rules.yml

# src/entrypoints/rules.yml — the SHIPPED entrypoint ruleset (#72; python `rules.yml` parity).
#
# Decorator `match:` is against the import-table-resolved name (`@nestjs/common.Get`): the module
# specifier kept verbatim, aliases mapped back to the exported name. There is no checker tier.
# Base-class `match:` is against the resolved-or-written base spelling the same way.
version: 1

frameworks:
  nestjs:
    detect: ["@nestjs/common", "@nestjs/core"]
    decorators:
      - id: nestjs.controller
        match: "@nestjs/common.Controller"
        route: {from: positional, index: 0}
      - id: nestjs.verb
        match: "@nestjs/common.{Get,Post,Put,Patch,Delete,Head,Options,All}"
        route: {from: positional, index: 0}
        methods: {from: match_suffix}

  angular:
    detect: ["@angular/core"]
    decorators:
      - id: angular.component
        match: "@angular/core.Component"
      - id: angular.ngmodule
        match: "@angular/core.NgModule"

  nextjs:
    detect: [next]
    files:
      - id: nextjs.app-route
        match: "app/**/route.{ts,tsx,js,mjs}"
        exports: [GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS]
        methods: {from: export_name}
      - id: nextjs.pages-api
        match: "pages/api/**/*.{ts,tsx,js,mjs}"
        exports: [default]
      # The `src/` layout Next.js supports officially (#206). Separate rows, not a loosened glob:
      # `globToRegExp` anchors a pattern containing `/` at the repo root by design, and a file must
      # match a convention path exactly, not anywhere in the tree.
      - id: nextjs.app-route-src
        match: "src/app/**/route.{ts,tsx,js,mjs}"
        exports: [GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS]
        methods: {from: export_name}
      - id: nextjs.pages-api-src
        match: "src/pages/api/**/*.{ts,tsx,js,mjs}"
        exports: [default]

  sveltekit:
    detect: ["@sveltejs/kit"]
    files:
      - id: sveltekit.server
        match: "**/+server.{ts,js}"
        exports: [GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS]
        methods: {from: export_name}

  # Remix, and React Router v7 which absorbed it (#206) — a route module exports named callables,
  # so the file tier resolves them with no resolution work. One rule per export rather than one rule
  # listing all three: the `rule` id is then what tells a consumer whether it is looking at a data
  # loader, a mutation, or the rendered component. `http_methods` stays empty — mapping `loader` to
  # GET and `action` to the mutating verbs needs a per-export method source the grammar lacks, and
  # inventing one here would be a spelling no sibling analyzer has agreed to.
  remix:
    detect: ["@remix-run/node", "@remix-run/react", "@remix-run/server-runtime", "@remix-run/cloudflare", react-router]
    files:
      - id: remix.loader
        match: "app/routes/**/*.{ts,tsx,js,jsx}"
        exports: [loader]
      - id: remix.action
        match: "app/routes/**/*.{ts,tsx,js,jsx}"
        exports: [action]
      - id: remix.route-component
        match: "app/routes/**/*.{ts,tsx,js,jsx}"
        exports: [default]

  # Astro API routes (#206): verb-named exports beside the `.astro` pages. `.astro` files themselves
  # are not parsed, so this covers the `.ts`/`.js` endpoints only. `ALL` is listed because it is a
  # real Astro handler; `methods: {from: export_name}` filters it to [] since it is not an HTTP verb.
  astro:
    detect: [astro]
    files:
      - id: astro.api-route
        match: "src/pages/**/*.{ts,js}"
        exports: [GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS, ALL]
        methods: {from: export_name}

  # ---- non-web (#167). Framework-tier CALL rules: gated on the dependency AND matched on the
  # import-table-resolved callee, so `app.on(...)` in an Express app or on any EventEmitter can
  # never register as Electron. `route` carries the event / channel name for `on`/`handle` rules —
  # the nearest field; python's `route` is HTTP-only.
  electron:
    detect: [electron]
    calls:
      - id: electron.app-on
        match: "electron.app.{on,once}"
        route: {from: positional, index: 0}
        handler: {from: positional, index: -1}
      - id: electron.ipc
        match: "electron.ipcMain.{on,once,handle,handleOnce}"
        route: {from: positional, index: 0}
        handler: {from: positional, index: -1}

  commander:
    detect: [commander]
    calls:
      # `program.command("x").option(...).action(run)` — the chain between `program` and `.action`
      # is one to three dotless segments (a call with parentheses has no dot).
      - id: commander.action
        match: "commander.program.{*,*.*,*.*.*}.action"
        handler: {from: positional, index: -1}

  worker_threads:
    detect: ["node:worker_threads", worker_threads]
    calls:
      - id: worker_threads.parent-port
        match: "{node:worker_threads,worker_threads}.parentPort.{on,once}"
        route: {from: positional, index: 0}
        handler: {from: positional, index: -1}

# Framework-independent tier. Matched on the WRITTEN spelling, never a resolved name, so a shape
# that reads as an HTTP entrypoint is flagged even when no `frameworks:` block knows the library
# (or it is not installed). Confidence `heuristic` is forced by the loader. Runs LAST; a node a
# framework rule already claimed gets no heuristic record.
heuristics:
  decorators:
    - id: heuristic.http-route
      match: "{route,*.route,*.*.route}"
      route: {from: positional, index: 0}
      methods: {from: keyword, name: methods}
    - id: heuristic.http-verb
      match: "{*,*.*}.{get,post,put,patch,delete,head,options,websocket}"
      route: {from: positional, index: 0}
      methods: {from: match_suffix}
  calls:
    # `app.get('/p', handler)` — the record attaches to the HANDLER (the callable the request
    # reaches), `via` is the module-scope call. `use` is deliberate: middleware is reachable from
    # outside just as a route is; filter on http_methods for routes only.
    - id: heuristic.http-verb-call
      match: "{*,*.*}.{get,post,put,patch,delete,all,use}"
      route: {from: positional, index: 0}
      methods: {from: match_suffix}
      handler: {from: positional, index: -1}
    # `process` is a Node global — nothing to gate on, and the spelling is distinctive enough to be
    # a heuristic. Signal and lifecycle handlers are invoked from outside the program.
    - id: heuristic.process-on
      match: "process.{on,once}"
      route: {from: positional, index: 0}
      handler: {from: positional, index: -1}

# Manifest-declared entrypoints: what runs when the package is executed. Confidence `declared`.
manifest:
  - id: manifest.bin
    source: package.json
    field: bin
  - id: manifest.main
    source: package.json
    field: main