gitnexus 1.6.10-rc.21 → 1.6.10-rc.211

package/dist/core/ingestion/languages/javascript/index.js

@@ -34,11 +34,60 @@
  *      resolved.
  *   3. **Dynamic require** — `require(computedPath)` is skipped (non-literal
  *      argument — cannot statically resolve the target).
- *   4. **`module.exports` / `exports.X`** — CJS export forms are not yet
- *      modeled as re-exports. The finalize algorithm treats the exporting
- *      module as a namespace; importers that do `const X = require('./m')`
- *      bind the module namespace, and member-call resolution walks the
- *      class graph from there.
+ *   4. **CommonJS `require()` in TypeScript** — `require()` decomposition is a
+ *      JavaScript-emitter concern, so a `.ts` file's `const m = require('./m')`
+ *      is not decomposed into an import. The EXPORT side of a `.ts` CommonJS
+ *      module is now declared (shared with the JS emitter), but an importer
+ *      written in TypeScript still cannot resolve through it.
+ *   5. **`.cjs` module-level `this`** — the CommonJS/ESM gate consults the file
+ *      extension where it can, but `provider.labelOverride` receives no file
+ *      path, so a `.cjs` file whose only export is a module-level `this.X = fn`
+ *      is not labelled. It now emits nothing rather than an ownerless `Method`.
+ *   6. **Calling a renamed default-export binding** — `module.exports = fn` IS
+ *      indexed (#2723, named after the file), but resolving a CALL through a
+ *      renamed local binding (`const renamed = require('./mod'); renamed()`)
+ *      needs the finalize layer to treat a called namespace binding as the
+ *      target module's default export. `const mod = require('./mod'); mod()`
+ *      happens to resolve because the names coincide.
+ *   7. **Anonymous ESM default** — `export default function () {}` (no name)
+ *      is not indexed either. Same class as the CJS default above, different
+ *      construct; not addressed by #2723.
+ *
+ * ## CommonJS export forms (#2723)
+ *
+ * Each of these declares its name in the module scope, so importers resolve to
+ * it by name — `const { foo } = require('./m')` matches directly and a
+ * namespace `m.foo()` walks the module's defs:
+ *
+ *   - `exports.foo = function () {}` / `module.exports.foo = (a) => a`, in
+ *     every value form (function, async, arrow, async arrow, generator).
+ *   - `const e = exports; e.foo = fn` — an alias bound at module scope. The
+ *     receiver cannot be pinned in a query, so the member-assignment rules
+ *     match any identifier receiver and the emitters prune anything that is
+ *     not the exports object.
+ *   - `this.foo = fn` at MODULE level of a CommonJS file, where `this` is
+ *     `module.exports`. Gated on the file being CommonJS — in ESM top-level
+ *     `this` is undefined and the same line exports nothing.
+ *   - `exports.foo = lib.imported` / `exports.foo = importedName` — forwarded
+ *     as a re-export (`reexport-alias`), so callers reach the ORIGINAL
+ *     definition. A plain import binding would not do: it is private to its
+ *     module, exactly as in ESM.
+ *   - `module.exports = fn` — the whole module is the callable, so it is named
+ *     after the file (`index.js` takes its parent directory). A named function
+ *     expression keeps its own name. `exports = fn` is NOT indexed: rebinding
+ *     `exports` exports nothing in CommonJS, it only breaks the alias.
+ *
+ * Two deliberate non-cases. `exports.foo = localFn`, where the value is a
+ * locally declared function, needs nothing — the module scope already binds
+ * `localFn` and importers already resolve through it. And a CJS export whose
+ * name the module ALSO declares lexically is suppressed rather than declared
+ * twice: two declarations of one name are ambiguous, and the resolver would
+ * drop the intra-module edge entirely.
+ *
+ * Callable members assigned through a receiver are Methods with an owner edge
+ * rather than free functions: `Foo.prototype.bar = fn` and `this.bar = fn`
+ * inside a constructor. Ownership resolves to what the file declares, so an
+ * owner it cannot see (`External.prototype.x = fn`) claims no edge.
  */
 export { emitJsScopeCaptures } from './captures.js';
 export { interpretJsImport, interpretJsTypeBinding } from './interpret.js';

package/dist/core/ingestion/languages/javascript/query.d.ts

@@ -46,6 +46,7 @@
  * tree-sitter init cost per file.
  */
 import Parser from 'tree-sitter';
+export declare const JAVASCRIPT_SCOPE_QUERY: string;
 export declare function getJsParser(filePath?: string): Parser;
 export declare function getJsScopeQuery(filePath?: string): Parser.Query;
 /** Validate that a cached Tree was produced by the JS grammar. */

package/dist/core/ingestion/languages/javascript/query.js

@@ -53,18 +53,40 @@ const JS_GRAMMAR = JS;
 function isJsxFile(filePath) {
     return filePath.endsWith('.jsx');
 }
-const JAVASCRIPT_SCOPE_QUERY = `
+export const JAVASCRIPT_SCOPE_QUERY = `
 ;; Scopes — module / class-likes / function-likes
 (program) @scope.module
 
 (class_declaration) @scope.class
 (class) @scope.class
 
-(function_declaration) @scope.function
-(generator_function_declaration) @scope.function
-(function_expression) @scope.function
+;; \`@receiver-owner.this\` — see the matching block in typescript/query.ts
+;; (#2701). Every function form except \`arrow_function\` binds its own \`this\`.
+(function_declaration) @scope.function @receiver-owner.this
+(generator_function_declaration) @scope.function @receiver-owner.this
+(function_expression) @scope.function @receiver-owner.this
+;; \`function*(){}\` as an EXPRESSION. Absent from this list before #2701, so it
+;; was not a scope at all and \`this\` inside one read as the enclosing method's.
+(generator_function) @scope.function @receiver-owner.this
 (arrow_function) @scope.function
-(method_definition) @scope.function
+(method_definition) @scope.function @receiver-owner.this
+
+;; Object literals get their own scope boundary -- see the matching
+;; comment in typescript/query.ts (#2545/#2551). Prevents a
+;; method_definition/property-arrow's auto-hoist from leaking its name
+;; past the literal into the enclosing scope, and (unlike Block) keeps
+;; sibling properties from seeing each other as bare identifiers.
+(object) @scope.object
+
+;; Statement blocks are BINDING scopes (#2699). ECMAScript gives every block its
+;; own environment record, so \`let\`/\`const\`/\`class\`/\`function\` declared in
+;; sibling blocks of one function are DIFFERENT bindings — without this the
+;; resolver sees both as function-level and a call in one branch resolves to
+;; both. \`tsBindingScopeFor\` already implements the other half of the rule:
+;; \`var\` hoists past blocks to the enclosing Function/Module, \`let\`/\`const\`
+;; take the innermost scope, which is now the block.
+(statement_block) @scope.block
+
 
 ;; Declarations — classes
 (class_declaration
@@ -78,6 +100,15 @@ const JAVASCRIPT_SCOPE_QUERY = `
 (field_definition
   property: (property_identifier) @declaration.name) @declaration.property
 
+;; Object-literal keys of a NAMED object (A1/A5) — the scope-resolution half of
+;; the same rule in TYPESCRIPT/JAVASCRIPT_QUERIES. The parse query mints the
+;; Property NODE; this mints the DEF the resolver can point a read/write at.
+(variable_declarator
+  name: (identifier)
+  value: (object
+    (pair
+      key: (property_identifier) @declaration.name) @declaration.property))
+
 ;; Declarations — free functions
 (function_declaration
   name: (identifier) @declaration.name) @declaration.function
@@ -123,6 +154,67 @@ const JAVASCRIPT_SCOPE_QUERY = `
     name: (identifier) @declaration.name
     value: (function_expression) @declaration.function))
 
+;; CJS property-assignment exports (#2723): \`exports.foo = function () {}\`,
+;; \`module.exports.foo = (a) => a\`. The graph node for these comes from
+;; TYPESCRIPT/JAVASCRIPT_QUERIES; this block is the other half — without a
+;; scope-resolution declaration the node exists but nothing resolves TO it,
+;; so \`impact\` answered "found, zero callers" on a whole CommonJS API.
+;;
+;; The declaration binds the BARE property name into the enclosing (module)
+;; scope, which is what importers see: \`const { foo } = require('./m')\`
+;; matches by name, and a namespace \`m.foo()\` walks the module's defs.
+;;
+;; Same anchor discipline as the blocks above — \`@declaration.function\` sits
+;; on the INNER arrow / function_expression so its range matches the
+;; \`@scope.function\` range.
+;; The three right-hand-side forms share one pattern via an inner LEAF
+;; alternation. tree-sitter 0.21.1 has a known hazard where a top-level
+;; \`[...]\` alternation makes sibling branches share one predicate bucket and
+;; silently drops matches; an inner leaf alternation whose predicates all sit
+;; on captures OUTSIDE it (here \`@_cjs.exports\` / \`@_cjs.module\`, both on the
+;; left-hand side and bound in every branch) is the safe form. Verified by
+;; probing all six receiver × RHS combinations, not by reading.
+;;
+;; \`(generator_function) @scope.function\` is declared near the top of this
+;; query, so the anchor aligns for that branch too.
+(assignment_expression
+  left: (member_expression
+    object: (identifier) @_cjs.receiver
+    property: (property_identifier) @declaration.name)
+  right: [
+    (arrow_function)
+    (function_expression)
+    (generator_function)
+  ] @declaration.function)
+
+;; \`this.X = fn\` at MODULE level of a CommonJS file — there \`this\` IS
+;; \`module.exports\`, so this declares an export. Pruned emit-side for ESM
+;; files (where top-level \`this\` is undefined) and for a \`this\` inside a
+;; function, which is an instance member rather than an export.
+(assignment_expression
+  left: (member_expression
+    object: (this)
+    property: (property_identifier) @declaration.name)
+  right: [
+    (arrow_function)
+    (function_expression)
+    (generator_function)
+  ] @declaration.function)
+
+(assignment_expression
+  left: (member_expression
+    object: (member_expression
+      object: (identifier) @_cjs.module
+      property: (property_identifier) @_cjs.exports)
+    property: (property_identifier) @declaration.name)
+  right: [
+    (arrow_function)
+    (function_expression)
+    (generator_function)
+  ] @declaration.function
+  (#eq? @_cjs.module "module")
+  (#eq? @_cjs.exports "exports"))
+
 ;; Object-property arrows / function expressions named by their pair key.
 ;; Same anchor discipline as the lexical_declaration block above: the
 ;; @declaration.function capture must sit on the INNER arrow/fn-expression.
@@ -340,6 +432,34 @@ const JAVASCRIPT_SCOPE_QUERY = `
   value: (new_expression
     constructor: (member_expression) @type-binding.type)) @type-binding.constructor
 
+;; Class field initializer: \`class C { p = new Outer(); }\` (#2807).
+;; JavaScript has no field annotations at all, so a class field's type can only
+;; ever come from its initializer — without this pattern \`this.p.inner()\` had
+;; nothing to type the receiver with and the receiver fold declined the whole
+;; chain. \`synthesizeConstructorFieldBindings\` in captures.ts already covers the
+;; sibling shape (\`this.p = new Outer()\`), but only inside a \`constructor\`
+;; body, so a field initialized at its declaration matched nothing.
+;;
+;; Anchored on \`field_definition\` so the binding lands in the class body scope,
+;; where \`typeOfMemberOnClass\` reads it — the same anchoring TypeScript uses for
+;; \`public_field_definition\`. Note the JS grammar names the field \`property:\`,
+;; not \`name:\`.
+(field_definition
+  property: (property_identifier) @type-binding.name
+  value: (new_expression
+    constructor: (identifier) @type-binding.type)) @type-binding.constructor
+
+(field_definition
+  property: (property_identifier) @type-binding.name
+  value: (new_expression
+    constructor: (member_expression) @type-binding.type)) @type-binding.constructor
+
+;; Private-name field: \`#p = new Outer()\`.
+(field_definition
+  property: (private_property_identifier) @type-binding.name
+  value: (new_expression
+    constructor: (identifier) @type-binding.type)) @type-binding.constructor
+
 ;; Call-result alias: const u = getUser()
 (variable_declarator
   name: (identifier) @type-binding.name
@@ -457,6 +577,113 @@ const JAVASCRIPT_SCOPE_QUERY = `
 (member_expression
   object: (_) @reference.receiver
   property: (property_identifier) @reference.name) @reference.read.member
+
+;; Value position (#2437): function identifier as object-literal property
+;; value ({ emitScopeCaptures: emitHook }) or shorthand ({ emitHook }).
+;; Resolution is callable-gated (MethodRegistry) and emits a USES reference;
+;; @reference.property-key feeds the property-dispatch pass, which
+;; synthesizes CALLS at x.<key>() sites. Two separate patterns (tree-sitter
+;; 0.21 alternation hazard); destructuring shorthand is
+;; shorthand_property_identifier_pattern and cannot match.
+(pair
+  key: (property_identifier) @reference.property-key
+  value: (identifier) @reference.name @reference.value-ref)
+
+(object
+  (shorthand_property_identifier) @reference.name @reference.property-key @reference.value-ref)
+
+;; Bare-identifier reads (A2). VALUE POSITIONS ONLY — a blanket
+;; \`(identifier)\` rule would mint a site for every token in the file.
+(arguments
+  (identifier) @reference.name @reference.read.identifier)
+
+(assignment_pattern
+  right: (identifier) @reference.name @reference.read.identifier)
+
+(return_statement
+  (identifier) @reference.name @reference.read.identifier)
+
+;; \`const next = LIMIT\` and \`n > LIMIT\` — both plainly value reads, and both
+;; named in review as gaps between what A2 claimed and what it matched.
+(variable_declarator
+  value: (identifier) @reference.name @reference.read.identifier)
+
+(binary_expression
+  left: (identifier) @reference.name @reference.read.identifier)
+
+(binary_expression
+  right: (identifier) @reference.name @reference.read.identifier)
+
+;; Destructured PARAMETER keys (R2-1c). \`function exit({ exitMinAtrMult = 0 })\`
+;; reads that property off whatever the caller passes, exactly as
+;; \`cfg.exitMinAtrMult\` would — the field just never appears in a
+;; member_expression, so the read had no site at all and the function that
+;; implements the behaviour was missing from "who reads this setting?".
+;;
+;; A distinct anchor rather than @reference.read.member: that tag is filtered
+;; emit-side to matches with a member_expression ancestor (calls and writes
+;; share its shape), and a destructuring pattern has none, so it would be
+;; dropped. The \`read.\` head is what maps this to a read kind, so the new tag
+;; needs no mapping change.
+;;
+;; The object_pattern is the receiver. It is anonymous — there is no name to
+;; type — which is precisely the untyped-receiver case the name-narrowing pass
+;; exists to serve.
+;;
+;; Scoped to formal_parameters deliberately. A destructuring binding elsewhere
+;; (\`const { x } = require('m')\`) is often an import rather than a field read,
+;; and minting a property read for it would attribute module bindings to
+;; unrelated same-named keys.
+(formal_parameters
+  (object_pattern
+    (shorthand_property_identifier_pattern) @reference.name
+      @reference.read.destructured) @reference.receiver)
+
+(formal_parameters
+  (object_pattern
+    (object_assignment_pattern
+      left: (shorthand_property_identifier_pattern) @reference.name
+        @reference.read.destructured)) @reference.receiver)
+
+(formal_parameters
+  (object_pattern
+    (pair_pattern
+      key: (property_identifier) @reference.name
+        @reference.read.destructured)) @reference.receiver)
+
+;; Object-literal keys in RECORD CONSTRUCTION position (R2-1b). Building
+;; \`{ exitContract: { exitMinAtrMult: settings.x } }\` SETS that field, so this
+;; is the write counterpart to the destructured read above — without it
+;; "who reads this setting?" answers well and "who SETS it?" misses the code
+;; that stamps the value.
+;;
+;; A WRITE REFERENCE, deliberately not a definition. The round-1 rule already
+;; mints Property nodes for literals bound to a variable; minting more for
+;; anonymous records would add same-named competitors to the very name-narrowing
+;; that makes these reads resolvable — measured at 26 competing definitions for
+;; one field on the reporting repo. A construction site is a USE of a field, not
+;; another declaration of it.
+;;
+;; Two positions only: nested under a key, and returned. Both are records with a
+;; name attached (the key, or the function). An inline call argument
+;; (\`doThing({ id: 1 })\`) stays excluded for the same reason round 1 excluded
+;; it from definitions — it is call-site data, not a named surface.
+;;
+;; The enclosing literal is the receiver, and it is anonymous, which routes
+;; these through the same narrowing and the same refusal-to-guess as every other
+;; untyped receiver.
+(pair
+  value: (object
+    (pair
+      key: (property_identifier) @reference.name
+        @reference.write.property-key) @_r2b.nested) @reference.receiver)
+
+(return_statement
+  (object
+    (pair
+      key: (property_identifier) @reference.name
+        @reference.write.property-key) @_r2b.returned) @reference.receiver)
+
 `;
 /** JSX-only suffix — appended when compiling against the JSX grammar for .jsx files. */
 const JSX_QUERY_SUFFIX = `

package/dist/core/ingestion/languages/javascript/scope-resolver.js

@@ -39,11 +39,23 @@ import { javascriptProvider } from '../typescript.js';
 import { jsMergeBindings } from './merge-bindings.js';
 import { jsArityCompatibility } from './arity.js';
 import { makeJsResolveImportTarget } from './import-target.js';
+import { loadTsconfigIndex } from '../typescript/tsconfig.js';
+import { loadNodeWorkspacePackages } from '../../import-resolvers/node-workspace-packages.js';
 const javascriptScopeResolver = {
+    // Construction is keyword-prefixed: `new Service(db).doWork()` (#2708).
+    constructionSyntax: { keyword: 'new' },
     language: SupportedLanguages.JavaScript,
     languageProvider: javascriptProvider,
     importEdgeReason: 'javascript-scope: import',
     resolveImportTarget: makeJsResolveImportTarget(),
+    // JavaScript resolution reads the same declared inputs TypeScript does —
+    // `jsconfig.json` is a tsconfig by another name, and `package.json` is shared
+    // outright. Without them a bare specifier used to fall through to suffix
+    // matching (#2953); now it simply does not resolve.
+    loadResolutionConfig: async (repoPath) => ({
+        tsconfigs: await loadTsconfigIndex(repoPath),
+        nodeWorkspacePackages: await loadNodeWorkspacePackages(repoPath),
+    }),
     // JavaScript LEGB — same tier ordering as TypeScript; no declaration-
     // merging across type/value/namespace spaces.
     mergeBindings: (existing, incoming) => [...jsMergeBindings([...existing, ...incoming])],

package/dist/core/ingestion/languages/javascript/simple-hooks.js

@@ -16,7 +16,8 @@
  * prevents language-specific logic from leaking into shared TypeScript
  * infrastructure (DoD.md §2.2).
  */
-import { tsBindingScopeFor, walkToScope } from '../typescript/simple-hooks.js';
+import { walkToScope } from '../../utils/scope-tree-walk.js';
+import { tsBindingScopeFor } from '../typescript/simple-hooks.js';
 export { tsImportOwningScope as jsImportOwningScope, tsReceiverBinding as jsReceiverBinding, } from '../typescript/simple-hooks.js';
 /**
  * Like `tsBindingScopeFor` but additionally hoists

package/dist/core/ingestion/languages/jvm/package-facts.d.ts

@@ -0,0 +1,35 @@
+/** Plain-data JVM package fact captured from the language's existing AST. */
+export type JvmPackageFact = {
+    readonly status: 'known';
+    readonly packageName: string;
+} | {
+    readonly status: 'unknown';
+};
+export declare const UNKNOWN_JVM_PACKAGE_FACT: JvmPackageFact;
+export interface JvmPackageSyntaxNode {
+    readonly type: string;
+    readonly text: string;
+    readonly hasError: boolean;
+    readonly namedChildren: readonly JvmPackageSyntaxNode[];
+}
+export interface JvmPackageFactOptions {
+    readonly packageNodeType: string;
+    readonly packageNameNodeTypes: readonly string[];
+}
+export interface JvmPackageFactStore {
+    clear(): void;
+    capture(filePath: string, root: JvmPackageSyntaxNode): void;
+    set(filePath: string, fact: JvmPackageFact): void;
+    get(filePath: string): JvmPackageFact | undefined;
+}
+/** Validate a package fact restored from an opaque worker payload. */
+export declare function isJvmPackageFact(value: unknown): value is JvmPackageFact;
+/**
+ * Create one language-local package fact store.
+ *
+ * Package facts are captured while the language's scope extractor already
+ * owns a tree-sitter Tree, then serialized through ParsedFile's side-channel.
+ * Resolution hooks consume only this plain data and never parse source again.
+ */
+export declare function createJvmPackageFactStore(options: JvmPackageFactOptions): JvmPackageFactStore;
+export declare function extractJvmPackageFact(root: JvmPackageSyntaxNode, options: JvmPackageFactOptions): JvmPackageFact;

package/dist/core/ingestion/languages/jvm/package-facts.js

@@ -0,0 +1,40 @@
+export const UNKNOWN_JVM_PACKAGE_FACT = Object.freeze({ status: 'unknown' });
+/** Validate a package fact restored from an opaque worker payload. */
+export function isJvmPackageFact(value) {
+    if (value === null || typeof value !== 'object')
+        return false;
+    const fact = value;
+    return (fact.status === 'unknown' || (fact.status === 'known' && typeof fact.packageName === 'string'));
+}
+/**
+ * Create one language-local package fact store.
+ *
+ * Package facts are captured while the language's scope extractor already
+ * owns a tree-sitter Tree, then serialized through ParsedFile's side-channel.
+ * Resolution hooks consume only this plain data and never parse source again.
+ */
+export function createJvmPackageFactStore(options) {
+    const factsByFile = new Map();
+    return {
+        clear: () => factsByFile.clear(),
+        capture: (filePath, root) => factsByFile.set(filePath, extractJvmPackageFact(root, options)),
+        set: (filePath, fact) => factsByFile.set(filePath, fact),
+        get: (filePath) => factsByFile.get(filePath),
+    };
+}
+export function extractJvmPackageFact(root, options) {
+    const packageNode = root.namedChildren.find((child) => child.type === options.packageNodeType);
+    if (packageNode === undefined) {
+        // A syntax error elsewhere in a default-package file does not make its
+        // package ambiguous. Only a top-level ERROR that contains the reserved
+        // package keyword is evidence of a malformed package header.
+        const malformedHeader = root.namedChildren.some((child) => child.type === 'ERROR' && /\bpackage\b/.test(child.text));
+        return malformedHeader ? UNKNOWN_JVM_PACKAGE_FACT : { status: 'known', packageName: '' };
+    }
+    const nameNode = packageNode.namedChildren.find((child) => options.packageNameNodeTypes.includes(child.type));
+    const packageName = nameNode?.text.trim();
+    if (packageNode.hasError || packageName === undefined || packageName.length === 0) {
+        return UNKNOWN_JVM_PACKAGE_FACT;
+    }
+    return { status: 'known', packageName };
+}

package/dist/core/ingestion/languages/jvm/package-siblings.d.ts

@@ -0,0 +1,14 @@
+import type { ParsedFile } from '../../../../_shared/index.js';
+import type { ScopeResolutionIndexes } from '../../model/scope-resolution-indexes.js';
+import type { JvmPackageFact } from './package-facts.js';
+export interface JvmPackageSiblingOptions {
+    readonly languageLabel: string;
+    readonly getPackageFact: (filePath: string) => JvmPackageFact | undefined;
+}
+export interface JvmPackageSiblingVisibility {
+    readonly populateNamespaceSiblings: (parsedFiles: readonly ParsedFile[], indexes: ScopeResolutionIndexes, ctx: {
+        readonly fileContents: ReadonlyMap<string, string>;
+    }) => void;
+    readonly isVisibilityIncomplete: (filePath: string) => boolean;
+}
+export declare function createJvmPackageSiblingVisibility(options: JvmPackageSiblingOptions): JvmPackageSiblingVisibility;