fix(express): only the handler argument decides whether a route is inline (#1957)

An Express route keeps its named handler when a middleware before it
holds an arrow function, like rateLimit({ keyGenerator: (req) => req.ip })
or (req, res, next) => next(). Only the last argument decides whether
the handler is inline, and strings, regex literals and type arguments
no longer end an argument or a body early. The Express, route and
framework suites pass (757 tests); on express itself three named
handlers gain their link.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -203,6 +203,7 @@ and adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 - In React with TypeScript, a component that renders a generic component and passes it type arguments, like outline's `<PaginatedList<Document> items={…} />` or excalidraw's `<DropdownMenuItemContentRadio<"contain" | "overlap"> …>`, now links to the component it renders. Before, a tag followed by type arguments was skipped, so the generic component looked unused by the screens that render it, and `codegraph_explore`'s call paths, callers and impact stopped short of it. Re-index React projects after upgrading.
 - In React, a component that a file declares itself as a value is now what that file's JSX renders, whatever else in the repository shares its name. A lazily loaded page, like `const RegisterPage = Loadable(lazy(() => import('./pages/Register')))`, a `dynamic(() => import(…))` component or one loaded only in development (`IS_DEV ? lazy(…) : null`), links to the component its module exports, including the one its loader picks and one an `export default observer(Login)` wraps; a wrapped component like `const Settings = observer(function Settings() {…})`, `React.memo(Rows, areEqual)` or `forwardRef(ComboboxInner) as {…}` links to the function it wraps; and an alias like `const DialogPortal = DialogPrimitive.Portal` links to its own declaration. Before, `<RegisterPage />` was linked to any lone component of that name elsewhere, often in another app of the same repository, so `codegraph_explore`, callers and impact followed it into the wrong app while the page it really renders had no caller. React Router layouts declared this way follow the same rule, and a TSX type named like a value the file declares now stays in that file. Re-index React projects after upgrading.
 - In React, a JSX tag imported from one of your own modules now links to the component that module exports under that name, read the way a lazily loaded page's module already is. That includes going through an `index` file or barrel that passes the component on, like outline's `Sidebar/index.ts` with `import Sidebar from './App'; export default Sidebar` or its `Avatar/index.ts` with `const Avatar = AvatarWithHoverCard`, and past a wrapper such as `export default observer(AppSidebar)`, `React.memo(StaticCanvas, areEqual)` or mastodon's `const MemoizedBlurhash = memo(Blurhash)`. Before, a tag was matched by its name and the import only broke ties, so outline's `<Sidebar>` linked to an unrelated styled `Sidebar` in a sibling file, a default import under another name linked to whatever other component its module exported, and an import through a barrel could land on another app's component of the same name. A tag whose module exports an unnamed component, like `export default () => …`, now links to nothing instead of to a namesake elsewhere. A lazily loaded React Router page exported as such a value or wrapper links to the component it holds too, the one with the markup. `codegraph sync` and the file watcher redraw these links when only the file that passes the component on changes. Re-index React projects after upgrading.
+- An Express route keeps its named handler when a middleware before it contains an arrow function. `rateLimit({ keyGenerator: (req) => req.ip })` or `(req, res, next) => next()` no longer hides the handler at the end of the route (re-index to update an existing project).
 - A TypeScript type re-exported through a barrel (`export type { Foo } from`, `export { type Foo } from`, `export type * from`) now links to its real declaration instead of a same-named type elsewhere in the project, and import lists with comments, string names, or a JSDoc `@import` are read correctly. Re-index to update an existing project.
 - Git sync hooks now refresh the project they were installed for, so a project inside a larger repository stays current after commit, pull and checkout; installing them no longer breaks an existing hook written in another language, and runs even when your own hook ends with `exit`.
 - In TypeScript and JavaScript, a call through a field the calling class inherits, like `this._store.add(…)` in a class whose base class declares `_store`, now links to the method of the field's class, with the base class found the way the subclass's file imports it, under its own name, an alias or a re-export. Before, such a call linked only when some other class with the calling class's name happened to declare the field, which could be another app's class: that last resort now needs a type the calling file imports or declares. A call on a field or variable whose type comes from a package outside your project, like `TelemetryReporter` from `@vscode/extension-telemetry`, no longer links to a project class that only shares the type's name, unless a file in your project declares that package (`declare module '…'`). Re-index TypeScript and JavaScript projects after upgrading.

__tests__/frameworks.test.ts

@@ -1,4 +1,4 @@
-import { describe, it, expect } from 'vitest';
+import { describe, it, expect, afterEach } from 'vitest';
 import type { FrameworkResolver, UnresolvedRef } from '../src/resolution/types';
 import type { Node } from '../src/types';
 
@@ -245,6 +245,186 @@ describe('expressResolver.extract', () => {
     const { nodes, references } = expressResolver.extract!('routes.ts', src);
     expect(references[0].referenceName).toBe('list');
   });
+
+  // Only the handler — the LAST argument — decides whether the route has an
+  // inline body. An arrow inside a middleware argument used to make the whole
+  // route "inline", attributing the middleware's calls to it and dropping the
+  // named handler.
+  const refsOf = (src: string) =>
+    expressResolver.extract!('routes.ts', src).references.map((r) => `${r.referenceKind}:${r.referenceName}`);
+
+  it('keeps the named handler when a middleware argument holds an arrow', () => {
+    const refs = refsOf(`router.get('/users', rateLimit({ keyGenerator: (req) => lookup(req.ip) }), getUsers);\n`);
+    expect(refs).toContain('references:getUsers');
+    expect(refs).not.toContain('calls:lookup');
+  });
+
+  it('keeps the named handler after an inline arrow middleware', () => {
+    const refs = refsOf(`router.get('/x', (req, res, next) => audit(req, next), getUsers);\n`);
+    expect(refs).toContain('references:getUsers');
+    expect(refs).not.toContain('calls:audit');
+  });
+
+  it('still reads an inline handler, wrapped or after named middleware', () => {
+    expect(refsOf(`router.post('/x', asyncHandler(async (req, res) => { createItem(req.body); }));\n`)).toContain('calls:createItem');
+    const afterAuth = refsOf(`router.post('/x', auth, async (req, res) => { createItem(req.body); });\n`);
+    expect(afterAuth).toContain('calls:createItem');
+    expect(afterAuth).not.toContain('references:auth');
+  });
+
+  it('reads a `function` expression handler', () => {
+    expect(refsOf(`router.get('/x', function (req, res) { listUsers(); });\n`)).toContain('calls:listUsers');
+  });
+
+  it('a `function` handler whose body holds an arrow keeps every call', () => {
+    const plain = refsOf(`router.get('/x', function (req, res) { const u = findUser(req.id); res.json(u.items.map((i) => shape(i))); });\n`);
+    expect(plain).toContain('calls:findUser');
+    expect(plain).toContain('calls:shape');
+    const chained = refsOf(`router.route('/x').get(function (req, res) { const a = load(); a.forEach((x) => shape(x)); });\n`);
+    expect(chained).toContain('calls:load');
+    expect(chained).toContain('calls:shape');
+  });
+
+  it('a `function` elsewhere in the argument is not the handler', () => {
+    expect(refsOf(`router.get('/x', (req, res, cb = function () {}) => { svc(); });\n`)).toContain('calls:svc');
+    expect(refsOf(`router.get('/x', wrap(ctrl.list, { onError: function (e) { report(e); } }));\n`)).not.toContain('calls:report');
+    expect(refsOf(`router.get('/x', asyncHandler(function (req, res) { svc(); }));\n`)).toContain('calls:svc');
+  });
+
+  it('a `function` callback before the handler inside a wrapper is not the handler', () => {
+    const refs = refsOf(`router.get('/x', withErrors(function onErr(e) { report(e); }, async (req, res) => { svc(); }));\n`);
+    expect(refs).toContain('calls:svc');
+    expect(refs).not.toContain('calls:report');
+  });
+
+  it('a regex literal in an argument does not throw off the split', () => {
+    expect(refsOf(`router.get('/x', body('tags').matches(/^[^\\]]+$/), getUsers);\n`)).toContain('references:getUsers');
+    expect(refsOf(`router.get('/x', check('q').matches(/\\[/), getUsers);\n`)).toContain('references:getUsers');
+    const inline = refsOf(`router.get('/x', async (req, res) => { const re = /[^]]/, out = compute(req); save(out); });\n`);
+    expect(inline).toContain('calls:compute');
+    expect(inline).toContain('calls:save');
+  });
+
+  it('keywords in a handler body are not calls', () => {
+    const refs = refsOf(`router.get('/x', function (req, res) { if (ok(req)) { for (const a of b) run(a); } items.forEach(function (i) { shape(i); }); });\n`);
+    expect(refs).toEqual(expect.arrayContaining(['calls:ok', 'calls:run', 'calls:shape']));
+    expect(refs.filter((r) => /^calls:(if|for|function|while|switch|catch|return)$/.test(r))).toEqual([]);
+  });
+
+  it('a JSX closing tag is not a regex', () => {
+    const refs = expressResolver.extract!('server.tsx', `app.get('/a', (req, res) => { res.send(renderToString(<div>{a()}</div>)); });\napp.get('/b', (req, res) => { res.send(renderPage(<>{b()}</>)); });\n`).references.map((r) => `${r.referenceKind}:${r.referenceName}`);
+    expect(refs).toEqual(expect.arrayContaining(['calls:renderToString', 'calls:a', 'calls:renderPage', 'calls:b']));
+  });
+
+  it('a self-closing JSX tag after an attribute, and division after `}`, are not regexes', () => {
+    const tsx = (src: string) =>
+      expressResolver.extract!('server.tsx', src).references.map((r) => `${r.referenceKind}:${r.referenceName}`);
+    expect(tsx(`app.get('*', (req, res) => {\n  const html = renderToString(<App store={store} />);\n  sendPage(res, html);\n});\n`)).toEqual(
+      expect.arrayContaining(['calls:renderToString', 'calls:sendPage'])
+    );
+    expect(refsOf(`router.get('/x', (req, res) => { const v = { a: 1 }\n/ 2; svc(v); });\n`)).toContain('calls:svc');
+  });
+
+  it('division after `!` or `++` is not a regex', () => {
+    expect(refsOf(`router.get('/x', rateLimit({ max: cfg.max! / 2 }), getUsers);\n`)).toContain('references:getUsers');
+    expect(refsOf(`router.get('/x', limiter(hits++ / 2), getUsers);\n`)).toContain('references:getUsers');
+  });
+
+  it('an `async function` handler whose body has a `}` regex and an arrow keeps every call', () => {
+    const refs = refsOf(`router.route('/x').get(async function (req, res) { const s = t.replace(/}/g, ''); load(); items.map((i) => shape(i)); });\n`);
+    expect(refs).toContain('calls:load');
+    expect(refs).toContain('calls:shape');
+  });
+
+  it('`async` and a nested `function` declaration name are not calls; a regex with `)` is skipped', () => {
+    const refs = refsOf(`router.get('/x', function (req, res) { function helper(a) { return a; } Promise.all(items.map(async (i) => save(i))); });\n`);
+    expect(refs).toContain('calls:save');
+    expect(refs).not.toContain('calls:async');
+    expect(refs).not.toContain('calls:helper');
+  });
+
+  it('regex literals in handlers do not cost the route its edges', () => {
+    expect(refsOf(`router.get('/u/:id', async (req, res) => { if (!/^\\d+/.test(req.params.id)) return res.sendStatus(400); const user = await userService.findById(req.params.id); res.json(user); });\n`)).toContain('calls:userService.findById');
+    const chained = expressResolver.extract!('routes.ts', `router.route('/:id').get((req, res) => { if (!/^\\w+/.test(req.params.id)) return bad(res); load(req); }).put(protect, updateThing);\n`);
+    expect(chained.nodes.map((n) => n.name)).toEqual(['GET /:id', 'PUT /:id']);
+    expect(chained.references.map((r) => `${r.referenceKind}:${r.referenceName}`)).toEqual(expect.arrayContaining(['calls:load', 'references:updateThing']));
+    expect(refsOf(`app.get('/echo', (req, res) => { res.send(String(req.query.q).replace(/</g, '&lt;').replace(/>/g, '&gt;')); audit(req); });\n`)).toContain('calls:audit');
+  });
+
+  it('a call inside a template interpolation in the body still counts', () => {
+    expect(refsOf('router.get(\'/x\', (req, res) => { res.send(`<p>${fmtUser(req.user)}</p>`); });\n')).toContain('calls:fmtUser');
+  });
+
+  it('a division that looks like a regex opener does not cost the route', () => {
+    expect(refsOf(`router.get('/stats', async (req, res) => { const pct = Math.round((a - b) / total * 100) / 100; res.json({ pct: summarize(pct) }); });\n`)).toContain('calls:summarize');
+    const chained = expressResolver.extract!('routes.ts', `router.route('/s').get((req, res) => { const m = Math.floor((t1 - t0) / 1000) / 60; res.json(fmt(m)); }).post(protect, createS);\n`);
+    expect(chained.nodes.map((n) => n.name)).toEqual(['GET /s', 'POST /s']);
+    expect(chained.references.map((r) => `${r.referenceKind}:${r.referenceName}`)).toEqual(expect.arrayContaining(['calls:fmt', 'references:createS']));
+    const tsx = expressResolver.extract!('server.tsx', `app.get('/list', (req, res) => { res.send(renderToString(<ul>{items.map((x) => (<li key={x}>{x}</li>))}</ul>)); audit(req); });\n`).references.map((r) => `${r.referenceKind}:${r.referenceName}`);
+    expect(tsx).toEqual(expect.arrayContaining(['calls:renderToString', 'calls:audit']));
+  });
+
+  it('a division after `)` with a `/` in a later string does not cost the route', () => {
+    const refs = refsOf(`router.get('/s', (req, res) => { res.json({ pct: Math.round(s.done) / s.total, next: '/stats/2' }); audit(req); });\n`);
+    expect(refs).toEqual(expect.arrayContaining(['calls:Math.round', 'calls:audit']));
+    expect(refsOf(`router.get('/p', (req, res) => { const n = Math.ceil(count(req)) / size; res.redirect('/p/' + n); after(req); });\n`)).toContain('calls:after');
+    expect(refsOf(`router.get('/c', cfg(f(a) / 2, 'x/y'), handler);\n`)).toContain('references:handler');
+  });
+
+  it('a callback inside middleware, or a middleware that calls `next()`, is not the handler', () => {
+    expect(refsOf(`router.get('/admin', authorize(function (user, req) { return user.isAdmin; }), adminCtrl.index);\n`)).toContain('references:index');
+    expect(refsOf(`router.get('/referrals', function (req, res, next) { check(); next(); }, getReferrals);\n`)).toContain('references:getReferrals');
+    expect(refsOf(`router.get('/cfg', (req, res, next) => { load(); next(); }, overrideConfig);\n`)).toContain('references:overrideConfig');
+  });
+
+  it('the last argument decides: middleware before a named handler, guards, factories, generics', () => {
+    expect(refsOf(`router.get('/admin', authorize(function (user, req) { return user.isAdmin; }), adminCtrl.index);\n`)).toContain('references:index');
+    expect(refsOf(`router.get('/u/:id', function (req, res, next) { User.findById(id, function (err, user) { req.user = user; next(err); }); }, userCtrl.show);\n`)).toContain('references:show');
+    expect(refsOf(`router.get('/x', responseTime(function (req, res, time) { stats.timing(req.path, time); }), ctrl.list);\n`)).toContain('references:list');
+    expect(refsOf(`router.get('/errors', function (req, res, next) { auth(req); next(); }, getErrors);\n`)).toContain('references:getErrors');
+    expect(refsOf(`app.use('/api', function (req, res, next) { if (!ok) return res.sendStatus(403); authorize(req, next); }, apiRouter);\n`)).toContain('references:apiRouter');
+    expect(refsOf(`router.post('/g', auth, asyncHandler<Req, Res>(async (req, res) => { doIt(); }));\n`)).toContain('calls:doIt');
+    expect(refsOf(`router.post('/d', asyncHandler<Req>(async (req, res) => { saveFile(req.file); }));\n`)).toContain('calls:saveFile');
+  });
+
+  it('JSX apostrophes, a trailing options object, a callback before a named handler', () => {
+    const tsx = expressResolver.extract!('server.tsx', `app.get('/x', (req, res) => {\n  res.send(render(<p>Don't</p>));\n  res.send(render(<p>won't</p>));\n  load();\n});\n`).references.map((r) => `${r.referenceKind}:${r.referenceName}`);
+    expect(tsx).toContain('calls:load');
+    expect(refsOf(`router.get('/o', (req, res) => { svc.list(); res.json(1) }, { cache: true });\n`)).toContain('calls:svc.list');
+    expect(refsOf(`router.get('/w', withErrors(function onErr(e) { report(e); }, ctrl.list));\n`)).not.toContain('calls:report');
+    // An array of handlers: its last element is the handler.
+    expect(refsOf(`router.post('/x', auth, [validate, ctrl.create]);\n`)).toEqual(['references:create']);
+  });
+
+  it('a regex that ends its line without a semicolon is still a regex', () => {
+    expect(refsOf(`router.get('/re', (req, res) => {\n  const re = /[}]/\n  run(re)\n})\n`)).toContain('calls:run');
+  });
+
+  it('a backtick in an earlier regex does not cost later routes', () => {
+    const refs = refsOf("const esc = (s) => s.replace(/`/g, 'x');\nrouter.get('/d', async (req, res) => { await svc.doThing(); res.end(); });\nrouter.get('/e', ctrl.list);\n");
+    expect(refs).toEqual(expect.arrayContaining(['calls:svc.doThing', 'references:list']));
+  });
+
+  it('a division after a non-null `!` is not a regex, even with a path string later on the line', () => {
+    expect(refsOf(`app.get('/x', (req, res) => {\n const r = done! / total!; res.redirect(r ? '/:id' : '/');\n svc.run(r);\n});\n`)).toContain('calls:svc.run');
+    expect(refsOf(`app.get('/y', (req, res) => {\n const r = sum! / count!; const parts = csv.split(/,/);\n svc.run(parts);\n});\n`)).toContain('calls:svc.run');
+  });
+
+  it('a method named like a keyword is still a call', () => {
+    const refs = refsOf(`router.delete('/users/:id', async (req, res) => { await userService.delete(req.params.id); cache .with(k); });\n`);
+    expect(refs).toContain('calls:userService.delete');
+    expect(refs).toContain('calls:cache.with');
+    expect(refsOf(`router.get('/x', (req, res) => { return of(load()); });\n`)).toContain('calls:of');
+  });
+
+  it('chained routes: the handler decides too', () => {
+    const refs = refsOf(
+      `router.route('/items').get(rateLimit({ keyGenerator: (r) => lookup(r.ip) }), getItem).post(async (req, res) => { createItem(); });\n`
+    );
+    expect(refs).toContain('references:getItem');
+    expect(refs).not.toContain('calls:lookup');
+    expect(refs).toContain('calls:createItem');
+  });
 });
 
 import { nestjsResolver } from '../src/resolution/frameworks/nestjs';
@@ -2034,3 +2214,37 @@ export class UsersController {
     expect(references.map((r) => r.referenceName)).toEqual(['real']);
   });
 });
+
+describe('Express mounts with a division in a middleware argument', () => {
+  let dir: string | undefined;
+  afterEach(() => {
+    if (dir) require('fs').rmSync(dir, { recursive: true, force: true });
+    dir = undefined;
+  });
+
+  it('still composes the mount prefix (`x! / 2` is not a regex)', async () => {
+    const fs = await import('fs');
+    const os = await import('os');
+    const path = await import('path');
+    const { CodeGraph } = await import('../src');
+    const root = fs.mkdtempSync(path.join(os.tmpdir(), 'cg-express-mount-'));
+    dir = root;
+    fs.writeFileSync(path.join(root, 'package.json'), JSON.stringify({ dependencies: { express: '4' } }));
+    fs.mkdirSync(path.join(root, 'routes'));
+    fs.writeFileSync(
+      path.join(root, 'app.ts'),
+      "import express from 'express';\nimport apiRouter from './routes/api';\nconst app = express();\n" +
+        "app.use('/api', rateLimit({ max: cfg.max! / 2 }), apiRouter);\n"
+    );
+    fs.writeFileSync(
+      path.join(root, 'routes', 'api.ts'),
+      "import { Router } from 'express';\nconst router = Router();\nfunction listUsers(req, res) {}\nrouter.get('/users', listUsers);\nexport default router;\n"
+    );
+    const cg = await CodeGraph.init(root, { index: true });
+    try {
+      expect(cg.getNodesByKind('route').map((n) => n.name)).toContain('GET /api/users');
+    } finally {
+      cg.destroy();
+    }
+  });
+});

src/resolution/frameworks/express.ts

@@ -6,7 +6,7 @@
 
 import { Node } from '../../types';
 import { FrameworkResolver, UnresolvedRef, ResolvedRef, ResolutionContext } from '../types';
-import { stripCommentsForRegex } from '../strip-comments';
+import { REGEX_START_BEFORE, stripCommentsForRegex } from '../strip-comments';
 import { resolveImportPath } from '../import-resolver';
 import { dependsOn } from './package-deps';
 
@@ -49,6 +49,11 @@ const RESERVED_CALLS = new Set([
   'Date', 'Math', 'JSON', 'Promise', 'require', 'fail', 'redirect',
 ]);
 
+// Keywords a `name(` scan over a handler body would otherwise read as calls.
+const JS_KEYWORDS = new Set([
+  'if', 'for', 'while', 'switch', 'function', 'async', 'return', 'typeof', 'await', 'new', 'do', 'else', 'with', 'yield', 'void', 'delete', 'in', 'super', 'import',
+]);
+
 /**
  * The calls an inline handler's body makes, each once, framework noise aside.
  * A member call keeps its receiver (`userService.find`, `c.text`) so it
@@ -65,6 +70,10 @@ function handlerCallNames(body: string): string[] {
     const method = cm[2]!;
     const receiver = cm[1]!.replace(/\s|\?/g, '').replace(/\.$/, '');
     if (!receiver && /\.\s*$/.test(body.slice(0, cm.index))) continue;
+    // A keyword is only a keyword when it isn't a member: `if (` is not a
+    // call, `userService.delete(` is. `function helper(` declares helper.
+    if (!receiver && JS_KEYWORDS.has(method)) continue;
+    if (!receiver && /\bfunction\s*\*?\s*$/.test(body.slice(Math.max(0, cm.index - 12), cm.index))) continue;
     const name = receiver ? `${receiver}.${method}` : method;
     if (seen.has(name) || RESERVED_CALLS.has(method)) continue;
     seen.add(name);
@@ -188,6 +197,10 @@ export const expressResolver: FrameworkResolver = {
     const now = Date.now();
     const lang = detectLanguage(filePath);
     const safe = stripCommentsForRegex(content, lang);
+    // Brackets and commas are counted on `structure`, where string and regex
+    // contents are blanked: `/[^]]/`, `/}/` or `'a, b)'` must not end an
+    // argument or a body early. Same offsets as `safe`, which the route path
+    // and reply calls are still read from.
     // Match the route head up to the first arg: (app|router).METHOD('/path',
     // (NOT the whole call — handlers are often inline arrows whose `)`/`{}` the
     // old single-regex couldn't span, so inline-handler routes connected to nothing.)
@@ -215,46 +228,9 @@ export const expressResolver: FrameworkResolver = {
 
       // The full argument list = balanced parens from the route call's open paren.
       const openParen = safe.indexOf('(', match.index);
-      const closeParen = openParen >= 0 ? matchDelim(safe, openParen, '(', ')') : -1;
-      const args = closeParen > openParen ? safe.slice(openParen + 1, closeParen) : '';
-      const inline = inlineHandlerBody(args);
-
-      if (inline) {
-        // Inline handler (`router.post('/x', async (req,res) => {…})`,
-        // `app.get('/x', function (req, res) {…})`). It is anonymous, so its
-        // body — the actual request→service flow — would be lost. Attribute the
-        // body's calls to the route node as `calls` edges so
-        // `trace(route, service)` connects.
-        const bodyStart = openParen + 1 + inline.start;
-        for (const name of handlerCallNames(inline.body)) {
-          references.push({
-            fromNodeId: routeNode.id,
-            referenceName: name,
-            referenceKind: 'calls',
-            line,
-            column: 0,
-            filePath,
-            language: lang,
-          });
-        }
-        references.push(...replyRefs(safe, bodyStart, bodyStart + inline.body.length, routeNode.id, filePath, lang));
-      } else {
-        // Named handler: the LAST comma-separated arg (earlier ones are middleware).
-        const parts = args.split(',').map((s) => s.trim()).filter(Boolean);
-        const last = parts[parts.length - 1];
-        const handlerName = last ? extractTailIdent(last) : null;
-        if (handlerName) {
-          references.push({
-            fromNodeId: routeNode.id,
-            referenceName: handlerName,
-            referenceKind: 'references',
-            line,
-            column: 0,
-            filePath,
-            language: lang,
-          });
-        }
-      }
+      const call = openParen >= 0 ? scanCall(safe, openParen) : null;
+      const args = call ? call.structure.slice(1, -1) : '';
+      references.push(...handlerRefs(safe, openParen + 1, args, routeNode.id, line, filePath, lang));
     }
     // The chained form: `router.route('/:id').get(getProduct).put(protect, updateProduct)`
     // — one path, several methods, each with its own handler. One route node
@@ -267,11 +243,12 @@ export const expressResolver: FrameworkResolver = {
         const link = /^\s*\.\s*(get|post|put|patch|delete|all)\s*\(/.exec(safe.slice(at, at + 64));
         if (!link) break;
         const openParen = at + link[0].length - 1;
-        const closeParen = matchDelim(safe, openParen, '(', ')');
-        if (closeParen < 0) break;
+        const call = scanCall(safe, openParen);
+        if (!call) break;
+        const closeParen = call.close;
         const method = link[1]!;
         const line = safe.slice(0, openParen).split('\n').length;
-        const args = safe.slice(openParen + 1, closeParen);
+        const args = call.structure.slice(1, -1);
         const routeNode: Node = {
           id: `route:${filePath}:${line}:${method.toUpperCase()}:${routePath}`,
           kind: 'route',
@@ -286,21 +263,7 @@ export const expressResolver: FrameworkResolver = {
           updatedAt: now,
         };
         nodes.push(routeNode);
-        const inline = inlineHandlerBody(args);
-        if (inline) {
-          for (const name of handlerCallNames(inline.body)) {
-            references.push({ fromNodeId: routeNode.id, referenceName: name, referenceKind: 'calls', line, column: 0, filePath, language: lang });
-          }
-          const bodyStart = openParen + 1 + inline.start;
-          references.push(...replyRefs(safe, bodyStart, bodyStart + inline.body.length, routeNode.id, filePath, lang));
-        } else {
-          const parts = splitTopLevel(args).map((s) => s.trim()).filter(Boolean);
-          const last = parts[parts.length - 1];
-          const handlerName = last ? extractTailIdent(last) : null;
-          if (handlerName) {
-            references.push({ fromNodeId: routeNode.id, referenceName: handlerName, referenceKind: 'references', line, column: 0, filePath, language: lang });
-          }
-        }
+        references.push(...handlerRefs(safe, openParen + 1, args, routeNode.id, line, filePath, lang));
         at = closeParen + 1;
       }
     }
@@ -340,10 +303,13 @@ export const expressResolver: FrameworkResolver = {
       let m: RegExpExecArray | null;
       while ((m = mount.exec(safe)) !== null) {
         const open = safe.indexOf('(', m.index);
-        const close = open >= 0 ? matchDelim(safe, open, '(', ')') : -1;
-        if (close < 0) continue;
-        const args = splitTopLevel(safe.slice(open + 1, close));
-        const last = args[args.length - 1]?.trim() ?? '';
+        const call = open >= 0 ? scanCall(safe, open) : null;
+        if (!call) continue;
+        // Split where the blanked structure says, but read the target from
+        // `safe`: a `require('./users')` target needs its string.
+        const parts = topLevelArgs(call.structure.slice(1, -1));
+        const lastPart = parts[parts.length - 1];
+        const last = lastPart ? safe.slice(open + 1 + lastPart.start, call.close).trim() : '';
         const target = mountTarget(last, safe, file, lang, context);
         if (!target || target === file) continue;
         const list = mounts.get(file) ?? [];
@@ -395,10 +361,115 @@ export const expressResolver: FrameworkResolver = {
   },
 };
 
-/** Top-level comma split of an argument list, strings and brackets respected. */
-function splitTopLevel(args: string): string[] {
+
+/**
+ * What ends a regex literal: its flags, then a member access, a separator or
+ * a closing bracket, an operator, or the end of the line.
+ */
+const REGEX_END_AFTER = /^[dgimsuyv]*[ \t]*(?:\.\s*(?:test|exec|source|flags|global|lastIndex)\b|[,;)\]}:?]|&&|\|\||\r?\n|$)/;
+
+/**
+ * The call whose `(` is at `open`, scanned from there to its matching `)`:
+ * its close, and its text with string contents and regex-literal bodies
+ * blanked (offsets kept) so `/[^]]/`, `/}/`, `'a, b)'` or a backtick in a regex
+ * can't end an argument or a body early. Scanned per call, from the call's own
+ * paren — never from the top of the file — so nothing earlier in the file can
+ * throw it off.
+ */
+function scanCall(safe: string, open: number): { close: number; structure: string } | null {
   const out: string[] = [];
   let depth = 0;
+  for (let i = open; i < safe.length; i++) {
+    const c = safe[i]!;
+    if ((c === '"' || c === "'") && !closesOnLine(safe, i)) {
+      // JSX text (`<p>Don't</p>`), not a string: an apostrophe with no
+      // closing quote on its line must not blank the `)` after it.
+      out.push(c);
+      continue;
+    }
+    if (c === '"' || c === "'" || c === '`') {
+      out.push(c);
+      for (i++; i < safe.length && safe[i] !== c; i++) {
+        if (c !== '`' && safe[i] === '\n') break;
+        if (safe[i] === '\\' && i + 1 < safe.length) {
+          out.push(' ');
+          i++;
+        }
+        out.push(safe[i] === '\n' ? '\n' : ' ');
+      }
+      if (i < safe.length) out.push(safe[i]!);
+      continue;
+    }
+    if (c === '/' && safe[i + 1] !== '/' && safe[i + 1] !== '*') {
+      const end = regexLiteralEndAt(safe, i);
+      if (end > i) {
+        out.push('/', ...' '.repeat(end - i - 1), '/');
+        i = end;
+        continue;
+      }
+    }
+    out.push(c);
+    if (c === '(') depth++;
+    else if (c === ')') {
+      depth--;
+      if (depth === 0) return { close: i, structure: out.join('') };
+    }
+  }
+  return null;
+}
+
+/** Whether the quote at `i` has an unescaped closing quote on the same line. */
+function closesOnLine(s: string, i: number): boolean {
+  const q = s[i];
+  for (let k = i + 1; k < s.length && s[k] !== '\n'; k++) {
+    if (s[k] === '\\') k++;
+    else if (s[k] === q) return true;
+  }
+  return false;
+}
+
+/**
+ * The closing `/` of the regex literal the `/` at `i` opens, or -1 when it
+ * divides. A regex opens after punctuation or a keyword (REGEX_START_BEFORE)
+ * but not after `)`, `]`, a postfix `!` (`done! / total`), `++` or `--`; it
+ * closes on the same line; and what follows the close must end a regex —
+ * flags, then `.test(`, `,`, `;`, `)`, … — since treating a division as one
+ * (`(a - b) / total * 100) / 100`, JSX `</li>…</ul>`) would hide a bracket.
+ */
+function regexLiteralEndAt(safe: string, i: number): number {
+  let p = i - 1;
+  while (p >= 0 && (safe[p] === ' ' || safe[p] === '\t')) p--;
+  if (p >= 0 && (safe[p] === ')' || safe[p] === ']' || safe[p] === '}')) return -1;
+  if (p >= 1 && safe[p] === '!' && /[\w$)\]]/.test(safe[p - 1]!)) return -1;
+  if (p >= 1 && (safe[p] === '+' || safe[p] === '-') && safe[p - 1] === safe[p]) return -1;
+  if (!REGEX_START_BEFORE.test(safe.slice(Math.max(0, i - 32), i))) return -1;
+  let end = i + 1;
+  let inClass = false;
+  for (; end < safe.length && safe[end] !== '\n'; end++) {
+    if (safe[end] === '\\') { end++; continue; }
+    if (safe[end] === '[') inClass = true;
+    else if (safe[end] === ']') inClass = false;
+    else if (safe[end] === '/' && !inClass) break;
+  }
+  if (end >= safe.length || safe[end] !== '/') return -1;
+  return REGEX_END_AFTER.test(safe.slice(end + 1, end + 24)) ? end : -1;
+}
+
+
+
+
+function functionBodyEnd(text: string, fnAt: number): number {
+  const paramsOpen = text.indexOf('(', fnAt);
+  const paramsClose = paramsOpen >= 0 ? matchDelim(text, paramsOpen, '(', ')') : -1;
+  if (paramsClose < 0) return -1;
+  const braceAt = text.indexOf('{', paramsClose);
+  return braceAt >= 0 ? matchDelim(text, braceAt, '{', '}') : -1;
+}
+
+/** `args` split at its top-level commas, each piece with its offset into `args`. */
+function topLevelArgs(args: string): Array<{ text: string; start: number }> {
+  const out: Array<{ text: string; start: number }> = [];
+  let depth = 0;
   let start = 0;
   for (let i = 0; i < args.length; i++) {
     const ch = args[i];
@@ -411,57 +482,125 @@ function splitTopLevel(args: string): string[] {
       }
       continue;
     }
+    if (ch === '<' && i > 0 && /[\w$]/.test(args[i - 1]!)) {
+      // A type-argument list (`asyncHandler<Req, Res>(`): its commas split nothing.
+      const generic = /^<[^()<>]*(?:<[^()<>]*>[^()<>]*)*>\s*\(/.exec(args.slice(i));
+      if (generic) {
+        i += generic[0].length - 2;
+        continue;
+      }
+    }
     if (ch === '(' || ch === '[' || ch === '{') depth++;
     else if (ch === ')' || ch === ']' || ch === '}') depth--;
     else if (ch === ',' && depth === 0) {
-      out.push(args.slice(start, i));
+      out.push({ text: args.slice(start, i), start });
       start = i + 1;
     }
   }
-  out.push(args.slice(start));
+  out.push({ text: args.slice(start), start });
   return out;
 }
 
 /**
- * The body of a handler written inline as a registration's LAST argument — an
- * arrow (`async (req, res) => {…}`, `req => …`) or a function expression
- * (`function (req, res) {…}`, the form Express's own examples use), bare or
- * inside a wrapper call (`asyncHandler(async (req, res) => {…})`). `start` is
- * the body's offset into `args`. Null when the last argument names a handler
- * instead: an inline middleware before a named handler is not the handler.
+ * What a route call's handler contributes. The handler is the LAST argument —
+ * the ones before it are middleware, and an arrow inside one of those
+ * (`rateLimit({ keyGenerator: (req) => req.ip })`, `(req, res, next) => next()`)
+ * says nothing about the handler. A handler that is a function — an arrow, a
+ * `function` expression, or one wrapped in a call (`asyncHandler(async (req,
+ * res) => …)`) — is anonymous, so its body's calls are attributed to the route
+ * as `calls` edges and `trace(route, service)` connects: the body is the
+ * balanced `{…}` after the arrow or parameter list, or an arrow's expression
+ * tail. Anything else is a named handler: a `references` edge to its last name
+ * (`listUsers`, `userController.list`).
+ *
+ * `argsStart` is where `args` begins in `safe`, for the reply-call offsets.
  */
-function inlineHandlerBody(args: string): { body: string; start: number } | null {
-  // A trailing comma (Prettier's default) leaves an empty last part.
-  const parts = splitTopLevel(args);
-  let lastStart = args.length;
-  let last = '';
-  for (let i = parts.length - 1, end = args.length; i >= 0; i--) {
-    const start = end - parts[i]!.length;
-    if (parts[i]!.trim() !== '') {
-      last = parts[i]!;
-      lastStart = start;
-      break;
+function handlerRefs(
+  safe: string,
+  argsStart: number,
+  args: string,
+  fromNodeId: string,
+  line: number,
+  filePath: string,
+  language: 'typescript' | 'javascript'
+): UnresolvedRef[] {
+  // A trailing options object (`…, handler, { cache: true }`) is not the
+  // handler; a trailing array of handlers (`[validate, ctrl.create]`) is read
+  // as its last element.
+  const parts = topLevelArgs(args).filter((a) => a.text.trim());
+  while (parts.length > 1 && /^\s*\{/.test(parts[parts.length - 1]!.text)) parts.pop();
+  const lastPart = parts[parts.length - 1];
+  const arrayAt = lastPart ? lastPart.text.search(/\S/) : -1;
+  if (lastPart && lastPart.text[arrayAt] === '[') {
+    const close = matchDelim(lastPart.text, arrayAt, '[', ']');
+    const inner = close > arrayAt ? topLevelArgs(lastPart.text.slice(arrayAt + 1, close)).filter((a) => a.text.trim()).pop() : undefined;
+    if (inner) parts[parts.length - 1] = { text: inner.text, start: lastPart.start + arrayAt + 1 + inner.start };
+    else parts.pop();
+  }
+  const handler = parts[parts.length - 1];
+  if (!handler) return [];
+  const text = handler.text;
+  // A `function` is the handler's own only when it opens the argument —
+  // directly, or inside wrapper calls (`asyncHandler(function …)`); then its
+  // body starts after its parameter list, not after an arrow inside it
+  // (`items.map((i) => …)`). A `function` anywhere else (a default parameter,
+  // a wrapper's options object) is not the handler.
+  let arrowAt = text.indexOf('=>');
+  const opening = /^\s*(?:[A-Za-z_$][\w$.]*\s*\(\s*)*(?:async\s+)?function\b[^(]*\(/.exec(text);
+  let fnAt = opening ? opening[0].lastIndexOf('function') : -1;
+  if (fnAt >= 0) {
+    // Inside a wrapper, a `function` followed by an arrow after its body is a
+    // callback argument (`withErrors(function onErr(e) {…}, async (req, res) => …)`):
+    // the arrow is the handler.
+    const fnBodyEnd = functionBodyEnd(text, fnAt);
+    const insideWrapper = opening![0].slice(0, fnAt).includes('(');
+    const laterArrow = fnBodyEnd >= 0 && insideWrapper ? text.indexOf('=>', fnBodyEnd) : -1;
+    if (laterArrow >= 0) {
+      arrowAt = laterArrow;
+      fnAt = -1;
+    } else if (insideWrapper && fnBodyEnd >= 0 && !/^[\s)]*$/.test(text.slice(fnBodyEnd + 1))) {
+      // A callback followed by more arguments (`withErrors(function onErr(e)
+      // {…}, ctrl.list)`) is not the handler.
+      arrowAt = -1;
+      fnAt = -1;
+    } else {
+      arrowAt = -1;
     }
-    end = start - 1;
   }
-  const arrowAt = last.indexOf('=>');
-  const fn = /(?:^|[^\w$.])function\b\s*\*?\s*[\w$]*\s*\(/.exec(last);
-  if (fn && (arrowAt < 0 || fn.index < arrowAt)) {
-    const open = fn.index + fn[0].length - 1;
-    const close = matchDelim(last, open, '(', ')');
-    const brace = close > open ? last.indexOf('{', close) : -1;
-    const end = brace >= 0 ? matchDelim(last, brace, '{', '}') : -1;
-    if (end < 0) return null;
-    return { body: last.slice(brace + 1, end), start: lastStart + brace + 1 };
+
+  if (arrowAt < 0 && fnAt < 0) {
+    const handlerName = extractTailIdent(text.trim()) ?? extractTailIdent(text.slice(text.lastIndexOf(',') + 1).trim());
+    return handlerName
+      ? [{ fromNodeId, referenceName: handlerName, referenceKind: 'references', line, column: 0, filePath, language }]
+      : [];
   }
-  if (arrowAt < 0) return null;
-  const afterArrow = last.slice(arrowAt + 2);
-  const braceAt = afterArrow.indexOf('{');
-  if (braceAt >= 0 && afterArrow.slice(0, braceAt).trim() === '') {
-    const end = matchDelim(afterArrow, braceAt, '{', '}');
-    if (end > braceAt) return { body: afterArrow.slice(braceAt + 1, end), start: lastStart + arrowAt + 2 + braceAt + 1 };
+
+  let bodyFrom = arrowAt + 2;
+  if (arrowAt < 0) {
+    const paramsOpen = text.indexOf('(', fnAt);
+    const paramsClose = matchDelim(text, paramsOpen, '(', ')');
+    bodyFrom = paramsClose > paramsOpen ? paramsClose + 1 : text.length;
   }
-  return { body: afterArrow, start: lastStart + arrowAt + 2 };
+  const afterParams = text.slice(bodyFrom);
+  let body = afterParams;
+  let bodyStart = argsStart + handler.start + bodyFrom;
+  const braceAt = afterParams.indexOf('{');
+  if (braceAt >= 0 && afterParams.slice(0, braceAt).trim() === '') {
+    const end = matchDelim(afterParams, braceAt, '{', '}');
+    if (end > braceAt) {
+      body = afterParams.slice(braceAt + 1, end);
+      bodyStart += braceAt + 1;
+    }
+  }
+
+  // Positions came from the blanked structure; the calls are read from `safe`
+  // at the same offsets, so a call inside a template interpolation counts.
+  const source = safe.slice(bodyStart, bodyStart + body.length);
+  const refs: UnresolvedRef[] = handlerCallNames(source).map((name) => (
+    { fromNodeId, referenceName: name, referenceKind: 'calls', line, column: 0, filePath, language }
+  ));
+  refs.push(...replyRefs(safe, bodyStart, bodyStart + body.length, fromNodeId, filePath, language));
+  return refs;
 }
 
 /** `/api` + `/users` → `/api/users`; `/api/` + `/` → `/api`. */

src/resolution/strip-comments.ts

@@ -23,6 +23,13 @@
  * framework extractors scan for.
  */
 
+/**
+ * Text before a `/` (up to ~32 chars) after which that `/` can open a regex
+ * literal rather than divide: expression-start punctuation or a keyword.
+ * A heuristic — callers that act on a guess must tolerate it being wrong.
+ */
+export const REGEX_START_BEFORE = /(?:^|[=(:,)!&|?;{}\[\]+*%~^<>-]|\b(?:return|throw|case|yield|await|else|do|typeof|void|delete|new|in|of|instanceof))\s*$/;
+
 /**
  * Blank string contents while preserving quotes and offsets. Template
  * interpolations are blanked too; callers checking executable expressions
@@ -38,7 +45,7 @@ export function blankStringContents(text: string, regexLiterals?: number[]): str
     const c = text[i]!;
     // A quote inside a JS regex is data, not the beginning of a string.
     // Expression-start punctuation and keywords distinguish these from division.
-    if (c === '/' && /(?:^|[=(:,)!&|?;{}\[\]+*%~^<>-]|\b(?:return|throw|case|yield|await|else|do|typeof|void|delete|new|in|of|instanceof))\s*$/.test(text.slice(Math.max(0, i - 32), i))) {
+    if (c === '/' && REGEX_START_BEFORE.test(text.slice(Math.max(0, i - 32), i))) {
       let end = i + 1;
       let inClass = false;
       for (; end < n && text[end] !== '\n'; end++) {