Endpoint

Non-HTTP command-line entry points. A CLI endpoint models the invocation surface of a command-line program: a (sub)command addressed as cli://<binary>/<subcommand> whose inputs are flags/options (param_type "flag"), positional arguments ("argument"), and consumed environment variables ("env"). The method is the synthetic verb "CLI". Like mobile endpoints these are not HTTP requests, so they are excluded from HTTP-shaped output (curl/httpie/powershell, OpenAPI, Postman) and from active probing / proxy delivery, and the optimizer keeps their URL verbatim instead of normalizing it as an HTTP path.

Non-HTTP mobile deep-link protocols. These endpoints are app URLs you open (myapp://, intent://, verified https app links) or ContentResolver surfaces you address (content://authority), not HTTP requests you send — so they are excluded from HTTP-shaped output (curl/httpie/powershell, OpenAPI) and from active probing / proxy delivery.

Dedup by (name, tagger) like push_callee/push_param do for their collections, so re-tagging the same target (e.g. a match in two code_paths) can't surface a duplicate "auth auth" in the text output.

Free-form metadata for non-HTTP entry points (mobile deep-link schemes, Android intents, universal links: action/category/host/ package/...). nil for ordinary endpoints and suppressed from serialization so the JSON/YAML schema is unchanged for them.

Free-form metadata for non-HTTP entry points (mobile deep-link schemes, Android intents, universal links: action/category/host/ package/...). nil for ordinary endpoints and suppressed from serialization so the JSON/YAML schema is unchanged for them.

True for endpoints whose URL is not an HTTP path and must be preserved verbatim — mobile deep-link schemes, CLI command surfaces and realtime ws:// event surfaces. The optimizer skips URL normalization for these, and the HTTP output builders / active deliverers skip them entirely.

Add a callee, deduping by (name, path) and enforcing the Callee::MAX_PER_ENDPOINT cap. Both checks are kept here so individual analyzers can't forget them and let the list balloon.

Dedup by (name, param_type) like push_callee/add_tag do for their collections. A handler that reads the same input twice (params[:id] on two lines, a path param re-read in the body) used to surface the identical Param multiple times in the raw params list and the text output. params_to_hash/== already collapse on name+type, so deduping here only trims redundant entries.

Realtime / event-driven entry points (SignalR hubs, Socket.IO namespaces, Phoenix channels, Action Cable channels). A realtime endpoint models one callable event/action/message handler on a long-lived socket, addressed as ws://<hub-or-namespace-or-channel- or-topic>/<event> (bare ws://<surface> when no discrete event is discoverable). The method is the synthetic verb "SEND" — the allow-listed messaging verb the optimizer keeps (matching Spring's @MessageMapping → SEND) — and the protocol is "ws", so the existing WebsocketTagger tags them with no changes. Message/argument fields are params (param_type "json").

Keyed on the ws:// / wss:// URL scheme rather than the protocol so AsyncAPI's bare-channel ws endpoints and HAR's normalized https://… + protocol=ws handshakes (both real, resolvable HTTP surfaces) stay HTTP-shaped, while these abstract source-analyzed surfaces — which can't be exercised as plain HTTP requests — are kept out of HTTP-shaped output and preserved verbatim by the optimizer.