codesift-mcp 0.2.18 → 0.4.0

package/dist/tools/hono-middleware-chain.js

@@ -0,0 +1,84 @@
+/**
+ * trace_middleware_chain — returns the ordered middleware chain for a given Hono route.
+ *
+ * For a path like /api/admin/users/:id, walks all middleware chains whose scope
+ * pattern matches the route's fully-resolved path and concatenates them in
+ * registration order. Output is a MiddlewareEntry[] (see hono-model.ts).
+ *
+ * Spec: docs/specs/2026-04-10-hono-framework-intelligence-spec.md (Task 16)
+ */
+import { getCodeIndex } from "./index-tools.js";
+import { honoCache } from "../cache/hono-cache.js";
+import { HonoExtractor } from "../parser/extractors/hono.js";
+import { matchPath } from "./route-tools.js";
+import { detectFrameworks } from "../utils/framework-detect.js";
+import { join } from "node:path";
+export async function traceMiddlewareChain(repo, path, method) {
+    const index = await getCodeIndex(repo);
+    if (!index) {
+        return { chain: [], error: `Repository "${repo}" not found` };
+    }
+    const frameworks = detectFrameworks(index);
+    if (!frameworks.has("hono")) {
+        return { chain: [], error: "No Hono app detected in this repo" };
+    }
+    const entryFile = resolveHonoEntryFile(index);
+    if (!entryFile) {
+        return { chain: [], error: "No Hono app entry file found" };
+    }
+    let model;
+    try {
+        model = await honoCache.get(repo, entryFile, new HonoExtractor());
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return { chain: [], error: `Failed to parse Hono app: ${msg}` };
+    }
+    // Find the matching route
+    const upperMethod = method?.toUpperCase();
+    const matchingRoute = model.routes.find((r) => matchPath(r.path, path) && (!upperMethod || r.method === upperMethod));
+    if (!matchingRoute) {
+        return {
+            chain: [],
+            error: `No route matching ${method ?? "ANY"} ${path}`,
+        };
+    }
+    // Find all middleware chains whose scope_pattern matches the route path
+    const chain = [];
+    for (const mc of model.middleware_chains) {
+        const pattern = compileScopePattern(mc.scope_pattern);
+        if (pattern.test(matchingRoute.path)) {
+            chain.push(...mc.entries);
+        }
+    }
+    // Sort by order (registration order within each chain is already numeric)
+    chain.sort((a, b) => a.order - b.order);
+    return {
+        route: {
+            method: matchingRoute.method,
+            path: matchingRoute.path,
+            file: matchingRoute.file,
+            line: matchingRoute.line,
+        },
+        chain,
+    };
+}
+function resolveHonoEntryFile(index) {
+    for (const sym of index.symbols) {
+        if (sym.source && /new\s+(?:Hono|OpenAPIHono)\s*(?:<[^>]*>)?\s*\(/.test(sym.source)) {
+            return join(index.root, sym.file);
+        }
+    }
+    return null;
+}
+function compileScopePattern(pattern) {
+    // Simple glob→regex: * matches anything (non-greedy-ish for path segments)
+    // Handle bare "*" as "match anything"
+    if (pattern === "*")
+        return /^.*$/;
+    // Escape regex metachars EXCEPT *, then replace * with .*
+    const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&");
+    const regexStr = escaped.replace(/\*/g, ".*");
+    return new RegExp(`^${regexStr}$`);
+}
+//# sourceMappingURL=hono-middleware-chain.js.map

package/dist/tools/hono-middleware-chain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hono-middleware-chain.js","sourceRoot":"","sources":["../../src/tools/hono-middleware-chain.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAcjC,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAY,EACZ,IAAY,EACZ,MAAe;IAEf,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,eAAe,IAAI,aAAa,EAAE,CAAC;IAChE,CAAC;IAED,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC;IACnE,CAAC;IAED,MAAM,SAAS,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;IAC9D,CAAC;IAED,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,aAAa,EAAE,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,6BAA6B,GAAG,EAAE,EAAE,CAAC;IAClE,CAAC;IAED,0BAA0B;IAC1B,MAAM,WAAW,GAAG,MAAM,EAAE,WAAW,EAAE,CAAC;IAC1C,MAAM,aAAa,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CACrC,CAAC,CAAY,EAAE,EAAE,CACf,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CACxE,CAAC;IAEF,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO;YACL,KAAK,EAAE,EAAE;YACT,KAAK,EAAE,qBAAqB,MAAM,IAAI,KAAK,IAAI,IAAI,EAAE;SACtD,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,MAAM,KAAK,GAAsB,EAAE,CAAC;IACpC,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,mBAAmB,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC;QACtD,IAAI,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IAExC,OAAO;QACL,KAAK,EAAE;YACL,MAAM,EAAE,aAAa,CAAC,MAAM;YAC5B,IAAI,EAAE,aAAa,CAAC,IAAI;YACxB,IAAI,EAAE,aAAa,CAAC,IAAI;YACxB,IAAI,EAAE,aAAa,CAAC,IAAI;SACzB;QACD,KAAK;KACN,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,KAG7B;IACC,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAChC,IAAI,GAAG,CAAC,MAAM,IAAI,gDAAgD,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACpF,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAe;IAC1C,2EAA2E;IAC3E,sCAAsC;IACtC,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,MAAM,CAAC;IACnC,0DAA0D;IAC1D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC9C,OAAO,IAAI,MAAM,CAAC,IAAI,QAAQ,GAAG,CAAC,CAAC;AACrC,CAAC"}

package/dist/tools/hono-modules.d.ts

@@ -0,0 +1,22 @@
+/**
+ * detect_hono_modules — clusters routes into logical modules without any new
+ * AST walking. Uses the 2-segment path prefix as the clustering key (e.g.,
+ * /api/admin/users → /api/admin), then rolls up middleware, env bindings,
+ * and source files per group. Single-segment routes cluster on the first
+ * segment alone.
+ *
+ * Closes Hono GitHub Issue #4121 — there is no existing architecture
+ * guidance for enterprise Hono apps with multiple logical modules. This
+ * tool surfaces the implicit module structure already encoded in path
+ * prefixes and shared middleware.
+ *
+ * Spec: docs/specs/2026-04-11-hono-phase-2-plan.md (T11)
+ */
+import type { HonoModule } from "../parser/extractors/hono-model.js";
+export interface HonoModulesResult {
+    modules?: HonoModule[];
+    total?: number;
+    error?: string;
+}
+export declare function detectHonoModules(repo: string): Promise<HonoModulesResult>;
+//# sourceMappingURL=hono-modules.d.ts.map

package/dist/tools/hono-modules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hono-modules.d.ts","sourceRoot":"","sources":["../../src/tools/hono-modules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAOH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oCAAoC,CAAC;AAErE,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,EAAE,UAAU,EAAE,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,iBAAiB,CAAC,CA0E5B"}

package/dist/tools/hono-modules.js

@@ -0,0 +1,126 @@
+/**
+ * detect_hono_modules — clusters routes into logical modules without any new
+ * AST walking. Uses the 2-segment path prefix as the clustering key (e.g.,
+ * /api/admin/users → /api/admin), then rolls up middleware, env bindings,
+ * and source files per group. Single-segment routes cluster on the first
+ * segment alone.
+ *
+ * Closes Hono GitHub Issue #4121 — there is no existing architecture
+ * guidance for enterprise Hono apps with multiple logical modules. This
+ * tool surfaces the implicit module structure already encoded in path
+ * prefixes and shared middleware.
+ *
+ * Spec: docs/specs/2026-04-11-hono-phase-2-plan.md (T11)
+ */
+import { getCodeIndex } from "./index-tools.js";
+import { honoCache } from "../cache/hono-cache.js";
+import { HonoExtractor } from "../parser/extractors/hono.js";
+import { detectFrameworks } from "../utils/framework-detect.js";
+import { join } from "node:path";
+export async function detectHonoModules(repo) {
+    const index = await getCodeIndex(repo);
+    if (!index)
+        return { error: `Repository "${repo}" not found` };
+    const frameworks = detectFrameworks(index);
+    if (!frameworks.has("hono"))
+        return { error: "No Hono app detected" };
+    const entryFile = resolveHonoEntryFile(index);
+    if (!entryFile)
+        return { error: "No Hono app entry file found" };
+    let model;
+    try {
+        model = await honoCache.get(repo, entryFile, new HonoExtractor());
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return { error: `Failed to parse: ${msg}` };
+    }
+    // Bucket routes by module prefix.
+    const buckets = new Map();
+    for (const route of model.routes) {
+        const prefix = modulePrefix(route.path);
+        let bucket = buckets.get(prefix);
+        if (!bucket) {
+            bucket = { routes: [], files: new Set(), bindings: new Set() };
+            buckets.set(prefix, bucket);
+        }
+        bucket.routes.push(`${route.method} ${route.path}`);
+        bucket.files.add(route.file);
+        // Collect env bindings referenced from the route's inline handler
+        if (route.inline_analysis) {
+            for (const access of route.inline_analysis.context_access) {
+                if (access.type === "env")
+                    bucket.bindings.add(access.key);
+            }
+        }
+    }
+    // Roll up middleware from chains whose scope pattern matches any route
+    // in the module. Scope matching is a simple glob-to-regex conversion.
+    const modules = [];
+    for (const [prefix, bucket] of buckets) {
+        const mwNames = new Set();
+        for (const chain of model.middleware_chains) {
+            const pattern = scopeToRegex(chain.scope);
+            const anyMatch = bucket.routes.some((r) => {
+                const path = r.split(" ")[1] ?? "";
+                return pattern.test(path);
+            });
+            if (anyMatch) {
+                for (const entry of chain.entries) {
+                    if (entry.name !== "<inline>")
+                        mwNames.add(entry.name);
+                }
+            }
+        }
+        modules.push({
+            name: moduleNameFromPrefix(prefix),
+            routes: bucket.routes.sort(),
+            middleware: [...mwNames].sort(),
+            bindings: [...bucket.bindings].sort(),
+            path_prefix: prefix,
+            files: [...bucket.files].sort(),
+        });
+    }
+    modules.sort((a, b) => a.name.localeCompare(b.name));
+    return { modules, total: modules.length };
+}
+/**
+ * Compute the module prefix from a route path. Takes the first two
+ * non-empty segments so `/api/admin/users/:id` → `/api/admin`, and
+ * `/health` → `/health`. Single-segment paths become their own module.
+ */
+function modulePrefix(routePath) {
+    const segments = routePath.split("/").filter((s) => s.length > 0);
+    if (segments.length === 0)
+        return "/";
+    if (segments.length === 1)
+        return `/${segments[0]}`;
+    return `/${segments[0]}/${segments[1]}`;
+}
+function moduleNameFromPrefix(prefix) {
+    const cleaned = prefix.replace(/^\//, "").replace(/\//g, "-");
+    return cleaned.length > 0 ? cleaned : "root";
+}
+/**
+ * Convert a middleware scope like "/api/admin/*" into a regex. "*" inside a
+ * path segment maps to "[^/]*"; a trailing "/*" means "anything under this
+ * prefix", so it maps to ".*". Bare "*" means global.
+ */
+function scopeToRegex(scope) {
+    if (scope === "*")
+        return /^.*$/;
+    const escaped = scope
+        .replace(/[.+?^${}()|[\]\\]/g, "\\$&")
+        .replace(/\/\*$/, "/.*")
+        .replace(/\*/g, "[^/]*");
+    return new RegExp(`^${escaped}$`);
+}
+function resolveHonoEntryFile(index) {
+    for (const sym of index.symbols) {
+        if (sym.source && /new\s+(?:Hono|OpenAPIHono)\s*(?:<[^>]*>)?\s*\(/.test(sym.source)) {
+            return join(index.root, sym.file);
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=hono-modules.js.map

package/dist/tools/hono-modules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hono-modules.js","sourceRoot":"","sources":["../../src/tools/hono-modules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AASjC,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAY;IAEZ,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,KAAK,EAAE,eAAe,IAAI,aAAa,EAAE,CAAC;IAE/D,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;IAEtE,MAAM,SAAS,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;IAEjE,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,aAAa,EAAE,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,EAAE,KAAK,EAAE,oBAAoB,GAAG,EAAE,EAAE,CAAC;IAC9C,CAAC;IAED,kCAAkC;IAClC,MAAM,OAAO,GAAG,IAAI,GAAG,EAOpB,CAAC;IAEJ,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;YAC/D,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC9B,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACpD,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,kEAAkE;QAClE,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;YAC1B,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,cAAc,EAAE,CAAC;gBAC1D,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK;oBAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,sEAAsE;IACtE,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;YAC5C,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC1C,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;gBACxC,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBACnC,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC,CAAC,CAAC;YACH,IAAI,QAAQ,EAAE,CAAC;gBACb,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;oBAClC,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU;wBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACzD,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,oBAAoB,CAAC,MAAM,CAAC;YAClC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;YAC5B,UAAU,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE;YAC/B,QAAQ,EAAE,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE;YACrC,WAAW,EAAE,MAAM;YACnB,KAAK,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE;SAChC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACrD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;AAC5C,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,SAAiB;IACrC,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAClE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IACtC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACpD,OAAO,IAAI,QAAQ,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1C,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAc;IAC1C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9D,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;AAC/C,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,KAAa;IACjC,IAAI,KAAK,KAAK,GAAG;QAAE,OAAO,MAAM,CAAC;IACjC,MAAM,OAAO,GAAG,KAAK;SAClB,OAAO,CAAC,oBAAoB,EAAE,MAAM,CAAC;SACrC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC;SACvB,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC3B,OAAO,IAAI,MAAM,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,oBAAoB,CAAC,KAG7B;IACC,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAChC,IAAI,GAAG,CAAC,MAAM,IAAI,gDAAgD,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACpF,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/tools/hono-response-types.d.ts

@@ -0,0 +1,37 @@
+/**
+ * extract_response_types — aggregates all statically-knowable response types
+ * (status code + body shape hint + error classes) per route. Closes Hono
+ * GitHub Issue #4270: error response types are not inferrable by RPC clients
+ * so client-side type narrowing silently drops them. This tool surfaces them
+ * from the inline_analysis data so callers can generate RPC client types
+ * that include error paths.
+ *
+ * Spec: docs/specs/2026-04-11-hono-phase-2-plan.md (T9)
+ */
+export interface ResponseTypeEntry {
+    status: number;
+    kind: "json" | "text" | "html" | "body" | "redirect" | "newResponse";
+    shape_hint?: string;
+}
+export interface ErrorTypeEntry {
+    status: number;
+    exception_class: string;
+    message_hint?: string;
+}
+export interface RouteResponseTypes {
+    route: string;
+    file: string;
+    line: number;
+    responses: ResponseTypeEntry[];
+    errors: ErrorTypeEntry[];
+    /** Distinct status codes reachable (union of responses + errors). */
+    status_codes: number[];
+}
+export interface ResponseTypesResult {
+    routes?: RouteResponseTypes[];
+    total_routes?: number;
+    total_statuses?: number;
+    error?: string;
+}
+export declare function extractResponseTypes(repo: string): Promise<ResponseTypesResult>;
+//# sourceMappingURL=hono-response-types.d.ts.map

package/dist/tools/hono-response-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hono-response-types.d.ts","sourceRoot":"","sources":["../../src/tools/hono-response-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAQH,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,GAAG,aAAa,CAAC;IACrE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAC/B,MAAM,EAAE,cAAc,EAAE,CAAC;IACzB,qEAAqE;IACrE,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,mBAAmB,CAAC,CAwD9B"}

package/dist/tools/hono-response-types.js

@@ -0,0 +1,84 @@
+/**
+ * extract_response_types — aggregates all statically-knowable response types
+ * (status code + body shape hint + error classes) per route. Closes Hono
+ * GitHub Issue #4270: error response types are not inferrable by RPC clients
+ * so client-side type narrowing silently drops them. This tool surfaces them
+ * from the inline_analysis data so callers can generate RPC client types
+ * that include error paths.
+ *
+ * Spec: docs/specs/2026-04-11-hono-phase-2-plan.md (T9)
+ */
+import { getCodeIndex } from "./index-tools.js";
+import { honoCache } from "../cache/hono-cache.js";
+import { HonoExtractor } from "../parser/extractors/hono.js";
+import { detectFrameworks } from "../utils/framework-detect.js";
+import { join } from "node:path";
+export async function extractResponseTypes(repo) {
+    const index = await getCodeIndex(repo);
+    if (!index)
+        return { error: `Repository "${repo}" not found` };
+    const frameworks = detectFrameworks(index);
+    if (!frameworks.has("hono"))
+        return { error: "No Hono app detected" };
+    const entryFile = resolveHonoEntryFile(index);
+    if (!entryFile)
+        return { error: "No Hono app entry file found" };
+    let model;
+    try {
+        model = await honoCache.get(repo, entryFile, new HonoExtractor());
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return { error: `Failed to parse: ${msg}` };
+    }
+    const routes = [];
+    const allStatuses = new Set();
+    for (const route of model.routes) {
+        if (!route.inline_analysis)
+            continue;
+        const responses = route.inline_analysis.responses.map((r) => {
+            const entry = { status: r.status, kind: r.kind };
+            if (r.shape_hint !== undefined)
+                entry.shape_hint = r.shape_hint;
+            return entry;
+        });
+        const errors = route.inline_analysis.errors.map((e) => {
+            const entry = {
+                status: e.status,
+                exception_class: e.exception_class,
+            };
+            if (e.message_hint !== undefined)
+                entry.message_hint = e.message_hint;
+            return entry;
+        });
+        const statusSet = new Set();
+        for (const r of responses)
+            statusSet.add(r.status);
+        for (const e of errors)
+            statusSet.add(e.status);
+        for (const s of statusSet)
+            allStatuses.add(s);
+        routes.push({
+            route: `${route.method} ${route.path}`,
+            file: route.file,
+            line: route.line,
+            responses,
+            errors,
+            status_codes: [...statusSet].sort((a, b) => a - b),
+        });
+    }
+    return {
+        routes,
+        total_routes: routes.length,
+        total_statuses: allStatuses.size,
+    };
+}
+function resolveHonoEntryFile(index) {
+    for (const sym of index.symbols) {
+        if (sym.source && /new\s+(?:Hono|OpenAPIHono)\s*(?:<[^>]*>)?\s*\(/.test(sym.source)) {
+            return join(index.root, sym.file);
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=hono-response-types.js.map

package/dist/tools/hono-response-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hono-response-types.js","sourceRoot":"","sources":["../../src/tools/hono-response-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AA+BjC,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAY;IAEZ,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,KAAK,EAAE,eAAe,IAAI,aAAa,EAAE,CAAC;IAE/D,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;IAEtE,MAAM,SAAS,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;IAEjE,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,aAAa,EAAE,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,EAAE,KAAK,EAAE,oBAAoB,GAAG,EAAE,EAAE,CAAC;IAC9C,CAAC;IAED,MAAM,MAAM,GAAyB,EAAE,CAAC;IACxC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IAEtC,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,IAAI,CAAC,KAAK,CAAC,eAAe;YAAE,SAAS;QACrC,MAAM,SAAS,GAAwB,KAAK,CAAC,eAAe,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAC/E,MAAM,KAAK,GAAsB,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACpE,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS;gBAAE,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC;YAChE,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;QACH,MAAM,MAAM,GAAqB,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACtE,MAAM,KAAK,GAAmB;gBAC5B,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,eAAe,EAAE,CAAC,CAAC,eAAe;aACnC,CAAC;YACF,IAAI,CAAC,CAAC,YAAY,KAAK,SAAS;gBAAE,KAAK,CAAC,YAAY,GAAG,CAAC,CAAC,YAAY,CAAC;YACtE,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;QACpC,KAAK,MAAM,CAAC,IAAI,SAAS;YAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACnD,KAAK,MAAM,CAAC,IAAI,MAAM;YAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAChD,KAAK,MAAM,CAAC,IAAI,SAAS;YAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAE9C,MAAM,CAAC,IAAI,CAAC;YACV,KAAK,EAAE,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE;YACtC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,SAAS;YACT,MAAM;YACN,YAAY,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;SACnD,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,MAAM;QACN,YAAY,EAAE,MAAM,CAAC,MAAM;QAC3B,cAAc,EAAE,WAAW,CAAC,IAAI;KACjC,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,KAG7B;IACC,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAChC,IAAI,GAAG,CAAC,MAAM,IAAI,gDAAgD,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACpF,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/tools/hono-rpc-types.d.ts

@@ -0,0 +1,21 @@
+/**
+ * trace_rpc_types — analyzes Hono RPC type exports for slow-pattern detection.
+ * Addresses Issue #3869: `export type X = typeof app` causes 8-min CI builds.
+ *
+ * Spec: docs/specs/2026-04-10-hono-framework-intelligence-spec.md (Task 20)
+ */
+export interface RpcTypesResult {
+    exports?: Array<{
+        name: string;
+        shape: "full_app" | "route_group";
+        is_slow: boolean;
+        source_var: string;
+        file: string;
+        line: number;
+        recommendation?: string;
+    }>;
+    has_slow_pattern?: boolean;
+    error?: string;
+}
+export declare function traceRpcTypes(repo: string): Promise<RpcTypesResult>;
+//# sourceMappingURL=hono-rpc-types.d.ts.map

package/dist/tools/hono-rpc-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hono-rpc-types.d.ts","sourceRoot":"","sources":["../../src/tools/hono-rpc-types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAQH,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,KAAK,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,UAAU,GAAG,aAAa,CAAC;QAClC,OAAO,EAAE,OAAO,CAAC;QACjB,UAAU,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC,CAAC;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAqCzE"}

package/dist/tools/hono-rpc-types.js

@@ -0,0 +1,57 @@
+/**
+ * trace_rpc_types — analyzes Hono RPC type exports for slow-pattern detection.
+ * Addresses Issue #3869: `export type X = typeof app` causes 8-min CI builds.
+ *
+ * Spec: docs/specs/2026-04-10-hono-framework-intelligence-spec.md (Task 20)
+ */
+import { getCodeIndex } from "./index-tools.js";
+import { honoCache } from "../cache/hono-cache.js";
+import { HonoExtractor } from "../parser/extractors/hono.js";
+import { detectFrameworks } from "../utils/framework-detect.js";
+import { join } from "node:path";
+export async function traceRpcTypes(repo) {
+    const index = await getCodeIndex(repo);
+    if (!index)
+        return { error: `Repository "${repo}" not found` };
+    const frameworks = detectFrameworks(index);
+    if (!frameworks.has("hono"))
+        return { error: "No Hono app detected" };
+    const entryFile = resolveHonoEntryFile(index);
+    if (!entryFile)
+        return { error: "No Hono entry file found" };
+    let model;
+    try {
+        model = await honoCache.get(repo, entryFile, new HonoExtractor());
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return { error: `Failed to parse: ${msg}` };
+    }
+    const exports = model.rpc_exports.map((r) => {
+        const entry = {
+            name: r.export_name,
+            shape: r.shape,
+            is_slow: r.shape === "full_app",
+            source_var: r.source_var,
+            file: r.file,
+            line: r.line,
+        };
+        if (r.shape === "full_app") {
+            entry.recommendation = "Split into per-route-group type exports (Hono docs + Issue #3869) to reduce tsc compile time.";
+        }
+        return entry;
+    });
+    return {
+        exports,
+        has_slow_pattern: exports.some((e) => e.is_slow),
+    };
+}
+function resolveHonoEntryFile(index) {
+    for (const sym of index.symbols) {
+        if (sym.source && /new\s+(?:Hono|OpenAPIHono)\s*(?:<[^>]*>)?\s*\(/.test(sym.source)) {
+            return join(index.root, sym.file);
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=hono-rpc-types.js.map

package/dist/tools/hono-rpc-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hono-rpc-types.js","sourceRoot":"","sources":["../../src/tools/hono-rpc-types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAgBjC,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAY;IAC9C,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,KAAK,EAAE,eAAe,IAAI,aAAa,EAAE,CAAC;IAE/D,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;IAEtE,MAAM,SAAS,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC;IAE7D,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,aAAa,EAAE,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,EAAE,KAAK,EAAE,oBAAoB,GAAG,EAAE,EAAE,CAAC;IAC9C,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC1C,MAAM,KAAK,GAAmD;YAC5D,IAAI,EAAE,CAAC,CAAC,WAAW;YACnB,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,OAAO,EAAE,CAAC,CAAC,KAAK,KAAK,UAAU;YAC/B,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;SACb,CAAC;QACF,IAAI,CAAC,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YAC3B,KAAK,CAAC,cAAc,GAAG,+FAA+F,CAAC;QACzH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,OAAO;QACP,gBAAgB,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;KACjD,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,KAG7B;IACC,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAChC,IAAI,GAAG,CAAC,MAAM,IAAI,gDAAgD,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACpF,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/tools/hono-security.d.ts

@@ -0,0 +1,21 @@
+/**
+ * audit_hono_security — security audit of Hono application.
+ *
+ * Checks: rate limiting on mutations, secure-headers middleware, auth
+ * ordering, CSRF protection, hardcoded secret access.
+ *
+ * Spec: docs/specs/2026-04-10-hono-framework-intelligence-spec.md (Task 21)
+ */
+export interface SecurityFinding {
+    severity: "CRITICAL" | "HIGH" | "MEDIUM" | "LOW";
+    rule: string;
+    message: string;
+    file?: string;
+    line?: number;
+}
+export interface SecurityAuditResult {
+    findings?: SecurityFinding[];
+    error?: string;
+}
+export declare function auditHonoSecurity(repo: string): Promise<SecurityAuditResult>;
+//# sourceMappingURL=hono-security.d.ts.map

package/dist/tools/hono-security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hono-security.d.ts","sourceRoot":"","sources":["../../src/tools/hono-security.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAQH,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,eAAe,EAAE,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAOD,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,mBAAmB,CAAC,CA+E9B"}

package/dist/tools/hono-security.js

@@ -0,0 +1,98 @@
+/**
+ * audit_hono_security — security audit of Hono application.
+ *
+ * Checks: rate limiting on mutations, secure-headers middleware, auth
+ * ordering, CSRF protection, hardcoded secret access.
+ *
+ * Spec: docs/specs/2026-04-10-hono-framework-intelligence-spec.md (Task 21)
+ */
+import { getCodeIndex } from "./index-tools.js";
+import { honoCache } from "../cache/hono-cache.js";
+import { HonoExtractor } from "../parser/extractors/hono.js";
+import { detectFrameworks } from "../utils/framework-detect.js";
+import { join } from "node:path";
+const RATE_LIMIT_KEYWORDS = /rate\s*limit/i;
+const SECURE_HEADERS_KEYWORDS = /secure[_-]?headers/i;
+const AUTH_KEYWORDS = /auth|jwt|bearer|clerk|session/i;
+const MUTATION_METHODS = new Set(["POST", "PUT", "DELETE", "PATCH"]);
+export async function auditHonoSecurity(repo) {
+    const index = await getCodeIndex(repo);
+    if (!index)
+        return { error: `Repository "${repo}" not found` };
+    const frameworks = detectFrameworks(index);
+    if (!frameworks.has("hono"))
+        return { error: "No Hono app detected" };
+    const entryFile = resolveHonoEntryFile(index);
+    if (!entryFile)
+        return { error: "No Hono entry file found" };
+    let model;
+    try {
+        model = await honoCache.get(repo, entryFile, new HonoExtractor());
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return { error: `Failed to parse: ${msg}` };
+    }
+    const findings = [];
+    // Check 1: global secure-headers middleware
+    const hasSecureHeaders = model.middleware_chains.some((mc) => mc.scope === "*" &&
+        mc.entries.some((e) => SECURE_HEADERS_KEYWORDS.test(e.name)));
+    if (!hasSecureHeaders) {
+        findings.push({
+            severity: "MEDIUM",
+            rule: "missing-secure-headers",
+            message: "No secure-headers middleware registered globally. Consider `app.use('*', secureHeaders())` from hono/secure-headers.",
+        });
+    }
+    // Check 2: mutation routes without rate limiting
+    for (const route of model.routes) {
+        if (!MUTATION_METHODS.has(route.method))
+            continue;
+        const activeChains = model.middleware_chains.filter((mc) => {
+            if (mc.scope === "*")
+                return true;
+            const pattern = mc.scope.replace(/\*/g, ".*");
+            return new RegExp(`^${pattern}$`).test(route.path);
+        });
+        const hasRateLimit = activeChains.some((mc) => mc.entries.some((e) => RATE_LIMIT_KEYWORDS.test(e.name)));
+        if (!hasRateLimit) {
+            findings.push({
+                severity: "HIGH",
+                rule: "missing-rate-limit",
+                message: `Mutation route ${route.method} ${route.path} has no rate limiting middleware.`,
+                file: route.file,
+                line: route.line,
+            });
+        }
+    }
+    // Check 3: auth ordering — auth middleware appearing after non-auth in chain
+    for (const mc of model.middleware_chains) {
+        let seenNonAuth = false;
+        for (const entry of mc.entries) {
+            if (AUTH_KEYWORDS.test(entry.name)) {
+                if (seenNonAuth) {
+                    findings.push({
+                        severity: "MEDIUM",
+                        rule: "auth-ordering",
+                        message: `Auth middleware "${entry.name}" appears after non-auth middleware in scope "${mc.scope}". Auth should be registered first.`,
+                        file: entry.file,
+                        line: entry.line,
+                    });
+                }
+            }
+            else {
+                seenNonAuth = true;
+            }
+        }
+    }
+    return { findings };
+}
+function resolveHonoEntryFile(index) {
+    for (const sym of index.symbols) {
+        if (sym.source && /new\s+(?:Hono|OpenAPIHono)\s*(?:<[^>]*>)?\s*\(/.test(sym.source)) {
+            return join(index.root, sym.file);
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=hono-security.js.map

package/dist/tools/hono-security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hono-security.js","sourceRoot":"","sources":["../../src/tools/hono-security.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAejC,MAAM,mBAAmB,GAAG,eAAe,CAAC;AAC5C,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;AACtD,MAAM,aAAa,GAAG,gCAAgC,CAAC;AACvD,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AAErE,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAY;IAEZ,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,KAAK,EAAE,eAAe,IAAI,aAAa,EAAE,CAAC;IAE/D,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;IAEtE,MAAM,SAAS,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC;IAE7D,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,aAAa,EAAE,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,EAAE,KAAK,EAAE,oBAAoB,GAAG,EAAE,EAAE,CAAC;IAC9C,CAAC;IAED,MAAM,QAAQ,GAAsB,EAAE,CAAC;IAEvC,4CAA4C;IAC5C,MAAM,gBAAgB,GAAG,KAAK,CAAC,iBAAiB,CAAC,IAAI,CACnD,CAAC,EAAE,EAAE,EAAE,CACL,EAAE,CAAC,KAAK,KAAK,GAAG;QAChB,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAC/D,CAAC;IACF,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,QAAQ;YAClB,IAAI,EAAE,wBAAwB;YAC9B,OAAO,EACL,sHAAsH;SACzH,CAAC,CAAC;IACL,CAAC;IAED,iDAAiD;IACjD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC;YAAE,SAAS;QAElD,MAAM,YAAY,GAAG,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE;YACzD,IAAI,EAAE,CAAC,KAAK,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC;YAClC,MAAM,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAC9C,OAAO,IAAI,MAAM,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;QACH,MAAM,YAAY,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAC5C,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CACzD,CAAC;QACF,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,kBAAkB,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,mCAAmC;gBACxF,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;aACjB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;QACzC,IAAI,WAAW,GAAG,KAAK,CAAC;QACxB,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;YAC/B,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnC,IAAI,WAAW,EAAE,CAAC;oBAChB,QAAQ,CAAC,IAAI,CAAC;wBACZ,QAAQ,EAAE,QAAQ;wBAClB,IAAI,EAAE,eAAe;wBACrB,OAAO,EAAE,oBAAoB,KAAK,CAAC,IAAI,iDAAiD,EAAE,CAAC,KAAK,qCAAqC;wBACrI,IAAI,EAAE,KAAK,CAAC,IAAI;wBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;qBACjB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,WAAW,GAAG,IAAI,CAAC;YACrB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,oBAAoB,CAAC,KAG7B;IACC,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAChC,IAAI,GAAG,CAAC,MAAM,IAAI,gDAAgD,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACpF,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/tools/hono-visualize.d.ts

@@ -0,0 +1,13 @@
+/**
+ * visualize_hono_routes — produce Mermaid or ASCII tree of Hono routing topology.
+ *
+ * Spec: docs/specs/2026-04-10-hono-framework-intelligence-spec.md (Task 22)
+ */
+export type VisualizeFormat = "mermaid" | "tree";
+export interface VisualizeResult {
+    format?: VisualizeFormat;
+    output?: string;
+    error?: string;
+}
+export declare function visualizeHonoRoutes(repo: string, format?: VisualizeFormat): Promise<VisualizeResult>;
+//# sourceMappingURL=hono-visualize.d.ts.map

package/dist/tools/hono-visualize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hono-visualize.d.ts","sourceRoot":"","sources":["../../src/tools/hono-visualize.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,MAAM,CAAC;AAEjD,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAAwB,GAC/B,OAAO,CAAC,eAAe,CAAC,CAsD1B"}