diff --git a/AGENT-INSTALL.md b/AGENT-INSTALL.md
index 6c7d3d3..c752b58 100644
--- a/AGENT-INSTALL.md
+++ b/AGENT-INSTALL.md
@@ -5,11 +5,13 @@ This versioned reference ships inside `@patchstack/connect` and documents each s
 ## Package and command behavior
 
 - Package: [`@patchstack/connect`](https://www.npmjs.com/package/@patchstack/connect), MIT-licensed, source at https://github.com/patchstack/connect. `npm view @patchstack/connect` shows the live registry metadata.
-- It reads the project's **dependency list only** — from the lockfile (`package-lock.json`, `pnpm-lock.yaml`, `yarn.lock`) or, on bun projects (`bun.lock`/`bun.lockb`), by enumerating the installed packages under `node_modules/` — and sends package names + versions to Patchstack for vulnerability matching. No source code, no env var values, no file paths, no git history. (`mark-build` additionally stamps built HTML with a coarse stack descriptor that may include hosting-related env variable *names* — e.g. `VERCEL`, `CF_PAGES` — never their values.)
+- **What is sent to Patchstack is the dependency list only** — read from the lockfile (`package-lock.json`, `pnpm-lock.yaml`, `yarn.lock`) or, on bun projects (`bun.lock`/`bun.lockb`), by enumerating the installed packages under `node_modules/` — package names + versions, for vulnerability matching. No source code, no env var values, no file paths, no git history is ever transmitted. (`mark-build` additionally stamps built HTML with a coarse stack descriptor that may include hosting-related env variable *names* — e.g. `VERCEL`, `CF_PAGES` — never their values.)
+- **One command reads source files, locally:** `map` (see below) parses your server source to report your app's attack surface. It runs only when you invoke it, prints to stdout, and transmits nothing. No other command reads source (`protect` writes guard files but does not analyze your code).
 - **`scan` makes one source edit, and only after a successful post:** it adds (or updates) the disclosure widget's `<script>` tag in the project's root HTML shell — the first of `index.html`, `public/index.html`, or `src/app.html` that exists. It touches no other file, never edits on `--dry-run` or after a failed post, leaves any pre-existing manual widget tag untouched, and is disabled entirely by `"widget": false` in `.patchstackrc.json`. `mark-build` writes to build output only (`dist/`, `build/`, `out/`, `.output/public`), never to source. `guide`, `status`, and `init` write nothing except `init`'s own `.patchstackrc.json`.
 - **`setup` runs `scan`, then `protect`, then edits `package.json` scripts:** provisioning happens first so the runtime guard can bake the real site UUID. It verifies the resulting framework seam, preserves existing commands, adds `scan` after dependency installs and before builds, adds `mark-build` after builds, and uses a direct build chain for Bun. It never runs the project build. If the widget or runtime guard needs a framework-specific manual merge, it prints the exact remaining step instead of overwriting user code.
 - The package also exposes **`protect`** directly (runtime exploit guard; its templates live under `dist/protect/`). `setup` invokes it automatically; `scan`, `guide`, `status`, and `mark-build` do not. It writes only local files and auto-wires known stacks — **TanStack Start + Supabase** (patches the Supabase client + `src/start.ts`), **Next.js** (scaffolds `middleware.ts`), **SvelteKit** (`src/hooks.server.ts`), **Astro** (`src/middleware.ts`), **Nuxt** (`server/middleware/`), **NestJS** (`app.use(patchstackMiddleware)` in the bootstrap), **Fastify** (`app.register(patchstackFastify)`), and **Express** (`app.use(patchstackMiddleware)`). On **any other stack** it scaffolds a framework-agnostic guard under `src/patchstack/` and prints a wiring plan — then you finish the install by importing that guard into your server entry (`protectFetch(handler)` for a Web-Fetch server, or `app.use(patchstackMiddleware)` for Node/Express) and running `patchstack-connect protect --check` to confirm it is wired (exit 1 until it is). Passing `--demo` seeds a broad sample rule set (for demonstrations, not production).
 - **`demo node-serialize` is an explicit production-backed walkthrough.** It requires `node-serialize@0.0.4` to already be present in the lockfile; it does not install the vulnerable dependency. It runs the same production `scan`, polls the configured site's public Pulse rules endpoint until rule `18843` is served, runs `protect`, verifies the generated guard, and prints exploit/benign test requests. It writes the same manifest/widget and guard files as those underlying commands. It does not start/restart the app and does not send the printed requests.
+- **`map` is a local, read-only analysis command.** It walks the project's server source (skipping `node_modules`, build output and dot-directories; it does not follow symlinks out of the project unless you pass `--follow-symlinks`), parses it with the project's **own** `typescript`, and prints JSON describing the attack surface: entry points, the inputs each reads, the sinks they can reach (database / file system / process / outbound HTTP) with the npm package behind each, and evidence-backed input→sink flows marked `precise` or `heuristic`. Static analysis is best-effort, so the output reports the *detected* surface with coverage counters — not a completeness guarantee. It writes nothing (except the file you name with `--out`), contacts nothing, and is never invoked by `scan`, `setup`, `guide`, `protect`, or `mark-build`.
 - **`demo-guide node-serialize` is the read-only companion.** It checks the Host-created site configuration and vulnerable lockfile entry, explains the complete local prepare/run/restart/prove/cleanup sequence, and prints the next exact command. It does not require a deployment and does not change files or contact Patchstack.
 - Patchstack is not WordPress-only. This connector monitors any JS/Node project — Vite, Next.js, plain vanilla JS, anything with a lockfile.
 
diff --git a/README.md b/README.md
index b1709bf..03789ea 100644
--- a/README.md
+++ b/README.md
@@ -69,6 +69,15 @@ patchstack-connect protect                         Install/reconcile the always-
                                                    guard. Auto-wires supported server stacks;
                                                    use --check to verify or --demo for local rules.
                                                    Also run by setup; never run by scan/guide/mark-build.
+patchstack-connect map    [--dir p] [--out f]      Print a JSON map of this project's attack
+                                                   surface: server entry points, the inputs each
+                                                   reads, the sinks they can reach (database, file
+                                                   system, process, outbound HTTP) and the npm
+                                                   package behind each sink. READS YOUR SOURCE
+                                                   FILES locally and parses them with the
+                                                   project's own TypeScript; writes nothing except
+                                                   --out, and posts nothing. Never run by
+                                                   scan/setup/guide/protect — run it yourself.
 patchstack-connect demo node-serialize             Production-backed walkthrough: require
                                                    node-serialize@0.0.4, scan it, wait for live
                                                    rule 18843, install + verify the runtime guard,
@@ -189,7 +198,7 @@ Lower-level pieces are also exported: `scanLockfile`, `buildWirePayload`, `postM
 }
 ```
 
-That's the entire payload. No source code, no environment variable values, no file paths — just the package names and versions from your lockfile. Duplicate names with different versions are preserved so transitive vulnerabilities aren't missed. (`mark-build` separately stamps built HTML with a stack descriptor that may include hosting-related env variable *names* — e.g. `VERCEL` — never their values.)
+That's the entire payload. No source code, no environment variable values, no file paths — just the package names and versions from your lockfile. (The `map` command reads source files locally to report your attack surface, but transmits nothing.) Duplicate names with different versions are preserved so transitive vulnerabilities aren't missed. (`mark-build` separately stamps built HTML with a stack descriptor that may include hosting-related env variable *names* — e.g. `VERCEL` — never their values.)
 
 ## Supported lockfiles
 
diff --git a/src/cli.ts b/src/cli.ts
index d2df467..f158dea 100644
--- a/src/cli.ts
+++ b/src/cli.ts
@@ -36,6 +36,7 @@ import {
   renderGuideChecklist,
 } from './guide.js';
 import { runProtect, runVerify } from './protect/install/index.js';
+import { buildInputMap } from './map/index.js';
 import { setupProtection, wireBuildScripts } from './setup.js';
 import { detectStack, type StackDescriptor } from './stack.js';
 import { PatchstackError } from './types.js';
@@ -56,6 +57,14 @@ Usage:
                                                      manage the widget, install + verify runtime
                                                      protection, and wire dependency/build scans.
                                                      Never runs the project build
+  patchstack-connect map    [--dir <p>] [--out <f>]  Map the app's attack surface: entry points, the
+                                                     inputs each reads, the sinks it can reach, and
+                                                     evidence-backed input→sink flows (each marked
+                                                     precise or heuristic). Best-effort static
+                                                     analysis — reports the DETECTED surface, with
+                                                     coverage counters. Prints JSON (--out writes a
+                                                     file; --follow-symlinks leaves the project dir).
+                                                     Uses the app's own TypeScript
   patchstack-connect init   <site-uuid>              Optional: pre-seed .patchstackrc.json
                                                      with an existing site UUID
   patchstack-connect status [options]                Show current configuration and whether the
@@ -128,7 +137,7 @@ Examples:
   npx @patchstack/connect demo-guide node-serialize
 `;
 
-const VALUE_FLAGS = new Set(['site-uuid', 'endpoint', 'dir', 'url']);
+const VALUE_FLAGS = new Set(['site-uuid', 'endpoint', 'dir', 'url', 'out']);
 
 interface ParsedArgs {
   command: string | null;
@@ -193,6 +202,41 @@ async function runInit(args: ParsedArgs): Promise<number> {
   return 0;
 }
 
+async function runMap(args: ParsedArgs): Promise<number> {
+  const cwd = getStringFlag(args.flags, 'dir') ?? process.cwd();
+  const { map, error } = await buildInputMap(cwd, {
+    followSymlinks: args.flags.get('follow-symlinks') === true,
+  });
+  if (!map) {
+    console.error(`patchstack: ${error}`);
+    return 1;
+  }
+  // Human summary → stderr; the JSON → stdout (so it can be piped / written). Report PRECISE flows
+  // separately from the inventories: only a precise flow is evidence that an input reaches a sink.
+  const inputs = map.endpoints.reduce((n, e) => n + e.inputs.length, 0);
+  const sinks = map.endpoints.reduce((n, e) => n + e.sinks.length, 0);
+  const precise = map.endpoints.reduce((n, e) => n + e.flows.filter((f) => f.confidence === 'precise').length, 0);
+  const c = map.coverage;
+  console.error(
+    `patchstack: ${map.endpoints.length} entry point(s), ${inputs} input(s), ${sinks} sink(s), ` +
+      `${precise} proven input→sink flow(s) [${map.framework}].`,
+  );
+  console.error(
+    `patchstack: ${c.filesParsed}/${c.filesDiscovered} file(s) parsed` +
+      (c.filesSkipped ? `, ${c.filesSkipped} skipped` : '') +
+      `. DETECTED surface only — static analysis is best-effort; unproven pairs are marked "heuristic".`,
+  );
+  const json = JSON.stringify(map, null, 2);
+  const out = getStringFlag(args.flags, 'out');
+  if (out) {
+    writeFileSync(out, json);
+    console.error(`patchstack: wrote ${out}`);
+  } else {
+    console.log(json);
+  }
+  return 0;
+}
+
 async function runScan(
   args: ParsedArgs,
   options: { showRemainingSetup?: boolean } = {},
@@ -771,6 +815,8 @@ async function main(): Promise<number> {
       return runGuide(args);
     case 'setup':
       return runSetup(args);
+    case 'map':
+      return runMap(args);
     default:
       console.error(`Unknown command: ${args.command}\n`);
       console.error(HELP);
diff --git a/src/map/extract.ts b/src/map/extract.ts
new file mode 100644
index 0000000..ebb34b0
--- /dev/null
+++ b/src/map/extract.ts
@@ -0,0 +1,971 @@
+import { readFileSync, readdirSync, realpathSync, statSync } from 'node:fs';
+import { builtinModules } from 'node:module';
+import { join, relative, isAbsolute } from 'node:path';
+import type { SiteInputMap, Endpoint, InputField, Sink, Flow, TsModule } from './types.js';
+
+// Framework-AGNOSTIC input-flow extractor. It doesn't gate on a specific stack — it walks any JS/TS
+// source and applies recognizer tables for (1) entry points, (2) inputs, (3) sinks, so it generalizes
+// across builders (TanStack Start, Next, SvelteKit, Express/Fastify/Hono, …) and providers, and
+// degrades gracefully (recording what it couldn't see in `coverage.notes`). Add a stack by adding a
+// recognizer, not a new adapter.
+//
+// False-positive control: sink and validator recognizers are gated on the file's module bindings —
+// a call whose receiver is a plain local object/class/function is NOT a dependency sink, and
+// `.object({…})` is only read as an input schema when its receiver traces to a known validator
+// package. Receivers that can't be traced (handler params, cross-file imports) stay heuristic,
+// favoring recall over precision.
+
+const HTTP_METHODS = new Set(['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS']);
+// One list drives BOTH the AST route-registration recognizer and the textual pre-filter — they must
+// never diverge: a file the pre-filter skips is invisible to every recognizer.
+const ROUTE_REGISTER_NAMES = ['get', 'post', 'put', 'patch', 'delete', 'options', 'all', 'head', 'use'];
+const ROUTE_REGISTER = new Set(ROUTE_REGISTER_NAMES);
+const ROUTE_CALL_RE = new RegExp(`\\.(${[...ROUTE_REGISTER_NAMES, 'route'].join('|')})\\s*\\(`);
+const DB_OPS = new Set(['insert', 'update', 'delete', 'select', 'upsert', 'rpc']);
+const PRISMA_OPS = new Set(['create', 'createMany', 'update', 'updateMany', 'delete', 'deleteMany', 'upsert', 'findFirst', 'findUnique', 'findMany', 'count', 'aggregate']);
+const FS_CALLS = /^(readFile|writeFile|readFileSync|writeFileSync|appendFile|createReadStream|createWriteStream|unlink|rm|rmSync|mkdir|readdir|stat|open)$/;
+const EXEC_CALLS = /^(exec|execSync|spawn|spawnSync|execFile|execFileSync|fork)$/;
+const HTTP_CALLS = /^(fetch|got|request)$/;
+const HTTP_MEMBER_METHODS = new Set(['get', 'post', 'put', 'patch', 'delete', 'head', 'request']);
+const ZOD_BASE = new Set(['string', 'number', 'boolean', 'array', 'object', 'enum', 'bigint', 'date', 'record']);
+// String-format refinements a validator can declare — kept on the field so a rule can pin the shape.
+const STRING_FORMATS = new Set(['email', 'uuid', 'url', 'ip', 'ipv4', 'ipv6', 'cuid', 'cuid2', 'ulid', 'emoji', 'datetime', 'base64', 'jwt', 'nanoid']);
+// Packages whose `.object({…})` calls describe an input schema.
+const VALIDATOR_PACKAGES = new Set(['zod', 'valibot', 'yup', 'joi', '@hapi/joi', 'superstruct']);
+// When a sink's base can't be traced precisely, infer its package from the file's imports of a known
+// provider for that sink kind (a file almost always uses one db/http client).
+const DB_PACKAGES = ['@supabase/supabase-js', '@prisma/client', 'drizzle-orm', 'knex', 'kysely', 'pg', 'mysql2', 'mysql', 'sequelize', 'typeorm', 'mongoose', 'better-sqlite3'];
+const HTTP_PACKAGES = ['axios', 'got', 'node-fetch', 'undici', 'superagent', 'ky'];
+const isHttpPackage = (pkg: string) => HTTP_PACKAGES.includes(pkg) || pkg === 'node:http' || pkg === 'node:https';
+const BUILTINS = new Set(builtinModules);
+
+// Per-file module bindings: resolve a local identifier to the npm package (or node: builtin) it came
+// from — directly (an import), or via `const x = <importedFn|new ImportedClass>(...)` /
+// `const x = require('mod')`; derived names resolve transitively (`const conn = pool.promise()`).
+// `imports` is every module specifier the file imports (for the fallback). `locals` is every name
+// declared in-file that does NOT trace to a module — calls on those receivers are not dependency
+// sinks. (Names assigned outside their declaration, e.g. `let fs; fs = require('fs')`, are treated
+// as local — an accepted miss.)
+interface Bindings {
+  resolve(name: string): string | undefined;
+  imports: Set<string>;
+  locals: Set<string>;
+}
+function buildModuleBindings(sf: any, ts: TsModule): Bindings {
+  const nameToModule = new Map<string, string>(); // local name → module specifier
+  const declared = new Set<string>(); // every name declared in this file
+  const imports = new Set<string>();
+
+  const record = (local: string, mod: string) => { nameToModule.set(local, mod); imports.add(mod); };
+  const declareBound = (nameNode: any) => {
+    if (ts.isIdentifier(nameNode)) declared.add(nameNode.text);
+    else if (ts.isObjectBindingPattern(nameNode) || ts.isArrayBindingPattern(nameNode)) {
+      for (const el of nameNode.elements) if (ts.isBindingElement(el) && ts.isIdentifier(el.name)) declared.add(el.name.text);
+    }
+  };
+
+  const visit = (node: any) => {
+    // import … from 'mod'
+    if (ts.isImportDeclaration(node) && node.moduleSpecifier && ts.isStringLiteralLike(node.moduleSpecifier)) {
+      const mod = node.moduleSpecifier.text;
+      imports.add(mod);
+      const clause = node.importClause;
+      if (clause?.name) record(clause.name.text, mod); // default
+      const nb = clause?.namedBindings;
+      if (nb) {
+        if (ts.isNamespaceImport(nb)) record(nb.name.text, mod);
+        else if (ts.isNamedImports(nb)) for (const el of nb.elements) record(el.name.text, mod);
+      }
+    }
+    if (ts.isFunctionDeclaration(node) && node.name) declared.add(node.name.text);
+    if (ts.isClassDeclaration(node) && node.name) declared.add(node.name.text);
+    // const x = require('mod')  /  const { a } = require('mod')
+    if (ts.isVariableStatement(node)) {
+      for (const decl of node.declarationList.declarations) {
+        declareBound(decl.name);
+        const init = decl.initializer;
+        const reqMod = requireSpecifier(init, ts);
+        if (reqMod) {
+          if (ts.isIdentifier(decl.name)) record(decl.name.text, reqMod);
+          else if (ts.isObjectBindingPattern(decl.name)) for (const el of decl.name.elements) if (ts.isIdentifier(el.name)) record(el.name.text, reqMod);
+        }
+        // const x = tracedFactory(...)  /  const x = new TracedClass(...)  → x carries that package.
+        // Looking up nameToModule (not just direct imports) makes this transitive: pool → conn → ….
+        // Recorded as pending too, so a factory resolved LATER (a local wrapper, below) still binds x.
+        if (init && ts.isIdentifier(decl.name)) {
+          const callee = ts.isCallExpression(init) ? init.expression : ts.isNewExpression(init) ? init.expression : undefined;
+          const root = callee ? rootIdentifier(callee, ts) : undefined;
+          if (root) {
+            pending.push([decl.name.text, root]);
+            if (nameToModule.has(root)) record(decl.name.text, nameToModule.get(root)!);
+          }
+        }
+      }
+    }
+    // A LOCAL factory that hands back a dependency object: `function getClient() { return createClient(…) }`.
+    // Without this, `const supabase = getClient()` looks like a plain local and every sink on it is
+    // dropped as "not a dependency" — silently losing the real client (the common AI-generated shape).
+    if ((ts.isFunctionDeclaration(node) || isFnLike(node, ts)) && node.body) {
+      const fnName = ts.isFunctionDeclaration(node) && node.name
+        ? node.name.text
+        : ts.isVariableDeclaration(node.parent) && ts.isIdentifier(node.parent.name)
+          ? node.parent.name.text
+          : undefined;
+      if (fnName) {
+        const root = returnedRootIdentifier(node.body, ts);
+        if (root) pending.push([fnName, root]);
+      }
+    }
+    ts.forEachChild(node, visit);
+  };
+  const pending: Array<[string, string]> = []; // [localName, rootIdentifierItCameFrom]
+  visit(sf);
+  // Fixpoint: resolve chains like createClient → getClient → supabase (bounded; order-independent).
+  for (let i = 0; i < 4; i++) {
+    let changed = false;
+    for (const [name, root] of pending) {
+      if (!nameToModule.has(name) && nameToModule.has(root)) { record(name, nameToModule.get(root)!); changed = true; }
+    }
+    if (!changed) break;
+  }
+  const locals = new Set([...declared].filter((n) => !nameToModule.has(n)));
+  return { resolve: (name: string) => nameToModule.get(name), imports, locals };
+}
+
+// Root identifier of what a function body returns (`return createClient(…)` → "createClient"), for
+// following a local factory to the dependency it wraps. Concise arrow bodies are the expression itself.
+function returnedRootIdentifier(body: any, ts: TsModule): string | undefined {
+  if (!ts.isBlock(body)) return rootIdentifier(body, ts); // concise arrow body
+  let found: string | undefined;
+  const visit = (n: any) => {
+    if (found) return;
+    if (isUninvokedFunctionDeclaration(n, ts) && n !== body) return; // don't read a nested fn's return
+    if (ts.isReturnStatement(n) && n.expression) { found = rootIdentifier(n.expression, ts); return; }
+    ts.forEachChild(n, visit);
+  };
+  visit(body);
+  return found;
+}
+
+function requireSpecifier(init: any, ts: TsModule): string | undefined {
+  if (init && ts.isCallExpression(init) && ts.isIdentifier(init.expression) && init.expression.text === 'require') {
+    const a = init.arguments[0];
+    if (a && ts.isStringLiteralLike(a)) return a.text;
+  }
+  return undefined;
+}
+
+// Leftmost identifier of a member/call chain (`supabase.from(x).insert` → "supabase", `fs.writeFile` → "fs").
+function rootIdentifier(node: any, ts: TsModule): string | undefined {
+  let cur = node;
+  while (cur) {
+    if (ts.isIdentifier(cur)) return cur.text;
+    if (ts.isPropertyAccessExpression(cur) || ts.isElementAccessExpression(cur) || ts.isCallExpression(cur) || ts.isNonNullExpression(cur) || ts.isParenthesizedExpression(cur) || ts.isAwaitExpression(cur)) {
+      cur = cur.expression;
+    } else return undefined;
+  }
+  return undefined;
+}
+
+// Normalize a module specifier to its npm package root (keep scope, drop subpath). Node builtins are
+// normalized to the `node:` form even when imported bare (`import fs from 'fs'`) — there IS an npm
+// package named `fs`, and CVE correlation must never confuse the two. Relative paths → undefined.
+function npmPackageOf(spec: string | undefined): string | undefined {
+  if (!spec) return undefined;
+  if (spec.startsWith('.') || spec.startsWith('/')) return undefined;
+  if (spec.startsWith('node:')) return spec;
+  if (BUILTINS.has(spec)) return `node:${spec}`;
+  const parts = spec.split('/');
+  return spec.startsWith('@') ? parts.slice(0, 2).join('/') : parts[0];
+}
+
+// 1-based line of a node in its source file — the auditable coordinate rules and humans point at.
+function lineOf(node: any): number | undefined {
+  const sf = typeof node?.getSourceFile === 'function' ? node.getSourceFile() : undefined;
+  if (!sf) return undefined;
+  try { return sf.getLineAndCharacterOfPosition(node.getStart(sf)).line + 1; } catch { return undefined; }
+}
+
+export interface ExtractOptions {
+  /** Follow symlinks that leave the project directory (off by default — keeps analysis in-project). */
+  followSymlinks?: boolean;
+}
+
+export async function extractInputMap(cwd: string, ts: TsModule, options: ExtractOptions = {}): Promise<SiteInputMap> {
+  const notes: string[] = [];
+  const endpoints: Endpoint[] = [];
+  const failed: string[] = [];
+  let boundary = cwd;
+  try { boundary = realpathSync(cwd); } catch { /* use cwd as-is */ }
+
+  const stats: WalkStats = { discovered: 0 };
+  const files = collectSources(cwd, boundary, { followOutside: options.followSymlinks }, [], new Set(), stats);
+  let parsed = 0;
+
+  for (const file of files) {
+    try {
+      const text = readFileSync(file, 'utf8');
+      if (!hasEntrySignal(text)) continue;
+      parsed++;
+      const sf = ts.createSourceFile(file, text, ts.ScriptTarget.Latest, true, guessScriptKind(ts, file));
+      const bindings = buildModuleBindings(sf, ts);
+      const localSinks = collectLocalSinks(sf, ts, bindings);
+      for (const ep of extractFromFile(sf, ts, localSinks, bindings)) {
+        const relFile = relative(cwd, file);
+        // A FILE-BASED route handler carries its URL path in its location, not in the code, so derive
+        // it here — without this a rule can only be param-pinned, never route-scoped (`when.path`).
+        if (ep.route === undefined && (ep.entryKind === 'route-handler' || ep.entryKind === 'server-action')) {
+          const derived = routeFromFilePath(relFile);
+          if (derived.route) {
+            ep.route = derived.route;
+            if (derived.dynamic) ep.routeDynamic = true;
+          }
+        }
+        endpoints.push({ ...ep, file: relFile });
+      }
+    } catch {
+      // Fail-open: one unreadable/unparseable file must never kill the whole map.
+      failed.push(relative(cwd, file));
+    }
+  }
+
+  notes.push('Static analysis is best-effort — this is the DETECTED surface, not a proof of completeness.');
+  notes.push('`inputs` and `sinks` are INVENTORIES (both present in the handler). Only `flows` asserts that an input reaches a sink — prefer flows with confidence "precise" when pinning a rule to a parameter.');
+  notes.push('Sinks are followed one level into same-file helpers; cross-file / dynamic indirection is not traced. Sinks inside declared-but-uncalled local functions are excluded.');
+  notes.push('A sink `package` is resolved from the file’s imports (precise) or inferred from a known provider import; an unresolved package means the backing dependency could not be traced.');
+  if (!options.followSymlinks) notes.push('Symlinks leaving the project directory were not followed (use --follow-symlinks to include them).');
+  if (failed.length > 0) {
+    const sample = failed.slice(0, 5).join(', ');
+    notes.push(`${failed.length} file(s) could not be analyzed and were skipped (fail-open): ${sample}${failed.length > 5 ? ', …' : ''}.`);
+  }
+  const unresolved = endpoints.filter((e) => e.inputsResolved === false).length;
+  if (unresolved > 0) {
+    notes.push(`${unresolved} endpoint(s) declare an input validator that could not be statically parsed — their inputs are UNKNOWN, not empty (marked inputsResolved: false).`);
+  }
+  const heuristicOnly = endpoints.filter((e) => e.sinks.length > 0 && e.inputs.length > 0 && !e.flows.some((f) => f.confidence === 'precise')).length;
+  if (heuristicOnly > 0) {
+    notes.push(`${heuristicOnly} endpoint(s) have inputs and sinks but no PRECISE data link — their flows are "heuristic" (may reach), not proven.`);
+  }
+  if (endpoints.length === 0) notes.push('No recognized server-side entry points found under the analyzed roots.');
+
+  return {
+    version: 1,
+    framework: detectFramework(cwd),
+    endpoints,
+    coverage: {
+      adapter: 'agnostic-v1',
+      filesDiscovered: stats.discovered,
+      filesParsed: parsed,
+      filesSkipped: failed.length,
+      roots: ['.'],
+      notes,
+    },
+  };
+}
+
+// Cheap textual pre-filter so we only parse files that could contain an entry point. Derived from the
+// same list as the AST recognizer (see ROUTE_REGISTER_NAMES).
+function hasEntrySignal(text: string): boolean {
+  return (
+    text.includes('createServerFn') ||
+    /\bexport\s+(async\s+)?(function|const)\s+(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS)\b/.test(text) ||
+    ROUTE_CALL_RE.test(text) ||
+    text.includes("'use server'") || text.includes('"use server"')
+  );
+}
+
+function detectFramework(cwd: string): string {
+  try {
+    const pkg = JSON.parse(readFileSync(join(cwd, 'package.json'), 'utf8'));
+    const d = { ...pkg.dependencies, ...pkg.devDependencies };
+    if (d['@tanstack/react-start'] || d['@tanstack/start'] || d['@tanstack/solid-start']) return 'tanstack-start';
+    if (d['next']) return 'next';
+    if (d['@sveltejs/kit']) return 'sveltekit';
+    if (d['@nestjs/core']) return 'nestjs';
+    if (d['fastify']) return 'fastify';
+    if (d['express']) return 'express';
+    if (d['hono']) return 'hono';
+  } catch { /* ignore */ }
+  return 'unknown';
+}
+
+function guessScriptKind(ts: TsModule, file: string) {
+  if (file.endsWith('.tsx')) return ts.ScriptKind.TSX;
+  if (file.endsWith('.jsx')) return ts.ScriptKind.JSX;
+  if (file.endsWith('.js')) return ts.ScriptKind.JS;
+  return ts.ScriptKind.TS;
+}
+
+const isSourceFile = (name: string) => /\.(ts|tsx|mts|cts|js|jsx|mjs|cjs)$/.test(name) && !name.endsWith('.d.ts');
+
+// Directories that never hold app source, so walking the whole project stays cheap. (We walk the whole
+// project rather than `src` only: server entrypoints, route dirs and platform function dirs commonly
+// live at the root — `server.ts`, `app/`, `api/`, `routes/`, `functions/`, `netlify/`, `supabase/`.)
+const SKIP_DIRS = new Set([
+  'node_modules', 'dist', 'build', 'out', 'coverage', 'public', 'static', 'assets',
+  '.git', '.next', '.nuxt', '.svelte-kit', '.output', '.vercel', '.wrangler', '.turbo', '.cache',
+  'vendor', 'tmp', 'temp', '__pycache__',
+]);
+
+export interface WalkStats { discovered: number }
+
+/**
+ * Walk the project for source files. Symlinks are followed ONLY while they stay inside the project
+ * boundary (`boundary`, a realpath) — a link to an external repo would otherwise pull unrelated code
+ * (and its paths) into the map. `followOutside` opts out of the boundary check. A realpath visited-set
+ * makes link cycles safe.
+ */
+function collectSources(
+  dir: string,
+  boundary: string,
+  opts: { followOutside?: boolean },
+  out: string[] = [],
+  seen = new Set<string>(),
+  stats: WalkStats = { discovered: 0 },
+): string[] {
+  let key: string;
+  try { key = realpathSync(dir); } catch { return out; }
+  if (seen.has(key)) return out;
+  if (!opts.followOutside && !isInside(key, boundary)) return out;
+  seen.add(key);
+  let entries;
+  try { entries = readdirSync(dir, { withFileTypes: true }); } catch { return out; }
+  for (const e of entries) {
+    if (SKIP_DIRS.has(e.name) || (e.name.startsWith('.') && e.name !== '.')) continue;
+    const full = join(dir, e.name);
+    if (e.isDirectory()) collectSources(full, boundary, opts, out, seen, stats);
+    else if (e.isSymbolicLink()) {
+      let st, real;
+      try { st = statSync(full); real = realpathSync(full); } catch { continue; }
+      if (!opts.followOutside && !isInside(real, boundary)) continue; // link escapes the project
+      if (st.isDirectory()) collectSources(full, boundary, opts, out, seen, stats);
+      else if (st.isFile() && isSourceFile(e.name)) { out.push(full); stats.discovered++; }
+    } else if (isSourceFile(e.name)) { out.push(full); stats.discovered++; }
+  }
+  return out;
+}
+
+function isInside(candidate: string, boundary: string): boolean {
+  if (candidate === boundary) return true;
+  const rel = relative(boundary, candidate);
+  return rel !== '' && !rel.startsWith('..') && !isAbsolute(rel);
+}
+
+// Derive the URL path of a FILE-BASED route handler from its location, across the conventions AI
+// builders actually emit. Dynamic segments become `:name` and set `dynamic` so a consumer knows the
+// route is a PATTERN (the engine's `when.path` takes a glob or /regex/, not an Express param), rather
+// than mistaking `/api/:id` for a literal path.
+//   Next App Router     app/api/items/route.ts          -> /api/items
+//                       app/api/items/[id]/route.ts     -> /api/items/:id      (dynamic)
+//                       app/(marketing)/api/x/route.ts  -> /api/x              (route group stripped)
+//   Next Pages Router   pages/api/items/index.ts        -> /api/items
+//                       pages/api/[id].ts               -> /api/:id            (dynamic)
+//   SvelteKit           src/routes/api/items/+server.ts -> /api/items
+//   Nuxt                server/api/items.post.ts        -> /api/items
+export function routeFromFilePath(relFile: string): { route?: string; dynamic?: boolean } {
+  const parts = relFile.split(/[\\/]/).filter(Boolean);
+  if (parts.length === 0) return {};
+  const base = (parts[parts.length - 1] ?? '').replace(/\.(ts|tsx|mts|cts|js|jsx|mjs|cjs)$/, '');
+  const dirs = parts.slice(0, -1);
+  const at = (name: string) => dirs.lastIndexOf(name);
+
+  let segs: string[] | null = null;
+  if (base === 'route' && at('app') !== -1) {
+    segs = dirs.slice(at('app') + 1); // Next App Router
+  } else if (base === '+server' && at('routes') !== -1) {
+    segs = dirs.slice(at('routes') + 1); // SvelteKit
+  } else if (at('pages') !== -1) {
+    segs = [...dirs.slice(at('pages') + 1), ...(base === 'index' ? [] : [base])]; // Next Pages Router
+  } else if (at('server') !== -1) {
+    // Nuxt server routes; a `.post`/`.get` suffix encodes the method, not a path segment.
+    segs = [...dirs.slice(at('server') + 1), ...(base === 'index' ? [] : [base.replace(/\.(get|post|put|patch|delete|head|options)$/i, '')])];
+  }
+  if (!segs) return {};
+
+  // Next route groups `(marketing)` and parallel/private segments don't appear in the URL.
+  segs = segs.filter((s) => !(s.startsWith('(') && s.endsWith(')')) && !s.startsWith('@') && !s.startsWith('_'));
+
+  let dynamic = false;
+  const mapped = segs.map((s) => {
+    const m = /^\[+(\.{0,3})(.+?)\]+$/.exec(s); // [id], [...slug], [[...slug]]
+    if (m) {
+      dynamic = true;
+      return ':' + m[2];
+    }
+    return s;
+  });
+  const route = '/' + mapped.join('/');
+  return { route: route.length > 1 ? route.replace(/\/+$/, '') : '/', dynamic };
+}
+
+// --- entry-point recognizers -----------------------------------------------
+function extractFromFile(sf: any, ts: TsModule, localSinks: Map<string, Sink[]>, bindings: Bindings): Omit<Endpoint, 'file'>[] {
+  const out: Omit<Endpoint, 'file'>[] = [];
+  const isServerActionsFile = fileHasUseServer(sf, ts);
+
+  const visit = (node: any) => {
+    if (ts.isVariableStatement(node) && hasExport(node, ts)) {
+      for (const decl of node.declarationList.declarations) {
+        // (1) TanStack Start: `export const NAME = createServerFn({method}).inputValidator(fn).handler(fn)`
+        if (decl.initializer && ts.isCallExpression(decl.initializer)) {
+          const chain = unwindChain(decl.initializer, ts);
+          if (chain.baseName === 'createServerFn' && ts.isIdentifier(decl.name)) {
+            const validatorCall = chain.calls['inputValidator'] ?? chain.calls['validator'];
+            const inputs = inputsFromValidator(validatorCall, ts, bindings);
+            const handlerFn = chain.calls['handler']?.arguments?.[0];
+            const sinks = sinksFrom(handlerFn, ts, localSinks, bindings);
+            const handlerBody = handlerFn && isFnLike(handlerFn, ts) ? handlerFn.body : undefined;
+            const ep: Omit<Endpoint, 'file'> = {
+              name: decl.name.text,
+              entryKind: 'server-fn',
+              method: methodFromObjectArg(chain.baseCall, ts),
+              line: lineOf(decl),
+              inputs,
+              sinks,
+              flows: linkFlows(handlerBody, handlerFn?.parameters, inputs, sinks, ts),
+            };
+            // Honesty marker: a validator EXISTS but couldn't be read — inputs are unknown, not "none".
+            if (validatorCall && inputs.length === 0) ep.inputsResolved = false;
+            out.push(ep);
+            continue;
+          }
+        }
+        // (2b) `export const POST = (req) => …` route handler, or a `'use server'` action arrow.
+        if (ts.isIdentifier(decl.name) && decl.initializer && isFnLike(decl.initializer, ts)) {
+          if (HTTP_METHODS.has(decl.name.text)) {
+            out.push(handlerEntry(decl.name.text, decl.name.text, decl.initializer.parameters, decl.initializer.body, ts, localSinks, bindings, { line: lineOf(decl) }));
+          } else if (isServerActionsFile) {
+            out.push(handlerEntry(decl.name.text, 'server-action', decl.initializer.parameters, decl.initializer.body, ts, localSinks, bindings, { line: lineOf(decl) }));
+          }
+        }
+      }
+    }
+
+    // (2a) Route handlers / server actions declared as functions.
+    if (ts.isFunctionDeclaration(node) && node.name && hasExport(node, ts)) {
+      if (HTTP_METHODS.has(node.name.text)) {
+        out.push(handlerEntry(node.name.text, node.name.text, node.parameters, node.body, ts, localSinks, bindings, { line: lineOf(node) }));
+      } else if (isServerActionsFile || hasUseServerDirective(node, ts)) {
+        out.push(handlerEntry(node.name.text, 'server-action', node.parameters, node.body, ts, localSinks, bindings, { line: lineOf(node) }));
+      }
+    }
+
+    if (ts.isCallExpression(node) && ts.isPropertyAccessExpression(node.expression)) {
+      const mname = node.expression.name.text;
+      // (3a) Route registrations: `app.post('/path', …, handler)` (Express/Fastify/Hono/Koa) and the
+      // chained `router.route('/x').get(handler)` idiom (path lives on the inner `.route()` call).
+      if (ROUTE_REGISTER.has(mname)) {
+        const args = node.arguments;
+        const first = args[0];
+        const route = first && ts.isStringLiteralLike(first) ? first.text : routeFromChain(node.expression.expression, ts);
+        const handler = args[args.length - 1];
+        if (route !== undefined && handler && isFnLike(handler, ts)) {
+          out.push(handlerEntry(route, 'route-registration', handler.parameters, handler.body, ts, localSinks, bindings, {
+            // `use`/`all` register handlers but are not HTTP methods — leave method undefined.
+            method: HTTP_METHODS.has(mname.toUpperCase()) ? mname.toUpperCase() : undefined,
+            route,
+            line: lineOf(node),
+          }));
+        }
+      }
+      // (3b) Fastify object form: `app.route({ method, url, handler })` — one endpoint per method.
+      if (mname === 'route') {
+        const arg = node.arguments[0];
+        if (arg && ts.isObjectLiteralExpression(arg)) {
+          const reg = routeObject(arg, ts);
+          if (reg.url && reg.handler) {
+            for (const m of reg.methods.length ? reg.methods : [undefined]) {
+              out.push(handlerEntry(reg.url, 'route-registration', reg.handler.parameters, reg.handler.body, ts, localSinks, bindings, { method: m, route: reg.url, line: lineOf(node) }));
+            }
+          }
+        }
+      }
+    }
+
+    ts.forEachChild(node, visit);
+  };
+  visit(sf);
+  return out;
+}
+
+// Unwind `router.route('/x').get(h).post(h2)` down to the `.route('/x')` call to recover the path.
+function routeFromChain(expr: any, ts: TsModule): string | undefined {
+  let cur = expr;
+  while (cur && ts.isCallExpression(cur) && ts.isPropertyAccessExpression(cur.expression)) {
+    const nm = cur.expression.name.text;
+    if (nm === 'route') {
+      const a = cur.arguments[0];
+      return a && ts.isStringLiteralLike(a) ? a.text : undefined;
+    }
+    if (!ROUTE_REGISTER.has(nm)) return undefined;
+    cur = cur.expression.expression;
+  }
+  return undefined;
+}
+
+// Read `{ method, url|path, handler }` from a Fastify-style route object (handler as arrow/function
+// property or as an object-method shorthand).
+function routeObject(obj: any, ts: TsModule): { url?: string; methods: string[]; handler?: any } {
+  let url: string | undefined;
+  let handler: any;
+  const methods: string[] = [];
+  for (const p of obj.properties) {
+    const key = (p.name as any)?.text;
+    if (ts.isPropertyAssignment(p)) {
+      if ((key === 'url' || key === 'path') && ts.isStringLiteralLike(p.initializer)) url = p.initializer.text;
+      if (key === 'method') {
+        if (ts.isStringLiteralLike(p.initializer)) methods.push(p.initializer.text.toUpperCase());
+        else if (ts.isArrayLiteralExpression(p.initializer)) {
+          for (const el of p.initializer.elements) if (ts.isStringLiteralLike(el)) methods.push(el.text.toUpperCase());
+        }
+      }
+      if (key === 'handler' && isFnLike(p.initializer, ts)) handler = p.initializer;
+    } else if (ts.isMethodDeclaration(p) && key === 'handler') handler = p;
+  }
+  return { url, methods, handler };
+}
+
+// Next server actions: a `'use server'` directive at the top of a module (whole file) or a function body.
+function fileHasUseServer(sf: any, ts: TsModule): boolean {
+  const first = sf.statements?.[0];
+  return Boolean(first && ts.isExpressionStatement(first) && ts.isStringLiteralLike(first.expression) && first.expression.text === 'use server');
+}
+function hasUseServerDirective(fn: any, ts: TsModule): boolean {
+  const first = fn.body?.statements?.[0];
+  return Boolean(first && ts.isExpressionStatement(first) && ts.isStringLiteralLike(first.expression) && first.expression.text === 'use server');
+}
+
+function handlerEntry(
+  name: string,
+  kindLabel: string,
+  params: any,
+  body: any,
+  ts: TsModule,
+  localSinks: Map<string, Sink[]>,
+  bindings: Bindings,
+  extra: { method?: string; route?: string; line?: number } = {},
+): Omit<Endpoint, 'file'> {
+  const entryKind = kindLabel === 'route-registration' ? 'route-registration' : kindLabel === 'server-action' ? 'server-action' : 'route-handler';
+  const inputs = inputsFromHandler(params, body, ts, bindings);
+  const sinks = sinksFrom({ body, parameters: params, isSyntheticBody: true }, ts, localSinks, bindings);
+  return {
+    name,
+    entryKind,
+    method: extra.method ?? (HTTP_METHODS.has(name) ? name : undefined),
+    route: extra.route,
+    line: extra.line,
+    inputs,
+    sinks,
+    flows: linkFlows(body, params, inputs, sinks, ts),
+  };
+}
+
+function isFnLike(n: any, ts: TsModule): n is import('typescript').ArrowFunction | import('typescript').FunctionExpression {
+  return ts.isArrowFunction(n) || ts.isFunctionExpression(n);
+}
+function hasExport(node: any, ts: TsModule): boolean {
+  return Boolean(node.modifiers?.some((m: any) => m.kind === ts.SyntaxKind.ExportKeyword));
+}
+
+// --- call-chain + method ----------------------------------------------------
+function unwindChain(node: any, ts: TsModule): { baseName?: string; baseCall?: any; calls: Record<string, any> } {
+  const calls: Record<string, any> = {};
+  let cur = node;
+  while (cur && ts.isCallExpression(cur)) {
+    const callee = cur.expression;
+    if (ts.isPropertyAccessExpression(callee)) { calls[callee.name.text] = cur; cur = callee.expression; }
+    else if (ts.isIdentifier(callee)) return { baseName: callee.text, baseCall: cur, calls };
+    else break;
+  }
+  return { calls };
+}
+
+function methodFromObjectArg(baseCall: any, ts: TsModule): string | undefined {
+  const arg = baseCall?.arguments?.[0];
+  if (!arg || !ts.isObjectLiteralExpression(arg)) return undefined;
+  for (const p of arg.properties) {
+    if (ts.isPropertyAssignment(p) && (p.name as any)?.text === 'method' && ts.isStringLiteralLike(p.initializer)) {
+      return p.initializer.text.toUpperCase();
+    }
+  }
+  return undefined;
+}
+
+// --- inputs -----------------------------------------------------------------
+function inputsFromValidator(validatorCall: any, ts: TsModule, bindings: Bindings): InputField[] {
+  if (!validatorCall) return [];
+  return zodObjectFields(validatorCall, ts, bindings);
+}
+
+// From a raw handler: validator schema fields it parses, plus the request fields it actually reads
+// (member accesses, destructuring, `await request.json()` bodies).
+function inputsFromHandler(params: any, body: any, ts: TsModule, bindings: Bindings): InputField[] {
+  const fields = zodObjectFields(body, ts, bindings);
+  const names = new Set(fields.map((f) => f.name));
+  for (const n of requestMemberAccesses(params, body, ts)) {
+    if (!names.has(n)) { names.add(n); fields.push({ name: n }); }
+  }
+  return fields;
+}
+
+// Find the first validator `.object({...})` in a subtree — gated on the receiver tracing to a known
+// validator package (so an unrelated `.object(` never becomes a schema). An untraceable receiver
+// literally named `z` is accepted as a heuristic (covers `z` re-exported from a local module).
+function findValidatorObject(node: any, ts: TsModule, bindings: Bindings): any {
+  let found: any = null;
+  const find = (n: any) => {
+    if (found || !n) return;
+    if (ts.isCallExpression(n) && ts.isPropertyAccessExpression(n.expression) && n.expression.name.text === 'object') {
+      const root = rootIdentifier(n.expression.expression, ts);
+      const pkg = root ? npmPackageOf(bindings.resolve(root)) : undefined;
+      const isValidator = (pkg && VALIDATOR_PACKAGES.has(pkg)) || (!pkg && root === 'z' && !bindings.locals.has(root));
+      if (isValidator) {
+        const arg = n.arguments[0];
+        if (arg && ts.isObjectLiteralExpression(arg)) { found = arg; return; }
+      }
+    }
+    ts.forEachChild(n, find);
+  };
+  find(node);
+  return found;
+}
+
+// Read a validator object's fields (name + type/constraints). Nested objects/arrays are flattened to
+// dotted paths — `address.city`, `tags[].label` — the same coordinates `array_key_value` rules use.
+function zodObjectFields(node: any, ts: TsModule, bindings: Bindings): InputField[] {
+  if (!node) return [];
+  const lit = findValidatorObject(node.body ?? node, ts, bindings);
+  return lit ? fieldsOfObject(lit, ts, bindings, '') : [];
+}
+
+function fieldsOfObject(objectLiteral: any, ts: TsModule, bindings: Bindings, prefix: string): InputField[] {
+  const fields: InputField[] = [];
+  for (const p of objectLiteral.properties) {
+    if (!ts.isPropertyAssignment(p) || !p.name) continue;
+    const fname = (p.name as any).text;
+    if (!fname) continue;
+    const shape = zodShape(p.initializer, ts);
+    fields.push({ name: prefix + fname, ...shape });
+    const nested = findValidatorObject(p.initializer, ts, bindings);
+    if (nested) fields.push(...fieldsOfObject(nested, ts, bindings, prefix + fname + (shape.type === 'array' ? '[].' : '.')));
+  }
+  return fields;
+}
+
+function numericValue(arg: any, ts: TsModule): number | undefined {
+  if (!arg) return undefined;
+  if (ts.isNumericLiteral(arg)) return Number(arg.text);
+  if (ts.isPrefixUnaryExpression(arg) && arg.operator === ts.SyntaxKind.MinusToken && ts.isNumericLiteral(arg.operand)) return -Number(arg.operand.text);
+  return undefined;
+}
+
+function zodShape(node: any, ts: TsModule): Omit<InputField, 'name'> {
+  const shape: Omit<InputField, 'name'> = {};
+  let cur = node;
+  while (cur && ts.isCallExpression(cur) && ts.isPropertyAccessExpression(cur.expression)) {
+    const method = cur.expression.name.text;
+    const arg0 = cur.arguments[0];
+    if (ZOD_BASE.has(method) && !shape.type) shape.type = method;
+    if (method === 'min') { const v = numericValue(arg0, ts); if (v !== undefined) shape.min = v; }
+    if (method === 'max') { const v = numericValue(arg0, ts); if (v !== undefined) shape.max = v; }
+    if (STRING_FORMATS.has(method) && !shape.format) shape.format = method;
+    if (method === 'regex' && arg0 && ts.isRegularExpressionLiteral(arg0) && !shape.pattern) shape.pattern = arg0.text;
+    if (method === 'optional' || method === 'nullish') shape.optional = true;
+    cur = cur.expression.expression;
+  }
+  return shape;
+}
+
+const REQ_SOURCES = ['body', 'query', 'params'];
+
+// The request fields a handler reads, across the common idioms:
+//   req.body.x / req.query.x / req.params.x        (member access)
+//   const { x } = req.body                          (destructuring)
+//   ({ body }) => body.x / const { x } = body       (destructured handler param)
+//   const b = await request.json(); b.x / const { x } = await request.json()   (fetch-style Request)
+function requestMemberAccesses(params: any, body: any, ts: TsModule): string[] {
+  if (!body) return [];
+  const out = new Set<string>();
+  const p0 = params?.[0];
+  const reqName = p0 && ts.isIdentifier(p0.name) ? p0.name.text : undefined;
+  // Identifiers that ARE a request-input object (destructured `({ body })` param, `await req.json()`).
+  const sourceNames = new Set<string>();
+  if (p0 && !reqName && ts.isObjectBindingPattern(p0.name)) {
+    for (const el of p0.name.elements) {
+      const key = bindingKey(el, ts);
+      if (key && REQ_SOURCES.includes(key) && ts.isIdentifier(el.name)) sourceNames.add(el.name.text);
+    }
+  }
+  const unwrap = (e: any): any => {
+    let cur = e;
+    while (cur && (ts.isAwaitExpression(cur) || ts.isAsExpression(cur) || ts.isParenthesizedExpression(cur) || ts.isNonNullExpression(cur))) cur = cur.expression;
+    return cur;
+  };
+  const isReqSourceExpr = (e: any): boolean =>
+    (ts.isPropertyAccessExpression(e) && ts.isIdentifier(e.expression) && e.expression.text === reqName && REQ_SOURCES.includes(e.name.text)) ||
+    (ts.isIdentifier(e) && sourceNames.has(e.text));
+  const isBodyReadCall = (e: any): boolean => {
+    const inner = unwrap(e);
+    return Boolean(inner && ts.isCallExpression(inner) && ts.isPropertyAccessExpression(inner.expression) &&
+      ['json', 'formData'].includes(inner.expression.name.text) &&
+      ts.isIdentifier(inner.expression.expression) && inner.expression.expression.text === reqName);
+  };
+  const visit = (n: any) => {
+    // <source>.<field>
+    if (ts.isPropertyAccessExpression(n) && isReqSourceExpr(n.expression)) out.add(n.name.text);
+    if (ts.isVariableDeclaration(n) && n.initializer) {
+      const init = unwrap(n.initializer);
+      // const b = await request.json() → b is a request-input object from here on.
+      if (ts.isIdentifier(n.name) && isBodyReadCall(n.initializer)) sourceNames.add(n.name.text);
+      // const { a, b } = <source> | await request.json()
+      if (ts.isObjectBindingPattern(n.name) && (isReqSourceExpr(init) || isBodyReadCall(n.initializer))) {
+        for (const el of n.name.elements) {
+          const key = bindingKey(el, ts);
+          if (key) out.add(key);
+        }
+      }
+    }
+    ts.forEachChild(n, visit);
+  };
+  visit(body);
+  return [...out];
+}
+
+function bindingKey(el: any, ts: TsModule): string | undefined {
+  if (!ts.isBindingElement(el)) return undefined;
+  const prop = el.propertyName ?? el.name;
+  return prop && ts.isIdentifier(prop) ? prop.text : undefined;
+}
+
+// --- sinks (agnostic) -------------------------------------------------------
+function collectLocalSinks(sf: any, ts: TsModule, bindings: Bindings): Map<string, Sink[]> {
+  const map = new Map<string, Sink[]>();
+  const visit = (node: any) => {
+    if (ts.isFunctionDeclaration(node) && node.name && node.body) map.set(node.name.text, directSinks(node.body, ts, bindings));
+    else if (ts.isVariableStatement(node)) {
+      for (const decl of node.declarationList.declarations) {
+        if (ts.isIdentifier(decl.name) && decl.initializer && isFnLike(decl.initializer, ts)) {
+          map.set(decl.name.text, directSinks(decl.initializer.body, ts, bindings));
+        }
+      }
+    }
+    ts.forEachChild(node, visit);
+  };
+  visit(sf);
+  return map;
+}
+
+function sinksFrom(arrowOrNode: any, ts: TsModule, localSinks: Map<string, Sink[]>, bindings: Bindings): Sink[] {
+  if (!arrowOrNode) return [];
+  const body = arrowOrNode.isSyntheticBody ? arrowOrNode.body
+    : isFnLike(arrowOrNode, ts) ? arrowOrNode.body : arrowOrNode;
+  if (!body) return [];
+  const sinks = directSinks(body, ts, bindings);
+  for (const called of localCalls(body, ts)) for (const s of localSinks.get(called) ?? []) sinks.push(s);
+  return dedupeSinks(sinks);
+}
+
+// Provider-agnostic sink recognizers over a subtree. Each sink is tagged with the npm package behind
+// it: resolved precisely from the call's base identifier via the file's imports, else inferred from
+// the file's imports of a known provider for that sink kind. A receiver that traces to a plain local
+// object/class/function is NOT a dependency sink and is dropped.
+function directSinks(node: any, ts: TsModule, bindings: Bindings): Sink[] {
+  const sinks: Sink[] = [];
+  const baseOf = (base: any): { pkg?: string; local?: boolean; root?: string } => {
+    const root = base ? rootIdentifier(base, ts) : undefined;
+    if (!root) return {};
+    const pkg = npmPackageOf(bindings.resolve(root));
+    if (pkg) return { pkg, root };
+    return { local: bindings.locals.has(root), root };
+  };
+  const infer = (kind: 'db' | 'http'): string | undefined => {
+    const table = kind === 'db' ? DB_PACKAGES : HTTP_PACKAGES;
+    for (const p of table) if (bindings.imports.has(p)) return p;
+    return undefined;
+  };
+  const push = (s: Sink) => sinks.push(s);
+  const visit = (n: any) => {
+    // A function that is DECLARED here but not invoked here is not reached by this endpoint — walking
+    // into it would report sinks the endpoint never touches (e.g. an unused local helper that shells
+    // out). Skip those subtrees; when the handler DOES call such a helper, `localCalls` +
+    // `collectLocalSinks` bring its sinks in by name. Inline callbacks / IIFEs are NOT skipped — those
+    // do run (`items.map(x => db.insert(x))`, `.then(...)`).
+    if (n !== node && isUninvokedFunctionDeclaration(n, ts)) return;
+    if (ts.isCallExpression(n)) {
+      const callee = n.expression;
+      // db: `.from("t").<op>()` (supabase/knex/kysely)
+      if (ts.isPropertyAccessExpression(callee) && callee.name.text === 'from') {
+        const b = baseOf(callee.expression);
+        const t = n.arguments[0];
+        const table = t && ts.isStringLiteralLike(t) ? t.text : undefined;
+        const parent = n.parent;
+        if (!b.local && parent && ts.isPropertyAccessExpression(parent) && DB_OPS.has(parent.name.text)) {
+          push({ kind: 'db', provider: 'sql', package: b.pkg ?? infer('db'), table, op: parent.name.text, line: lineOf(parent) });
+        }
+      }
+      if (ts.isPropertyAccessExpression(callee)) {
+        const method = callee.name.text;
+        const b = baseOf(callee.expression);
+        if (!b.local) {
+          // db: prisma-style `prisma.<model>.<op>()` — the op names are generic (`delete`, `update`, …),
+          // so require a real prisma signal: a resolved binding, the import, or a prisma-named receiver.
+          if (PRISMA_OPS.has(method) && ts.isPropertyAccessExpression(callee.expression)) {
+            const prismaLikely = b.pkg === '@prisma/client' ||
+              (!b.pkg && (bindings.imports.has('@prisma/client') || /prisma/i.test(b.root ?? '')));
+            if (prismaLikely) push({ kind: 'db', provider: 'prisma', package: '@prisma/client', table: callee.expression.name.text, op: method, line: lineOf(n) });
+          }
+          // db: raw `.query(` / `.execute(`
+          if (method === 'query' || method === 'execute') {
+            push({ kind: 'db', provider: 'sql', package: b.pkg ?? infer('db'), op: method, line: lineOf(n) });
+          }
+          // fs / exec via a namespace: `fs.writeFile(` / `child_process.exec(`
+          if (FS_CALLS.test(method)) push({ kind: 'fs', package: b.pkg, op: method, line: lineOf(n) });
+          if (EXEC_CALLS.test(method)) push({ kind: 'exec', package: b.pkg, op: method, line: lineOf(n) });
+          // http: any client whose binding resolves to a known http package (`axios.get`, `ky.post`,
+          // `http.request`), else the classic identifiers by name as a heuristic.
+          if (HTTP_MEMBER_METHODS.has(method)) {
+            if (b.pkg && isHttpPackage(b.pkg)) {
+              push({ kind: 'http', provider: b.root, package: b.pkg, op: method, line: lineOf(n) });
+            } else if (!b.pkg && ts.isIdentifier(callee.expression) && /^(axios|http|https|got|ky)$/.test(callee.expression.text)) {
+              push({ kind: 'http', provider: callee.expression.text, package: infer('http'), op: method, line: lineOf(n) });
+            }
+          }
+        }
+      }
+      // bare calls: fetch( / exec( / readFile( / eval( — unless the name is a plain local function.
+      if (ts.isIdentifier(callee) && !bindings.locals.has(callee.text)) {
+        const name = callee.text;
+        const pkg = npmPackageOf(bindings.resolve(name));
+        // `fetch` is a global — never attribute it to an unrelated imported http client.
+        if (HTTP_CALLS.test(name)) push({ kind: 'http', provider: name, package: pkg ?? (name === 'fetch' ? undefined : infer('http')), op: 'request', line: lineOf(n) });
+        if (FS_CALLS.test(name)) push({ kind: 'fs', package: pkg, op: name, line: lineOf(n) });
+        if (EXEC_CALLS.test(name)) push({ kind: 'exec', package: pkg, op: name, line: lineOf(n) });
+        if (name === 'eval') push({ kind: 'eval', op: 'eval', line: lineOf(n) });
+      }
+    }
+    if (ts.isNewExpression(n) && ts.isIdentifier(n.expression) && n.expression.text === 'Function') {
+      push({ kind: 'eval', op: 'new Function', line: lineOf(n) });
+    }
+    ts.forEachChild(n, visit);
+  };
+  visit(node);
+  return sinks;
+}
+
+// A named function *declaration*, or a function bound to a variable/property — i.e. code that only runs
+// if something calls it. An inline callback (an arrow passed as an argument), an IIFE, or a function
+// used directly in an expression is NOT this: those execute where they appear.
+function isUninvokedFunctionDeclaration(n: any, ts: TsModule): boolean {
+  if (ts.isFunctionDeclaration(n)) return true;
+  if (isFnLike(n, ts)) {
+    const p = n.parent;
+    if (p && (ts.isVariableDeclaration(p) || ts.isPropertyAssignment(p) || ts.isPropertyDeclaration(p))) return true;
+  }
+  return false;
+}
+
+// --- input → sink flow linking ---------------------------------------------
+// Evidence-backed data links: for each sink, does an INPUT identifier/path appear inside the sink
+// call's arguments? "Tainted" roots are the handler's own parameter names (`{ data }`, `req`) plus any
+// local alias of them (`const body = await request.json()`, `const { title } = data`).
+//
+// Deliberately conservative: a match yields `precise`; no match yields `heuristic` (the input and sink
+// merely co-occur). It never claims a flow it didn't see, which is the point — a consumer pinning a
+// rule to a parameter should trust `precise` and treat `heuristic` as "may reach".
+function linkFlows(
+  bodyNode: any,
+  params: any,
+  inputs: InputField[],
+  sinks: Sink[],
+  ts: TsModule,
+): Flow[] {
+  if (!bodyNode || sinks.length === 0 || inputs.length === 0) return [];
+  const taintedRoots = new Set<string>();
+  for (const p of params ?? []) {
+    if (!p?.name) continue;
+    if (ts.isIdentifier(p.name)) taintedRoots.add(p.name.text);
+    else if (ts.isObjectBindingPattern(p.name)) {
+      for (const el of p.name.elements) if (ts.isBindingElement(el) && ts.isIdentifier(el.name)) taintedRoots.add(el.name.text);
+    }
+  }
+  // Local aliases of tainted data: `const body = await request.json()`, `const { title } = data`.
+  const aliasVisit = (n: any) => {
+    if (ts.isVariableDeclaration(n) && n.initializer) {
+      const root = rootIdentifier(n.initializer, ts);
+      const fromTainted = root ? taintedRoots.has(root) : false;
+      const isRequestRead = /\b(json|formData|text|body|query|params)\b/.test(n.initializer.getText?.() ?? '');
+      if (fromTainted || isRequestRead) {
+        if (ts.isIdentifier(n.name)) taintedRoots.add(n.name.text);
+        else if (ts.isObjectBindingPattern(n.name)) {
+          for (const el of n.name.elements) if (ts.isBindingElement(el) && ts.isIdentifier(el.name)) taintedRoots.add(el.name.text);
+        }
+      }
+    }
+    ts.forEachChild(n, aliasVisit);
+  };
+  aliasVisit(bodyNode);
+
+  // Index sink call sites by line so a sink (which carries `line`) can be matched to its AST node.
+  const callsByLine = new Map<number, any[]>();
+  const callVisit = (n: any) => {
+    if (ts.isCallExpression(n)) {
+      const ln = lineOf(n);
+      if (ln !== undefined) {
+        const list = callsByLine.get(ln) ?? [];
+        list.push(n);
+        callsByLine.set(ln, list);
+      }
+    }
+    ts.forEachChild(n, callVisit);
+  };
+  callVisit(bodyNode);
+
+  const flows: Flow[] = [];
+  for (const sink of sinks) {
+    const candidates = sink.line !== undefined ? (callsByLine.get(sink.line) ?? []) : [];
+    // Text of every argument at this sink's call site(s) — where a tainted value would appear.
+    let argText = '';
+    for (const c of candidates) {
+      for (const a of c.arguments ?? []) {
+        try { argText += ' ' + a.getText(); } catch { /* ignore */ }
+      }
+    }
+    for (const input of inputs) {
+      const leaf = input.name.split('.').pop()!.replace(/\[\]$/, '');
+      // `data.title` / `{ title }` / `req.body.title` — the leaf name appearing in the sink's args,
+      // qualified by a tainted root when it's a member path.
+      const mentionsLeaf = argText.length > 0 && new RegExp(`\\b${escapeRe(leaf)}\\b`).test(argText);
+      const mentionsTaintedRoot = [...taintedRoots].some((r) => new RegExp(`\\b${escapeRe(r)}\\b`).test(argText));
+      if (mentionsLeaf && (mentionsTaintedRoot || taintedRoots.has(leaf))) {
+        flows.push({ input: input.name, sink, confidence: 'precise', line: sink.line });
+      } else {
+        flows.push({ input: input.name, sink, confidence: 'heuristic', line: sink.line });
+      }
+    }
+  }
+  return flows;
+}
+
+function escapeRe(s: string): string {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+function localCalls(node: any, ts: TsModule): string[] {
+  const names: string[] = [];
+  const visit = (n: any) => {
+    if (ts.isCallExpression(n) && ts.isIdentifier(n.expression)) names.push(n.expression.text);
+    ts.forEachChild(n, visit);
+  };
+  visit(node);
+  return names;
+}
+
+function dedupeSinks(sinks: Sink[]): Sink[] {
+  const seen = new Set<string>();
+  const out: Sink[] = [];
+  for (const s of sinks) {
+    const key = `${s.kind}:${s.provider}:${s.package}:${s.table}:${s.op}:${s.line}`;
+    if (!seen.has(key)) { seen.add(key); out.push(s); }
+  }
+  return out;
+}
diff --git a/src/map/index.ts b/src/map/index.ts
new file mode 100644
index 0000000..d6bd54d
--- /dev/null
+++ b/src/map/index.ts
@@ -0,0 +1,28 @@
+import { loadTypeScript } from './ts-loader.js';
+import { extractInputMap, type ExtractOptions } from './extract.js';
+import type { SiteInputMap } from './types.js';
+
+export type { SiteInputMap, Endpoint, InputField, Sink, Flow, Coverage } from './types.js';
+export type { ExtractOptions } from './extract.js';
+
+/**
+ * Build the app's input-flow ("attack surface") map at build time. Resolves the target app's own
+ * TypeScript to parse the source; returns { map: null, error } (never throws) when TS can't be
+ * resolved, so the CLI can degrade with a clear message.
+ */
+export async function buildInputMap(
+  cwd: string,
+  options: ExtractOptions = {},
+): Promise<{ map: SiteInputMap | null; error?: string }> {
+  const ts = await loadTypeScript(cwd);
+  if (!ts) {
+    return {
+      map: null,
+      error:
+        'Could not resolve a TypeScript compiler to parse the app. `map` uses your project’s own ' +
+        '`typescript` (already a devDependency of a TypeScript app) — install it and retry.',
+    };
+  }
+  const map = await extractInputMap(cwd, ts, options);
+  return { map };
+}
diff --git a/src/map/ts-loader.ts b/src/map/ts-loader.ts
new file mode 100644
index 0000000..612a3a4
--- /dev/null
+++ b/src/map/ts-loader.ts
@@ -0,0 +1,28 @@
+import { createRequire } from 'node:module';
+import { pathToFileURL } from 'node:url';
+import { join } from 'node:path';
+import type { TsModule } from './types.js';
+
+// Load a TypeScript compiler for parsing the target app's source. We do NOT bundle `typescript` into
+// connect (it's a heavy dep and the runtime guard never needs it) — instead we resolve the TARGET
+// app's own installed `typescript` (every TS app has it, at the exact version its code expects), then
+// fall back to a `typescript` resolvable from connect's own context (dev/global). Returns null if
+// neither is available, so the caller can degrade with a clear message rather than crash.
+export async function loadTypeScript(cwd: string): Promise<TsModule | null> {
+  // 1. The target app's node_modules (the normal case).
+  try {
+    const req = createRequire(pathToFileURL(join(cwd, 'package.json')));
+    const resolved = req.resolve('typescript');
+    const mod = await import(pathToFileURL(resolved).href);
+    return (mod.default ?? mod) as TsModule;
+  } catch {
+    /* fall through */
+  }
+  // 2. A `typescript` resolvable from here (connect dev / a global install).
+  try {
+    const mod = await import('typescript');
+    return (mod.default ?? mod) as TsModule;
+  } catch {
+    return null;
+  }
+}
diff --git a/src/map/types.ts b/src/map/types.ts
new file mode 100644
index 0000000..d787a32
--- /dev/null
+++ b/src/map/types.ts
@@ -0,0 +1,123 @@
+// The build-time input-flow ("attack surface") map. connect's `map` command walks the app's source
+// and emits this per-site: entry points → the inputs each reads → the sinks/dependencies they reach.
+// It's both a user-facing surface view and the coordinate source dynamic vPatch templates bind against.
+//
+// Honesty is a first-class field: static analysis is best-effort, so `coverage` records what the
+// adapter could and couldn't see. Never present the map as "complete".
+
+export interface InputField {
+  /**
+   * Parameter / body-field name — the coordinate a rule pins to. Nested validator fields are
+   * flattened to dotted paths (`address.city`, `tags[].label`), matching `array_key_value` paths.
+   */
+  name: string;
+  /** Coarse type when derivable (string | number | boolean | array | object | unknown). */
+  type?: string;
+  /** Declared constraints, when a validator (e.g. zod) exposes them. */
+  min?: number;
+  max?: number;
+  optional?: boolean;
+  /** Declared string format when the validator names one (email | uuid | url | …). */
+  format?: string;
+  /** Declared regex constraint (the regex literal's source text), when present. */
+  pattern?: string;
+}
+
+export interface Sink {
+  /** db | fs | http | exec | template | redirect | … */
+  kind: string;
+  /** e.g. "supabase", "pg", "fetch". */
+  provider?: string;
+  /**
+   * The npm package (or `node:` builtin) backing this sink — the link that lets a site's vulnerable
+   * dependency (from the manifest / TI) be correlated to the exact input that reaches it. Resolved from
+   * the file's imports (e.g. `@supabase/supabase-js`, `express`, `node:child_process`); undefined when
+   * it can't be traced (a global like `fetch`, or an untraced indirection).
+   */
+  package?: string;
+  /** For db sinks: the table. */
+  table?: string;
+  /** The operation at the sink (db: insert | select | …; fs/exec/http: the called function). */
+  op?: string;
+  /** 1-based line of the sink call in the endpoint's file — the auditable coordinate. */
+  line?: number;
+}
+
+export interface Endpoint {
+  /** Exported server-fn name / route id / handler — the entry point. */
+  name: string;
+  /** How it was recognized: server-fn | route-handler | route-registration | server-action. */
+  entryKind: string;
+  /** HTTP method when known. */
+  method?: string;
+  /** URL path when known (route registrations / derived from a file-based route's location). */
+  route?: string;
+  /**
+   * true when `route` contains dynamic segments (`/api/items/:id`) — it is a PATTERN, not a literal
+   * path, so a rule scoping to it needs a glob/regex `when.path`, not an equality match.
+   */
+  routeDynamic?: boolean;
+  /** Repo-relative source file. */
+  file: string;
+  /** 1-based line of the entry-point declaration in `file`. */
+  line?: number;
+  /** Inventory: inputs the handler reads. Presence here does NOT mean an input reaches a sink. */
+  inputs: InputField[];
+  /** Inventory: sinks reachable in the handler. Presence here does NOT mean an input flows into it. */
+  sinks: Sink[];
+  /**
+   * Evidence-backed input→sink data links. This — not the `inputs`×`sinks` cross-product — is what a
+   * consumer should use to pin a rule to a parameter. Empty when no link could be established.
+   */
+  flows: Flow[];
+  /**
+   * false when the endpoint DECLARES an input validator that static analysis could not parse — its
+   * `inputs` are UNKNOWN rather than empty. Absent when the extracted inputs can be trusted as-is.
+   */
+  inputsResolved?: boolean;
+}
+
+/**
+ * A DATA LINK from one input to one sink — the only place the map asserts that an input actually
+ * *reaches* a sink. `inputs` and `sinks` on an endpoint are inventories (both present somewhere in the
+ * handler); a `Flow` is evidence-backed:
+ *   - `precise`   — the input identifier/path appears inside the sink call's arguments.
+ *   - `heuristic` — the input and sink co-occur in the handler but no data link was found; treat as
+ *                   "may reach", never as proven.
+ * Consumers that pin a rule to a parameter should prefer `precise` flows and fall back to broad rules.
+ */
+export interface Flow {
+  /** Input field name (dotted path), matching an entry in `Endpoint.inputs`. */
+  input: string;
+  /** The sink reached. */
+  sink: Sink;
+  confidence: 'precise' | 'heuristic';
+  /** 1-based line of the sink call — the auditable evidence location. */
+  line?: number;
+}
+
+export interface Coverage {
+  /** Adapter that produced the map. */
+  adapter: string;
+  /** Files the walker found under the analyzed roots. */
+  filesDiscovered: number;
+  /** Files actually parsed (passed the entry-point pre-filter). */
+  filesParsed: number;
+  /** Files skipped because they could not be read/parsed (fail-open). */
+  filesSkipped: number;
+  /** Source roots analyzed, repo-relative. */
+  roots: string[];
+  /** Honest notes on what static analysis could not resolve (dynamic dispatch, indirection, …). */
+  notes: string[];
+}
+
+export interface SiteInputMap {
+  version: 1;
+  /** e.g. "tanstack-start". */
+  framework: string;
+  endpoints: Endpoint[];
+  coverage: Coverage;
+}
+
+/** The TypeScript module surface we use (a subset of `typescript`), resolved from the target app. */
+export type TsModule = typeof import('typescript');
diff --git a/tests/map-extract-strict.test.ts b/tests/map-extract-strict.test.ts
new file mode 100644
index 0000000..ca60959
--- /dev/null
+++ b/tests/map-extract-strict.test.ts
@@ -0,0 +1,226 @@
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import { mkdtempSync, mkdirSync, writeFileSync, symlinkSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { buildInputMap } from '../src/map/index.js';
+import type { SiteInputMap, Endpoint } from '../src/map/types.js';
+
+// Regression suite for the strict-review hardening: destructured / request.json() inputs, pre-filter ↔
+// recognizer parity, chained + object route registration, bindings-gated sinks (local objects are not
+// dependency sinks), validator gating + nested fields + formats, node: builtin normalization, source
+// positions, and the honesty markers (inputsResolved, dynamic coverage notes).
+
+let dir: string;
+let map: SiteInputMap;
+const ep = (pred: (e: Endpoint) => boolean): Endpoint => {
+  const found = map.endpoints.find(pred);
+  expect(found).toBeDefined();
+  return found!;
+};
+const inputNames = (e: Endpoint) => e.inputs.map((i) => i.name).sort();
+
+beforeAll(async () => {
+  dir = mkdtempSync(join(tmpdir(), 'ps-map-strict-'));
+  mkdirSync(join(dir, 'src'), { recursive: true });
+  writeFileSync(join(dir, 'package.json'), JSON.stringify({
+    dependencies: { express: '4', fastify: '5', '@tanstack/react-start': '1' },
+  }));
+
+  // Destructured req.body, destructured handler param, head/use registrations, chained .route().get().
+  writeFileSync(join(dir, 'src', 'express.ts'), `
+    import express from "express";
+    import fs from "fs";
+    import { exec } from "node:child_process";
+    const app = express();
+    app.post("/api/items", (req, res) => {
+      const { title, qty } = req.body;
+      fs.writeFileSync("/tmp/x", title + qty);
+      res.end();
+    });
+    app.post("/api/other", ({ body }, res) => {
+      const cache = { params: { zzz: 1 } };
+      console.log(cache.params.zzz);
+      res.end(String(body.note));
+    });
+    app.head("/health", (req, res) => res.end());
+    app.use("/legacy", (req, res) => { run(req.query.cmd); res.end(); });
+    function run(cmd) { exec("legacy " + cmd); }
+    const r = express.Router();
+    r.route("/chained").get((req, res) => { fs.readFile(req.query.f, () => res.end()); });
+  `);
+
+  // Fastify object-form registration with a method array.
+  writeFileSync(join(dir, 'src', 'fastify.ts'), `
+    import Fastify from "fastify";
+    const app = Fastify();
+    app.route({
+      method: ["POST", "PUT"],
+      url: "/upload",
+      handler: async (req, reply) => {
+        const { filename } = req.body;
+        reply.send(filename);
+      },
+    });
+  `);
+
+  // fetch-style Request body reads + a non-validator ".object(" decoy.
+  writeFileSync(join(dir, 'src', 'next-route.ts'), `
+    import { createClient } from "@supabase/supabase-js";
+    const supabase = createClient("u", "k");
+    const t = { object: (x) => x };
+    export async function POST(request) {
+      const shape = t.object({ decoy: 1 });
+      const body = await request.json();
+      const { extra } = await request.json();
+      await supabase.from("orders").insert({ note: body.note, qty: body.qty, extra });
+      return new Response(String(shape));
+    }
+  `);
+
+  // Local objects/functions must not read as dependency sinks.
+  writeFileSync(join(dir, 'src', 'sinks-gate.ts'), `
+    import express from "express";
+    const app = express();
+    class WorkQueue { open() { return this; } query(s) { return s; } execute() { return 1; } }
+    function request(x) { return x; }
+    app.post("/probe", (req, res) => {
+      const q = new WorkQueue();
+      q.open(); q.query("a"); q.execute(); request("h");
+      res.end();
+    });
+  `);
+
+  // Zod: nested objects/arrays, formats, regex, negative bounds; plus an opaque validator.
+  writeFileSync(join(dir, 'src', 'zod.functions.ts'), `
+    import { createServerFn } from "@tanstack/react-start";
+    import { z } from "zod";
+    export const saveProfile = createServerFn({ method: "POST" })
+      .inputValidator((i) => z.object({
+        email: z.string().email(),
+        slug: z.string().regex(/^[a-z0-9-]+$/),
+        offset: z.number().min(-10).max(50),
+        address: z.object({ city: z.string().min(1) }),
+        tags: z.array(z.object({ label: z.string() })),
+      }).parse(i))
+      .handler(async ({ data }) => data);
+    export const opaque = createServerFn({ method: "POST" })
+      .inputValidator((i) => checkSomehow(i))
+      .handler(async ({ data }) => data);
+  `);
+
+  // Transitive binding: conn ← pool.promise() ← createPool ← mysql2.
+  writeFileSync(join(dir, 'src', 'transitive.ts'), `
+    import express from "express";
+    import { createPool } from "mysql2";
+    const app = express();
+    const pool = createPool({});
+    const conn = pool.promise();
+    app.post("/sql", (req, res) => { conn.query(req.body.sql); res.end(); });
+  `);
+
+  // A route file reachable only through a symlinked directory.
+  mkdirSync(join(dir, 'linked-src'), { recursive: true });
+  writeFileSync(join(dir, 'linked-src', 'ext.ts'), `
+    import express from "express";
+    const app = express();
+    app.post("/linked", (req, res) => res.end(req.body.x));
+  `);
+  symlinkSync(join(dir, 'linked-src'), join(dir, 'src', 'ext'));
+
+  const res = await buildInputMap(dir);
+  expect(res.error).toBeUndefined();
+  map = res.map!;
+});
+afterAll(() => rmSync(dir, { recursive: true, force: true }));
+
+describe('inputs: destructuring and fetch-style bodies', () => {
+  it('extracts fields destructured from req.body', () => {
+    const e = ep((x) => x.route === '/api/items');
+    expect(inputNames(e)).toEqual(['qty', 'title']);
+    expect(e.sinks).toEqual([
+      expect.objectContaining({ kind: 'fs', package: 'node:fs', op: 'writeFileSync' }),
+    ]);
+  });
+
+  it('follows a destructured handler param without matching unrelated objects', () => {
+    const e = ep((x) => x.route === '/api/other');
+    expect(inputNames(e)).toEqual(['note']); // body.note yes, cache.params.zzz no
+  });
+
+  it('traces `await request.json()` bodies through variables and destructuring', () => {
+    const e = ep((x) => x.name === 'POST' && x.entryKind === 'route-handler');
+    expect(inputNames(e)).toEqual(['extra', 'note', 'qty']); // and never the t.object decoy
+    expect(e.sinks).toEqual([
+      expect.objectContaining({ kind: 'db', package: '@supabase/supabase-js', table: 'orders', op: 'insert' }),
+    ]);
+  });
+});
+
+describe('entry points: pre-filter parity and registration idioms', () => {
+  it('sees files that only register .head()/.use() routes', () => {
+    expect(ep((x) => x.route === '/health').method).toBe('HEAD');
+    const legacy = ep((x) => x.route === '/legacy');
+    expect(legacy.method).toBeUndefined(); // `use` is not an HTTP method
+    expect(inputNames(legacy)).toEqual(['cmd']);
+    expect(legacy.sinks).toEqual([
+      expect.objectContaining({ kind: 'exec', package: 'node:child_process', op: 'exec' }), // via run()
+    ]);
+  });
+
+  it('recovers the path from router.route("/x").get(handler) chains', () => {
+    const e = ep((x) => x.route === '/chained');
+    expect(e.method).toBe('GET');
+    expect(inputNames(e)).toEqual(['f']);
+    expect(e.sinks).toEqual([expect.objectContaining({ kind: 'fs', package: 'node:fs', op: 'readFile' })]);
+  });
+
+  it('reads Fastify route objects, one endpoint per method', () => {
+    const uploads = map.endpoints.filter((x) => x.route === '/upload');
+    expect(uploads.map((u) => u.method).sort()).toEqual(['POST', 'PUT']);
+    for (const u of uploads) expect(inputNames(u)).toEqual(['filename']);
+  });
+
+  it('follows symlinked source directories', () => {
+    expect(inputNames(ep((x) => x.route === '/linked'))).toEqual(['x']);
+  });
+});
+
+describe('sinks: bindings gating and package attribution', () => {
+  it('does not report calls on local objects/functions as dependency sinks', () => {
+    expect(ep((x) => x.route === '/probe').sinks).toEqual([]);
+  });
+
+  it('resolves packages transitively through derived bindings', () => {
+    const e = ep((x) => x.route === '/sql');
+    expect(inputNames(e)).toEqual(['sql']);
+    expect(e.sinks).toEqual([expect.objectContaining({ kind: 'db', package: 'mysql2', op: 'query' })]);
+  });
+
+  it('records source positions on endpoints and sinks', () => {
+    const e = ep((x) => x.route === '/api/items');
+    expect(e.line).toBeGreaterThan(0);
+    expect(e.sinks[0].line).toBeGreaterThan(0);
+  });
+});
+
+describe('validator schemas: gating, nesting, formats', () => {
+  it('extracts nested fields as dotted paths with constraints', () => {
+    const e = ep((x) => x.name === 'saveProfile');
+    const byName = Object.fromEntries(e.inputs.map((i) => [i.name, i]));
+    expect(byName['email']).toEqual({ name: 'email', type: 'string', format: 'email' });
+    expect(byName['slug']).toMatchObject({ type: 'string', pattern: '/^[a-z0-9-]+$/' });
+    expect(byName['offset']).toEqual({ name: 'offset', type: 'number', min: -10, max: 50 });
+    expect(byName['address']).toMatchObject({ type: 'object' });
+    expect(byName['address.city']).toEqual({ name: 'address.city', type: 'string', min: 1 });
+    expect(byName['tags']).toMatchObject({ type: 'array' });
+    expect(byName['tags[].label']).toMatchObject({ type: 'string' });
+    expect(e.inputsResolved).toBeUndefined();
+  });
+
+  it('marks endpoints whose validator could not be parsed, and says so in coverage', () => {
+    const e = ep((x) => x.name === 'opaque');
+    expect(e.inputs).toEqual([]);
+    expect(e.inputsResolved).toBe(false);
+    expect(map.coverage.notes.join(' ')).toMatch(/UNKNOWN, not empty/);
+  });
+});
diff --git a/tests/map-extract.test.ts b/tests/map-extract.test.ts
new file mode 100644
index 0000000..843cabb
--- /dev/null
+++ b/tests/map-extract.test.ts
@@ -0,0 +1,217 @@
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { buildInputMap } from '../src/map/index.js';
+
+// The agnostic extractor across three stacks in one fixture app: a TanStack server fn (zod inputs +
+// supabase sink, incl. a helper-indirected select), an Express route (req.body access + fs/exec
+// sinks), and a Next-style route handler (supabase sink).
+
+let dir: string;
+beforeAll(() => {
+  dir = mkdtempSync(join(tmpdir(), 'ps-map-'));
+  mkdirSync(join(dir, 'src'), { recursive: true });
+  writeFileSync(join(dir, 'package.json'), JSON.stringify({ dependencies: { '@tanstack/react-start': '1', express: '4' } }));
+
+  writeFileSync(join(dir, 'src', 'tasks.functions.ts'), `
+    import { createServerFn } from "@tanstack/react-start";
+    import { z } from "zod";
+    import { createClient } from "@supabase/supabase-js";
+    const supabase = createClient(process.env.URL, process.env.KEY);
+    function listTasks() {
+      return supabase.from("tasks").select("id, title").order("created_at");
+    }
+    export const getTasks = createServerFn({ method: "GET" }).handler(async () => listTasks());
+    export const createTask = createServerFn({ method: "POST" })
+      .inputValidator((input) => z.object({ title: z.string().trim().min(1).max(200) }).parse(input))
+      .handler(async ({ data }) => { supabase.from("tasks").insert({ title: data.title }); return listTasks(); });
+  `);
+
+  writeFileSync(join(dir, 'src', 'server.ts'), `
+    import express from "express";
+    import { exec } from "node:child_process";
+    import fs from "node:fs";
+    const app = express();
+    app.post("/api/convert", (req, res) => {
+      fs.writeFileSync(req.body.path, req.body.data);
+      exec("convert " + req.query.fmt);
+      res.end();
+    });
+  `);
+
+  writeFileSync(join(dir, 'src', 'route.ts'), `
+    import { createClient } from "@supabase/supabase-js";
+    const supabase = createClient(process.env.URL, process.env.KEY);
+    export async function POST(request) {
+      const body = await request.json();
+      return supabase.from("orders").insert({ note: body.note });
+    }
+  `);
+
+  writeFileSync(join(dir, 'src', 'actions.ts'), `
+    'use server';
+    import { exec } from "node:child_process";
+    export async function runReport(input) {
+      exec("report " + input.name);
+    }
+  `);
+
+  // ROOT-level entrypoint (not under src/) — common for server.ts / app.ts / worker entrypoints.
+  writeFileSync(join(dir, 'root-server.cjs'), `
+    const express = require("express");
+    const fs = require("node:fs");
+    const app = express();
+    app.post("/root/upload", (req, res) => {
+      fs.writeFileSync("/tmp/x", req.body.blob);
+      res.end();
+    });
+  `);
+
+  // A handler with a DECLARED-BUT-UNCALLED local helper that shells out: its exec must NOT be
+  // attributed to the endpoint, while the helper it DOES call must be.
+  writeFileSync(join(dir, 'src', 'fp.ts'), `
+    import { exec } from "node:child_process";
+    import fs from "node:fs";
+    export async function PUT(req) {
+      function neverCalled() { exec("rm -rf /"); }
+      const used = () => { fs.readFileSync("/etc/hosts"); };
+      used();
+      return new Response("ok");
+    }
+  `);
+
+  // A Next App Router file-based route (dynamic segment) — its URL path lives in the LOCATION.
+  mkdirSync(join(dir, 'app', 'api', 'orders', '[id]'), { recursive: true });
+  writeFileSync(join(dir, 'app', 'api', 'orders', '[id]', 'route.ts'), `
+    import { createClient } from "@supabase/supabase-js";
+    const supabase = createClient(process.env.URL, process.env.KEY);
+    export async function PATCH(request) {
+      const body = await request.json();
+      return supabase.from("orders").update({ note: body.note }).eq("id", body.id);
+    }
+  `);
+
+  // A local factory returning an imported client — the client must still resolve to its package.
+  writeFileSync(join(dir, 'src', 'factory.ts'), `
+    import { createClient } from "@supabase/supabase-js";
+    function getClient() { return createClient(process.env.URL, process.env.KEY); }
+    export async function DELETE(req) {
+      const db = getClient();
+      return db.from("audit").delete().eq("id", req.query.id);
+    }
+  `);
+});
+afterAll(() => rmSync(dir, { recursive: true, force: true }));
+
+describe('agnostic input-flow extractor', () => {
+  it('extracts entry points across TanStack / Express / Next shapes', async () => {
+    const { map, error } = await buildInputMap(dir);
+    expect(error).toBeUndefined();
+    expect(map).not.toBeNull();
+    const byName = Object.fromEntries(map!.endpoints.map((e) => [e.name, e]));
+
+    // TanStack server fn: zod input + direct + helper-indirected sinks, each tagged with the package.
+    expect(byName.createTask).toMatchObject({ entryKind: 'server-fn', method: 'POST' });
+    expect(byName.createTask.inputs).toEqual([{ name: 'title', type: 'string', min: 1, max: 200 }]);
+    expect(byName.createTask.sinks).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({ kind: 'db', provider: 'sql', package: '@supabase/supabase-js', table: 'tasks', op: 'insert' }),
+        expect.objectContaining({ kind: 'db', provider: 'sql', package: '@supabase/supabase-js', table: 'tasks', op: 'select' }), // via listTasks()
+      ]),
+    );
+    expect(byName.getTasks.inputs).toEqual([]);
+    expect(byName.getTasks.sinks).toEqual([
+      expect.objectContaining({ kind: 'db', provider: 'sql', package: '@supabase/supabase-js', table: 'tasks', op: 'select' }),
+    ]);
+
+    // Express route registration: path + method + req.body/query inputs + fs/exec sinks with node: packages.
+    const convert = map!.endpoints.find((e) => e.route === '/api/convert')!;
+    expect(convert.entryKind).toBe('route-registration');
+    expect(convert.method).toBe('POST');
+    expect(convert.inputs.map((i) => i.name).sort()).toEqual(['data', 'fmt', 'path']);
+    expect(convert.sinks).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({ kind: 'fs', package: 'node:fs', op: 'writeFileSync' }),
+        expect.objectContaining({ kind: 'exec', package: 'node:child_process', op: 'exec' }),
+      ]),
+    );
+
+    // Next-style route handler: method from the export name, supabase sink with package.
+    expect(byName.POST).toMatchObject({ entryKind: 'route-handler', method: 'POST' });
+    expect(byName.POST.sinks).toEqual([
+      expect.objectContaining({ kind: 'db', provider: 'sql', package: '@supabase/supabase-js', table: 'orders', op: 'insert' }),
+    ]);
+    expect(byName.POST.inputs.map((i) => i.name)).toEqual(['note']); // via `const body = await request.json()`
+
+    // Next `'use server'` action: recognized as an entry point, exec sink tagged with its package.
+    expect(byName.runReport).toMatchObject({ entryKind: 'server-action' });
+    expect(byName.runReport.sinks).toEqual([
+      expect.objectContaining({ kind: 'exec', package: 'node:child_process', op: 'exec' }),
+    ]);
+  });
+
+  it('records honest coverage notes, counters and a framework label', async () => {
+    const { map } = await buildInputMap(dir);
+    expect(map!.framework).toBe('tanstack-start');
+    const notes = map!.coverage.notes.join(' ');
+    expect(notes).toMatch(/best-effort/i);
+    // Must state that inputs/sinks are inventories and only `flows` asserts reachability.
+    expect(notes).toMatch(/INVENTOR/i);
+    expect(notes).toMatch(/flows/i);
+    expect(map!.coverage.filesDiscovered).toBeGreaterThan(0);
+    expect(map!.coverage.filesParsed).toBeGreaterThan(0);
+    expect(map!.coverage.filesParsed).toBeLessThanOrEqual(map!.coverage.filesDiscovered);
+  });
+
+  it('links input → sink flows with evidence, and only claims "precise" when the data reaches it', async () => {
+    const { map } = await buildInputMap(dir);
+    const createTask = map!.endpoints.find((e) => e.name === 'createTask')!;
+    const precise = createTask.flows.filter((f) => f.confidence === 'precise');
+    // `title` is passed into the insert → proven.
+    expect(precise).toEqual([
+      expect.objectContaining({ input: 'title', confidence: 'precise', sink: expect.objectContaining({ op: 'insert' }) }),
+    ]);
+    // The helper-reached select does NOT receive the input → heuristic, never precise.
+    expect(createTask.flows.some((f) => f.sink.op === 'select' && f.confidence === 'heuristic')).toBe(true);
+    expect(precise.every((f) => typeof f.line === 'number')).toBe(true); // evidence location
+  });
+
+  it('scans root-level entrypoints and .cjs files, not just src/', async () => {
+    const { map } = await buildInputMap(dir);
+    const rootEp = map!.endpoints.find((e) => e.route === '/root/upload');
+    expect(rootEp).toBeDefined();
+    expect(rootEp!.file).toBe('root-server.cjs');
+    expect(rootEp!.sinks).toEqual(
+      expect.arrayContaining([expect.objectContaining({ kind: 'fs', package: 'node:fs', op: 'writeFileSync' })]),
+    );
+  });
+
+  it('does not attribute sinks from a declared-but-uncalled local helper', async () => {
+    const { map } = await buildInputMap(dir);
+    const put = map!.endpoints.find((e) => e.name === 'PUT' && e.file.endsWith('fp.ts'))!;
+    expect(put.sinks.some((s) => s.kind === 'exec')).toBe(false); // neverCalled() must not count
+    expect(put.sinks.some((s) => s.kind === 'fs' && s.op === 'readFileSync')).toBe(true); // used() does
+  });
+
+  it('derives the URL path of a file-based route handler (so rules can be route-scoped)', async () => {
+    const { map } = await buildInputMap(dir);
+    const patch = map!.endpoints.find((e) => e.name === 'PATCH')!;
+    // Full coordinates for pinning: route + method + inputs — the route came from the file location.
+    expect(patch.route).toBe('/api/orders/:id');
+    expect(patch.routeDynamic).toBe(true); // a PATTERN, so when.path needs a glob/regex
+    expect(patch.method).toBe('PATCH');
+    expect(patch.inputs.map((i) => i.name).sort()).toEqual(['id', 'note']);
+    expect(patch.flows.some((f) => f.confidence === 'precise' && f.sink.op === 'update')).toBe(true);
+  });
+
+  it('resolves a client built by a local factory back to its package', async () => {
+    const { map } = await buildInputMap(dir);
+    const del = map!.endpoints.find((e) => e.name === 'DELETE')!;
+    expect(del.sinks).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({ kind: 'db', package: '@supabase/supabase-js', table: 'audit', op: 'delete' }),
+      ]),
+    );
+  });
+});
diff --git a/tsup.config.ts b/tsup.config.ts
index 15ec4b9..b50bdfd 100644
--- a/tsup.config.ts
+++ b/tsup.config.ts
@@ -16,6 +16,10 @@ export default defineConfig([
     sourcemap: true,
     target: 'node18',
     banner: { js: '#!/usr/bin/env node' },
+    // `map` parses the target app's source with a TypeScript compiler resolved at RUNTIME (the app's
+    // own `typescript`, or the environment's). Never bundle the compiler into the CLI — it's a heavy
+    // devDependency and the runtime guard never needs it.
+    external: ['typescript'],
   },
   {
     // Vendored runtime protection engine (node-waf + createProtection + Supabase guard),