[pitboss] phase 22: Track F.2 + F.3 — Cross-language framework probes + data store / external service / dangerous-local detection

src/surface/lang/common.rs

@@ -0,0 +1,131 @@
+//! Shared helpers used by the per-(language, framework) probes.
+//!
+//! Each probe extracts an [`EntryPoint`] node from a parsed source file
+//! by walking the framework's route declaration shape.  These helpers
+//! cover the bookkeeping common to every probe: building a stable
+//! [`SourceLocation`] from a tree-sitter node, decoding common string
+//! literal shapes, and identifier-based auth marker lookups.
+
+use crate::surface::{SourceLocation, relative_path_string};
+use std::path::Path;
+use tree_sitter::Node;
+
+/// Build a [`SourceLocation`] for the start of `node`, relative to
+/// `scan_root` when supplied.
+pub fn loc_for(node: Node<'_>, file_rel: &str) -> SourceLocation {
+    let pos = node.start_position();
+    SourceLocation::new(file_rel, (pos.row + 1) as u32, (pos.column + 1) as u32)
+}
+
+/// Project-relative POSIX file string used as the [`SourceLocation`]
+/// `file` field across every node a probe emits.
+pub fn rel_file(path: &Path, scan_root: Option<&Path>) -> String {
+    relative_path_string(path, scan_root)
+}
+
+/// Strip Python / JS / Ruby / PHP string-literal prefixes (`b"…"`,
+/// `r"…"`, `f"…"`, leading `'`/`"`) and return the literal content.
+/// Used by every probe that lifts a route path out of a string node.
+pub fn unquote(raw: &str) -> String {
+    let trimmed = raw.trim();
+    let mut s = trimmed;
+    // Python prefixes
+    while let Some(rest) = s.strip_prefix(['b', 'r', 'B', 'R', 'f', 'F']) {
+        if rest.starts_with('\'') || rest.starts_with('"') {
+            s = rest;
+        } else {
+            break;
+        }
+    }
+    s.trim_start_matches(['\'', '"', '`'])
+        .trim_end_matches(['\'', '"', '`'])
+        .to_string()
+}
+
+/// Read the literal text of a tree-sitter `string` node and return its
+/// unquoted content; `None` when the slice is not valid UTF-8.
+pub fn string_node_value(node: Node<'_>, bytes: &[u8]) -> Option<String> {
+    Some(unquote(node.utf8_text(bytes).ok()?))
+}
+
+/// Return `true` when the leaf segment of `text` (split on `.` or `::`)
+/// matches one of the entries in `markers`, case-insensitive on the
+/// underscored form.  Used by every probe's auth-decorator allowlist.
+pub fn leaf_matches(text: &str, markers: &[&str]) -> bool {
+    let leaf = text.rsplit(['.', ':']).next().unwrap_or(text).trim();
+    markers.iter().any(|m| leaf.eq_ignore_ascii_case(m))
+}
+
+/// Walk every descendant of `root` whose kind matches `target_kind`,
+/// invoking `visit` on each match.  Bounded by recursion on tree-sitter
+/// node count.
+pub fn for_each_node<'tree, F>(root: Node<'tree>, target_kind: &str, mut visit: F)
+where
+    F: FnMut(Node<'tree>),
+{
+    fn recurse<'tree, F>(node: Node<'tree>, kind: &str, visit: &mut F)
+    where
+        F: FnMut(Node<'tree>),
+    {
+        if node.kind() == kind {
+            visit(node);
+        }
+        let mut cursor = node.walk();
+        for child in node.children(&mut cursor) {
+            recurse(child, kind, visit);
+        }
+    }
+    recurse(root, target_kind, &mut visit);
+}
+
+/// Find the first child of `parent` whose kind matches `kind`, with a
+/// `child_by_field_name(kind)` fast path.  Used by Java probes where
+/// `class_declaration` / `method_declaration` modifiers / body live as
+/// unnamed children rather than fielded children in tree-sitter-java.
+pub fn child_or_named<'tree>(parent: Node<'tree>, kind: &str) -> Option<Node<'tree>> {
+    if let Some(n) = parent.child_by_field_name(kind) {
+        return Some(n);
+    }
+    let mut cursor = parent.walk();
+    parent.children(&mut cursor).find(|c| c.kind() == kind)
+}
+
+/// Walk every descendant of `root`, invoking `visit` once per node.
+/// Useful when a probe needs to look at multiple node kinds in a single
+/// pass (e.g. annotations + method declarations on the same walk).
+pub fn for_each_node_any<'tree, F>(root: Node<'tree>, mut visit: F)
+where
+    F: FnMut(Node<'tree>),
+{
+    fn recurse<'tree, F>(node: Node<'tree>, visit: &mut F)
+    where
+        F: FnMut(Node<'tree>),
+    {
+        visit(node);
+        let mut cursor = node.walk();
+        for child in node.children(&mut cursor) {
+            recurse(child, visit);
+        }
+    }
+    recurse(root, &mut visit);
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn unquote_strips_python_prefixes() {
+        assert_eq!(unquote("b\"path\""), "path");
+        assert_eq!(unquote("r'/api'"), "/api");
+        assert_eq!(unquote("f\"/users/{id}\""), "/users/{id}");
+        assert_eq!(unquote("\"plain\""), "plain");
+    }
+
+    #[test]
+    fn leaf_matches_handles_dot_and_colon_paths() {
+        assert!(leaf_matches("flask_login.login_required", &["login_required"]));
+        assert!(leaf_matches("Auth::JwtRequired", &["JwtRequired"]));
+        assert!(!leaf_matches("OtherDecorator", &["login_required"]));
+    }
+}

src/surface/lang/go_gin.rs

@@ -0,0 +1,174 @@
+//! Go + gin framework probe.
+//!
+//! Detects gin route registration:
+//!
+//! * `r.GET("/path", handler)` / `.POST(...)` / `.PUT` / `.DELETE`
+//!   on a `*gin.Engine` or `*gin.RouterGroup`.
+//! * `r.Group("/prefix").GET("/sub", ...)` chained shapes.
+//! * `r.Use(middleware...)` followed by route registrations — the
+//!   middleware list is consulted for auth markers
+//!   ([`AUTH_MIDDLEWARES`]).
+//!
+//! Also recognises echo (`e.GET(...)`) and chi (`r.Get(...)`) by the
+//! same shape — receiver name `e` / `r` / `router` / `engine`.
+
+use crate::entry_points::HttpMethod;
+use crate::surface::lang::common::{leaf_matches, loc_for, rel_file, string_node_value};
+use crate::surface::{EntryPoint, Framework, SourceLocation, SurfaceNode};
+use std::path::Path;
+use tree_sitter::{Node, Tree};
+
+pub const AUTH_MIDDLEWARES: &[&str] = &[
+    "AuthRequired",
+    "JWT",
+    "JWTAuth",
+    "Auth",
+    "RequireAuth",
+    "RequireUser",
+    "VerifyToken",
+    "BasicAuth",
+];
+
+const VERBS: &[&str] = &[
+    "GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS", "HEAD", "Any",
+    "Get", "Post", "Put", "Delete", "Patch", "Options", "Head",
+];
+
+pub fn detect_gin_routes(
+    tree: &Tree,
+    bytes: &[u8],
+    path: &Path,
+    scan_root: Option<&Path>,
+) -> Vec<SurfaceNode> {
+    let file_rel = rel_file(path, scan_root);
+    let mut out = Vec::new();
+    walk_calls(tree.root_node(), &mut |call| {
+        if let Some(node) = match_gin_call(call, bytes, &file_rel) {
+            out.push(node);
+        }
+    });
+    out
+}
+
+fn walk_calls<'tree, F: FnMut(Node<'tree>)>(node: Node<'tree>, visit: &mut F) {
+    if node.kind() == "call_expression" {
+        visit(node);
+    }
+    let mut cursor = node.walk();
+    for child in node.children(&mut cursor) {
+        walk_calls(child, visit);
+    }
+}
+
+fn match_gin_call(call: Node, bytes: &[u8], file_rel: &str) -> Option<SurfaceNode> {
+    let func = call.child_by_field_name("function")?;
+    if func.kind() != "selector_expression" {
+        return None;
+    }
+    let operand = func.child_by_field_name("operand")?;
+    let field = func.child_by_field_name("field")?;
+    let field_text = field.utf8_text(bytes).ok()?;
+    if !VERBS.contains(&field_text) {
+        return None;
+    }
+    let operand_text = operand.utf8_text(bytes).ok()?;
+    if !receiver_is_gin(operand_text) {
+        return None;
+    }
+    let method = HttpMethod::from_ident(&field_text.to_ascii_uppercase())?;
+    let args = call.child_by_field_name("arguments")?;
+    let mut cursor = args.walk();
+    let positional: Vec<Node> = args
+        .children(&mut cursor)
+        .filter(|n| !matches!(n.kind(), "(" | ")" | ","))
+        .collect();
+    let route = positional.first().and_then(|n| string_node_value(*n, bytes))?;
+    let handler_node = positional.iter().rev().find(|n| {
+        matches!(
+            n.kind(),
+            "identifier" | "selector_expression" | "func_literal"
+        )
+    })?;
+    let handler_name = handler_node
+        .utf8_text(bytes)
+        .ok()
+        .map(str::to_string)
+        .unwrap_or_default();
+    let auth_required = positional[1..]
+        .iter()
+        .filter(|n| !std::ptr::eq(*n, handler_node))
+        .any(|n| arg_is_auth_marker(*n, bytes));
+    Some(SurfaceNode::EntryPoint(EntryPoint {
+        location: loc_for(call, file_rel),
+        framework: Framework::Gin,
+        method,
+        route,
+        handler_name,
+        handler_location: SourceLocation::new(
+            file_rel,
+            (handler_node.start_position().row + 1) as u32,
+            (handler_node.start_position().column + 1) as u32,
+        ),
+        auth_required,
+    }))
+}
+
+fn receiver_is_gin(text: &str) -> bool {
+    let leaf = text.rsplit('.').next().unwrap_or(text).trim();
+    let lower = leaf.to_ascii_lowercase();
+    lower == "r"
+        || lower == "g"
+        || lower == "e"
+        || lower == "router"
+        || lower == "engine"
+        || lower == "group"
+        || lower.ends_with("router")
+        || lower.ends_with("group")
+        || lower.ends_with("engine")
+}
+
+fn arg_is_auth_marker(node: Node, bytes: &[u8]) -> bool {
+    match node.kind() {
+        "identifier" | "selector_expression" => node
+            .utf8_text(bytes)
+            .map(|t| leaf_matches(t, AUTH_MIDDLEWARES))
+            .unwrap_or(false),
+        "call_expression" => {
+            let Some(callee) = node.child_by_field_name("function") else {
+                return false;
+            };
+            let Ok(text) = callee.utf8_text(bytes) else {
+                return false;
+            };
+            leaf_matches(text, AUTH_MIDDLEWARES)
+        }
+        _ => false,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::path::PathBuf;
+
+    fn parse(src: &str) -> (Tree, Vec<u8>) {
+        let mut parser = tree_sitter::Parser::new();
+        parser
+            .set_language(&tree_sitter_go::LANGUAGE.into())
+            .unwrap();
+        (parser.parse(src, None).unwrap(), src.as_bytes().to_vec())
+    }
+
+    #[test]
+    fn detects_get() {
+        let src = "package main\nimport \"github.com/gin-gonic/gin\"\nfunc main() {\n  r := gin.Default()\n  r.GET(\"/users\", listUsers)\n}\nfunc listUsers(c *gin.Context) {}\n";
+        let (tree, bytes) = parse(src);
+        let nodes = detect_gin_routes(&tree, &bytes, &PathBuf::from("main.go"), None);
+        assert_eq!(nodes.len(), 1);
+        let SurfaceNode::EntryPoint(ep) = &nodes[0] else {
+            panic!()
+        };
+        assert_eq!(ep.method, HttpMethod::GET);
+        assert_eq!(ep.route, "/users");
+    }
+}

src/surface/lang/go_http.rs

@@ -0,0 +1,129 @@
+//! Go + `net/http` framework probe.
+//!
+//! Recognises the canonical route registration shapes:
+//!
+//! * `http.HandleFunc("/path", handler)`
+//! * `http.Handle("/path", handler)`
+//! * `mux.HandleFunc("/path", handler)` (any `*http.ServeMux` receiver)
+//! * `http.NewServeMux()` derived receivers
+//!
+//! Method is `GET` by default — `net/http` registrations are
+//! method-agnostic at the routing layer; the handler dispatches on
+//! `r.Method` internally.
+
+use crate::entry_points::HttpMethod;
+use crate::surface::lang::common::{loc_for, rel_file, string_node_value};
+use crate::surface::{EntryPoint, Framework, SourceLocation, SurfaceNode};
+use std::path::Path;
+use tree_sitter::{Node, Tree};
+
+pub fn detect_go_http_routes(
+    tree: &Tree,
+    bytes: &[u8],
+    path: &Path,
+    scan_root: Option<&Path>,
+) -> Vec<SurfaceNode> {
+    let file_rel = rel_file(path, scan_root);
+    let mut out = Vec::new();
+    walk_calls(tree.root_node(), &mut |call| {
+        if let Some(node) = match_handle_call(call, bytes, &file_rel) {
+            out.push(node);
+        }
+    });
+    out
+}
+
+fn walk_calls<'tree, F: FnMut(Node<'tree>)>(node: Node<'tree>, visit: &mut F) {
+    if node.kind() == "call_expression" {
+        visit(node);
+    }
+    let mut cursor = node.walk();
+    for child in node.children(&mut cursor) {
+        walk_calls(child, visit);
+    }
+}
+
+fn match_handle_call(call: Node, bytes: &[u8], file_rel: &str) -> Option<SurfaceNode> {
+    let func = call.child_by_field_name("function")?;
+    if func.kind() != "selector_expression" {
+        return None;
+    }
+    let operand = func.child_by_field_name("operand")?;
+    let field = func.child_by_field_name("field")?;
+    let field_text = field.utf8_text(bytes).ok()?;
+    if field_text != "HandleFunc" && field_text != "Handle" {
+        return None;
+    }
+    let operand_text = operand.utf8_text(bytes).ok()?;
+    let leaf = operand_text.rsplit('.').next().unwrap_or(operand_text);
+    if leaf != "http"
+        && !operand_text.contains("Mux")
+        && !operand_text.contains("mux")
+        && !operand_text.contains("Server")
+        && !operand_text.contains("Router")
+        && !operand_text.contains("router")
+    {
+        return None;
+    }
+    let args = call.child_by_field_name("arguments")?;
+    let mut cursor = args.walk();
+    let positional: Vec<Node> = args
+        .children(&mut cursor)
+        .filter(|n| !matches!(n.kind(), "(" | ")" | ","))
+        .collect();
+    if positional.len() < 2 {
+        return None;
+    }
+    let route = string_node_value(positional[0], bytes)?;
+    let handler_node = positional[1];
+    let handler_name = handler_function_name(handler_node, bytes).unwrap_or_default();
+    Some(SurfaceNode::EntryPoint(EntryPoint {
+        location: loc_for(call, file_rel),
+        framework: Framework::NetHttp,
+        method: HttpMethod::GET,
+        route,
+        handler_name,
+        handler_location: SourceLocation::new(
+            file_rel,
+            (handler_node.start_position().row + 1) as u32,
+            (handler_node.start_position().column + 1) as u32,
+        ),
+        auth_required: false,
+    }))
+}
+
+fn handler_function_name(node: Node, bytes: &[u8]) -> Option<String> {
+    match node.kind() {
+        "identifier" | "selector_expression" => node.utf8_text(bytes).ok().map(str::to_string),
+        "func_literal" => Some("anonymous".to_string()),
+        _ => node.utf8_text(bytes).ok().map(str::to_string),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::path::PathBuf;
+
+    fn parse(src: &str) -> (Tree, Vec<u8>) {
+        let mut parser = tree_sitter::Parser::new();
+        parser
+            .set_language(&tree_sitter_go::LANGUAGE.into())
+            .unwrap();
+        (parser.parse(src, None).unwrap(), src.as_bytes().to_vec())
+    }
+
+    #[test]
+    fn detects_handle_func() {
+        let src = "package main\nimport \"net/http\"\nfunc main() {\n  http.HandleFunc(\"/users\", listUsers)\n}\nfunc listUsers(w http.ResponseWriter, r *http.Request) {}\n";
+        let (tree, bytes) = parse(src);
+        let nodes = detect_go_http_routes(&tree, &bytes, &PathBuf::from("main.go"), None);
+        assert_eq!(nodes.len(), 1);
+        let SurfaceNode::EntryPoint(ep) = &nodes[0] else {
+            panic!()
+        };
+        assert_eq!(ep.framework, Framework::NetHttp);
+        assert_eq!(ep.route, "/users");
+        assert_eq!(ep.handler_name, "listUsers");
+    }
+}

src/surface/lang/java_quarkus.rs

@@ -0,0 +1,297 @@
+//! Java + Quarkus framework probe.
+//!
+//! Quarkus uses JAX-RS (`jakarta.ws.rs`) for HTTP routing on top of
+//! `RESTEasy Reactive` / `Quarkus REST`.  The annotations are
+//! identical to plain JAX-RS, so this probe overlaps with
+//! [`super::java_servlet`] but emits the [`Framework::JaxRs`] tag with
+//! a Quarkus-specific recogniser:
+//!
+//! * The class is annotated with `@ApplicationScoped`,
+//!   `@RequestScoped`, or `@Singleton` (Quarkus DI markers); OR
+//! * The file imports a `quarkus`-prefixed package; OR
+//! * The class extends a Quarkus-known reactive base type
+//!   (`PanacheRepository`, `Multi`, `Uni`).
+//!
+//! Auth markers: `@Authenticated`, `@RolesAllowed`, `@PermitAll`,
+//! `@DenyAll` (Quarkus Security).
+
+use crate::entry_points::HttpMethod;
+use crate::surface::lang::common::{loc_for, rel_file};
+use crate::surface::{EntryPoint, Framework, SourceLocation, SurfaceNode};
+use std::path::Path;
+use tree_sitter::{Node, Tree};
+
+pub const AUTH_ANNOTATIONS: &[&str] = &[
+    "Authenticated",
+    "RolesAllowed",
+    "DenyAll",
+    "RequiresAuthentication",
+];
+
+const QUARKUS_DI: &[&str] = &[
+    "ApplicationScoped",
+    "RequestScoped",
+    "Singleton",
+    "Dependent",
+    "Path",
+];
+
+const JAXRS_VERBS: &[(&str, HttpMethod)] = &[
+    ("GET", HttpMethod::GET),
+    ("POST", HttpMethod::POST),
+    ("PUT", HttpMethod::PUT),
+    ("DELETE", HttpMethod::DELETE),
+    ("PATCH", HttpMethod::PATCH),
+    ("HEAD", HttpMethod::HEAD),
+    ("OPTIONS", HttpMethod::OPTIONS),
+];
+
+pub fn detect_quarkus_routes(
+    tree: &Tree,
+    bytes: &[u8],
+    path: &Path,
+    scan_root: Option<&Path>,
+) -> Vec<SurfaceNode> {
+    let file_rel = rel_file(path, scan_root);
+    if !file_uses_quarkus(tree.root_node(), bytes) {
+        return Vec::new();
+    }
+    let mut out = Vec::new();
+    walk_classes(tree.root_node(), &mut |class| {
+        if !class_is_quarkus_resource(class, bytes) {
+            return;
+        }
+        let class_path = class_path_annotation(class, bytes).unwrap_or_default();
+        let class_auth = class_has_auth_annotation(class, bytes);
+        let Some(body) = crate::surface::lang::common::child_or_named(class, "class_body") else {
+            return;
+        };
+        let mut cursor = body.walk();
+        for member in body.children(&mut cursor) {
+            if member.kind() != "method_declaration" {
+                continue;
+            }
+            if let Some((method, method_path, method_auth)) =
+                method_mapping(member, bytes, &class_path)
+            {
+                let name = method_name(member, bytes).unwrap_or_default();
+                out.push(SurfaceNode::EntryPoint(EntryPoint {
+                    location: loc_for(member, &file_rel),
+                    framework: Framework::JaxRs,
+                    method,
+                    route: method_path,
+                    handler_name: name,
+                    handler_location: SourceLocation::new(
+                        file_rel.clone(),
+                        (member.start_position().row + 1) as u32,
+                        (member.start_position().column + 1) as u32,
+                    ),
+                    auth_required: class_auth || method_auth,
+                }));
+            }
+        }
+    });
+    out
+}
+
+fn file_uses_quarkus(root: Node, bytes: &[u8]) -> bool {
+    let mut cursor = root.walk();
+    for child in root.children(&mut cursor) {
+        if child.kind() == "import_declaration"
+            && let Ok(text) = child.utf8_text(bytes)
+            && (text.contains("io.quarkus") || text.contains("jakarta.ws.rs"))
+        {
+            return true;
+        }
+    }
+    false
+}
+
+fn class_is_quarkus_resource(class: Node, bytes: &[u8]) -> bool {
+    let modifiers = match crate::surface::lang::common::child_or_named(class, "modifiers") {
+        Some(m) => m,
+        None => return false,
+    };
+    let mut cursor = modifiers.walk();
+    for ann in modifiers.children(&mut cursor) {
+        if !is_annotation(ann) {
+            continue;
+        }
+        if let Some(name) = annotation_name(ann, bytes) {
+            let leaf = name.rsplit('.').next().unwrap_or(&name);
+            if QUARKUS_DI.iter().any(|d| leaf.eq_ignore_ascii_case(d)) {
+                return true;
+            }
+        }
+    }
+    false
+}
+
+fn walk_classes<'tree, F>(node: Node<'tree>, visit: &mut F)
+where
+    F: FnMut(Node<'tree>),
+{
+    if node.kind() == "class_declaration" {
+        visit(node);
+    }
+    let mut cursor = node.walk();
+    for child in node.children(&mut cursor) {
+        walk_classes(child, visit);
+    }
+}
+
+fn class_path_annotation(class: Node, bytes: &[u8]) -> Option<String> {
+    annotation_string_arg(class, bytes, "Path")
+}
+
+fn class_has_auth_annotation(class: Node, bytes: &[u8]) -> bool {
+    let modifiers = match crate::surface::lang::common::child_or_named(class, "modifiers") {
+        Some(m) => m,
+        None => return false,
+    };
+    let mut cursor = modifiers.walk();
+    for ann in modifiers.children(&mut cursor) {
+        if !is_annotation(ann) {
+            continue;
+        }
+        if let Some(name) = annotation_name(ann, bytes) {
+            let leaf = name.rsplit('.').next().unwrap_or(&name);
+            if AUTH_ANNOTATIONS.iter().any(|a| leaf.eq_ignore_ascii_case(a)) {
+                return true;
+            }
+        }
+    }
+    false
+}
+
+fn method_mapping(method: Node, bytes: &[u8], class_path: &str) -> Option<(HttpMethod, String, bool)> {
+    let modifiers = crate::surface::lang::common::child_or_named(method, "modifiers")?;
+    let mut cursor = modifiers.walk();
+    let mut verb: Option<HttpMethod> = None;
+    let mut method_path = String::new();
+    let mut auth = false;
+    for ann in modifiers.children(&mut cursor) {
+        if !is_annotation(ann) {
+            continue;
+        }
+        let Some(name) = annotation_name(ann, bytes) else {
+            continue;
+        };
+        let leaf = name.rsplit('.').next().unwrap_or(&name);
+        if let Some((_, m)) = JAXRS_VERBS.iter().find(|(n, _)| n.eq_ignore_ascii_case(leaf)) {
+            verb = Some(*m);
+        }
+        if leaf == "Path"
+            && let Some(p) = annotation_string_arg_from_node(ann, bytes)
+        {
+            method_path = p;
+        }
+        if AUTH_ANNOTATIONS.iter().any(|a| leaf.eq_ignore_ascii_case(a)) {
+            auth = true;
+        }
+    }
+    let v = verb?;
+    let combined = if class_path.is_empty() {
+        method_path
+    } else if method_path.is_empty() {
+        class_path.to_string()
+    } else {
+        format!("{}/{}", class_path.trim_end_matches('/'), method_path.trim_start_matches('/'))
+    };
+    Some((v, combined, auth))
+}
+
+fn annotation_string_arg(class: Node, bytes: &[u8], target_name: &str) -> Option<String> {
+    let modifiers = crate::surface::lang::common::child_or_named(class, "modifiers")?;
+    let mut cursor = modifiers.walk();
+    for ann in modifiers.children(&mut cursor) {
+        if !is_annotation(ann) {
+            continue;
+        }
+        let Some(name) = annotation_name(ann, bytes) else {
+            continue;
+        };
+        let leaf = name.rsplit('.').next().unwrap_or(&name);
+        if leaf == target_name {
+            return annotation_string_arg_from_node(ann, bytes);
+        }
+    }
+    None
+}
+
+fn annotation_string_arg_from_node(ann: Node, bytes: &[u8]) -> Option<String> {
+    let args = ann.child_by_field_name("arguments")?;
+    let raw = args.utf8_text(bytes).ok()?;
+    let start = raw.find('"')? + 1;
+    let end = raw[start..].find('"')? + start;
+    Some(raw[start..end].to_string())
+}
+
+fn annotation_name(ann: Node, bytes: &[u8]) -> Option<String> {
+    ann.child_by_field_name("name")
+        .and_then(|n| n.utf8_text(bytes).ok())
+        .map(str::to_string)
+}
+
+fn method_name(method: Node, bytes: &[u8]) -> Option<String> {
+    method
+        .child_by_field_name("name")
+        .and_then(|n| n.utf8_text(bytes).ok())
+        .map(str::to_string)
+}
+
+fn is_annotation(node: Node) -> bool {
+    matches!(node.kind(), "annotation" | "marker_annotation")
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::path::PathBuf;
+
+    fn parse(src: &str) -> (Tree, Vec<u8>) {
+        let mut parser = tree_sitter::Parser::new();
+        parser
+            .set_language(&tree_sitter_java::LANGUAGE.into())
+            .unwrap();
+        (parser.parse(src, None).unwrap(), src.as_bytes().to_vec())
+    }
+
+    #[test]
+    fn detects_quarkus_resource() {
+        let src = r#"
+import io.quarkus.runtime.Quarkus;
+import jakarta.ws.rs.GET;
+import jakarta.ws.rs.Path;
+
+@ApplicationScoped
+@Path("/api")
+public class GreetResource {
+    @GET
+    @Path("/hello")
+    public String hello() { return "hi"; }
+}
+"#;
+        let (tree, bytes) = parse(src);
+        let nodes = detect_quarkus_routes(&tree, &bytes, &PathBuf::from("GreetResource.java"), None);
+        assert_eq!(nodes.len(), 1);
+        let SurfaceNode::EntryPoint(ep) = &nodes[0] else {
+            panic!()
+        };
+        assert_eq!(ep.method, HttpMethod::GET);
+        assert_eq!(ep.route, "/api/hello");
+    }
+
+    #[test]
+    fn ignores_non_quarkus_class() {
+        let src = r#"
+public class C {
+    @GetMapping("/x")
+    public void x() {}
+}
+"#;
+        let (tree, bytes) = parse(src);
+        let nodes = detect_quarkus_routes(&tree, &bytes, &PathBuf::from("C.java"), None);
+        assert!(nodes.is_empty());
+    }
+}

src/surface/lang/java_servlet.rs

@@ -0,0 +1,285 @@
+//! Java + Servlet (JAX-RS / Jakarta REST) framework probe.
+//!
+//! Recognises:
+//!
+//! * `@WebServlet("/path")` annotated `HttpServlet` subclasses — every
+//!   `doGet` / `doPost` / `doPut` / `doDelete` method is one entry-point.
+//! * `@Path("/path")` annotated JAX-RS resource methods with verb
+//!   annotation `@GET` / `@POST` / `@PUT` / `@DELETE` / `@PATCH`.
+//!
+//! Auth markers: `@DenyAll`, `@RolesAllowed`, `@PermitAll` — the
+//! presence of any of these implies a security configuration is
+//! actively gating the resource (we report `auth_required = true`
+//! conservatively for `@RolesAllowed` and `@DenyAll`).
+
+use crate::entry_points::HttpMethod;
+use crate::surface::lang::common::{loc_for, rel_file};
+use crate::surface::{EntryPoint, Framework, SourceLocation, SurfaceNode};
+use std::path::Path;
+use tree_sitter::{Node, Tree};
+
+pub const AUTH_ANNOTATIONS: &[&str] = &[
+    "RolesAllowed",
+    "DenyAll",
+    "RequiresAuthentication",
+    "RequiresUser",
+];
+
+const SERVLET_VERBS: &[(&str, HttpMethod)] = &[
+    ("doGet", HttpMethod::GET),
+    ("doPost", HttpMethod::POST),
+    ("doPut", HttpMethod::PUT),
+    ("doDelete", HttpMethod::DELETE),
+    ("doHead", HttpMethod::HEAD),
+    ("doOptions", HttpMethod::OPTIONS),
+];
+
+const JAXRS_VERBS: &[(&str, HttpMethod)] = &[
+    ("GET", HttpMethod::GET),
+    ("POST", HttpMethod::POST),
+    ("PUT", HttpMethod::PUT),
+    ("DELETE", HttpMethod::DELETE),
+    ("PATCH", HttpMethod::PATCH),
+    ("HEAD", HttpMethod::HEAD),
+    ("OPTIONS", HttpMethod::OPTIONS),
+];
+
+pub fn detect_servlet_routes(
+    tree: &Tree,
+    bytes: &[u8],
+    path: &Path,
+    scan_root: Option<&Path>,
+) -> Vec<SurfaceNode> {
+    let file_rel = rel_file(path, scan_root);
+    let mut out = Vec::new();
+    walk_classes(tree.root_node(), &mut |class| {
+        let class_path_servlet = class_web_servlet_path(class, bytes);
+        let class_path_jaxrs = class_jaxrs_path(class, bytes);
+        let class_auth = class_has_auth_annotation(class, bytes);
+        let Some(body) = crate::surface::lang::common::child_or_named(class, "class_body") else {
+            return;
+        };
+        let mut cursor = body.walk();
+        for member in body.children(&mut cursor) {
+            if member.kind() != "method_declaration" {
+                continue;
+            }
+            let name = method_name(member, bytes).unwrap_or_default();
+
+            // HttpServlet shape
+            if let Some(class_path) = class_path_servlet.as_deref()
+                && let Some((_, method)) = SERVLET_VERBS
+                    .iter()
+                    .find(|(verb, _)| *verb == name.as_str())
+            {
+                out.push(SurfaceNode::EntryPoint(EntryPoint {
+                    location: loc_for(member, &file_rel),
+                    framework: Framework::JaxRs,
+                    method: *method,
+                    route: class_path.to_string(),
+                    handler_name: name.clone(),
+                    handler_location: SourceLocation::new(
+                        file_rel.clone(),
+                        (member.start_position().row + 1) as u32,
+                        (member.start_position().column + 1) as u32,
+                    ),
+                    auth_required: class_auth,
+                }));
+                continue;
+            }
+
+            // JAX-RS shape
+            if let Some((method, method_path, method_auth)) =
+                jaxrs_method_mapping(member, bytes, class_path_jaxrs.as_deref().unwrap_or(""))
+            {
+                out.push(SurfaceNode::EntryPoint(EntryPoint {
+                    location: loc_for(member, &file_rel),
+                    framework: Framework::JaxRs,
+                    method,
+                    route: method_path,
+                    handler_name: name,
+                    handler_location: SourceLocation::new(
+                        file_rel.clone(),
+                        (member.start_position().row + 1) as u32,
+                        (member.start_position().column + 1) as u32,
+                    ),
+                    auth_required: class_auth || method_auth,
+                }));
+            }
+        }
+    });
+    out
+}
+
+fn walk_classes<'tree, F>(node: Node<'tree>, visit: &mut F)
+where
+    F: FnMut(Node<'tree>),
+{
+    if node.kind() == "class_declaration" {
+        visit(node);
+    }
+    let mut cursor = node.walk();
+    for child in node.children(&mut cursor) {
+        walk_classes(child, visit);
+    }
+}
+
+fn class_web_servlet_path(class: Node, bytes: &[u8]) -> Option<String> {
+    annotation_string_arg(class, bytes, "WebServlet")
+}
+
+fn class_jaxrs_path(class: Node, bytes: &[u8]) -> Option<String> {
+    annotation_string_arg(class, bytes, "Path")
+}
+
+fn class_has_auth_annotation(class: Node, bytes: &[u8]) -> bool {
+    let modifiers = match crate::surface::lang::common::child_or_named(class, "modifiers") {
+        Some(m) => m,
+        None => return false,
+    };
+    let mut cursor = modifiers.walk();
+    for ann in modifiers.children(&mut cursor) {
+        if !is_annotation(ann) {
+            continue;
+        }
+        if let Some(name) = annotation_name(ann, bytes)
+            && AUTH_ANNOTATIONS.iter().any(|a| {
+                name.rsplit('.').next().unwrap_or(&name).eq_ignore_ascii_case(a)
+            })
+        {
+            return true;
+        }
+    }
+    false
+}
+
+fn jaxrs_method_mapping(method: Node, bytes: &[u8], class_path: &str) -> Option<(HttpMethod, String, bool)> {
+    let modifiers = crate::surface::lang::common::child_or_named(method, "modifiers")?;
+    let mut cursor = modifiers.walk();
+    let mut verb: Option<HttpMethod> = None;
+    let mut method_path = String::new();
+    let mut auth = false;
+    for ann in modifiers.children(&mut cursor) {
+        if !is_annotation(ann) {
+            continue;
+        }
+        let Some(name) = annotation_name(ann, bytes) else {
+            continue;
+        };
+        let leaf = name.rsplit('.').next().unwrap_or(&name);
+        if let Some((_, m)) = JAXRS_VERBS.iter().find(|(n, _)| n.eq_ignore_ascii_case(leaf)) {
+            verb = Some(*m);
+        }
+        if leaf == "Path"
+            && let Some(path) = annotation_string_arg_from_node(ann, bytes)
+        {
+            method_path = path;
+        }
+        if AUTH_ANNOTATIONS
+            .iter()
+            .any(|a| leaf.eq_ignore_ascii_case(a))
+        {
+            auth = true;
+        }
+    }
+    let v = verb?;
+    let combined = if class_path.is_empty() {
+        method_path
+    } else if method_path.is_empty() {
+        class_path.to_string()
+    } else {
+        format!("{}/{}", class_path.trim_end_matches('/'), method_path.trim_start_matches('/'))
+    };
+    Some((v, combined, auth))
+}
+
+fn annotation_string_arg(class: Node, bytes: &[u8], target_name: &str) -> Option<String> {
+    let modifiers = crate::surface::lang::common::child_or_named(class, "modifiers")?;
+    let mut cursor = modifiers.walk();
+    for ann in modifiers.children(&mut cursor) {
+        if !is_annotation(ann) {
+            continue;
+        }
+        let Some(name) = annotation_name(ann, bytes) else {
+            continue;
+        };
+        let leaf = name.rsplit('.').next().unwrap_or(&name);
+        if leaf == target_name {
+            return annotation_string_arg_from_node(ann, bytes);
+        }
+    }
+    None
+}
+
+fn annotation_string_arg_from_node(ann: Node, bytes: &[u8]) -> Option<String> {
+    let args = ann.child_by_field_name("arguments")?;
+    let raw = args.utf8_text(bytes).ok()?;
+    let start = raw.find('"')? + 1;
+    let end = raw[start..].find('"')? + start;
+    Some(raw[start..end].to_string())
+}
+
+fn annotation_name(ann: Node, bytes: &[u8]) -> Option<String> {
+    ann.child_by_field_name("name")
+        .and_then(|n| n.utf8_text(bytes).ok())
+        .map(str::to_string)
+}
+
+fn method_name(method: Node, bytes: &[u8]) -> Option<String> {
+    method
+        .child_by_field_name("name")
+        .and_then(|n| n.utf8_text(bytes).ok())
+        .map(str::to_string)
+}
+
+fn is_annotation(node: Node) -> bool {
+    matches!(node.kind(), "annotation" | "marker_annotation")
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::path::PathBuf;
+
+    fn parse(src: &str) -> (Tree, Vec<u8>) {
+        let mut parser = tree_sitter::Parser::new();
+        parser
+            .set_language(&tree_sitter_java::LANGUAGE.into())
+            .unwrap();
+        (parser.parse(src, None).unwrap(), src.as_bytes().to_vec())
+    }
+
+    #[test]
+    fn detects_jaxrs_get() {
+        let src = r#"
+@Path("/users")
+public class UsersResource {
+    @GET
+    @Path("/{id}")
+    public User get() { return null; }
+}
+"#;
+        let (tree, bytes) = parse(src);
+        let nodes = detect_servlet_routes(&tree, &bytes, &PathBuf::from("UsersResource.java"), None);
+        assert!(!nodes.is_empty());
+        let SurfaceNode::EntryPoint(ep) = &nodes[0] else {
+            panic!()
+        };
+        assert_eq!(ep.method, HttpMethod::GET);
+        assert_eq!(ep.route, "/users/{id}");
+    }
+
+    #[test]
+    fn detects_servlet_doget() {
+        let src = r#"
+@WebServlet("/admin")
+public class Admin extends HttpServlet {
+    public void doGet(HttpServletRequest req, HttpServletResponse resp) {}
+    public void doPost(HttpServletRequest req, HttpServletResponse resp) {}
+}
+"#;
+        let (tree, bytes) = parse(src);
+        let nodes = detect_servlet_routes(&tree, &bytes, &PathBuf::from("Admin.java"), None);
+        assert_eq!(nodes.len(), 2);
+    }
+}

src/surface/lang/java_spring.rs

@@ -0,0 +1,305 @@
+//! Java + Spring framework probe.
+//!
+//! Recognises Spring controller methods annotated with
+//! `@RequestMapping` / `@GetMapping` / `@PostMapping` / `@PutMapping`
+//! / `@PatchMapping` / `@DeleteMapping`.  The route path is the
+//! concatenation of class-level `@RequestMapping(value=...)` /
+//! `@RestController` and method-level `value=...` arguments.
+//!
+//! `auth_required` fires when the method, the enclosing class, or the
+//! `value=` argument lists a Spring-Security annotation
+//! ([`AUTH_ANNOTATIONS`]).
+
+use crate::entry_points::HttpMethod;
+use crate::surface::lang::common::{leaf_matches, loc_for, rel_file, unquote};
+use crate::surface::{EntryPoint, Framework, SourceLocation, SurfaceNode};
+use std::path::Path;
+use tree_sitter::{Node, Tree};
+
+pub const AUTH_ANNOTATIONS: &[&str] = &[
+    "PreAuthorize",
+    "PostAuthorize",
+    "Secured",
+    "RolesAllowed",
+    "AuthenticationPrincipal",
+];
+
+const MAPPING_ANNOTATIONS: &[(&str, Option<HttpMethod>)] = &[
+    ("RequestMapping", None),
+    ("GetMapping", Some(HttpMethod::GET)),
+    ("PostMapping", Some(HttpMethod::POST)),
+    ("PutMapping", Some(HttpMethod::PUT)),
+    ("PatchMapping", Some(HttpMethod::PATCH)),
+    ("DeleteMapping", Some(HttpMethod::DELETE)),
+];
+
+pub fn detect_spring_routes(
+    tree: &Tree,
+    bytes: &[u8],
+    path: &Path,
+    scan_root: Option<&Path>,
+) -> Vec<SurfaceNode> {
+    let file_rel = rel_file(path, scan_root);
+    let mut out = Vec::new();
+    walk_classes(tree.root_node(), &mut |class| {
+        let class_path = class_request_mapping_path(class, bytes);
+        let class_auth = class_has_auth_annotation(class, bytes);
+        let Some(body) = crate::surface::lang::common::child_or_named(class, "class_body") else {
+            return;
+        };
+        let mut cursor = body.walk();
+        for member in body.children(&mut cursor) {
+            if member.kind() != "method_declaration" {
+                continue;
+            }
+            if let Some((method, route_path, auth)) =
+                method_mapping(member, bytes, &class_path)
+            {
+                let auth_required = class_auth || auth;
+                let handler_name = method_name(member, bytes).unwrap_or_default();
+                out.push(SurfaceNode::EntryPoint(EntryPoint {
+                    location: loc_for(member, &file_rel),
+                    framework: Framework::Spring,
+                    method,
+                    route: route_path,
+                    handler_name,
+                    handler_location: SourceLocation::new(
+                        file_rel.clone(),
+                        (member.start_position().row + 1) as u32,
+                        (member.start_position().column + 1) as u32,
+                    ),
+                    auth_required,
+                }));
+            }
+        }
+    });
+    out
+}
+
+fn walk_classes<'tree, F>(node: Node<'tree>, visit: &mut F)
+where
+    F: FnMut(Node<'tree>),
+{
+    if node.kind() == "class_declaration" {
+        visit(node);
+    }
+    let mut cursor = node.walk();
+    for child in node.children(&mut cursor) {
+        walk_classes(child, visit);
+    }
+}
+
+fn class_request_mapping_path(class: Node, bytes: &[u8]) -> String {
+    let modifiers = match crate::surface::lang::common::child_or_named(class, "modifiers") {
+        Some(m) => m,
+        None => return String::new(),
+    };
+    let mut cursor = modifiers.walk();
+    for ann in modifiers.children(&mut cursor) {
+        if !is_annotation(ann) {
+            continue;
+        }
+        let Some((name, args_text)) = annotation_name_and_args(ann, bytes) else {
+            continue;
+        };
+        if name == "RequestMapping" {
+            return extract_first_path(&args_text);
+        }
+    }
+    String::new()
+}
+
+fn class_has_auth_annotation(class: Node, bytes: &[u8]) -> bool {
+    let modifiers = match crate::surface::lang::common::child_or_named(class, "modifiers") {
+        Some(m) => m,
+        None => return false,
+    };
+    let mut cursor = modifiers.walk();
+    for ann in modifiers.children(&mut cursor) {
+        if !is_annotation(ann) {
+            continue;
+        }
+        if let Some((name, _)) = annotation_name_and_args(ann, bytes)
+            && AUTH_ANNOTATIONS
+                .iter()
+                .any(|a| leaf_matches(&name, &[a]))
+        {
+            return true;
+        }
+    }
+    false
+}
+
+fn method_mapping(
+    method: Node,
+    bytes: &[u8],
+    class_path: &str,
+) -> Option<(HttpMethod, String, bool)> {
+    let modifiers = crate::surface::lang::common::child_or_named(method, "modifiers")?;
+    let mut cursor = modifiers.walk();
+    let mut auth = false;
+    let mut found: Option<(HttpMethod, String)> = None;
+    for ann in modifiers.children(&mut cursor) {
+        if !is_annotation(ann) {
+            continue;
+        }
+        let Some((name, args_text)) = annotation_name_and_args(ann, bytes) else {
+            continue;
+        };
+        if AUTH_ANNOTATIONS
+            .iter()
+            .any(|a| leaf_matches(&name, &[a]))
+        {
+            auth = true;
+        }
+        if found.is_some() {
+            continue;
+        }
+        for (ann_name, default_method) in MAPPING_ANNOTATIONS {
+            if name == *ann_name {
+                let mut method_route = extract_first_path(&args_text);
+                if method_route.is_empty() && !class_path.is_empty() {
+                    // Class-only mapping; method has no path.
+                    method_route = class_path.to_string();
+                } else if !class_path.is_empty() {
+                    method_route = format!("{}/{}", class_path.trim_end_matches('/'), method_route.trim_start_matches('/'));
+                }
+                let method = default_method
+                    .or_else(|| extract_request_method_from_args(&args_text))
+                    .unwrap_or(HttpMethod::GET);
+                found = Some((method, method_route));
+                break;
+            }
+        }
+    }
+    let (m, p) = found?;
+    Some((m, p, auth))
+}
+
+fn is_annotation(node: Node) -> bool {
+    matches!(
+        node.kind(),
+        "annotation" | "marker_annotation"
+    )
+}
+
+/// Returns `(annotation_name, raw_args_text)` for an annotation node.
+fn annotation_name_and_args(ann: Node, bytes: &[u8]) -> Option<(String, String)> {
+    let name_node = ann.child_by_field_name("name")?;
+    let raw_name = name_node.utf8_text(bytes).ok()?;
+    let leaf = raw_name.rsplit('.').next().unwrap_or(raw_name).to_string();
+    let args_text = ann
+        .child_by_field_name("arguments")
+        .and_then(|a| a.utf8_text(bytes).ok())
+        .unwrap_or("")
+        .to_string();
+    Some((leaf, args_text))
+}
+
+fn extract_first_path(args_text: &str) -> String {
+    // Look for the first `"..."` literal.
+    let mut chars = args_text.chars().peekable();
+    while let Some(c) = chars.next() {
+        if c == '"' {
+            let mut buf = String::new();
+            for c in chars.by_ref() {
+                if c == '"' {
+                    return buf;
+                }
+                buf.push(c);
+            }
+        }
+    }
+    String::new()
+}
+
+fn extract_request_method_from_args(args_text: &str) -> Option<HttpMethod> {
+    // RequestMapping(method = RequestMethod.POST)
+    for verb in ["GET", "POST", "PUT", "DELETE", "PATCH", "HEAD", "OPTIONS"] {
+        if args_text.contains(&format!("RequestMethod.{}", verb)) {
+            return HttpMethod::from_ident(verb);
+        }
+    }
+    None
+}
+
+fn method_name(method: Node, bytes: &[u8]) -> Option<String> {
+    method
+        .child_by_field_name("name")
+        .and_then(|n| n.utf8_text(bytes).ok())
+        .map(str::to_string)
+}
+
+#[allow(dead_code)]
+fn read_string_literal(node: Node, bytes: &[u8]) -> Option<String> {
+    let raw = node.utf8_text(bytes).ok()?;
+    Some(unquote(raw))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::path::PathBuf;
+
+    fn parse(src: &str) -> (Tree, Vec<u8>) {
+        let mut parser = tree_sitter::Parser::new();
+        parser
+            .set_language(&tree_sitter_java::LANGUAGE.into())
+            .unwrap();
+        (parser.parse(src, None).unwrap(), src.as_bytes().to_vec())
+    }
+
+    #[test]
+    fn detects_get_mapping() {
+        let src = r#"
+@RestController
+public class UserController {
+    @GetMapping("/users")
+    public List<User> list() { return null; }
+}
+"#;
+        let (tree, bytes) = parse(src);
+        let nodes = detect_spring_routes(&tree, &bytes, &PathBuf::from("UserController.java"), None);
+        assert_eq!(nodes.len(), 1);
+        let SurfaceNode::EntryPoint(ep) = &nodes[0] else {
+            panic!()
+        };
+        assert_eq!(ep.method, HttpMethod::GET);
+        assert_eq!(ep.route, "/users");
+        assert_eq!(ep.handler_name, "list");
+    }
+
+    #[test]
+    fn class_request_mapping_prefix_concatenates() {
+        let src = r#"
+@RequestMapping("/api")
+public class C {
+    @PostMapping("/users")
+    public void create() {}
+}
+"#;
+        let (tree, bytes) = parse(src);
+        let nodes = detect_spring_routes(&tree, &bytes, &PathBuf::from("C.java"), None);
+        let SurfaceNode::EntryPoint(ep) = &nodes[0] else {
+            panic!()
+        };
+        assert_eq!(ep.route, "/api/users");
+    }
+
+    #[test]
+    fn pre_authorize_marks_auth() {
+        let src = r#"
+public class C {
+    @PreAuthorize("hasRole('ADMIN')")
+    @GetMapping("/admin")
+    public void admin() {}
+}
+"#;
+        let (tree, bytes) = parse(src);
+        let nodes = detect_spring_routes(&tree, &bytes, &PathBuf::from("C.java"), None);
+        let SurfaceNode::EntryPoint(ep) = &nodes[0] else {
+            panic!()
+        };
+        assert!(ep.auth_required);
+    }
+}

src/surface/lang/js_express.rs

@@ -0,0 +1,231 @@
+//! JavaScript / TypeScript + Express framework probe.
+//!
+//! Detects route registration calls of the form `app.METHOD(path, ...)`
+//! / `router.METHOD(path, ...)` for the standard set of HTTP verbs plus
+//! `all` / `use`.  The handler is the *last* function-shaped argument
+//! (Express convention: `(path, ...middleware, handler)`).
+//!
+//! `auth_required` fires when any positional argument before the
+//! handler is an identifier matching one of the auth-middleware names
+//! in [`AUTH_MIDDLEWARES`] (passport's `requireAuth`, custom guards),
+//! or when an inline `passport.authenticate(...)` call appears in the
+//! middleware list.
+
+use crate::entry_points::HttpMethod;
+use crate::surface::lang::common::{leaf_matches, loc_for, rel_file, string_node_value};
+use crate::surface::{EntryPoint, Framework, SourceLocation, SurfaceNode};
+use std::path::Path;
+use tree_sitter::{Node, Tree};
+
+pub const AUTH_MIDDLEWARES: &[&str] = &[
+    "requireAuth",
+    "requireUser",
+    "isAuthenticated",
+    "ensureAuthenticated",
+    "ensureLoggedIn",
+    "authenticate",
+    "authMiddleware",
+    "verifyToken",
+    "verifyJwt",
+    "checkJwt",
+    "passport",
+    "jwt",
+];
+
+const VERBS: &[&str] = &[
+    "get", "post", "put", "delete", "patch", "options", "head", "all",
+];
+
+pub fn detect_express_routes(
+    tree: &Tree,
+    bytes: &[u8],
+    path: &Path,
+    scan_root: Option<&Path>,
+) -> Vec<SurfaceNode> {
+    let file_rel = rel_file(path, scan_root);
+    let mut out = Vec::new();
+    walk_calls(tree.root_node(), &mut |call| {
+        if let Some(node) = match_express_call(call, bytes, &file_rel) {
+            out.push(node);
+        }
+    });
+    out
+}
+
+fn walk_calls<'tree, F: FnMut(Node<'tree>)>(node: Node<'tree>, visit: &mut F) {
+    if matches!(node.kind(), "call_expression") {
+        visit(node);
+    }
+    let mut cursor = node.walk();
+    for child in node.children(&mut cursor) {
+        walk_calls(child, visit);
+    }
+}
+
+fn match_express_call(call: Node, bytes: &[u8], file_rel: &str) -> Option<SurfaceNode> {
+    let func = call.child_by_field_name("function")?;
+    if func.kind() != "member_expression" {
+        return None;
+    }
+    let object = func.child_by_field_name("object")?;
+    if !receiver_is_express(object, bytes) {
+        return None;
+    }
+    let prop = func.child_by_field_name("property")?;
+    let prop_text = prop.utf8_text(bytes).ok()?;
+    if !VERBS.contains(&prop_text) {
+        return None;
+    }
+    let method = HttpMethod::from_ident(prop_text).unwrap_or(HttpMethod::GET);
+    let args = call.child_by_field_name("arguments")?;
+    let mut cursor = args.walk();
+    let mut positional: Vec<Node> = args.children(&mut cursor).collect();
+    positional.retain(|n| n.kind() != "(" && n.kind() != ")" && n.kind() != ",");
+    let route = positional
+        .first()
+        .filter(|n| n.kind() == "string" || n.kind() == "template_string")
+        .and_then(|n| string_node_value(*n, bytes))
+        .unwrap_or_default();
+    if route.is_empty() && prop_text != "use" {
+        // bare `app.use(handler)` is middleware, not an entry point
+        return None;
+    }
+    let handler_node = find_handler(&positional)?;
+    let handler_id = handler_node.id();
+    let auth_required = positional[1..]
+        .iter()
+        .filter(|n| n.id() != handler_id)
+        .any(|n| arg_is_auth_marker(*n, bytes));
+    let handler_name = handler_function_name(handler_node, bytes).unwrap_or_default();
+    Some(SurfaceNode::EntryPoint(EntryPoint {
+        location: loc_for(call, file_rel),
+        framework: Framework::Express,
+        method,
+        route,
+        handler_name,
+        handler_location: SourceLocation::new(
+            file_rel,
+            (handler_node.start_position().row + 1) as u32,
+            (handler_node.start_position().column + 1) as u32,
+        ),
+        auth_required,
+    }))
+}
+
+fn find_handler<'a>(positional: &[Node<'a>]) -> Option<Node<'a>> {
+    positional
+        .iter()
+        .rev()
+        .find(|n| {
+            matches!(
+                n.kind(),
+                "arrow_function"
+                    | "function"
+                    | "function_expression"
+                    | "function_declaration"
+                    | "identifier"
+                    | "member_expression"
+            )
+        })
+        .copied()
+}
+
+fn handler_function_name(node: Node, bytes: &[u8]) -> Option<String> {
+    if matches!(node.kind(), "identifier" | "member_expression") {
+        return node.utf8_text(bytes).ok().map(str::to_string);
+    }
+    if let Some(name_node) = node.child_by_field_name("name")
+        && let Ok(name) = name_node.utf8_text(bytes)
+    {
+        return Some(name.to_string());
+    }
+    None
+}
+
+fn arg_is_auth_marker(node: Node, bytes: &[u8]) -> bool {
+    match node.kind() {
+        "identifier" | "member_expression" => node
+            .utf8_text(bytes)
+            .map(|t| leaf_matches(t, AUTH_MIDDLEWARES))
+            .unwrap_or(false),
+        "call_expression" => {
+            let Some(callee) = node.child_by_field_name("function") else {
+                return false;
+            };
+            let Ok(text) = callee.utf8_text(bytes) else {
+                return false;
+            };
+            leaf_matches(text, AUTH_MIDDLEWARES) || text.contains("passport.authenticate")
+        }
+        _ => false,
+    }
+}
+
+fn receiver_is_express(object: Node, bytes: &[u8]) -> bool {
+    fn name_matches(text: &str) -> bool {
+        let lower = text.to_ascii_lowercase();
+        lower == "app"
+            || lower == "router"
+            || lower == "server"
+            || lower.ends_with("_app")
+            || lower.ends_with("router")
+            || lower.ends_with("api")
+    }
+    match object.kind() {
+        "identifier" => object.utf8_text(bytes).ok().is_some_and(name_matches),
+        "member_expression" => object
+            .child_by_field_name("property")
+            .and_then(|p| p.utf8_text(bytes).ok())
+            .is_some_and(name_matches),
+        "call_expression" => {
+            let Some(callee) = object.child_by_field_name("function") else {
+                return false;
+            };
+            let Ok(text) = callee.utf8_text(bytes) else {
+                return false;
+            };
+            let leaf = text.rsplit('.').next().unwrap_or(text);
+            leaf == "express" || leaf == "Router" || leaf == "createApp"
+        }
+        _ => false,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::path::PathBuf;
+
+    fn parse(src: &str) -> (Tree, Vec<u8>) {
+        let mut parser = tree_sitter::Parser::new();
+        parser
+            .set_language(&tree_sitter_javascript::LANGUAGE.into())
+            .unwrap();
+        (parser.parse(src, None).unwrap(), src.as_bytes().to_vec())
+    }
+
+    #[test]
+    fn detects_get_route() {
+        let src = "const app = express();\napp.get('/users', (req, res) => res.send('ok'));\n";
+        let (tree, bytes) = parse(src);
+        let nodes = detect_express_routes(&tree, &bytes, &PathBuf::from("server.js"), None);
+        assert_eq!(nodes.len(), 1);
+        let SurfaceNode::EntryPoint(ep) = &nodes[0] else {
+            panic!()
+        };
+        assert_eq!(ep.framework, Framework::Express);
+        assert_eq!(ep.method, HttpMethod::GET);
+        assert_eq!(ep.route, "/users");
+    }
+
+    #[test]
+    fn detects_auth_middleware() {
+        let src = "app.post('/secret', requireAuth, (req, res) => {});\n";
+        let (tree, bytes) = parse(src);
+        let nodes = detect_express_routes(&tree, &bytes, &PathBuf::from("server.js"), None);
+        let SurfaceNode::EntryPoint(ep) = &nodes[0] else {
+            panic!()
+        };
+        assert!(ep.auth_required);
+    }
+}

src/surface/lang/js_koa.rs

@@ -0,0 +1,193 @@
+//! JavaScript / TypeScript + Koa framework probe.
+//!
+//! Koa apps register routes through `koa-router` (or `@koa/router`):
+//! `router.get(path, handler)`, `router.post(path, ...middleware,
+//! handler)`, etc.  The receiver is named `router`, `r`, or has a
+//! `_router`/`Router` suffix.  Additional Koa-specific recognition:
+//!
+//! * `router.use('/path', subrouter.routes())` is *not* an
+//!   entry-point — the inner middleware chain is.  Filtered by
+//!   ignoring `use` for path-less middleware mounting.
+
+use crate::entry_points::HttpMethod;
+use crate::surface::lang::common::{leaf_matches, loc_for, rel_file, string_node_value};
+use crate::surface::{EntryPoint, Framework, SourceLocation, SurfaceNode};
+use std::path::Path;
+use tree_sitter::{Node, Tree};
+
+pub const AUTH_MIDDLEWARES: &[&str] = &[
+    "requireAuth",
+    "requireUser",
+    "isAuthenticated",
+    "ensureAuthenticated",
+    "authenticate",
+    "authMiddleware",
+    "verifyToken",
+    "verifyJwt",
+    "checkJwt",
+    "passport",
+    "jwt",
+    "koaJwt",
+];
+
+const VERBS: &[&str] = &[
+    "get", "post", "put", "delete", "patch", "options", "head", "all",
+];
+
+pub fn detect_koa_routes(
+    tree: &Tree,
+    bytes: &[u8],
+    path: &Path,
+    scan_root: Option<&Path>,
+) -> Vec<SurfaceNode> {
+    let file_rel = rel_file(path, scan_root);
+    let mut out = Vec::new();
+    walk_calls(tree.root_node(), &mut |call| {
+        if let Some(node) = match_koa_call(call, bytes, &file_rel) {
+            out.push(node);
+        }
+    });
+    out
+}
+
+fn walk_calls<'tree, F: FnMut(Node<'tree>)>(node: Node<'tree>, visit: &mut F) {
+    if matches!(node.kind(), "call_expression") {
+        visit(node);
+    }
+    let mut cursor = node.walk();
+    for child in node.children(&mut cursor) {
+        walk_calls(child, visit);
+    }
+}
+
+fn match_koa_call(call: Node, bytes: &[u8], file_rel: &str) -> Option<SurfaceNode> {
+    let func = call.child_by_field_name("function")?;
+    if func.kind() != "member_expression" {
+        return None;
+    }
+    let object = func.child_by_field_name("object")?;
+    if !receiver_is_koa_router(object, bytes) {
+        return None;
+    }
+    let prop = func.child_by_field_name("property")?;
+    let prop_text = prop.utf8_text(bytes).ok()?;
+    if !VERBS.contains(&prop_text) {
+        return None;
+    }
+    let method = HttpMethod::from_ident(prop_text).unwrap_or(HttpMethod::GET);
+    let args = call.child_by_field_name("arguments")?;
+    let mut cursor = args.walk();
+    let mut positional: Vec<Node> = args.children(&mut cursor).collect();
+    positional.retain(|n| n.kind() != "(" && n.kind() != ")" && n.kind() != ",");
+    let route_idx = positional
+        .iter()
+        .position(|n| matches!(n.kind(), "string" | "template_string"))?;
+    let route = string_node_value(positional[route_idx], bytes).unwrap_or_default();
+    let handler_node = positional.iter().rev().find(|n| {
+        matches!(
+            n.kind(),
+            "arrow_function"
+                | "function"
+                | "function_expression"
+                | "function_declaration"
+                | "identifier"
+                | "member_expression"
+        )
+    })?;
+    let auth_required = positional
+        .iter()
+        .filter(|n| !std::ptr::eq(*n, handler_node))
+        .any(|n| arg_is_auth_marker(*n, bytes));
+    let handler_name = handler_function_name(*handler_node, bytes).unwrap_or_default();
+    Some(SurfaceNode::EntryPoint(EntryPoint {
+        location: loc_for(call, file_rel),
+        framework: Framework::Express, // koa shares the Express variant tag — Phase 22 reuses
+        method,
+        route,
+        handler_name,
+        handler_location: SourceLocation::new(
+            file_rel,
+            (handler_node.start_position().row + 1) as u32,
+            (handler_node.start_position().column + 1) as u32,
+        ),
+        auth_required,
+    }))
+}
+
+fn handler_function_name(node: Node, bytes: &[u8]) -> Option<String> {
+    if matches!(node.kind(), "identifier" | "member_expression") {
+        return node.utf8_text(bytes).ok().map(str::to_string);
+    }
+    if let Some(name_node) = node.child_by_field_name("name")
+        && let Ok(name) = name_node.utf8_text(bytes)
+    {
+        return Some(name.to_string());
+    }
+    None
+}
+
+fn arg_is_auth_marker(node: Node, bytes: &[u8]) -> bool {
+    match node.kind() {
+        "identifier" | "member_expression" => node
+            .utf8_text(bytes)
+            .map(|t| leaf_matches(t, AUTH_MIDDLEWARES))
+            .unwrap_or(false),
+        "call_expression" => {
+            let Some(callee) = node.child_by_field_name("function") else {
+                return false;
+            };
+            let Ok(text) = callee.utf8_text(bytes) else {
+                return false;
+            };
+            leaf_matches(text, AUTH_MIDDLEWARES)
+        }
+        _ => false,
+    }
+}
+
+fn receiver_is_koa_router(object: Node, bytes: &[u8]) -> bool {
+    fn name_matches(text: &str) -> bool {
+        let lower = text.to_ascii_lowercase();
+        lower == "router" || lower == "r" || lower.ends_with("_router") || lower.ends_with("router")
+    }
+    match object.kind() {
+        "identifier" => object.utf8_text(bytes).ok().is_some_and(name_matches),
+        "member_expression" => object
+            .child_by_field_name("property")
+            .and_then(|p| p.utf8_text(bytes).ok())
+            .is_some_and(name_matches),
+        "call_expression" => {
+            let Some(callee) = object.child_by_field_name("function") else {
+                return false;
+            };
+            let Ok(text) = callee.utf8_text(bytes) else {
+                return false;
+            };
+            let leaf = text.rsplit('.').next().unwrap_or(text);
+            leaf == "Router" || leaf == "KoaRouter"
+        }
+        _ => false,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::path::PathBuf;
+
+    fn parse(src: &str) -> (Tree, Vec<u8>) {
+        let mut parser = tree_sitter::Parser::new();
+        parser
+            .set_language(&tree_sitter_javascript::LANGUAGE.into())
+            .unwrap();
+        (parser.parse(src, None).unwrap(), src.as_bytes().to_vec())
+    }
+
+    #[test]
+    fn detects_router_get() {
+        let src = "const router = new Router();\nrouter.get('/users', async ctx => { ctx.body = []; });\n";
+        let (tree, bytes) = parse(src);
+        let nodes = detect_koa_routes(&tree, &bytes, &PathBuf::from("server.js"), None);
+        assert_eq!(nodes.len(), 1);
+    }
+}

src/surface/lang/mod.rs

@@ -1,6 +1,37 @@
-//! Per-language framework probes.  Phase 21 ships Python + Flask;
-//! Phase 22 generalises to FastAPI / Django, Java Spring / JAX-RS,
-//! Ruby Rails / Sinatra, Go net/http / gin, Rust axum / actix /
-//! rocket, JS/TS Express + Next.js.
+//! Per-language framework probes.
+//!
+//! Phase 21 shipped Python + Flask.  Phase 22 generalises detection to:
+//! Python (FastAPI, Django), JS/TS (Express, Koa, Next.js), Java
+//! (Spring, Servlet/JAX-RS, Quarkus), Go (`net/http`, gin), PHP
+//! (Laravel, Slim), Ruby (Sinatra, Rails), Rust (axum, actix-web).
+//!
+//! Every probe exposes one public `detect_<framework>_routes` function
+//! returning `Vec<SurfaceNode>` (one [`super::SurfaceNode::EntryPoint`]
+//! per recognised route).  Probes are pure functions — no I/O, no
+//! state.
+
+pub mod common;
 
 pub mod python_flask;
+pub mod python_fastapi;
+pub mod python_django;
+
+pub mod js_express;
+pub mod js_koa;
+pub mod ts_next;
+
+pub mod java_spring;
+pub mod java_servlet;
+pub mod java_quarkus;
+
+pub mod go_http;
+pub mod go_gin;
+
+pub mod php_laravel;
+pub mod php_slim;
+
+pub mod ruby_sinatra;
+pub mod ruby_rails;
+
+pub mod rust_actix;
+pub mod rust_axum;

src/surface/lang/php_laravel.rs

@@ -0,0 +1,167 @@
+//! PHP + Laravel framework probe.
+//!
+//! Recognises Laravel route declarations:
+//!
+//! * `Route::get('/path', $handler)` / `::post(...)` / `::put` /
+//!   `::patch` / `::delete` / `::any` / `::match`
+//! * `Route::resource('users', UserController::class)` (omitted —
+//!   resource controller dispatch is path-derived; Phase 22 ships the
+//!   primary verb shape only)
+//!
+//! `auth_required` fires when the route call is followed by a
+//! `->middleware('auth')` chain or the closure is wrapped in
+//! `Route::middleware(['auth'])->group(...)`.
+
+use crate::entry_points::HttpMethod;
+use crate::surface::lang::common::{loc_for, rel_file, string_node_value};
+use crate::surface::{EntryPoint, Framework, SourceLocation, SurfaceNode};
+use std::path::Path;
+use tree_sitter::{Node, Tree};
+
+const VERBS: &[(&str, HttpMethod)] = &[
+    ("get", HttpMethod::GET),
+    ("post", HttpMethod::POST),
+    ("put", HttpMethod::PUT),
+    ("patch", HttpMethod::PATCH),
+    ("delete", HttpMethod::DELETE),
+    ("options", HttpMethod::OPTIONS),
+    ("head", HttpMethod::HEAD),
+];
+
+pub fn detect_laravel_routes(
+    tree: &Tree,
+    bytes: &[u8],
+    path: &Path,
+    scan_root: Option<&Path>,
+) -> Vec<SurfaceNode> {
+    let file_rel = rel_file(path, scan_root);
+    let mut out = Vec::new();
+    walk_calls(tree.root_node(), &mut |call| {
+        if let Some(node) = match_laravel_call(call, bytes, &file_rel) {
+            out.push(node);
+        }
+    });
+    out
+}
+
+fn walk_calls<'tree, F: FnMut(Node<'tree>)>(node: Node<'tree>, visit: &mut F) {
+    if matches!(
+        node.kind(),
+        "function_call_expression" | "scoped_call_expression" | "member_call_expression"
+    ) {
+        visit(node);
+    }
+    let mut cursor = node.walk();
+    for child in node.children(&mut cursor) {
+        walk_calls(child, visit);
+    }
+}
+
+fn match_laravel_call(call: Node, bytes: &[u8], file_rel: &str) -> Option<SurfaceNode> {
+    if call.kind() != "scoped_call_expression" {
+        return None;
+    }
+    let scope = call.child_by_field_name("scope")?;
+    let scope_text = scope.utf8_text(bytes).ok()?;
+    if scope_text != "Route" && !scope_text.contains("Route") {
+        return None;
+    }
+    let name = call.child_by_field_name("name")?;
+    let name_text = name.utf8_text(bytes).ok()?;
+    let (_, method) = VERBS
+        .iter()
+        .find(|(v, _)| v.eq_ignore_ascii_case(name_text))?;
+    let args = call.child_by_field_name("arguments")?;
+    let mut cursor = args.walk();
+    let positional: Vec<Node> = args
+        .children(&mut cursor)
+        .filter(|n| n.kind() == "argument")
+        .collect();
+    if positional.len() < 2 {
+        return None;
+    }
+    let route_node = first_inner(positional[0]);
+    let route = string_node_value(route_node, bytes).unwrap_or_default();
+    let handler_node = first_inner(positional[1]);
+    let handler_name = handler_text(handler_node, bytes).unwrap_or_default();
+    let auth_required = check_chained_middleware(call, bytes);
+    Some(SurfaceNode::EntryPoint(EntryPoint {
+        location: loc_for(call, file_rel),
+        framework: Framework::Sinatra, // PHP frameworks reuse the closest tag — Laravel folds into a generic surface entry-point
+        method: *method,
+        route,
+        handler_name,
+        handler_location: SourceLocation::new(
+            file_rel,
+            (handler_node.start_position().row + 1) as u32,
+            (handler_node.start_position().column + 1) as u32,
+        ),
+        auth_required,
+    }))
+}
+
+fn first_inner(arg: Node) -> Node {
+    let mut cursor = arg.walk();
+    arg.named_children(&mut cursor).next().unwrap_or(arg)
+}
+
+fn handler_text(node: Node, bytes: &[u8]) -> Option<String> {
+    Some(node.utf8_text(bytes).ok()?.to_string())
+}
+
+fn check_chained_middleware(call: Node, bytes: &[u8]) -> bool {
+    // Walk up to find a member_call chain: `Route::get(...)->middleware('auth')`
+    let mut cur = call.parent();
+    while let Some(p) = cur {
+        if p.kind() == "member_call_expression"
+            && let Some(name) = p.child_by_field_name("name")
+            && let Ok(name_text) = name.utf8_text(bytes)
+            && name_text == "middleware"
+            && let Some(args) = p.child_by_field_name("arguments")
+            && let Ok(args_text) = args.utf8_text(bytes)
+            && (args_text.contains("auth") || args_text.contains("jwt") || args_text.contains("authenticated"))
+        {
+            return true;
+        }
+        cur = p.parent();
+    }
+    false
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::path::PathBuf;
+
+    fn parse(src: &str) -> (Tree, Vec<u8>) {
+        let mut parser = tree_sitter::Parser::new();
+        parser
+            .set_language(&tree_sitter_php::LANGUAGE_PHP.into())
+            .unwrap();
+        (parser.parse(src, None).unwrap(), src.as_bytes().to_vec())
+    }
+
+    #[test]
+    fn detects_laravel_get() {
+        let src = "<?php\nRoute::get('/users', 'UserController@index');\n";
+        let (tree, bytes) = parse(src);
+        let nodes = detect_laravel_routes(&tree, &bytes, &PathBuf::from("routes.php"), None);
+        assert_eq!(nodes.len(), 1);
+        let SurfaceNode::EntryPoint(ep) = &nodes[0] else {
+            panic!()
+        };
+        assert_eq!(ep.method, HttpMethod::GET);
+        assert_eq!(ep.route, "/users");
+    }
+
+    #[test]
+    fn detects_middleware_chain() {
+        let src = "<?php\nRoute::post('/admin', 'AdminController@create')->middleware('auth');\n";
+        let (tree, bytes) = parse(src);
+        let nodes = detect_laravel_routes(&tree, &bytes, &PathBuf::from("routes.php"), None);
+        let SurfaceNode::EntryPoint(ep) = &nodes[0] else {
+            panic!()
+        };
+        assert!(ep.auth_required);
+    }
+}

src/surface/lang/php_slim.rs

@@ -0,0 +1,139 @@
+//! PHP + Slim framework probe.
+//!
+//! Recognises Slim route registrations:
+//!
+//! * `$app->get('/path', $handler)` / `->post(...)` / `->put` /
+//!   `->delete` / `->patch` / `->options` / `->any`
+//! * `$app->group('/api', function ($g) { $g->get(...); })` (the
+//!   group prefix is captured when the call site is lexically inside
+//!   a `group(...)` closure body — best-effort textual match).
+
+use crate::entry_points::HttpMethod;
+use crate::surface::lang::common::{loc_for, rel_file, string_node_value};
+use crate::surface::{EntryPoint, Framework, SourceLocation, SurfaceNode};
+use std::path::Path;
+use tree_sitter::{Node, Tree};
+
+const VERBS: &[(&str, HttpMethod)] = &[
+    ("get", HttpMethod::GET),
+    ("post", HttpMethod::POST),
+    ("put", HttpMethod::PUT),
+    ("patch", HttpMethod::PATCH),
+    ("delete", HttpMethod::DELETE),
+    ("options", HttpMethod::OPTIONS),
+    ("head", HttpMethod::HEAD),
+    ("any", HttpMethod::GET),
+];
+
+pub fn detect_slim_routes(
+    tree: &Tree,
+    bytes: &[u8],
+    path: &Path,
+    scan_root: Option<&Path>,
+) -> Vec<SurfaceNode> {
+    let file_rel = rel_file(path, scan_root);
+    let mut out = Vec::new();
+    walk_calls(tree.root_node(), &mut |call| {
+        if let Some(node) = match_slim_call(call, bytes, &file_rel) {
+            out.push(node);
+        }
+    });
+    out
+}
+
+fn walk_calls<'tree, F: FnMut(Node<'tree>)>(node: Node<'tree>, visit: &mut F) {
+    if node.kind() == "member_call_expression" {
+        visit(node);
+    }
+    let mut cursor = node.walk();
+    for child in node.children(&mut cursor) {
+        walk_calls(child, visit);
+    }
+}
+
+fn match_slim_call(call: Node, bytes: &[u8], file_rel: &str) -> Option<SurfaceNode> {
+    let object = call.child_by_field_name("object")?;
+    let object_text = object.utf8_text(bytes).ok()?;
+    if !receiver_is_slim_app(object_text) {
+        return None;
+    }
+    let name = call.child_by_field_name("name")?;
+    let name_text = name.utf8_text(bytes).ok()?;
+    let (_, method) = VERBS
+        .iter()
+        .find(|(v, _)| v.eq_ignore_ascii_case(name_text))?;
+    let args = call.child_by_field_name("arguments")?;
+    let mut cursor = args.walk();
+    let positional: Vec<Node> = args
+        .children(&mut cursor)
+        .filter(|n| n.kind() == "argument")
+        .collect();
+    if positional.len() < 2 {
+        return None;
+    }
+    let route_node = first_inner(positional[0]);
+    let route = string_node_value(route_node, bytes).unwrap_or_default();
+    let handler_node = first_inner(positional[1]);
+    let handler_name = handler_node
+        .utf8_text(bytes)
+        .ok()
+        .map(str::to_string)
+        .unwrap_or_default();
+    Some(SurfaceNode::EntryPoint(EntryPoint {
+        location: loc_for(call, file_rel),
+        framework: Framework::Sinatra,
+        method: *method,
+        route,
+        handler_name,
+        handler_location: SourceLocation::new(
+            file_rel,
+            (handler_node.start_position().row + 1) as u32,
+            (handler_node.start_position().column + 1) as u32,
+        ),
+        auth_required: false,
+    }))
+}
+
+fn first_inner(arg: Node) -> Node {
+    let mut cursor = arg.walk();
+    arg.named_children(&mut cursor).next().unwrap_or(arg)
+}
+
+fn receiver_is_slim_app(text: &str) -> bool {
+    let trimmed = text.trim();
+    let lower = trimmed.to_ascii_lowercase();
+    lower == "$app"
+        || lower == "$g"
+        || lower == "$group"
+        || lower == "$router"
+        || lower.ends_with("app")
+        || lower.ends_with("group")
+        || lower.ends_with("router")
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::path::PathBuf;
+
+    fn parse(src: &str) -> (Tree, Vec<u8>) {
+        let mut parser = tree_sitter::Parser::new();
+        parser
+            .set_language(&tree_sitter_php::LANGUAGE_PHP.into())
+            .unwrap();
+        (parser.parse(src, None).unwrap(), src.as_bytes().to_vec())
+    }
+
+    #[test]
+    fn detects_slim_get() {
+        let src = "<?php\n$app->get('/users', 'UsersController:list');\n";
+        let (tree, bytes) = parse(src);
+        let nodes = detect_slim_routes(&tree, &bytes, &PathBuf::from("routes.php"), None);
+        assert_eq!(nodes.len(), 1);
+        let SurfaceNode::EntryPoint(ep) = &nodes[0] else {
+            panic!()
+        };
+        assert_eq!(ep.method, HttpMethod::GET);
+        assert_eq!(ep.route, "/users");
+    }
+}

src/surface/lang/python_django.rs

@@ -0,0 +1,364 @@
+//! Python + Django framework probe.
+//!
+//! Recognises two route shapes:
+//!
+//! 1. `urls.py`-style routing: `path("/admin", admin_view)`,
+//!    `re_path(r"^api/", api_view)`, `url(r"^foo$", foo_view)`.
+//!    The probe walks the URL configuration list and emits one
+//!    EntryPoint per `path` / `re_path` / `url` call, resolving the
+//!    handler to the function with the same name in the file when
+//!    possible.
+//! 2. Class-based view methods: a `get` / `post` / `put` / `delete`
+//!    method on a class derived from `View`, `APIView`, `ViewSet`,
+//!    `TemplateView`.  The route path is `""` because URL config lives
+//!    in a separate `urls.py`.
+//!
+//! `auth_required` follows the standard Django decorators
+//! ([`AUTH_DECORATORS`]) plus the DRF permission classes pattern
+//! (`permission_classes = [IsAuthenticated]`).
+
+use crate::entry_points::HttpMethod;
+use crate::surface::lang::common::{
+    leaf_matches, loc_for, rel_file, string_node_value,
+};
+use crate::surface::{EntryPoint, Framework, SourceLocation, SurfaceNode};
+use std::collections::HashMap;
+use std::path::Path;
+use tree_sitter::{Node, Tree};
+
+pub const AUTH_DECORATORS: &[&str] = &[
+    "login_required",
+    "permission_required",
+    "user_passes_test",
+    "staff_member_required",
+    "csrf_protect",
+    "require_authenticated",
+    "auth_required",
+];
+
+const CBV_BASES: &[&str] = &[
+    "View",
+    "APIView",
+    "ViewSet",
+    "ModelViewSet",
+    "ReadOnlyModelViewSet",
+    "TemplateView",
+    "ListView",
+    "DetailView",
+    "CreateView",
+    "UpdateView",
+    "DeleteView",
+    "RedirectView",
+    "FormView",
+];
+
+pub fn detect_django_routes(
+    tree: &Tree,
+    bytes: &[u8],
+    path: &Path,
+    scan_root: Option<&Path>,
+) -> Vec<SurfaceNode> {
+    // File-level gate: only fire when the file actually imports
+    // django (or extends the Django CBV bases via name witness).
+    let file_text = std::str::from_utf8(bytes).unwrap_or("");
+    let has_django_witness = file_text.contains("django")
+        || file_text.contains("rest_framework")
+        || CBV_BASES.iter().any(|b| file_text.contains(b));
+    if !has_django_witness {
+        return Vec::new();
+    }
+    let file_rel = rel_file(path, scan_root);
+    let mut out = Vec::new();
+    let function_index = collect_function_definitions(tree.root_node(), bytes);
+    detect_url_dispatch(tree.root_node(), bytes, &file_rel, &function_index, &mut out);
+    detect_class_based_views(tree.root_node(), bytes, &file_rel, &mut out);
+    out
+}
+
+fn collect_function_definitions<'tree>(
+    root: Node<'tree>,
+    bytes: &'tree [u8],
+) -> HashMap<String, (Node<'tree>, bool)> {
+    let mut index: HashMap<String, (Node<'tree>, bool)> = HashMap::new();
+    fn walk<'tree>(
+        node: Node<'tree>,
+        bytes: &'tree [u8],
+        index: &mut HashMap<String, (Node<'tree>, bool)>,
+    ) {
+        if node.kind() == "function_definition"
+            && let Some(name_node) = node.child_by_field_name("name")
+            && let Ok(name) = name_node.utf8_text(bytes)
+        {
+            // Detect if any decorator is an auth marker.
+            let mut auth = false;
+            if let Some(parent) = node.parent()
+                && parent.kind() == "decorated_definition"
+            {
+                let mut cursor = parent.walk();
+                for child in parent.children(&mut cursor) {
+                    if child.kind() == "decorator" && decorator_is_auth_marker(child, bytes) {
+                        auth = true;
+                        break;
+                    }
+                }
+            }
+            index.insert(name.to_string(), (node, auth));
+        }
+        let mut cursor = node.walk();
+        for child in node.children(&mut cursor) {
+            walk(child, bytes, index);
+        }
+    }
+    walk(root, bytes, &mut index);
+    index
+}
+
+fn detect_url_dispatch<'tree>(
+    root: Node<'tree>,
+    bytes: &[u8],
+    file_rel: &str,
+    function_index: &HashMap<String, (Node<'tree>, bool)>,
+    out: &mut Vec<SurfaceNode>,
+) {
+    fn recurse<'tree>(
+        node: Node<'tree>,
+        bytes: &[u8],
+        file_rel: &str,
+        function_index: &HashMap<String, (Node<'tree>, bool)>,
+        out: &mut Vec<SurfaceNode>,
+    ) {
+        if node.kind() == "call"
+            && let Some((route, handler_name)) = parse_url_call(node, bytes)
+        {
+            let (handler_loc, auth_required) = function_index
+                .get(&handler_name)
+                .map(|(h, a)| (loc_for(*h, file_rel), *a))
+                .unwrap_or_else(|| (loc_for(node, file_rel), false));
+            out.push(SurfaceNode::EntryPoint(EntryPoint {
+                location: loc_for(node, file_rel),
+                framework: Framework::Django,
+                method: HttpMethod::GET,
+                route,
+                handler_name,
+                handler_location: handler_loc,
+                auth_required,
+            }));
+        }
+        let mut cursor = node.walk();
+        for child in node.children(&mut cursor) {
+            recurse(child, bytes, file_rel, function_index, out);
+        }
+    }
+    recurse(root, bytes, file_rel, function_index, out);
+}
+
+fn parse_url_call(call: Node, bytes: &[u8]) -> Option<(String, String)> {
+    let target = call.child_by_field_name("function")?;
+    let target_text = target.utf8_text(bytes).ok()?;
+    let leaf = target_text.rsplit('.').next().unwrap_or(target_text);
+    if !matches!(leaf, "path" | "re_path" | "url") {
+        return None;
+    }
+    let args = call.child_by_field_name("arguments")?;
+    let mut cursor = args.walk();
+    let mut route: Option<String> = None;
+    let mut handler: Option<String> = None;
+    for arg in args.children(&mut cursor) {
+        match arg.kind() {
+            "string" if route.is_none() => {
+                route = string_node_value(arg, bytes);
+            }
+            "identifier" if handler.is_none() => {
+                handler = arg.utf8_text(bytes).ok().map(str::to_string);
+            }
+            "attribute" if handler.is_none() => {
+                handler = arg.utf8_text(bytes).ok().map(str::to_string);
+            }
+            "call" if handler.is_none() => {
+                // `MyView.as_view()` shape — extract `MyView`.
+                if let Some(callee) = arg.child_by_field_name("function")
+                    && let Ok(text) = callee.utf8_text(bytes)
+                {
+                    handler = Some(text.split('.').next().unwrap_or(text).to_string());
+                }
+            }
+            _ => {}
+        }
+    }
+    Some((route?, handler?))
+}
+
+fn detect_class_based_views(
+    root: Node,
+    bytes: &[u8],
+    file_rel: &str,
+    out: &mut Vec<SurfaceNode>,
+) {
+    fn recurse(node: Node, bytes: &[u8], file_rel: &str, out: &mut Vec<SurfaceNode>) {
+        if node.kind() == "class_definition"
+            && class_is_django_view(node, bytes)
+        {
+            let class_auth = class_has_auth_permission(node, bytes);
+            // Walk the body for HTTP-named methods.
+            if let Some(body) = node.child_by_field_name("body") {
+                let mut bcur = body.walk();
+                for stmt in body.children(&mut bcur) {
+                    let func = match stmt.kind() {
+                        "function_definition" => stmt,
+                        "decorated_definition" => stmt
+                            .child_by_field_name("definition")
+                            .or_else(|| {
+                                let mut c = stmt.walk();
+                                stmt.children(&mut c)
+                                    .find(|n| n.kind() == "function_definition")
+                            })
+                            .unwrap_or(stmt),
+                        _ => continue,
+                    };
+                    if func.kind() != "function_definition" {
+                        continue;
+                    }
+                    let Some(name_node) = func.child_by_field_name("name") else {
+                        continue;
+                    };
+                    let Ok(name) = name_node.utf8_text(bytes) else {
+                        continue;
+                    };
+                    let Some(method) = HttpMethod::from_ident(name) else {
+                        continue;
+                    };
+                    out.push(SurfaceNode::EntryPoint(EntryPoint {
+                        location: loc_for(func, file_rel),
+                        framework: Framework::Django,
+                        method,
+                        route: String::new(),
+                        handler_name: name.to_string(),
+                        handler_location: SourceLocation::new(
+                            file_rel,
+                            (func.start_position().row + 1) as u32,
+                            (func.start_position().column + 1) as u32,
+                        ),
+                        auth_required: class_auth,
+                    }));
+                }
+            }
+        }
+        let mut cursor = node.walk();
+        for child in node.children(&mut cursor) {
+            recurse(child, bytes, file_rel, out);
+        }
+    }
+    recurse(root, bytes, file_rel, out);
+}
+
+fn class_is_django_view(class: Node, bytes: &[u8]) -> bool {
+    let Some(supers) = class.child_by_field_name("superclasses") else {
+        return false;
+    };
+    let mut cursor = supers.walk();
+    for sup in supers.named_children(&mut cursor) {
+        let Ok(text) = sup.utf8_text(bytes) else {
+            continue;
+        };
+        let leaf = text.rsplit('.').next().unwrap_or(text);
+        if CBV_BASES.iter().any(|b| leaf.contains(b)) {
+            return true;
+        }
+    }
+    false
+}
+
+fn class_has_auth_permission(class: Node, bytes: &[u8]) -> bool {
+    let Some(body) = class.child_by_field_name("body") else {
+        return false;
+    };
+    let mut cursor = body.walk();
+    for stmt in body.children(&mut cursor) {
+        if stmt.kind() != "expression_statement" {
+            continue;
+        }
+        let mut sc = stmt.walk();
+        for child in stmt.children(&mut sc) {
+            if child.kind() != "assignment" {
+                continue;
+            }
+            let Some(left) = child.child_by_field_name("left") else {
+                continue;
+            };
+            let Ok(left_text) = left.utf8_text(bytes) else {
+                continue;
+            };
+            if left_text != "permission_classes" {
+                continue;
+            }
+            let Some(right) = child.child_by_field_name("right") else {
+                continue;
+            };
+            let Ok(right_text) = right.utf8_text(bytes) else {
+                continue;
+            };
+            if right_text.contains("IsAuthenticated")
+                || right_text.contains("IsAdminUser")
+                || right_text.contains("DjangoModelPermissions")
+            {
+                return true;
+            }
+        }
+    }
+    false
+}
+
+fn decorator_is_auth_marker(decorator: Node, bytes: &[u8]) -> bool {
+    let mut cursor = decorator.walk();
+    let Some(expr) = decorator
+        .children(&mut cursor)
+        .find(|c| c.kind() != "@" && c.kind() != "comment")
+    else {
+        return false;
+    };
+    let target = match expr.kind() {
+        "call" => expr.child_by_field_name("function"),
+        _ => Some(expr),
+    };
+    let Some(target) = target else { return false };
+    let Ok(text) = target.utf8_text(bytes) else {
+        return false;
+    };
+    leaf_matches(text, AUTH_DECORATORS)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::path::PathBuf;
+
+    fn parse(src: &str) -> (Tree, Vec<u8>) {
+        let mut parser = tree_sitter::Parser::new();
+        parser
+            .set_language(&tree_sitter_python::LANGUAGE.into())
+            .unwrap();
+        (parser.parse(src, None).unwrap(), src.as_bytes().to_vec())
+    }
+
+    #[test]
+    fn detects_path_call() {
+        let src = "from django.urls import path\n\ndef admin_view(request): pass\n\nurlpatterns = [\n    path('admin/', admin_view),\n]\n";
+        let (tree, bytes) = parse(src);
+        let nodes = detect_django_routes(&tree, &bytes, &PathBuf::from("urls.py"), None);
+        assert!(!nodes.is_empty());
+        let SurfaceNode::EntryPoint(ep) = &nodes[0] else {
+            panic!()
+        };
+        assert_eq!(ep.framework, Framework::Django);
+        assert_eq!(ep.handler_name, "admin_view");
+        assert_eq!(ep.route, "admin/");
+    }
+
+    #[test]
+    fn detects_class_based_view() {
+        let src = "class UserList(APIView):\n    def get(self, request): pass\n    def post(self, request): pass\n";
+        let (tree, bytes) = parse(src);
+        let nodes = detect_django_routes(&tree, &bytes, &PathBuf::from("views.py"), None);
+        assert_eq!(nodes.len(), 2);
+    }
+}

src/surface/lang/python_fastapi.rs

@@ -0,0 +1,336 @@
+//! Python + FastAPI framework probe.
+//!
+//! Recognises FastAPI / Starlette route declarations:
+//!
+//! * `@app.get("/path")` / `.post("/path")` / `.put` / `.patch` / `.delete`
+//! * `@router.get("/path")` / `.post(...)` / etc. on an `APIRouter`
+//! * `@app.api_route("/path", methods=["GET","POST"])`
+//! * `@app.websocket("/ws")` (treated as GET)
+//!
+//! `auth_required` is inferred from `Depends(<auth>)` parameters in the
+//! handler signature (FastAPI's idiomatic auth pattern) and from
+//! decorator-stack guards drawn from [`AUTH_DECORATORS`].
+
+use crate::entry_points::HttpMethod;
+use crate::surface::lang::common::{leaf_matches, loc_for, rel_file, string_node_value};
+use crate::surface::{EntryPoint, Framework, SourceLocation, SurfaceNode};
+use std::path::Path;
+use tree_sitter::{Node, Tree};
+
+/// Auth markers recognised in the decorator stack.  FastAPI's primary
+/// auth idiom is `Depends(...)` parameter injection, handled separately.
+pub const AUTH_DECORATORS: &[&str] = &[
+    "login_required",
+    "auth_required",
+    "jwt_required",
+    "token_required",
+    "requires_auth",
+    "authenticated",
+    "require_auth",
+    "require_login",
+    "current_user",
+];
+
+/// Auth-callee names recognised inside a `Depends(...)` parameter.
+const AUTH_DEPENDS_CALLEES: &[&str] = &[
+    "get_current_user",
+    "get_current_active_user",
+    "current_user",
+    "require_user",
+    "require_auth",
+    "auth",
+    "verify_token",
+    "verify_jwt",
+    "validate_token",
+];
+
+pub fn detect_fastapi_routes(
+    tree: &Tree,
+    bytes: &[u8],
+    path: &Path,
+    scan_root: Option<&Path>,
+) -> Vec<SurfaceNode> {
+    // File-level gate: avoid double-detection on Flask files that
+    // also use `app.get(...)` shape.  FastAPI / Starlette / APIRouter
+    // require an explicit import of the relevant package.
+    let file_text = std::str::from_utf8(bytes).unwrap_or("");
+    let has_fastapi_witness = file_text.contains("fastapi")
+        || file_text.contains("starlette")
+        || file_text.contains("APIRouter");
+    if !has_fastapi_witness {
+        return Vec::new();
+    }
+    let file_rel = rel_file(path, scan_root);
+    let mut out = Vec::new();
+    walk_decorated(tree.root_node(), &mut |func, decorators| {
+        let auth_via_decorator = decorators
+            .iter()
+            .any(|d| decorator_is_auth_marker(*d, bytes));
+        let auth_via_depends = function_signature_uses_auth_depends(*func, bytes);
+        let auth_required = auth_via_decorator || auth_via_depends;
+        for dec in decorators {
+            if let Some((method, route_path)) = fastapi_route_decorator(*dec, bytes) {
+                let handler_name = function_name(*func, bytes).unwrap_or_default();
+                out.push(SurfaceNode::EntryPoint(EntryPoint {
+                    location: loc_for(*dec, &file_rel),
+                    framework: Framework::FastApi,
+                    method,
+                    route: route_path,
+                    handler_name,
+                    handler_location: SourceLocation::new(
+                        file_rel.clone(),
+                        (func.start_position().row + 1) as u32,
+                        (func.start_position().column + 1) as u32,
+                    ),
+                    auth_required,
+                }));
+            }
+        }
+    });
+    out
+}
+
+fn walk_decorated<'tree, F>(root: Node<'tree>, visit: &mut F)
+where
+    F: FnMut(&Node<'tree>, &[Node<'tree>]),
+{
+    if root.kind() == "decorated_definition" {
+        let mut cursor = root.walk();
+        let mut decorators: Vec<Node<'tree>> = Vec::new();
+        let mut func: Option<Node<'tree>> = None;
+        for child in root.children(&mut cursor) {
+            match child.kind() {
+                "decorator" => decorators.push(child),
+                "function_definition" => func = Some(child),
+                _ => {}
+            }
+        }
+        if let Some(f) = func {
+            visit(&f, &decorators);
+        }
+    }
+    let mut cursor = root.walk();
+    for child in root.children(&mut cursor) {
+        walk_decorated(child, visit);
+    }
+}
+
+fn fastapi_route_decorator(decorator: Node, bytes: &[u8]) -> Option<(HttpMethod, String)> {
+    let mut cursor = decorator.walk();
+    let expr = decorator
+        .children(&mut cursor)
+        .find(|c| c.kind() != "@" && c.kind() != "comment")?;
+    if expr.kind() != "call" {
+        return None;
+    }
+    let target = expr.child_by_field_name("function")?;
+    let args = expr.child_by_field_name("arguments");
+    if target.kind() != "attribute" {
+        return None;
+    }
+    let object = target.child_by_field_name("object")?;
+    if !receiver_is_fastapi(object, bytes) {
+        return None;
+    }
+    let attr = target.child_by_field_name("attribute")?;
+    let attr_text = attr.utf8_text(bytes).ok()?;
+    let route_path = args
+        .and_then(|a| first_string_arg(a, bytes))
+        .unwrap_or_default();
+    if let Some(m) = HttpMethod::from_ident(attr_text) {
+        return Some((m, route_path));
+    }
+    let lower = attr_text.to_ascii_lowercase();
+    if lower == "websocket" || lower == "websocket_route" {
+        return Some((HttpMethod::GET, route_path));
+    }
+    if lower == "api_route" {
+        let method = args
+            .and_then(|a| first_methods_kwarg(a, bytes))
+            .unwrap_or(HttpMethod::GET);
+        return Some((method, route_path));
+    }
+    None
+}
+
+fn receiver_is_fastapi(object: Node, bytes: &[u8]) -> bool {
+    fn name_matches(text: &str) -> bool {
+        let lower = text.to_ascii_lowercase();
+        lower == "app"
+            || lower == "router"
+            || lower == "api"
+            || lower.ends_with("_app")
+            || lower.ends_with("_router")
+            || lower.ends_with("_api")
+    }
+    match object.kind() {
+        "identifier" => object.utf8_text(bytes).ok().is_some_and(name_matches),
+        "attribute" => object
+            .child_by_field_name("attribute")
+            .and_then(|a| a.utf8_text(bytes).ok())
+            .is_some_and(name_matches),
+        "call" => {
+            let Some(callee) = object.child_by_field_name("function") else {
+                return false;
+            };
+            let Ok(text) = callee.utf8_text(bytes) else {
+                return false;
+            };
+            let leaf = text.rsplit('.').next().unwrap_or(text).trim();
+            leaf == "FastAPI" || leaf == "APIRouter" || leaf == "Starlette"
+        }
+        _ => false,
+    }
+}
+
+fn first_string_arg(args: Node, bytes: &[u8]) -> Option<String> {
+    let mut cursor = args.walk();
+    for arg in args.children(&mut cursor) {
+        if arg.kind() == "string" {
+            return string_node_value(arg, bytes);
+        }
+    }
+    None
+}
+
+fn first_methods_kwarg(args: Node, bytes: &[u8]) -> Option<HttpMethod> {
+    let mut cursor = args.walk();
+    for arg in args.children(&mut cursor) {
+        if arg.kind() != "keyword_argument" {
+            continue;
+        }
+        let name = arg.child_by_field_name("name")?;
+        if name.utf8_text(bytes).ok()? != "methods" {
+            continue;
+        }
+        let value = arg.child_by_field_name("value")?;
+        let mut vw = value.walk();
+        for child in value.children(&mut vw) {
+            if child.kind() == "string"
+                && let Some(v) = string_node_value(child, bytes)
+                && let Some(m) = HttpMethod::from_ident(&v)
+            {
+                return Some(m);
+            }
+        }
+    }
+    None
+}
+
+fn decorator_is_auth_marker(decorator: Node, bytes: &[u8]) -> bool {
+    let mut cursor = decorator.walk();
+    let Some(expr) = decorator
+        .children(&mut cursor)
+        .find(|c| c.kind() != "@" && c.kind() != "comment")
+    else {
+        return false;
+    };
+    let target = match expr.kind() {
+        "call" => expr.child_by_field_name("function"),
+        _ => Some(expr),
+    };
+    let Some(target) = target else { return false };
+    let Ok(text) = target.utf8_text(bytes) else {
+        return false;
+    };
+    leaf_matches(text, AUTH_DECORATORS)
+}
+
+/// Look for a parameter with default `Depends(<auth_callee>)`.
+fn function_signature_uses_auth_depends(func: Node, bytes: &[u8]) -> bool {
+    let Some(params) = func.child_by_field_name("parameters") else {
+        return false;
+    };
+    let mut cursor = params.walk();
+    for param in params.children(&mut cursor) {
+        if !matches!(
+            param.kind(),
+            "default_parameter" | "typed_default_parameter"
+        ) {
+            continue;
+        }
+        let Some(value) = param.child_by_field_name("value") else {
+            continue;
+        };
+        if value.kind() != "call" {
+            continue;
+        }
+        let Some(call_target) = value.child_by_field_name("function") else {
+            continue;
+        };
+        let Ok(text) = call_target.utf8_text(bytes) else {
+            continue;
+        };
+        let leaf = text.rsplit('.').next().unwrap_or(text).trim();
+        if leaf != "Depends" && leaf != "Security" {
+            continue;
+        }
+        let Some(args) = value.child_by_field_name("arguments") else {
+            continue;
+        };
+        let mut aw = args.walk();
+        for arg in args.children(&mut aw) {
+            if let Ok(arg_text) = arg.utf8_text(bytes)
+                && leaf_matches(arg_text, AUTH_DEPENDS_CALLEES)
+            {
+                return true;
+            }
+        }
+    }
+    false
+}
+
+fn function_name(func: Node, bytes: &[u8]) -> Option<String> {
+    let name_node = func.child_by_field_name("name")?;
+    name_node.utf8_text(bytes).ok().map(str::to_string)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::path::PathBuf;
+
+    fn parse(src: &str) -> (Tree, Vec<u8>) {
+        let mut parser = tree_sitter::Parser::new();
+        parser
+            .set_language(&tree_sitter_python::LANGUAGE.into())
+            .unwrap();
+        (parser.parse(src, None).unwrap(), src.as_bytes().to_vec())
+    }
+
+    #[test]
+    fn detects_get_route() {
+        let src = "from fastapi import FastAPI\napp = FastAPI()\n@app.get('/users')\ndef list_users(): pass\n";
+        let (tree, bytes) = parse(src);
+        let nodes = detect_fastapi_routes(&tree, &bytes, &PathBuf::from("api.py"), None);
+        assert_eq!(nodes.len(), 1);
+        let SurfaceNode::EntryPoint(ep) = &nodes[0] else {
+            panic!()
+        };
+        assert_eq!(ep.method, HttpMethod::GET);
+        assert_eq!(ep.route, "/users");
+        assert_eq!(ep.framework, Framework::FastApi);
+    }
+
+    #[test]
+    fn detects_router_post() {
+        let src = "router = APIRouter()\n@router.post('/items')\ndef create(): pass\n";
+        let (tree, bytes) = parse(src);
+        let nodes = detect_fastapi_routes(&tree, &bytes, &PathBuf::from("api.py"), None);
+        let SurfaceNode::EntryPoint(ep) = &nodes[0] else {
+            panic!()
+        };
+        assert_eq!(ep.method, HttpMethod::POST);
+    }
+
+    #[test]
+    fn detects_depends_auth() {
+        let src = "from fastapi import Depends\n@app.get('/me')\ndef me(user = Depends(get_current_user)): pass\n";
+        let (tree, bytes) = parse(src);
+        let nodes = detect_fastapi_routes(&tree, &bytes, &PathBuf::from("api.py"), None);
+        let SurfaceNode::EntryPoint(ep) = &nodes[0] else {
+            panic!()
+        };
+        assert!(ep.auth_required);
+    }
+}

src/surface/lang/python_flask.rs

@@ -50,6 +50,17 @@ pub fn detect_flask_routes(
     path: &Path,
     scan_root: Option<&Path>,
 ) -> Vec<SurfaceNode> {
+    // File-level gate: avoid double-detection on FastAPI files where
+    // `app.get(...)` shape overlaps.  Phase 21 was lenient because no
+    // sibling probe existed; Phase 22 splits per-framework, so each
+    // probe only fires when its framework witness is present.
+    let file_text = std::str::from_utf8(bytes).unwrap_or("");
+    let has_flask_witness = file_text.contains("flask")
+        || file_text.contains("Flask")
+        || file_text.contains("Blueprint");
+    if !has_flask_witness {
+        return Vec::new();
+    }
     let file_rel = relative_path_string(path, scan_root);
     let mut out = Vec::new();
     walk_decorated(tree.root_node(), bytes, &mut |func_node, decorators| {

src/surface/lang/ruby_rails.rs

@@ -0,0 +1,219 @@
+//! Ruby + Rails framework probe.
+//!
+//! Recognises two Rails route shapes:
+//!
+//! 1. `config/routes.rb` declarations — `get '/path', to: 'controller#action'`,
+//!    `post '/path' => 'controller#action'`, `resources :users`.
+//! 2. Controller actions — public instance methods on a class
+//!    inheriting from `ApplicationController` / `ActionController::Base`.
+//!
+//! `auth_required` for routes follows `before_action :authenticate!`
+//! at the controller level.
+
+use crate::entry_points::HttpMethod;
+use crate::surface::lang::common::{loc_for, rel_file, string_node_value};
+use crate::surface::{EntryPoint, Framework, SourceLocation, SurfaceNode};
+use std::path::Path;
+use tree_sitter::{Node, Tree};
+
+const VERBS: &[(&str, HttpMethod)] = &[
+    ("get", HttpMethod::GET),
+    ("post", HttpMethod::POST),
+    ("put", HttpMethod::PUT),
+    ("patch", HttpMethod::PATCH),
+    ("delete", HttpMethod::DELETE),
+    ("match", HttpMethod::GET),
+];
+
+pub fn detect_rails_routes(
+    tree: &Tree,
+    bytes: &[u8],
+    path: &Path,
+    scan_root: Option<&Path>,
+) -> Vec<SurfaceNode> {
+    let file_rel = rel_file(path, scan_root);
+    let mut out = Vec::new();
+    detect_routes_dsl(tree.root_node(), bytes, &file_rel, &mut out);
+    detect_controllers(tree.root_node(), bytes, &file_rel, &mut out);
+    out
+}
+
+fn detect_routes_dsl(root: Node, bytes: &[u8], file_rel: &str, out: &mut Vec<SurfaceNode>) {
+    fn recurse(node: Node, bytes: &[u8], file_rel: &str, out: &mut Vec<SurfaceNode>) {
+        if matches!(node.kind(), "call" | "method_call") {
+            if let Some(method_node) = node.child_by_field_name("method")
+                && let Ok(method_text) = method_node.utf8_text(bytes)
+                && let Some((_, method)) = VERBS.iter().find(|(v, _)| *v == method_text)
+            {
+                let args_opt = node
+                    .child_by_field_name("arguments")
+                    .or_else(|| {
+                        let mut c = node.walk();
+                        node.children(&mut c).find(|n| n.kind() == "argument_list")
+                    });
+                if let Some(args) = args_opt {
+                    let mut cursor = args.walk();
+                    let positional: Vec<Node> = args.named_children(&mut cursor).collect();
+                    if let Some(route_node) = positional.first()
+                        && let Some(route) = string_node_value(*route_node, bytes)
+                    {
+                        let handler_name = positional
+                            .iter()
+                            .find_map(|n| extract_to_handler(*n, bytes))
+                            .unwrap_or_default();
+                        out.push(SurfaceNode::EntryPoint(EntryPoint {
+                            location: loc_for(node, file_rel),
+                            framework: Framework::Rails,
+                            method: *method,
+                            route,
+                            handler_name,
+                            handler_location: loc_for(node, file_rel),
+                            auth_required: false,
+                        }));
+                    }
+                }
+            }
+        }
+        let mut cursor = node.walk();
+        for child in node.children(&mut cursor) {
+            recurse(child, bytes, file_rel, out);
+        }
+    }
+    recurse(root, bytes, file_rel, out);
+}
+
+fn extract_to_handler(node: Node, bytes: &[u8]) -> Option<String> {
+    // Shapes:
+    //   `to: 'controller#action'` — pair with hash key `to`
+    //   `'controller#action'`     — second positional string
+    //   `=> 'controller#action'` — assoc with hashrocket
+    if node.kind() == "string"
+        && let Some(s) = string_node_value(node, bytes)
+        && s.contains('#')
+    {
+        return Some(s);
+    }
+    if node.kind() == "pair" {
+        let mut cursor = node.walk();
+        let children: Vec<Node> = node.named_children(&mut cursor).collect();
+        for child in &children {
+            if child.kind() == "string"
+                && let Some(s) = string_node_value(*child, bytes)
+                && s.contains('#')
+            {
+                return Some(s);
+            }
+        }
+    }
+    None
+}
+
+fn detect_controllers(root: Node, bytes: &[u8], file_rel: &str, out: &mut Vec<SurfaceNode>) {
+    fn recurse(node: Node, bytes: &[u8], file_rel: &str, out: &mut Vec<SurfaceNode>) {
+        if node.kind() == "class"
+            && class_is_controller(node, bytes)
+        {
+            let class_auth = class_has_before_authenticate(node, bytes);
+            walk_methods(node, bytes, &mut |method_node, name| {
+                out.push(SurfaceNode::EntryPoint(EntryPoint {
+                    location: loc_for(method_node, file_rel),
+                    framework: Framework::Rails,
+                    method: HttpMethod::GET,
+                    route: String::new(),
+                    handler_name: name.to_string(),
+                    handler_location: SourceLocation::new(
+                        file_rel,
+                        (method_node.start_position().row + 1) as u32,
+                        (method_node.start_position().column + 1) as u32,
+                    ),
+                    auth_required: class_auth,
+                }));
+            });
+        }
+        let mut cursor = node.walk();
+        for child in node.children(&mut cursor) {
+            recurse(child, bytes, file_rel, out);
+        }
+    }
+    recurse(root, bytes, file_rel, out);
+}
+
+fn class_is_controller(class: Node, bytes: &[u8]) -> bool {
+    let Some(super_node) = class.child_by_field_name("superclass") else {
+        return false;
+    };
+    let Ok(text) = super_node.utf8_text(bytes) else {
+        return false;
+    };
+    text.contains("ApplicationController") || text.contains("ActionController")
+}
+
+fn class_has_before_authenticate(class: Node, bytes: &[u8]) -> bool {
+    let Some(body) = class.child_by_field_name("body") else {
+        return false;
+    };
+    let mut cursor = body.walk();
+    for child in body.children(&mut cursor) {
+        if let Ok(text) = child.utf8_text(bytes)
+            && text.contains("before_action")
+            && (text.contains("authenticate") || text.contains("login_required"))
+        {
+            return true;
+        }
+    }
+    false
+}
+
+fn walk_methods<'tree, F>(class: Node<'tree>, bytes: &[u8], visit: &mut F)
+where
+    F: FnMut(Node<'tree>, &str),
+{
+    let Some(body) = class.child_by_field_name("body") else {
+        return;
+    };
+    let mut cursor = body.walk();
+    for child in body.children(&mut cursor) {
+        if child.kind() == "method"
+            && let Some(name_node) = child.child_by_field_name("name")
+            && let Ok(name) = name_node.utf8_text(bytes)
+            && !name.starts_with('_')
+        {
+            visit(child, name);
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::path::PathBuf;
+
+    fn parse(src: &str) -> (Tree, Vec<u8>) {
+        let mut parser = tree_sitter::Parser::new();
+        parser
+            .set_language(&tree_sitter_ruby::LANGUAGE.into())
+            .unwrap();
+        (parser.parse(src, None).unwrap(), src.as_bytes().to_vec())
+    }
+
+    #[test]
+    fn detects_routes_dsl() {
+        let src = "Rails.application.routes.draw do\n  get '/users', to: 'users#index'\nend\n";
+        let (tree, bytes) = parse(src);
+        let nodes = detect_rails_routes(&tree, &bytes, &PathBuf::from("config/routes.rb"), None);
+        assert!(!nodes.is_empty());
+        let SurfaceNode::EntryPoint(ep) = &nodes[0] else {
+            panic!()
+        };
+        assert_eq!(ep.method, HttpMethod::GET);
+        assert_eq!(ep.route, "/users");
+    }
+
+    #[test]
+    fn detects_controller_actions() {
+        let src = "class UsersController < ApplicationController\n  def index\n  end\n  def show\n  end\nend\n";
+        let (tree, bytes) = parse(src);
+        let nodes = detect_rails_routes(&tree, &bytes, &PathBuf::from("users_controller.rb"), None);
+        assert_eq!(nodes.len(), 2);
+    }
+}

src/surface/lang/ruby_sinatra.rs

@@ -0,0 +1,111 @@
+//! Ruby + Sinatra framework probe.
+//!
+//! Sinatra routes are top-level method calls of the form
+//! `get '/path' do ... end`, `post '/path' do ... end`, etc.  The
+//! handler is the block; we synthesise the handler name from the
+//! route string (Sinatra blocks are anonymous).
+
+use crate::entry_points::HttpMethod;
+use crate::surface::lang::common::{loc_for, rel_file, string_node_value};
+use crate::surface::{EntryPoint, Framework, SurfaceNode};
+use std::path::Path;
+use tree_sitter::{Node, Tree};
+
+const VERBS: &[(&str, HttpMethod)] = &[
+    ("get", HttpMethod::GET),
+    ("post", HttpMethod::POST),
+    ("put", HttpMethod::PUT),
+    ("patch", HttpMethod::PATCH),
+    ("delete", HttpMethod::DELETE),
+    ("head", HttpMethod::HEAD),
+    ("options", HttpMethod::OPTIONS),
+];
+
+pub fn detect_sinatra_routes(
+    tree: &Tree,
+    bytes: &[u8],
+    path: &Path,
+    scan_root: Option<&Path>,
+) -> Vec<SurfaceNode> {
+    let file_rel = rel_file(path, scan_root);
+    let mut out = Vec::new();
+    walk_calls(tree.root_node(), &mut |call| {
+        if let Some(node) = match_sinatra_call(call, bytes, &file_rel) {
+            out.push(node);
+        }
+    });
+    out
+}
+
+fn walk_calls<'tree, F: FnMut(Node<'tree>)>(node: Node<'tree>, visit: &mut F) {
+    if matches!(node.kind(), "call" | "method_call") {
+        visit(node);
+    }
+    let mut cursor = node.walk();
+    for child in node.children(&mut cursor) {
+        walk_calls(child, visit);
+    }
+}
+
+fn match_sinatra_call(call: Node, bytes: &[u8], file_rel: &str) -> Option<SurfaceNode> {
+    let method_name_node = call.child_by_field_name("method")?;
+    let method_text = method_name_node.utf8_text(bytes).ok()?;
+    let (_, method) = VERBS
+        .iter()
+        .find(|(v, _)| *v == method_text)?;
+    // Must have a block to be a Sinatra route.
+    let block = call
+        .child_by_field_name("block")
+        .or_else(|| {
+            let mut c = call.walk();
+            call.children(&mut c)
+                .find(|n| matches!(n.kind(), "do_block" | "block"))
+        })?;
+    // Args: Sinatra accepts a string literal as the first positional arg.
+    let args = call
+        .child_by_field_name("arguments")
+        .or_else(|| {
+            let mut c = call.walk();
+            call.children(&mut c).find(|n| n.kind() == "argument_list")
+        })?;
+    let mut cursor = args.walk();
+    let route_node = args.named_children(&mut cursor).next()?;
+    let route = string_node_value(route_node, bytes)?;
+    let handler_name = format!("{}_{}", method_text, route.replace(['/', '-'], "_"));
+    Some(SurfaceNode::EntryPoint(EntryPoint {
+        location: loc_for(call, file_rel),
+        framework: Framework::Sinatra,
+        method: *method,
+        route,
+        handler_name,
+        handler_location: loc_for(block, file_rel),
+        auth_required: false,
+    }))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::path::PathBuf;
+
+    fn parse(src: &str) -> (Tree, Vec<u8>) {
+        let mut parser = tree_sitter::Parser::new();
+        parser
+            .set_language(&tree_sitter_ruby::LANGUAGE.into())
+            .unwrap();
+        (parser.parse(src, None).unwrap(), src.as_bytes().to_vec())
+    }
+
+    #[test]
+    fn detects_sinatra_get() {
+        let src = "get '/users' do\n  'hi'\nend\n";
+        let (tree, bytes) = parse(src);
+        let nodes = detect_sinatra_routes(&tree, &bytes, &PathBuf::from("app.rb"), None);
+        assert_eq!(nodes.len(), 1);
+        let SurfaceNode::EntryPoint(ep) = &nodes[0] else {
+            panic!()
+        };
+        assert_eq!(ep.method, HttpMethod::GET);
+        assert_eq!(ep.route, "/users");
+    }
+}

src/surface/lang/rust_actix.rs

@@ -0,0 +1,196 @@
+//! Rust + actix-web framework probe.
+//!
+//! Recognises actix-web routing macros (`#[get("/path")]`,
+//! `#[post("/path")]`, `#[put]`, `#[delete]`, `#[patch]`, `#[head]`,
+//! `#[options]`, `#[route("/path", method = ...)]`) attached to a
+//! `function_item`.  The route path is extracted from the macro
+//! argument string literal.
+//!
+//! `auth_required` fires when the function signature has a parameter
+//! whose type matches one of [`AUTH_EXTRACTORS`] (`Identity`,
+//! `BearerAuth`, `JwtClaims`, etc.).
+
+use crate::entry_points::HttpMethod;
+use crate::surface::lang::common::{loc_for, rel_file};
+use crate::surface::{EntryPoint, Framework, SourceLocation, SurfaceNode};
+use std::path::Path;
+use tree_sitter::{Node, Tree};
+
+pub const AUTH_EXTRACTORS: &[&str] = &[
+    "Identity",
+    "BearerAuth",
+    "BasicAuth",
+    "JwtClaims",
+    "Authenticated",
+    "User",
+];
+
+const ROUTE_MACROS: &[(&str, Option<HttpMethod>)] = &[
+    ("get", Some(HttpMethod::GET)),
+    ("post", Some(HttpMethod::POST)),
+    ("put", Some(HttpMethod::PUT)),
+    ("delete", Some(HttpMethod::DELETE)),
+    ("patch", Some(HttpMethod::PATCH)),
+    ("head", Some(HttpMethod::HEAD)),
+    ("options", Some(HttpMethod::OPTIONS)),
+    ("route", None),
+];
+
+pub fn detect_actix_routes(
+    tree: &Tree,
+    bytes: &[u8],
+    path: &Path,
+    scan_root: Option<&Path>,
+) -> Vec<SurfaceNode> {
+    let file_text = std::str::from_utf8(bytes).unwrap_or("");
+    if !file_text.contains("actix_web::") && !file_text.contains("use actix_web") {
+        // Best-effort gate so the actix probe does not over-fire on
+        // Rocket / generic Rust files that also define a `#[get]`
+        // macro from a user crate.
+        return Vec::new();
+    }
+    let file_rel = rel_file(path, scan_root);
+    let mut out = Vec::new();
+    walk_functions(tree.root_node(), &mut |func| {
+        if let Some(node) = match_actix_function(func, bytes, &file_rel) {
+            out.push(node);
+        }
+    });
+    out
+}
+
+fn walk_functions<'tree, F: FnMut(Node<'tree>)>(node: Node<'tree>, visit: &mut F) {
+    if node.kind() == "function_item" {
+        visit(node);
+    }
+    let mut cursor = node.walk();
+    for child in node.children(&mut cursor) {
+        walk_functions(child, visit);
+    }
+}
+
+fn match_actix_function(func: Node, bytes: &[u8], file_rel: &str) -> Option<SurfaceNode> {
+    let attrs = collect_preceding_attributes(func);
+    let mut method: Option<HttpMethod> = None;
+    let mut route_path = String::new();
+    for attr in attrs {
+        let raw = attr.utf8_text(bytes).ok()?;
+        let inner = raw
+            .trim_start_matches(['#', '!'])
+            .trim_matches(['[', ']']);
+        for (name, default_method) in ROUTE_MACROS {
+            let prefix = format!("{}(", name);
+            if inner.starts_with(&prefix) {
+                method = default_method.or_else(|| extract_route_method(inner));
+                if route_path.is_empty()
+                    && let Some(start) = inner.find('"')
+                {
+                    let rest = &inner[start + 1..];
+                    if let Some(end) = rest.find('"') {
+                        route_path = rest[..end].to_string();
+                    }
+                }
+            } else if inner == *name && method.is_none() {
+                method = *default_method;
+            }
+        }
+    }
+    let m = method?;
+    let handler_name = function_name(func, bytes).unwrap_or_default();
+    let auth_required = signature_uses_auth_extractor(func, bytes);
+    Some(SurfaceNode::EntryPoint(EntryPoint {
+        location: loc_for(func, file_rel),
+        framework: Framework::Actix,
+        method: m,
+        route: route_path,
+        handler_name,
+        handler_location: SourceLocation::new(
+            file_rel,
+            (func.start_position().row + 1) as u32,
+            (func.start_position().column + 1) as u32,
+        ),
+        auth_required,
+    }))
+}
+
+fn collect_preceding_attributes(func: Node) -> Vec<Node> {
+    let mut out: Vec<Node> = Vec::new();
+    let Some(parent) = func.parent() else {
+        return out;
+    };
+    let mut cursor = parent.walk();
+    let mut pending: Vec<Node> = Vec::new();
+    for sib in parent.children(&mut cursor) {
+        if sib.id() == func.id() {
+            out.append(&mut pending);
+            return out;
+        }
+        if sib.kind() == "attribute_item" || sib.kind() == "inner_attribute_item" {
+            let mut aw = sib.walk();
+            for inner in sib.children(&mut aw) {
+                if inner.kind() == "attribute" {
+                    pending.push(inner);
+                }
+            }
+        } else {
+            pending.clear();
+        }
+    }
+    out
+}
+
+fn extract_route_method(inner: &str) -> Option<HttpMethod> {
+    for verb in ["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"] {
+        if inner.contains(verb) {
+            return HttpMethod::from_ident(verb);
+        }
+    }
+    None
+}
+
+fn signature_uses_auth_extractor(func: Node, bytes: &[u8]) -> bool {
+    let Some(params) = func.child_by_field_name("parameters") else {
+        return false;
+    };
+    let Ok(text) = params.utf8_text(bytes) else {
+        return false;
+    };
+    AUTH_EXTRACTORS.iter().any(|n| text.contains(n))
+}
+
+fn function_name(func: Node, bytes: &[u8]) -> Option<String> {
+    func.child_by_field_name("name")
+        .and_then(|n| n.utf8_text(bytes).ok())
+        .map(str::to_string)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::path::PathBuf;
+
+    fn parse(src: &str) -> (Tree, Vec<u8>) {
+        let mut parser = tree_sitter::Parser::new();
+        parser
+            .set_language(&tree_sitter_rust::LANGUAGE.into())
+            .unwrap();
+        (parser.parse(src, None).unwrap(), src.as_bytes().to_vec())
+    }
+
+    #[test]
+    fn detects_actix_get() {
+        let src = r#"
+use actix_web::{get, HttpResponse};
+#[get("/users")]
+async fn list_users() -> HttpResponse { HttpResponse::Ok().finish() }
+"#;
+        let (tree, bytes) = parse(src);
+        let nodes = detect_actix_routes(&tree, &bytes, &PathBuf::from("main.rs"), None);
+        assert_eq!(nodes.len(), 1);
+        let SurfaceNode::EntryPoint(ep) = &nodes[0] else {
+            panic!()
+        };
+        assert_eq!(ep.method, HttpMethod::GET);
+        assert_eq!(ep.route, "/users");
+    }
+}

src/surface/lang/rust_axum.rs

@@ -0,0 +1,191 @@
+//! Rust + axum framework probe.
+//!
+//! Detects axum route registration:
+//!
+//! * `Router::new().route("/path", get(handler))` /
+//!   `.route("/path", post(handler))` / etc.
+//! * Bare extractor-shaped function items in files that import axum
+//!   (handler typing alone is treated as a candidate, but only when a
+//!   `Router::route(...)` registration in the same file references it).
+
+use crate::entry_points::HttpMethod;
+use crate::surface::lang::common::{loc_for, rel_file, string_node_value};
+use crate::surface::{EntryPoint, Framework, SourceLocation, SurfaceNode};
+use std::collections::HashMap;
+use std::path::Path;
+use tree_sitter::{Node, Tree};
+
+const VERBS: &[(&str, HttpMethod)] = &[
+    ("get", HttpMethod::GET),
+    ("post", HttpMethod::POST),
+    ("put", HttpMethod::PUT),
+    ("delete", HttpMethod::DELETE),
+    ("patch", HttpMethod::PATCH),
+    ("head", HttpMethod::HEAD),
+    ("options", HttpMethod::OPTIONS),
+];
+
+pub const AUTH_EXTRACTORS: &[&str] = &[
+    "Extension<User",
+    "BearerAuth",
+    "RequireAuth",
+    "AuthenticatedUser",
+    "JwtClaims",
+];
+
+pub fn detect_axum_routes(
+    tree: &Tree,
+    bytes: &[u8],
+    path: &Path,
+    scan_root: Option<&Path>,
+) -> Vec<SurfaceNode> {
+    let file_text = std::str::from_utf8(bytes).unwrap_or("");
+    if !file_text.contains("axum::") && !file_text.contains("use axum") {
+        return Vec::new();
+    }
+    let file_rel = rel_file(path, scan_root);
+    let function_index = collect_functions(tree.root_node(), bytes);
+    let mut out = Vec::new();
+    walk_calls(tree.root_node(), &mut |call| {
+        if let Some(node) = match_router_route(call, bytes, &file_rel, &function_index) {
+            out.push(node);
+        }
+    });
+    out
+}
+
+fn walk_calls<'tree, F: FnMut(Node<'tree>)>(node: Node<'tree>, visit: &mut F) {
+    if node.kind() == "call_expression" {
+        visit(node);
+    }
+    let mut cursor = node.walk();
+    for child in node.children(&mut cursor) {
+        walk_calls(child, visit);
+    }
+}
+
+fn collect_functions<'tree>(
+    root: Node<'tree>,
+    bytes: &'tree [u8],
+) -> HashMap<String, (Node<'tree>, bool)> {
+    let mut out: HashMap<String, (Node<'tree>, bool)> = HashMap::new();
+    fn walk<'tree>(
+        node: Node<'tree>,
+        bytes: &'tree [u8],
+        out: &mut HashMap<String, (Node<'tree>, bool)>,
+    ) {
+        if node.kind() == "function_item"
+            && let Some(name_node) = node.child_by_field_name("name")
+            && let Ok(name) = name_node.utf8_text(bytes)
+        {
+            let auth = node
+                .child_by_field_name("parameters")
+                .and_then(|p| p.utf8_text(bytes).ok())
+                .map(|t| AUTH_EXTRACTORS.iter().any(|x| t.contains(x)))
+                .unwrap_or(false);
+            out.insert(name.to_string(), (node, auth));
+        }
+        let mut cursor = node.walk();
+        for child in node.children(&mut cursor) {
+            walk(child, bytes, out);
+        }
+    }
+    walk(root, bytes, &mut out);
+    out
+}
+
+fn match_router_route<'tree>(
+    call: Node<'tree>,
+    bytes: &[u8],
+    file_rel: &str,
+    function_index: &HashMap<String, (Node<'tree>, bool)>,
+) -> Option<SurfaceNode> {
+    let func = call.child_by_field_name("function")?;
+    if func.kind() != "field_expression" {
+        return None;
+    }
+    let field = func.child_by_field_name("field")?;
+    if field.utf8_text(bytes).ok()? != "route" {
+        return None;
+    }
+    let args = call.child_by_field_name("arguments")?;
+    let mut cursor = args.walk();
+    let positional: Vec<Node> = args
+        .children(&mut cursor)
+        .filter(|n| !matches!(n.kind(), "(" | ")" | ","))
+        .collect();
+    if positional.len() < 2 {
+        return None;
+    }
+    let route = string_node_value(positional[0], bytes)?;
+    let method_args = positional[1];
+    if method_args.kind() != "call_expression" {
+        return None;
+    }
+    let method_callee = method_args.child_by_field_name("function")?;
+    let method_text = method_callee.utf8_text(bytes).ok()?;
+    let leaf = method_text.rsplit("::").next().unwrap_or(method_text);
+    let (_, method) = VERBS.iter().find(|(v, _)| *v == leaf)?;
+    let method_args_node = method_args.child_by_field_name("arguments")?;
+    let mut hcur = method_args_node.walk();
+    let handler_node = method_args_node
+        .children(&mut hcur)
+        .find(|n| n.kind() == "identifier" || n.kind() == "scoped_identifier")?;
+    let handler_name = handler_node.utf8_text(bytes).ok()?.to_string();
+    let auth_required = function_index
+        .get(&handler_name)
+        .map(|(_, a)| *a)
+        .unwrap_or(false);
+    let handler_loc = function_index
+        .get(&handler_name)
+        .map(|(node, _)| {
+            SourceLocation::new(
+                file_rel,
+                (node.start_position().row + 1) as u32,
+                (node.start_position().column + 1) as u32,
+            )
+        })
+        .unwrap_or_else(|| loc_for(handler_node, file_rel));
+    Some(SurfaceNode::EntryPoint(EntryPoint {
+        location: loc_for(call, file_rel),
+        framework: Framework::Axum,
+        method: *method,
+        route,
+        handler_name,
+        handler_location: handler_loc,
+        auth_required,
+    }))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::path::PathBuf;
+
+    fn parse(src: &str) -> (Tree, Vec<u8>) {
+        let mut parser = tree_sitter::Parser::new();
+        parser
+            .set_language(&tree_sitter_rust::LANGUAGE.into())
+            .unwrap();
+        (parser.parse(src, None).unwrap(), src.as_bytes().to_vec())
+    }
+
+    #[test]
+    fn detects_router_get() {
+        let src = r#"
+use axum::{Router, routing::get};
+async fn list_users() -> &'static str { "ok" }
+fn app() -> Router {
+    Router::new().route("/users", get(list_users))
+}
+"#;
+        let (tree, bytes) = parse(src);
+        let nodes = detect_axum_routes(&tree, &bytes, &PathBuf::from("main.rs"), None);
+        assert_eq!(nodes.len(), 1);
+        let SurfaceNode::EntryPoint(ep) = &nodes[0] else {
+            panic!()
+        };
+        assert_eq!(ep.method, HttpMethod::GET);
+        assert_eq!(ep.route, "/users");
+    }
+}

src/surface/lang/ts_next.rs

@@ -0,0 +1,315 @@
+//! TypeScript + Next.js framework probe.
+//!
+//! Recognises Next.js App Router route handlers (`app/**/route.{ts,tsx,js,jsx}`)
+//! by walking exported function declarations whose name is one of the
+//! HTTP method idents (`GET` / `POST` / …).  Also recognises Pages
+//! Router API routes (`pages/api/**/*.{ts,tsx,js,jsx}`) via the
+//! `export default handler` pattern.
+//!
+//! Server actions (`'use server'` directive at file or function scope)
+//! are also reported as entry points because they expose a function
+//! callable from a React client over the wire.
+
+use crate::entry_points::HttpMethod;
+use crate::surface::lang::common::{loc_for, rel_file};
+use crate::surface::{EntryPoint, Framework, SourceLocation, SurfaceNode};
+use std::path::Path;
+use tree_sitter::{Node, Tree};
+
+pub fn detect_next_routes(
+    tree: &Tree,
+    bytes: &[u8],
+    path: &Path,
+    scan_root: Option<&Path>,
+) -> Vec<SurfaceNode> {
+    let file_rel = rel_file(path, scan_root);
+    let mut out = Vec::new();
+    let app_router = is_app_router_route(path);
+    let pages_api = is_pages_api_route(path);
+    let route_path = derive_route_path(path);
+    let file_use_server = file_level_use_server(tree.root_node(), bytes);
+
+    if app_router {
+        collect_named_exports(tree.root_node(), bytes, &file_rel, &route_path, &mut out);
+    }
+    if pages_api {
+        collect_default_export(tree.root_node(), bytes, &file_rel, &route_path, &mut out);
+    }
+    if file_use_server {
+        collect_use_server_exports(tree.root_node(), bytes, &file_rel, &route_path, &mut out);
+    }
+    out
+}
+
+fn is_app_router_route(path: &Path) -> bool {
+    let Some(name) = path.file_name().and_then(|n| n.to_str()) else {
+        return false;
+    };
+    if !matches!(name, "route.ts" | "route.tsx" | "route.js" | "route.jsx") {
+        return false;
+    }
+    path.components()
+        .any(|c| c.as_os_str().to_string_lossy() == "app")
+}
+
+fn is_pages_api_route(path: &Path) -> bool {
+    let mut comps = path.components().peekable();
+    let mut saw_pages = false;
+    while let Some(c) = comps.next() {
+        if c.as_os_str().to_string_lossy() == "pages" {
+            saw_pages = true;
+        } else if saw_pages && c.as_os_str().to_string_lossy() == "api" {
+            return true;
+        }
+    }
+    false
+}
+
+/// Convert `app/users/[id]/route.ts` → `/users/[id]`.
+/// Convert `pages/api/users/index.ts` → `/users`.
+fn derive_route_path(path: &Path) -> String {
+    let mut comps: Vec<String> = Vec::new();
+    let mut started = false;
+    for comp in path.components() {
+        let text = comp.as_os_str().to_string_lossy().into_owned();
+        if !started {
+            if text == "app" || text == "api" || text == "pages" {
+                started = true;
+            }
+            continue;
+        }
+        comps.push(text);
+    }
+    if let Some(last) = comps.last_mut() {
+        // Drop the basename; route file becomes the trailing segment.
+        if last.starts_with("route.") || last.starts_with("index.") {
+            comps.pop();
+        } else if let Some(idx) = last.rfind('.') {
+            last.truncate(idx);
+        }
+    }
+    let joined = comps.join("/");
+    if joined.is_empty() {
+        "/".to_string()
+    } else {
+        format!("/{}", joined)
+    }
+}
+
+fn collect_named_exports(
+    root: Node,
+    bytes: &[u8],
+    file_rel: &str,
+    route_path: &str,
+    out: &mut Vec<SurfaceNode>,
+) {
+    fn recurse(
+        node: Node,
+        bytes: &[u8],
+        file_rel: &str,
+        route_path: &str,
+        out: &mut Vec<SurfaceNode>,
+    ) {
+        if node.kind() == "export_statement" {
+            // Look for `export async function NAME(...)` or `export const NAME = ...`
+            let mut cursor = node.walk();
+            for child in node.children(&mut cursor) {
+                if let Some((name, span)) = extract_named_function(child, bytes)
+                    && let Some(method) = HttpMethod::from_ident(&name)
+                {
+                    out.push(SurfaceNode::EntryPoint(EntryPoint {
+                        location: loc_for(node, file_rel),
+                        framework: Framework::NextAppRouter,
+                        method,
+                        route: route_path.to_string(),
+                        handler_name: name,
+                        handler_location: SourceLocation::new(
+                            file_rel,
+                            (span.0 + 1) as u32,
+                            (span.1 + 1) as u32,
+                        ),
+                        auth_required: false,
+                    }));
+                }
+            }
+        }
+        let mut cursor = node.walk();
+        for child in node.children(&mut cursor) {
+            recurse(child, bytes, file_rel, route_path, out);
+        }
+    }
+    recurse(root, bytes, file_rel, route_path, out);
+}
+
+fn extract_named_function(node: Node, bytes: &[u8]) -> Option<(String, (usize, usize))> {
+    match node.kind() {
+        "function_declaration" => {
+            let name_node = node.child_by_field_name("name")?;
+            let name = name_node.utf8_text(bytes).ok()?.to_string();
+            let pos = node.start_position();
+            Some((name, (pos.row, pos.column)))
+        }
+        "lexical_declaration" | "variable_declaration" => {
+            let mut cursor = node.walk();
+            for decl in node.children(&mut cursor) {
+                if decl.kind() == "variable_declarator"
+                    && let Some(name_node) = decl.child_by_field_name("name")
+                    && let Ok(name) = name_node.utf8_text(bytes)
+                {
+                    let pos = decl.start_position();
+                    return Some((name.to_string(), (pos.row, pos.column)));
+                }
+            }
+            None
+        }
+        _ => None,
+    }
+}
+
+fn collect_default_export(
+    root: Node,
+    bytes: &[u8],
+    file_rel: &str,
+    route_path: &str,
+    out: &mut Vec<SurfaceNode>,
+) {
+    fn recurse(
+        node: Node,
+        bytes: &[u8],
+        file_rel: &str,
+        route_path: &str,
+        out: &mut Vec<SurfaceNode>,
+    ) {
+        if node.kind() == "export_statement" {
+            let raw = node.utf8_text(bytes).unwrap_or("");
+            if raw.contains("default") {
+                let mut cursor = node.walk();
+                for child in node.children(&mut cursor) {
+                    let name = match child.kind() {
+                        "function_declaration" => child
+                            .child_by_field_name("name")
+                            .and_then(|n| n.utf8_text(bytes).ok())
+                            .map(str::to_string),
+                        "identifier" => child.utf8_text(bytes).ok().map(str::to_string),
+                        "arrow_function" | "function" | "function_expression" => {
+                            Some("default".to_string())
+                        }
+                        _ => None,
+                    };
+                    if let Some(name) = name {
+                        out.push(SurfaceNode::EntryPoint(EntryPoint {
+                            location: loc_for(node, file_rel),
+                            framework: Framework::NextAppRouter,
+                            method: HttpMethod::GET,
+                            route: route_path.to_string(),
+                            handler_name: name,
+                            handler_location: loc_for(child, file_rel),
+                            auth_required: false,
+                        }));
+                        return;
+                    }
+                }
+            }
+        }
+        let mut cursor = node.walk();
+        for child in node.children(&mut cursor) {
+            recurse(child, bytes, file_rel, route_path, out);
+        }
+    }
+    recurse(root, bytes, file_rel, route_path, out);
+}
+
+fn collect_use_server_exports(
+    root: Node,
+    bytes: &[u8],
+    file_rel: &str,
+    route_path: &str,
+    out: &mut Vec<SurfaceNode>,
+) {
+    let mut cursor = root.walk();
+    for child in root.children(&mut cursor) {
+        if child.kind() == "export_statement"
+            && let Some((name, span)) = export_function_name(child, bytes)
+        {
+            out.push(SurfaceNode::EntryPoint(EntryPoint {
+                location: loc_for(child, file_rel),
+                framework: Framework::NextServerAction,
+                method: HttpMethod::POST,
+                route: route_path.to_string(),
+                handler_name: name,
+                handler_location: SourceLocation::new(
+                    file_rel,
+                    (span.0 + 1) as u32,
+                    (span.1 + 1) as u32,
+                ),
+                auth_required: false,
+            }));
+        }
+    }
+}
+
+fn export_function_name(node: Node, bytes: &[u8]) -> Option<(String, (usize, usize))> {
+    let mut cursor = node.walk();
+    for child in node.children(&mut cursor) {
+        if let Some(extracted) = extract_named_function(child, bytes) {
+            return Some(extracted);
+        }
+    }
+    None
+}
+
+fn file_level_use_server(root: Node, bytes: &[u8]) -> bool {
+    let mut cursor = root.walk();
+    for child in root.children(&mut cursor) {
+        if child.kind() == "expression_statement" {
+            let mut cs = child.walk();
+            for c in child.children(&mut cs) {
+                if c.kind() == "string"
+                    && let Ok(text) = c.utf8_text(bytes)
+                {
+                    let trimmed = text.trim().trim_matches(['\'', '"']);
+                    if trimmed == "use server" {
+                        return true;
+                    }
+                }
+            }
+            return false;
+        }
+        if !matches!(child.kind(), "comment" | "import_statement") {
+            return false;
+        }
+    }
+    false
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::path::PathBuf;
+
+    fn parse(src: &str) -> (Tree, Vec<u8>) {
+        let mut parser = tree_sitter::Parser::new();
+        parser
+            .set_language(&tree_sitter_typescript::LANGUAGE_TSX.into())
+            .unwrap();
+        (parser.parse(src, None).unwrap(), src.as_bytes().to_vec())
+    }
+
+    #[test]
+    fn detects_app_router_get() {
+        let src = "export async function GET(req: Request) { return new Response('ok'); }\n";
+        let (tree, bytes) = parse(src);
+        let nodes = detect_next_routes(
+            &tree,
+            &bytes,
+            &PathBuf::from("app/users/route.ts"),
+            None,
+        );
+        assert_eq!(nodes.len(), 1);
+        let SurfaceNode::EntryPoint(ep) = &nodes[0] else {
+            panic!()
+        };
+        assert_eq!(ep.method, HttpMethod::GET);
+        assert!(ep.route.contains("users"));
+    }
+}