Analyzer::Php::PhpEngine

Regex fragment for the rest of a call's argument list, up to the ) that closes it. Quoted strings are skipped whole so a ) in one ('placeholder' => '(:num)') does not end the list; nested calls are not balanced, so the text stops at their first bare ). Possessive throughout, so it never backtracks.

Naive English singular of a resource name (photos -> photo, categories -> category), for nested-resource parameter names.

Illuminate\Http\Request reads (Laravel, Lumen): $request->input('x'), request()->query('x'), $request->header('X-Token'), ... Capture 1 is the accessor, capture 2 the input name.

$request->has(self::ENTITY_KEY): the input named by a class constant.

A dynamic property read, $request->email: Request::__get returns that input. Not a call, not a chain, not an assignment, and not one of the request's own public properties ($request->query->get(...)).

foreach ($fields as $field) / foreach (['a', 'b'] as $k => $field).

$request->only('a', 'b') / ->only(['a', 'b']): several literal input names per call, as arguments or one array. Capture 1 the list. (except names the inputs the code drops, often _token.)

->paginate(...) / simplePaginate read the current page from the request's page input, cursorPaginate its cursor.

Calls taking a validation rules array: $request->validate([...]), $this->validate($request, [...]), Validator::make($data, [...]).

Body of an inline function (...) use (...) { ... } closure handler starting at pos: {body, position after the closure, body start line}, or {nil, pos, nil} when no closure starts there.

PHP double-quoted strings interpolate $var, {$var}, and ${var}. The route extractor captures the literal characters between the quotes, so "/api/{$VERSION}/items" came out as /api/{$VERSION}/items with the $ leaking into the URL. Rewrite each shape to {name} so the path-parameter extractor picks it up and the URL template reads cleanly. Same posture as the Python f-string and Ruby #{} fixes.

'password' => 'required|confirmed': Laravel's confirmed rule reads a second input, password_confirmation.

A rules-array key: 'title' =>, 'author.name' => (input author).

Standard PHP test-source conventions:

• /Tests/ — PSR-4 / Symfony convention (src/Symfony/Bundle/FrameworkBundle/Tests/...)
• /tests/ — Laravel / CakePHP / PHPUnit default
• /Test/Unit/, /Test/Mftf/, … — Magento's per-module test trees (Test/Unit/_files/webapi.xml), /test/phpunit/ — Dolibarr, and /config/routes/test/ — Symfony's test-env routes. A bare Test/ or test/ is not a test dir: it is the Test namespace of app/Http/Controllers/Test/ (Laravel), src/Controller/Test/ (Symfony), a ThinkPHP application/test/ or Yii modules/test/ module, all real routes.
• /Fixtures/, /legacy_tests/ — test data and Dusk suites
• /workbench/ — Orchestra Testbench skeleton app
• /docs/ at the scan base — runnable doc snippets (API Platform docs/guides); anchored, because Folio mounts resources/views/docs as a real route. root_docs: false drops it for the plain PHP analyzer, which serves a docs/ section.
• *Test.php filename — PHPUnit suffix convention
• *Tests.php filename — pluralized variant (rare)

symfony/symfony's own repo accounts for ~63 phantom endpoints under src/Symfony/Bundle/FrameworkBundle/Tests/.... The conventions are unambiguous — production routing never adopts any of them.

Takes the scan-base-relative path (Analyzer#base_relative_path), never the absolute one. The conventions describe a location inside the project, so matching the absolute path handed the decision to whatever directory the checkout happened to live in: the same tree scanned from ~/work/tests/myapp reported 0 endpoints instead of 235.