cg-code-graph 0.23.4__tar.gz → 0.23.6__tar.gz

{cg_code_graph-0.23.4/cg_code_graph.egg-info → cg_code_graph-0.23.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: cg-code-graph
-Version: 0.23.4
+Version: 0.23.6
 Summary: cg: a code graph of routes, calls, data access and platform boundaries for agents and humans (CLI + MCP server)
 Author: cyberchronos00
 License-Expression: MIT

{cg_code_graph-0.23.4 → cg_code_graph-0.23.6}/cg_code_graph/__init__.py

@@ -1,2 +1,2 @@
 """code-graph: deterministic code knowledge graph (beta)."""
-__version__ = "0.23.4"
+__version__ = "0.23.6"

{cg_code_graph-0.23.4 → cg_code_graph-0.23.6}/cg_code_graph/blindspots.py

@@ -222,11 +222,23 @@ def express_loop_routes(root: Path, files: list[str]) -> dict | None:
 _PHP_LOOPS = re.compile(r"\b(?:foreach|for|while)\s*\(|->\s*(?:each|map|flatMap|eachSpread)\s*\(|\barray_(?:map|walk)\s*\(")
 
 
-def laravel_loop_routes(root: Path, files: list[str]) -> dict | None:
-    """Route::get(...) inside foreach / for / ->each(...) / array_map(...): the URIs come from data, so the Laravel
-    plugin cannot list them."""
+def laravel_loop_routes(root: Path, files: list[str], builder=None) -> dict | None:
+    """Route::get(...) inside foreach / for / ->each(...) / array_map(...) that the Laravel plugin did not unroll.
+
+    Loops over literal data in route files are unrolled (#184); the plugin records every loop it saw in
+    `builder.route_loops` ({file: [{line, end, unrolled, reason}]}). The ones it could not unroll are reported with
+    their reason (`iterable not literal`); the regex below still finds loops outside route files."""
     hits = []
+    reasons: dict[str, str] = {}
+    known = getattr(builder, "route_loops", None) or {}
+    for rel, loops in known.items():
+        for lp in loops:
+            if not lp.get("unrolled"):
+                hits.append((rel, lp["line"]))
+                if lp.get("reason"):
+                    reasons[f"{rel}:{lp['line']}"] = lp["reason"]
     for rel in files:
+        spans = [(lp["line"], lp.get("end") or lp["line"]) for lp in known.get(rel, [])]
         src = _read(root, rel)
         if not src or "Route::" not in src:
             continue
@@ -237,9 +249,17 @@ def laravel_loop_routes(root: Path, files: list[str]) -> dict | None:
                 continue
             if re.search(r"\bRoute::\s*(?:get|post|put|patch|delete|any|match|resource|apiResource|resources|apiResources|view|redirect)\s*\(",
                          src[b0:b1]):
-                hits.append((rel, _line(src, start)))
+                ln = _line(src, start)
+                if not any(lo <= ln <= hi for lo, hi in spans):
+                    hits.append((rel, ln))
                 done_until = b1
-    return _finding("laravel_loop_routes", hits)
+    out = _finding("laravel_loop_routes", hits)
+    if out and reasons:
+        out["reasons"] = {k: reasons[k] for k in out["samples"] if k in reasons}
+        why = sorted(set(out["reasons"].values()))
+        if why:
+            out["what"] = f"{out['what']} ({'; '.join(why)})"
+    return out
 
 
 # ------------------------------------------------------------------------------------------- Django (AST)
@@ -549,7 +569,7 @@ def detect(root: str | Path, files_by_ext: dict[str, list[str]], builder=None, p
     run(nuxt_unevaluable_import_dirs, root)
     run(vue_unresolved_navigation, builder)
     run(ts_unrecognised_http_client, root, js, builder)
-    run(laravel_loop_routes, root, php)
+    run(laravel_loop_routes, root, php, builder)
     py = programs.get("python")
     if py is not None:
         run(django_dynamic_urlpatterns, [(m.file, m.tree) for m in py.modules.values()])

{cg_code_graph-0.23.4 → cg_code_graph-0.23.6}/cg_code_graph/cli.py

@@ -826,6 +826,9 @@ def main(argv=None):
 def _unknown_route(st, spec: str, as_json: bool) -> bool:
     miss = Q.route_failure(st, spec)
     if not miss:
+        note = Q.route_declared_note(st, spec)
+        if note:
+            print(note, file=sys.stderr)
         return False
     if as_json:
         print(json.dumps({"error": miss["error"], "spec": miss["spec"], "suggestions": miss["suggestions"]}))

{cg_code_graph-0.23.4 → cg_code_graph-0.23.6}/cg_code_graph/core/plugin.py

@@ -59,6 +59,9 @@ class GraphBuilder:
         # Pigeon API definitions found by the Dart plugin ({Api: {kind: host | flutter, methods, file}}): bridges.py
         # links their native implementations / native callers
         self.pigeon_apis: dict = {}
+        # loops around route registrations in Laravel route files ({file: [{line, end, unrolled, reason}]}, #184):
+        # the blind-spot detector reports the ones that were not unrolled
+        self.route_loops: dict = {}
         # keyed-hash salt for the markers that stand in for secret values (cg_code_graph/core/redact.py); the indexer
         # sets it from the graph DB before any plugin runs
         self.redact_salt: str | None = None

{cg_code_graph-0.23.4 → cg_code_graph-0.23.6}/cg_code_graph/link.py

@@ -11,8 +11,11 @@ graphs (role backend, frontend or both):
 Matching is deterministic (no guessing):
   - the client path is the extractor's URL template with the origin (scheme://host or the
     unknown server-URL placeholder) and query string removed;
-  - backend URIs are tried as declared and, for routes from routes/api.php, with the `/api`
-    prefix Laravel adds;
+  - backend URIs are tried at the path the server serves them under: a Laravel route of routes/api.php is
+    stored with its API prefix (`apiPrefix` in bootstrap/app.php, a RouteServiceProvider group, `api` by
+    default) and keeps its declared path in attrs.declared_uri. When no prefix configuration was found
+    (the `api` default) the declared path is tried as well, and a route from an older graph without
+    declared_uri gets the `/api` + uri variant (see route_uri_variants);
   - segments match when literal == literal, client placeholder <-> route {param},
     client literal -> route {param} (resolved), or a client segment with an embedded
     placeholder fully matches a route literal (heuristic, e.g. export.{format} ~ export.csv);
@@ -39,6 +42,28 @@ from types import SimpleNamespace
 from .core.model import CONFIDENCE_RANK
 from .core.store import GraphStore
 
+
+_API_ROUTE_FILE = re.compile(r"(^|/)routes/api(\.php$|/)")
+
+
+def route_uri_variants(file: str | None, attrs: dict) -> list[tuple[str, str]]:
+    """(variant, uri) pairs a route answers to. `file` is the route node's file (with or without a repo prefix).
+
+    A Laravel route stores the served path (#191): attrs.uri carries the API prefix and attrs.declared_uri the
+    path as written. The declared path is also tried when the prefix is Laravel's default rather than read from
+    configuration. A route without declared_uri from routes/api.php (an older graph) gets the `/api` variant."""
+    uri = attrs.get("uri")
+    out = [("as-declared", uri)]
+    declared = attrs.get("declared_uri")
+    if declared:
+        out = [("served", uri)]
+        if attrs.get("prefix_from") == "laravel-default" and declared != uri:
+            out.append(("declared, without the default /api prefix", declared))
+        return out
+    if _API_ROUTE_FILE.search(file or "") and uri and not uri.startswith("/api/"):
+        out.append(("api-prefixed", "/api" + uri))
+    return out
+
 PARAM = re.compile(r"^\{(\w+)(\?)?\}$")
 CATCH_ALL = re.compile(r"^\{(\w+)\*(\?)?\}$")   # {rest*} one or more segments, {rest*?} zero or more (TS routers, Next.js)
 PH = re.compile(r"\{[^{}]*\}")
@@ -401,9 +426,7 @@ def link_many(repos: list[tuple[str, str, str]], out_db: str, *, allow: dict | N
                     uri, method = a.get("uri"), a.get("method")
                     if not uri or not method:
                         continue
-                    uris = [("as-declared", uri)]
-                    if (r[1] or "").startswith("routes/api.php") or (r[1] or "").startswith("routes/api/"):
-                        uris.append(("api-prefixed", "/api" + uri))
+                    uris = route_uri_variants(r[1], a)
                     routes.append({"id": mid(name, r[0]), "uri": uri, "method": method, "uris": uris, "server": name,
                                    "file": f"{name}/{r[1]}" if r[1] else None, "line": r[3],
                                    "attrs": dict(a, _file=r[1], _line=r[3])})

{cg_code_graph-0.23.4 → cg_code_graph-0.23.6}/cg_code_graph/plans.py

@@ -21,6 +21,7 @@ from . import presets
 from . import query as Q
 from .core.model import PROPAGATING
 from .core.store import GraphStore
+from .link import route_uri_variants
 
 PLAN_VERSION = 1
 STATUSES = ("draft", "agreed", "in_progress", "implemented", "abandoned")
@@ -419,10 +420,8 @@ class Ctx:
             a = json.loads(r["attrs"] or "{}")
             if not a.get("uri") or not a.get("method"):
                 continue
-            uris = [("as-declared", a["uri"])]
             f = (r["file"] or "").split("/", 1)[-1] if self.combined else (r["file"] or "")
-            if f.startswith("routes/api"):
-                uris.append(("api-prefixed", "/api" + a["uri"]))
+            uris = route_uri_variants(f, a)
             out.append({"id": r["id"], "uri": a["uri"], "method": a["method"], "uris": uris, "file": r["file"], "line": r["line"]})
         return out
 
@@ -796,10 +795,8 @@ def snapshot_clients(st, route_ids, root: str | Path | None = None) -> list[dict
                     a = json.loads(r["attrs"] or "{}")
                     if not a.get("uri") or not a.get("method"):
                         continue
-                    uris = [("as-declared", a["uri"])]
                     rf = (r["file"] or "").split("/", 1)[-1] if combined else (r["file"] or "")
-                    if rf.startswith("routes/api"):
-                        uris.append(("api-prefixed", "/api" + a["uri"]))
+                    uris = route_uri_variants(rf, a)
                     routes.append({"id": r["id"], "uri": a["uri"], "method": a["method"], "uris": uris,
                                    "file": r["file"], "line": r["line"]})
             hit = [m["route"] for m in match_endpoint(c.get("method") or "GET", base + c["path"], routes)["matched"]

{cg_code_graph-0.23.4 → cg_code_graph-0.23.6}/cg_code_graph/plugins/kotlin/plugin.py

@@ -305,6 +305,9 @@ class KotlinPlugin(LanguagePlugin):
         self.calls: list[tuple] = []
         self.unresolved_calls: list[tuple] = []          # (owner_id, name, receiver, line, file obj, decl)
         self.call_branch: dict = {}           # (owner_id, line, name) -> {branch, branch_line} (#88)
+        self.call_default: dict = {}          # (owner_id, line, name) -> parameter whose default holds the call (#212)
+        self.call_args: dict = {}             # (owner_id, line, name) -> (positional count, named labels, trailing lambda)
+        self.fn_params: dict = {}             # function id -> [(name, has default, function type)]
         # properties with a custom accessor, `by lazy` or a delegate are nodes (#89); kept out of by_name / members so
         # a call `x()` never binds to one
         self.props: dict[str, dict] = {}                                   # decl id -> {"property", "accessors"}
@@ -599,11 +602,14 @@ class KotlinPlugin(LanguagePlugin):
                 fq = f"{owner}.{nm}" if owner else nm
                 kind = "method" if cls else "function"
                 params = next((d for d in c.children if d.type == "function_value_parameters"), None)
+                fparams = self._param_defaults(params)
                 dc = Decl(f"{kind}:{fq}{self._variant(kf, mods)}", kind, nm, fq, kf.rel, c.start_point[0] + 1,
                           c.end_point[0] + 1, cls.fqn if cls else None, [], anns, mods, recv,
                           self._params(params) if params is not None else {}, kf.test, self._name_line(c),
                           slots=self._fn_slots(params))
                 self._local_types(c, dc.types)
+                if any(dflt for _n, dflt, _f in fparams):
+                    self.fn_params[dc.id] = fparams
                 self._add_decl(dc, kind)
                 self._local_fns(c, kf, dc)
             elif ty == "enum_entry" and cls is not None:
@@ -1161,12 +1167,77 @@ class KotlinPlugin(LanguagePlugin):
                     if typ:
                         self.navs.append((owner, None, typ, kf.rel, line))
         self.calls.append((owner, name, rtext, line, kf, decl, self._accessor(c) if owner in self.props else None))
+        dp = self._default_param(c)
+        if dp:
+            self.call_default[(owner, line, name)] = dp
+        if args is not None:
+            vas = [x for x in args.children if x.type == "value_argument"]
+            named = {self.t(x.children[0]) for x in vas if any(k.type == "=" for k in x.children) and x.children}
+            spread = any(self.t(x).lstrip().startswith("*") for x in vas)
+            self.call_args[(owner, line, name)] = (None if spread else len(vas) - len(named), named, lam is not None)
+        elif lam is not None:
+            self.call_args[(owner, line, name)] = (0, set(), True)
         if name[:1].isupper():                      # a constructor or a composable: its branch (#88)
             br = self._branch(c)
             if br:
                 self.call_branch[(owner, line, name)] = br
         return False
 
+    def _param_defaults(self, fvp) -> list:
+        """[(name, has a default value, function-typed)] per value parameter of a `function_value_parameters` node."""
+        out = []
+        kids = list(fvp.children) if fvp is not None else []
+        for i, p in enumerate(kids):
+            if p.type != "parameter":
+                continue
+            ids = [x for x in p.children if x.type == "identifier"]
+            if not ids:
+                continue
+            ft = any(x.type == "function_type" or (x.type == "nullable_type" and "->" in self.t(x)) for x in p.children)
+            out.append((self.t(ids[0]), i + 1 < len(kids) and kids[i + 1].type == "=", ft))
+        return out
+
+    def _default_param(self, c) -> str | None:
+        """The parameter whose default value holds call `c` (`fun render(gamut: Int = currentGamut())`), else None."""
+        x = c
+        while x is not None and x.parent is not None:
+            p = x.parent
+            if p.type == "function_value_parameters":
+                prev = x.prev_sibling
+                if prev is None or prev.type != "=":
+                    return None
+                par = prev.prev_sibling
+                ids = [y for y in par.children if y.type == "identifier"] if par is not None and par.type == "parameter" else []
+                return self.t(ids[0]) if ids else None
+            if p.type in ("function_declaration", "lambda_literal", "anonymous_function", "class_body", "function_body"):
+                return None
+            x = p
+        return None
+
+    def _omitted_defaults(self):
+        """A call that leaves out a defaulted argument runs the default: an edge from the caller to what the default
+        calls, at the call site, with `omits_default` and `default_of` (#212). A call that passes it gets none."""
+        if not self._default_edges:
+            return
+        n = 0
+        for owner, tid, rel, line, key in self._default_sites:
+            defs = self._default_edges.get(tid)
+            params = self.fn_params.get(tid)
+            ca = self.call_args.get(key, (0, set(), False))
+            if not defs or not params or ca[0] is None:
+                continue
+            pos, named, trailing = ca
+            given = {nm for nm, _d, _f in params[:pos]} | named
+            if trailing and params[-1][2]:
+                given.add(params[-1][0])
+            left = {nm for nm, dflt, _f in params if dflt and nm not in given}
+            for label, callee, kind in defs:
+                if label in left and callee != owner:
+                    self.b.add_edge(owner, callee, kind, rel, line, HEURISTIC, omits_default=label, default_of=tid)
+                    n += 1
+        if n:
+            self.st["default_argument_sites"] = n
+
     def _branch(self, c) -> dict:
         """The innermost `if` / `else` / `when` entry around a construction or a composable call inside its function
         (#88): attrs.branch (`if (loading)`, `else of if (loading)`, `when Tab.Home`, `else of when (tab)`) and
@@ -1525,6 +1596,7 @@ class KotlinPlugin(LanguagePlugin):
         return []
 
     def _resolve_calls(self):
+        self._default_edges, self._default_sites = defaultdict(list), []
         for owner, name, recv, line, kf, decl, acc in self.calls:
             self._data_access(owner, name, recv, line, kf, decl)
             self._how = self._recv = None
@@ -1543,17 +1615,24 @@ class KotlinPlugin(LanguagePlugin):
                 how["candidates"] = len(targets)
                 self.st["call_candidate_edges"] += len(targets)
             br = self.call_branch.get((owner, line, name), {})
+            dp = self.call_default.get((owner, line, name))
+            da = {"default_arg": dp} if dp else {}
             for t in targets[:MAX_CANDIDATES if self._how == "candidate" else 3]:
                 if t.kind == "class":
-                    self.b.add_edge(owner, t.id, "INSTANTIATES", kf.rel, line, HEURISTIC, **br)
+                    self.b.add_edge(owner, t.id, "INSTANTIATES", kf.rel, line, HEURISTIC, **br, **da)
                     ctor = [m for m in self.members.get(t.fqn, {}).get("init", [])]
                     self.b.add_edge(owner, t.id, "USES_TYPE", kf.rel, line, HEURISTIC, how="constructor call")
                     for m in ctor:
-                        self.b.add_edge(owner, m.id, "CALLS", kf.rel, line, HEURISTIC)
+                        self.b.add_edge(owner, m.id, "CALLS", kf.rel, line, HEURISTIC, **da)
                 else:
                     composable = br and any(a[0] == "Composable" for a in t.annotations)
-                    self.b.add_edge(owner, t.id, "CALLS", kf.rel, line, HEURISTIC, **how, **(br if composable else {}))
+                    self.b.add_edge(owner, t.id, "CALLS", kf.rel, line, HEURISTIC, **how, **(br if composable else {}), **da)
+                    if self._how != "candidate":
+                        self._default_sites.append((owner, t.id, kf.rel, line, (owner, line, name)))
+                if dp:
+                    self._default_edges[owner].append((dp, t.id, "INSTANTIATES" if t.kind == "class" else "CALLS"))
             self.st["calls_resolved"] += 1
+        self._omitted_defaults()
         self._resolve_reads()
         self._resolve_fields()
         self._resolve_copies()

{cg_code_graph-0.23.4 → cg_code_graph-0.23.6}/cg_code_graph/plugins/laravel/plugin.py

@@ -180,6 +180,7 @@ class LaravelPlugin(FrameworkPlugin):
         self.observers, self.listeners, self.schedules, self.bindings = [], [], [], []
         self.seen_cols = set()
         self.records = {r["file"]: r for r in prog.records}
+        self._apply_route_mounts()
         self._parse_config()
         self._parse_migrations()
         self._parse_models()
@@ -196,6 +197,40 @@ class LaravelPlugin(FrameworkPlugin):
         self.tests = LaravelTests(self, prog)
         prog.test_fact_handlers.append(self.tests.handle_fact)
 
+    # ---- route files: served path (#191)
+    def _route_mounts(self) -> dict[str, tuple[str, str]]:
+        """routes file -> (prefix, where it comes from): `withRouting(api:, apiPrefix:)` / `then:` groups in
+        bootstrap/app.php, `Route::prefix(..)->group(base_path(..))` in a (Laravel <= 10) RouteServiceProvider."""
+        out: dict[str, tuple[str, str]] = {}
+        order = sorted(self.records, key=lambda f: (not f.startswith("bootstrap/"), f))
+        for f in order:
+            for m in self.records[f].get("route_mounts") or []:
+                rf = m.get("file")
+                if isinstance(rf, str) and rf not in out and isinstance(m.get("prefix"), str):
+                    out[rf] = (m["prefix"].strip("/"), f)
+        return out
+
+    def _apply_route_mounts(self):
+        """Every route of routes/api.php (and routes/api/) is stored at the path Laravel serves it under: the configured
+        API prefix, `api` when nothing configures it. The declared path stays in `declared_uri`."""
+        mounts = self._route_mounts()
+        for f, r in self.records.items():
+            if not f.startswith("routes/") or not r.get("routes"):
+                continue
+            hit = mounts.get(f)
+            if hit is None and f.startswith("routes/api/"):
+                hit = mounts.get("routes/api.php")
+            if hit is None and (f == "routes/api.php" or f.startswith("routes/api/")):
+                hit = ("api", "laravel-default")
+            if hit is None or not hit[0]:
+                continue
+            prefix, src = hit
+            for rt in r["routes"]:
+                declared = rt.get("full_uri") or "/"
+                rt["declared_uri"] = declared
+                rt["full_uri"] = "/" + "/".join(p for p in (prefix.strip("/"), declared.strip("/")) if p)
+                rt["prefix_from"] = src
+
     # ---- config/*.php
     def _parse_config(self):
         b = self.b
@@ -916,13 +951,20 @@ class LaravelPlugin(FrameworkPlugin):
         cid = self.b.add_node("config", key, lang="php")
         self.b.add_edge(fn.id, cid, "READS_CONFIG", fn.file, line, conf)
 
+    def _recv_of(self, c, h) -> dict:
+        """attrs.recv for an edge into a job's handle() inherited from a base class: the job class, so the base
+        handle()'s `$this->execute()` reaches only this job's override (#148)."""
+        if c.methods.get("handle") is h or c.methods.get("__invoke") is h:
+            return {}
+        return {"recv": [f"{c.kind}:{c.fqcn}"]}
+
     def _dispatch(self, fn, cls, line, conf):
         c = self.prog.cls(cls)
         if not c:
             return
         h = self.prog.find_method(c.fqcn, "handle") or self.prog.find_method(c.fqcn, "__invoke")
         if self._is_job(c.fqcn) and h:
-            self.b.add_edge(fn.id, h.id, "DISPATCHES", fn.file, line, conf, via="job")
+            self.b.add_edge(fn.id, h.id, "DISPATCHES", fn.file, line, conf, via="job", **self._recv_of(c, h))
         else:
             eid = self.b.add_node("event", c.fqcn, name=c.fqcn.split("\\")[-1], fqn=c.fqcn, file=c.file, line=c.line,
                                   module=module_of(c.file), lang="php")
@@ -1011,6 +1053,8 @@ class LaravelPlugin(FrameworkPlugin):
         from ..php.inline_guards import for_action
         n = 0
         for f, r in self.records.items():
+            if r.get("route_loops"):
+                b.route_loops[f] = r["route_loops"]
             for rt in r.get("routes") or []:
                 for verb in rt["methods"]:
                     key = f"{verb.upper()} {rt['full_uri']}"
@@ -1021,6 +1065,15 @@ class LaravelPlugin(FrameworkPlugin):
                         self.stats["route_middleware_unresolved"] = self.stats.get("route_middleware_unresolved", 0) + 1
                     attrs = {"name": rt.get("name") or None, "middleware": mws if rt.get("middleware") is not None else None,
                              "uri": rt["full_uri"], "method": verb.upper()}
+                    if rt.get("declared_uri"):
+                        attrs["declared_uri"] = rt["declared_uri"]
+                        attrs["prefix_from"] = rt.get("prefix_from")
+                    for k, ak in (("defaults", "defaults"), ("wheres", "where")):
+                        if rt.get(k):
+                            attrs[ak] = rt[k]
+                    if rt.get("unrolled_from"):
+                        u = rt["unrolled_from"]
+                        attrs["unrolled_from"] = {"file": f, "line": u.get("line"), "binding": u.get("binding") or {}}
                     if rt.get("webhook_client"):
                         attrs["webhook_client"] = rt["webhook_client"]
                         attrs["webhook_framework"] = "laravel-webhook-client"
@@ -1197,7 +1250,7 @@ class LaravelPlugin(FrameworkPlugin):
                 if h:
                     jid = b.add_node("job", c.fqcn, name=c.fqcn.split("\\")[-1], fqn=c.fqcn, file=c.file, line=c.line,
                                      module=module_of(c.file), lang="php", entry_kind="queue_job")
-                    b.add_edge(jid, h.id, "HANDLED_BY", c.file, h.line, EXACT)
+                    b.add_edge(jid, h.id, "HANDLED_BY", c.file, h.line, EXACT, **self._recv_of(c, h))
                     self.stats["jobs"] += 1
             if c.fqcn.startswith("App\\Listeners\\"):
                 h = prog.find_method(c.fqcn, "handle")

{cg_code_graph-0.23.4 → cg_code_graph-0.23.6}/cg_code_graph/plugins/laravel/tests.py

@@ -7,8 +7,8 @@
   TEST_CALLS -> the file (beforeEach, uses(...) and other file-level setup);
 * HTTP test calls (`$this->getJson('/api/x')`, `->actingAs($u)->post(route('x.store'))`, Pest `get('/x')`,
   `$this->json('PATCH', '/x')`, and the same calls through project helpers such as `$this->getAs('/x')` whose URL /
-  verb are parameters) -> TEST_HTTP -> the matching route (URIs matched like cross-repo links, with the
-  `/api` prefix Laravel adds to routes/api.php; `route('name')` by route name).
+  verb are parameters) -> TEST_HTTP -> the matching route (URIs matched like cross-repo links, on the served path: routes/api.php routes
+  carry the API prefix Laravel adds; `route('name')` by route name).
 
 Edges made by test code are retyped to non-propagating TEST_* kinds afterwards (cg_code_graph/tests_index.py), so
 tests never change blast radius, caller counts or entry tagging. `cg tests <symbol|route>` walks them on purpose.
@@ -154,7 +154,7 @@ class LaravelTests:
 
     # ---- after reference emission
     def contribute(self) -> dict:
-        from ...link import match_endpoint
+        from ...link import match_endpoint, route_uri_variants
         b, prog = self.lp.b, self.prog
         st = defaultdict(int)
         self._expand_helpers(st)
@@ -162,9 +162,7 @@ class LaravelTests:
         for nid, n in b.nodes.items():
             if n.kind != "route" or not n.attrs.get("uri") or not n.attrs.get("method"):
                 continue
-            uris = [("as-declared", n.attrs["uri"])]
-            if (n.file or "").startswith(("routes/api.php", "routes/api/")):
-                uris.append(("api-prefixed", "/api" + n.attrs["uri"]))
+            uris = route_uri_variants(n.file, n.attrs)
             routes.append({"id": nid, "uri": n.attrs["uri"], "method": n.attrs["method"], "uris": uris})
             if n.attrs.get("name"):
                 by_name[n.attrs["name"]].append(n)