weavatrix 0.3.13 → 1.0.0

package/src/analysis/duplicates.tokenize.js

@@ -1,199 +0,0 @@
-// duplicates.tokenize.js — lexical layer of the clone detector (split from duplicates.js): comment &
-// string stripping, body-end detection, strict/renamed tokenization, and winnowing fingerprints.
-
-const K = 8;               // k-gram length (tokens)
-const W = 4;               // winnowing window → guaranteed detection of matches ≥ K+W-1 tokens
-const STRLIT = String.fromCharCode(0); // opaque-literal sentinel for string bodies: a NUL
-                           // its own class (never an identifier "I" nor a number "N"), so a literal can
-                           // never masquerade as code in either mode
-const REGEXLIT = String.fromCharCode(1); // regex bodies are executable behavior, so retain an equality anchor
-const literalHash = (value) => {
-  let hash = 2166136261;
-  for (const char of String(value || "")) hash = Math.imul(hash ^ char.charCodeAt(0), 16777619);
-  return (hash >>> 0).toString(16);
-};
-const regexMarker = (value) => ` ${REGEXLIT} 0x${literalHash(value)} `;
-
-const KEYWORDS = new Set(("if else for while do switch case break continue return function const let var new class extends async await try catch finally throw import from export default typeof instanceof in of delete void yield static get set this super null undefined true false def elif except lambda pass raise with as is not and or None True False func go defer chan map range struct interface type package nil err string int bool byte float64 public private protected final void long double boolean").split(" "));
-
-// A leading `/` is a REGEX literal (not division) when the previous significant char is one of these
-// or the fragment start; after a word char / ) / ] it is division. Covers .match(/…/), = /…/, (/…/),
-// and arrow `x => /…/`. NOTE: `+` and `-` are deliberately EXCLUDED — a regex never legitimately
-// follows them, but `i++ / 2` and `a - b / c` do, and including them mis-scanned the division as a
-// regex and ate the rest of the line.
-const REGEX_PREV = new Set("(,=:[!&|?{};~*%^<>".split(""));
-
-// Replace comments with nothing and string bodies with an opaque sentinel. Regex bodies retain only
-// a one-way equality anchor: their source is executable behavior, and collapsing every pattern to the
-// same token creates false clone groups for unrelated replace/validate pipelines.
-export function stripNonCode(text, py) {
-  let out = "", i = 0, prevSig = "";
-  const s = String(text || "");
-  const push = (c) => { out += c; const t = c.trim(); if (t) prevSig = t[t.length - 1]; };
-  while (i < s.length) {
-    const ch = s[i], two = s.slice(i, i + 2), three = s.slice(i, i + 3);
-    if (py && ch === "#") { while (i < s.length && s[i] !== "\n") i++; continue; }
-    if (py && (three === "'''" || three === '"""')) {
-      i += 3;
-      while (i < s.length && s.slice(i, i + 3) !== three) i++;
-      i += 3; push(` ${STRLIT} `); continue;
-    }
-    if (!py && two === "//") { while (i < s.length && s[i] !== "\n") i++; continue; }
-    if (!py && two === "/*") { i += 2; while (i < s.length && s.slice(i, i + 2) !== "*/") i++; i += 2; continue; }
-    if (!py && ch === "/" && REGEX_PREV.has(prevSig)) {
-      i++; const regexStart = i; let inClass = false; // '/' inside a [...] char class is literal, not the terminator
-      while (i < s.length && s[i] !== "\n") {
-        const c = s[i];
-        if (c === "\\") { i += 2; continue; }
-        if (c === "[") inClass = true;
-        else if (c === "]") inClass = false;
-        else if (c === "/" && !inClass) { i++; break; }
-        i++;
-      }
-      while (i < s.length && /[a-z]/i.test(s[i])) i++; // regex flags (gimsuy)
-      push(regexMarker(s.slice(regexStart, i))); continue;
-    }
-    if (ch === '"' || ch === "'" || ch === "`") {
-      const q = ch; i++;
-      while (i < s.length && s[i] !== q) { if (s[i] === "\\") i++; i++; }
-      i++; push(` ${STRLIT} `); continue;
-    }
-    push(ch); i++;
-  }
-  return out;
-}
-
-// Where a symbol's body ends — so the LAST symbol in a file doesn't swallow trailing module-level code
-// (module.exports tables, main() calls, handler registrations) up to EOF and dilute/misattribute
-// clones. Brace/bracket depth for brace langs (body ends when {}()[] balance after first opening);
-// indentation for Python. Returns a 1-based line count within bodyLines (≤ its length; = its length
-// when the construct never closes, so the caller's cap stands).
-export function bodyEndLineCount(bodyLines, py) {
-  if (py) {
-    const base = bodyLines[0].match(/^[ \t]*/)[0].length;
-    let last = 1;
-    for (let k = 1; k < bodyLines.length; k++) {
-      const ln = bodyLines[k];
-      if (!ln.trim()) continue; // blank lines never end a block
-      if (ln.match(/^[ \t]*/)[0].length <= base) return last; // dedent to ≤ the def → body ended above
-      last = k + 1;
-    }
-    return bodyLines.length;
-  }
-  const text = bodyLines.join("\n");
-  let depth = 0, opened = false, i = 0, line = 1, prevSig = "";
-  while (i < text.length) {
-    const ch = text[i], two = text.slice(i, i + 2);
-    if (ch === "\n") { line++; i++; continue; }
-    if (two === "//") { while (i < text.length && text[i] !== "\n") i++; continue; }
-    if (two === "/*") { i += 2; while (i < text.length && text.slice(i, i + 2) !== "*/") { if (text[i] === "\n") line++; i++; } i += 2; continue; }
-    if (ch === "/" && REGEX_PREV.has(prevSig)) {
-      i++; let inClass = false;
-      while (i < text.length && text[i] !== "\n") { const c = text[i]; if (c === "\\") { i += 2; continue; } if (c === "[") inClass = true; else if (c === "]") inClass = false; else if (c === "/" && !inClass) { i++; break; } i++; }
-      prevSig = "/"; continue;
-    }
-    if (ch === '"' || ch === "'" || ch === "`") { const q = ch; i++; while (i < text.length && text[i] !== q) { if (text[i] === "\\") i++; else if (text[i] === "\n") line++; i++; } i++; prevSig = q; continue; }
-    // depth tracks all brackets, but only a { or [ opens the BODY — a bare (param list) returning to
-    // depth 0 must not be read as the construct closing on line 1
-    if (ch === "{" || ch === "(" || ch === "[") { depth++; if (ch === "{" || ch === "[") opened = true; }
-    else if (ch === "}" || ch === ")" || ch === "]") { depth--; if (opened && depth <= 0) return line; }
-    if (ch.trim()) prevSig = ch;
-    i++;
-  }
-  return bodyLines.length;
-}
-
-// Large multi-line string literals — the OPPOSITE selection to stripNonCode: everything the code
-// scan throws away. Embedded DSLs (inline C#/SQL/PowerShell templates) are invisible to the normal
-// clone pass because their bodies are stripped; this extractor feeds them back in as their own
-// fragments when the caller opts in (find_duplicates include_strings). Comment/regex handling
-// mirrors stripNonCode so a quote inside a comment never opens a phantom literal.
-export function extractLargeStrings(text, { py = false, cs = false, minLines = 6 } = {}) {
-  const s = String(text || "");
-  const out = [];
-  let i = 0, line = 1, prevSig = "";
-  const capture = (from, to, startLine) => {
-    const content = s.slice(from, to);
-    const nl = (content.match(/\n/g) || []).length;
-    if (nl + 1 >= minLines) out.push({ start: startLine, end: startLine + nl, content });
-  };
-  while (i < s.length) {
-    const ch = s[i], two = s.slice(i, i + 2), three = s.slice(i, i + 3);
-    if (ch === "\n") { line++; i++; continue; }
-    if (py && ch === "#") { while (i < s.length && s[i] !== "\n") i++; continue; }
-    if (py && (three === "'''" || three === '"""')) {
-      const startLine = line; i += 3; const from = i;
-      while (i < s.length && s.slice(i, i + 3) !== three) { if (s[i] === "\n") line++; i++; }
-      capture(from, i, startLine); i += 3; continue;
-    }
-    if (!py && two === "//") { while (i < s.length && s[i] !== "\n") i++; continue; }
-    if (!py && two === "/*") { i += 2; while (i < s.length && s.slice(i, i + 2) !== "*/") { if (s[i] === "\n") line++; i++; } i += 2; continue; }
-    if (!py && ch === "/" && REGEX_PREV.has(prevSig)) {
-      i++; let inClass = false;
-      while (i < s.length && s[i] !== "\n") { const c = s[i]; if (c === "\\") { i += 2; continue; } if (c === "[") inClass = true; else if (c === "]") inClass = false; else if (c === "/" && !inClass) { i++; break; } i++; }
-      prevSig = "/"; continue;
-    }
-    if (cs && two === '@"') { // C# verbatim string; "" is the escaped quote
-      const startLine = line; i += 2; const from = i;
-      while (i < s.length) { if (s.slice(i, i + 2) === '""') { i += 2; continue; } if (s[i] === '"') break; if (s[i] === "\n") line++; i++; }
-      capture(from, i, startLine); i++; continue;
-    }
-    if (!py && ch === "`") { // JS/TS template literal — the main multi-line carrier
-      const startLine = line; i++; const from = i;
-      while (i < s.length && s[i] !== "`") { if (s[i] === "\\") { i++; if (s[i] === "\n") line++; i++; continue; } if (s[i] === "\n") line++; i++; }
-      capture(from, i, startLine); i++; continue;
-    }
-    if (ch === '"' || ch === "'") { // single-line strings can't span minLines — just skip past
-      const q = ch; i++;
-      while (i < s.length && s[i] !== q && s[i] !== "\n") { if (s[i] === "\\") i++; i++; }
-      if (s[i] === q) i++; continue;
-    }
-    if (ch.trim()) prevSig = ch;
-    i++;
-  }
-  return out;
-}
-
-// one raw token stream; the two modes differ only in identifier canonicalization
-export function tokenize(text) {
-  const raw = text.match(/[A-Za-z_$][\w$]*|(?:0[xX][\dA-Fa-f_]+|0[bB][01_]+|0[oO][0-7_]+|\d[\d_]*(?:\.\d[\d_]*)?(?:[eE][+-]?\d[\d_]*)?)n?|[^\s\w]/g) || [];
-  const strict = [];
-  const renamed = [];
-  for (const t of raw) {
-    if (/^\d/.test(t)) {
-      // Numeric constants are behavior, not renameable identifiers. Preserve
-      // their value so same-shape limit/config tables with different numbers do
-      // not become perfect clones; a small constant edit still leaves the rest
-      // of a genuine copied body highly similar.
-      strict.push(`N:${t}`); renamed.push(`N:${t}`); continue;
-    }
-    if (/^[A-Za-z_$]/.test(t) && !KEYWORDS.has(t)) { strict.push(t); renamed.push("I"); continue; }
-    strict.push(t); renamed.push(t);
-  }
-  return { strict, renamed };
-}
-
-export function fingerprints(toks) {
-  if (toks.length < K + W - 1) return new Set();
-  const hashes = [];
-  for (let i = 0; i + K <= toks.length; i++) {
-    let h = 0;
-    for (let j = i; j < i + K; j++) {
-      const s = toks[j];
-      for (let c = 0; c < s.length; c++) h = (h * 31 + s.charCodeAt(c)) | 0;
-      h = (h * 131) | 0;
-    }
-    hashes.push(h >>> 0);
-  }
-  const fp = new Set();
-  for (let i = 0; i + W <= hashes.length + 1; i++) {
-    let min = Infinity;
-    for (let j = i; j < Math.min(i + W, hashes.length); j++) if (hashes[j] < min) min = hashes[j];
-    fp.add(min);
-  }
-  // Winnowing can skip every changed literal in a repetitive policy table.
-  // Exact numeric anchors keep behavior-defining limits in the similarity
-  // denominator while leaving ordinary copied bodies tolerant of a small edit.
-  for (const token of toks) if (token.startsWith("N:")) fp.add(`numeric:${token}`);
-  return fp;
-}

package/src/analysis/endpoints/common.js

@@ -1,62 +0,0 @@
-export const MAX_ENDPOINT_FILES = 3_000;
-export const MAX_ENDPOINTS = 2_000;
-export const HTTP_METHODS = new Set(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS", "TRACE", "CONNECT", "ALL", "ANY"]);
-
-export function lineAt(text, index) {
-  let line = 1;
-  for (let i = 0; i < index && i < text.length; i++) if (text[i] === "\n") line++;
-  return line;
-}
-
-// Preserve offsets and literals while hiding comments from regex extractors.
-export function maskComments(text, { hashComments = false } = {}) {
-  const chars = String(text || "").split("");
-  let quote = "", escaped = false, lineComment = false, blockComment = false;
-  for (let i = 0; i < chars.length; i++) {
-    const ch = chars[i], next = chars[i + 1];
-    if (lineComment) {
-      if (ch === "\n" || ch === "\r") lineComment = false;
-      else chars[i] = " ";
-      continue;
-    }
-    if (blockComment) {
-      if (ch === "*" && next === "/") { chars[i] = chars[i + 1] = " "; i++; blockComment = false; }
-      else if (ch !== "\n" && ch !== "\r") chars[i] = " ";
-      continue;
-    }
-    if (quote) {
-      if (escaped) escaped = false;
-      else if (ch === "\\") escaped = true;
-      else if (ch === quote) quote = "";
-      continue;
-    }
-    if (ch === '"' || ch === "'" || ch === "`") { quote = ch; continue; }
-    if (ch === "/" && next === "/") { chars[i] = chars[i + 1] = " "; i++; lineComment = true; continue; }
-    if (ch === "/" && next === "*") { chars[i] = chars[i + 1] = " "; i++; blockComment = true; continue; }
-    if (hashComments && ch === "#") { chars[i] = " "; lineComment = true; }
-  }
-  return chars.join("");
-}
-
-export function handlerName(expr) {
-  const source = String(expr || "").trim();
-  if (!source || /=>/.test(source) || /^\s*(async\s+)?function\b/.test(source) || /^\s*(?:async\s+)?(?:move\s+)?\|[^|]*\|/.test(source)) return "";
-  const turbofish = /(?:^|::)([A-Za-z_][\w]*)\s*::<[\s\S]*>\s*$/.exec(source);
-  if (turbofish) return turbofish[1];
-  const identifiers = source.match(/[A-Za-z_$][\w$]*/g);
-  if (!identifiers) return "";
-  const skipped = new Set(["async", "function", "await", "req", "res", "ctx", "request", "response", "next", "return"]);
-  for (let i = identifiers.length - 1; i >= 0; i--) if (!skipped.has(identifiers[i])) return identifiers[i];
-  return "";
-}
-
-export function handlerReference(expr) {
-  const source = String(expr || "").trim();
-  if (!source || /=>/.test(source) || /^\s*(async\s+)?function\b/.test(source)) return "";
-  const refs = [...source.matchAll(/([A-Za-z_$][\w$]*(?:\s*\.\s*[A-Za-z_$][\w$]*)+)/g)];
-  return refs.length ? refs.at(-1)[1].replace(/\s+/g, "") : "";
-}
-
-export const looksLikePath = (path) => typeof path === "string" && /^\/[\w\-./:{}*$?]*$/.test(path) && !path.includes("://");
-export const cleanPath = (path) => String(path || "").replace(/\/+$/, "") || "/";
-export const normalizedFile = (file) => String(file || "").replace(/\\/g, "/").replace(/^\.\//, "");

package/src/analysis/endpoints/extract.js

@@ -1,107 +0,0 @@
-import { extractRustEndpoints } from "../endpoints-rust.js";
-import { extractSpringEndpoints } from "../endpoints-java.js";
-import { HTTP_METHODS, cleanPath, handlerName, handlerReference, lineAt, looksLikePath, maskComments } from "./common.js";
-
-const HTTP_CLIENT_CALLER = /^(axios|https?|fetch|ky|got|superagent|needle|undici|xhr|\$http|http[Cc]lient|api[Cc]lient|rest[Cc]lient)$/;
-const OPENAPI_BLOCK = /\boperationId\b|\bresponses\s*:|\brequestBody\b|\bschemaRef\b|\boperation\s*\(|\bsummary\s*:/;
-
-export function nextRoutePath(file) {
-  const parts = String(file || "").replace(/\\/g, "/").split("/").filter(Boolean);
-  if (!/^route\.[cm]?[jt]s$/i.test(parts.at(-1) || "")) return "";
-  const appAt = parts.lastIndexOf("app");
-  if (appAt < 0) return "";
-  const route = [];
-  for (let segment of parts.slice(appAt + 1, -1)) {
-    if (!segment || /^\([^)]*\)$/.test(segment) || segment.startsWith("@")) continue;
-    segment = segment.replace(/^\((?:\.{1,3})\)/, "");
-    let match;
-    if ((match = /^\[\[\.\.\.([^\]]+)\]\]$/.exec(segment))) segment = `*${match[1]}?`;
-    else if ((match = /^\[\.\.\.([^\]]+)\]$/.exec(segment))) segment = `*${match[1]}`;
-    else if ((match = /^\[([^\]]+)\]$/.exec(segment))) segment = `:${match[1]}`;
-    if (segment) route.push(segment);
-  }
-  return `/${route.join("/")}`;
-}
-
-export function extractEndpointsFromText(text, file) {
-  const out = [];
-  const py = /\.py$/i.test(file), rust = /\.rs$/i.test(file), java = /\.java$/i.test(file);
-  const scanText = maskComments(text, { hashComments: py });
-  const add = (method, path, expr, index) => {
-    const normalizedPath = cleanPath(path);
-    const normalizedMethod = String(method || "ANY").toUpperCase();
-    if (!looksLikePath(normalizedPath) || !HTTP_METHODS.has(normalizedMethod)) return;
-    const handler = handlerName(expr);
-    const handlerRef = handlerReference(expr);
-    out.push({ method: normalizedMethod, path: normalizedPath, handler, ...(handlerRef ? { handlerRef } : {}), file, line: lineAt(text, index) });
-  };
-
-  const nextPath = nextRoutePath(file);
-  if (nextPath) {
-    const seen = new Set();
-    const direct = /\bexport\s+(?:(?:async|declare)\s+)*(?:function\s+|(?:const|let|var)\s+)(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS)\b/g;
-    let match;
-    while ((match = direct.exec(scanText))) {
-      const method = match[1].toUpperCase();
-      if (!seen.has(method)) { seen.add(method); add(method, nextPath, method, match.index); }
-    }
-    const lists = /\bexport\s*\{([^}]+)\}/g;
-    while ((match = lists.exec(scanText))) {
-      for (const item of match[1].split(",")) {
-        const methodMatch = /^\s*([A-Za-z_$][\w$]*)(?:\s+as\s+(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS))?\s*$/.exec(item);
-        if (!methodMatch || (!methodMatch[2] && !HTTP_METHODS.has(methodMatch[1]))) continue;
-        const method = String(methodMatch[2] || methodMatch[1]).toUpperCase();
-        if (HTTP_METHODS.has(method) && !seen.has(method)) { seen.add(method); add(method, nextPath, methodMatch[1], match.index); }
-      }
-    }
-  }
-
-  if (rust) extractRustEndpoints(scanText, add);
-  if (java) {
-    out.push(...extractSpringEndpoints(scanText, file));
-    return out;
-  }
-
-  const objKey = /(["'`])(\/[^"'`]*)\1\s*:\s*(\{)?/g;
-  let match;
-  while ((match = objKey.exec(scanText))) {
-    const path = match[2], keyIndex = match.index;
-    if (match[3]) {
-      let cursor = objKey.lastIndex, depth = 1;
-      const start = cursor;
-      while (cursor < scanText.length && depth > 0) {
-        if (scanText[cursor] === "{") depth++;
-        else if (scanText[cursor] === "}") depth--;
-        cursor++;
-      }
-      const body = scanText.slice(start, cursor - 1);
-      objKey.lastIndex = cursor;
-      if (OPENAPI_BLOCK.test(body)) continue;
-      const methodEntry = /\b(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS)\b\s*:\s*([^,\n}]+)/gi;
-      let entry;
-      while ((entry = methodEntry.exec(body))) add(entry[1], path, entry[2], keyIndex);
-    } else {
-      const expression = /^([^,\n}]+)/.exec(scanText.slice(objKey.lastIndex, objKey.lastIndex + 200));
-      if (expression && !/^\s*(?:\{|["'`\[]|[-+]?\d|true\b|false\b|null\b|undefined\b)/i.test(expression[1])) add("ANY", path, expression[1], keyIndex);
-    }
-  }
-
-  const call = /(?<!@)\b([\w$]+)\s*\.\s*(get|post|put|patch|delete|head|options|all)\s*\(\s*(["'`])(\/[^"'`]*)\3\s*(?:,\s*([\s\S]{0,160}?))?\)/gi;
-  while ((match = call.exec(scanText))) {
-    const handler = String(match[5] || "").trim();
-    if (!HTTP_CLIENT_CALLER.test(match[1]) && handler && handler[0] !== "{") add(match[2], match[4], match[5], match.index);
-  }
-
-  const go = /\.\s*(?:HandleFunc|Handle)\s*\(\s*(["'`])(\/[^"'`]*)\1\s*,\s*([\s\S]{0,120}?)\)/g;
-  while ((match = go.exec(scanText))) add("ANY", match[2], match[3], match.index);
-
-  if (py || /\.(?:[cm]?[jt]sx?)$/i.test(file)) {
-    const decorator = /@[\w$]*\.?\s*(get|post|put|patch|delete|head|options)\s*\(\s*(["'`])(\/[^"'`]*)\2/gi;
-    while ((match = decorator.exec(scanText))) {
-      const after = scanText.slice(decorator.lastIndex, decorator.lastIndex + 200);
-      const fn = /\b(?:def|async\s+def|function|const|export\s+function)\s+([A-Za-z_$][\w$]*)/.exec(after);
-      add(match[1], match[3], fn ? fn[1] : "", match.index);
-    }
-  }
-  return out;
-}

package/src/analysis/endpoints/inventory.js

@@ -1,84 +0,0 @@
-import { safeRead } from "../../util.js";
-import { createRepoBoundary } from "../../repo-path.js";
-import { MAX_ENDPOINT_FILES, MAX_ENDPOINTS, normalizedFile } from "./common.js";
-import { extractEndpointsFromText, nextRoutePath } from "./extract.js";
-import { joinEndpointPath, mountedBasePaths } from "./mounts.js";
-
-const normParamKey = (path) => String(path).replace(/\{([^/}]+)\}/g, ":$1");
-const sortEndpoints = (left, right) => left.path.localeCompare(right.path) || left.method.localeCompare(right.method);
-
-function preferEndpoint(candidate, current) {
-  if (Boolean(candidate.handler) !== Boolean(current.handler)) return Boolean(candidate.handler);
-  return Number(candidate.path.includes("{")) < Number(current.path.includes("{"));
-}
-
-export function analyzeEndpointInventory(repoPath, codeFiles) {
-  const files = (codeFiles || []).slice(0, MAX_ENDPOINT_FILES);
-  const byKey = new Map();
-  const declarations = new Map();
-  const boundary = createRepoBoundary(repoPath);
-  const sources = new Map();
-  const eligibleFiles = [];
-  for (const file of files) {
-    const relative = normalizedFile(file.path || file);
-    if (!/\.(?:[cm]?[jt]sx?|py|go|rs|java)$/i.test(relative)) continue;
-    const resolved = boundary.resolve(relative);
-    if (!resolved.ok) continue;
-    sources.set(relative, safeRead(resolved.path) || "");
-    eligibleFiles.push(relative);
-  }
-  const mountAnalysis = mountedBasePaths(eligibleFiles, sources);
-  let truncated = false;
-  for (const relative of eligibleFiles) {
-    const text = sources.get(relative);
-    const routeSignal = /["'`]\/|\.(?:get|post|put|patch|delete)\s*\(|HandleFunc|@\w*\.?(?:get|post|put|patch|delete)|@(?:[\w$]+\.)*(?:Request|Get|Post|Put|Patch|Delete)Mapping\b/i;
-    if (!text || (!nextRoutePath(relative) && !routeSignal.test(text))) continue;
-    for (const declaration of extractEndpointsFromText(text, relative)) {
-      const declarationKey = `${declaration.file}\0${declaration.line}\0${declaration.method}\0${normParamKey(declaration.path)}`;
-      if (!declarations.has(declarationKey)) declarations.set(declarationKey, declaration);
-      const bases = mountAnalysis.paths.get(relative) || [{ path: "", chain: [] }];
-      for (const base of bases) {
-        const path = base.path ? joinEndpointPath(base.path, declaration.path) : declaration.path;
-        const endpoint = {
-          ...declaration,
-          declaredPath: declaration.path,
-          path,
-          mountState: base.chain.length ? "COMPOSED_STATIC" : "DECLARED_LOCAL",
-          confidence: base.chain.length ? "high" : "medium",
-          mountChain: base.chain,
-          ...(base.path ? { localPath: declaration.path } : {}),
-        };
-        const key = `${endpoint.method} ${normParamKey(endpoint.path)}`;
-        const current = byKey.get(key);
-        if (!current || preferEndpoint(endpoint, current)) byKey.set(key, endpoint);
-        if (byKey.size >= MAX_ENDPOINTS) { truncated = true; break; }
-      }
-      if (truncated) break;
-    }
-    if (truncated) break;
-  }
-  const endpoints = [...byKey.values()].sort(sortEndpoints);
-  const composed = endpoints.filter((endpoint) => endpoint.mountChain.length).length;
-  return {
-    endpoints,
-    declarations: [...declarations.values()].sort(sortEndpoints),
-    mounts: mountAnalysis.mounts,
-    stats: {
-      scannedFiles: eligibleFiles.length,
-      declaredRoutes: declarations.size,
-      emittedRoutes: endpoints.length,
-      reachableRoutes: composed,
-      reachableStaticRoutes: composed,
-      composedRoutes: composed,
-      localRoutes: endpoints.length - composed,
-      localDeclarations: endpoints.length - composed,
-      staticMounts: mountAnalysis.mounts.length,
-      truncated,
-      maxEndpoints: MAX_ENDPOINTS,
-    },
-  };
-}
-
-export function detectEndpoints(repoPath, codeFiles) {
-  return analyzeEndpointInventory(repoPath, codeFiles).endpoints;
-}

package/src/analysis/endpoints/mounts.js

@@ -1,129 +0,0 @@
-import { posix } from "node:path";
-import { cleanPath, lineAt, maskComments } from "./common.js";
-
-const JS_ROUTE_EXTENSIONS = [".js", ".ts", ".tsx", ".jsx", ".cjs", ".mjs"];
-
-function importBindings(text) {
-  const bindings = new Map();
-  const add = (name, specifier) => {
-    if (/^[A-Za-z_$][\w$]*$/.test(name || "") && typeof specifier === "string") bindings.set(name, specifier);
-  };
-  let match;
-  const direct = /\bimport\s+([A-Za-z_$][\w$]*)\s*(?:,\s*\{[^}]*\})?\s+from\s*(["'`])([^"'`]+)\2/g;
-  while ((match = direct.exec(text))) add(match[1], match[3]);
-  const namespace = /\bimport\s+\*\s+as\s+([A-Za-z_$][\w$]*)\s+from\s*(["'`])([^"'`]+)\2/g;
-  while ((match = namespace.exec(text))) add(match[1], match[3]);
-  const named = /\bimport\s*\{([^}]+)\}\s*from\s*(["'`])([^"'`]+)\2/g;
-  while ((match = named.exec(text))) {
-    for (const item of match[1].split(",")) {
-      const binding = /^\s*[A-Za-z_$][\w$]*(?:\s+as\s+([A-Za-z_$][\w$]*))?\s*$/.exec(item);
-      if (binding) add(binding[1] || item.trim(), match[3]);
-    }
-  }
-  const commonJs = /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*require\s*\(\s*(["'`])([^"'`]+)\2\s*\)/g;
-  while ((match = commonJs.exec(text))) add(match[1], match[3]);
-  return bindings;
-}
-
-function resolveImportedFile(importer, specifier, availableFiles) {
-  if (!specifier?.startsWith(".")) return null;
-  const base = posix.normalize(posix.join(posix.dirname(importer), specifier));
-  const candidates = [base];
-  if (!JS_ROUTE_EXTENSIONS.some((extension) => base.endsWith(extension))) {
-    for (const extension of JS_ROUTE_EXTENSIONS) candidates.push(`${base}${extension}`);
-    for (const extension of JS_ROUTE_EXTENSIONS) candidates.push(`${base}/index${extension}`);
-  }
-  return candidates.find((candidate) => availableFiles.has(candidate)) || null;
-}
-
-function callArguments(text, openParen) {
-  let quote = "", escaped = false, depth = 0, start = openParen + 1;
-  const args = [];
-  for (let index = openParen; index < text.length; index++) {
-    const char = text[index];
-    if (quote) {
-      if (escaped) escaped = false;
-      else if (char === "\\") escaped = true;
-      else if (char === quote) quote = "";
-      continue;
-    }
-    if (char === '"' || char === "'" || char === "`") { quote = char; continue; }
-    if (char === "(") { depth++; continue; }
-    if (char === ")") {
-      depth--;
-      if (depth === 0) {
-        args.push(text.slice(start, index).trim());
-        return { args, end: index + 1 };
-      }
-      continue;
-    }
-    if (char === "," && depth === 1) {
-      args.push(text.slice(start, index).trim());
-      start = index + 1;
-    }
-  }
-  return null;
-}
-
-function routerMounts(text, file, availableFiles) {
-  const scanText = maskComments(text);
-  const bindings = importBindings(scanText);
-  const mounts = [];
-  const useCall = /\b[A-Za-z_$][\w$]*\s*\.\s*use\s*\(/g;
-  let match;
-  while ((match = useCall.exec(scanText))) {
-    const parsed = callArguments(scanText, scanText.indexOf("(", match.index));
-    if (!parsed) continue;
-    useCall.lastIndex = parsed.end;
-    const args = parsed.args.filter(Boolean);
-    if (!args.length) continue;
-    const literal = /^(["'`])(\/[^"'`]*)\1$/.exec(args[0]);
-    const mountPath = literal ? cleanPath(literal[2]) : "/";
-    const identifier = /^([A-Za-z_$][\w$]*)(?:\.[A-Za-z_$][\w$]*)?$/.exec(args.at(-1) || "")?.[1];
-    const child = resolveImportedFile(file, identifier ? bindings.get(identifier) : null, availableFiles);
-    if (child && child !== file) mounts.push({ parent: file, child, path: mountPath, line: lineAt(text, match.index) });
-  }
-  return mounts;
-}
-
-export function joinEndpointPath(base, route) {
-  const left = cleanPath(base || "/");
-  const right = cleanPath(route || "/");
-  if (left === "/") return right;
-  if (right === "/") return left;
-  return cleanPath(`${left}/${right.replace(/^\/+/, "")}`.replace(/\/{2,}/g, "/"));
-}
-
-export function mountedBasePaths(files, sources) {
-  const incoming = new Map();
-  const mounts = [];
-  const available = new Set(files);
-  for (const file of files) {
-    for (const mount of routerMounts(sources.get(file) || "", file, available)) {
-      mounts.push(mount);
-      if (!incoming.has(mount.child)) incoming.set(mount.child, []);
-      incoming.get(mount.child).push(mount);
-    }
-  }
-  const cache = new Map();
-  const resolve = (file, stack = new Set()) => {
-    if (cache.has(file)) return cache.get(file);
-    if (stack.has(file)) return [];
-    const parents = incoming.get(file) || [];
-    if (!parents.length) return [{ path: "", chain: [] }];
-    const paths = [];
-    for (const mount of parents) {
-      for (const base of resolve(mount.parent, new Set(stack).add(file))) {
-        const path = joinEndpointPath(base.path, mount.path);
-        const key = `${path}\0${base.chain.map((item) => `${item.file}:${item.line}:${item.path}`).join("|")}\0${mount.parent}:${mount.line}:${mount.path}`;
-        if (!paths.some((item) => item.key === key)) paths.push({ key, path, chain: [...base.chain, { file: mount.parent, line: mount.line, path: mount.path, child: mount.child }] });
-        if (paths.length >= 32) break;
-      }
-      if (paths.length >= 32) break;
-    }
-    const result = paths.length ? paths.map(({ key: _key, ...item }) => item) : [{ path: "", chain: [] }];
-    cache.set(file, result);
-    return result;
-  };
-  return { paths: new Map(files.map((file) => [file, resolve(file)])), mounts };
-}