[ENG-4061] Recognise more ways handlers read their request

[patchstackdave]

Refs ENG-4061

Stacked on #308. Review that one first; this diff is only the last commit.

The input map now recognises more of the ways handlers read their request. Each addition names the field in the namespace it arrives in, on both the input inventory and the flow side:

• Query string through the request URL: new URL(request.url).searchParams.get('q'), the same through a URL binding, a searchParams binding or destructured { searchParams }, request.nextUrl, and a request event's url (SvelteKit, Astro). Other members of the URL are not treated as request fields.
• Other names for the request: const r = req, and aliases of a namespace (const b = req.body, const q = req.query, const h = request.headers). A field destructured from req.body now proves its flow. An alias of the body is not treated as the request itself.
• Framework request objects: a request event's request (SvelteKit, Astro), and a route context's params in the second argument (Next.js).
• Hono: c.req.json(), c.req.query(), c.req.param() and c.req.header(). c.req.query(...) is no longer inventoried as a database call.
• Next.js Pages Router: the default export of a pages/api/** file, whether declared in place, as an arrow, or exported by name. Its route comes from the file location. Default exports elsewhere under pages/ are not endpoints.
• Schemas declared outside the handler: Schema.parse(await request.json()) reads the fields of a schema declared in the same module. When the schema is imported from another module, its fields cannot be read, so the endpoint is marked inputsResolved: false.

A read through any of these keeps the reassignment marker of the binding it comes from. Once that binding is assigned again, the read proves reachability (transformed-local) but not an exact value. new URL(...) counts only when URL is the global constructor or globalThis.URL; a local or imported URL does not.

Effect on map output
Maps of apps using these idioms gain inputs, proven flows and, for Pages Router apps, endpoints.

Validation: full suite (3,516 passed, 7 skipped), typecheck, build. New regression tests fail on the base branch, and each rule has its own test.

🤖 Generated with Claude Code

[coderbuds]

Adds support for diverse request reading idioms with extensive input mapping coverage.

🎯 Quality: 84% Excellent · 📦 Size: Large — consider splitting if possible

🛡️ Standards: Not checked — 537 lines changed, over your team's 400-line limit, and nothing checked before it was opened. Coding agents can call the assess-change-fit tool first, while a change this size is still cheap to split.

🤖 Authorship: Agent-written — Claude Code, going by its own attribution. Whether a person read it is unknown; coding agents can call the report-ai-usage tool to say.

📈 This month: Your 163rd PR — above team average · Averaging Good

_{See how your team is trending →}

[patchstackdave]

/review