devlensio 0.4.1 → 0.4.3

package/README.md

@@ -0,0 +1,137 @@
+# devlensio — the DevLens analysis engine
+
+[![npm: devlensio](https://img.shields.io/badge/npm-devlensio-cb3837?logo=npm)](https://www.npmjs.com/package/devlensio)
+[![License: AGPL v3](https://img.shields.io/badge/License-AGPL_v3-blue.svg)](https://www.gnu.org/licenses/agpl-3.0)
+
+The core engine behind [DevLens](https://github.com/devlensio/devlensOSS). It turns a TypeScript / JavaScript / React / Next.js / Node.js repository into a **typed code graph** — nodes (components, hooks, functions, stores, routes, files, …) joined by typed edges — scores every node by architectural importance, optionally **summarizes** each node with an LLM (technical / business / security), and exposes a **traversal/query API**.
+
+`devlensio` is a **library + local server**. The user-facing tools — the `devlens` CLI, the MCP server, the Agent Skill, and the Web UI — live in [DevLens OSS](https://github.com/devlensio/devlensOSS) and consume this package.
+
+---
+
+## Install
+
+```bash
+npm install devlensio
+# or: bun add devlensio
+```
+
+Requires Node 18+ (or Bun). An LLM provider key is needed only for summarization, not for structural analysis.
+
+---
+
+## What it does (the pipeline)
+
+```
+Repo path
+   │
+[1] Fingerprint     detect language, framework, router, state manager, data layer, databases
+[2] Filesystem scan extract routes (Next.js app/pages, Express, Fastify, Koa)
+[3] Parse (ts-morph) walk every .ts/.tsx/.js/.jsx → nodes (typed params, return types, prop types)
+[4] Edge detection  many detectors → CALLS, IMPORTS, READS_FROM, WRITES_TO, PROP_PASS, EMITS,
+                    LISTENS, WRAPPED_BY, GUARDS, HANDLES, TESTS, USES, NEXTJS_API_CALL
+[5] Scoring         multi-pass importance scoring + noise filtering (no AI)
+[6] Clustering      cohesive cluster assignment
+[7] Summarize       (optional) topologically-ordered LLM summaries, checkpoint/resume, MapReduce
+   │
+   ▼
+Graph persisted to ~/.devlens  →  queried via the traversal API / CLI / MCP / UI
+```
+
+Structural analysis is fast and deterministic; summarization is the only step that calls an LLM and reuses unchanged nodes across commits.
+
+---
+
+## Public API
+
+```ts
+import {
+  analyzePipeline,        // build the graph (nodes, edges, scores)
+  runSummarization,       // generate technical/business/security summaries
+  computeClusters,        // cohesive clustering
+  buildGraphIndex,        // index nodes+edges for traversal
+  getBlastRadius,         // upstream dependents ("what breaks if I change this")
+  getKHop,                // downstream dependencies ("what this needs")
+  getSubgraph,            // cohesive cluster around a seed
+  findCycles,             // circular-dependency groups
+  resolveConfig, initConfig,   // LLM provider config (~/.devlens/config.json)
+  storage, queue,         // file-based graph storage + job queue singletons
+} from "devlensio";
+
+// Analyze a repo → graph
+const result = await analyzePipeline("/path/to/repo", /* isGithubRepo */ false);
+// result.allNodes, result.allEdges, result.nodeScores
+
+// Query the graph
+const index  = buildGraphIndex(result.allNodes, result.allEdges);
+const impact = getBlastRadius(index, "src/auth/login.ts::login", { radius: 2 });
+const cycles = findCycles(result.allNodes, result.allEdges);
+```
+
+Also exported: all core types (`CodeNode`, `CodeEdge`, `NodeType`, `EdgeType`, …), config helpers (`maskConfig`, `writeConfig`), pre-scan helpers (`readPackageDependencies`, `categorizeLibrary`), and `EDGE_LABELS`. See `dist/index.d.ts` for the full surface.
+
+### Node & edge types
+
+- **Node types:** `COMPONENT`, `HOOK`, `FUNCTION`, `STATE_STORE`, `UTILITY`, `FILE`, `ROUTE`, `TEST`, `STORY`, `THIRD_PARTY` (+ internal `GHOST`).
+- **Edge types:** `CALLS`, `IMPORTS`, `READS_FROM`, `WRITES_TO`, `PROP_PASS`, `EMITS`, `LISTENS`, `WRAPPED_BY`, `GUARDS`, `HANDLES`, `TESTS`, `USES`, `NEXTJS_API_CALL` (frontend `fetch`/`axios`/`useSWR` call site → Next.js API route).
+- Each node carries an importance score and (after summarization) a technical summary, a business summary, and a security assessment (`none|low|medium|high` + notes).
+
+---
+
+## Configuration
+
+Summarization config lives in `~/.devlens/config.json` (set via `initConfig`/`writeConfig`, or env vars loaded with dotenv). Supported providers: **Anthropic**, **OpenAI**, **OpenRouter**, **Gemini**, **Ollama** (local).
+
+```env
+LLM_PROVIDER=openrouter        # ollama | openai | anthropic | openrouter | gemini
+LLM_MODEL=grok-4.1-fast
+LLM_API_KEY=your_api_key       # not needed for ollama
+LLM_BASE_URL=                  # e.g. http://localhost:11434 for Ollama
+```
+
+Graphs and config are stored under `~/.devlens` and shared with all DevLens tools.
+
+---
+
+## Repo layout
+
+```
+src/
+├── fingerprint/   # detect framework, language, router, state, data layer, databases
+├── filesystem/    # route detection (Next.js app/pages, Express, Fastify, Koa)
+├── parser/        # ts-morph AST extraction → nodes
+├── graph/         # edge detectors, traversal API, third-party libs, lookup maps
+├── scoring/       # multi-pass importance scoring + noise filtering
+├── clustering/    # cohesive cluster computation
+├── summarizer/    # LLM summarization (technical/business/security), prompts, checkpoints
+├── pipeline/      # analyzePipeline — orchestrates the whole analysis
+├── jobs/          # job queue, concurrency, SSE progress events
+├── storage/       # file-based graph persistence (~/.devlens)
+├── config/        # provider config resolution
+├── server/        # HTTP API server (consumed by the DevLens Web UI)
+└── debug/         # exportGraph and dev utilities
+```
+
+---
+
+## Scripts
+
+| Script | Does |
+| :-- | :-- |
+| `bun run dev` | watch-mode HTTP server (`src/server/index.ts`) |
+| `bun run start` | run the HTTP server |
+| `bun run build` | `tsc --project tsconfig.build.json` → `dist/` (the published artifact) |
+| `bun test` | run the test suite |
+| `bun run export-graph` | dump a graph for debugging |
+
+---
+
+## Relationship to DevLens OSS
+
+`devlensio` is published to npm and consumed by [DevLens OSS](https://github.com/devlensio/devlensOSS), which provides the `devlens` CLI (`@devlensio/cli`), the MCP server, the `/devlens` Agent Skill, and the Web UI on top of this engine. The CLI binaries bundle whatever version of `devlensio` resolves at build time, so engine fixes ship to users after a `devlensio` release **and** a bump of the dependency pin in DevLens OSS.
+
+---
+
+## License
+
+[GNU Affero General Public License v3.0](LICENSE). If you run a modified version as a hosted service, you must release your modifications under the same license.

package/dist/graph/edges/apiFetchEdges.d.ts

@@ -0,0 +1,8 @@
+import { CodeEdge, CodeNode } from "../../types.js";
+export interface ApiFetchCall {
+    callerType: string;
+    rawUrl: string;
+    resolvedUrl: string;
+    method: string;
+}
+export declare function detectNextjsApiCallEdges(nodes: CodeNode[], repoPath: string): CodeEdge[];

package/dist/graph/edges/apiFetchEdges.js

@@ -0,0 +1,437 @@
+// This file detects the backend routes of the NEXTjs only
+import { Project, SyntaxKind } from "ts-morph";
+import path from "node:path";
+const CALLER_CONFIG = {
+    "fetch": { inferMethod: "from-options", defaultMethod: "GET" },
+    "axios.get": { inferMethod: "fixed", method: "GET" },
+    "axios.post": { inferMethod: "fixed", method: "POST" },
+    "axios.put": { inferMethod: "fixed", method: "PUT" },
+    "axios.delete": { inferMethod: "fixed", method: "DELETE" },
+    "axios.patch": { inferMethod: "fixed", method: "PATCH" },
+    // axios(...) called as a function. Default verb is GET (matching axios),
+    // and the first arg may be either a URL string or a config object — both
+    // handled in extractApiCallsFromFile.
+    "axios": { inferMethod: "from-options", defaultMethod: "GET" },
+    // useSWR(key, fetcher) / useSWRMutation(key, fetcher): the first arg IS the
+    // key/URL, so URL extraction works. useQuery/useSuspenseQuery/useMutation
+    // are intentionally omitted — their first arg is a query-key array or an
+    // options object, never a URL. The real request they fire is the inner
+    // fetch/axios call, which is captured on its own as a CallExpression.
+    "useSWR": { inferMethod: "fixed", method: "GET" },
+    "useSWRMutation": { inferMethod: "fixed", method: "UNKNOWN" },
+};
+function urlPathtoRegex(urlPath) {
+    const pattern = urlPath.split("/").map(segment => {
+        if (segment.startsWith(":") && segment.endsWith("*"))
+            return ".+"; // catch-all :slug*
+        if (segment.startsWith(":"))
+            return "[^/]+"; // dynamic :id
+        return segment.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"); // escape static segments
+    }).join("\\/");
+    return new RegExp(`^${pattern}$`);
+}
+// Groups Next.js API ROUTE nodes by HTTP method for efficient lookup.
+// Each route node carries a concrete method, so it is indexed under that one
+// method key. Callers with an UNKNOWN method (e.g. useSWRMutation) are handled
+// on the query side in matchRouteEntries by scanning every method bucket.
+function buildRouteIndex(nodes) {
+    const index = new Map();
+    const apiRouteNodes = nodes.filter(n => n.type === "ROUTE" &&
+        n.metadata.routeKind === "nextjs" &&
+        n.metadata.routeNodeType === "API_ROUTE" &&
+        typeof n.metadata.httpMethod === "string" &&
+        typeof n.metadata.urlPath === "string");
+    for (const routeNode of apiRouteNodes) {
+        const httpMethod = routeNode.metadata.httpMethod.toUpperCase();
+        const urlPath = routeNode.metadata.urlPath;
+        const isDynamic = routeNode.metadata.isDynamic;
+        const entry = {
+            routeNode, urlPath, httpMethod, isDynamic, urlRegex: urlPathtoRegex(urlPath),
+        };
+        if (!index.has(httpMethod))
+            index.set(httpMethod, []);
+        index.get(httpMethod).push(entry);
+    }
+    return index;
+}
+/*
+Extracts string value from an initializer node.
+Handles 3 cases:
+  'string literal'           → returns value directly
+  `no-substitution template` → returns value directly
+  `template ${expr} literal` → preserves ${...} as-is so normalizeUrl handles it later
+*/
+function resolveVariableValue(initializer) {
+    const kind = initializer.getKind();
+    if (kind === SyntaxKind.StringLiteral) {
+        return initializer.getLiteralText();
+    }
+    if (kind === SyntaxKind.NoSubstitutionTemplateLiteral) {
+        return initializer.getLiteralText();
+    }
+    if (kind === SyntaxKind.TemplateExpression) {
+        const head = initializer.getHead().getLiteralText();
+        const spans = initializer.getTemplateSpans().map((span) => `\${${span.getExpression().getText()}}${span.getLiteral().getLiteralText()}`);
+        return head + spans.join("");
+    }
+    return null; // object, function, computed — can't resolve
+}
+/*
+Resolves a variable name to its string value.
+Strategy:
+  1. Look in the same file
+  2. Walk named imports → find the source file → look there
+  Files not yet in the project are added lazily so we don't pre-load everything.
+ */
+function resolveUrlVariable(varName, sourceFile, project) {
+    //case 1 -> Variable exists in same file
+    const localDecl = sourceFile.getVariableDeclaration(varName);
+    if (localDecl) {
+        const init = localDecl.getInitializer();
+        if (init)
+            return resolveVariableValue(init);
+    }
+    //case 2 -> named imports
+    for (const importDecl of sourceFile.getImportDeclarations()) {
+        const match = importDecl.getNamedImports().find(n => n.getName() === varName);
+        if (!match)
+            continue;
+        // Try to get the source file — it may not be in the project yet
+        let importedFile = importDecl.getModuleSpecifierSourceFile();
+        if (!importedFile) {
+            // Lazily add the file to the project
+            const specifier = importDecl.getModuleSpecifierValue();
+            const currentDir = path.dirname(sourceFile.getFilePath());
+            const base = path.resolve(currentDir, specifier);
+            for (const ext of [".ts", ".tsx", ".js", ".jsx"]) {
+                try {
+                    importedFile = project.addSourceFileAtPath(base + ext);
+                    break;
+                }
+                catch {
+                    continue;
+                }
+            }
+        }
+        if (!importedFile)
+            continue;
+        const importedDecl = importedFile.getVariableDeclaration(varName);
+        if (importedDecl) {
+            const init = importedDecl.getInitializer();
+            if (init)
+                return resolveVariableValue(init);
+        }
+    }
+    return null;
+}
+//  URL Normalization 
+// Converts a raw URL string from the call site into a normalized form
+// that can be compared against route index entries.
+// Examples:
+//   `/api/users/${id}`        → /api/users/:dynamic
+//   `/api/users/${org}/${id}` → /api/users/:dynamic/:dynamic
+//   /api/users?foo=bar        → /api/users
+//   /api/users/               → /api/users
+function normalizeUrl(rawUrl) {
+    // Skip external URLs
+    if (rawUrl.startsWith("http://") || rawUrl.startsWith("https://"))
+        return null;
+    // Must start with /
+    if (!rawUrl.startsWith("/"))
+        return null;
+    return rawUrl
+        .split("?")[0] // strip query string
+        .replace(/\$\{[^}]+\}/g, ":dynamic") // ${anything} → :dynamic
+        .replace(/\/+$/, "") // strip trailing slash
+        || "/"; // fallback to root if empty
+}
+//  Route Matching 
+// Matches a normalized URL + HTTP method against the route index.
+// Rules:
+//   1. Static routes (isDynamic=false) are matched first using === equality
+//   2. Dynamic routes are only tried if no static match found
+//   3. UNKNOWN method (useSWRMutation etc.) tries all entries across all methods
+function matchRouteEntries(normalizedUrl, method, routeIndex) {
+    // Gather candidate entries for this method
+    const candidates = method === "UNKNOWN" ? [...routeIndex.values()].flat() : routeIndex.get(method) ?? [];
+    if (candidates.length === 0)
+        return [];
+    //  Pass 1: static exact match
+    const staticMatches = candidates.filter(e => !e.isDynamic && e.urlPath === normalizedUrl);
+    if (staticMatches.length > 0)
+        return staticMatches;
+    //  Pass 2: dynamic regex match
+    // normalizeUrl has already turned every interpolated segment into the
+    // literal token ":dynamic", which the route regex's [^/]+ (or .+ for
+    // catch-alls) matches directly — so testing the normalized URL is enough.
+    // e.g. "/api/users/:dynamic" matches the regex for route "/api/users/:id".
+    return candidates.filter(e => e.isDynamic && e.urlRegex.test(normalizedUrl));
+}
+//  URL Argument Extraction 
+// Shared helper — reconstructs a template literal preserving ${...} as-is
+// so normalizeUrl can replace them with :dynamic later.
+// Same logic as resolveVariableValue's TemplateExpression branch.
+function reconstructTemplate(templateExpr) {
+    const head = templateExpr.getHead().getLiteralText();
+    const spans = templateExpr.getTemplateSpans().map((span) => `\${${span.getExpression().getText()}}${span.getLiteral().getLiteralText()}`);
+    return head + spans.join("");
+}
+// Extracts a URL string from a call argument.
+// Handles 4 cases:
+//   '/api/users'          → string literal      → return directly
+//   `/api/users`          → no-sub template     → return directly
+//   `/api/users/${id}`    → template expression → preserve ${...}
+//   API_URL               → identifier          → resolve via resolveUrlVariable
+// Returns null if the arg is an object / array / expression we can't resolve.
+function extractUrlFromArg(arg, sourceFile, project) {
+    const kind = arg.getKind();
+    if (kind === SyntaxKind.StringLiteral ||
+        kind === SyntaxKind.NoSubstitutionTemplateLiteral) {
+        const url = arg.getLiteralText();
+        return { rawUrl: url, resolvedUrl: url };
+    }
+    if (kind === SyntaxKind.TemplateExpression) {
+        const url = reconstructTemplate(arg);
+        return { rawUrl: url, resolvedUrl: url };
+    }
+    if (kind === SyntaxKind.Identifier) {
+        const varName = arg.getText();
+        const resolved = resolveUrlVariable(varName, sourceFile, project);
+        if (!resolved)
+            return null;
+        return { rawUrl: varName, resolvedUrl: resolved };
+    }
+    return null;
+}
+// Scans EVERY call expression in a source file exactly once.
+// For each call matching CALLER_CONFIG:
+//   - infers the HTTP method
+//   - extracts and resolves the URL argument
+// It additionally scans for backend routes used as a resource URL:
+//   - JSX src/href attributes — tag-agnostic, so it covers native elements
+//     (<video src="/api/..">, <iframe src={url}>, <a href={`/api/${id}`}>)
+//     AND third-party player components (<HlsPlayer src={url} />,
+//     <ReactHlsPlayer src={...} />).
+//   - object-literal src/href properties — config-object style usage where a
+//     route is handed to a third-party player/function, e.g.
+//     loadPlayer({ src: '/api/stream' }).
+// The browser issues a GET for any such resource, so these are emitted as GET.
+// The expensive AST traversal happens once per file here; callers then
+// attribute the resulting calls to nodes by line range (see detectNextjsApiCallEdges).
+// Note: useQuery/useMutation inner fetch/axios calls are captured naturally
+// since they are also CallExpressions in the file.
+function extractApiCallsFromFile(sourceFile, project) {
+    const results = [];
+    for (const call of sourceFile.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+        const callerType = call.getExpression().getText();
+        const config = CALLER_CONFIG[callerType];
+        if (!config)
+            continue;
+        const args = call.getArguments();
+        if (args.length === 0)
+            continue;
+        //  Infer HTTP method + extract URL
+        let method;
+        let urlResult;
+        if (callerType === "axios" &&
+            args[0].getKind() === SyntaxKind.ObjectLiteralExpression) {
+            // axios({ url, method }) — both url and method live in the config object.
+            // axios defaults to GET when no method is given.
+            const cfg = args[0];
+            const urlInit = cfg.getProperty("url")?.getInitializer?.();
+            urlResult = urlInit ? extractUrlFromArg(urlInit, sourceFile, project) : null;
+            method = "GET";
+            const methodInit = cfg.getProperty("method")?.getInitializer?.();
+            if (methodInit && methodInit.getKind() === SyntaxKind.StringLiteral) {
+                method = methodInit.getLiteralText().toUpperCase();
+            }
+        }
+        else if (config.inferMethod === "fixed") {
+            method = config.method;
+            urlResult = extractUrlFromArg(args[0], sourceFile, project);
+        }
+        else {
+            method = config.defaultMethod;
+            // fetch('/api', { method: 'POST' }) / axios('/api', { method }) — check 2nd arg
+            if (args.length >= 2) {
+                const optsArg = args[1];
+                if (optsArg.getKind() === SyntaxKind.ObjectLiteralExpression) {
+                    const methodProp = optsArg.getProperty("method");
+                    if (methodProp) {
+                        const init = methodProp.getInitializer?.();
+                        if (init && init.getKind() === SyntaxKind.StringLiteral) {
+                            method = init.getLiteralText().toUpperCase();
+                        }
+                    }
+                }
+            }
+            urlResult = extractUrlFromArg(args[0], sourceFile, project);
+        }
+        if (!urlResult)
+            continue;
+        results.push({
+            startLine: call.getStartLineNumber(),
+            call: {
+                callerType,
+                rawUrl: urlResult.rawUrl,
+                resolvedUrl: urlResult.resolvedUrl,
+                method,
+            },
+        });
+    }
+    // JSX src/href attributes — tag-agnostic, so native elements (video, iframe,
+    // a) and third-party player components (HlsPlayer, ReactHlsPlayer, …) are all
+    // covered. The browser fetches the resource with GET.
+    for (const attr of sourceFile.getDescendantsOfKind(SyntaxKind.JsxAttribute)) {
+        const attrName = attr.getNameNode().getText();
+        if (attrName !== "src" && attrName !== "href")
+            continue;
+        const initializer = attr.getInitializer();
+        if (!initializer)
+            continue;
+        // value is either a bare string (src="/api/x") or a JSX expression
+        // container (src={url} / src={`/api/${id}`})
+        let valueNode;
+        const initKind = initializer.getKind();
+        if (initKind === SyntaxKind.StringLiteral) {
+            valueNode = initializer;
+        }
+        else if (initKind === SyntaxKind.JsxExpression) {
+            valueNode = initializer.getExpression();
+        }
+        if (!valueNode)
+            continue;
+        const urlResult = extractUrlFromArg(valueNode, sourceFile, project);
+        if (!urlResult)
+            continue;
+        results.push({
+            startLine: attr.getStartLineNumber(),
+            call: {
+                callerType: `jsx-${attrName}`,
+                rawUrl: urlResult.rawUrl,
+                resolvedUrl: urlResult.resolvedUrl,
+                method: "GET",
+            },
+        });
+    }
+    // Object-literal src/href properties — config-object style usage where a
+    // backend route is passed to a third-party player/function, e.g.
+    // loadPlayer({ src: '/api/stream' }). Same GET semantics.
+    for (const prop of sourceFile.getDescendantsOfKind(SyntaxKind.PropertyAssignment)) {
+        const name = prop.getName();
+        if (name !== "src" && name !== "href")
+            continue;
+        const init = prop.getInitializer();
+        if (!init)
+            continue;
+        const urlResult = extractUrlFromArg(init, sourceFile, project);
+        if (!urlResult)
+            continue;
+        results.push({
+            startLine: prop.getStartLineNumber(),
+            call: {
+                callerType: `prop-${name}`,
+                rawUrl: urlResult.rawUrl,
+                resolvedUrl: urlResult.resolvedUrl,
+                method: "GET",
+            },
+        });
+    }
+    return results;
+}
+//MAIN FUNCTION 
+export function detectNextjsApiCallEdges(nodes, repoPath) {
+    const edges = [];
+    const dedupSet = new Set();
+    // Build route index — bail early if no Next.js API routes exist in this repo
+    const routeIndex = buildRouteIndex(nodes);
+    if (routeIndex.size === 0)
+        return [];
+    // One shared project instance — source files are added lazily per node
+    // so we never load the entire repo into ts-morph upfront
+    const project = new Project({
+        compilerOptions: {
+            allowJs: true,
+            checkJs: false,
+            strict: false,
+        },
+        skipAddingFilesFromTsConfig: true,
+    });
+    // Only scan nodes that:
+    //   - are not ROUTE or THIRD_PARTY nodes themselves
+    //   - have rawCode (we need the AST, not just metadata)
+    const candidateNodes = nodes.filter(n => n.type !== "ROUTE" &&
+        n.type !== "THIRD_PARTY" &&
+        typeof n.rawCode === "string" &&
+        n.rawCode.length > 0);
+    // Group candidate nodes by absolute file path so each file is parsed and
+    // its AST traversed exactly once — previously every node re-scanned the
+    // entire file's call expressions (O(calls × nodes per file)).
+    const nodesByFile = new Map();
+    for (const node of candidateNodes) {
+        const absolutePath = path.resolve(repoPath, node.filePath);
+        if (!nodesByFile.has(absolutePath))
+            nodesByFile.set(absolutePath, []);
+        nodesByFile.get(absolutePath).push(node);
+    }
+    for (const [absolutePath, fileNodes] of nodesByFile) {
+        // Reuse already-loaded file if present, otherwise add it lazily
+        let sourceFile = project.getSourceFile(absolutePath);
+        if (!sourceFile) {
+            try {
+                sourceFile = project.addSourceFileAtPath(absolutePath);
+            }
+            catch {
+                continue; // file missing, non-parseable — skip silently
+            }
+        }
+        // Scan the whole file's API calls once, then attribute by line range.
+        const locatedCalls = extractApiCallsFromFile(sourceFile, project);
+        if (locatedCalls.length === 0)
+            continue;
+        for (const located of locatedCalls) {
+            // Attribute each call to the single innermost node whose line range
+            // contains it. Nodes can nest (e.g. a component and an inner function
+            // both span the call); without picking the smallest containing range a
+            // call would be counted once per containing node, producing duplicate
+            // edges with different `from` nodes.
+            let owner = null;
+            for (const node of fileNodes) {
+                if (located.startLine < node.startLine || located.startLine > node.endLine)
+                    continue;
+                if (owner === null || (node.endLine - node.startLine) < (owner.endLine - owner.startLine)) {
+                    owner = node;
+                }
+            }
+            if (owner === null)
+                continue;
+            const call = located.call;
+            const normalizedUrl = normalizeUrl(call.resolvedUrl);
+            if (!normalizedUrl)
+                continue;
+            const matches = matchRouteEntries(normalizedUrl, call.method, routeIndex);
+            if (matches.length === 0)
+                continue;
+            for (const match of matches) {
+                // One edge per unique (caller node, route node, method) combination
+                const dedupKey = `${owner.id}→${match.routeNode.id}:${call.method}`;
+                if (dedupSet.has(dedupKey))
+                    continue;
+                dedupSet.add(dedupKey);
+                edges.push({
+                    from: owner.id,
+                    to: match.routeNode.id,
+                    type: "NEXTJS_API_CALL",
+                    metadata: {
+                        url: call.resolvedUrl,
+                        rawUrl: call.rawUrl,
+                        method: call.method,
+                        callerType: call.callerType,
+                        matchType: match.isDynamic ? "dynamic" : "exact",
+                    },
+                });
+            }
+        }
+    }
+    return edges;
+}

package/dist/graph/index.js

@@ -1,4 +1,5 @@
 import { buildLookupMaps } from "./buildLookup.js";
+import { detectNextjsApiCallEdges } from "./edges/apiFetchEdges.js";
 import { detectCallEdges } from "./edges/callEdges.js";
 import { detectEventEdges } from "./edges/eventEdges.js";
 import { detectGuardEdges } from "./edges/guardEdges.js";
@@ -27,6 +28,7 @@ export function detectEdges(nodes, routeNodes, repoPath, fingerprint) {
     // GUARDS — middleware to route protection
     const guardEdges = detectGuardEdges(nodes, lookupMp, routeNodes, repoPath, fingerprint);
     const testEdges = detectTestEdges(lookupMp, repoPath); // This does not needs nodes, as it detect edges from the file
+    const nextjsApiCallEdges = detectNextjsApiCallEdges(nodes, repoPath);
     // Collect all dynamically-created third-party method nodes (dedup by id)
     const newThirdPartyNodesMap = new Map();
     for (const n of [...importResult.thirdPartyMethodNodes, ...callResult.newThirdPartyNodes]) {
@@ -46,6 +48,7 @@ export function detectEdges(nodes, routeNodes, repoPath, fingerprint) {
     console.log(`  TEST edges: ${testEdges.length}`);
     console.log(`  Ghost nodes created: ${eventResults.ghostNodes.length}`);
     console.log(`  Third-party method nodes: ${newThirdPartyNodes.length}`);
+    console.log(` NEXTJS_API_CALL edges: ${nextjsApiCallEdges.length}`);
     const allEdges = [
         ...callEdges,
         ...importEdges,
@@ -56,6 +59,7 @@ export function detectEdges(nodes, routeNodes, repoPath, fingerprint) {
         ...routeEdges,
         ...guardEdges,
         ...testEdges,
+        ...nextjsApiCallEdges,
     ];
     console.log(`Total edges detected: ${allEdges.length}`);
     return {

package/dist/parser/extractors/functions.d.ts

@@ -1,4 +1,9 @@
 import { SourceFile } from "ts-morph";
 import type { CodeNode } from "../../types.js";
 import { type RenderingBoundary } from "../directives.js";
+export declare function extractFunctionCalls(node: any): string[];
+export declare function extractHookCalls(node: any): string[];
+export declare function extractApiCalls(node: any): string[];
+export declare function hasErrorHandling(node: any): boolean;
+export declare function extractThrowStatements(node: any): boolean;
 export declare function extractFunctions(file: SourceFile, fileDirective?: RenderingBoundary): CodeNode[];

package/dist/parser/extractors/functions.js

@@ -7,7 +7,7 @@ const HTTP_METHOD_EXPORTS = new Set(["GET", "POST", "PUT", "DELETE", "PATCH", "H
 function makeId(filePath, name) {
     return `${filePath}::${name}`;
 }
-function extractFunctionCalls(node) {
+export function extractFunctionCalls(node) {
     const calls = node.getDescendantsOfKind(SyntaxKind.CallExpression);
     const names = [];
     for (const call of calls) {
@@ -22,7 +22,7 @@ function extractFunctionCalls(node) {
     }
     return [...new Set(names)];
 }
-function extractHookCalls(node) {
+export function extractHookCalls(node) {
     const calls = node.getDescendantsOfKind(SyntaxKind.CallExpression);
     const hooks = [];
     for (const call of calls) {
@@ -34,7 +34,7 @@ function extractHookCalls(node) {
     }
     return [...new Set(hooks)];
 }
-function extractApiCalls(node) {
+export function extractApiCalls(node) {
     const calls = node.getDescendantsOfKind(SyntaxKind.CallExpression);
     const apiCalls = [];
     for (const call of calls) {
@@ -75,11 +75,11 @@ function extractApiCalls(node) {
     }
     return [...new Set(apiCalls)];
 }
-function hasErrorHandling(node) {
+export function hasErrorHandling(node) {
     const tryCatch = node.getDescendantsOfKind(SyntaxKind.TryStatement);
     return tryCatch.length > 0;
 }
-function extractThrowStatements(node) {
+export function extractThrowStatements(node) {
     const throws = node.getDescendantsOfKind(SyntaxKind.ThrowStatement);
     return throws.length > 0;
 }

package/dist/parser/extractors/objectMethods.d.ts

@@ -0,0 +1,4 @@
+import { SourceFile } from "ts-morph";
+import type { CodeNode } from "../../types.js";
+import { type RenderingBoundary } from "../directives.js";
+export declare function extractObjectMethods(file: SourceFile, fileDirective?: RenderingBoundary): CodeNode[];

package/dist/parser/extractors/objectMethods.js

@@ -0,0 +1,141 @@
+import { SyntaxKind } from "ts-morph";
+import { detectFunctionDirective } from "../directives.js";
+import { extractFunctionCalls, extractHookCalls, extractApiCalls, hasErrorHandling, extractThrowStatements, } from "./functions.js";
+import { extractParams, extractReturnTypeAnnotation, extractBareTypeNames, extractReferencedInterfaces, } from "../typeUtils.js";
+// Extracts function-valued properties of object literals as FUNCTION nodes.
+//
+// Many React/Next.js modules keep their logic inside an exported object literal
+// (provider adapters, route tables, command maps, strategy/config objects). The
+// other extractors (declarations, var-assigned arrows, components, hooks) never
+// descend into object literals, so those functions had no node to anchor edges
+// to — every CALLS / NEXTJS_API_CALL / READS_FROM edge silently dropped.
+//
+// The node `name` encodes the dotted access path (e.g.
+// "providersConfig.zoro.streamingData"). index.ts builds the id as
+// `${relativePath}::${name}`, so this yields the desired node identity for free.
+function makeId(filePath, name) {
+    return `${filePath}::${name}`;
+}
+// Unwraps `as const` / `as Foo` and parenthesized expressions, returning the
+// underlying ObjectLiteralExpression node, or null if it isn't one.
+function asObjectLiteral(node) {
+    let n = node;
+    while (n &&
+        (n.getKind() === SyntaxKind.AsExpression ||
+            n.getKind() === SyntaxKind.ParenthesizedExpression)) {
+        n = n.getExpression?.();
+    }
+    return n && n.getKind() === SyntaxKind.ObjectLiteralExpression ? n : null;
+}
+// True for `async (...) => {}`, `async function () {}`, `async key() {}`.
+function isAsyncFn(fnNode) {
+    if (typeof fnNode.isAsync === "function")
+        return fnNode.isAsync();
+    return fnNode.getText().trimStart().startsWith("async");
+}
+// Builds a FUNCTION node from a function-like node + the span node that should
+// own its line range / rawCode. The metadata shape mirrors functions.ts exactly
+// so callEdges / apiFetchEdges treat these like any other FUNCTION node.
+//   fnNode  — ArrowFunction | FunctionExpression | MethodDeclaration (params/body)
+//   spanNode— the PropertyAssignment (`key: fn`) or the MethodDeclaration itself,
+//             so the inner call's line falls inside [startLine, endLine].
+function buildNode(file, dottedName, fnNode, spanNode, fileDirective) {
+    const filePath = file.getFilePath();
+    const typedParams = extractParams(fnNode);
+    const calls = extractFunctionCalls(fnNode);
+    const hookCalls = extractHookCalls(fnNode);
+    const apiCalls = extractApiCalls(fnNode);
+    const isAsync = isAsyncFn(fnNode);
+    const hasErrors = hasErrorHandling(fnNode);
+    const throws = extractThrowStatements(fnNode);
+    const renderingBoundary = detectFunctionDirective(fnNode.getBody?.()) ?? fileDirective;
+    const returnType = extractReturnTypeAnnotation(fnNode);
+    const bareTypeNames = extractBareTypeNames([...typedParams.map((p) => p.type), returnType]);
+    const referencedTypes = extractReferencedInterfaces(file, bareTypeNames);
+    return {
+        id: makeId(filePath, dottedName),
+        name: dottedName,
+        type: "FUNCTION",
+        filePath,
+        startLine: spanNode.getStartLineNumber(),
+        endLine: spanNode.getEndLineNumber(),
+        rawCode: spanNode.getText(),
+        metadata: {
+            params: typedParams.map((p) => p.name),
+            parameters: typedParams,
+            returnType,
+            referencedTypes,
+            calls,
+            hookCalls,
+            apiCalls,
+            isAsync,
+            hasErrorHandling: hasErrors,
+            throws,
+            lineCount: spanNode.getEndLineNumber() - spanNode.getStartLineNumber(),
+            isHttpHandler: false,
+            httpMethod: undefined,
+            ...(renderingBoundary !== null && { renderingBoundary }),
+        },
+    };
+}
+// Recursively walks an object literal, emitting a node per function-valued
+// property and descending into nested object literals to arbitrary depth.
+function walkObject(file, objLiteral, prefix, fileDirective, out) {
+    // getProperties() returns a union (PropertyAssignment | ShorthandPropertyAssignment
+    // | SpreadAssignment | MethodDeclaration | Get/SetAccessor) — guard every getter.
+    for (const prop of objLiteral.getProperties()) {
+        const kind = prop.getKind();
+        // Shorthand method:  streamingData(args) { ... }  (incl. async)
+        if (kind === SyntaxKind.MethodDeclaration) {
+            const name = prop.getName?.();
+            if (!name)
+                continue;
+            out.push(buildNode(file, `${prefix}.${name}`, prop, prop, fileDirective));
+            continue;
+        }
+        // Everything else we handle needs a name + initializer.
+        if (kind !== SyntaxKind.PropertyAssignment)
+            continue; // skip spread/shorthand/get/set
+        const name = prop.getName?.();
+        const init = prop.getInitializer?.();
+        if (!name || !init)
+            continue;
+        const ik = init.getKind();
+        if (ik === SyntaxKind.ArrowFunction || ik === SyntaxKind.FunctionExpression) {
+            // span = the PropertyAssignment so the range wraps `key: <fn>`.
+            out.push(buildNode(file, `${prefix}.${name}`, init, prop, fileDirective));
+            continue;
+        }
+        // Nested object → recurse (unwrap `as const` / parens).
+        const nested = asObjectLiteral(init);
+        if (nested) {
+            walkObject(file, nested, `${prefix}.${name}`, fileDirective, out);
+        }
+    }
+}
+export function extractObjectMethods(file, fileDirective = null) {
+    const out = [];
+    // Roots: named object literals — `const x = { ... }` (incl. `as const`).
+    for (const variable of file.getVariableDeclarations()) {
+        const init = variable.getInitializer();
+        if (!init)
+            continue;
+        const obj = asObjectLiteral(init);
+        if (!obj)
+            continue;
+        walkObject(file, obj, variable.getName(), fileDirective, out);
+    }
+    // Root: `export default { ... }` — fall back to the "default" prefix.
+    for (const assign of file.getExportAssignments()) {
+        if (assign.isExportEquals?.())
+            continue; // skip `export = ...`
+        const expr = assign.getExpression?.();
+        if (!expr)
+            continue;
+        const obj = asObjectLiteral(expr);
+        if (!obj)
+            continue;
+        walkObject(file, obj, "default", fileDirective, out);
+    }
+    return out;
+}

package/dist/parser/index.js

@@ -5,6 +5,7 @@ import { extractComponents } from "./extractors/components.js";
 import { extractHooks } from "./extractors/hooks.js";
 import { extractFunctions } from "./extractors/functions.js";
 import { extractStores } from "./extractors/stores.js";
+import { extractObjectMethods } from "./extractors/objectMethods.js";
 import { detectFileDirective } from "./directives.js";
 import { createHash } from "crypto";
 // Directories to skip entirely while walking
@@ -107,7 +108,8 @@ export function parseRepo(repoPath) {
             const hooks = extractHooks(file, fileDirective);
             const functions = extractFunctions(file, fileDirective);
             const stores = extractStores(file);
-            const extracted = [...components, ...hooks, ...functions, ...stores];
+            const objectMethods = extractObjectMethods(file, fileDirective);
+            const extracted = [...components, ...hooks, ...functions, ...stores, ...objectMethods];
             for (const node of extracted) {
                 // Normalize all extracted nodes to relative paths so every node in the
                 // graph uses the same coordinate system as the FILE nodes.

package/dist/parser/index.test.js

@@ -316,4 +316,134 @@ describe("parseRepo", () => {
         expect(configNode).toBeUndefined();
         deleteFakeRepo(repoPath);
     });
+    // ─── Object-literal Method Extraction ──────────────────────────────────────
+    it("should detect an arrow-function value in an object literal", () => {
+        const repoPath = createFakeRepo({
+            "src/cfg.ts": `
+        export const cfg = {
+          load: () => doThing(),
+        };
+      `,
+        });
+        const result = parseRepo(repoPath);
+        const fn = result.nodes.find((n) => n.name === "cfg.load");
+        expect(fn).toBeDefined();
+        expect(fn?.type).toBe("FUNCTION");
+        expect(fn?.startLine).toBeGreaterThanOrEqual(1);
+        expect(fn?.endLine).toBeGreaterThanOrEqual(fn.startLine);
+        expect(fn?.metadata.calls).toContain("doThing");
+        deleteFakeRepo(repoPath);
+    });
+    it("should detect an async arrow value calling axios (nested object)", () => {
+        const repoPath = createFakeRepo({
+            "src/providersConfig.js": `
+        export const providersConfig = {
+          zoro: {
+            streamingData: async (episodeId) => {
+              const response = await axios.get('/api/v2/zoro/watch/' + episodeId);
+              return response.data;
+            },
+          },
+        };
+      `,
+        });
+        const result = parseRepo(repoPath);
+        const fn = result.nodes.find((n) => n.name === "providersConfig.zoro.streamingData");
+        expect(fn).toBeDefined();
+        expect(fn?.type).toBe("FUNCTION");
+        expect(fn?.metadata.isAsync).toBe(true);
+        expect((fn?.metadata.apiCalls).length).toBeGreaterThan(0);
+        deleteFakeRepo(repoPath);
+    });
+    it("should detect a function-expression value in an object literal", () => {
+        const repoPath = createFakeRepo({
+            "src/cfg.ts": `
+        export const cfg = {
+          run: function (x) { return helper(x); },
+        };
+      `,
+        });
+        const result = parseRepo(repoPath);
+        const fn = result.nodes.find((n) => n.name === "cfg.run");
+        expect(fn).toBeDefined();
+        expect(fn?.type).toBe("FUNCTION");
+        expect(fn?.metadata.params).toContain("x");
+        deleteFakeRepo(repoPath);
+    });
+    it("should detect a shorthand method in an object literal", () => {
+        const repoPath = createFakeRepo({
+            "src/cfg.ts": `
+        export const cfg = {
+          fetchData(url) { return fetch(url); },
+        };
+      `,
+        });
+        const result = parseRepo(repoPath);
+        const fn = result.nodes.find((n) => n.name === "cfg.fetchData");
+        expect(fn).toBeDefined();
+        expect(fn?.type).toBe("FUNCTION");
+        deleteFakeRepo(repoPath);
+    });
+    it("should detect a concise-body arrow value in an object literal", () => {
+        const repoPath = createFakeRepo({
+            "src/cfg.ts": `
+        export const cfg = {
+          pick: (u) => u.id,
+        };
+      `,
+        });
+        const result = parseRepo(repoPath);
+        const fn = result.nodes.find((n) => n.name === "cfg.pick");
+        expect(fn).toBeDefined();
+        expect(fn?.type).toBe("FUNCTION");
+        deleteFakeRepo(repoPath);
+    });
+    it("should detect a function in a two-level nested object", () => {
+        const repoPath = createFakeRepo({
+            "src/api.ts": `
+        export const api = {
+          v2: {
+            users: {
+              list: async () => fetch('/api/users'),
+            },
+          },
+        };
+      `,
+        });
+        const result = parseRepo(repoPath);
+        const fn = result.nodes.find((n) => n.name === "api.v2.users.list");
+        expect(fn).toBeDefined();
+        expect(fn?.type).toBe("FUNCTION");
+        deleteFakeRepo(repoPath);
+    });
+    it("should detect a function in an export-default object", () => {
+        const repoPath = createFakeRepo({
+            "src/handler.ts": `
+        export default {
+          handler: async () => fetch('/api/x'),
+        };
+      `,
+        });
+        const result = parseRepo(repoPath);
+        const fn = result.nodes.find((n) => n.name === "default.handler");
+        expect(fn).toBeDefined();
+        expect(fn?.type).toBe("FUNCTION");
+        deleteFakeRepo(repoPath);
+    });
+    it("should not double-extract or collide with top-level hooks", () => {
+        const repoPath = createFakeRepo({
+            "src/mix.ts": `
+        export const useThing = () => { return 1; };
+        export const cfg = {
+          a: () => doA(),
+        };
+      `,
+        });
+        const result = parseRepo(repoPath);
+        const objMethods = result.nodes.filter((n) => n.name === "cfg.a");
+        expect(objMethods.length).toBe(1);
+        const hook = result.nodes.find((n) => n.name === "useThing");
+        expect(hook?.type).toBe("HOOK");
+        deleteFakeRepo(repoPath);
+    });
 });

package/dist/pipeline/index.js

@@ -7,7 +7,7 @@ import { parseRepo } from "../parser/index.js";
 import { detectEdges } from "../graph/index.js";
 import { buildThirdPartyNodes } from "../graph/thirdPartyLibs.js";
 import { scoreAndFilter } from "../scoring/index.js";
-// ─── Helpers ──────────────────────────────────────────────────────────────────
+//  Helpers 
 // Deterministic graphId — same repo always produces same id
 // This ensures multiple analyses of the same repo go into the same folder
 function generateGraphId(repoPath, isGithubRepo) {
@@ -162,7 +162,7 @@ function routesToCodeNodes(routes, repoPath) {
     }
     return nodes;
 }
-// ─── analyzePipeline ──────────────────────────────────────────────────────────
+//  analyzePipeline 
 export async function analyzePipeline(repoPath, isGithubRepo, options) {
     const absoluteRepoPath = path.resolve(repoPath);
     const graphId = generateGraphId(repoPath, isGithubRepo); // stable, deterministic ID based on repo path
@@ -172,11 +172,11 @@ export async function analyzePipeline(repoPath, isGithubRepo, options) {
     console.log(`   Graph ID:   ${graphId}`);
     console.log(`   Commit:     ${gitInfo.commitHash} (${gitInfo.branch})`);
     console.log(`   Message:    ${gitInfo.message}`);
-    // ── Step 1: Fingerprint ───────────────────────────────────────
+    //  Step 1: Fingerprint 
     console.log("\n[1/5] Fingerprinting project...");
     const fingerprint = analyzeFingerprint(absoluteRepoPath);
     console.log(`  Framework: ${fingerprint.framework}  |  Language: ${fingerprint.language}  |  Type: ${fingerprint.projectType}`);
-    // ── Step 2: Filesystem / routes ───────────────────────────────
+    //  Step 2: Filesystem / routes 
     console.log("\n[2/5] Analyzing filesystem routes...");
     const routes = analyzeFilesystem(absoluteRepoPath, fingerprint);
     console.log(`  Routes found: ${routes.length}`);
@@ -184,21 +184,20 @@ export async function analyzePipeline(repoPath, isGithubRepo, options) {
     // It is important to add here before the detection of the edges
     let routeNodes = routesToCodeNodes(routes, absoluteRepoPath);
     console.log(`  Route nodes created: ${routeNodes.length}`);
-    // ── Step 3: Parse source files into nodes ─────────────────────
+    //  Step 3: Parse source files into nodes 
     console.log("\n[3/5] Parsing source files...");
     const parserResult = parseRepo(absoluteRepoPath);
     console.log(`  Files: ${parserResult.stats.totalFiles}  |  Nodes: ${parserResult.stats.totalNodes}  |  Skipped: ${parserResult.stats.skippedFiles}`);
-    // ── Step 3.5: Build third-party nodes ────────────────────────
+    //  Step 3.5: Build third-party nodes 
     const thirdPartyNodes = options?.includedThirdPartyLibs?.length
         ? buildThirdPartyNodes(absoluteRepoPath, options.includedThirdPartyLibs)
         : [];
     if (thirdPartyNodes.length) {
         console.log(`  Third-party nodes: ${thirdPartyNodes.length}`);
     }
-    // ── Step 4: Detect edges ──────────────────────────────────────
+    //  Step 4: Detect edges 
     console.log("\n[4/5] Detecting edges...");
     const edgeResult = detectEdges([...parserResult.nodes, ...routeNodes, ...thirdPartyNodes], routes, absoluteRepoPath, fingerprint);
-    // filter API_ROUTE nodes without handlers - because at the time of converting routes to code nodes, POST and GET both possibilties are taken for the API_ROUTE nodes, however it is possible that only one of them is being used for that route. Meaning only one handler and for the second method undefined handler.
     routeNodes = routeNodes.filter(routeNode => {
         if (routeNode.metadata.routeNodeType === "API_ROUTE") {
             const hasHandler = edgeResult.edges.some(edge => edge.type === "HANDLES" && edge.from === routeNode.id);
@@ -208,7 +207,7 @@ export async function analyzePipeline(repoPath, isGithubRepo, options) {
     });
     const allNodes = [...parserResult.nodes, ...routeNodes, ...thirdPartyNodes, ...edgeResult.ghostNodes];
     const allEdges = edgeResult.edges;
-    // ── Step 5: Score and filter ──────────────────────────────────
+    //  Step 5: Score and filter 
     console.log("\n[5/5] Scoring and filtering...");
     const scoringResult = scoreAndFilter(allNodes, allEdges, options?.thresholds);
     const nodeScores = mapToRecord(scoringResult.nodeScores);
@@ -236,7 +235,7 @@ export async function analyzePipeline(repoPath, isGithubRepo, options) {
         gitInfo,
     };
 }
-// ─── refilterPipeline ─────────────────────────────────────────────────────────
+//  refilterPipeline 
 export function refilterPipeline(stored, thresholds) {
     const existingScores = new Map(Object.entries(stored.nodeScores));
     const scoringResult = scoreAndFilter(stored.allNodes, stored.allEdges, thresholds, existingScores);

package/dist/types.d.ts

@@ -69,7 +69,7 @@ export interface CodeNode {
     score?: Number;
     metadata: Record<string, unknown>;
 }
-export type EdgeType = "CALLS" | "IMPORTS" | "READS_FROM" | "WRITES_TO" | "PROP_PASS" | "EMITS" | "LISTENS" | "WRAPPED_BY" | "GUARDS" | "HANDLES" | "TESTS" | "USES";
+export type EdgeType = "CALLS" | "IMPORTS" | "READS_FROM" | "WRITES_TO" | "PROP_PASS" | "EMITS" | "LISTENS" | "WRAPPED_BY" | "GUARDS" | "HANDLES" | "TESTS" | "USES" | "NEXTJS_API_CALL";
 export interface CodeEdge {
     from: string;
     to: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "devlensio",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "description": "Codebase intelligence engine for TypeScript/JavaScript/Reactjs/Nextjs repositories.",
   "type": "module",
   "main": "./dist/index.js",