@skyramp/mcp 0.3.8 → 0.4.0-rc.1

package/build/utils/routeParsers.js

@@ -1,951 +0,0 @@
-import * as fs from "fs";
-import * as os from "os";
-import * as path from "path";
-import { execFileSync } from "child_process";
-import { joinRoutePrefix, resolvePythonMountPrefixes } from "./pythonMountPrefixes.js";
-import { logger } from "./logger.js";
-export function nextjsFileToApiPath(filePath) {
-    const pagesMatch = filePath.match(/(?:^|\/)pages\/(api\/.+)\.[jt]sx?$/);
-    if (pagesMatch) {
-        let route = "/" + pagesMatch[1];
-        route = route.replace(/\/index$/, "");
-        route = route
-            .replace(/\[\.\.\.(\w+)\]/g, "{$1}")
-            .replace(/\[(\w+)\]/g, "{$1}");
-        return route;
-    }
-    const appMatch = filePath.match(/(?:^|\/)app\/(api\/.+)\/route\.[jt]sx?$/);
-    if (appMatch) {
-        let route = "/" + appMatch[1];
-        route = route
-            .replace(/\[\.\.\.(\w+)\]/g, "{$1}")
-            .replace(/\[(\w+)\]/g, "{$1}");
-        return route;
-    }
-    return null;
-}
-// UI component file extensions are unambiguously frontend — never route definitions.
-const UI_COMPONENT_EXT = /\.(jsx|tsx|vue|svelte)$/i;
-// Frontend-file extensions for UI-change detection (broader than UI_COMPONENT_EXT —
-// includes template/markup files that backend-only PRs won't touch). Used by
-// testbot-prompts.ts to gate the UI pre-scan and capture-act-capture sections,
-// and anywhere else that needs to ask "does this PR touch the frontend?".
-// Single source of truth for that question.
-export const UI_FILE_EXTENSIONS = ['tsx', 'jsx', 'vue', 'svelte', 'html', 'xml'];
-// Git pathspec form of the UI-file filter — usable directly with `git diff`'s
-// trailing pathspec args, no external tool needed. Avoids the "agent shell
-// has grep aliased to rg" failure mode where `grep -E` becomes `rg -E`
-// (which means `--encoding`, not extended regex). Each entry is `*.ext`;
-// pass them as `-- '*.tsx' '*.jsx' ...` to git diff.
-export const UI_FILE_GIT_PATHSPEC = UI_FILE_EXTENSIONS.map(ext => `'*.${ext}'`).join(' ');
-// Pipe-joined form of the UI extensions for use inside an extended regex
-// (e.g. `grep -E '\\.(tsx|jsx|vue|svelte|html|xml) '`). Mirrors
-// UI_FILE_GIT_PATHSPEC but for grep over a pre-computed diff file.
-export const UI_FILE_EXTENSIONS_PIPED = UI_FILE_EXTENSIONS.join('|');
-export function parseRouteLine(line, sourceFile) {
-    const stripped = line.replace(/^[+-]\s*/, "").trim();
-    const isComponent = UI_COMPONENT_EXT.test(sourceFile);
-    const decoratorMatch = stripped.match(/@(?:\w+)\.(get|post|put|patch|delete|head|options)\s*\(\s*["']([^"'?#]*)/i);
-    if (decoratorMatch) {
-        return {
-            method: decoratorMatch[1].toUpperCase(),
-            path: decoratorMatch[2],
-            sourceFile,
-        };
-    }
-    const flaskMatch = stripped.match(/@\w+\.route\s*\(\s*["']([^"'?#]+)["'][^)]*methods\s*=\s*\[["'](\w+)["']/i);
-    if (flaskMatch) {
-        return {
-            method: flaskMatch[2].toUpperCase(),
-            path: flaskMatch[1],
-            sourceFile,
-        };
-    }
-    const expressMatch = stripped.match(/(?:router|app)\.(get|post|put|patch|delete)\s*\(\s*["']([^"'?#]+)/i);
-    if (expressMatch && !isComponent) {
-        return {
-            method: expressMatch[1].toUpperCase(),
-            path: expressMatch[2],
-            sourceFile,
-        };
-    }
-    const springMatch = stripped.match(/@(Get|Post|Put|Patch|Delete)Mapping\s*(?:\(\s*(?:(?:value|path)\s*=\s*)?["']([^"'?#]+)["'])?/i);
-    if (springMatch && springMatch[2]) {
-        return {
-            method: springMatch[1].toUpperCase(),
-            path: springMatch[2],
-            sourceFile,
-        };
-    }
-    // @RequestMapping at method level — without explicit method = RequestMethod.X it matches
-    // all HTTP verbs, so emit "MULTI" as the sentinel rather than guessing GET.
-    const requestMappingMatch = stripped.match(/@RequestMapping\s*\(\s*(?:(?:value|path)\s*=\s*)?["']([^"'?#]+)["']/i);
-    if (requestMappingMatch) {
-        const methodMatches = [...stripped.matchAll(/RequestMethod\.([A-Z]+)/gi)];
-        const method = methodMatches.length === 1 ? methodMatches[0][1].toUpperCase() : "MULTI";
-        return { method, path: requestMappingMatch[1], sourceFile };
-    }
-    const nestjsMatch = stripped.match(/@(Get|Post|Put|Patch|Delete)\s*\(\s*["']([^"'?#]+)["']/i);
-    if (nestjsMatch && !isComponent) {
-        return {
-            method: nestjsMatch[1].toUpperCase(),
-            path: nestjsMatch[2],
-            sourceFile,
-        };
-    }
-    const nextjsMethodMatch = stripped.match(/req\.method\s*===?\s*["'](GET|POST|PUT|PATCH|DELETE)["']/i);
-    if (nextjsMethodMatch) {
-        const apiPath = nextjsFileToApiPath(sourceFile);
-        if (apiPath) {
-            return {
-                method: nextjsMethodMatch[1].toUpperCase(),
-                path: apiPath,
-                sourceFile,
-            };
-        }
-    }
-    // Next.js guard clause: `if (req.method !== "POST")` means the handler IS for POST
-    const nextjsGuardMatch = stripped.match(/req\.method\s*!==?\s*["'](GET|POST|PUT|PATCH|DELETE)["']/i);
-    if (nextjsGuardMatch) {
-        const apiPath = nextjsFileToApiPath(sourceFile);
-        if (apiPath) {
-            return {
-                method: nextjsGuardMatch[1].toUpperCase(),
-                path: apiPath,
-                sourceFile,
-            };
-        }
-    }
-    const appRouterExportMatch = stripped.match(/export\s+(?:async\s+)?function\s+(GET|POST|PUT|PATCH|DELETE)\s*\(/i);
-    if (appRouterExportMatch) {
-        const apiPath = nextjsFileToApiPath(sourceFile);
-        if (apiPath) {
-            return {
-                method: appRouterExportMatch[1].toUpperCase(),
-                path: apiPath,
-                sourceFile,
-            };
-        }
-    }
-    // Go (Gin, Echo, Chi): <ident>.GET/POST/...("path", handler)
-    //
-    // An all-caps method token (Gin/Echo convention: `g.GET(...)`, `r.POST(...)`)
-    // is unambiguously a route registration — nobody writes `query.GET(...)` — so
-    // it's accepted even without a leading slash (real Gin routes like
-    // `g.GET("ping", ...)` omit it). A CamelCase token (Chi's `r.Get`/`r.Post`)
-    // shares call syntax with a plain getter — `query.Get("term")`,
-    // `Header.Get("Accept-Version")` — so it only counts as a route when the
-    // captured path starts with "/", which every Chi route does and a getter's
-    // argument never does.
-    const ginUpperMatch = stripped.match(/\w+\.(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS)\s*\(\s*["']([^"'?#]+)/);
-    if (ginUpperMatch && sourceFile.endsWith(".go")) {
-        return { method: ginUpperMatch[1], path: ginUpperMatch[2], sourceFile };
-    }
-    const ginCamelMatch = stripped.match(/\w+\.(Get|Post|Put|Patch|Delete|Head|Options)\s*\(\s*["'](\/[^"'?#]*)/);
-    if (ginCamelMatch && sourceFile.endsWith(".go")) {
-        return {
-            method: ginCamelMatch[1].toUpperCase(),
-            path: ginCamelMatch[2],
-            sourceFile,
-        };
-    }
-    // Go stdlib: http.HandleFunc/Handle
-    const goHandleMatch = stripped.match(/(?:HandleFunc|Handle)\s*\(\s*["']([^"'?#]+)/);
-    if (goHandleMatch && sourceFile.endsWith(".go")) {
-        return { method: "MULTI", path: goHandleMatch[1], sourceFile };
-    }
-    // Ruby (Rails) and Elixir (Phoenix): verb "/path", ...
-    // Rails: get "/users", to: "users#index"
-    // Phoenix: get "/users", UserController, :index
-    const railsMatch = stripped.match(/^(get|post|put|patch|delete)\s+["']([^"'?#]+)/i);
-    if (railsMatch && (sourceFile.endsWith(".rb") ||
-        sourceFile.endsWith(".ex") ||
-        sourceFile.endsWith(".exs") ||
-        /routes/i.test(sourceFile))) {
-        return { method: railsMatch[1].toUpperCase(), path: railsMatch[2], sourceFile };
-    }
-    // PHP — Laravel
-    const laravelMatch = stripped.match(/Route::(get|post|put|patch|delete|options)\s*\(\s*["']([^"'?#]+)/i);
-    if (laravelMatch) {
-        return { method: laravelMatch[1].toUpperCase(), path: laravelMatch[2], sourceFile };
-    }
-    // Rust — Actix
-    const actixAttrMatch = stripped.match(/#\[(get|post|put|patch|delete)\s*\(\s*["']([^"'?#]+)/i);
-    if (actixAttrMatch) {
-        return { method: actixAttrMatch[1].toUpperCase(), path: actixAttrMatch[2], sourceFile };
-    }
-    // ASP.NET
-    const aspnetMatch = stripped.match(/\[Http(Get|Post|Put|Patch|Delete)\s*(?:\(\s*["']([^"'?#]+)["'])?/i);
-    if (aspnetMatch) {
-        return {
-            method: aspnetMatch[1].toUpperCase(),
-            path: aspnetMatch[2] || "/",
-            sourceFile,
-        };
-    }
-    // Hapi.js
-    const hapiMatch = stripped.match(/method:\s*["'](GET|POST|PUT|PATCH|DELETE)["'][^}]*path:\s*["']([^"'?#]+)/i);
-    if (hapiMatch && !isComponent) {
-        return { method: hapiMatch[1].toUpperCase(), path: hapiMatch[2], sourceFile };
-    }
-    return null;
-}
-/**
- * Scan all route definitions in a single source file, combining prefix declarations
- * with method-level annotations. Two orthogonal state machines run in parallel:
- *
- * 1. Class-prefix (Spring, NestJS, ASP.NET, Kotlin):
- *    @Controller/@RestController/@RequestMapping (class level) + class declaration →
- *    activates classPrefix, applied to all @Get/@Post/@GetMapping etc. below.
- *
- * 2. Router-variable prefix (FastAPI, Flask Blueprint):
- *    varName = APIRouter(prefix=...) or Blueprint(url_prefix=...) — handles both
- *    single-line and multi-line declarations — maps the variable name to its prefix.
- *    Applied when @varName.method(...) is seen.
- *
- * Falls back to pure parseRouteLine for all other frameworks (Express inline, Gin,
- * Rails, Laravel, Actix, Hapi, Go stdlib, etc.), which remain unaffected.
- *
- * `mountPrefixes` optionally supplies, per router variable, the **ancestor**
- * prefix that router inherits from cross-file `include_router(...)` mount points
- * (see `resolvePythonMountPrefixes`). It is composed *ahead* of the router's own
- * in-file prefix, so a `router = APIRouter(prefix="/recipes")` mounted under an
- * aggregator's `APIRouter(prefix="/api")` yields `/api/recipes`, not `/recipes`.
- */
-export function parseFileEndpoints(content, sourceFile, mountPrefixes) {
-    const results = [];
-    let classPrefix = ""; // active prefix for the current class body
-    let pendingPrefix = ""; // set by class-level annotation; activated on class declaration
-    // FastAPI APIRouter / Flask Blueprint: variable name → prefix
-    const routerPrefixes = new Map();
-    // Effective prefix for a router var = its cross-file ancestor mount prefix
-    // composed with its own in-file APIRouter(prefix=…). Returns undefined when
-    // the var has neither, so callers leave the path untouched.
-    const effectivePrefix = (varName) => {
-        const own = routerPrefixes.get(varName);
-        const mount = mountPrefixes?.get(varName);
-        if (own === undefined && mount === undefined)
-            return undefined;
-        return joinRoutePrefix(mount ?? "", own ?? "");
-    };
-    let pendingRouterVar = ""; // variable name being accumulated in a multi-line declaration
-    let pendingPythonDecorator = null;
-    let pendingExpressMethod = ""; // HTTP method from a multi-line Express route (e.g. "POST" from `router.post(\n`)
-    let pendingExpressLine = 0; // line where the multi-line Express route started
-    // Fastify: server.route({ method: "GET", url: "/:id", ... }) — method may be a
-    // single string or an array of strings (one route handling multiple verbs).
-    // Object bodies are always multi-line in practice (Prettier-formatted), so this
-    // accumulates method/url across lines until both are found (then emits) or the
-    // call closes / runs long without resolving (then abandons, fail-open).
-    // `depth` is the brace depth relative to the route-options object: fields are
-    // only matched on lines that START at depth 1 (directly inside the options
-    // object), so a coincidental "url"/"method" key inside a nested config/schema
-    // body is never mistaken for the route's own — and depth returning to 0 marks
-    // the true end of the call regardless of how many nested blocks preceded it.
-    let pendingFastifyRoute = null;
-    const FASTIFY_PENDING_LINE_BUDGET = 200;
-    let lineNo = 0; // 1-based; incremented for every line (including skipped) to keep numbering accurate
-    for (const line of content.split("\n")) {
-        lineNo++;
-        const trimmed = line.trim();
-        if (!trimmed || trimmed.startsWith("//") || trimmed.startsWith("*"))
-            continue;
-        // ── Class-prefix state machine (Java/Kotlin/TS/C#) ───────────────────────
-        // Class declaration → activate any pending prefix (or clear if none was set)
-        if (/^(?:(?:public|private|protected|abstract|final|sealed|static|override)\s+)*(?:export\s+)?(?:abstract\s+)?class\s+\w+/.test(trimmed)) {
-            classPrefix = pendingPrefix;
-            pendingPrefix = "";
-            continue;
-        }
-        // @Controller / @RestController → marks a class-level context (Spring, NestJS)
-        if (/@(?:Controller|RestController)\b/.test(trimmed)) {
-            const m = trimmed.match(/@(?:Controller|RestController)\s*\(\s*["']([^"'?#]+)["']/i);
-            if (m)
-                pendingPrefix = m[1]; // explicit path → update pending
-            // No path arg → leave pendingPrefix unchanged (may have been set by @RequestMapping)
-            continue;
-        }
-        // @RequestMapping without method= → class-level prefix declaration (Spring/Kotlin)
-        if (/@RequestMapping\b/.test(trimmed) && !/method\s*=/.test(trimmed)) {
-            const m = trimmed.match(/@RequestMapping\s*\(\s*(?:(?:value|path)\s*=\s*)?["']([^"'?#]+)["']/i);
-            pendingPrefix = m ? m[1] : "";
-            continue;
-        }
-        // ASP.NET [Route("prefix")] at start of line → class-level prefix
-        if (/^\[Route\s*\(/.test(trimmed)) {
-            const m = trimmed.match(/\[Route\s*\(\s*["']([^"'?#]+)["']/i);
-            pendingPrefix = m ? m[1] : "";
-            continue;
-        }
-        // ── Router-variable prefix state machine (Python FastAPI / Flask) ─────────
-        if (!trimmed.startsWith("@")) {
-            // Inside a multi-line APIRouter()/Blueprint() call — collect prefix= / url_prefix=
-            if (pendingRouterVar) {
-                const prefM = trimmed.match(/\burl_prefix\s*=\s*["']([^"'?#]+)["']/)
-                    || trimmed.match(/(?<![a-zA-Z_])prefix\s*=\s*["']([^"'?#]+)["']/);
-                if (prefM) {
-                    routerPrefixes.set(pendingRouterVar, prefM[1]);
-                    pendingRouterVar = "";
-                }
-                else if (trimmed.startsWith(")")) {
-                    pendingRouterVar = ""; // closed without a prefix arg
-                }
-                continue;
-            }
-            // Single-line: varName = APIRouter(prefix="/path") or APIRouter(tags=..., prefix="/path").
-            // `\w*APIRouter` also matches custom subclasses (e.g. Mealie's UserAPIRouter).
-            const singleM = trimmed.match(/^(\w+)\s*=\s*\w*APIRouter\s*\([^)]*prefix\s*=\s*["']([^"'?#]+)["']/) ||
-                trimmed.match(/^(\w+)\s*=\s*Blueprint\s*\([^)]*url_prefix\s*=\s*["']([^"'?#]+)["']/);
-            if (singleM) {
-                routerPrefixes.set(singleM[1], singleM[2]);
-                continue;
-            }
-            // Multi-line open: varName = APIRouter( or Blueprint( without closing ) on this line
-            if (/^(\w+)\s*=\s*(?:\w*APIRouter|Blueprint)\s*\(/.test(trimmed) && !trimmed.includes(")")) {
-                const openM = trimmed.match(/^(\w+)/);
-                if (openM)
-                    pendingRouterVar = openM[1];
-                continue;
-            }
-        }
-        if (pendingPythonDecorator) {
-            // FastAPI decorators commonly split the route path onto the next line:
-            //   @router.delete(
-            //       "/{id}",
-            //       ...
-            //   )
-            const pathMatch = trimmed.match(/^(?:path\s*=\s*)?["']([^"'?#]*)/) ||
-                trimmed.match(/^value\s*=\s*["']([^"'?#]*)/);
-            if (pathMatch) {
-                const eff = effectivePrefix(pendingPythonDecorator.routerVar);
-                const composedPath = eff !== undefined
-                    ? joinRoutePrefix(eff, pathMatch[1])
-                    : pathMatch[1];
-                results.push({
-                    method: pendingPythonDecorator.method,
-                    path: composedPath,
-                    sourceFile,
-                    line: pendingPythonDecorator.startLine,
-                });
-                pendingPythonDecorator = null;
-                continue;
-            }
-            if (/^[\]\)\}]+[;,)]*\s*(?:#.*)?$/.test(trimmed) ||
-                trimmed.startsWith("@") ||
-                /^async\s+def\b|^def\b/.test(trimmed)) {
-                pendingPythonDecorator = null;
-            }
-            else {
-                continue;
-            }
-        }
-        // ── Fastify route state machine ───────────────────────────────────────────
-        // Handles patterns like:
-        //   server.route({
-        //     config: { ... },            // nested blocks may precede or follow
-        //     schema: { ... },            // method/url — brace depth tracks them
-        //     method: "GET",              // or: method: ["GET", "POST"],
-        //     url: "/:secretName",
-        //     handler: ...
-        //   });
-        // method/url may appear in either order and on their own lines. Fields are
-        // matched only on lines starting at brace depth 1 (directly inside the
-        // options object) so a coincidental "url"/"method" key inside a nested
-        // config/schema body can't cause a false match, and the pending state is
-        // abandoned only when depth returns to 0 (the call actually closed).
-        if (!pendingFastifyRoute && /\.route\s*\(\s*\{/.test(trimmed)) {
-            pendingFastifyRoute = { method: null, url: null, startLine: lineNo, depth: 0 };
-        }
-        if (pendingFastifyRoute) {
-            // The opener line starts at depth 0 (its own `{` raises it to 1), so
-            // inline fields on the opener are matchable too.
-            const matchable = pendingFastifyRoute.depth <= 1;
-            if (matchable) {
-                if (pendingFastifyRoute.method === null) {
-                    const arrMatch = trimmed.match(/\bmethod\s*:\s*\[([^\]]*)\]/i);
-                    const strMatch = trimmed.match(/\bmethod\s*:\s*["']([A-Za-z]+)["']/i);
-                    if (arrMatch) {
-                        pendingFastifyRoute.method = [...arrMatch[1].matchAll(/["']([A-Za-z]+)["']/g)]
-                            .map((m) => m[1].toUpperCase());
-                    }
-                    else if (strMatch) {
-                        pendingFastifyRoute.method = [strMatch[1].toUpperCase()];
-                    }
-                }
-                if (pendingFastifyRoute.url === null) {
-                    const urlMatch = trimmed.match(/\burl\s*:\s*["']([^"'?#]*)["']/i);
-                    if (urlMatch)
-                        pendingFastifyRoute.url = urlMatch[1];
-                }
-                if (pendingFastifyRoute.method && pendingFastifyRoute.url !== null && !UI_COMPONENT_EXT.test(sourceFile)) {
-                    for (const method of pendingFastifyRoute.method) {
-                        results.push({
-                            method,
-                            path: pendingFastifyRoute.url,
-                            sourceFile,
-                            line: pendingFastifyRoute.startLine,
-                        });
-                    }
-                    pendingFastifyRoute = null;
-                    continue;
-                }
-            }
-            // Update brace depth from this line, ignoring braces inside string
-            // literals (a url like "/items/{id}" or a schema description containing
-            // "{" must not skew the count). Abandon when the options object closes
-            // (depth back to 0) without both fields resolving, or if the call has
-            // run implausibly long — fail-open, never throws.
-            const withoutStrings = trimmed.replace(/(["'`])(?:\\.|(?!\1).)*\1/g, "");
-            pendingFastifyRoute.depth +=
-                (withoutStrings.match(/\{/g)?.length ?? 0) - (withoutStrings.match(/\}/g)?.length ?? 0);
-            if (pendingFastifyRoute.depth <= 0 ||
-                lineNo - pendingFastifyRoute.startLine > FASTIFY_PENDING_LINE_BUDGET) {
-                pendingFastifyRoute = null;
-            }
-            continue;
-        }
-        // ── Multi-line Express route state machine ────────────────────────────────
-        // Handles patterns like:
-        //   router.post(
-        //       '/:collection',
-        //       middleware,
-        //       handler
-        //   );
-        if (pendingExpressMethod) {
-            // Look for the first path-like string literal on this line
-            const pathMatch = trimmed.match(/["'](\/[^"'?#]*|:[^"'?#]+)["']/);
-            if (pathMatch) {
-                const isComponent = UI_COMPONENT_EXT.test(sourceFile);
-                if (!isComponent) {
-                    results.push({
-                        method: pendingExpressMethod,
-                        path: pathMatch[1],
-                        sourceFile,
-                        line: pendingExpressLine,
-                    });
-                }
-                pendingExpressMethod = "";
-                continue;
-            }
-            // If we hit a closing delimiter-only line or another route call, abandon the pending state
-            if (/^[\]\)\}]+[;,)]*\s*(?:\/\/.*)?$/.test(trimmed)) {
-                pendingExpressMethod = "";
-                continue;
-            }
-            if (/(?:router|app)\.(get|post|put|patch|delete)\s*\(/i.test(trimmed)) {
-                // New route call — reset and fall through to parse this line normally
-                pendingExpressMethod = "";
-            }
-            else {
-                continue; // Skip middleware/handler lines
-            }
-        }
-        // ── Non-annotation line → clear any dangling pendingPrefix ───────────────
-        // Prevents method-level @RequestMapping (no method=) from being misidentified
-        if (pendingPrefix && !trimmed.startsWith("@") && !trimmed.startsWith("[")) {
-            pendingPrefix = "";
-        }
-        // ── Parse method-level annotation ─────────────────────────────────────────
-        let ep = parseRouteLine(trimmed, sourceFile);
-        // NestJS decorator with no path arg → applies to the controller's root path
-        if (!ep) {
-            const nestjsNoPath = trimmed.match(/@(Get|Post|Put|Patch|Delete)\s*\(\s*\)/i);
-            if (nestjsNoPath)
-                ep = { method: nestjsNoPath[1].toUpperCase(), path: "", sourceFile };
-        }
-        if (!ep) {
-            // Detect multi-line FastAPI/Flask-style decorators with the path on a later line.
-            const pythonDecoratorMultiLine = trimmed.match(/@(\w+)\.(get|post|put|patch|delete|head|options)\s*\(\s*$/i);
-            if (pythonDecoratorMultiLine) {
-                pendingPythonDecorator = {
-                    routerVar: pythonDecoratorMultiLine[1],
-                    method: pythonDecoratorMultiLine[2].toUpperCase(),
-                    startLine: lineNo,
-                };
-                continue;
-            }
-            // Detect multi-line Express route: method call with no path string on same line
-            // e.g. "router.post(" or "app.get(\n"
-            const expressMultiLine = trimmed.match(/(?:router|app)\.(get|post|put|patch|delete)\s*\(\s*$/i);
-            if (expressMultiLine && !UI_COMPONENT_EXT.test(sourceFile)) {
-                pendingExpressMethod = expressMultiLine[1].toUpperCase();
-                pendingExpressLine = lineNo;
-            }
-            continue;
-        }
-        // ── Apply prefix ──────────────────────────────────────────────────────────
-        if (classPrefix) {
-            // Class-based prefix (Spring, NestJS, ASP.NET)
-            const prefix = classPrefix.replace(/\/$/, "");
-            const suffix = ep.path.replace(/^\//, "");
-            if (!suffix) {
-                ep.path = prefix || "/";
-            }
-            else if (!ep.path.startsWith(prefix)) {
-                ep.path = `${prefix}/${suffix}`;
-            }
-        }
-        else if (routerPrefixes.size > 0 || (mountPrefixes && mountPrefixes.size > 0)) {
-            // Router-variable prefix (FastAPI, Flask Blueprint) — own prefix composed
-            // with any cross-file ancestor mount prefix.
-            const varM = trimmed.match(/@(\w+)\.(get|post|put|patch|delete|head|options)\s*\(/i)
-                || trimmed.match(/@(\w+)\.route\s*\(/i);
-            if (varM) {
-                const eff = effectivePrefix(varM[1]);
-                if (eff !== undefined)
-                    ep.path = joinRoutePrefix(eff, ep.path);
-            }
-        }
-        ep.line = lineNo;
-        results.push(ep);
-    }
-    // Normalize to a leading-slash path here (single responsibility) so callers
-    // don't each re-normalize. Empty paths (e.g. NestJS no-path decorators) are
-    // left as-is.
-    return results.map((ep) => ({
-        ...ep,
-        path: ep.path && !ep.path.startsWith("/") ? `/${ep.path}` : ep.path,
-    }));
-}
-/**
- * One path segment that names a parameter rather than a resource, in any route
- * syntax the scanners read: OpenAPI "{id}", Express/NestJS ":id", and Next.js
- * "[id]" / "[...id]" / "[[...id]]" (the double-bracket form needs its own
- * alternative — it contains an inner "]", which the single-bracket form's
- * [^\]]+ can never span).
- */
-// The colon form may carry an Express/Fastify constraint or modifier —
-// `:id(\d+)`, `:id?`, `:id*`, `:id+`. Those are still parameters, and a
-// resource name is never one, so the predicate has to accept them or
-// extractResourceFromPath returns the whole segment as the resource.
-const PARAM_SEGMENT_RE = /^\{[^}]+\}$|^:[A-Za-z_]\w*(?:\([^)]*\))?[?*+]?$|^\[\[[^\]]+\]\]$|^\[[^\]]+\]$/;
-export function isParamSegment(segment) {
-    return PARAM_SEGMENT_RE.test(segment);
-}
-/**
- * One path segment that is an id VALUE rather than a name: a UUID, digits only,
- * or a long hex run (a Mongo ObjectId is 24). A caller writes a literal id in a
- * path where the route declares a parameter, and an id can never be a resource
- * name, so resource derivation must skip it exactly as it skips a parameter.
- * SKYR-4214: an accepted UUID produced the key
- * "DELETE::a0eebc99-9c0b-4ef8-bb6d-6bb9bd380a11::integration", which matches
- * nothing, so the candidate escaped dedup entirely.
- *
- * The 16-character floor on the hex rule keeps real resource names safe: a name
- * built only from the letters a-f and digits, 16 characters or longer, is not a
- * word.
- */
-const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-export function isOpaqueIdSegment(segment) {
-    // The sign belongs to the value: an edge-case step writes `/orders/-1` to
-    // probe a negative id, and without the sign that segment became the resource
-    // name, so the key could never match real order coverage.
-    return UUID_RE.test(segment) || /^-?\d+$/.test(segment) || /^[0-9a-f]{16,}$/i.test(segment);
-}
-/** A segment that names neither a resource nor a sub-resource. */
-function isNonResourceSegment(segment) {
-    return isParamSegment(segment) || isOpaqueIdSegment(segment);
-}
-export const SKIP_PATH_SEGMENTS = new Set(["api", "v1", "v2", "v3", "public"]);
-/**
- * True for version/prefix path segments — "v1".."v99" and the literal "api".
- * `SKIP_PATH_SEGMENTS` enumerates only v1-v3, so resource-token derivation uses
- * this predicate as well; without it any endpoint versioned beyond v3 would
- * derive a nonsense token ("v4") as its resource (SKYR-3857).
- */
-export function isVersionLikeSegment(segment) {
-    const lower = segment.toLowerCase();
-    return /^v\d+$/.test(lower) || lower === "api";
-}
-/**
- * Extract the primary resource key from an endpoint path for use as a dedup key.
- *
- * For top-level resources (e.g. "/api/v1/orders/{id}") returns the resource name ("orders").
- * For sub-resources (e.g. "/orders/{id}/items") returns "orders_items" — including the
- * parent prevents "/orders/{id}/items" and "/products/{id}/items" from colliding on "items".
- */
-export function extractResourceFromPath(endpointPath) {
-    const segments = endpointPath.split("/").filter(Boolean);
-    const meaningful = segments.filter((s) => !isNonResourceSegment(s) && !SKIP_PATH_SEGMENTS.has(s));
-    if (meaningful.length === 0)
-        return "unknown";
-    // Sub-resource pattern: /…/<parent>/<id>/<child>
-    // Detected when the last raw segment names a resource and the one before it
-    // does not — an id in any spelling, not only "{param}".
-    const last = segments[segments.length - 1];
-    const secondLast = segments.length >= 2 ? segments[segments.length - 2] : "";
-    if (!isNonResourceSegment(last) && isNonResourceSegment(secondLast) && meaningful.length >= 2) {
-        return `${meaningful[meaningful.length - 2]}_${meaningful[meaningful.length - 1]}`;
-    }
-    return meaningful[meaningful.length - 1];
-}
-const GENERIC_ROUTE_BASENAMES = new Set(["api", "app", "handler", "handlers", "index", "route", "routes", "router", "server"]);
-function normalizeSourcePath(filePath) {
-    return filePath.replace(/\\/g, "/");
-}
-function staticPathSegments(urlPath) {
-    return urlPath.split("/").filter(s => s && !/^[:{[]/.test(s)).map(s => s.toLowerCase());
-}
-function endpointSourceResource(ep) {
-    const sourceSegments = ep.sourceFile.split(/[\\/]/).filter(Boolean);
-    const filename = sourceSegments.at(-1)?.replace(/\.[^.]+$/, "") ?? "";
-    const normalizedFilename = filename.replace(/^(?:old|new)[-_]/i, "").toLowerCase();
-    const isDynamic = /^\[.*\]$/.test(normalizedFilename) || /^\{.*\}$/.test(normalizedFilename);
-    if (!isDynamic && !GENERIC_ROUTE_BASENAMES.has(normalizedFilename) && normalizedFilename) {
-        return normalizedFilename;
-    }
-    else if (GENERIC_ROUTE_BASENAMES.has(normalizedFilename)) {
-        // Generic filename: walk up the directory tree for a more specific ancestor name.
-        const parentSegments = sourceSegments.slice(0, -1).reverse();
-        const contextSegment = parentSegments
-            .map(s => s.replace(/\.[^.]+$/, "").replace(/^(?:old|new)[-_]/i, "").toLowerCase())
-            .find(s => s && !GENERIC_ROUTE_BASENAMES.has(s) && !/^\[.*\]$/.test(s) && !/^\{.*\}$/.test(s));
-        if (contextSegment)
-            return `${contextSegment}/${normalizedFilename}`;
-    }
-    // Fall back to the last static segment of the endpoint's URL path.
-    const segments = staticPathSegments(ep.path);
-    return segments.at(-1) ?? normalizedFilename;
-}
-function endpointMovedKey(path, resource, method) {
-    return method ? `${path}::${resource}::${method}` : `${path}::${resource}`;
-}
-// Route-file heuristics: keep base-branch I/O bounded to files that plausibly
-// declare endpoints. Mirrors the previous deleted-file recovery filter.
-const ROUTE_FILE_PATTERN = /route|controller|endpoint|handler|view|urls|api|router|service|gateway|resolver|\bserver\b/i;
-const ROUTE_FILE_BASENAME_PATTERN = /\bapp\b|\bmain\b/i;
-const SOURCE_EXTS = /\.(ts|tsx|js|jsx|py|java|kt|go|rb|php|rs|cs|ex|exs)$/;
-export function isRouteLikeFile(filePath) {
-    const base = normalizeSourcePath(filePath).split("/").pop() ?? "";
-    return SOURCE_EXTS.test(filePath) &&
-        (ROUTE_FILE_PATTERN.test(filePath) || ROUTE_FILE_BASENAME_PATTERN.test(base));
-}
-/**
- * Files that may contain endpoints removed in this branch: every changed file
- * except newly-created ones. Both whole-file deletions AND line-edits that drop a
- * route from a surviving file belong here — newly-created files cannot contain a
- * route that existed in the base branch.
- */
-export function selectRemovalCandidateFiles(diffData) {
-    const newFileSet = new Set(diffData.newFiles.map(normalizeSourcePath));
-    return diffData.changedFiles.filter((f) => !newFileSet.has(normalizeSourcePath(f)));
-}
-/**
- * Recover endpoints as they existed in the base branch, for the given candidate
- * files. `fetchBaseContent` returns a file's base-branch content (e.g. via
- * `git show base:<file>`); files that throw are skipped. Returns every endpoint
- * found in the base versions — callers pass the result to
- * `classifyEndpointsByChangedFiles`, whose moved/still-present filter drops any
- * endpoint that survives in the current catalog, leaving only genuine removals.
- */
-/**
- * Materialize just the `.py` files of a git ref into a fresh temp directory
- * via `git archive` (no full checkout/worktree) — lets `resolvePythonMountPrefixes`
- * run against the BASE tree unmodified. Best-effort: returns null on any
- * failure (shallow clone missing the ref, git/tar unavailable, etc.) so the
- * caller can fall back rather than abort removal recovery.
- */
-function materializePythonFilesFromRef(repositoryPath, ref) {
-    let tmpDir;
-    try {
-        tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "skyramp-base-py-"));
-    }
-    catch {
-        return null;
-    }
-    const archivePath = path.join(tmpDir, "archive.tar");
-    try {
-        execFileSync("git", ["-C", repositoryPath, "archive", "--format=tar", "-o", archivePath, ref, "--", "*.py"], {
-            stdio: ["ignore", "ignore", "ignore"],
-        });
-        execFileSync("tar", ["-xf", archivePath, "-C", tmpDir], { stdio: ["ignore", "ignore", "ignore"] });
-        fs.rmSync(archivePath, { force: true });
-        return tmpDir;
-    }
-    catch (err) {
-        logger.warning("Failed to materialize base-branch Python files for mount-prefix resolution — falling back to current working tree", {
-            ref,
-            error: err instanceof Error ? err.message : String(err),
-        });
-        try {
-            fs.rmSync(tmpDir, { recursive: true, force: true });
-        }
-        catch {
-            // best-effort cleanup
-        }
-        return null;
-    }
-}
-export async function recoverRemovedEndpointsFromBase(candidateFiles, fetchBaseContent, repositoryPath, baseBranch) {
-    const routeFiles = candidateFiles.filter(isRouteLikeFile);
-    const endpointMap = new Map();
-    // Cross-file FastAPI mount-prefix resolution, mirroring the main scan
-    // (repoScanner.ts). Without it, a route file whose prefix is applied
-    // externally (app.include_router(router, prefix=...)) yields unmounted
-    // paths here that can never match the fully-mounted current-catalog
-    // paths in classifyEndpointsByChangedFiles's "still exists" check — every
-    // endpoint in that file gets misreported as removed, not just the one
-    // actually deleted (SKYR-4026).
-    //
-    // Resolved from the BASE tree when possible (via a `.py`-only git-archive
-    // extraction), not the current working tree — if a PR also renames the
-    // mount prefix itself (not just the recovered route), head-state prefixes
-    // would rewrite the recovered base endpoint onto the NEW prefix, which
-    // could mask a real removal or misattribute the path. Falls back to the
-    // current working tree if base-tree materialization isn't possible (e.g.
-    // shallow clone, git/tar unavailable) — still strictly better than no
-    // mount-prefix resolution at all.
-    let mountPrefixesByFile;
-    if (repositoryPath && routeFiles.some((f) => f.endsWith(".py"))) {
-        const baseTreeDir = baseBranch ? materializePythonFilesFromRef(repositoryPath, baseBranch) : null;
-        try {
-            mountPrefixesByFile = resolvePythonMountPrefixes(baseTreeDir ?? repositoryPath);
-        }
-        finally {
-            if (baseTreeDir) {
-                try {
-                    fs.rmSync(baseTreeDir, { recursive: true, force: true });
-                }
-                catch {
-                    // best-effort cleanup
-                }
-            }
-        }
-    }
-    for (const file of routeFiles) {
-        let content;
-        try {
-            content = await fetchBaseContent(file);
-        }
-        catch (err) {
-            // Expected for files that don't exist in the base tree: a path renamed in
-            // this branch (the new name isn't in base), or a sparse/shallow checkout
-            // where `git show base:<file>` can't resolve. We skip (best-effort
-            // recovery — a single unreadable file shouldn't abort removal detection)
-            // but warn so it's visible if recovery silently under-reports.
-            logger.warning("Failed to fetch base-branch content for removal recovery", {
-                file,
-                error: err instanceof Error ? err.message : String(err),
-            });
-            continue;
-        }
-        for (const ep of parseFileEndpoints(content, file, mountPrefixesByFile?.get(file))) {
-            // parseFileEndpoints already normalizes paths to a leading slash.
-            const key = `${file}::${ep.path}`;
-            const existing = endpointMap.get(key);
-            if (existing) {
-                existing.methods.add(ep.method);
-            }
-            else {
-                endpointMap.set(key, {
-                    path: ep.path,
-                    methods: new Set([ep.method]),
-                    sourceFile: file,
-                });
-            }
-        }
-    }
-    return [...endpointMap.values()].map((d) => ({
-        path: d.path,
-        methods: [...d.methods],
-        sourceFile: d.sourceFile,
-    }));
-}
-/** Strip git's `a/` / `b/` diff-path prefix and normalize separators. */
-export function normalizeDiffPath(spec) {
-    let p = spec.replace(/\\/g, "/");
-    if (p.startsWith("a/") || p.startsWith("b/"))
-        p = p.slice(2);
-    return p;
-}
-/**
- * Parse a unified diff into the set of new-side (post-change) line numbers that
- * were touched, keyed by normalized file path.
- *
- * Context and added (`+`) lines advance the new-side cursor; added lines are
- * recorded. Removed (`-`) lines don't advance the cursor but record the current
- * new-side position, so deletion-only hunks still map to a location (otherwise a
- * pure deletion would scope to nothing and fall back to whole-file matching).
- * Feeds hunk-aware scoping in `classifyEndpointsByChangedFiles` so a
- * change can be attributed to the specific route whose declaration owns those
- * lines — instead of flagging every route in a touched file (the failure mode
- * on centralized-routing SUTs that register the whole API in one hub file).
- */
-export function parseChangedLinesByFile(diffContent) {
-    const result = new Map();
-    if (!diffContent)
-        return result;
-    let currentFile = null;
-    let newCursor = 0;
-    // Walk the diff line-by-line without materializing a full array of every line
-    // (`split("\n")`), which would transiently double the memory of an already
-    // in-memory (and potentially large) diff. Only one line is held at a time.
-    const len = diffContent.length;
-    let pos = 0;
-    while (pos <= len) {
-        let nl = diffContent.indexOf("\n", pos);
-        if (nl === -1)
-            nl = len;
-        const raw = diffContent.slice(pos, nl);
-        pos = nl + 1;
-        // New-file header: "+++ b/path" (checked before the generic "+" branch).
-        if (raw.startsWith("+++ ")) {
-            const spec = raw.slice(4).trim().split("\t")[0];
-            currentFile = spec === "/dev/null" ? null : normalizeDiffPath(spec);
-            continue;
-        }
-        if (raw.startsWith("--- ") || raw.startsWith("diff --git") || raw.startsWith("index ")) {
-            continue;
-        }
-        const hunk = raw.match(/^@@ -\d+(?:,\d+)? \+(\d+)(?:,\d+)? @@/);
-        if (hunk) {
-            newCursor = parseInt(hunk[1], 10);
-            continue;
-        }
-        if (currentFile === null)
-            continue;
-        if (raw.startsWith("+")) {
-            const set = result.get(currentFile) ?? new Set();
-            set.add(newCursor);
-            result.set(currentFile, set);
-            newCursor++;
-        }
-        else if (raw.startsWith("-")) {
-            // Removed line — present only on the old side, so the new-side cursor does
-            // not advance. Record the current new-side position so deletion-only hunks
-            // (removing a route line or handler code) still scope to the owning route
-            // instead of falling back to whole-file matching.
-            const set = result.get(currentFile) ?? new Set();
-            set.add(newCursor);
-            result.set(currentFile, set);
-        }
-        else if (raw.startsWith("\\")) {
-            // "" — not a real line.
-        }
-        else {
-            // Context line (leading space, or a blank final line).
-            newCursor++;
-        }
-    }
-    return result;
-}
-/**
- * Scope a file's endpoints to the ones actually touched by the diff, using an
- * ownership-range model: sorted by declaration line, each endpoint owns
- * [line_i, line_{i+1}) (the last owns to EOF). An endpoint is "changed" iff a
- * changed line falls in its range — so a route-line edit maps to that one route
- * and a handler-body edit maps to its enclosing route.
- *
- * Falls back to the full set (file-level behavior) whenever scoping isn't safe:
- * no changed lines for the file, fewer than two endpoints, any endpoint missing
- * line info, or no changed line mapping to any route (e.g. an import edit above
- * the first route). Fallback keeps behavior identical to pre-scoping when
- * `diffContent` is empty.
- */
-function scopeEndpointsToHunks(eps, changedLines) {
-    if (!changedLines || changedLines.size === 0)
-        return eps;
-    if (eps.length <= 1)
-        return eps;
-    if (!eps.every((e) => typeof e.line === "number"))
-        return eps;
-    const sorted = [...eps].sort((a, b) => a.line - b.line);
-    const matched = new Set();
-    for (let i = 0; i < sorted.length; i++) {
-        const start = sorted[i].line;
-        const end = i + 1 < sorted.length ? sorted[i + 1].line : Infinity;
-        for (const ln of changedLines) {
-            if (ln >= start && ln < end) {
-                matched.add(sorted[i]);
-                break;
-            }
-        }
-    }
-    if (matched.size === 0)
-        return eps;
-    return eps.filter((e) => matched.has(e));
-}
-export function classifyEndpointsByChangedFiles(diffData, scannedEndpoints, deletedFileEndpoints) {
-    const newFileSet = new Set(diffData.newFiles.map(normalizeSourcePath));
-    const deletedFileSet = new Set(diffData.deletedFiles.map(normalizeSourcePath));
-    const changedLinesByFile = parseChangedLinesByFile(diffData.diffContent);
-    const bySourceFile = new Map();
-    for (const ep of scannedEndpoints) {
-        const sourceKey = normalizeSourcePath(ep.sourceFile);
-        const existing = bySourceFile.get(sourceKey);
-        if (existing)
-            existing.push(ep);
-        else
-            bySourceFile.set(sourceKey, [ep]);
-    }
-    const changedEndpoints = [];
-    const newEndpoints = [];
-    const unmatchedFiles = [];
-    for (const file of diffData.changedFiles) {
-        const fileKey = normalizeSourcePath(file);
-        if (deletedFileSet.has(fileKey))
-            continue;
-        const eps = bySourceFile.get(fileKey);
-        if (!eps || eps.length === 0) {
-            unmatchedFiles.push(file);
-            continue;
-        }
-        if (newFileSet.has(fileKey)) {
-            newEndpoints.push(...eps);
-        }
-        else {
-            // Scope to the routes the diff actually touched — critical on hub files
-            // that register the whole API, where file-level matching would flag every
-            // route as changed. Falls back to `eps` when scoping isn't safe.
-            changedEndpoints.push(...scopeEndpointsToHunks(eps, changedLinesByFile.get(fileKey)));
-        }
-    }
-    // Removed endpoints: from deleted files, recovered from the base branch.
-    // Filter out endpoints that still exist in the current catalog as moved/refactored.
-    // Same router-relative paths can exist in sibling files, so only treat them as moved
-    // when the source resource also matches.
-    const currentMethodKeys = new Set();
-    const currentPathResourceKeys = new Set();
-    const currentMultiKeys = new Set();
-    for (const current of scannedEndpoints) {
-        const currentResource = endpointSourceResource(current);
-        const pathResourceKey = endpointMovedKey(current.path, currentResource);
-        currentPathResourceKeys.add(pathResourceKey);
-        for (const method of current.methods) {
-            if (method === "MULTI")
-                currentMultiKeys.add(pathResourceKey);
-            currentMethodKeys.add(endpointMovedKey(current.path, currentResource, method));
-        }
-    }
-    function isMovedEndpoint(deleted, method) {
-        const deletedResource = endpointSourceResource(deleted);
-        const pathResourceKey = endpointMovedKey(deleted.path, deletedResource);
-        if (method === "MULTI")
-            return currentPathResourceKeys.has(pathResourceKey);
-        return currentMultiKeys.has(pathResourceKey) ||
-            currentMethodKeys.has(endpointMovedKey(deleted.path, deletedResource, method));
-    }
-    const removedEndpoints = (deletedFileEndpoints ?? [])
-        .map((ep) => ({
-        ...ep,
-        methods: ep.methods.filter((m) => !isMovedEndpoint(ep, m)),
-    }))
-        .filter((ep) => ep.methods.length > 0);
-    // Affected services: same heuristic as before
-    const servicePattern = /(?:services?|modules?|apps?)\/([a-z0-9_-]+)/i;
-    const affectedServices = [
-        ...new Set(diffData.changedFiles
-            .map((f) => f.match(servicePattern)?.[1])
-            .filter((s) => !!s)),
-    ];
-    return {
-        changedEndpoints,
-        newEndpoints,
-        removedEndpoints,
-        unmatchedFiles,
-        changedFiles: diffData.changedFiles,
-        currentBranch: diffData.currentBranch,
-        baseBranch: diffData.baseBranch,
-        affectedServices,
-    };
-}