TypeScript: implement file-based server routes for Remix, SvelteKit, Astro, and Nuxt/Nitro

[bjcorder]

Parent

Part of #89.

Context

Several TypeScript full-stack frameworks expose server-side route entrypoints through file conventions rather than explicit router calls. Rulepath should model these as externally reachable routes/actions/endpoints and map request sources into service/data-layer sinks.

References:

• Remix loaders/actions: https://v2.remix.run/docs/route/loader/ and https://v2.remix.run/docs/route/action/
• SvelteKit routing/actions: https://svelte.dev/docs/kit/routing and https://svelte.dev/docs/kit/form-actions
• Astro endpoints: https://docs.astro.build/en/guides/endpoints/
• Nuxt server routes: https://nuxt.com/docs/guide/directory-structure/server

Scope

• Discover Remix/React Router route files, loaders, actions, route params, request, form data, JSON body, cookies, headers, and auth/session helpers.
• Discover SvelteKit +server.ts, +page.server.ts, actions, load, route params, RequestEvent, cookies, locals, form data, JSON body, and params.
• Discover Astro endpoint files and exported HTTP methods, params, request objects, cookies, locals, and body/form data.
• Discover Nuxt/Nitro server routes, event handlers, route params, query/body helpers, cookies, headers, and middleware where statically visible.
• Normalize route IDs from file-system paths and dynamic segments.
• Normalize auth/session/current-user/current-tenant evidence from framework locals/session helpers and configured helpers.
• Integrate with service tracing and TypeScript data-layer sinks.

Acceptance Criteria

• Unsafe fixtures for at least Remix and SvelteKit emit expected findings for route-param/body/form flows.
• Safe fixtures recognize session/auth/locals evidence, tenant/object scope, and safe mapping.
• File-route dynamic params are represented as route-param sources.
• Astro and Nuxt/Nitro have staged or complete fixture coverage with documented limitations.

Test Plan

• Add framework unit tests for file-route path normalization, dynamic segments, loaders/actions/endpoints/server handlers, request APIs, and locals/session helpers.
• Add CLI fixtures for Remix, SvelteKit, Astro, and Nuxt/Nitro safe/unsafe cases or staged subsets.
• Assert JSON source IDs and call paths.
• Run cargo fmt --all -- --check, cargo clippy --locked --workspace --all-targets, and cargo test --locked --workspace.