gitnexus 1.6.10-rc.21 → 1.6.10-rc.211

package/dist/core/group/bridge-db.js

@@ -1,12 +1,12 @@
 import fsp from 'node:fs/promises';
 import path from 'node:path';
-import { createHash, randomBytes } from 'node:crypto';
+import { createHash } from 'node:crypto';
 import lbug from '@ladybugdb/core';
 import { BRIDGE_SCHEMA_QUERIES, BRIDGE_SCHEMA_VERSION } from './bridge-schema.js';
 import { closeLbugConnection, openLbugConnection, } from '../lbug/lbug-config.js';
 import { dedupeContracts, dedupeCrossLinks } from './normalization.js';
 import { createLogger } from '../logger.js';
-import { retryRename } from '../../storage/fs-atomic.js';
+import { retryRename, writeFileAtomic } from '../../storage/fs-atomic.js';
 const bridgeLogger = createLogger('bridge-db', {
     debugEnvVar: 'GITNEXUS_DEBUG_BRIDGE',
 });
@@ -516,31 +516,7 @@ export async function closeBridgeDb(handle) {
 /*  writeBridgeMeta / readBridgeMeta                                  */
 /* ------------------------------------------------------------------ */
 export async function writeBridgeMeta(groupDir, meta) {
-    const target = path.join(groupDir, 'meta.json');
-    // Unpredictable suffix + O_EXCL via `'wx'` flag closes the symlink/
-    // pre-create attack window. The third argument `0o600` is the
-    // user-only mode mask — CodeQL's `js/insecure-temporary-file` query
-    // sources its verdict from the `mode` argument, NOT from `flags`:
-    // its `isSecureMode(mode)` predicate requires the low 6 bits to be
-    // zero (no group/world bits). Without an explicit mode the file is
-    // created with the process umask (typically 0o644 = group/world
-    // readable), which the query treats as the actual vulnerability.
-    // Both `'wx'` (runtime O_EXCL) AND `0o600` (CodeQL-credited mode)
-    // are needed: one closes the symlink race, the other closes the
-    // permissions exposure.
-    const tmp = `${target}.tmp.${randomBytes(8).toString('hex')}`;
-    const handle = await fsp.open(tmp, 'wx', 0o600);
-    try {
-        await handle.writeFile(JSON.stringify(meta, null, 2), 'utf-8');
-    }
-    finally {
-        await handle.close();
-    }
-    // Use retryRename for consistency with writeBridge's atomic swap — on
-    // Windows a concurrent reader can cause EBUSY/EPERM even on a tiny
-    // meta.json, and we don't want meta write to be less robust than the
-    // bridge.lbug swap it accompanies.
-    await retryRename(tmp, target);
+    await writeFileAtomic(path.join(groupDir, 'meta.json'), JSON.stringify(meta, null, 2));
 }
 export async function readBridgeMeta(groupDir) {
     try {
@@ -829,6 +805,8 @@ const LBUG_OPEN_RETRY_PATTERNS = [
     'could not set lock',
     'lock held by another process',
 ];
+// Cross-repo bridge RO open retry. Catalogued as entry 5 of the lbug-config
+// retry-budget registry; caps back-off so total wait ~3s.
 const LBUG_OPEN_RETRY_ATTEMPTS = 10;
 const LBUG_OPEN_RETRY_BASE_MS = 100;
 /** Cap individual back-off delays so the total wait is bounded (~3s). */

package/dist/core/group/cross-impact.d.ts

@@ -4,10 +4,30 @@
  */
 import type { BridgeHandle, CrossRepoImpact, GroupImpactResult } from './types.js';
 import type { GroupToolPort } from './service.js';
+import { compareCodeUnits } from '../../lib/utils.js';
 /** Cross-boundary hops beyond this value are clamped (multi-hop reserved for future work). */
 export declare const MAX_SUPPORTED_CROSS_DEPTH = 1;
 /** Default wall-clock budget for the Phase 1 `impact` leg when callers omit `timeoutMs`. */
 export declare const DEFAULT_LOCAL_IMPACT_TIMEOUT_MS = 30000;
+/**
+ * Cap on neighbour fan-outs attempted per group-impact request.
+ *
+ * The bound used to be the wall clock alone, which made the cutoff a function
+ * of machine load: an idle host traversed more crossings and `mergeRisk`
+ * escalated to CRITICAL at three, while a loaded host stopped at two and
+ * reported HIGH or lower — same graph, same arguments, different verdict
+ * (#2787). A count is deterministic, and the neighbour list carries a total
+ * order over the full crossing identity (confidence DESC, then repo, uid,
+ * contract), so the cap keeps the strongest crossings rather than an arbitrary
+ * prefix.
+ *
+ * 50 is borrowed from `MAX_CROSSINGS_TO_TRY` (cross-trace.ts) on cost, not on
+ * scope — that one caps ContractLinks per repo pair inside a trace, this one
+ * caps the total across all neighbour repos in one impact call, and group impact
+ * had no numeric cap at all before #2787. The wall clock stays as a hang
+ * backstop below; this is the bound that normally binds.
+ */
+export declare const MAX_NEIGHBOR_FANOUT = 50;
 export type BridgeNeighborRow = {
     neighborRepo: string;
     neighborUid: string;
@@ -117,3 +137,4 @@ export declare function runGroupImpact(deps: RunGroupImpactDeps, params: Record<
     error: string;
 }>;
 export { normalizeServicePrefix, fileMatchesServicePrefix } from './group-path-utils.js';
+export { compareCodeUnits };

package/dist/core/group/cross-impact.js

@@ -9,6 +9,7 @@ import { fileMatchesServicePrefix, normalizeServicePrefix, repoInSubgroup, } fro
 import { getGroupDir } from './storage.js';
 import { closeBridgeDb, getCachedBridgeReadOnly, queryBridge, readBridgeMeta, } from './bridge-db.js';
 import { BRIDGE_SCHEMA_VERSION } from './bridge-schema.js';
+import { compareCodeUnits } from '../../lib/utils.js';
 // High limit for the local phase of group impact so collectImpactSymbolUids
 // sees (nearly) all symbols. Bypasses the MCP-facing default of 100.
 const GROUP_LOCAL_PHASE_LIMIT = 10000;
@@ -16,6 +17,25 @@ const GROUP_LOCAL_PHASE_LIMIT = 10000;
 export const MAX_SUPPORTED_CROSS_DEPTH = 1;
 /** Default wall-clock budget for the Phase 1 `impact` leg when callers omit `timeoutMs`. */
 export const DEFAULT_LOCAL_IMPACT_TIMEOUT_MS = 30_000;
+/**
+ * Cap on neighbour fan-outs attempted per group-impact request.
+ *
+ * The bound used to be the wall clock alone, which made the cutoff a function
+ * of machine load: an idle host traversed more crossings and `mergeRisk`
+ * escalated to CRITICAL at three, while a loaded host stopped at two and
+ * reported HIGH or lower — same graph, same arguments, different verdict
+ * (#2787). A count is deterministic, and the neighbour list carries a total
+ * order over the full crossing identity (confidence DESC, then repo, uid,
+ * contract), so the cap keeps the strongest crossings rather than an arbitrary
+ * prefix.
+ *
+ * 50 is borrowed from `MAX_CROSSINGS_TO_TRY` (cross-trace.ts) on cost, not on
+ * scope — that one caps ContractLinks per repo pair inside a trace, this one
+ * caps the total across all neighbour repos in one impact call, and group impact
+ * had no numeric cap at all before #2787. The wall clock stays as a hang
+ * backstop below; this is the bound that normally binds.
+ */
+export const MAX_NEIGHBOR_FANOUT = 50;
 const CY_NEIGHBORS_UPSTREAM = `
 MATCH (consumer:Contract)-[l:ContractLink]->(provider:Contract)
 WHERE provider.repo = $localRepo
@@ -256,17 +276,49 @@ function extractProcessNames(impact) {
 // No behavior change — `'UNKNOWN'` was already handled correctly at the
 // `(localRisk === 'LOW' || localRisk === 'UNKNOWN')` branch below.
 export function mergeRisk(localRisk, cross) {
-    const highConf = cross.some((c) => c.contract.confidence >= 0.85);
+    const traversed = cross.filter((c) => c.fanout_status !== 'not_attempted');
+    const highConf = traversed.some((c) => c.contract.confidence >= 0.85);
     if (localRisk === 'CRITICAL')
         return 'CRITICAL';
-    if (cross.length >= 3)
+    if (traversed.length >= 3)
         return 'CRITICAL';
     if (highConf)
         return 'HIGH';
-    if (cross.length > 0 && (localRisk === 'LOW' || localRisk === 'UNKNOWN'))
+    if (traversed.length > 0 && (localRisk === 'LOW' || localRisk === 'UNKNOWN'))
         return 'MEDIUM';
     return localRisk;
 }
+/**
+ * Build the truncation fields every `runGroupImpact` return path shares.
+ *
+ * `riskEpistemic` must follow `truncated` mechanically: it is the marker that
+ * tells a caller the `risk` value is a floor rather than a verdict, and
+ * `mergeRisk` can only under-report once a crossing is dropped. Attaching it at
+ * each return let two of the four paths set `truncated` without it, so a
+ * truncated result read as complete — deriving it in one place is what keeps
+ * the invariant from drifting again (#2787).
+ */
+function truncationFields(truncated, 
+// Only read on the truncated branch, so the not-truncated call sites omit it
+// rather than passing a reason that is thrown away.
+reasonIfTruncated = 'partial') {
+    if (!truncated)
+        return { truncated: false };
+    return { truncated: true, truncationReason: reasonIfTruncated, riskEpistemic: 'lower-bound' };
+}
+function addCrossImpact(cross, candidate) {
+    const sameBoundary = (entry) => entry.repo_path === candidate.repo_path && entry.contract.id === candidate.contract.id;
+    if (candidate.fanout_status === 'not_attempted') {
+        if (cross.some(sameBoundary))
+            return;
+    }
+    else {
+        const boundaryOnlyIndex = cross.findIndex((entry) => sameBoundary(entry) && entry.fanout_status === 'not_attempted');
+        if (boundaryOnlyIndex >= 0)
+            cross.splice(boundaryOnlyIndex, 1);
+    }
+    cross.push(candidate);
+}
 export async function ensureBridgeReady(groupDir) {
     const meta = await readBridgeMeta(groupDir);
     if (meta.version > 0 && meta.version !== BRIDGE_SCHEMA_VERSION) {
@@ -337,7 +389,15 @@ export async function resolveBridgeNeighbors(handle, opts) {
         if (n)
             neighbors.push(n);
     }
-    neighbors.sort((a, b) => b.confidence - a.confidence);
+    // Sort on the FULL crossing identity — the same triple the fan-out dedups on
+    // below (`repo\0uid\0contractId`). Two links that share (confidence, repo,
+    // uid) but differ in contract both survive that dedup, so leaving contractId
+    // out of the comparator makes them compare 0 and fall back to raw bridge row
+    // order, which is what decides who lands past MAX_NEIGHBOR_FANOUT (#2787).
+    neighbors.sort((a, b) => b.confidence - a.confidence ||
+        compareCodeUnits(a.neighborRepo, b.neighborRepo) ||
+        compareCodeUnits(a.neighborUid, b.neighborUid) ||
+        compareCodeUnits(a.contractId, b.contractId));
     return neighbors;
 }
 export async function runGroupImpact(deps, params) {
@@ -376,7 +436,7 @@ export async function runGroupImpact(deps, params) {
             group: name,
             cross: [],
             outOfScope: [],
-            truncated: true,
+            ...truncationFields(true, 'timeout'),
             truncatedRepos: [],
             summary: {
                 direct: 0,
@@ -386,7 +446,6 @@ export async function runGroupImpact(deps, params) {
             },
             risk: 'UNKNOWN',
             timeoutMs,
-            truncationReason: 'timeout',
             crossDepthWarning,
         };
     }
@@ -408,7 +467,7 @@ export async function runGroupImpact(deps, params) {
                 group: name,
                 cross: [],
                 outOfScope: [],
-                truncated: false,
+                ...truncationFields(false),
                 truncatedRepos: [],
                 summary: {
                     direct: 0,
@@ -430,7 +489,7 @@ export async function runGroupImpact(deps, params) {
             group: name,
             cross: [],
             outOfScope: [],
-            truncated: Boolean(local.partial),
+            ...truncationFields(Boolean(local.partial), 'partial'),
             truncatedRepos: [],
             summary: {
                 direct: s.direct ?? 0,
@@ -440,7 +499,6 @@ export async function runGroupImpact(deps, params) {
             },
             risk: String(local.risk ?? 'LOW'),
             timeoutMs,
-            truncationReason: local.partial ? 'partial' : undefined,
             crossDepthWarning,
         };
     }
@@ -451,6 +509,10 @@ export async function runGroupImpact(deps, params) {
     const cross = [];
     const outOfScope = [];
     const truncatedRepos = [];
+    /** Real `impactByUid` fan-outs issued — what MAX_NEIGHBOR_FANOUT bounds. */
+    let attemptedFanouts = 0;
+    /** True when the wall-clock backstop, not the count cap, cut the fan-out. */
+    let fanoutTimedOut = false;
     try {
         const neighbors = await resolveBridgeNeighbors(handle, {
             localRepo: repoPath,
@@ -459,7 +521,10 @@ export async function runGroupImpact(deps, params) {
         });
         const seen = new Set();
         for (const n of neighbors) {
-            if (servicePrefix && !fileMatchesServicePrefix(n.neighborFilePath, servicePrefix)) {
+            const manifestOnly = n.neighborUid.startsWith('manifest::');
+            if (servicePrefix &&
+                !manifestOnly &&
+                !fileMatchesServicePrefix(n.neighborFilePath, servicePrefix)) {
                 continue;
             }
             if (!repoInSubgroup(n.neighborRepo, subgroup)) {
@@ -475,8 +540,18 @@ export async function runGroupImpact(deps, params) {
             if (seen.has(key))
                 continue;
             seen.add(key);
-            const remainingMs = deadline - Date.now();
-            if (remainingMs <= 0) {
+            // Deterministic bound first: the count decides the cutoff on every host.
+            // Manifest-only crossings are exempt because they cost no `impactByUid`
+            // and dropping them regresses #2784.
+            if (!manifestOnly && attemptedFanouts >= MAX_NEIGHBOR_FANOUT) {
+                truncatedRepos.push(n.neighborRepo);
+                continue;
+            }
+            // Wall clock second, as a hang backstop only. It is load-dependent by
+            // construction, so when it is what fired the response must say `timeout`,
+            // not the generic `partial` it used to report.
+            if (!manifestOnly && deadline - Date.now() <= 0) {
+                fanoutTimedOut = true;
                 truncatedRepos.push(n.neighborRepo);
                 continue;
             }
@@ -491,11 +566,40 @@ export async function runGroupImpact(deps, params) {
                 truncatedRepos.push(n.neighborRepo);
                 continue;
             }
+            // A manifest link can prove the repository boundary even when its far
+            // endpoint has no graph symbol of its own (for example, a string-based
+            // RPC dispatch). Those endpoints deliberately use a deterministic
+            // `manifest::...` UID. Calling impactByUid with that synthetic value can
+            // never succeed because it is not a node in the verified neighbor
+            // repository; dropping the crossing here made `group sync` report the
+            // manifest link while `group impact` silently returned cross=0 (#2722).
+            //
+            // Preserve the proven crossing with an empty local fan-out. Real UIDs
+            // still take the normal impactByUid path below, where failures remain
+            // truncations rather than false successful traversals.
+            if (manifestOnly) {
+                addCrossImpact(cross, {
+                    repo: regName,
+                    repo_path: n.neighborRepo,
+                    contract: {
+                        id: n.contractId,
+                        type: n.contractType,
+                        match_type: 'manifest',
+                        confidence: n.confidence,
+                    },
+                    by_depth: {},
+                    affected_processes: [],
+                    fanout_status: 'not_attempted',
+                });
+                continue;
+            }
+            const remainingMs = deadline - Date.now();
             // Phase-2 hardening: race each impactByUid against a per-call
             // timeout derived from the remaining budget. Without this wrap a
             // single hung neighbor would pin the request past the clamped
             // timeout, which Codex's adversarial review on PR #1331 flagged
             // as the still-open half of CodeQL #184 / js/resource-exhaustion.
+            attemptedFanouts += 1;
             const { value: fan, timedOut: neighborTimedOut } = await safeNeighborImpact(deps.port, neighborHandle.id, n.neighborUid, direction, {
                 maxDepth,
                 relationTypes: relationTypes ?? [],
@@ -503,10 +607,12 @@ export async function runGroupImpact(deps, params) {
                 includeTests,
             }, remainingMs);
             if (neighborTimedOut || fan == null) {
+                if (neighborTimedOut)
+                    fanoutTimedOut = true;
                 truncatedRepos.push(n.neighborRepo);
                 continue;
             }
-            cross.push({
+            addCrossImpact(cross, {
                 repo: regName,
                 repo_path: n.neighborRepo,
                 contract: {
@@ -532,7 +638,12 @@ export async function runGroupImpact(deps, params) {
         group: name,
         cross,
         outOfScope,
-        truncated,
+        // The risk VALUE is never clamped down. `mergeRisk` is monotone increasing
+        // in the traversed-crossing count, so truncation can only under-report —
+        // and under-reporting a blast radius is the unsafe direction (an agent told
+        // LOW proceeds; told CRITICAL it stops). Marking the floor keeps the
+        // warning intact while making the incompleteness legible.
+        ...truncationFields(truncated, fanoutTimedOut ? 'timeout' : 'partial'),
         truncatedRepos: [...new Set(truncatedRepos)],
         summary: {
             direct: localSum.direct ?? 0,
@@ -542,9 +653,11 @@ export async function runGroupImpact(deps, params) {
         },
         risk: mergeRisk(localRisk, cross),
         timeoutMs,
-        truncationReason: truncated ? 'partial' : undefined,
         crossDepthWarning,
     };
     return result;
 }
 export { normalizeServicePrefix, fileMatchesServicePrefix } from './group-path-utils.js';
+// Re-exported, not redefined: the single definition lives in lib/utils.ts, but
+// this module's own surface is what the #2787 regression test imports it from.
+export { compareCodeUnits };

package/dist/core/group/cross-trace.js

@@ -25,6 +25,7 @@
 import { GroupNotFoundError, loadGroupConfig } from './config-parser.js';
 import { getGroupDir } from './storage.js';
 import { ensureBridgeReady, MAX_SUPPORTED_CROSS_DEPTH } from './cross-impact.js';
+import { compareCodeUnits } from '../../lib/utils.js';
 import { closeBridgeDb, queryBridge } from './bridge-db.js';
 /**
  * Centralized degraded-state messages so wording stays consistent and
@@ -115,7 +116,7 @@ RETURN consumer.symbolUid AS consumerUid,
        l.confidence AS confidence,
        l.contractId AS contractId,
        consumer.type AS contractType
-ORDER BY l.confidence DESC
+ORDER BY l.confidence DESC, contractId, consumerUid, providerUid
 LIMIT ${MAX_CROSSINGS_TO_TRY + 1}
 `;
 // Destination trace: every ContractLink leaving a consumer repo, to ANY provider
@@ -136,7 +137,7 @@ RETURN consumer.symbolUid AS consumerUid,
        l.confidence AS confidence,
        l.contractId AS contractId,
        consumer.type AS contractType
-ORDER BY l.confidence DESC
+ORDER BY l.confidence DESC, contractId, consumerUid, providerUid
 LIMIT ${MAX_CROSSINGS_TO_TRY + 1}
 `;
 function rowToCrossing(r) {
@@ -164,6 +165,28 @@ function rowToCrossing(r) {
         contractType: String(r.contractType ?? r[7] ?? 'custom'),
     };
 }
+/**
+ * Sort a crossing list on the full crossing identity, then apply
+ * `MAX_CROSSINGS_TO_TRY`.
+ *
+ * Both bridge queries already order by confidence DESC; this re-sorts
+ * defensively so the cap keeps the strongest candidates even if a tuple-mode
+ * driver reorders rows. The comparator mirrors BOTH queries' `ORDER BY`
+ * key-for-key — a shorter comparator reproduces less than the order it is
+ * defending, leaving ties on raw row order (#2787) — so it lives in one place
+ * rather than being hand-synced across the two callers and two Cypher clauses.
+ */
+function capCrossings(all) {
+    all.sort((a, b) => b.confidence - a.confidence ||
+        compareCodeUnits(a.contractId, b.contractId) ||
+        compareCodeUnits(a.consumerUid, b.consumerUid) ||
+        compareCodeUnits(a.providerUid, b.providerUid));
+    const truncated = all.length > MAX_CROSSINGS_TO_TRY;
+    return {
+        crossings: truncated ? all.slice(0, MAX_CROSSINGS_TO_TRY) : all,
+        truncated,
+    };
+}
 async function listCrossingsBetween(handle, fromRepo, toRepo) {
     const rows = await queryBridge(handle, CY_CROSSINGS_BETWEEN, {
         fromRepo,
@@ -175,14 +198,7 @@ async function listCrossingsBetween(handle, fromRepo, toRepo) {
         if (c)
             all.push(c);
     }
-    // The query already orders by confidence DESC; re-sort defensively so the cap
-    // keeps the strongest candidates even if a tuple-mode driver reorders rows.
-    all.sort((a, b) => b.confidence - a.confidence);
-    const truncated = all.length > MAX_CROSSINGS_TO_TRY;
-    return {
-        crossings: truncated ? all.slice(0, MAX_CROSSINGS_TO_TRY) : all,
-        truncated,
-    };
+    return capCrossings(all);
 }
 function destRowToCrossing(r) {
     const consumerUid = String(r.consumerUid ?? r[0] ?? '');
@@ -212,12 +228,7 @@ async function listCrossingsFrom(handle, fromRepo) {
         if (c)
             all.push(c);
     }
-    all.sort((a, b) => b.confidence - a.confidence);
-    const truncated = all.length > MAX_CROSSINGS_TO_TRY;
-    return {
-        crossings: truncated ? all.slice(0, MAX_CROSSINGS_TO_TRY) : all,
-        truncated,
-    };
+    return capCrossings(all);
 }
 /**
  * Resolve a symbol query across every member repo. Exactly one `ok` match and

package/dist/core/group/extractors/http-patterns/java.js

@@ -1,11 +1,11 @@
 import Java from 'tree-sitter-java';
 import { compilePatterns, runCompiledPatterns, unquoteLiteral, } from '../tree-sitter-scanner.js';
-import { METHOD_ANNOTATION_TO_HTTP, isRouteMemberKey, findEnclosingClass, joinPath, } from '../../../ingestion/route-extractors/spring-shared.js';
+import { springAnnotationHttpMethods, intersectSpringHttpMethods, isRouteMemberKey, findEnclosingClass, joinPath, } from '../../../ingestion/route-extractors/spring-shared.js';
 import { REST_TEMPLATE_TO_HTTP, WEB_CLIENT_SHORT_TO_HTTP, WEB_CLIENT_LONG_VERB_RE, EXCHANGE_ANNOTATION_TO_HTTP, parseRequestLine, pushPrefix, scanSpringInheritanceProject, OPENFEIGN_FRAMEWORK, HTTP_INTERFACE_FRAMEWORK, FEIGN_CONFIDENCE, REQUEST_LINE_CONFIDENCE, EXCHANGE_CONFIDENCE, } from './spring-consumer-shared.js';
 import { extractStaticPathExpression, inferOkHttpMethod, inferHttpClientMethod, okHttpUrlRootsAtBuilder, httpClientUriRootsAtNewBuilder, httpClientChainHasUriCall, } from './java-static-path.js';
 /**
  * Java HTTP plugin. Handles:
- *   - Spring `@RequestMapping` class prefixes + `@(Get|Post|...)Mapping` method annotations
+ *   - Spring `@RequestMapping` class prefixes + shortcut/`@RequestMapping` method annotations
  *   - Spring `RestTemplate.getForObject/...`, `exchange(...)`
  *   - Spring `WebClient.method(HttpMethod.X, ...)`, `WebClient.get().uri(...)`
  *   - OkHttp `new Request.Builder().url("...")`
@@ -345,6 +345,33 @@ function getNodeName(node) {
 function simpleName(text) {
     return text.split('.').pop() ?? text;
 }
+function declarationAnnotations(node) {
+    const modifiers = node.namedChildren.find((child) => child.type === 'modifiers');
+    if (!modifiers)
+        return [];
+    return modifiers.namedChildren.filter((child) => child.type === 'annotation' || child.type === 'marker_annotation');
+}
+function annotationHasRouteMember(annotation) {
+    const args = annotation.childForFieldName('arguments');
+    if (!args)
+        return false;
+    for (const child of args.namedChildren) {
+        if (child.type !== 'element_value_pair')
+            return true;
+        const key = child.childForFieldName('key');
+        if (isRouteMemberKey(key ?? undefined))
+            return true;
+    }
+    return false;
+}
+function typeRequestMethods(typeNode) {
+    const mappings = declarationAnnotations(typeNode).filter((annotation) => simpleName(annotation.childForFieldName('name')?.text ?? '') === 'RequestMapping');
+    if (mappings.length === 0)
+        return ['*'];
+    if (mappings.length !== 1)
+        return [];
+    return springAnnotationHttpMethods('RequestMapping', mappings[0].text);
+}
 function hasAnnotation(node, names) {
     const modifiers = node.namedChildren.find((child) => child.type === 'modifiers');
     if (!modifiers)
@@ -385,6 +412,7 @@ function scanRouteAnnotations(tree) {
     const methodRoutes = [];
     const requestLines = [];
     const exchangeRoutes = [];
+    const httpMethodsByAnnotationId = new Map();
     // Interface `@RequestMapping` prefixes rank below `@FeignClient(path)`;
     // collect them and apply only after the FeignClient pass below.
     const interfaceRequestMappingPrefixes = [];
@@ -405,19 +433,30 @@ function scanRouteAnnotations(tree) {
         const ann = simpleName(annNode.text);
         const keyNode = captures.key; // undefined for the positional shape
         if (node.type === 'method_declaration') {
-            // Method-level: a Spring `@(Get|...)Mapping` route, or native `@RequestLine`.
-            const httpMethod = METHOD_ANNOTATION_TO_HTTP[ann];
-            if (httpMethod) {
+            // Method-level: a Spring shortcut/`@RequestMapping` route, or native `@RequestLine`.
+            const annotationNode = annNode.parent;
+            if (!annotationNode)
+                continue;
+            let httpMethods = httpMethodsByAnnotationId.get(annotationNode.id);
+            if (!httpMethods) {
+                httpMethods = springAnnotationHttpMethods(ann, annotationNode.text);
+                httpMethodsByAnnotationId.set(annotationNode.id, httpMethods);
+            }
+            if (httpMethods.length > 0) {
+                const feignHttpMethod = httpMethods.length === 1 ? (httpMethods[0] === '*' ? 'GET' : httpMethods[0]) : null;
                 if (!isRouteMemberKey(keyNode))
                     continue;
                 const rawPath = unquoteLiteral(valueNode.text);
                 if (rawPath !== null) {
-                    methodRoutes.push({
-                        methodNode: node,
-                        methodName: captures.member?.text ?? null,
-                        httpMethod,
-                        rawPath,
-                    });
+                    for (const httpMethod of httpMethods) {
+                        methodRoutes.push({
+                            methodNode: node,
+                            methodName: captures.member?.text ?? null,
+                            httpMethod,
+                            rawPath,
+                            feignHttpMethod,
+                        });
+                    }
                 }
             }
             else if (ann === 'RequestLine') {
@@ -483,6 +522,42 @@ function scanRouteAnnotations(tree) {
                 pushPrefix(httpExchangePrefixByTypeId, node.id, prefix);
         }
     }
+    const classHttpMethodsByTypeId = new Map();
+    for (const match of runCompiledPatterns(SPRING_TYPE_DECLARATION_PATTERNS, tree)) {
+        const typeNode = match.captures.type;
+        if (!typeNode)
+            continue;
+        const classMethods = typeRequestMethods(typeNode);
+        classHttpMethodsByTypeId.set(typeNode.id, classMethods);
+        for (const methodNode of collectDirectMethods(typeNode)) {
+            for (const annotationNode of declarationAnnotations(methodNode)) {
+                if (annotationHasRouteMember(annotationNode))
+                    continue;
+                const ann = simpleName(annotationNode.childForFieldName('name')?.text ?? '');
+                const httpMethods = springAnnotationHttpMethods(ann, annotationNode.text);
+                if (httpMethods.length === 0)
+                    continue;
+                const feignHttpMethod = httpMethods.length === 1 ? (httpMethods[0] === '*' ? 'GET' : httpMethods[0]) : null;
+                for (const httpMethod of httpMethods) {
+                    methodRoutes.push({
+                        methodNode,
+                        methodName: getNodeName(methodNode),
+                        httpMethod,
+                        rawPath: '',
+                        feignHttpMethod,
+                    });
+                }
+            }
+        }
+    }
+    const constrainedMethodRoutes = methodRoutes.flatMap((route) => {
+        const typeNode = findEnclosingInterface(route.methodNode) ?? findEnclosingClass(route.methodNode);
+        const classMethods = typeNode ? (classHttpMethodsByTypeId.get(typeNode.id) ?? ['*']) : ['*'];
+        return intersectSpringHttpMethods(classMethods, [route.httpMethod]).map((httpMethod) => ({
+            ...route,
+            httpMethod,
+        }));
+    });
     // `@RequestMapping` on a Feign interface is the fallback prefix, but only when
     // the interface has no `@FeignClient(path)` of its own (path wins).
     for (const { id, prefix } of interfaceRequestMappingPrefixes) {
@@ -493,7 +568,7 @@ function scanRouteAnnotations(tree) {
         prefixByTypeId,
         feignPrefixByInterfaceId,
         httpExchangePrefixByTypeId,
-        methodRoutes,
+        methodRoutes: constrainedMethodRoutes,
         requestLines,
         exchangeRoutes,
     };
@@ -600,7 +675,7 @@ export const JAVA_HTTP_PLUGIN = {
         const out = [];
         // ─── Spring providers + OpenFeign consumers (one query pass) ────
         // `scanRouteAnnotations` resolves every route-defining annotation —
-        // class/interface prefixes, method `@(Get|...)Mapping`s and native
+        // class/interface prefixes, method shortcut/`@RequestMapping`s and native
         // `@RequestLine`s — from a single `matches()` pass over the tree.
         const { prefixByTypeId, feignPrefixByInterfaceId, httpExchangePrefixByTypeId, methodRoutes, requestLines, exchangeRoutes, } = scanRouteAnnotations(tree);
         // A `@(Get|...)Mapping` inside a `@FeignClient` interface is an OpenFeign
@@ -611,12 +686,14 @@ export const JAVA_HTTP_PLUGIN = {
         for (const route of methodRoutes) {
             const enclosingInterface = findEnclosingInterface(route.methodNode);
             if (enclosingInterface && hasAnnotation(enclosingInterface, 'FeignClient')) {
+                if (!route.feignHttpMethod)
+                    continue;
                 const prefixes = feignPrefixByInterfaceId.get(enclosingInterface.id) ?? [''];
                 for (const prefix of prefixes) {
                     out.push({
                         role: 'consumer',
                         framework: OPENFEIGN_FRAMEWORK,
-                        method: route.httpMethod,
+                        method: route.feignHttpMethod,
                         path: joinPath(prefix, route.rawPath),
                         name: route.methodName,
                         line: route.methodNode.startPosition.row + 1,

package/dist/core/group/extractors/http-patterns/node.js

@@ -1,6 +1,7 @@
 import JavaScript from 'tree-sitter-javascript';
 import TypeScript from 'tree-sitter-typescript';
 import { compilePatterns, runCompiledPatterns, unquoteLiteral, } from '../tree-sitter-scanner.js';
+import { DATA_ROUTE_TABLE_SOURCE, scanDataRouteTables, } from '../../../ingestion/route-extractors/data-route-table.js';
 /**
  * Node.js / TypeScript HTTP plugin family. Handles:
  *   - NestJS `@Controller('prefix')` classes with `@Get(':id')` methods
@@ -530,6 +531,24 @@ function scanBundle(bundle, tree) {
             confidence: 0.7,
         });
     }
+    for (const route of scanDataRouteTables(tree)) {
+        const imported = route.handlerLocalName === undefined ? undefined : importMap.get(route.handlerLocalName);
+        out.push({
+            role: 'provider',
+            framework: DATA_ROUTE_TABLE_SOURCE,
+            method: route.method,
+            path: route.path,
+            // A source-only scan can prove a bare local/imported binding. Member
+            // ownership needs the semantic model, so leave it unattributed here;
+            // the graph-backed path consumes the exact handlerSymbolId later.
+            name: imported?.name ?? (route.handlerLocalName === undefined ? null : route.handlerName),
+            ...(imported === undefined ? {} : { handlerImport: imported }),
+            strictHandlerResolution: true,
+            ...(route.handlerLocalName === undefined ? { unresolvedHandler: true } : {}),
+            line: route.line,
+            confidence: 0.8,
+        });
+    }
     return out;
 }
 export const JAVASCRIPT_HTTP_PLUGIN = {

package/dist/core/group/extractors/http-patterns/types.d.ts

@@ -56,6 +56,14 @@ export interface HttpDetection {
         name: string;
         module: string;
     };
+    /** Resolve only from the registration file or exact import target; never guess repo-wide. */
+    strictHandlerResolution?: boolean;
+    /**
+     * The plugin saw a provider handler designator but could not prove its owner.
+     * Prevents the orchestrator from treating it as an anonymous inline handler
+     * and attributing it to the containing registrar function.
+     */
+    unresolvedHandler?: boolean;
     /** Confidence in (0, 1]. Source-scan plugins typically use 0.7–0.8. */
     confidence: number;
 }