@praneeth_54/agentdoctor 2.1.0 → 3.0.0

package/dist/languages/rust.js

@@ -0,0 +1,93 @@
+/** Lightweight line-oriented Rust scan — not syn/rustc AST. */
+export function parseRustSource(filePath, source) {
+    const lines = source.split(/\r?\n/);
+    const limitations = [
+        "Rust parsing uses a lightweight line scanner — not syn or tree-sitter-rust; calls/types are partial.",
+        "Full rustc/syn or tree-sitter-rust integration remains an EXTERNAL enhancement path (not bundled).",
+    ];
+    let moduleName = "";
+    const imports = [];
+    const symbols = [];
+    for (let i = 0; i < lines.length; i++) {
+        const trimmed = lines[i].trim();
+        if (!moduleName && trimmed.startsWith("mod ") && !trimmed.includes("{")) {
+            moduleName = trimmed.slice("mod ".length).split(/\s+/)[0]?.replace(";", "") ?? "";
+        }
+        if (trimmed.startsWith("use ") && trimmed.endsWith(";")) {
+            const spec = trimmed.slice("use ".length, -1).trim();
+            if (spec)
+                imports.push({ fromFile: filePath, specifier: spec, evidence: "ast" });
+        }
+        const structMatch = /^(?:pub\s+)?(?:struct|enum|trait|type)\s+(\w+)/.exec(trimmed);
+        if (structMatch) {
+            let kind = "struct";
+            if (trimmed.includes("enum"))
+                kind = "enum";
+            else if (trimmed.includes("trait"))
+                kind = "trait";
+            else if (trimmed.includes("type"))
+                kind = "type";
+            symbols.push({
+                id: `rust:${kind}:${filePath}:${structMatch[1]}`,
+                name: structMatch[1],
+                kind,
+                file: filePath,
+                line: i + 1,
+                evidence: "ast",
+            });
+        }
+        const fnMatch = /^(?:pub\s+)?(?:async\s+)?fn\s+(\w+)/.exec(trimmed);
+        if (fnMatch) {
+            symbols.push({
+                id: `rust:function:${filePath}:${fnMatch[1]}`,
+                name: fnMatch[1],
+                kind: "function",
+                file: filePath,
+                line: i + 1,
+                evidence: "ast",
+            });
+        }
+        const implMatch = /^impl(?:<[^>]+>)?\s+(?:\w+::)*(\w+)/.exec(trimmed);
+        if (implMatch) {
+            symbols.push({
+                id: `rust:impl:${filePath}:${implMatch[1]}`,
+                name: implMatch[1],
+                kind: "impl",
+                file: filePath,
+                line: i + 1,
+                evidence: "ast",
+            });
+        }
+    }
+    return { moduleName, imports, symbols, limitations };
+}
+const RUST_CAPABILITIES = () => ({
+    parse: "supported",
+    symbols: "supported",
+    definitions: "unsupported",
+    references: "unsupported",
+    imports: "supported",
+    calls: "partial",
+    diagnostics: "unsupported",
+    types: "partial",
+});
+export const rustAdapter = {
+    id: "rust",
+    extensions: [".rs"],
+    capabilities: RUST_CAPABILITIES,
+    async parse(filePath, source) {
+        const summary = parseRustSource(filePath, source);
+        const ok = Boolean(summary.moduleName || summary.symbols.length > 0 || summary.imports.length > 0);
+        return {
+            language: "rust",
+            file: filePath,
+            ok,
+            capabilities: rustAdapter.capabilities(),
+            symbols: summary.symbols,
+            imports: summary.imports,
+            calls: [],
+            diagnostics: ok ? [] : ["no mod, use, or declarations detected"],
+            limitations: summary.limitations,
+        };
+    },
+};

package/dist/languages/types.d.ts

@@ -3,7 +3,7 @@
  * Unsupported capabilities must be reported as unsupported, never as inferred AST.
  */
 export type LanguageId = "typescript" | "javascript" | "python" | "java" | "kotlin" | "go" | "rust" | "php" | "dart" | "unknown";
-export type AdapterCapability = "parse" | "symbols" | "definitions" | "references" | "imports" | "calls" | "diagnostics";
+export type AdapterCapability = "parse" | "symbols" | "definitions" | "references" | "imports" | "calls" | "diagnostics" | "types";
 export interface LanguageSymbol {
     id: string;
     name: string;
@@ -22,11 +22,12 @@ export interface LanguageCall {
     callee: string;
     evidence: "ast" | "unsupported";
 }
+export type AdapterCapabilityLevel = "supported" | "unsupported" | "partial";
 export interface ParseResult {
     language: LanguageId;
     file: string;
     ok: boolean;
-    capabilities: Partial<Record<AdapterCapability, "supported" | "unsupported">>;
+    capabilities: Partial<Record<AdapterCapability, AdapterCapabilityLevel>>;
     symbols: LanguageSymbol[];
     imports: LanguageImport[];
     calls: LanguageCall[];
@@ -36,7 +37,7 @@ export interface ParseResult {
 export interface LanguageAdapter {
     id: LanguageId;
     extensions: string[];
-    capabilities(): Partial<Record<AdapterCapability, "supported" | "unsupported">>;
+    capabilities(): Partial<Record<AdapterCapability, AdapterCapabilityLevel>>;
     parse(filePath: string, source: string): Promise<ParseResult>;
 }
 export declare function detectLanguage(filePath: string): LanguageId;

package/dist/mcp/agent/registry.d.ts

@@ -1,6 +1,6 @@
 import type { Tool } from "@modelcontextprotocol/sdk/types.js";
 import type { ModelProvider } from "../../ai/types.js";
-export declare const AGENT_MCP_TOOL_NAMES: readonly ["project_context", "project_ask", "code_search", "file_read", "file_create", "file_edit", "agent_plan", "change_verify"];
+export declare const AGENT_MCP_TOOL_NAMES: readonly ["project_context", "project_ask", "code_search", "file_read", "file_create", "file_edit", "approval_issue", "agent_plan", "change_verify"];
 export type AgentMcpToolName = (typeof AGENT_MCP_TOOL_NAMES)[number];
 export declare function listAgentMcpTools(): Tool[];
 export declare function invokeAgentMcpTool(root: string, name: string, args: Record<string, unknown>, options?: {

package/dist/mcp/agent/registry.js

@@ -4,6 +4,8 @@ import { buildAgentPlan } from "../../agent/plan.js";
 import { executeAgentTool, newToolCall } from "../../agent/tools/index.js";
 import { retrieveProjectContext } from "../../agent/context/retrieve.js";
 import { summarizeProjectForChat } from "../../agent/chat/project-summary.js";
+import { consumeApprovalGrant, issueApprovalGrant, hashPlanPayload, hashFileWritePlan, } from "../../product/approval/session.js";
+import { assertForensicReadOnly } from "../../product/forensic/mode.js";
 export const AGENT_MCP_TOOL_NAMES = [
     "project_context",
     "project_ask",
@@ -11,6 +13,7 @@ export const AGENT_MCP_TOOL_NAMES = [
     "file_read",
     "file_create",
     "file_edit",
+    "approval_issue",
     "agent_plan",
     "change_verify",
 ];
@@ -58,30 +61,53 @@ export function listAgentMcpTools() {
         },
         {
             name: "file_create",
-            description: "WRITE: Create file (requires approved=true). Path-safe; never shell. Model cannot self-approve.",
+            description: "WRITE: Create file. Requires approvalToken from issueApprovalGrant / CLI --approve. Bare approved=true is rejected.",
             inputSchema: {
                 type: "object",
                 properties: {
                     path: { type: "string" },
                     content: { type: "string" },
-                    approved: { type: "boolean" },
+                    approvalToken: { type: "string" },
+                    approved: {
+                        type: "boolean",
+                        description: "Legacy flag — insufficient alone; approvalToken required",
+                    },
                 },
-                required: ["path", "content", "approved"],
+                required: ["path", "content", "approvalToken"],
                 additionalProperties: false,
             },
         },
         {
             name: "file_edit",
-            description: "WRITE: Edit file (requires approved=true). Path-safe.",
+            description: "WRITE: Edit file. Requires approvalToken from issueApprovalGrant / CLI --approve.",
             inputSchema: {
                 type: "object",
                 properties: {
                     path: { type: "string" },
                     content: { type: "string" },
                     oldContent: { type: "string" },
-                    approved: { type: "boolean" },
+                    approvalToken: { type: "string" },
+                    approved: {
+                        type: "boolean",
+                        description: "Legacy flag — insufficient alone; approvalToken required",
+                    },
+                },
+                required: ["path", "approvalToken"],
+                additionalProperties: false,
+            },
+        },
+        {
+            name: "approval_issue",
+            description: "TRUSTED: Issue a short-lived approval grant for writes. Requires AGENTDOCTOR_MCP_TRUSTED_APPROVE=1 in the MCP server environment (not model-settable).",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    action: { type: "string" },
+                    resources: { type: "array", items: { type: "string" } },
+                    planHash: { type: "string" },
+                    risk: { type: "string", enum: ["LOW", "MEDIUM", "HIGH", "CRITICAL"] },
                 },
-                required: ["path", "approved"],
+                required: ["action", "resources", "planHash"],
                 additionalProperties: false,
             },
         },
@@ -126,18 +152,6 @@ export async function invokeAgentMcpTool(root, name, args, options) {
                     };
                 }
                 const provider = options?.provider ?? createModelProvider(loadAiConfig());
-                if (provider.id === "none") {
-                    return {
-                        structured: {
-                            ok: false,
-                            error: {
-                                code: "provider_none",
-                                message: "AI chat is not configured. Set AGENTDOCTOR_AI_PROVIDER=mock (or openai-compatible). Silent mock fallback is disabled.",
-                            },
-                        },
-                        isError: true,
-                    };
-                }
                 const chat = new ChatService({
                     root,
                     provider,
@@ -147,7 +161,7 @@ export async function invokeAgentMcpTool(root, name, args, options) {
                     const response = await chat.ask(question);
                     return {
                         structured: { ok: response.status === "ok", response },
-                        isError: response.status !== "ok",
+                        isError: response.status !== "ok" && response.status !== "provider-none",
                     };
                 }
                 finally {
@@ -163,11 +177,23 @@ export async function invokeAgentMcpTool(root, name, args, options) {
                 return { structured: result, isError: !result.ok };
             }
             case "file_create": {
-                if (args.approved !== true) {
+                assertForensicReadOnly(process.env.AGENTDOCTOR_FORENSIC_MODE === "1");
+                const token = typeof args.approvalToken === "string" ? args.approvalToken : undefined;
+                const pathArg = typeof args.path === "string" ? args.path : "";
+                const content = typeof args.content === "string" ? args.content : "";
+                const planHash = hashFileWritePlan("file_create", pathArg, content);
+                const gate = await consumeApprovalGrant({
+                    root,
+                    token,
+                    action: "file_create",
+                    resources: [pathArg],
+                    requirePlanHash: planHash,
+                });
+                if (!gate.ok) {
                     return {
                         structured: {
                             ok: false,
-                            error: { code: "approval_required", message: "approved=true required" },
+                            error: { code: "approval_required", message: gate.reason },
                         },
                         isError: true,
                     };
@@ -176,11 +202,23 @@ export async function invokeAgentMcpTool(root, name, args, options) {
                 return { structured: result, isError: !result.ok };
             }
             case "file_edit": {
-                if (args.approved !== true) {
+                assertForensicReadOnly(process.env.AGENTDOCTOR_FORENSIC_MODE === "1");
+                const token = typeof args.approvalToken === "string" ? args.approvalToken : undefined;
+                const pathArg = typeof args.path === "string" ? args.path : "";
+                const content = typeof args.content === "string" ? args.content : "";
+                const planHash = hashFileWritePlan("file_edit", pathArg, content);
+                const gate = await consumeApprovalGrant({
+                    root,
+                    token,
+                    action: "file_edit",
+                    resources: [pathArg],
+                    requirePlanHash: planHash,
+                });
+                if (!gate.ok) {
                     return {
                         structured: {
                             ok: false,
-                            error: { code: "approval_required", message: "approved=true required" },
+                            error: { code: "approval_required", message: gate.reason },
                         },
                         isError: true,
                     };
@@ -192,6 +230,54 @@ export async function invokeAgentMcpTool(root, name, args, options) {
                 }), { allowWrite: true, approvedByHuman: true });
                 return { structured: result, isError: !result.ok };
             }
+            case "approval_issue": {
+                if (process.env.AGENTDOCTOR_MCP_TRUSTED_APPROVE !== "1") {
+                    return {
+                        structured: {
+                            ok: false,
+                            error: {
+                                code: "trust_required",
+                                message: "approval_issue requires AGENTDOCTOR_MCP_TRUSTED_APPROVE=1 in the MCP host environment",
+                            },
+                        },
+                        isError: true,
+                    };
+                }
+                const resources = Array.isArray(args.resources)
+                    ? args.resources.filter((r) => typeof r === "string")
+                    : [];
+                const action = typeof args.action === "string" ? args.action : "file_edit";
+                const planHash = typeof args.planHash === "string" && args.planHash.length >= 8
+                    ? args.planHash
+                    : hashPlanPayload(action);
+                const risk = (typeof args.risk === "string" ? args.risk : "MEDIUM");
+                try {
+                    const grant = await issueApprovalGrant({
+                        root,
+                        action,
+                        resources,
+                        risk,
+                        planHash,
+                        actor: "mcp-trusted-host",
+                    });
+                    return {
+                        structured: { ok: true, token: grant.token, expiresAt: grant.expiresAt, planHash },
+                        isError: false,
+                    };
+                }
+                catch (error) {
+                    return {
+                        structured: {
+                            ok: false,
+                            error: {
+                                code: "invalid_grant",
+                                message: error instanceof Error ? error.message : String(error),
+                            },
+                        },
+                        isError: true,
+                    };
+                }
+            }
             case "agent_plan": {
                 const goal = typeof args.goal === "string" ? args.goal : "";
                 const plan = await buildAgentPlan({ root, goal });

package/dist/mcp/intelligence/handlers.d.ts

@@ -14,3 +14,6 @@ export declare function handleArchitectureCheckTool(rootInput: string): Promise<
 export declare function handleProofInspectTool(rootInput: string, args: Record<string, unknown>): Promise<unknown>;
 export declare function handleEvidenceInspectTool(rootInput: string, args: Record<string, unknown>): Promise<unknown>;
 export declare function handleGraphQueryTool(rootInput: string, args: Record<string, unknown>): Promise<unknown>;
+export declare function handleProjectDnaTool(rootInput: string): Promise<unknown>;
+export declare function handleSoftwareMapTool(rootInput: string): Promise<unknown>;
+export declare function handleWhatIfTool(rootInput: string, args: Record<string, unknown>): Promise<unknown>;

package/dist/mcp/intelligence/handlers.js

@@ -11,6 +11,9 @@ import { redactSecrets } from "../../platform/security/redact.js";
 import { resolveRepoRoot } from "../../utils/path.js";
 import { CONTRACTS_VERSION } from "../../contracts/index.js";
 import { assertSafeRepoTarget } from "./path-safety.js";
+import { buildProjectDna } from "../../product/dna/build.js";
+import { buildSoftwareMap } from "../../product/map/software-map.js";
+import { analyzeWhatIf } from "../../product/whatif/engine.js";
 function requireString(args, key) {
     const value = args[key];
     if (typeof value !== "string")
@@ -362,3 +365,28 @@ export async function handleGraphQueryTool(rootInput, args) {
         ],
     });
 }
+export async function handleProjectDnaTool(rootInput) {
+    const root = resolveRepoRoot(rootInput);
+    const dna = await buildProjectDna(root);
+    return redactDeep({ ok: true, dna, limitations: dna.limitations });
+}
+export async function handleSoftwareMapTool(rootInput) {
+    const root = resolveRepoRoot(rootInput);
+    const map = await buildSoftwareMap(root);
+    return redactDeep({ ok: true, map, limitations: map.limitations });
+}
+export async function handleWhatIfTool(rootInput, args) {
+    const root = resolveRepoRoot(rootInput);
+    const target = requireString(args, "target");
+    if (!target) {
+        return invalidArgument("target required (repo-relative path or symbol)");
+    }
+    try {
+        assertSafeRepoTarget(root, target);
+    }
+    catch {
+        return pathEscape();
+    }
+    const report = await analyzeWhatIf(root, target);
+    return redactDeep({ ok: true, report, limitations: report.limitations });
+}

package/dist/mcp/intelligence/registry.d.ts

@@ -1,5 +1,5 @@
 import type { Tool } from "@modelcontextprotocol/sdk/types.js";
-export declare const INTELLIGENCE_MCP_TOOL_NAMES: readonly ["repo_overview", "codebase_search", "symbol_lookup", "dependency_lookup", "call_graph_lookup", "test_impact", "refactor_impact", "code_health", "architecture_info", "architecture_check", "knowledge_retrieve", "policy_evaluate", "change_analyze", "proof_inspect", "evidence_inspect", "graph_query"];
+export declare const INTELLIGENCE_MCP_TOOL_NAMES: readonly ["repo_overview", "codebase_search", "symbol_lookup", "dependency_lookup", "call_graph_lookup", "test_impact", "refactor_impact", "code_health", "architecture_info", "architecture_check", "knowledge_retrieve", "policy_evaluate", "change_analyze", "proof_inspect", "evidence_inspect", "graph_query", "project_dna", "software_map", "what_if"];
 export type IntelligenceMcpToolName = (typeof INTELLIGENCE_MCP_TOOL_NAMES)[number];
 export declare function listIntelligenceMcpTools(): Tool[];
 export declare function invokeIntelligenceMcpTool(root: string, name: string, args: Record<string, unknown>): Promise<{

package/dist/mcp/intelligence/registry.js

@@ -1,4 +1,4 @@
-import { handleArchitectureCheckTool, handleArchitectureTool, handleCallGraphLookup, handleChangeAnalyzeTool, handleCodeHealthTool, handleCodebaseSearch, handleDependencyLookup, handleEvidenceInspectTool, handleGraphQueryTool, handleKnowledgeTool, handlePolicyEvalTool, handleProofInspectTool, handleRefactorImpactTool, handleRepoOverview, handleSymbolLookup, handleTestImpactTool, } from "./handlers.js";
+import { handleArchitectureCheckTool, handleArchitectureTool, handleCallGraphLookup, handleChangeAnalyzeTool, handleCodeHealthTool, handleCodebaseSearch, handleDependencyLookup, handleEvidenceInspectTool, handleGraphQueryTool, handleKnowledgeTool, handlePolicyEvalTool, handleProofInspectTool, handleRefactorImpactTool, handleRepoOverview, handleSymbolLookup, handleTestImpactTool, handleProjectDnaTool, handleSoftwareMapTool, handleWhatIfTool, } from "./handlers.js";
 export const INTELLIGENCE_MCP_TOOL_NAMES = [
     "repo_overview",
     "codebase_search",
@@ -16,6 +16,9 @@ export const INTELLIGENCE_MCP_TOOL_NAMES = [
     "proof_inspect",
     "evidence_inspect",
     "graph_query",
+    "project_dna",
+    "software_map",
+    "what_if",
 ];
 const emptyObjectSchema = {
     type: "object",
@@ -166,6 +169,26 @@ export function listIntelligenceMcpTools() {
                 additionalProperties: false,
             },
         },
+        {
+            name: "project_dna",
+            description: "READ: Deterministic project DNA fingerprint (languages, frameworks, monorepo). No shell.",
+            inputSchema: emptyObjectSchema,
+        },
+        {
+            name: "software_map",
+            description: "READ: Navigable software map tree from discovery heuristics. No shell.",
+            inputSchema: emptyObjectSchema,
+        },
+        {
+            name: "what_if",
+            description: "READ: What-if impact analysis for a repo-relative path or symbol (graph-backed). Path validated.",
+            inputSchema: {
+                type: "object",
+                properties: { target: { type: "string" } },
+                required: ["target"],
+                additionalProperties: false,
+            },
+        },
     ];
 }
 export async function invokeIntelligenceMcpTool(root, name, args) {
@@ -203,6 +226,12 @@ export async function invokeIntelligenceMcpTool(root, name, args) {
                 return { structured: await handleEvidenceInspectTool(root, args), isError: false };
             case "graph_query":
                 return { structured: await handleGraphQueryTool(root, args), isError: false };
+            case "project_dna":
+                return { structured: await handleProjectDnaTool(root), isError: false };
+            case "software_map":
+                return { structured: await handleSoftwareMapTool(root), isError: false };
+            case "what_if":
+                return { structured: await handleWhatIfTool(root, args), isError: false };
             default:
                 return {
                     structured: {

package/dist/product/api/doctor.d.ts

@@ -0,0 +1,14 @@
+import type { ProductEvidence, TruthLabel } from "../truth.js";
+export interface ApiEndpointFinding {
+    method: string;
+    pathPattern: string;
+    framework: string;
+    truth: TruthLabel;
+    evidence: ProductEvidence[];
+}
+export interface ApiDoctorReport {
+    root: string;
+    endpoints: ApiEndpointFinding[];
+    limitations: string[];
+}
+export declare function analyzeApiSurface(rootInput: string): Promise<ApiDoctorReport>;

package/dist/product/api/doctor.js

@@ -0,0 +1,185 @@
+import { lineNumberAt, loadProjectSourceFiles } from "../evidence-scan.js";
+import { discoverOpenApiEndpoints } from "./openapi.js";
+const ROUTE_PATTERNS = [
+    {
+        framework: "express",
+        regex: /\.(?:get|post|put|patch|delete|all)\(\s*['"`]([^'"`]+)['"`]/gi,
+        pathGroup: 1,
+    },
+    {
+        framework: "express-router",
+        regex: /router\.(?:get|post|put|patch|delete|all)\(\s*['"`]([^'"`]+)['"`]/gi,
+        pathGroup: 1,
+    },
+    {
+        framework: "fastify",
+        regex: /fastify\.(?:get|post|put|patch|delete)\(\s*['"`]([^'"`]+)['"`]/gi,
+        pathGroup: 1,
+    },
+    {
+        framework: "nestjs",
+        regex: /@(Get|Post|Put|Patch|Delete|All)\(\s*['"`]([^'"`]+)['"`]?\s*\)/g,
+        methodGroup: 1,
+        pathGroup: 2,
+    },
+    {
+        framework: "nestjs",
+        regex: /@(Get|Post|Put|Patch|Delete|All)\(\)/g,
+        methodGroup: 1,
+        pathGroup: 0,
+    },
+    {
+        framework: "laravel",
+        regex: /Route::(get|post|put|patch|delete|any)\(\s*['"]([^'"]+)['"]/gi,
+        methodGroup: 1,
+        pathGroup: 2,
+    },
+    {
+        framework: "flask",
+        regex: /@(?:app|bp|blueprint)\.(?:route|get|post|put|patch|delete)\(\s*['"]([^'"]+)['"]/gi,
+        pathGroup: 1,
+    },
+    {
+        framework: "flask",
+        regex: /@(?:app|bp)\.(get|post|put|patch|delete)\(\s*['"]([^'"]+)['"]/gi,
+        methodGroup: 1,
+        pathGroup: 2,
+    },
+];
+function inferMethodFromMatch(full, pattern, groups) {
+    const methodRaw = pattern.methodGroup !== undefined ? groups[pattern.methodGroup] : undefined;
+    if (methodRaw) {
+        return methodRaw.toUpperCase();
+    }
+    const lower = full.toLowerCase();
+    for (const m of ["get", "post", "put", "patch", "delete", "all"]) {
+        if (lower.includes(`.${m}(`) || lower.includes(`@${m}`) || lower.includes(`::${m}(`)) {
+            return m === "all" ? "ALL" : m.toUpperCase();
+        }
+    }
+    return pattern.defaultMethod ?? "UNKNOWN";
+}
+function scanFile(relativePath, content) {
+    const findings = [];
+    for (const pattern of ROUTE_PATTERNS) {
+        pattern.regex.lastIndex = 0;
+        let match;
+        while ((match = pattern.regex.exec(content)) !== null) {
+            const pathGroup = pattern.pathGroup;
+            let pathPattern = pathGroup > 0 ? (match[pathGroup] ?? "") : "/";
+            if (!pathPattern && pattern.framework === "nestjs")
+                pathPattern = "/";
+            if (!pathPattern)
+                continue;
+            const method = inferMethodFromMatch(match[0], pattern, match);
+            const line = lineNumberAt(content, match.index);
+            findings.push({
+                method,
+                pathPattern,
+                framework: pattern.framework,
+                truth: "INFERRED",
+                evidence: [
+                    {
+                        path: relativePath,
+                        line,
+                        excerpt: match[0].trim().slice(0, 160),
+                    },
+                ],
+            });
+        }
+    }
+    return findings;
+}
+function scanGraphqlSurface(relativePath, content) {
+    const findings = [];
+    const typeQueryRe = /type\s+Query\s*\{/g;
+    let match;
+    while ((match = typeQueryRe.exec(content)) !== null) {
+        findings.push({
+            method: "GRAPHQL",
+            pathPattern: "Query",
+            framework: "graphql-sdl",
+            truth: "INFERRED",
+            evidence: [
+                {
+                    path: relativePath,
+                    line: lineNumberAt(content, match.index),
+                    excerpt: match[0].trim(),
+                },
+            ],
+        });
+    }
+    const gqlRe = /gql`\s*([\s\S]*?)`/g;
+    while ((match = gqlRe.exec(content)) !== null) {
+        const inner = match[1] ?? "";
+        const opMatch = /(?:query|mutation|subscription)\s+(\w+)/i.exec(inner);
+        const opName = opMatch?.[1] ?? "anonymous";
+        findings.push({
+            method: "GRAPHQL",
+            pathPattern: opName,
+            framework: "graphql-tag",
+            truth: "INFERRED",
+            evidence: [
+                {
+                    path: relativePath,
+                    line: lineNumberAt(content, match.index),
+                    excerpt: match[0].trim().slice(0, 160),
+                },
+            ],
+        });
+    }
+    return findings;
+}
+const SOURCE_FILTER = (rel) => {
+    const lower = rel.toLowerCase();
+    if (lower.endsWith(".graphql") || lower.endsWith(".gql"))
+        return true;
+    if (lower.endsWith(".php") && (lower.includes("routes/") || lower.includes("route")))
+        return true;
+    if (lower.endsWith(".py") &&
+        (lower.includes("routes") || lower.includes("views") || lower.includes("app"))) {
+        return true;
+    }
+    if (lower.endsWith(".ts") ||
+        lower.endsWith(".tsx") ||
+        lower.endsWith(".js") ||
+        lower.endsWith(".jsx")) {
+        return (lower.includes("route") ||
+            lower.includes("controller") ||
+            lower.includes("api/") ||
+            lower.includes("server") ||
+            lower.includes("app.module") ||
+            lower.includes("graphql") ||
+            lower.includes("schema"));
+    }
+    return false;
+};
+export async function analyzeApiSurface(rootInput) {
+    const { root, files, limitations: scanLimits, } = await loadProjectSourceFiles(rootInput, SOURCE_FILTER);
+    const limitations = [
+        "Endpoint discovery uses regex on route declarations; middleware, prefixes, and global mounts are not resolved.",
+        "Dynamic route paths and framework-specific route files may be missed.",
+        "GraphQL schema extraction (PARTIAL): static SDL `type Query` and gql` template literals only — not live gateway introspection.",
+        ...scanLimits,
+    ];
+    const endpoints = [];
+    for (const file of files) {
+        endpoints.push(...scanFile(file.relativePath, file.content));
+        endpoints.push(...scanGraphqlSurface(file.relativePath, file.content));
+    }
+    const openApi = await discoverOpenApiEndpoints(root);
+    limitations.push(...openApi.limitations);
+    endpoints.push(...openApi.endpoints);
+    const seen = new Set();
+    const deduped = endpoints.filter((e) => {
+        const key = `${e.method}:${e.pathPattern}:${e.framework}:${e.evidence[0]?.path}:${e.evidence[0]?.line}`;
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    });
+    deduped.sort((a, b) => a.pathPattern === b.pathPattern
+        ? a.method.localeCompare(b.method)
+        : a.pathPattern.localeCompare(b.pathPattern));
+    return { root, endpoints: deduped, limitations };
+}

package/dist/product/api/openapi.d.ts

@@ -0,0 +1,7 @@
+import type { ProductEvidence, TruthLabel } from "../truth.js";
+import type { ApiEndpointFinding } from "./doctor.js";
+export declare function discoverOpenApiEndpoints(rootInput: string, maxFileSizeBytes?: number): Promise<{
+    endpoints: ApiEndpointFinding[];
+    limitations: string[];
+}>;
+export type { TruthLabel, ProductEvidence };