@polycode-projects/seonix 0.9.1 → 0.10.1

package/src/cs_treesitter.mjs

@@ -54,6 +54,59 @@ function collectCalls(node) {
   return [...out].sort();
 }
 
+// ---- HTTP-client call capture (un-typed interfaces: the callsHttp client→route half). ----
+// `<recv>.GetAsync("api/x")`-style HttpClient invocations whose FIRST argument is a string
+// literal. The verb comes from the method name (Get|Post|Put|Delete|Patch, with the common
+// String/Stream/ByteArray/FromJson/AsJson suffixes, always ...Async); interpolated strings keep
+// their `{expr}` holes verbatim — the matcher in interfaces.mjs collapses them to wildcard
+// segments. The URL must contain "/". Emitted as an optional `http_calls` field on the method
+// define — absent when empty, and the DEFAULT graph ignores the field (gating contract).
+// NOTE: the tree-sitter backend only; the Roslyn backend does not capture http_calls yet.
+const HTTP_METHOD = /^(get|post|put|delete|patch)(string|stream|bytearray|fromjson|asjson)?async$/;
+const URL_LITERALS = new Set(["string_literal", "verbatim_string_literal", "interpolated_string_expression", "raw_string_literal"]);
+function collectHttpCalls(node) {
+  const out = [];
+  const seen = new Set();
+  const visit = (n) => {
+    if (n.type === "invocation_expression") {
+      const fn = n.childForFieldName("function");
+      const name = fn && fn.type === "member_access_expression" ? (fn.childForFieldName("name")?.text || "") : "";
+      const m = HTTP_METHOD.exec(name.toLowerCase());
+      if (m) {
+        const arg = n.childForFieldName("arguments")?.namedChild(0); // first `argument` node
+        const expr = arg?.namedChild(0) || arg;
+        if (expr && URL_LITERALS.has(expr.type)) {
+          const url = expr.text.replace(/\s+/g, " ").replace(/^[$@]+/, "").replace(/^"+|"+$/g, "").slice(0, 160);
+          if (url.includes("/")) {
+            const key = `${m[1]} ${url}`;
+            if (!seen.has(key)) { seen.add(key); out.push({ verb: m[1], url }); }
+          }
+        }
+      }
+    }
+    for (let i = 0; i < n.namedChildCount; i++) visit(n.namedChild(i)); // document order
+  };
+  visit(node);
+  return out;
+}
+
+/** C# attributes on a declaration node → decorator strings, matching the Roslyn
+ *  backend's shape (`m.AttributeLists.SelectMany(a => a.Attributes)` + OneLine):
+ *  each `attribute` child of an `attribute_list`, whitespace-collapsed to one line.
+ *  So `[Route("api/[controller]")]` → `Route("api/[controller]")` on both backends. */
+function attrsOf(node) {
+  const out = [];
+  for (let i = 0; i < node.namedChildCount; i++) {
+    const list = node.namedChild(i);
+    if (list.type !== "attribute_list") continue;
+    for (let j = 0; j < list.namedChildCount; j++) {
+      const a = list.namedChild(j);
+      if (a.type === "attribute") out.push(a.text.replace(/\s+/g, " ").trim());
+    }
+  }
+  return out;
+}
+
 function modifiersText(node) {
   // tree-sitter-c-sharp surfaces modifiers as anonymous children before the name
   const mods = [];
@@ -76,7 +129,7 @@ function emitType(n, prefix, defines, exports) {
   const bases = [];
   const baseList = n.childForFieldName("bases") || n.namedChildren.find((c) => c.type === "base_list");
   if (baseList) for (let i = 0; i < baseList.namedChildCount; i++) bases.push(baseList.namedChild(i).text.slice(0, 80));
-  defines.push({ name: cname, kind: "class", lineno: line(n), end_lineno: endLine(n), bases, decorators: [],
+  defines.push({ name: cname, kind: "class", lineno: line(n), end_lineno: endLine(n), bases, decorators: attrsOf(n),
     ...(SUBKIND[n.type] ? { subkind: SUBKIND[n.type] } : {}),
     ...(visFrom(mods) ? { visibility: visFrom(mods) } : {}) });
   if (mods.includes("public")) exports.add(cname);
@@ -94,10 +147,12 @@ function emitType(n, prefix, defines, exports) {
       const mmods = modifiersText(mem);
       const params = (mem.childForFieldName("parameters")?.text || "").replace(/\s+/g, " ").replace(/^\(|\)$/g, "").slice(0, 160);
       const returns = (mem.childForFieldName("returns") || mem.childForFieldName("type"))?.text?.slice(0, 80) || "";
+      const http = collectHttpCalls(mem);
       defines.push({ name: `${cname}.${mn}`, kind: "method", lineno: line(mem), end_lineno: endLine(mem),
-        decorators: [], params, returns, calls: collectCalls(mem),
+        decorators: attrsOf(mem), params, returns, calls: collectCalls(mem),
         ...(mmods.includes("static") ? { is_static: true } : {}),
-        ...(visFrom(mmods) ? { visibility: visFrom(mmods) } : {}) });
+        ...(visFrom(mmods) ? { visibility: visFrom(mmods) } : {}),
+        ...(http.length ? { http_calls: http } : {}) });
     } else if (mem.type === "property_declaration") {
       const mn = fieldText(mem, "name");
       if (mn) defines.push({ name: `${cname}.${mn}`, kind: "attribute", lineno: line(mem), end_lineno: endLine(mem), decorators: [] });

package/src/extract.mjs

@@ -13,7 +13,9 @@
 //   mgx:testsCoverage       Module → Module   (a test module → the internal modules it imports)
 //   seon:history            Commit → Module   (from git log --name-only)
 //   mgx:touchesSymbol       Commit → CodeEntity (commit changed-line-range ∩ symbol span)
-//   mgx:callsSymbol         Function/Method → Function/Class (symbol-granular, unambiguous)
+//   mgx:callsSymbol         Function/Method → Function/Class/Method (symbol-granular,
+//                                              unambiguous; method targets resolve through a
+//                                              tiered simple-name fallback — see buildEntities)
 //   seon:containsCodeEntity Class  → Method/Attribute (class membership)
 //   mgx:subclassOf          Class  → Class    (inheritance; internal base resolved, else ext:)
 
@@ -233,9 +235,38 @@ export function buildEntities(modules, commits, { generatedAt = "", symbolHistor
   // Registry of top-level functions/classes by simple name — used to resolve coarse
   // call targets AND inheritance bases to a single internal module (else dropped).
   const classToPaths = new Map();    // class name -> Set<path> (for base resolution)
+  // Method-level call-target registries. Receiver-typed call texts (`_svc.ProcessOrder(...)`,
+  // `self.render()`) never match a top-level function/class name, and on C#/Java estates there
+  // are NO top-level functions at all — so without these every method stays caller-less.
+  const methodToSymbolIds = new Map();       // simple method name (last ident of the define) -> Set<fnId>
+  const dottedMethodToSymbolIds = new Map(); // "Owner.Method" (last two idents of the define) -> Set<fnId>
+  const interfaceOwnedIds = new Set();       // method ids owned by a class defined with subkind "interface"
   for (const m of modules) {
+    // Interface class names in THIS module first (defines are document-ordered, but a full
+    // pre-pass keeps membership independent of class/member ordering).
+    const interfaceNames = new Set();
     for (const d of m.defines || []) {
-      if (d.kind === "method" || d.kind === "attribute" || d.kind === "global") continue; // not standalone call targets
+      if (d.kind === "class" && d.subkind === "interface") interfaceNames.add(d.name);
+    }
+    for (const d of m.defines || []) {
+      if (d.kind === "method") {
+        const id = fnId(m.path, d.name);
+        const simple = lastIdent(d.name);
+        if (simple) {
+          if (!methodToSymbolIds.has(simple)) methodToSymbolIds.set(simple, new Set());
+          methodToSymbolIds.get(simple).add(id);
+        }
+        const parts = d.name.split(".");
+        if (parts.length >= 2) {
+          const dotted = parts.slice(-2).join(".");
+          if (!dottedMethodToSymbolIds.has(dotted)) dottedMethodToSymbolIds.set(dotted, new Set());
+          dottedMethodToSymbolIds.get(dotted).add(id);
+        }
+        const owner = d.name.includes(".") ? d.name.slice(0, d.name.lastIndexOf(".")) : "";
+        if (owner && interfaceNames.has(owner)) interfaceOwnedIds.add(id);
+        continue;
+      }
+      if (d.kind === "attribute" || d.kind === "global") continue; // not standalone call targets
       const register = (name) => {
         if (!nameToPaths.has(name)) nameToPaths.set(name, new Set());
         nameToPaths.get(name).add(m.path);
@@ -267,6 +298,32 @@ export function buildEntities(modules, commits, { generatedAt = "", symbolHistor
     return ids[0];
   };
 
+  // Resolve a receiver-typed call text (`_svc.ProcessOrder`, `self.render`) to ONE method
+  // define, tiered and deterministic — same honest Group-A discipline as the base registry,
+  // mirroring its same-module-wins rule:
+  //   0. precision: the call's last TWO identifiers hit the dotted "Owner.Method" registry
+  //      uniquely (qualified/static call texts) → it;
+  //   a. exactly one candidate defined in the calling module → local win;
+  //   b. else exactly one after excluding interface-owned members → the implementation
+  //      wins over the interface declaration it satisfies;
+  //   c. else exactly one overall → it;
+  //   d. else drop (ambiguous → no edge, never guessed).
+  const resolveMethodCallee = (callName, ident, path) => {
+    const dm = String(callName).match(/([A-Za-z_][A-Za-z0-9_]*)\s*\.\s*([A-Za-z_][A-Za-z0-9_]*)\s*$/);
+    if (dm) {
+      const dotted = dottedMethodToSymbolIds.get(`${dm[1]}.${dm[2]}`);
+      if (dotted?.size === 1) return [...dotted][0];
+    }
+    const cands = methodToSymbolIds.get(ident);
+    if (!cands || !cands.size) return null;
+    const pre = `fn:${path}#`;
+    const local = [...cands].filter((i) => i.startsWith(pre));
+    if (local.length === 1) return local[0];
+    const impls = [...cands].filter((i) => !interfaceOwnedIds.has(i));
+    if (impls.length === 1) return impls[0];
+    return cands.size === 1 ? [...cands][0] : null;
+  };
+
   // resolve a module's import candidates to internal module paths
   const internalImports = (m) => {
     const set = new Set();
@@ -380,17 +437,22 @@ export function buildEntities(modules, commits, { generatedAt = "", symbolHistor
         }
       }
 
-      // symbol-granular calls: caller fn/method → callee fn/class, resolved ONLY when the
-      // callee simple name has exactly ONE in-repo definition (same unique-name discipline
-      // as the module-coarse calls). Ambiguous / receiver-typed / external names are dropped
-      // (honest Group-A). Reuses the per-function call names already parsed by extract_ast.py.
+      // symbol-granular calls: caller fn/method → callee fn/class/method. The top-level
+      // function/class registry resolves first, unchanged (exactly ONE in-repo definition —
+      // same unique-name discipline as the module-coarse calls). On a complete miss there,
+      // receiver-typed call texts fall through to the tiered METHOD registry above, so
+      // `_svc.ProcessOrder(...)` reaches `B.ProcessOrder` even though no top-level symbol
+      // carries that name (C#/Java estates have none). Ambiguous / external names are
+      // dropped (honest Group-A). Reuses the per-function call names the extractors parsed.
       if ((d.kind === "function" || d.kind === "method") && d.calls?.length) {
         for (const callName of d.calls) {
           const ident = lastIdent(callName);
           if (!ident) continue;
           const ids = nameToSymbolIds.get(ident);
-          if (!ids || ids.size !== 1) continue; // ambiguous or external → drop
-          const callee = [...ids][0];
+          let callee = null;
+          if (ids?.size === 1) callee = [...ids][0];
+          else if (!ids) callee = resolveMethodCallee(callName, ident, m.path); // method fallback on a clean miss only
+          if (!callee) continue; // ambiguous or external → drop
           if (callee === oid) continue; // self-recursion not an edge
           const ckey = `${oid}>${callee}`;
           if (seenCallSymbol.has(ckey)) continue;
@@ -544,7 +606,7 @@ export function buildEntities(modules, commits, { generatedAt = "", symbolHistor
   // a no-op → byte-identical graph.json/summary.json (the measurement contract).
   const serves = interfaces?.enabled
     ? extractServes(modules, { fnId, opts: interfaceOpts(interfaces) })
-    : { edges: [], routes: [], vocab: [] };
+    : { edges: [], routes: [], vocab: [], callsHttp: [] };
 
   // Second pass (PLAN_PROSE_INDEX.md) — see the returned `proseIndex` field's comment below.
   const allIndividuals = attachProseTokens(
@@ -564,7 +626,7 @@ export function buildEntities(modules, commits, { generatedAt = "", symbolHistor
     vocabulary: [
       { prop: "mgx:importsNamespace", predicate: "imports", note: "module→module; SEON usesComplexType is type→type, so owned (cf. main:dependsOn)" },
       { prop: "mgx:callsCoarse", predicate: "calls", note: "module→module, import-backed; NOT SEON's method→method invokesMethod" },
-      { prop: "mgx:callsSymbol", predicate: "callsSymbol", note: "caller fn/method→callee fn/class; symbol-granular, unique-name-resolved (Group A); cf. seon:invokesMethod" },
+      { prop: "mgx:callsSymbol", predicate: "callsSymbol", note: "caller fn/method→callee fn/class/method; symbol-granular, unique-name-resolved (Group A; method targets via a tiered simple-name fallback — same-module wins, interface members excluded when one implementation remains); cf. seon:invokesMethod" },
       { prop: "seon:declaresMethod", predicate: "defines" },
       { prop: "seon:containsCodeEntity", predicate: "contains" },
       { prop: "mgx:touchedByCommit", predicate: "touches", note: "owned; seon:history is not a real SEON property (cf. history:isCommittedIn)" },
@@ -617,8 +679,10 @@ export function buildEntities(modules, commits, { generatedAt = "", symbolHistor
       rel("cochange", "mgx:changeCoupledWith", cochangeEdges),
       rel("reexports", "mgx:reExports", reExportEdges),
       // GATED (PLAN_UNTYPED_INTERFACES.md): emitted ONLY when the interfaces feature produced
-      // edges, so the default graph never carries a zero-count `serves` group → byte-identical.
+      // edges, so the default graph never carries a zero-count `serves`/`callsHttp` group →
+      // byte-identical.
       ...(serves.edges.length ? [rel("serves", "mgx:serves", serves.edges)] : []),
+      ...(serves.callsHttp.length ? [rel("callsHttp", "mgx:callsHttp", serves.callsHttp)] : []),
     ],
     individuals: allIndividuals,
     // Second pass (PLAN_PROSE_INDEX.md): word -> [individual ids], inverted from the
@@ -828,6 +892,10 @@ async function assembleAndWrite(rootDir, { modules, commits, symbolHistory, gene
   // the same in-memory payload, stamped with the JSON's stat for freshness. Mirrors the
   // SEONIX_PROSE_INDEX env-gate precedent; unset → no import of node:sqlite, no graph.db,
   // byte-identical default path. Best-effort: graph.json stays authoritative on any failure.
+  // storeMode feeds the A1 summary's `store:` line — "sqlite" ONLY when graph.db was actually
+  // (re)built, so an inactive gate (e.g. SEONIX_STORE set in the shell but never EXPORTED) is
+  // visible at a glance instead of silently running the JSON single-string path.
+  let storeMode = "json";
   if (process.env.SEONIX_STORE === "sqlite") {
     try {
       const { writeStore, storeFileFor } = await import("./store.mjs");
@@ -837,6 +905,7 @@ async function assembleAndWrite(rootDir, { modules, commits, symbolHistory, gene
       // file, so verifyStore/readPayload-freshness would fail on every fresh v2 store. Mirrors
       // bin/cli.mjs store_rebuild (which passes sourceText: text).
       await writeStore(storeFileFor(graphFile), entities, { sourceStat, sourceText: payload });
+      storeMode = "sqlite";
     } catch (e) {
       process.stderr.write(`seonix: sqlite store build failed (${e?.message || e}) — graph.json is authoritative\n`);
     }
@@ -848,7 +917,7 @@ async function assembleAndWrite(rootDir, { modules, commits, symbolHistory, gene
     ? codegraph.renderToolsCatalog(CLI_SCRIPT)
     : localToolsCatalog(CLI_SCRIPT);
   await writeFile(join(rootDir, ".seonix", "TOOLS.md"), toolsMd);
-  return { entities, graphFile, graphBytes };
+  return { entities, graphFile, graphBytes, storeMode };
 }
 
 function buildCounts(entities, { modules, languages, commits, proseEnabled, baseMs, historyMs }) {
@@ -886,7 +955,7 @@ export async function indexRepository(repoPath, { python = DEFAULT_PYTHON(), gen
   const { modules, perLang, commits, symbolHistory, baseMs, historyMs, gitErrors } = r;
   warnGitErrors(gitErrors, repoPath); // surface any history-pass failure immediately (never fatal)
   const sessions = await readSessionRecords(repoPath); // recorded chat sessions (.seonix/sessions/*.jsonl), [] when none
-  const { entities, graphFile, graphBytes } = await assembleAndWrite(repoPath, { modules, commits, symbolHistory, generatedAt, proseEnabled, sessions, interfaces });
+  const { entities, graphFile, graphBytes, storeMode } = await assembleAndWrite(repoPath, { modules, commits, symbolHistory, generatedAt, proseEnabled, sessions, interfaces });
   // A1 post-index summary: SUMMARY.md + summary.json next to graph.json (NEW files; the
   // graph.json bytes are untouched). The rendered MD is also printed to stdout by cli.mjs.
   const summary = buildSummary(entities, {
@@ -901,6 +970,7 @@ export async function indexRepository(repoPath, { python = DEFAULT_PYTHON(), gen
     skipped: [],
     languages: perLang,
     graphBytes,
+    store: storeMode,
   });
   await writeSummaryArtifacts(dirname(graphFile), summary);
   return {
@@ -961,7 +1031,8 @@ export function applyRepoPrefix({ modules, commits, symbolHistory }, prefix) {
 export function defaultOutRoot(repoPaths, cwd = process.cwd()) {
   const segs = repoPaths.map((p) => resolve(p).split(sep));
   const first = segs[0];
-  let depth = Math.min(...segs.map((s) => s.length));
+  let depth = first.length; // running min, not Math.min(...spread) — one arg per repo path
+  for (const s of segs) if (s.length < depth) depth = s.length;
   let i = 0;
   while (i < depth && segs.every((s) => s[i] === first[i])) i += 1;
   const ancestor = first.slice(0, i).join(sep) || sep;
@@ -1018,9 +1089,11 @@ export async function indexRepositories(repoPaths, { python = DEFAULT_PYTHON(),
     const r = await extractRepo(rp, { python, ignores, historyDepth, extraIgnores, languages: languageAllow });
     warnGitErrors(r.gitErrors, prefix); // surface any history-pass failure immediately (never fatal)
     applyRepoPrefix(r, prefix);
-    allModules.push(...r.modules);
-    allCommits.push(...r.commits);
-    allSymbolHistory.push(...r.symbolHistory);
+    // NB: append iteratively — spreading into push() passes one argument per element and
+    // module/commit lists scale with repo size, past V8's argument-count limit on estates.
+    for (const m of r.modules) allModules.push(m);
+    for (const c of r.commits) allCommits.push(c);
+    for (const h of r.symbolHistory) allSymbolHistory.push(h);
     baseMs += r.baseMs;
     historyMs += r.historyMs;
     for (const [lang, s] of Object.entries(r.perLang)) {
@@ -1036,7 +1109,7 @@ export async function indexRepositories(repoPaths, { python = DEFAULT_PYTHON(),
   // TODO(sessions): multi-repo merges don't fold in the member repos' .seonix/sessions
   // yet — their recorded ids would need the same repo-name prefixing as modules to
   // re-resolve against the merged graph. Deferred; single-path fold-in is the contract.
-  const { entities, graphFile, graphBytes } = await assembleAndWrite(root, {
+  const { entities, graphFile, graphBytes, storeMode } = await assembleAndWrite(root, {
     modules: allModules, commits: allCommits, symbolHistory: allSymbolHistory, generatedAt, proseEnabled, interfaces,
   });
   // A1 post-index summary (merged): per-repo rows (name = prefix) + any discovery
@@ -1053,6 +1126,7 @@ export async function indexRepositories(repoPaths, { python = DEFAULT_PYTHON(),
     skipped,
     languages,
     graphBytes,
+    store: storeMode,
   });
   await writeSummaryArtifacts(dirname(graphFile), summary);
   return {
@@ -1188,9 +1262,10 @@ export async function syncRepositories(multiRoot, { python = DEFAULT_PYTHON(), g
     } else {
       ext = await readCache(artifactDir, name); // reused post-prefix extraction
     }
-    allModules.push(...ext.modules);
-    allCommits.push(...ext.commits);
-    allSymbolHistory.push(...ext.symbolHistory);
+    // NB: append iteratively — same repo-scaled-spread hazard as indexRepositories above.
+    for (const m of ext.modules) allModules.push(m);
+    for (const c of ext.commits) allCommits.push(c);
+    for (const h of ext.symbolHistory) allSymbolHistory.push(h);
     for (const [lang, s] of Object.entries(ext.perLang || {})) {
       const agg = languages[lang] || (languages[lang] = { lib: s.lib, files: 0, modules: 0, symbols: 0, failures: 0, ms: 0 });
       agg.files += s.files; agg.modules += s.modules; agg.symbols += s.symbols; agg.failures += s.failures; agg.ms += s.ms;
@@ -1208,10 +1283,10 @@ export async function syncRepositories(multiRoot, { python = DEFAULT_PYTHON(), g
   for (const r of diff.removed) await rm(cachePath(artifactDir, r.name), { force: true }).catch(() => {});
 
   // ONE buildEntities over the union (cached + fresh) → the exact full-re-index graph.
-  const { entities, graphFile, graphBytes } = await assembleAndWrite(root, {
+  const { entities, graphFile, graphBytes, storeMode } = await assembleAndWrite(root, {
     modules: allModules, commits: allCommits, symbolHistory: allSymbolHistory, generatedAt, proseEnabled, interfaces,
   });
-  const summary = buildSummary(entities, { mode: "multi", repos: repoRows, skipped: [], languages, graphBytes });
+  const summary = buildSummary(entities, { mode: "multi", repos: repoRows, skipped: [], languages, graphBytes, store: storeMode });
   await writeSummaryArtifacts(dirname(graphFile), summary);
   await writeManifest(artifactDir, { format: 1, generated_at: generatedAt, repos: manifestRows });
 

package/src/extract_lang.mjs

@@ -66,9 +66,11 @@ export async function ingestRepo(root, { cs, java, ignore = null } = {}) {
     const { modules, failures, fileCount } = await extractor.ingest(root, { ignore });
     const ms = Date.now() - t0;
     if (fileCount === 0) continue; // language not present
-    allModules.push(...modules);
+    // NB: append iteratively — spreading into push() passes one argument per module and
+    // per-language module counts hit ~20k+ on estates, past V8's argument-count limit.
+    for (const m of modules) allModules.push(m);
     totalFiles += fileCount;
-    allFailures.push(...failures);
+    for (const f of failures) allFailures.push(f);
     const symbols = modules.reduce((n, m) => n + (m.defines?.length || 0), 0);
     perLang[lang] = { lib: extractor.meta.lib, files: fileCount, modules: modules.length, symbols, failures: failures.length, ms };
   }

package/src/interfaces.mjs

@@ -18,7 +18,9 @@ export function interfaceOpts(cfg = {}) {
     verbs: cfg.verbs && cfg.verbs.length ? cfg.verbs.map((s) => String(s).toLowerCase()) : VERBS,
     combineControllerPrefix: cfg.combineControllerPrefix !== false, // default true
     prefixStrip: (cfg.prefixStrip || []).map((s) => normPath(String(s))),
-    // Forward-compat: the confidence threshold the future callsHttp client↔route matcher will tune.
+    // Minimum matchScore (see below) for a callsHttp client↔route link. 1.0 = exact-length
+    // matches only; the 0.5 default also admits exact-prefix overlaps (e.g. a client URL with
+    // extra trailing segments over a shorter route template).
     matchThreshold: typeof cfg.matchThreshold === "number" ? cfg.matchThreshold : 0.5,
   };
 }
@@ -64,21 +66,28 @@ function parseCsAttr(attr) {
 }
 
 /** C# controller routes from a module's defines[] (Roslyn emits `[Http*]`/`[Route]` in decorators).
- *  Methods are named "Class.Method"; the class-level [Route] prefix is combined per opts. */
+ *  Methods are named "Class.Method". ASP.NET semantics honoured here:
+ *  - EVERY class-level `[Route("…")]` is a prefix (a controller can declare several — one route per
+ *    prefix × method mapping, document order, deterministic).
+ *  - A method-level verb attr with its own template (`[HttpGet("{id}")]`) uses that template.
+ *  - A verb attr with NO template (`[HttpPost]`) takes the method-level verb-less `[Route("…")]`
+ *    template(s) as its suffix — the common `[HttpPost] + [Route("process")]` pattern; with no
+ *    method [Route] either, the mapping is just the prefix. */
 function csRoutes(mod, opts) {
   const out = [];
   const defines = mod.defines || [];
-  // class name → { prefix, isController } from class-level [Route]/[ApiController]
+  // class name → { prefixes, isController } from class-level [Route]/[ApiController]
   const classInfo = new Map();
   for (const d of defines) {
     if (d.kind !== "class") continue;
-    let prefix = "", isController = /controller$/i.test(d.name);
+    const prefixes = [];
+    let isController = /controller$/i.test(d.name);
     for (const a of d.decorators || []) {
       const p = parseCsAttr(a);
-      if (p && p.verb === null && p.path) prefix = p.path;
+      if (p && p.verb === null && p.path) prefixes.push(p.path);
       if (/^apicontroller/i.test(String(a).trim())) isController = true;
     }
-    classInfo.set(d.name, { prefix, isController });
+    classInfo.set(d.name, { prefixes, isController });
   }
   for (const d of defines) {
     if (d.kind !== "method") continue;
@@ -87,14 +96,27 @@ function csRoutes(mod, opts) {
     const methodName = dot >= 0 ? d.name.slice(dot + 1) : d.name;
     const info = classInfo.get(className);
     const controller = className.replace(/Controller$/i, "");
+    // First pass over the method's attributes: verb mappings + verb-less [Route] templates.
+    const verbAttrs = [];
+    const routeTemplates = [];
     for (const a of d.decorators || []) {
       const p = parseCsAttr(a);
-      if (!p || p.verb === null) continue;               // only [Http*] maps a method to a verb
+      if (!p) continue;
+      if (p.verb === null) { if (p.path) routeTemplates.push(p.path); continue; }
       if (!opts.verbs.includes(p.verb)) continue;
-      const prefix = opts.combineControllerPrefix ? (info?.prefix || "") : "";
-      let path = subTokens(joinRoute(prefix, p.path), controller, methodName);
-      path = stripPrefixes(path, opts.prefixStrip);
-      out.push({ verb: p.verb.toUpperCase(), path, handler: d.name });
+      verbAttrs.push(p);
+    }
+    if (!verbAttrs.length) continue;                     // only [Http*] maps a method to a verb
+    const prefixes = opts.combineControllerPrefix && info?.prefixes.length ? info.prefixes : [""];
+    for (const p of verbAttrs) {
+      const suffixes = p.path ? [p.path] : (routeTemplates.length ? routeTemplates : [""]);
+      for (const prefix of prefixes) {
+        for (const suffix of suffixes) {
+          let path = subTokens(joinRoute(prefix, suffix), controller, methodName);
+          path = stripPrefixes(path, opts.prefixStrip);
+          out.push({ verb: p.verb.toUpperCase(), path, handler: d.name });
+        }
+      }
     }
   }
   return out;
@@ -124,16 +146,46 @@ function stripPrefixes(path, prefixes) {
 const isCs = (p) => /\.cs$/i.test(p || "");
 const isJsTs = (p) => /\.(m?[jt]sx?)$/i.test(p || "");
 
+/** Normalise a URL / route template into match segments (the deterministic half of callsHttp):
+ *  scheme+host stripped, query/hash dropped, duplicate slashes collapsed, and any parameter-ish
+ *  segment — `{id}` / `{id:int}` (ASP.NET, also a C# interpolation hole after quote-stripping),
+ *  `${expr}` / `{*}` (JS interpolation holes), `:id` (Express) — collapsed to a `*` wildcard.
+ *  Literal segments compare case-insensitively (ASP.NET routing is case-insensitive).
+ *  Exported for the matcher tests; pure. */
+export function normalizeHttpTemplate(url) {
+  let u = String(url || "").trim();
+  u = u.replace(/^[a-z][a-z0-9+.-]*:\/\/[^/]*/i, ""); // scheme://host[:port]
+  u = u.split(/[?#]/)[0];
+  u = normPath(u);
+  if (!u) return [];
+  return u.split("/").map((seg) => (/[{}]|^:/.test(seg) ? "*" : seg.toLowerCase()));
+}
+
+/** Deterministic template match: segment-by-segment prefix discipline (`*` matches any single
+ *  segment; the first literal mismatch is fatal), scored 2·shared/(|url|+|route|). 1.0 is an
+ *  exact-length match; an exact-prefix overlap scores below 1 and is admitted (or not) by the
+ *  match_threshold knob. No embeddings, no fuzzy scoring beyond this normalisation. */
+function matchScore(a, b) {
+  if (!a.length || !b.length) return 0;
+  const n = Math.min(a.length, b.length);
+  for (let i = 0; i < n; i += 1) {
+    if (a[i] !== b[i] && a[i] !== "*" && b[i] !== "*") return 0;
+  }
+  return (2 * n) / (a.length + b.length);
+}
+
 /**
  * Build the `serves` edges + `Route` individuals for a set of modules.
  * @param modules  the same module records buildEntities consumes (path, defines[], routes[]).
  * @param fnId     the id-builder buildEntities uses: (path, symbolName) → "fn:path#name".
  * @param opts     from interfaceOpts().
- * @returns { edges, routes } — edges are {subject,object,subjectLabel,objectLabel}; routes are
- *          Route individuals. Both deterministically ordered; empty when nothing matched.
+ * @returns { edges, routes, callsHttp } — edges/callsHttp are {subject,object,subjectLabel,
+ *          objectLabel}; routes are Route individuals. All deterministically ordered; empty when
+ *          nothing matched.
  */
 export function extractServes(modules, { fnId, opts }) {
   const routeById = new Map();     // route id → individual (deduped across modules/methods)
+  const routeMeta = [];            // route id → {verb, segs} for the callsHttp matcher below
   const edgeSet = new Set();       // dedupe subject|object
   const edges = [];
   for (const mod of modules || []) {
@@ -143,7 +195,7 @@ export function extractServes(modules, { fnId, opts }) {
     for (const r of routes) {
       const label = `${r.verb} ${r.path}`;
       const rid = `route:${label}`;
-      if (!routeById.has(rid))
+      if (!routeById.has(rid)) {
         routeById.set(rid, {
           id: rid, label, class: "Route", derived_from: [], mentions: [],
           attributes: [
@@ -151,6 +203,8 @@ export function extractServes(modules, { fnId, opts }) {
             { prop: "mgx:routePath", key: "path", value: r.path },
           ],
         });
+        routeMeta.push({ id: rid, label, verb: r.verb, segs: normalizeHttpTemplate(r.path) });
+      }
       const object = fnId(mod.path, r.handler);
       const key = `${rid}|${object}`;
       if (edgeSet.has(key)) continue;
@@ -158,8 +212,47 @@ export function extractServes(modules, { fnId, opts }) {
       edges.push({ subject: rid, object, subjectLabel: label, objectLabel: r.handler });
     }
   }
-  edges.sort((a, b) => (a.subject < b.subject ? -1 : a.subject > b.subject ? 1 : a.object < b.object ? -1 : a.object > b.object ? 1 : 0));
+  const byEdge = (a, b) => (a.subject < b.subject ? -1 : a.subject > b.subject ? 1 : a.object < b.object ? -1 : a.object > b.object ? 1 : 0);
+  edges.sort(byEdge);
   const routes = [...routeById.values()].sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+
+  // callsHttp (client→route) — the other half of the cross-service chain, PLAN_UNTYPED_INTERFACES
+  // follow-up #1. Client call sites come pre-captured from the extractors as an optional per-define
+  // `http_calls: [{verb, url}]` (fetch/axios/HttpClient first-argument URL literals). Each call is
+  // matched against the Route table just built: verbs must agree, templates match per matchScore
+  // above, and only the BEST-scoring route(s) at or above opts.matchThreshold link (ties all link —
+  // deterministic). A call matching nothing emits nothing; no orphan Route individuals are created,
+  // so callsHttp can only point at Routes that `serves` already justified.
+  const callsHttp = [];
+  const chSeen = new Set();
+  for (const mod of modules || []) {
+    for (const d of mod.defines || []) {
+      for (const c of d.http_calls || []) {
+        const verb = String(c.verb || "").toUpperCase();
+        const segs = normalizeHttpTemplate(c.url);
+        if (!segs.length) continue;
+        // No anchor, no edge: an all-wildcard template (`{base}{uri}/{id}`) would match ANY
+        // same-length route at 1.0 — at least one literal segment is required (house "no wrong edge").
+        if (!segs.some((s) => s !== "*")) continue;
+        let best = 0;
+        let hits = [];
+        for (const r of routeMeta) {
+          if (r.verb !== verb) continue;
+          const s = matchScore(segs, r.segs);
+          if (s < opts.matchThreshold || s < best) continue;
+          if (s > best) { best = s; hits = [r]; } else hits.push(r);
+        }
+        const subject = fnId(mod.path, d.name);
+        for (const r of hits) {
+          const key = `${subject}|${r.id}`;
+          if (chSeen.has(key)) continue;
+          chSeen.add(key);
+          callsHttp.push({ subject, object: r.id, subjectLabel: d.name, objectLabel: r.label });
+        }
+      }
+    }
+  }
+  callsHttp.sort(byEdge);
   // Vocabulary notes for the emitted tokens, built HERE (not in extract.mjs) so the un-typed-interface
   // props stay scoped to this gated feature module — the core schema drift guard documents the always
   // -on extract.mjs props; these opt-in props are self-documented inline until they earn a
@@ -167,5 +260,6 @@ export function extractServes(modules, { fnId, opts }) {
   const vocab = [];
   if (edges.length) vocab.push({ prop: "mgx:serves", predicate: "serves", note: "route-declaration→handler-symbol; the HTTP boundary a syntax-only AST misses (un-typed interface)" });
   if (routes.length) vocab.push({ prop: "mgx:httpVerb", note: "HTTP verb of a Route individual" }, { prop: "mgx:routePath", note: "normalised path template of a Route individual" });
-  return { edges, routes, vocab };
+  if (callsHttp.length) vocab.push({ prop: "mgx:callsHttp", predicate: "callsHttp", note: "client call-site→Route; HTTP URL literal matched to a route template (deterministic normalisation, match_threshold-gated)" });
+  return { edges, routes, vocab, callsHttp };
 }

package/src/jsts_tsc.mjs

@@ -66,6 +66,55 @@ function decoratorsOf(sf, node) {
   return (ds || []).map((d) => d.expression.getText(sf).replace(/\s+/g, " ").slice(0, 80));
 }
 
+// ---- HTTP-client call capture (un-typed interfaces: the callsHttp client→route half). ----
+// The URL literal at a client call site, per define — the base calls[] strips arguments, so the
+// route-matchable string must be captured here. Deterministic name gates, no resolution:
+//   fetch('/api/x' [, {method:'POST'}])         → verb from a literal `method:` property, else get
+//   <recv>.get|post|…('/api/x', …) where recv's text looks like an HTTP client (axios / http /
+//   client / api / request) — so Express-style registrations (router./app. receivers) and
+//   Map.get('key') never match.
+// The URL must be a string/template literal containing "/"; template interpolation holes become
+// `{*}` (collapsed to a wildcard segment by the matcher in interfaces.mjs). Emitted as an optional
+// `http_calls` field on the define — absent when empty, so modules without client calls are
+// byte-identical to before, and the DEFAULT graph ignores the field entirely (gating contract).
+const CLIENTISH = /axios|http|client|api|request/i;
+function urlLiteralText(sf, a) {
+  if (!a) return "";
+  if (ts.isStringLiteralLike(a)) return a.text; // 'x' / "x" / `x` (no holes)
+  if (ts.isTemplateExpression(a)) return a.head.text + a.templateSpans.map((s) => `{*}${s.literal.text}`).join("");
+  return "";
+}
+function httpCallsIn(sf, node) {
+  const out = [];
+  const seen = new Set();
+  const visit = (n) => {
+    if (ts.isCallExpression(n)) {
+      const t = n.expression;
+      let verb = "";
+      if ((ts.isIdentifier(t) && t.text === "fetch") || (ts.isPropertyAccessExpression(t) && t.name.text === "fetch")) {
+        verb = "get"; // fetch defaults to GET; a literal {method:'POST'} option overrides
+        const opt = n.arguments[1];
+        if (opt && ts.isObjectLiteralExpression(opt)) {
+          for (const p of opt.properties) {
+            if (ts.isPropertyAssignment(p) && p.name && p.name.getText(sf) === "method" && ts.isStringLiteralLike(p.initializer))
+              verb = p.initializer.text.toLowerCase();
+          }
+        }
+      } else if (ts.isPropertyAccessExpression(t) && ROUTE_VERBS.has(t.name.text.toLowerCase()) && CLIENTISH.test(t.expression.getText(sf))) {
+        verb = t.name.text.toLowerCase();
+      }
+      const url = verb ? urlLiteralText(sf, n.arguments[0]) : "";
+      if (ROUTE_VERBS.has(verb) && url.includes("/")) {
+        const key = `${verb} ${url}`;
+        if (!seen.has(key)) { seen.add(key); out.push({ verb, url: url.slice(0, 160) }); }
+      }
+    }
+    ts.forEachChild(n, visit);
+  };
+  ts.forEachChild(node, visit);
+  return out;
+}
+
 /** Collect callee names within a node body (coarse; unparsed call target). */
 function callsIn(sf, node) {
   const out = new Set();
@@ -129,12 +178,14 @@ export async function extractFile(absPath, root) {
   const isExportsRef = (e) => isModuleExports(e) || (ts.isIdentifier(e) && e.text === "exports");
 
   const addFn = (name, node, kind, extra = {}) => {
+    const http = httpCallsIn(sf, node);
     defines.push({
       name, kind, lineno: lineOf(sf, node), end_lineno: endLineOf(sf, node),
       decorators: decoratorsOf(sf, node),
       params: paramsText(sf, node), returns: returnText(sf, node),
       calls: callsIn(sf, node), doc: firstDocLine(sf, node),
       ...(visibilityOf(node) ? { visibility: visibilityOf(node) } : {}),
+      ...(http.length ? { http_calls: http } : {}),
       ...extra,
     });
   };