@vk.amogh/trace 2.1.0

package/src/trace_engine/framework/express.py

@@ -0,0 +1,82 @@
+"""Express.js framework adapter for endpoint discovery."""
+
+import re
+from typing import List
+from trace_engine.parsing.parser import ParsedFile
+from trace_engine.framework.base import FrameworkAdapter, Endpoint, EndpointParameter
+from trace_engine.parsing.locations import SourceLocation
+
+
+class ExpressFrameworkAdapter(FrameworkAdapter):
+    """Detects and extracts Express.js routes and middleware."""
+
+    def can_handle(self, parsed_file: ParsedFile) -> bool:
+        if parsed_file.language not in ("javascript", "typescript"):
+            return False
+        return any("express" in imp.module.lower() for imp in parsed_file.imports)
+
+    def extract_endpoints(self, parsed_file: ParsedFile, content: str) -> List[Endpoint]:
+        endpoints: List[Endpoint] = []
+
+        # Multi-line regex supporting app, router, server, api
+        pattern = re.compile(
+            r"""(?:app|router|server|api)\.(get|post|put|delete|patch)\s*\(\s*["']([^"']+)["']\s*(?:,\s*([^)]+))?""",
+            re.IGNORECASE | re.DOTALL,
+        )
+
+        content_lower = content.lower()
+        has_db_sink = any(
+            term in content_lower
+            for term in ("mongoose", "prisma", "sequelize", "knex", "pool.query", "db.query", "db.collection")
+        )
+        has_ext_sink = any(
+            term in content_lower
+            for term in ("axios", "node-fetch", "fetch(", "needle", "got(", "http.request", "https.request")
+        )
+
+        for match in pattern.finditer(content):
+            method = match.group(1).upper()
+            raw_path = match.group(2)
+            handler_and_middleware = match.group(3) or ""
+
+            # Calculate accurate line number
+            line_no = content[:match.start()].count("\n") + 1
+
+            # Convert Express :id into {id}
+            norm_path = re.sub(r":([a-zA-Z0-9_]+)", r"{\1}", raw_path)
+            path_params = re.findall(r":([a-zA-Z0-9_]+)", raw_path)
+
+            auth_required = any(
+                term in handler_and_middleware.lower()
+                for term in ("auth", "jwt", "passport", "verifytoken", "isauthenticated", "requireauth")
+            )
+            roles = ["admin"] if "admin" in handler_and_middleware.lower() or "admin" in norm_path.lower() else []
+
+            ep_id = f"ep_express_{parsed_file.file_path}_{line_no}_{method}".replace("/", "_").replace(".", "_")
+
+            endpoints.append(
+                Endpoint(
+                    id=ep_id,
+                    method=method,
+                    path=norm_path,
+                    handler_name=f"route_handler_L{line_no}",
+                    auth_required=auth_required,
+                    roles=roles,
+                    parameters=[
+                        EndpointParameter(name=p, location="path", required=True)
+                        for p in path_params
+                    ],
+                    database_access=has_db_sink,
+                    object_identifier=bool(path_params),
+                    state_changing=method in ("POST", "PUT", "DELETE", "PATCH"),
+                    external_network=has_ext_sink,
+                    sensitive_data="admin" in norm_path.lower() or "user" in norm_path.lower() or "order" in norm_path.lower(),
+                    source=SourceLocation(
+                        file=parsed_file.file_path,
+                        line_start=line_no,
+                        line_end=line_no,
+                    ),
+                )
+            )
+
+        return endpoints

package/src/trace_engine/framework/fastapi.py

@@ -0,0 +1,135 @@
+"""FastAPI framework adapter for endpoint and attack-surface discovery."""
+
+import re
+from typing import List, Optional
+from trace_engine.parsing.parser import ParsedFile
+from trace_engine.framework.base import FrameworkAdapter, Endpoint, EndpointParameter
+from trace_engine.parsing.locations import SourceLocation
+
+HTTP_METHODS = {"get", "post", "put", "delete", "patch", "options", "head"}
+
+
+class FastAPIFrameworkAdapter(FrameworkAdapter):
+    """Detects and extracts FastAPI/Starlette routes and auth gates."""
+
+    def can_handle(self, parsed_file: ParsedFile) -> bool:
+        if parsed_file.language != "python":
+            return False
+        for imp in parsed_file.imports:
+            if "fastapi" in imp.module.lower() or "starlette" in imp.module.lower():
+                return True
+        return False
+
+    def extract_endpoints(self, parsed_file: ParsedFile, content: str) -> List[Endpoint]:
+        endpoints: List[Endpoint] = []
+        ep_count = 0
+
+        # Also search decorators in parsed functions
+        for fn in parsed_file.functions:
+            for dec in fn.decorators:
+                dec_text = dec.raw_text.strip()
+                # Pattern: @app.get('/path' ...) or @router.post('/path' ...)
+                match = re.search(
+                    r"""@?(?:[a-zA-Z0-9_]+)\.(get|post|put|delete|patch)\s*\(\s*["']([^"']+)["']""",
+                    dec_text,
+                    re.IGNORECASE,
+                )
+                if match:
+                    ep_count += 1
+                    method = match.group(1).upper()
+                    path = match.group(2)
+                    ep_id = f"ep_{parsed_file.file_path.replace('/', '_').replace('.', '_')}_{fn.name}_{method}"
+
+                    # Detect path parameters: {param_name}
+                    path_params = re.findall(r"\{([a-zA-Z0-9_]+)\}", path)
+                    params: List[EndpointParameter] = [
+                        EndpointParameter(name=p, location="path", required=True)
+                        for p in path_params
+                    ]
+
+                    # Detect function params from AST
+                    for p in fn.parameters:
+                        if p.name not in ("self", "cls") and p.name not in path_params:
+                            params.append(
+                                EndpointParameter(
+                                    name=p.name,
+                                    location="query" if method == "GET" else "body",
+                                    param_type=p.type_annotation or "string",
+                                )
+                            )
+
+                    # Analyze auth dependencies in decorator or args
+                    auth_required = False
+                    roles = []
+                    fn_body = fn.body_text or ""
+                    
+                    auth_indicators = [
+                        "current_user",
+                        "auth",
+                        "token",
+                        "security",
+                        "jwt",
+                        "oauth",
+                        "credentials",
+                        "verify_token",
+                        "api_key",
+                    ]
+                    for p in fn.parameters:
+                        p_ann = (p.type_annotation or "").lower()
+                        p_def = (p.default_value or "").lower()
+                        if any(ind in p.name.lower() or ind in p_ann or ind in p_def for ind in auth_indicators):
+                            auth_required = True
+                        if "admin" in p.name.lower() or "admin" in p_ann or "admin" in p_def:
+                            roles.append("admin")
+
+                    if "require_admin" in dec_text.lower() or "admin" in path.lower():
+                        roles.append("admin")
+                    if "current_user" in dec_text.lower() or "depends(get_current_user" in dec_text.lower():
+                        auth_required = True
+
+                    # Object identifier flag (e.g. /items/{id})
+                    has_obj_id = any(
+                        p in ("id", "user_id", "order_id", "product_id", "item_id")
+                        for p in path_params
+                    )
+
+                    # State changing
+                    state_changing = method in ("POST", "PUT", "DELETE", "PATCH")
+
+                    # Database access check
+                    db_access = any(
+                        term in fn_body.lower()
+                        for term in ("db.", "session.", "cursor.", "repository", "query(", ".filter(", "orders", "database", "find")
+                    )
+
+                    # Outbound network (SSRF indicator)
+                    ext_network = any(
+                        term in fn_body.lower()
+                        for term in ("requests.", "httpx.", "urllib.", "aiohttp.", "fetch(")
+                    )
+
+                    # Sensitive data
+                    sensitive = any(
+                        term in path.lower() or term in fn_body.lower()
+                        for term in ("password", "secret", "token", "credit", "card", "user", "order", "refund", "admin")
+                    )
+
+                    endpoints.append(
+                        Endpoint(
+                            id=ep_id,
+                            method=method,
+                            path=path,
+                            handler_name=fn.qualified_name,
+                            auth_required=auth_required,
+                            roles=list(set(roles)),
+                            parameters=params,
+                            database_access=db_access,
+                            object_identifier=has_obj_id,
+                            state_changing=state_changing,
+                            external_network=ext_network,
+                            sensitive_data=sensitive,
+                            source=fn.location,
+                        )
+                    )
+
+        return endpoints

package/src/trace_engine/framework/flask.py

@@ -0,0 +1,108 @@
+"""Flask framework adapter for endpoint, Blueprint, and parameter extraction."""
+
+import re
+from typing import List, Optional
+from trace_engine.parsing.parser import ParsedFile
+from trace_engine.parsing.locations import SourceLocation
+from trace_engine.framework.base import FrameworkAdapter, Endpoint, EndpointParameter
+
+
+class FlaskFrameworkAdapter(FrameworkAdapter):
+    """Detects and extracts Flask routes, Blueprints, parameters, and database/network sinks."""
+
+    def can_handle(self, parsed_file: ParsedFile) -> bool:
+        if parsed_file.language != "python":
+            return False
+
+        for imp in parsed_file.imports:
+            mod = imp.module.lower()
+            if "flask" in mod:
+                return True
+
+        # Check for typical Flask route decorators in content
+        return False
+
+    def extract_endpoints(self, parsed_file: ParsedFile, content: str) -> List[Endpoint]:
+        endpoints: List[Endpoint] = []
+        content_lower = content.lower()
+
+        # Database and sink detection
+        has_db_sink = any(
+            term in content_lower
+            for term in (
+                "db.session", ".query.", "session.execute", "cursor.execute",
+                "sqlite3.connect", "psycopg2.connect", "find_one", "find(", "collection."
+            )
+        )
+        has_ext_sink = any(
+            term in content_lower
+            for term in ("requests.get", "requests.post", "httpx.get", "httpx.post", "urllib.request")
+        )
+
+        for fn in parsed_file.functions:
+            fn_body = fn.body_text or ""
+            fn_body_lower = fn_body.lower()
+
+            for dec in fn.decorators:
+                dec_text = dec.raw_text.strip()
+                # Matches @app.route('/path', methods=['GET', 'POST']) or @bp.route('/path') or @blueprint.route
+                route_match = re.search(
+                    r"""@?(?:[a-zA-Z0-9_]+)\.route\s*\(\s*["']([^"']+)["'](?:\s*,\s*methods\s*=\s*\[([^\]]+)\])?""",
+                    dec_text,
+                    re.IGNORECASE,
+                )
+                if not route_match:
+                    continue
+
+                raw_path = route_match.group(1).strip()
+                methods_raw = route_match.group(2)
+
+                if methods_raw:
+                    methods = [
+                        m.strip().strip("'\"").upper()
+                        for m in methods_raw.split(",")
+                        if m.strip()
+                    ]
+                else:
+                    methods = ["GET"]
+
+                # Flask path parameters: <int:id>, <string:slug>, <path:filename>, <uuid:pk> -> {id}, {slug}, {filename}, {pk}
+                clean_path = re.sub(r"<(?:[a-zA-Z0-9_]+:)?([a-zA-Z0-9_]+)>", r"{\1}", raw_path)
+                norm_path = clean_path if clean_path.startswith("/") else f"/{clean_path}"
+                path_params = re.findall(r"\{([a-zA-Z0-9_]+)\}", norm_path)
+
+                # Extract request.args or request.form parameters from function body
+                query_params = re.findall(r"""request\.args\.get\s*\(\s*["']([a-zA-Z0-9_]+)["']""", fn_body)
+                body_params = re.findall(r"""request\.(?:form|json)\.get\s*\(\s*["']([a-zA-Z0-9_]+)["']""", fn_body)
+
+                params = [EndpointParameter(name=p, location="path", required=True) for p in path_params]
+                params.extend([EndpointParameter(name=p, location="query", required=False) for p in query_params])
+                params.extend([EndpointParameter(name=p, location="body", required=False) for p in body_params])
+
+                auth_required = any(
+                    sig in fn_body_lower or sig in dec_text.lower()
+                    for sig in ("@login_required", "@jwt_required", "current_user", "get_jwt_identity", "auth")
+                )
+                roles = ["admin"] if "admin" in fn.name.lower() or "admin" in norm_path.lower() else []
+
+                for m in methods:
+                    ep_id = f"ep_flask_{parsed_file.file_path}_{fn.name}_{m}".replace("/", "_").replace(".", "_")
+                    endpoints.append(
+                        Endpoint(
+                            id=ep_id,
+                            method=m,
+                            path=norm_path,
+                            handler_name=fn.qualified_name,
+                            auth_required=auth_required,
+                            roles=roles,
+                            parameters=params,
+                            database_access=has_db_sink or "execute(" in fn_body_lower or "query" in fn_body_lower,
+                            object_identifier=bool(path_params),
+                            state_changing=m in ("POST", "PUT", "DELETE", "PATCH"),
+                            external_network=has_ext_sink or "requests." in fn_body_lower or "urllib" in fn_body_lower,
+                            sensitive_data="admin" in norm_path.lower() or "user" in norm_path.lower() or "secret" in norm_path.lower(),
+                            source=fn.location,
+                        )
+                    )
+
+        return endpoints

package/src/trace_engine/framework/go.py

@@ -0,0 +1,94 @@
+"""Go framework adapter for Gin, Fiber, Chi, Echo, and standard net/http routes."""
+
+import re
+from typing import List, Dict, Optional
+from trace_engine.parsing.parser import ParsedFile
+from trace_engine.framework.base import FrameworkAdapter, Endpoint, EndpointParameter
+from trace_engine.parsing.locations import SourceLocation
+
+
+class GoFrameworkAdapter(FrameworkAdapter):
+    """Detects and extracts Go web routes, closures, parameters, and middleware across Gin, Echo, Fiber, Chi, and net/http."""
+
+    def can_handle(self, parsed_file: ParsedFile) -> bool:
+        if parsed_file.language != "go":
+            norm = parsed_file.file_path.replace("\\", "/").lower()
+            return norm.endswith(".go")
+        return True
+
+    def extract_endpoints(self, parsed_file: ParsedFile, content: str) -> List[Endpoint]:
+        endpoints: List[Endpoint] = []
+        norm_file_path = parsed_file.file_path.replace("\\", "/")
+        content_lower = content.lower()
+
+        has_db_sink = any(
+            term in content_lower
+            for term in ("db.query", "db.exec", "db.raw", "gorm", "sqlx", "mongo.", "redis.", "findone", "sql.open")
+        )
+        has_ext_sink = any(
+            term in content_lower
+            for term in ("http.get", "http.post", "http.client", "fasthttp", "resty", "http.newrequest", "client.do")
+        )
+
+        auth_signals = ("auth", "jwt", "bearer", "token", "requireauth", "admin", "middleware.auth", "authrequired")
+        auth_required = any(sig in content_lower for sig in auth_signals) or "admin" in norm_file_path.lower()
+        roles = ["admin"] if "admin" in content_lower or "admin" in norm_file_path.lower() else []
+
+        # Matches:
+        # 1. Gin/Echo: r.GET("/path", handler) or r.GET("/path", func(c *gin.Context) {
+        # 2. Chi/Fiber: r.Get("/path", handler) or app.Post("/path", func(...) {
+        # 3. net/http: http.HandleFunc("/path", handler) or mux.Handle("/path", ...)
+        pattern = re.compile(
+            r"""(?:[a-zA-Z0-9_]+)\.(GET|POST|PUT|DELETE|PATCH|Get|Post|Put|Delete|Patch|Handle|HandleFunc)\s*\(\s*["']([^"']+)["']\s*,\s*([a-zA-Z0-9_\.]+|func\s*\([^)]*\))""",
+            re.MULTILINE
+        )
+
+        for match in pattern.finditer(content):
+            raw_method = match.group(1).upper()
+            method = "GET" if raw_method in ("HANDLE", "HANDLEFUNC") else raw_method
+            raw_path = match.group(2)
+            raw_handler = match.group(3).strip()
+            handler_name = "closure_handler" if raw_handler.startswith("func") else raw_handler
+            line_no = content[:match.start()].count("\n") + 1
+
+            # Convert Go :id or {id} or *wildcard to standard {id}
+            norm_path = re.sub(r':([a-zA-Z0-9_]+)', r'{\1}', raw_path)
+            norm_path = re.sub(r'\*([a-zA-Z0-9_]+)', r'{\1}', norm_path)
+            norm_path = "/" + norm_path.lstrip("/")
+
+            path_params = re.findall(r'\{([a-zA-Z0-9_]+)\}', norm_path)
+
+            # Query and body parameter extraction from Go conventions
+            query_params = re.findall(r"""(?:c\.Query|r\.URL\.Query\(\)\.Get)\s*\(\s*["']([a-zA-Z0-9_]+)["']""", content)
+            body_params = re.findall(r"""(?:c\.PostForm|c\.BindJSON|c\.BodyParser)\s*\(\s*&?([a-zA-Z0-9_]+)""", content)
+
+            params = [EndpointParameter(name=p, location="path", required=True) for p in path_params]
+            params.extend([EndpointParameter(name=p, location="query", required=False) for p in query_params])
+            params.extend([EndpointParameter(name=p, location="body", required=False) for p in body_params])
+
+            ep_id = f"ep_go_{norm_file_path}_{line_no}_{method}".replace("/", "_").replace(".", "_")
+
+            sensitive = any(
+                term in norm_path.lower() or term in content_lower
+                for term in ("admin", "user", "auth", "billing", "payment", "token", "secret", "order")
+            )
+
+            endpoints.append(
+                Endpoint(
+                    id=ep_id,
+                    method=method,
+                    path=norm_path,
+                    handler_name=handler_name,
+                    auth_required=auth_required or ("admin" in norm_path.lower()),
+                    roles=roles if "admin" not in norm_path.lower() else ["admin"],
+                    parameters=params,
+                    database_access=has_db_sink,
+                    object_identifier=bool(path_params),
+                    state_changing=method in ("POST", "PUT", "DELETE", "PATCH"),
+                    external_network=has_ext_sink,
+                    sensitive_data=sensitive,
+                    source=SourceLocation(file=parsed_file.file_path, line_start=line_no, line_end=line_no),
+                )
+            )
+
+        return endpoints

package/src/trace_engine/framework/nextjs.py

@@ -0,0 +1,200 @@
+"""Next.js framework adapter for App Router and Pages Router endpoint discovery."""
+
+import re
+from pathlib import Path
+from typing import List, Dict, Optional
+from trace_engine.parsing.parser import ParsedFile
+from trace_engine.framework.base import FrameworkAdapter, Endpoint, EndpointParameter
+from trace_engine.parsing.locations import SourceLocation
+
+
+class NextJSFrameworkAdapter(FrameworkAdapter):
+    """Detects and extracts Next.js API routes, route handlers, and page endpoints."""
+
+    def _infer_app_router_path(self, norm_path: str) -> str:
+        # Strip leading app/ or src/app/
+        clean = norm_path
+        if clean.startswith("src/app/"):
+            clean = clean[8:]
+        elif clean.startswith("app/"):
+            clean = clean[4:]
+
+        # Strip trailing /route.ts, /route.js, /page.tsx, etc.
+        clean = re.sub(r'/(?:route|page)\.[a-zA-Z0-9]+$', '', clean)
+
+        # Remove route groups like (auth), (dashboard)
+        parts = [p for p in clean.split("/") if not (p.startswith("(") and p.endswith(")"))]
+        clean = "/".join(parts)
+
+        # Normalize Next.js params: [[...slug]] -> {slug}, [...slug] -> {slug}, [id] -> {id}
+        clean = re.sub(r'\[\[?\.\.\.([a-zA-Z0-9_]+)\]?\]', r'{\1}', clean)
+        clean = re.sub(r'\[([a-zA-Z0-9_]+)\]', r'{\1}', clean)
+
+        norm_url = "/" + clean.lstrip("/")
+        return norm_url or "/"
+
+    def _infer_pages_router_path(self, norm_path: str) -> str:
+        # Strip leading pages/ or src/pages/
+        clean = norm_path
+        if clean.startswith("src/pages/"):
+            clean = clean[10:]
+        elif clean.startswith("pages/"):
+            clean = clean[6:]
+
+        # Strip file extension
+        clean = re.sub(r'\.[a-zA-Z0-9]+$', '', clean)
+
+        # Normalize params: [id] -> {id}
+        clean = re.sub(r'\[\[?\.\.\.([a-zA-Z0-9_]+)\]?\]', r'{\1}', clean)
+        clean = re.sub(r'\[([a-zA-Z0-9_]+)\]', r'{\1}', clean)
+
+        # Strip index
+        clean = re.sub(r'(?:^|/)index$', '', clean)
+
+        norm_url = "/" + clean.lstrip("/")
+        return norm_url or "/"
+
+    def can_handle(self, parsed_file: ParsedFile) -> bool:
+        if parsed_file.language not in ("javascript", "typescript"):
+            return False
+
+        norm_path = parsed_file.file_path.replace("\\", "/")
+
+        # App Router route/page
+        if re.search(r'(?:^|/)(?:src/)?app/.+/(?:route|page)\.[a-zA-Z0-9]+$', norm_path):
+            return True
+
+        # Pages Router api or page
+        if re.search(r'(?:^|/)(?:src/)?pages/(?:api/)?.+\.[a-zA-Z0-9]+$', norm_path):
+            return True
+
+        # Imports from next
+        for imp in parsed_file.imports:
+            mod_low = imp.module.lower()
+            if mod_low == "next" or mod_low.startswith("next/"):
+                return True
+
+        return False
+
+    def extract_endpoints(self, parsed_file: ParsedFile, content: str) -> List[Endpoint]:
+        endpoints: List[Endpoint] = []
+        norm_file_path = parsed_file.file_path.replace("\\", "/")
+
+        is_app_router = bool(re.search(r'(?:^|/)(?:src/)?app/', norm_file_path))
+        is_pages_router = bool(re.search(r'(?:^|/)(?:src/)?pages/', norm_file_path))
+
+        if is_app_router:
+            url_path = self._infer_app_router_path(norm_file_path)
+        elif is_pages_router:
+            url_path = self._infer_pages_router_path(norm_file_path)
+        else:
+            url_path = "/" + norm_file_path.split("/")[-1].split(".")[0]
+
+        path_params = re.findall(r'\{([a-zA-Z0-9_]+)\}', url_path)
+
+        content_lower = content.lower()
+        has_db_sink = any(
+            term in content_lower
+            for term in (
+                "prisma", "mongoose", "sequelize", "supabase", "knex",
+                "pool.query", "client.query", "db.query", "db.select", ".from("
+            )
+        )
+        has_ext_sink = any(
+            term in content_lower
+            for term in (
+                "axios", "fetch(", "nodemailer", "got(", "needle",
+                "http.request", "https.request", "transporter.sendmail", "octokit", "stripe"
+            )
+        )
+
+        auth_signals = (
+            "getserversession", "getauth", "auth()", "clerk", "next-auth",
+            "verifytoken", "requireauth", "requireadmin", "jwt.verify", "supabase.auth"
+        )
+        auth_required = any(sig in content_lower for sig in auth_signals) or "admin" in url_path.lower()
+        roles = ["admin"] if "admin" in content_lower or "admin" in url_path.lower() else []
+
+        sensitive_data = any(
+            term in url_path.lower() or term in content_lower
+            for term in (
+                "admin", "user", "auth", "login", "register", "profile",
+                "password", "token", "secret", "webhook", "session", "payment"
+            )
+        )
+
+        parameters: List[EndpointParameter] = [
+            EndpointParameter(name=p, location="path", required=True, user_controlled=True)
+            for p in path_params
+        ]
+
+        # Extract searchParams
+        for m in re.finditer(r'''(?:searchParams|nextUrl\.searchParams)\.get\s*\(\s*["']([^"']+)["']''', content):
+            p_name = m.group(1)
+            if not any(p.name == p_name for p in parameters):
+                parameters.append(
+                    EndpointParameter(name=p_name, location="query", required=False, user_controlled=True)
+                )
+
+        # App Router named exports: GET, POST, PUT, DELETE, PATCH, HEAD, OPTIONS
+        app_verbs = list(re.finditer(
+            r'''export\s+(?:async\s+)?function\s+(GET|POST|PUT|DELETE|PATCH|HEAD|OPTIONS)\b''',
+            content
+        ))
+
+        for v_match in app_verbs:
+            verb = v_match.group(1).upper()
+            line_no = content[:v_match.start()].count("\n") + 1
+            ep_id = f"ep_next_{verb.lower()}_{norm_file_path}_{line_no}".replace("/", "_").replace(".", "_")
+            endpoints.append(
+                Endpoint(
+                    id=ep_id,
+                    method=verb,
+                    path=url_path,
+                    handler_name=verb,
+                    auth_required=auth_required,
+                    roles=roles,
+                    parameters=parameters,
+                    database_access=has_db_sink,
+                    object_identifier=bool(path_params),
+                    state_changing=verb in ("POST", "PUT", "DELETE", "PATCH"),
+                    external_network=has_ext_sink,
+                    sensitive_data=sensitive_data,
+                    source=SourceLocation(file=parsed_file.file_path, line_start=line_no, line_end=line_no),
+                )
+            )
+
+        # Pages Router or App Router default export
+        if not endpoints:
+            # Check for checked HTTP methods in handler body
+            checked_methods = []
+            for m in re.finditer(r'''req\.method\s*===?\s*["'](GET|POST|PUT|DELETE|PATCH)["']''', content):
+                checked_methods.append(m.group(1).upper())
+
+            methods_to_add = set(checked_methods) if checked_methods else (["GET"] if "page." in norm_file_path else ["GET", "POST"])
+
+            default_match = re.search(r'''export\s+default\s+(?:async\s+)?(?:function|const|class)?\s*([a-zA-Z0-9_$]+)?''', content)
+            handler_name = default_match.group(1) if (default_match and default_match.group(1)) else "handler"
+            line_no = content[:default_match.start()].count("\n") + 1 if default_match else 1
+
+            for meth in sorted(methods_to_add):
+                ep_id = f"ep_next_{meth.lower()}_{norm_file_path}_{line_no}".replace("/", "_").replace(".", "_")
+                endpoints.append(
+                    Endpoint(
+                        id=ep_id,
+                        method=meth,
+                        path=url_path,
+                        handler_name=handler_name,
+                        auth_required=auth_required,
+                        roles=roles,
+                        parameters=parameters,
+                        database_access=has_db_sink,
+                        object_identifier=bool(path_params),
+                        state_changing=meth in ("POST", "PUT", "DELETE", "PATCH"),
+                        external_network=has_ext_sink,
+                        sensitive_data=sensitive_data,
+                        source=SourceLocation(file=parsed_file.file_path, line_start=line_no, line_end=line_no),
+                    )
+                )
+
+        return endpoints