ucn 4.2.3 → 5.0.2

package/core/ast-analysis.js

@@ -0,0 +1,279 @@
+'use strict';
+
+/**
+ * Small AST-derived analyses shared by the public trust surface.
+ *
+ * Keep these queries syntax-only. They deliberately do not attempt compiler
+ * binding or runtime prediction; their job is to replace source-text guesses
+ * with stable tree-sitter facts.
+ */
+
+const { getParser, safeParse } = require('../languages');
+
+const CALLABLE_NODES = new Set([
+    // JavaScript / TypeScript
+    'function_declaration', 'generator_function_declaration',
+    'function_expression', 'generator_function', 'arrow_function',
+    'method_definition',
+    // Python
+    'function_definition', 'lambda',
+    // Go
+    'method_declaration', 'func_literal',
+    // Rust
+    'function_item', 'closure_expression',
+    // Java / C / C++ / C#
+    'method_declaration', 'constructor_declaration', 'lambda_expression',
+    'function_definition',
+    'local_function_statement', 'anonymous_method_expression',
+    'operator_declaration', 'conversion_operator_declaration',
+]);
+
+const BRANCH_NODES = new Set([
+    'if_statement', 'if_expression', 'elif_clause',
+    'for_statement', 'for_in_statement', 'for_expression',
+    'foreach_statement', 'for_range_loop',
+    'while_statement', 'while_expression', 'do_statement',
+    'catch_clause', 'except_clause',
+    'conditional_expression', 'ternary_expression',
+    'switch_case', 'case_clause', 'case_statement',
+    'switch_label', 'switch_section', 'expression_case',
+    'communication_case', 'match_arm',
+]);
+
+const NESTING_NODES = new Set([
+    'if_statement', 'if_expression', 'elif_clause',
+    'for_statement', 'for_in_statement', 'for_expression',
+    'foreach_statement', 'for_range_loop',
+    'while_statement', 'while_expression', 'do_statement',
+    'try_statement', 'catch_clause', 'except_clause',
+    'switch_statement', 'switch_expression', 'expression_switch_statement',
+    'type_switch_statement', 'select_statement', 'match_expression',
+]);
+
+const LITERAL_INDEX_NODES = new Set([
+    'string', 'string_literal', 'raw_string_literal', 'interpreted_string_literal',
+    'character', 'char_literal',
+    'number', 'integer', 'integer_literal', 'int_literal',
+    'number_literal', 'decimal_integer_literal', 'float', 'float_literal',
+    'true', 'false', 'null', 'none',
+]);
+
+function walkNamed(node, visit) {
+    if (!node) return;
+    if (visit(node) === false) return;
+    for (const child of node.namedChildren || []) walkNamed(child, visit);
+}
+
+function isDefaultBranch(node) {
+    const text = String(node.text || '').trimStart();
+    return text.startsWith('default') || text.startsWith('case _');
+}
+
+function findCallableForRange(root, startLine, endLine) {
+    const candidates = [];
+    walkNamed(root, node => {
+        if (!CALLABLE_NODES.has(node.type)) return true;
+        const start = node.startPosition.row + 1;
+        const end = node.endPosition.row + 1;
+        if (start < startLine || end > endLine) return true;
+        candidates.push({
+            node,
+            exactEnd: end === endLine ? 1 : 0,
+            exactStart: start === startLine ? 1 : 0,
+            span: end - start,
+            startDistance: Math.abs(start - startLine),
+        });
+        return true;
+    });
+    candidates.sort((a, b) =>
+        b.exactEnd - a.exactEnd ||
+        b.exactStart - a.exactStart ||
+        b.span - a.span ||
+        a.startDistance - b.startDistance);
+    return candidates[0]?.node || null;
+}
+
+/**
+ * Return AST structural branch count and control-flow nesting depth for one
+ * indexed callable. Formatting, comments, strings, optional chaining, and
+ * nullish coalescing cannot affect these values.
+ */
+function computeAstComplexity(content, language, {
+    startLine = 1,
+    endLine = startLine,
+} = {}) {
+    const lineCount = Math.max(0, endLine - startLine + 1);
+    try {
+        const parser = getParser(language);
+        if (!parser) {
+            return {
+                branches: null,
+                maxDepth: null,
+                lineCount,
+                measuredBy: 'unavailable-no-parser',
+            };
+        }
+        const tree = safeParse(parser, content);
+        const callable = findCallableForRange(tree.rootNode, startLine, endLine);
+        if (!callable) {
+            return {
+                branches: null,
+                maxDepth: null,
+                lineCount,
+                measuredBy: 'unavailable-no-callable-node',
+            };
+        }
+
+        let branches = 0;
+        let maxDepth = 0;
+        const visit = (node, depth) => {
+            if (node !== callable && CALLABLE_NODES.has(node.type)) return;
+
+            if (BRANCH_NODES.has(node.type) && !isDefaultBranch(node)) branches++;
+            const nextDepth = depth + (NESTING_NODES.has(node.type) ? 1 : 0);
+            if (nextDepth > maxDepth) maxDepth = nextDepth;
+            for (const child of node.namedChildren || []) visit(child, nextDepth);
+        };
+        visit(callable, 0);
+        return {
+            branches,
+            maxDepth,
+            lineCount,
+            measuredBy: 'tree-sitter-ast',
+        };
+    } catch (error) {
+        return {
+            branches: null,
+            maxDepth: null,
+            lineCount,
+            measuredBy: 'unavailable-parse-error',
+        };
+    }
+}
+
+function indexNodeForComputedCallee(callee) {
+    if (!callee) return null;
+    switch (callee.type) {
+        case 'subscript_expression':
+            return callee.childForFieldName('index') || callee.namedChild(1);
+        case 'index_expression':
+            return callee.childForFieldName('index') || callee.namedChild(1);
+        case 'subscript':
+            return callee.childForFieldName('subscript') || callee.namedChild(1);
+        case 'element_access_expression': {
+            const list = callee.childForFieldName('subscript') ||
+                (callee.namedChildren || []).find(child =>
+                    child.type === 'bracketed_argument_list');
+            return list?.namedChild(0)?.namedChild(0) || list?.namedChild(0) || null;
+        }
+        default:
+            return null;
+    }
+}
+
+function computedReceiver(callee) {
+    if (!callee) return null;
+    const node = callee.childForFieldName('object') ||
+        callee.childForFieldName('operand') ||
+        callee.childForFieldName('value') ||
+        callee.childForFieldName('expression') ||
+        callee.namedChild(0);
+    return node?.type === 'identifier' ? node.text : null;
+}
+
+/**
+ * Find direct computed dispatch calls such as handlers[name](). Literal keys
+ * are excluded because they retain a statically visible member name.
+ */
+function computedDispatchSites(content, language) {
+    try {
+        const parser = getParser(language);
+        if (!parser) return [];
+        const tree = safeParse(parser, content);
+        const sites = [];
+        const seen = new Set();
+        const selectedByLocal = new Map();
+        const calledLocals = new Set();
+        const scopeKey = node => {
+            let current = node?.parent;
+            while (current && !CALLABLE_NODES.has(current.type)) current = current.parent;
+            return current ? `${current.startIndex}:${current.endIndex}` : 'module';
+        };
+        const record = (node, callee, expression) => {
+            const indexNode = indexNodeForComputedCallee(callee);
+            if (!indexNode || LITERAL_INDEX_NODES.has(indexNode.type)) return;
+            const receiver = computedReceiver(callee);
+            if (!receiver) return;
+            const key = `${callee.startIndex}:${callee.endIndex}`;
+            if (seen.has(key)) return;
+            seen.add(key);
+            sites.push({
+                line: node.startPosition.row + 1,
+                receiver,
+                expression: expression || node.text,
+            });
+        };
+        walkNamed(tree.rootNode, node => {
+            let callee = null;
+            if (node.type === 'call_expression' || node.type === 'call' ||
+                node.type === 'invocation_expression') {
+                callee = node.childForFieldName('function');
+            }
+            record(node, callee);
+
+            if (callee?.type === 'identifier') {
+                calledLocals.add(`${scopeKey(node)}\0${callee.text}`);
+            }
+
+            // Two-step dispatch: `const h = handlers[key]; h()`. Record the
+            // dynamic access only when its bound local is actually invoked in
+            // the same callable scope. Ordinary indexing (`xs[i]`) is a value
+            // read and says nothing about runtime-selected call targets.
+            if (node.type === 'variable_declarator' ||
+                node.type === 'assignment_expression' ||
+                node.type === 'assignment') {
+                const left = node.childForFieldName('name') ||
+                    node.childForFieldName('left');
+                const right = node.childForFieldName('value') ||
+                    node.childForFieldName('right');
+                if (left?.type === 'identifier' && indexNodeForComputedCallee(right)) {
+                    selectedByLocal.set(`${scopeKey(node)}\0${left.text}`, { node, right });
+                }
+            }
+            return true;
+        });
+        for (const [key, selection] of selectedByLocal) {
+            if (calledLocals.has(key)) record(selection.node, selection.right);
+        }
+        return sites;
+    } catch (error) {
+        return [];
+    }
+}
+
+/**
+ * Project-level cached computed-dispatch inventory. ProjectIndex invalidates
+ * this memo on rebuilds and file removal so long-lived MCP sessions see edits.
+ */
+function projectComputedDispatch(index) {
+    if (index._computedDispatchBlindspots) return index._computedDispatchBlindspots;
+    const byFile = new Map();
+    for (const [filePath, fileEntry] of index.files) {
+        try {
+            const sites = computedDispatchSites(index._readFile(filePath), fileEntry.language);
+            if (sites.length > 0) byFile.set(filePath, sites);
+        } catch (_) {
+            // Unreadable files are reported through the existing parse/read
+            // diagnostics; do not turn this optional scan into a query crash.
+        }
+    }
+    index._computedDispatchBlindspots = byFile;
+    index.computedDispatchDirty = true;
+    return byFile;
+}
+
+module.exports = {
+    computeAstComplexity,
+    computedDispatchSites,
+    projectComputedDispatch,
+};

package/core/bridge.js

@@ -133,6 +133,11 @@ const SERVER_RECEIVER_PATTERNS = {
         // route mount with method ALL. (Prefix concat with inner router routes
         // is deferred — too complex to track inner Router argument.)
     ],
+    csharp: [
+        { receiverPattern: /^(app|endpoints|routes)$/i,
+          methodPattern: /^Map(Get|Post|Put|Delete|Patch|Methods|Fallback)$/,
+          framework: 'aspnet-minimal' },
+    ],
 };
 
 // Client: receiver+method patterns and bare-call patterns.
@@ -195,6 +200,15 @@ const CLIENT_PATTERNS = {
         // reqwest::get("/path") is a path-call captured separately
         callableReceivers: new Set(),
     },
+    csharp: {
+        bareCalls: new Set(),
+        receivers: [
+            { receiverPattern: /^(client|http|httpClient)$/i,
+              methodPattern: /^(GetAsync|PostAsync|PutAsync|DeleteAsync|PatchAsync|SendAsync)$/,
+              framework: 'dotnet-httpclient' },
+        ],
+        callableReceivers: new Set(),
+    },
 };
 
 // HTTP-method decorator/annotation/attribute patterns.
@@ -247,6 +261,7 @@ const PREFIX_ANNOTATIONS = new Set([
     'RequestMapping', // Spring class-level @RequestMapping("/api")
     'Path',           // JAX-RS class-level @Path("/api")
 ]);
+const CSHARP_PREFIX_ATTRIBUTES = new Set(['Route']);
 
 // ============================================================================
 // EXTRACT SERVER ROUTES
@@ -265,6 +280,21 @@ function extractServerRoutes(index) {
     }
 
     const routes = [];
+    const mountedPrefixes = collectProjectRouterMounts(index);
+    const pythonReceiverFrameworks = new Map();
+    for (const [filePath, entry] of index.files) {
+        if (entry.language !== 'python') continue;
+        const receiverMap = new Map();
+        for (const call of getCachedCalls(index, filePath) || []) {
+            if (!call.assignedTo) continue;
+            if (call.name === 'Flask' || call.name === 'Blueprint') {
+                receiverMap.set(call.assignedTo, 'flask');
+            } else if (call.name === 'FastAPI' || call.name === 'APIRouter') {
+                receiverMap.set(call.assignedTo, 'fastapi');
+            }
+        }
+        pythonReceiverFrameworks.set(filePath, receiverMap);
+    }
 
     // 1) Decorator/annotation/attribute-based routes (NestJS, Flask/FastAPI, Spring, JAX-RS, Actix).
     //    Iterate symbols once and look at their decoratorsWithArgs/annotationsWithArgs/attributesWithArgs.
@@ -299,7 +329,8 @@ function extractServerRoutes(index) {
                 classPrefix = classPrefixByFileClass.get(`${sym.file}:${sym.className}`) || '';
             }
 
-            const declRoutes = collectMethodRoutes(sym, lang, classPrefix);
+            const declRoutes = collectMethodRoutes(sym, lang, classPrefix, fileEntry,
+                pythonReceiverFrameworks.get(sym.file));
             for (const r of declRoutes) {
                 routes.push({
                     method: r.method,
@@ -323,9 +354,19 @@ function extractServerRoutes(index) {
         const lang = fileEntry.language;
         const calls = getCachedCalls(index, filePath);
         if (!calls || calls.length === 0) continue;
+        const routerReceivers = collectRouterReceivers(calls, lang);
 
+        const groupPrefixes = new Map();
         for (const call of calls) {
-            const r = matchCallPatternRoute(call, lang);
+            if (!/^(Group|group|nest)$/.test(call.name) ||
+                !call.assignedTo || !call.firstStringArg ||
+                !routerReceivers.has(call.assignedTo)) continue;
+            const parent = groupPrefixes.get(call.receiver) || '';
+            groupPrefixes.set(call.assignedTo, joinRoutePath(parent, call.firstStringArg));
+        }
+
+        for (const call of calls) {
+            const r = matchCallPatternRoute(call, lang, routerReceivers);
             if (!r) continue;
 
             // Resolve handler name from arg position 1 if call.firstStringArg is set.
@@ -333,17 +374,24 @@ function extractServerRoutes(index) {
             // call on the same line — we look for it.
             const handlerName = findHandlerCallback(calls, call.line, call) || '<anonymous>';
 
-            routes.push({
-                method: r.method,
-                path: r.path,
-                normalizedPath: normalizePath(r.path),
-                handler: handlerName,
-                file: fileEntry.relativePath || filePath,
-                absoluteFile: filePath,
-                line: call.line,
-                framework: r.framework,
-                raw: `${r.method} ${r.path}`,
-            });
+            const receiverKey = `${filePath}:${call.receiver || ''}`;
+            const prefixes = mountedPrefixes.get(receiverKey) ||
+                (groupPrefixes.has(call.receiver) ? [groupPrefixes.get(call.receiver)] : ['']);
+            for (const prefix of prefixes) {
+                const fullPath = prefix ? joinRoutePath(prefix, r.path) : r.path;
+                routes.push({
+                    method: r.method,
+                    path: fullPath,
+                    normalizedPath: normalizePath(fullPath),
+                    handler: handlerName,
+                    file: fileEntry.relativePath || filePath,
+                    absoluteFile: filePath,
+                    line: call.line,
+                    framework: r.framework,
+                    ...(prefix && { mountPrefix: prefix }),
+                    raw: `${r.method} ${fullPath}`,
+                });
+            }
         }
     }
 
@@ -385,13 +433,21 @@ function collectClassPrefixes(sym, lang) {
             }
         }
     }
+    if (lang === 'csharp' && sym.attributesWithArgs) {
+        for (const attribute of sym.attributesWithArgs) {
+            if (CSHARP_PREFIX_ATTRIBUTES.has(attribute.name) && attribute.arg != null) {
+                prefixes.push(attribute.arg);
+            }
+        }
+    }
     return prefixes;
 }
 
 /**
  * Return zero or more route objects {method, path, framework, raw} for a method/function symbol.
  */
-function collectMethodRoutes(sym, lang, classPrefix) {
+function collectMethodRoutes(sym, lang, classPrefix, fileEntry = null,
+    pythonReceiverFramework = null) {
     const out = [];
 
     // ── JS/TS decorators (NestJS) ────────────────────────────────────
@@ -414,7 +470,7 @@ function collectMethodRoutes(sym, lang, classPrefix) {
     if (lang === 'python' && sym.decorators) {
         for (const decRaw of sym.decorators) {
             // Decorator text in Python is the full source: "app.route('/users', methods=['GET'])"
-            const r = parsePythonDecoratorFull(decRaw);
+            const r = parsePythonDecoratorFull(decRaw, fileEntry, pythonReceiverFramework);
             if (r) {
                 out.push({
                     method: r.method,
@@ -492,6 +548,21 @@ function collectMethodRoutes(sym, lang, classPrefix) {
         }
     }
 
+    // ── C# attributes (ASP.NET Core) ─────────────────────────────────
+    if (lang === 'csharp' && sym.attributesWithArgs) {
+        for (const attribute of sym.attributesWithArgs) {
+            const match = attribute.name.match(
+                /^Http(Get|Post|Put|Delete|Patch|Head|Options)$/);
+            if (!match) continue;
+            const sub = attribute.arg || '';
+            out.push({
+                method: match[1].toUpperCase(),
+                path: joinRoutePath(classPrefix, sub) || '/',
+                framework: 'aspnet',
+            });
+        }
+    }
+
     return out;
 }
 
@@ -502,7 +573,7 @@ function collectMethodRoutes(sym, lang, classPrefix) {
  *   "router.post('/items')"
  * Returns { method, path, framework } or null.
  */
-function parsePythonDecoratorFull(raw) {
+function parsePythonDecoratorFull(raw, fileEntry = null, receiverFramework = null) {
     if (typeof raw !== 'string') return null;
     // Match receiver.verb('path', ...)
     const m = raw.match(/^([A-Za-z_][A-Za-z0-9_]*)\.([a-z]+)\s*\(\s*(['"])([^'"]*)\3/);
@@ -522,11 +593,53 @@ function parsePythonDecoratorFull(raw) {
         return { method: 'GET', path: pathStr, framework: 'flask' };
     }
     if (['get','post','put','delete','patch','options','head'].includes(verb)) {
-        return { method: verb.toUpperCase(), path: pathStr, framework: 'fastapi' };
+        const modules = (fileEntry?.imports || []).map(value =>
+            typeof value === 'string' ? value : String(value?.module || ''));
+        const framework = receiverFramework?.get(m[1]) ||
+            (modules.some(module => /^flask\b/.test(module)) &&
+             !modules.some(module => /^fastapi\b/.test(module))
+                ? 'flask' : modules.some(module => /^fastapi\b/.test(module)) &&
+                  !modules.some(module => /^flask\b/.test(module))
+                    ? 'fastapi' : 'unknown-python');
+        return { method: verb.toUpperCase(), path: pathStr, framework };
     }
     return null;
 }
 
+/** Map exported router receiver variables to their literal project mounts. */
+function collectProjectRouterMounts(index) {
+    const mounts = new Map();
+    for (const [filePath, fileEntry] of index.files) {
+        if (!['javascript', 'typescript', 'tsx'].includes(fileEntry.language)) continue;
+        const calls = getCachedCalls(index, filePath) || [];
+        for (const call of calls) {
+            if (call.name !== 'use' || !call.receiver || !call.firstStringArg ||
+                (call.argCount != null && call.argCount < 2)) continue;
+            const refs = calls.filter(candidate => candidate.line === call.line &&
+                candidate !== call && (candidate.isFunctionReference || candidate.isPotentialCallback));
+            for (const ref of refs) {
+                const binding = (fileEntry.importBindings || []).find(item => item.name === ref.name);
+                const rel = binding && fileEntry.moduleResolved?.[binding.module];
+                if (!rel) continue;
+                const targetFile = path.join(index.root, rel);
+                const targetEntry = index.files.get(targetFile);
+                if (!targetEntry) continue;
+                const exportedReceivers = (targetEntry.exportDetails || [])
+                    .filter(exp => exp.type === 'module.exports' || exp.isDefault ||
+                        exp.kind === 'default' || exp.type === 'export-default')
+                    .map(exp => exp.localName || exp.name).filter(Boolean);
+                for (const receiver of exportedReceivers) {
+                    const key = `${targetFile}:${receiver}`;
+                    const list = mounts.get(key) || [];
+                    if (!list.includes(call.firstStringArg)) list.push(call.firstStringArg);
+                    mounts.set(key, list);
+                }
+            }
+        }
+    }
+    return mounts;
+}
+
 /**
  * Spring @RequestMapping(method = RequestMethod.GET) — extract method.
  * Returns 'GET' / 'POST' / etc. or null.
@@ -537,10 +650,51 @@ function parseSpringRequestMappingMethod(argsRaw) {
     return m ? m[1] : null;
 }
 
+/** Infer router values from AST call/assignment evidence, independent of the
+ * variable's spelling. Legacy receiver-name patterns remain seeds for code
+ * where the factory assignment is outside the indexed file. */
+function collectRouterReceivers(calls, lang) {
+    const receivers = new Set();
+    const patterns = SERVER_RECEIVER_PATTERNS[lang] || [];
+    for (const call of calls) {
+        if (call.receiver && patterns.some(pattern =>
+            pattern.receiverPattern.test(call.receiver))) {
+            receivers.add(call.receiver);
+        }
+        if (!call.assignedTo) continue;
+        const receiver = String(call.receiver || '');
+        const factory = (
+            (['javascript', 'typescript'].includes(lang) &&
+                /^(Router|express|fastify|Koa)$/.test(call.name)) ||
+            (lang === 'go' && (
+                /^(NewRouter|NewServeMux|Default)$/.test(call.name) ||
+                (call.name === 'New' && /^(gin|echo|chi|fiber|mux|http)$/i.test(receiver)))) ||
+            (lang === 'rust' && call.name === 'new' && /Router$/.test(receiver)) ||
+            (lang === 'csharp' && call.name === 'Build')
+        );
+        if (factory) receivers.add(call.assignedTo);
+    }
+
+    // Router groups/nests produce another router. Iterate because nested
+    // groups are common (`admin := api.Group(...); v2 := admin.Group(...)`).
+    let changed = true;
+    while (changed) {
+        changed = false;
+        for (const call of calls) {
+            if (!call.assignedTo || !call.receiver ||
+                !/^(Group|group|nest|NewGroup)$/.test(call.name) ||
+                !receivers.has(call.receiver) || receivers.has(call.assignedTo)) continue;
+            receivers.add(call.assignedTo);
+            changed = true;
+        }
+    }
+    return receivers;
+}
+
 /**
  * Match a call against server route patterns. Returns {method, path, framework} or null.
  */
-function matchCallPatternRoute(call, lang) {
+function matchCallPatternRoute(call, lang, routerReceivers = null) {
     if (!call.firstStringArg) return null;
 
     // Path-call patterns (Rust): handled outside (router.route, router.nest captured below)
@@ -550,7 +704,8 @@ function matchCallPatternRoute(call, lang) {
     // For Express/Gin/etc, the call is method-call: app.get('/path', handler)
     for (const p of patterns) {
         if (!call.receiver) continue;
-        if (!p.receiverPattern.test(call.receiver)) continue;
+        if (!routerReceivers?.has(call.receiver) &&
+            !p.receiverPattern.test(call.receiver)) continue;
         if (!p.methodPattern.test(call.name)) continue;
 
         // BUG M5: Express has dual-purpose APIs where 1-arg .get/.set are config
@@ -566,6 +721,10 @@ function matchCallPatternRoute(call, lang) {
         // axum router.route('/path', get(handler)) — method comes from the *second* arg's verb,
         // which we don't have direct access to here. Fall back to ALL.
         let method = call.name.toUpperCase();
+        if (p.framework === 'aspnet-minimal') {
+            const mapped = call.name.match(/^Map(Get|Post|Put|Delete|Patch)$/);
+            method = mapped ? mapped[1].toUpperCase() : 'ALL';
+        }
         if (method === 'ROUTE' || method === 'HANDLE' || method === 'HANDLEFUNC' || method === 'USE' || method === 'ANY') {
             method = 'ALL';
         }
@@ -705,6 +864,18 @@ function extractClientRequests(index) {
             const r = matchClientRequest(call, lang, calls);
             if (!r) continue;
 
+            // Python's common `session.get("key")` / `s.get("key")`
+            // dictionary and ORM idioms are not HTTP requests.  Without
+            // receiver-type evidence, require the string to have a URL/path
+            // shape before claiming an outbound request.  This deliberately
+            // keeps absolute URLs and normal relative API paths while
+            // rejecting cache/session keys (UCN5-162).
+            if (lang === 'python' &&
+                !call.firstStringArg.startsWith('/') &&
+                !call.firstStringArg.includes('://')) {
+                continue;
+            }
+
             const callerName = call.enclosingFunction?.name || '<top-level>';
             const callerStartLine = call.enclosingFunction?.startLine;
 
@@ -773,7 +944,15 @@ function matchClientRequest(call, lang, allCallsInFile) {
             // we tag as ALL.
             let method;
             let inferred = false;
-            if (methodName === 'uri') {
+            if (lang === 'csharp' && methodName.endsWith('async')) {
+                const verb = methodName.slice(0, -'async'.length);
+                if (verb === 'send') {
+                    method = 'ALL';
+                    inferred = true;
+                } else {
+                    method = verb.toUpperCase();
+                }
+            } else if (methodName === 'uri') {
                 // Java pattern: rest of the chain — we can't easily extract method, use ALL
                 method = 'ALL';
                 inferred = true;
@@ -1067,10 +1246,12 @@ function endpoints(index, options = {}) {
     }
 
     return {
-        // Advisory when bridging (v4 two-tier surface): route↔request
-        // matching is heuristic (per-match tiers EXACT/PARTIAL/UNCERTAIN),
-        // not a verified claim. Route/request EXTRACTION is AST-based.
-        ...(opts.bridge && { advisory: 'heuristic-route-matching' }),
+        // Endpoint extraction is AST-based but bounded to known framework
+        // patterns; a missing route is never proof that no endpoint exists.
+        // Bridge matching adds a second heuristic layer.
+        advisory: opts.bridge
+            ? 'heuristic-route-matching-and-incomplete-inventory'
+            : 'incomplete-endpoint-inventory',
         routes,
         requests,
         bridges,