cgraphx 1.1.0 → 1.3.0

package/dist/api-test/bru-writer.js

@@ -0,0 +1,159 @@
+"use strict";
+/**
+ * Bruno `.bru` file writer.
+ *
+ * Spec §5.2 template — emits one `.bru` per endpoint. The HTTP method block
+ * keyword (`post {` / `get {` / `put {` / `delete {` / `patch {`) reflects
+ * `endpoint.httpMethod` (lowercased). Default body is `[{}]` — the assemble
+ * phase (T-40) fills it in; scan phase writes the placeholder.
+ *
+ * Header values from `config.defaultHeaders` are written verbatim, INCLUDING
+ * any `{{var}}` placeholders — Bruno resolves those at request time from the
+ * collection environment. Per spec §9, scan/analyze/assemble do NOT load the
+ * profile (only run does) — Bruno's `{{var}}` syntax does the substitution
+ * natively at request time.
+ *
+ * Public surface:
+ *   - `renderBru(endpoint, config)` — string
+ *   - `writeBru(endpoint, config, outputDir)` — Promise<string> (written path)
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.__INTERNAL_BRU = void 0;
+exports.bruFileName = bruFileName;
+exports.serviceDirName = serviceDirName;
+exports.renderBru = renderBru;
+exports.writeBru = writeBru;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+/** Filename for an endpoint's `.bru` pair: `<svc_id>_<methodName>.bru`. */
+function bruFileName(endpoint) {
+    return `${endpoint.svcId}_${endpoint.method}.bru`;
+}
+/** Subdirectory under `outputDir` for an endpoint's service: `<service>/`. */
+function serviceDirName(endpoint) {
+    return endpoint.service;
+}
+/**
+ * Render the `.bru` body for one endpoint, following spec §5.2.
+ *
+ * The HTTP method keyword is derived from `endpoint.httpMethod`
+ * (lowercased). If the method is unknown (not get/post/put/delete/patch),
+ * fall back to `post` (the hx default) and emit a comment.
+ */
+function renderBru(endpoint, config) {
+    const methodKey = normalizeHttpMethodKey(endpoint.httpMethod);
+    const metaName = `${endpoint.svcId}_${endpoint.method}`;
+    const url = endpoint.urlPattern;
+    const headerLines = Object.entries(config.defaultHeaders).map(([k, v]) => `    ${k}: ${v}`);
+    const headersBlock = headerLines.length > 0
+        ? `headers {\n${headerLines.join('\n')}\n}`
+        : 'headers {}';
+    const bodyTemplate = config.bodyTemplate || '[{}]';
+    const descLine = endpoint.javadoc
+        ? firstLine(endpoint.javadoc)
+        : '(scan 阶段未提取到 Javadoc,请补充业务说明)';
+    // The HTTP method block keyword — Bruno's grammar uses the lowercase method
+    // name as the block key. We emit the matched key; if the configured method
+    // is non-standard, fall back to `post` and add a `docs` note.
+    const methodBlockKey = methodKey ?? 'post';
+    const methodFallbackNote = methodKey === null
+        ? `\n    # NOTE: endpoint.httpMethod="${endpoint.httpMethod}" is non-standard; defaulting to post.`
+        : '';
+    return `meta {
+    name: ${metaName}
+    type: http
+}
+
+${methodBlockKey} {${methodFallbackNote}
+    url: ${url}
+    body: json
+}
+
+${headersBlock}
+
+body:json {
+    ${bodyTemplate}
+}
+
+docs {
+    业务说明: ${descLine}
+    完整分析见同名 .md 文件
+}
+
+tests {
+    test("HTTP 200", function() {
+        expect(res.getStatus()).to.equal(200);
+    });
+}
+`;
+}
+/**
+ * Write an endpoint's `.bru` to `<outputDir>/<service>/<svc_id>_<methodName>.bru`.
+ * Creates the service directory if needed. Returns the absolute written path.
+ *
+ * Also stamps the written path back onto `endpoint.bruPath` so the report
+ * phase can reference it.
+ */
+async function writeBru(endpoint, config, outputDir) {
+    const serviceDir = path.join(outputDir, serviceDirName(endpoint));
+    await fs.promises.mkdir(serviceDir, { recursive: true });
+    const filePath = path.join(serviceDir, bruFileName(endpoint));
+    const content = renderBru(endpoint, config);
+    await fs.promises.writeFile(filePath, content, 'utf8');
+    endpoint.bruPath = filePath;
+    return filePath;
+}
+/** Map an HTTP method string to Bruno's lowercase block key. `null` = unknown. */
+function normalizeHttpMethodKey(method) {
+    const m = method.trim().toLowerCase();
+    if (m === 'get' || m === 'post' || m === 'put' || m === 'delete' || m === 'patch') {
+        return m;
+    }
+    return null;
+}
+/** First non-empty line of a javadoc string, trimmed. */
+function firstLine(javadoc) {
+    const line = javadoc.split(/\r?\n/).map((s) => s.trim()).find((s) => s.length > 0);
+    return line ?? '';
+}
+/** Internal helpers re-exported for tests. */
+exports.__INTERNAL_BRU = {
+    bruFileName,
+    serviceDirName,
+    normalizeHttpMethodKey,
+    firstLine,
+};
+//# sourceMappingURL=bru-writer.js.map

package/dist/api-test/bru-writer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bru-writer.js","sourceRoot":"","sources":["../../src/api-test/bru-writer.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;GAiBG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAQH,kCAEC;AAGD,wCAEC;AASD,8BAwDC;AASD,4BAYC;AAnGD,4CAA8B;AAC9B,gDAAkC;AAIlC,2EAA2E;AAC3E,SAAgB,WAAW,CAAC,QAAkB;IAC5C,OAAO,GAAG,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,MAAM,MAAM,CAAC;AACpD,CAAC;AAED,8EAA8E;AAC9E,SAAgB,cAAc,CAAC,QAAkB;IAC/C,OAAO,QAAQ,CAAC,OAAO,CAAC;AAC1B,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,SAAS,CACvB,QAAkB,EAClB,MAAqB;IAErB,MAAM,SAAS,GAAG,sBAAsB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,GAAG,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;IACxD,MAAM,GAAG,GAAG,QAAQ,CAAC,UAAU,CAAC;IAEhC,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,GAAG,CAC3D,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAC7B,CAAC;IACF,MAAM,YAAY,GAAG,WAAW,CAAC,MAAM,GAAG,CAAC;QACzC,CAAC,CAAC,cAAc,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;QAC3C,CAAC,CAAC,YAAY,CAAC;IAEjB,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC;IAEnD,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO;QAC/B,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC;QAC7B,CAAC,CAAC,+BAA+B,CAAC;IAEpC,4EAA4E;IAC5E,2EAA2E;IAC3E,8DAA8D;IAC9D,MAAM,cAAc,GAAG,SAAS,IAAI,MAAM,CAAC;IAC3C,MAAM,kBAAkB,GAAG,SAAS,KAAK,IAAI;QAC3C,CAAC,CAAC,sCAAsC,QAAQ,CAAC,UAAU,wCAAwC;QACnG,CAAC,CAAC,EAAE,CAAC;IAEP,OAAO;YACG,QAAQ;;;;EAIlB,cAAc,KAAK,kBAAkB;WAC5B,GAAG;;;;EAIZ,YAAY;;;MAGR,YAAY;;;;YAIN,QAAQ;;;;;;;;;CASnB,CAAC;AACF,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,QAAQ,CAC5B,QAAkB,EAClB,MAAqB,EACrB,SAAiB;IAEjB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;IAClE,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC5C,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACvD,QAAQ,CAAC,OAAO,GAAG,QAAQ,CAAC;IAC5B,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,kFAAkF;AAClF,SAAS,sBAAsB,CAAC,MAAc;IAC5C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACtC,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,OAAO,EAAE,CAAC;QAClF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,yDAAyD;AACzD,SAAS,SAAS,CAAC,OAAe;IAChC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnF,OAAO,IAAI,IAAI,EAAE,CAAC;AACpB,CAAC;AAED,8CAA8C;AACjC,QAAA,cAAc,GAAG;IAC5B,WAAW;IACX,cAAc;IACd,sBAAsB;IACtB,SAAS;CACV,CAAC"}

package/dist/api-test/call-chain-extractor.d.ts

@@ -0,0 +1,80 @@
+/**
+ * Analyze phase — extract the call chain, dependency tables, and auth flag
+ * from an impl method body.
+ *
+ * Spec contract (T-30):
+ *   - Call chain: every `someService.method()` invocation in the body
+ *     (first-level callees only — no recursion into callees of callees).
+ *     At least 1 level is expected (impl → first callee).
+ *   - Dep tables: inferred from Mapper calls (`xxxMapper.selectXxx` etc.)
+ *     by stripping the `Mapper` suffix from the receiver's declared field
+ *     type (or receiver name) and lowercasing.
+ *   - Auth required: true when the impl calls `IAuthInfoService` (field type
+ *     or receiver name starting with `iAuth` / `IAuthInfoService`) or reads
+ *     the staffcode header (`ServerHeadersHolder.getStaffcode()` etc.).
+ *
+ * Implementation note: extraction uses `method.bodyText` (regex) rather than
+ * the AST `body` node. The T-11 parser deletes the tree after extraction to
+ * release WASM heap, which would invalidate any retained AST node reference;
+ * `bodyText` is captured before the delete and stays valid. The task's
+ * "允许局部适配" clause permits this regex-based approach.
+ *
+ * Self-contained: depends only on `./java-parser` (ClassInfo, MethodSignature).
+ * No imports from `src/extraction/` / `src/resolution/` / `src/db/`.
+ *
+ * Public surface:
+ *   - `extractCallChain(implInfo, method)` —
+ *       Promise<{ callChain: string[]; depTables: string[]; authRequired: boolean }>
+ */
+import type { ClassInfo, MethodSignature } from './java-parser';
+/**
+ * Extract `receiver.methodName` strings from the body text. Dedupes by
+ * the full `receiver.method` pair, preserving document order.
+ */
+declare function extractCallChainFromBody(bodyText: string): string[];
+/**
+ * Infer dependency table names from Mapper-typed calls in the body.
+ *
+ * Heuristic:
+ *   1. For each `xxxMapper.method()` call in the body, look up the field
+ *      `xxxMapper` on the impl class. If its type ends with `Mapper`,
+ *      strip the suffix and lowercase → table name.
+ *   2. Fallback: if the receiver name itself ends with `Mapper` (e.g.
+ *      `orderMapper`), strip + lowercase.
+ *
+ * Returns deduped table names in document order.
+ */
+declare function inferDepTables(bodyText: string, implInfo: ClassInfo): string[];
+/**
+ * Detect whether the impl method touches the auth surface.
+ *
+ * Signals (any one → true):
+ *   - The impl class has a field whose type simple-name is `IAuthInfoService`
+ *     (or whose name starts with `iAuth`).
+ *   - The body text references `IAuthInfoService`, `getStaffcode`, or
+ *     `ServerHeadersHolder`.
+ *
+ * The field-type check catches `@Resource IAuthInfoService iAuthService;`
+ * even when the body only calls `iAuthService.check()` (receiver name
+ * doesn't carry the type). The body-text check catches direct
+ * `ServerHeadersHolder.getStaffcode()` calls without a field.
+ */
+declare function detectAuthRequired(bodyText: string, implInfo: ClassInfo): boolean;
+/**
+ * Extract the call chain, dependency tables, and auth-required flag for
+ * one impl method. Returns empty arrays + `authRequired: false` when the
+ * method has no body (interface/abstract method — shouldn't happen for an
+ * impl, but defensive per T-11's empty-bodyText caveat).
+ */
+export declare function extractCallChain(implInfo: ClassInfo, method: MethodSignature): Promise<{
+    callChain: string[];
+    depTables: string[];
+    authRequired: boolean;
+}>;
+export declare const __INTERNAL_CALL_CHAIN: {
+    extractCallChainFromBody: typeof extractCallChainFromBody;
+    inferDepTables: typeof inferDepTables;
+    detectAuthRequired: typeof detectAuthRequired;
+};
+export {};
+//# sourceMappingURL=call-chain-extractor.d.ts.map

package/dist/api-test/call-chain-extractor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"call-chain-extractor.d.ts","sourceRoot":"","sources":["../../src/api-test/call-chain-extractor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAoBhE;;;GAGG;AACH,iBAAS,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAkB5D;AAMD;;;;;;;;;;;GAWG;AACH,iBAAS,cAAc,CACrB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,SAAS,GAClB,MAAM,EAAE,CA8BV;AAMD;;;;;;;;;;;;;GAaG;AACH,iBAAS,kBAAkB,CACzB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,SAAS,GAClB,OAAO,CAkBT;AAMD;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,SAAS,EACnB,MAAM,EAAE,eAAe,GACtB,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,OAAO,CAAA;CAAE,CAAC,CAU9E;AAGD,eAAO,MAAM,qBAAqB;;;;CAIjC,CAAC"}

package/dist/api-test/call-chain-extractor.js

@@ -0,0 +1,179 @@
+"use strict";
+/**
+ * Analyze phase — extract the call chain, dependency tables, and auth flag
+ * from an impl method body.
+ *
+ * Spec contract (T-30):
+ *   - Call chain: every `someService.method()` invocation in the body
+ *     (first-level callees only — no recursion into callees of callees).
+ *     At least 1 level is expected (impl → first callee).
+ *   - Dep tables: inferred from Mapper calls (`xxxMapper.selectXxx` etc.)
+ *     by stripping the `Mapper` suffix from the receiver's declared field
+ *     type (or receiver name) and lowercasing.
+ *   - Auth required: true when the impl calls `IAuthInfoService` (field type
+ *     or receiver name starting with `iAuth` / `IAuthInfoService`) or reads
+ *     the staffcode header (`ServerHeadersHolder.getStaffcode()` etc.).
+ *
+ * Implementation note: extraction uses `method.bodyText` (regex) rather than
+ * the AST `body` node. The T-11 parser deletes the tree after extraction to
+ * release WASM heap, which would invalidate any retained AST node reference;
+ * `bodyText` is captured before the delete and stays valid. The task's
+ * "允许局部适配" clause permits this regex-based approach.
+ *
+ * Self-contained: depends only on `./java-parser` (ClassInfo, MethodSignature).
+ * No imports from `src/extraction/` / `src/resolution/` / `src/db/`.
+ *
+ * Public surface:
+ *   - `extractCallChain(implInfo, method)` —
+ *       Promise<{ callChain: string[]; depTables: string[]; authRequired: boolean }>
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.__INTERNAL_CALL_CHAIN = void 0;
+exports.extractCallChain = extractCallChain;
+// ---------------------------------------------------------------------------
+// Call chain extraction
+// ---------------------------------------------------------------------------
+/**
+ * Match `receiver.methodName(` calls in the body text. Captures the receiver
+ * identifier and method name. Skips:
+ *   - Calls without a receiver (`foo()` — can't qualify).
+ *   - `super(...)` / `this(...)` constructor calls.
+ *   - Chained-call inner segments are captured as separate `a.b` and `b.c`
+ *     pairs; dedup handles the rest.
+ *
+ * The receiver pattern `[A-Za-z_]\w*` matches simple identifiers (not
+ * qualified `this.foo` or `Class.staticMethod` — those are captured as
+ * `this.foo` / `Class.staticMethod` with the dotted receiver included).
+ */
+const METHOD_CALL_RE = /\b([A-Za-z_]\w*(?:\.[A-Za-z_]\w*)*)\.([A-Za-z_]\w*)\s*\(/g;
+/**
+ * Extract `receiver.methodName` strings from the body text. Dedupes by
+ * the full `receiver.method` pair, preserving document order.
+ */
+function extractCallChainFromBody(bodyText) {
+    const out = [];
+    const seen = new Set();
+    METHOD_CALL_RE.lastIndex = 0;
+    let m;
+    while ((m = METHOD_CALL_RE.exec(bodyText)) !== null) {
+        const receiver = m[1] ?? '';
+        const methodName = m[2] ?? '';
+        if (!receiver || !methodName)
+            continue;
+        // Skip `super.x` and `this.x` — not service calls.
+        if (receiver === 'super' || receiver === 'this')
+            continue;
+        const key = `${receiver}.${methodName}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        out.push(key);
+    }
+    return out;
+}
+// ---------------------------------------------------------------------------
+// Dependency table inference
+// ---------------------------------------------------------------------------
+/**
+ * Infer dependency table names from Mapper-typed calls in the body.
+ *
+ * Heuristic:
+ *   1. For each `xxxMapper.method()` call in the body, look up the field
+ *      `xxxMapper` on the impl class. If its type ends with `Mapper`,
+ *      strip the suffix and lowercase → table name.
+ *   2. Fallback: if the receiver name itself ends with `Mapper` (e.g.
+ *      `orderMapper`), strip + lowercase.
+ *
+ * Returns deduped table names in document order.
+ */
+function inferDepTables(bodyText, implInfo) {
+    // Build a map of field name → field type for the impl class.
+    const fieldTypeByName = new Map();
+    for (const f of implInfo.fields) {
+        fieldTypeByName.set(f.name, f.type);
+    }
+    const out = [];
+    const seen = new Set();
+    METHOD_CALL_RE.lastIndex = 0;
+    let m;
+    while ((m = METHOD_CALL_RE.exec(bodyText)) !== null) {
+        const receiver = m[1] ?? '';
+        if (!receiver)
+            continue;
+        // Resolve receiver → field type (if it's a simple identifier matching a field).
+        const fieldType = fieldTypeByName.get(receiver);
+        const typeForInference = fieldType ?? receiver;
+        // Match `XxxMapper` (or `xxxMapper`).
+        const mm = /^([A-Za-z_]\w*)Mapper$/.exec(typeForInference);
+        if (!mm)
+            continue;
+        const table = (mm[1] ?? '').toLowerCase();
+        if (!table || seen.has(table))
+            continue;
+        seen.add(table);
+        out.push(table);
+    }
+    return out;
+}
+// ---------------------------------------------------------------------------
+// Auth-required detection
+// ---------------------------------------------------------------------------
+/**
+ * Detect whether the impl method touches the auth surface.
+ *
+ * Signals (any one → true):
+ *   - The impl class has a field whose type simple-name is `IAuthInfoService`
+ *     (or whose name starts with `iAuth`).
+ *   - The body text references `IAuthInfoService`, `getStaffcode`, or
+ *     `ServerHeadersHolder`.
+ *
+ * The field-type check catches `@Resource IAuthInfoService iAuthService;`
+ * even when the body only calls `iAuthService.check()` (receiver name
+ * doesn't carry the type). The body-text check catches direct
+ * `ServerHeadersHolder.getStaffcode()` calls without a field.
+ */
+function detectAuthRequired(bodyText, implInfo) {
+    // Field-type check.
+    for (const f of implInfo.fields) {
+        const simple = f.type.split('.').pop() ?? f.type;
+        if (simple === 'IAuthInfoService' || simple === 'AuthInfoService') {
+            return true;
+        }
+        if (/^iAuth\w*/.test(f.name) || /^authService$/i.test(f.name)) {
+            return true;
+        }
+    }
+    // Body-text check.
+    if (/IAuthInfoService/.test(bodyText))
+        return true;
+    if (/getStaffcode/.test(bodyText))
+        return true;
+    if (/ServerHeadersHolder/.test(bodyText))
+        return true;
+    return false;
+}
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+/**
+ * Extract the call chain, dependency tables, and auth-required flag for
+ * one impl method. Returns empty arrays + `authRequired: false` when the
+ * method has no body (interface/abstract method — shouldn't happen for an
+ * impl, but defensive per T-11's empty-bodyText caveat).
+ */
+async function extractCallChain(implInfo, method) {
+    if (!method.bodyText) {
+        return { callChain: [], depTables: [], authRequired: false };
+    }
+    const callChain = extractCallChainFromBody(method.bodyText);
+    const depTables = inferDepTables(method.bodyText, implInfo);
+    const authRequired = detectAuthRequired(method.bodyText, implInfo);
+    return { callChain, depTables, authRequired };
+}
+// Internal helpers re-exported for tests.
+exports.__INTERNAL_CALL_CHAIN = {
+    extractCallChainFromBody,
+    inferDepTables,
+    detectAuthRequired,
+};
+//# sourceMappingURL=call-chain-extractor.js.map

package/dist/api-test/call-chain-extractor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"call-chain-extractor.js","sourceRoot":"","sources":["../../src/api-test/call-chain-extractor.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;;;AAoJH,4CAaC;AA7JD,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,cAAc,GAAG,2DAA2D,CAAC;AAEnF;;;GAGG;AACH,SAAS,wBAAwB,CAAC,QAAgB;IAChD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,cAAc,CAAC,SAAS,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU;YAAE,SAAS;QACvC,mDAAmD;QACnD,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,MAAM;YAAE,SAAS;QAC1D,MAAM,GAAG,GAAG,GAAG,QAAQ,IAAI,UAAU,EAAE,CAAC;QACxC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,SAAS,cAAc,CACrB,QAAgB,EAChB,QAAmB;IAEnB,6DAA6D;IAC7D,MAAM,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAC;IAClD,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QAChC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IAED,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,cAAc,CAAC,SAAS,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,QAAQ;YAAE,SAAS;QAExB,gFAAgF;QAChF,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAChD,MAAM,gBAAgB,GAAG,SAAS,IAAI,QAAQ,CAAC;QAE/C,sCAAsC;QACtC,MAAM,EAAE,GAAG,wBAAwB,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC3D,IAAI,CAAC,EAAE;YAAE,SAAS;QAElB,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAC1C,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAS;QACxC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,0BAA0B;AAC1B,8EAA8E;AAE9E;;;;;;;;;;;;;GAaG;AACH,SAAS,kBAAkB,CACzB,QAAgB,EAChB,QAAmB;IAEnB,oBAAoB;IACpB,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC;QACjD,IAAI,MAAM,KAAK,kBAAkB,IAAI,MAAM,KAAK,iBAAiB,EAAE,CAAC;YAClE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,mBAAmB;IACnB,IAAI,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;GAKG;AACI,KAAK,UAAU,gBAAgB,CACpC,QAAmB,EACnB,MAAuB;IAEvB,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrB,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;IAC/D,CAAC;IAED,MAAM,SAAS,GAAG,wBAAwB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAEnE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC;AAChD,CAAC;AAED,0CAA0C;AAC7B,QAAA,qBAAqB,GAAG;IACnC,wBAAwB;IACxB,cAAc;IACd,kBAAkB;CACnB,CAAC"}

package/dist/api-test/cli.d.ts

@@ -0,0 +1,133 @@
+/**
+ * CLI wiring for the api-test subsystem.
+ *
+ * Exposes `registerApiTestCommands(program)` — called once from
+ * `src/bin/codegraph.ts`. All api-test subcommands live under
+ * `codegraph api-test <sub>`. The scan subcommand (T-20) is wired here;
+ * the analyze/assemble/run/report/list subcommands will be added in
+ * T-30 / T-40 / T-50 / T-60.
+ *
+ * Spec contract — scan:
+ *   - Full re-scan (delete `docs/api-test/<service>/` subtree, rebuild).
+ *   - Writes one `.bru` + one `.md` per endpoint under
+ *     `docs/api-test/<service>/<svc_id>_<methodName>.{bru,md}`.
+ *   - Writes `docs/api-test/bruno.json` at the api-test root with the
+ *     minimal Bruno collection schema.
+ *   - Failed endpoints don't abort the rest — warnings go to stderr.
+ *
+ * Exit codes:
+ *   0  success (or partial success with warnings)
+ *   2  config error (ConfigError — missing/invalid profile or config)
+ *   5  argument error
+ */
+import type { Command } from 'commander';
+import { type ClassInfo, type MethodSignature } from './java-parser';
+import { type BrunoRunResult } from './bru-runner';
+import type { Endpoint, ApiTestProfile } from './types';
+/**
+ * Attach the `api-test` command group to a commander program.
+ */
+export declare function registerApiTestCommands(program: Command): void;
+/**
+ * Walk `projectRoot` and yield every `.java` file path. Same ignore list as
+ * the scan phase (parser-httpservice.iterJavaFiles) — duplicated here to
+ * avoid leaking the scan module's internal helper through the CLI surface.
+ * Symlinks are not followed.
+ */
+declare function iterJavaFilesCached(root: string): IterableIterator<string>;
+/**
+ * Run the analyze pipeline for one endpoint:
+ *   1. findImplFor(interfaceFqn, allClasses) — locate the impl class.
+ *   2. Match the interface method to the impl method (name + param count).
+ *   3. extractFields + extractCallChain.
+ *
+ * Returns the enriched fields/callChain/depTables/authRequired, plus a
+ * `skipReason` string when the endpoint should be marked `status: skip`.
+ */
+declare function analyzeEndpoint(endpoint: Endpoint, allClasses: ClassInfo[]): Promise<{
+    fields: Endpoint['fields'];
+    callChain: string[];
+    depTables: string[];
+    authRequired: boolean;
+    skipReason: string | null;
+}>;
+/** Count parameters in a signature string like `Object qryOrderList(Object reqVo)`. */
+declare function countParamsInSignature(signature: string): number;
+/**
+ * Find the impl method matching `name` + `paramCount`. Falls back to
+ * name-only match if paramCount is 0 (defensive — shouldn't happen for
+ * real @Center methods, which always have ≥1 param).
+ */
+declare function findImplMethod(implInfo: ClassInfo, name: string, paramCount: number): MethodSignature | null;
+/**
+ * Remove the existing output subtree so a re-scan doesn't leave stale
+ * `.bru` / `.md` files behind for endpoints that no longer exist. Safe to
+ * call on a non-existent dir.
+ *
+ * Preserves any files / subdirs the user might have added that are NOT
+ * `.bru` / `.md` pairs? Spec says "full re-scan" = delete the whole
+ * `docs/api-test/<service>/` subtree and rewrite bruno.json. We follow
+ * that literally: delete the entire output dir's *.bru / *.md / bruno.json,
+ * and remove now-empty service subdirs.
+ */
+declare function clearOutputDir(outputDir: string): Promise<void>;
+/**
+ * Read an endpoint's status from its `.md` frontmatter. Returns 'active'
+ * when the .md doesn't exist or the status line can't be found (defensive
+ * — a fresh collection with no analyze phase still runs).
+ */
+declare function readEndpointStatus(endpoint: Endpoint, outputDir: string): 'active' | 'skip';
+/**
+ * When `--filter` narrows to exactly one service, return that service name
+ * so `runBrunoCollection` can narrow Bruno CLI's run to that subdir (faster).
+ * When multiple services match (or none), return null — run the whole
+ * collection and filter results after.
+ */
+declare function pickFilterService(filterRe: RegExp | null, endpoints: Endpoint[]): string | null;
+/** Judgment outcome for one BrunoRunResult. */
+interface Judgment {
+    passed: boolean;
+    bizCode: string | null;
+    error: string | null;
+}
+/**
+ * Judge pass/fail for one Bruno run result against the profile's biz-code rule.
+ *
+ *   - Bruno-reported error (timeout / request_failed) → passed=false, error
+ *     forwarded.
+ *   - HTTP 5xx → passed=false, error=http_5xx.
+ *   - HTTP 4xx → passed=false, error=http_4xx.
+ *   - Other non-200 → passed=false, error=http_non_200.
+ *   - HTTP 200 + bizCodeField null → passed=true (HTTP-only check).
+ *   - HTTP 200 + bizCodeField set + value in bizCodeSuccessValues → passed=true.
+ *   - HTTP 200 + bizCodeField set + value NOT in success values → passed=false,
+ *     error=biz_code_value_mismatch.
+ *   - HTTP 200 + bizCodeField set + field missing from response body →
+ *     passed=false, error=biz_code_field_missing.
+ */
+declare function judgePass(result: BrunoRunResult, profile: ApiTestProfile): Judgment;
+/**
+ * Extract the biz code value from a response body. The body may be a JSON
+ * object or a JSON string. Returns the stringified value, or null when the
+ * field is absent / the body can't be parsed.
+ */
+declare function extractBizCode(responseBody: string, bizCodeField: string): string | null;
+export declare const __INTERNAL_CLI: {
+    DEFAULT_OUTPUT_DIR: string;
+    BRUNO_COLLECTION_CONFIG: {
+        version: number;
+        name: string;
+        type: string;
+    };
+    clearOutputDir: typeof clearOutputDir;
+    iterJavaFilesCached: typeof iterJavaFilesCached;
+    analyzeEndpoint: typeof analyzeEndpoint;
+    countParamsInSignature: typeof countParamsInSignature;
+    findImplMethod: typeof findImplMethod;
+    readEndpointStatus: typeof readEndpointStatus;
+    pickFilterService: typeof pickFilterService;
+    judgePass: typeof judgePass;
+    extractBizCode: typeof extractBizCode;
+};
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/api-test/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/api-test/cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAKH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAOzC,OAAO,EAAiB,KAAK,SAAS,EAAE,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AAKpF,OAAO,EAAsB,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAevE,OAAO,KAAK,EAAE,QAAQ,EAAW,cAAc,EAAE,MAAM,SAAS,CAAC;AAcjE;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA4rB9D;AAID;;;;;GAKG;AACH,iBAAU,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAkBpE;AAaD;;;;;;;;GAQG;AACH,iBAAe,eAAe,CAC5B,QAAQ,EAAE,QAAQ,EAClB,UAAU,EAAE,SAAS,EAAE,GACtB,OAAO,CAAC;IACT,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC3B,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,YAAY,EAAE,OAAO,CAAC;IACtB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,CAAC,CA4CD;AAED,uFAAuF;AACvF,iBAAS,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CASzD;AAED;;;;GAIG;AACH,iBAAS,cAAc,CACrB,QAAQ,EAAE,SAAS,EACnB,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,GACjB,eAAe,GAAG,IAAI,CAMxB;AAED;;;;;;;;;;GAUG;AACH,iBAAe,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAmB9D;AAkED;;;;GAIG;AACH,iBAAS,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,QAAQ,GAAG,MAAM,CAWpF;AAED;;;;;GAKG;AACH,iBAAS,iBAAiB,CACxB,QAAQ,EAAE,MAAM,GAAG,IAAI,EACvB,SAAS,EAAE,QAAQ,EAAE,GACpB,MAAM,GAAG,IAAI,CAYf;AAED,+CAA+C;AAC/C,UAAU,QAAQ;IAChB,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED;;;;;;;;;;;;;;GAcG;AACH,iBAAS,SAAS,CAAC,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,GAAG,QAAQ,CA8B5E;AAED;;;;GAIG;AACH,iBAAS,cAAc,CAAC,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAgBjF;AAGD,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;CAY1B,CAAC"}