ucn 4.2.2 → 5.0.1

package/core/entrypoints.js

@@ -16,7 +16,7 @@ const fs = require('fs');
 const { codeUnitCompare, NON_CALLABLE_TYPES } = require('./shared');
 const path = require('path');
 const { getCachedCalls } = require('./callers');
-const { getLanguageModule } = require('../languages');
+const { getLanguageAdapter } = require('../languages');
 
 // ============================================================================
 // FRAMEWORK PATTERNS
@@ -74,7 +74,10 @@ const FRAMEWORK_PATTERNS = [
     // Listed BEFORE fastapi: both frameworks share the @app.get/@app.post
     // shortcuts, and @app.route is Flask-only — a file using @app.route +
     // @app.post on the SAME app object got split across two frameworks
-    // (fix #245; first match wins in matchDecoratorOrModifier).
+    // (fix #245; first match wins in matchDecoratorOrModifier). When the
+    // decorator shape is shared, the file's own imports break the tie
+    // (importSignal): a fastapi-importing file's @app.get is fastapi, not
+    // flask — the label must agree with what `endpoints` reports.
     {
         id: 'flask-route',
         languages: new Set(['python']),
@@ -82,6 +85,7 @@ const FRAMEWORK_PATTERNS = [
         framework: 'flask',
         detection: 'decorator',
         pattern: /^(app|bp|blueprint)\.(route|get|post|put|delete|patch)/,
+        importSignal: /^flask\b/,
     },
 
     // FastAPI (Python) — decorators: @app.get('/path'), @router.post('/path')
@@ -92,6 +96,7 @@ const FRAMEWORK_PATTERNS = [
         framework: 'fastapi',
         detection: 'decorator',
         pattern: /^(app|router)\.(get|post|put|delete|patch|options|head)/,
+        importSignal: /^fastapi\b/,
     },
 
     // Django (Python) — decorators: @api_view, @action, @permission_classes
@@ -165,6 +170,34 @@ const FRAMEWORK_PATTERNS = [
         pattern: /^(get|post|put|delete|patch)$/,
     },
 
+    // ASP.NET Core controllers and Azure Functions.
+    {
+        id: 'aspnet-controller-route',
+        languages: new Set(['csharp']),
+        type: 'http',
+        framework: 'aspnet',
+        detection: 'decorator',
+        pattern: /^(ApiController|Route|Http(Get|Post|Put|Delete|Patch|Head|Options)|AcceptVerbs)$/,
+    },
+    {
+        id: 'azure-function',
+        languages: new Set(['csharp']),
+        type: 'http',
+        framework: 'azure-functions',
+        detection: 'decorator',
+        pattern: /^(FunctionName|Function|HttpTrigger)$/,
+    },
+    // ASP.NET minimal APIs: app.MapGet("/path", Handler).
+    {
+        id: 'aspnet-minimal-route',
+        languages: new Set(['csharp']),
+        type: 'http',
+        framework: 'aspnet-minimal',
+        detection: 'callPattern',
+        receiverPattern: /^(app|endpoints|routes)$/i,
+        methodPattern: /^Map(Get|Post|Put|Delete|Patch|Methods|Fallback)$/,
+    },
+
     // ── Dependency Injection ────────────────────────────────────────────
 
     // Spring DI (Java)
@@ -252,7 +285,11 @@ const FRAMEWORK_PATTERNS = [
         type: 'jobs',
         framework: 'celery',
         detection: 'decorator',
-        pattern: /^(app\.task|shared_task|celery\.task)/,
+        // Celery instances are conventionally named app, celery, tasks, or
+        // something project-specific. The import requirement prevents an
+        // arbitrary object's `.task` decorator from becoming a job root.
+        pattern: /^(?:[A-Za-z_]\w*\.)?task\b|^shared_task\b/,
+        requireImportSignal: /^celery\b/,
     },
 
     // ── Test Frameworks ─────────────────────────────────────────────────
@@ -267,6 +304,30 @@ const FRAMEWORK_PATTERNS = [
         pattern: /^pytest\.fixture/,
     },
 
+    // pytest/unittest test functions and plugin hooks — the same name
+    // convention the Python language module already uses for deadcode entry
+    // points (the entrypoints command must agree with it; Go's Test* pattern
+    // set the precedent).
+    {
+        id: 'pytest-test',
+        languages: new Set(['python']),
+        type: 'test',
+        framework: 'pytest',
+        detection: 'namePattern',
+        pattern: /^(test_|pytest_)/,
+    },
+
+    // C/C++ test conventions (Unity, CTest, GoogleTest wrappers) — mirrors
+    // the c-family language module's own entry-point rule.
+    {
+        id: 'c-family-test',
+        languages: new Set(['c', 'cpp']),
+        type: 'test',
+        framework: 'native-test',
+        detection: 'namePattern',
+        pattern: /^(test_|Test|TEST_)/,
+    },
+
     // ── Runtime ─────────────────────────────────────────────────────────
 
     // Tokio (Rust)
@@ -387,6 +448,34 @@ const FRAMEWORK_PATTERNS = [
         pattern: /^(test|tokio::test|cfg\(test\))$/,
     },
 
+    // ── C / C++ / C# runtime and test roots ─────────────────────────
+    {
+        id: 'c-family-main',
+        languages: new Set(['c', 'cpp']),
+        type: 'runtime',
+        framework: 'native',
+        detection: 'namePattern',
+        pattern: /^(main|WinMain|wWinMain|DllMain)$/,
+        symbolFilter: (s) => !s.className,
+    },
+    {
+        id: 'csharp-main',
+        languages: new Set(['csharp']),
+        type: 'runtime',
+        framework: 'dotnet',
+        detection: 'namePattern',
+        pattern: /^Main$/,
+        symbolFilter: (s) => s.modifiers?.includes('static'),
+    },
+    {
+        id: 'csharp-test',
+        languages: new Set(['csharp']),
+        type: 'test',
+        framework: 'dotnet-test',
+        detection: 'decorator',
+        pattern: /^(Fact|Theory|Test|TestMethod|TestCase|TestCaseSource|SetUp|OneTimeSetUp)$/,
+    },
+
     // ── Go Framework Patterns ─────────────────────────────────────────
 
     // Cobra CLI framework — RunE, Run, PreRunE etc. assigned to cobra.Command struct fields
@@ -420,7 +509,7 @@ const FRAMEWORK_PATTERNS = [
         detection: 'filePath',
         // Match files under bin/ (any depth), or top-level index/main/cli/server in any directory.
         // The matcher is run against the project-relative path with forward slashes.
-        pathPattern: /(^|\/)bin\/[^/]+\.(js|ts|mjs|cjs)$|(^|\/)(index|main|cli|server)\.(js|ts|mjs|cjs)$/,
+        pathPattern: /(^|\/)bin\/[^/]+\.(js|ts|mjs|cjs)$|(^|\/)(main|cli|server)\.(js|ts|mjs|cjs)$/,
     },
 
     // Node shebang entry: any file whose first bytes are `#!/usr/bin/env node`
@@ -470,31 +559,40 @@ const FRAMEWORK_PATTERNS = [
         pathPattern: /(^|\/)__main__\.py$/,
     },
 
-    // ── Catch-all fallbacks ─────────────────────────────────────────────
+    // Django management commands — discovered by module path
+    // (management/commands/<name>.py); the Command class and its handle()
+    // are invoked by `manage.py <name>` (the #253 external-contract family,
+    // now visible to the entrypoints command too).
+    {
+        id: 'django-command',
+        languages: new Set(['python']),
+        type: 'cli',
+        framework: 'django',
+        detection: 'filePath',
+        pathPattern: /(^|\/)management\/commands\/[^/]+\.py$/,
+    },
 
-    // Python: any decorator with '.' (attribute access) — framework registration heuristic
-    // Catches @app.route, @router.get, @celery.task, @something.hook, etc.
-    // Placed last so specific patterns match first (for better type/framework labeling).
+    // Explicit Python event/CLI decorators. Dotted syntax by itself is not
+    // registration evidence (`typing.overload`, `property.setter`, and
+    // `functools.wraps` are counterexamples).
     {
-        id: 'python-dotted-decorator',
+        id: 'flask-event-hook',
         languages: new Set(['python']),
         type: 'events',
-        framework: 'unknown',
+        framework: 'flask',
         detection: 'decorator',
-        pattern: /\./,
+        pattern: /^(app|bp|blueprint)\.(before_request|after_request|teardown_request|before_app_request|after_app_request|teardown_app_request|context_processor|url_value_preprocessor|url_defaults|errorhandler)/,
+        importSignal: /^flask\b/,
     },
-
-    // Java: any non-standard annotation (not a keyword modifier or standard JDK annotation)
-    // Catches @Bean, @Scheduled, @EventListener, @Transactional, etc.
-    // Placed last so specific patterns match first.
     {
-        id: 'java-custom-annotation',
-        languages: new Set(['java']),
-        type: 'di',
-        framework: 'unknown',
-        detection: 'modifier',
-        pattern: /^(?!public$|private$|protected$|static$|final$|abstract$|synchronized$|native$|default$|override$|deprecated$|suppresswarnings$|functionalinterface$|safevarargs$)/,
+        id: 'click-command',
+        languages: new Set(['python']),
+        type: 'cli',
+        framework: 'click',
+        detection: 'decorator',
+        pattern: /^(click\.)?(command|group)|^[A-Za-z_]\w*\.(command|group)$/,
     },
+
 ];
 
 // ============================================================================
@@ -507,25 +605,41 @@ const FRAMEWORK_PATTERNS = [
  * @param {string} language - File language
  * @returns {{ pattern: object, matchedOn: string }|null}
  */
-function matchDecoratorOrModifier(symbol, language) {
+function matchDecoratorOrModifier(symbol, language, fileEntry = null) {
     const decorators = symbol.decorators || [];
     const modifiers = symbol.modifiers || [];
+    const modules = (fileEntry?.imports || []).map(imp =>
+        typeof imp === 'string' ? imp : String(imp?.module || ''));
 
+    const matches = [];
     for (const fp of FRAMEWORK_PATTERNS) {
         if (!fp.languages.has(language)) continue;
+        if (fp.requireImportSignal &&
+            !modules.some(moduleName => fp.requireImportSignal.test(moduleName))) continue;
 
         if (fp.detection === 'decorator') {
             const matched = decorators.find(d => fp.pattern.test(d));
-            if (matched) return { pattern: fp, matchedOn: `@${matched}` };
+            if (matched) matches.push({ pattern: fp, matchedOn: `@${matched}` });
         }
 
         if (fp.detection === 'modifier') {
             const matched = modifiers.find(m => fp.pattern.test(m));
-            if (matched) return { pattern: fp, matchedOn: `@${matched}` };
+            if (matched) matches.push({ pattern: fp, matchedOn: `@${matched}` });
         }
     }
-
-    return null;
+    if (matches.length === 0) return null;
+
+    // Shared decorator shapes (@app.get is both flask and fastapi): the
+    // file's own imports break the tie. Without an import signal, declaration
+    // order keeps deciding (the #245 rule).
+    if (matches.length > 1 && fileEntry) {
+        // fileEntry.imports holds module strings; parser-level records hold
+        // { module } objects — accept both shapes.
+        const importBacked = matches.find(m => m.pattern.importSignal &&
+            modules.some(mod => m.pattern.importSignal.test(mod)));
+        if (importBacked) return importBacked;
+    }
+    return matches[0];
 }
 
 /**
@@ -560,7 +674,8 @@ function buildCallbackEntrypointMap(index) {
     // registration was never seeded. The registration site is kept as
     // evidence (registrationFile/registrationLine).
     const resolveHandlerDef = (name, registrationFile) => {
-        const defs = index.symbols.get(name);
+        const defs = (index.symbols.get(name) || []).filter(definition =>
+            !NON_CALLABLE_TYPES.has(definition.type));
         if (!defs || defs.length === 0) return null;
         // Prefer a def in the registration file; defs are canonical-sorted,
         // so falling back to the first is deterministic.
@@ -585,7 +700,8 @@ function buildCallbackEntrypointMap(index) {
                         pattern.methodPattern.test(call.name)) {
                         // BUG M2 (interpolated paths): align with bridge.js's
                         // extractServerRoutes — skip routes whose path is interpolated.
-                        if (pattern.type === 'http' && call.firstStringArg && call.firstStringArgInterp) continue;
+                        if (pattern.type === 'http' && call.name.toLowerCase() !== 'use' &&
+                            (!call.firstStringArg || call.firstStringArgInterp)) continue;
                         // BUG M5: Express dual-purpose APIs — 1-arg .get('env') is a
                         // config getter, not a route registration.
                         if (pattern.framework === 'express' &&
@@ -603,6 +719,9 @@ function buildCallbackEntrypointMap(index) {
                 // only visible as the enclosingFunction of the handler
                 // body's own calls (fix #247; the route vanished entirely).
                 const handledLines = new Set();
+                // Route lines that produced an actual entry (pass 2 or 2b) —
+                // the remainder are anonymous-handler routes for pass 2c.
+                const attributedLines = new Set();
 
                 // Pass 2: find callbacks on route-registration lines
                 for (const call of calls) {
@@ -618,10 +737,11 @@ function buildCallbackEntrypointMap(index) {
                     // not exported handler functions — they must not be marked as
                     // entry points. This aligns the HTTP Routes section with
                     // bridge.js's extractServerRoutes.
-                    if (!index.symbols.has(call.name)) continue;
+                    const def = resolveHandlerDef(call.name, filePath);
+                    if (!def) continue;
+                    attributedLines.add(call.line);
 
                     if (!result.has(call.name)) {
-                        const def = resolveHandlerDef(call.name, filePath);
                         result.set(call.name, {
                             framework: route.pattern.framework,
                             type: route.pattern.type,
@@ -644,7 +764,16 @@ function buildCallbackEntrypointMap(index) {
                     if (!enc || !enc.name || enc.name === '<anonymous>') continue;
                     const route = routeLines.get(enc.startLine);
                     if (!route || handledLines.has(enc.startLine)) continue;
-                    if (index.symbols.has(enc.name)) continue; // real defs took pass 2
+                    // Real defs took pass 2 (they arrive as function
+                    // REFERENCES on the route line). The inline expression's
+                    // own indexed symbol (bodyScopedName, anchored at this
+                    // registration line) is not a pass-2 shape — it IS the
+                    // handler this pass exists to surface.
+                    const encDefs = index.symbols.get(enc.name) || [];
+                    const inlineDef = encDefs.find(d => d.bodyScopedName &&
+                        d.file === filePath && d.startLine === enc.startLine);
+                    if (encDefs.length > 0 && !inlineDef) continue;
+                    attributedLines.add(enc.startLine);
                     if (!result.has(enc.name)) {
                         result.set(enc.name, {
                             framework: route.pattern.framework,
@@ -658,6 +787,33 @@ function buildCallbackEntrypointMap(index) {
                         });
                     }
                 }
+
+                // Pass 2c: routes with no attributable handler — anonymous
+                // arrows (`app.get('/e', (req, res) => …)`) or handlers UCN
+                // cannot name. The ROUTE is still a framework entry point:
+                // `endpoints` lists it, and `entrypoints` must agree.
+                // Literal-path routes only — the same rule that keeps
+                // library-internal registration helpers (gin's
+                // `group.GET(relativePath, handler)`) out of the route list.
+                for (const [line, route] of routeLines) {
+                    if (attributedLines.has(line)) continue;
+                    if (!route.call.firstStringArg || route.call.firstStringArgInterp) continue;
+                    const key = `<anonymous>@${filePath}:${line}`;
+                    if (!result.has(key)) {
+                        result.set(key, {
+                            name: '<anonymous>',
+                            framework: route.pattern.framework,
+                            type: route.pattern.type,
+                            patternId: route.pattern.id,
+                            method: route.call.name.toUpperCase(),
+                            file: filePath,
+                            line,
+                            registrationFile: filePath,
+                            registrationLine: line,
+                            route: route.call.firstStringArg,
+                        });
+                    }
+                }
             }
         }
 
@@ -797,7 +953,7 @@ function detectEntrypoints(index, options = {}) {
             if (!fileEntry) continue;
 
             // Check decorator/modifier-based patterns
-            const match = matchDecoratorOrModifier(symbol, fileEntry.language);
+            const match = matchDecoratorOrModifier(symbol, fileEntry.language, fileEntry);
             if (match) {
                 const key = `${symbol.file}:${symbol.startLine}:${name}`;
                 if (seen.has(key)) continue;
@@ -820,6 +976,7 @@ function detectEntrypoints(index, options = {}) {
             // Check name-based patterns (main, init, TestXxx, etc.)
             for (const np of namePatterns) {
                 if (!np.languages.has(fileEntry.language)) continue;
+                if (NON_CALLABLE_TYPES.has(symbol.type)) continue;
                 // Per-pattern symbol predicate (fix #243) — e.g. main must be
                 // a free function (Rust/Go) or a static method (Java)
                 if (np.symbolFilter && !np.symbolFilter(symbol)) continue;
@@ -848,14 +1005,19 @@ function detectEntrypoints(index, options = {}) {
     // 2. Add call-pattern-based entry points (route handlers).
     // Run BEFORE file-level patterns so framework labels (express, gin, etc.) win
     // over generic file-level labels (e.g. server.js / index.js js-cli-main).
-    for (const [name, info] of callbackMap) {
+    for (const [mapKey, info] of callbackMap) {
+        // Anonymous-handler routes are stored under a synthetic unique key;
+        // the display name lives in info.name.
+        const name = info.name || mapKey;
         const fileEntry = index.files.get(info.file);
         const relPath = fileEntry?.relativePath || info.file;
         const key = `${info.file}:${info.line}:${name}`;
         if (seen.has(key)) continue;
         seen.add(key);
 
-        let evidence = `${info.method} route handler`;
+        let evidence = info.route
+            ? `${info.method} ${info.route} — inline anonymous handler`
+            : `${info.method} route handler`;
         let registeredAt;
         if (info.registrationFile) {
             const regEntry = index.files.get(info.registrationFile);
@@ -965,10 +1127,10 @@ function detectEntrypoints(index, options = {}) {
                 //     (3) already covers `if (require.main === module) { main(); }`.
             }
 
-            // If we identified at least one specific entry, use that set.
-            // Otherwise fall back to permissive (null) so a CLI file with neither
-            // `main()` nor a clear default-export is still seeded somehow.
-            narrowAllowedByFile.set(filePath, allowed.size > 0 ? allowed : null);
+            // Empty means no callable entry was proven. Do not turn an
+            // ordinary `index.ts`/`server.ts` module into an entry point by
+            // falling back to every symbol in the file.
+            narrowAllowedByFile.set(filePath, allowed);
         }
     }
 
@@ -1039,8 +1201,8 @@ function detectEntrypoints(index, options = {}) {
         const raw = Array.isArray(options.exclude) ? options.exclude : options.exclude.split(',');
         const patterns = raw.map(s => s.trim()).filter(Boolean);
         if (patterns.length > 0) {
-            const regexes = patterns.map(p => new RegExp(`(^|[/._-])${p}s?([/._-]|$)`, 'i'));
-            filtered = filtered.filter(e => !regexes.some(r => r.test(e.file)));
+            filtered = filtered.filter(e =>
+                index.matchesFilters(e.file, { exclude: patterns }));
         }
     }
 
@@ -1161,7 +1323,7 @@ function computeReachability(index) {
                 langModule = langModuleCache.get(lang);
             } else {
                 try {
-                    langModule = getLanguageModule(lang);
+                    langModule = getLanguageAdapter(lang);
                 } catch (_e) {
                     langModule = null;
                 }
@@ -1286,7 +1448,7 @@ function isFrameworkEntrypoint(symbol, index) {
     if (!fileEntry) return false;
 
     // Fast path: check decorator/modifier patterns (no index scan needed)
-    if (matchDecoratorOrModifier(symbol, fileEntry.language)) {
+    if (matchDecoratorOrModifier(symbol, fileEntry.language, fileEntry)) {
         return true;
     }