteInput[];
+}
+export interface RouteInput {
+    source: 'body' | 'query' | 'params' | 'headers' | 'cookies' | 'files';
+    knownParams?: string[];
+}
+export interface RouteMap {
+    routes: RouteDefinition[];
+    fileToRoutes: Map<string, RouteDefinition[]>;
+}
+export interface MountPoint {
+    path: string;
+    middleware: string[];
+    line: number;
+    isGlobal: boolean;
+    filePath: string;
+}
+export declare function createEmptyRouteMap(): RouteMap;
+//# sourceMappingURL=types.d.ts.map

package/dist/model/route-discovery/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/model/route-discovery/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,MAAM,cAAc,GACtB,SAAS,GAAG,YAAY,GAAG,cAAc,GAAG,SAAS,GACrD,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,OAAO,CAAA;AAE5D,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,cAAc,CAAA;IACzB,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB,YAAY,EAAE,OAAO,CAAA;IACrB,QAAQ,EAAE,OAAO,CAAA;IACjB,MAAM,EAAE,UAAU,EAAE,CAAA;CACrB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,CAAA;IACrE,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;CACvB;AAED,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,eAAe,EAAE,CAAA;IACzB,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,CAAC,CAAA;CAC7C;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,OAAO,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,wBAAgB,mBAAmB,IAAI,QAAQ,CAK9C"}

package/dist/model/route-discovery/types.js

@@ -0,0 +1,16 @@
+"use strict";
+/**
+ * Route Discovery Types
+ *
+ * Type definitions for route extraction, mapping, and auth resolution.
+ * Used by CE Phase 2 to provide route context to scoring and AI validation.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createEmptyRouteMap = createEmptyRouteMap;
+function createEmptyRouteMap() {
+    return {
+        routes: [],
+        fileToRoutes: new Map(),
+    };
+}
+//# sourceMappingURL=types.js.map

package/dist/model/route-discovery/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/model/route-discovery/types.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;AAqCH,kDAKC;AALD,SAAgB,mBAAmB;IACjC,OAAO;QACL,MAAM,EAAE,EAAE;QACV,YAAY,EAAE,IAAI,GAAG,EAAE;KACxB,CAAA;AACH,CAAC"}

package/dist/model/route-discovery/utils.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Route Discovery Utilities
+ *
+ * Shared helpers used across route discovery, scoring, and validation.
+ */
+import type { RouteDefinition } from './types';
+/**
+ * Find the route whose handler line is closest to (and at or before) the finding line.
+ * Falls back to the closest route overall if none are before the finding.
+ */
+export declare function findClosestRoute(routes: RouteDefinition[], findingLine: number): RouteDefinition | null;
+/**
+ * Extract a brace-delimited block starting from a given line.
+ * Tracks brace depth to find the matching closing brace.
+ * Falls back to 50-line limit if no closing brace is found.
+ */
+export declare function extractBlock(lines: string[], startLine: number): string;
+//# sourceMappingURL=utils.d.ts.map

package/dist/model/route-discovery/utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../../src/model/route-discovery/utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAE9C;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,eAAe,EAAE,EAAE,WAAW,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAoBvG;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAcvE"}

package/dist/model/route-discovery/utils.js

@@ -0,0 +1,55 @@
+"use strict";
+/**
+ * Route Discovery Utilities
+ *
+ * Shared helpers used across route discovery, scoring, and validation.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findClosestRoute = findClosestRoute;
+exports.extractBlock = extractBlock;
+/**
+ * Find the route whose handler line is closest to (and at or before) the finding line.
+ * Falls back to the closest route overall if none are before the finding.
+ */
+function findClosestRoute(routes, findingLine) {
+    let best = null;
+    let bestDistance = Infinity;
+    for (const route of routes) {
+        const distance = findingLine - route.handlerLine;
+        if (distance >= 0 && distance < bestDistance) {
+            best = route;
+            bestDistance = distance;
+        }
+    }
+    // If no route is before the finding, return the closest one overall
+    if (!best && routes.length > 0) {
+        best = routes.reduce((a, b) => Math.abs(a.handlerLine - findingLine) < Math.abs(b.handlerLine - findingLine) ? a : b);
+    }
+    return best;
+}
+/**
+ * Extract a brace-delimited block starting from a given line.
+ * Tracks brace depth to find the matching closing brace.
+ * Falls back to 50-line limit if no closing brace is found.
+ */
+function extractBlock(lines, startLine) {
+    let depth = 0;
+    let started = false;
+    const result = [];
+    for (let i = startLine; i < Math.min(startLine + 50, lines.length); i++) {
+        const line = lines[i];
+        result.push(line);
+        for (const ch of line) {
+            if (ch === '{') {
+                depth++;
+                started = true;
+            }
+            if (ch === '}')
+                depth--;
+        }
+        if (started && depth <= 0)
+            break;
+    }
+    return result.join('\n');
+}
+//# sourceMappingURL=utils.js.map

package/dist/model/route-discovery/utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../../src/model/route-discovery/utils.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;AAQH,4CAoBC;AAOD,oCAcC;AA7CD;;;GAGG;AACH,SAAgB,gBAAgB,CAAC,MAAyB,EAAE,WAAmB;IAC7E,IAAI,IAAI,GAA2B,IAAI,CAAA;IACvC,IAAI,YAAY,GAAG,QAAQ,CAAA;IAE3B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,WAAW,GAAG,KAAK,CAAC,WAAW,CAAA;QAChD,IAAI,QAAQ,IAAI,CAAC,IAAI,QAAQ,GAAG,YAAY,EAAE,CAAC;YAC7C,IAAI,GAAG,KAAK,CAAA;YACZ,YAAY,GAAG,QAAQ,CAAA;QACzB,CAAC;IACH,CAAC;IAED,oEAAoE;IACpE,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAC5B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,WAAW,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACtF,CAAA;IACH,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;GAIG;AACH,SAAgB,YAAY,CAAC,KAAe,EAAE,SAAiB;IAC7D,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,IAAI,OAAO,GAAG,KAAK,CAAA;IACnB,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,KAAK,IAAI,CAAC,GAAG,SAAS,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,GAAG,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACxE,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACrB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACjB,KAAK,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC;YACtB,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBAAC,KAAK,EAAE,CAAC;gBAAC,OAAO,GAAG,IAAI,CAAA;YAAC,CAAC;YAC3C,IAAI,EAAE,KAAK,GAAG;gBAAE,KAAK,EAAE,CAAA;QACzB,CAAC;QACD,IAAI,OAAO,IAAI,KAAK,IAAI,CAAC;YAAE,MAAK;IAClC,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAC1B,CAAC"}

package/dist/model/route-hierarchy.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Route Hierarchy Utility
+ * Understands framework-specific route hierarchy conventions
+ *
+ * This addresses false positives where routes inside authenticated layouts
+ * are flagged for "missing auth" when they inherit protection from parents.
+ *
+ * Key insight: Modern frameworks use layouts/middleware that protect entire
+ * route subtrees - child routes inherit this protection.
+ */
+export interface RouteProtectionContext {
+    /** Whether this route is in a protected hierarchy */
+    isInProtectedHierarchy: boolean;
+    /** Sources of protection (e.g., ["Remix _authenticated+ layout"]) */
+    protectionSource: string[];
+    /** Framework detected */
+    framework?: 'remix' | 'nextjs' | 'sveltekit' | 'nuxt' | 'unknown';
+    /** Whether this is in an admin section */
+    isAdminRoute: boolean;
+}
+/**
+ * Get route protection context for a file path
+ *
+ * @param filePath - The full file path to analyze
+ * @returns RouteProtectionContext with protection information
+ */
+export declare function getRouteProtectionContext(filePath: string): RouteProtectionContext;
+/**
+ * Check if a file path is inside a protected route hierarchy
+ *
+ * @param filePath - The full file path
+ * @returns true if the route is protected by its hierarchy
+ */
+export declare function isProtectedByRouteHierarchy(filePath: string): boolean;
+/**
+ * Check if a file path is inside an admin route section
+ *
+ * @param filePath - The full file path
+ * @returns true if this is an admin route
+ */
+export declare function isAdminRoute(filePath: string): boolean;
+/**
+ * Check if a component is likely used only within authenticated routes
+ * Useful for components in /components/admin/ or similar
+ *
+ * @param filePath - The full file path
+ * @returns true if this component is likely only used in authenticated contexts
+ */
+export declare function isAuthenticatedOnlyComponent(filePath: string): boolean;
+//# sourceMappingURL=route-hierarchy.d.ts.map

package/dist/model/route-hierarchy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-hierarchy.d.ts","sourceRoot":"","sources":["../../src/model/route-hierarchy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,WAAW,sBAAsB;IACrC,qDAAqD;IACrD,sBAAsB,EAAE,OAAO,CAAA;IAC/B,qEAAqE;IACrE,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,yBAAyB;IACzB,SAAS,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,WAAW,GAAG,MAAM,GAAG,SAAS,CAAA;IACjE,0CAA0C;IAC1C,YAAY,EAAE,OAAO,CAAA;CACtB;AAiHD;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,GAAG,sBAAsB,CA8DlF;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAGrE;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAGtD;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAiBtE"}