gitnexus 1.6.11-rc.27 → 1.6.11-rc.29

package/dist/cli/analyze.js

@@ -524,6 +524,8 @@ const ANALYZE_CLI_ENV_KEYS = [
     'GITNEXUS_EMBEDDING_SUB_BATCH_SIZE',
     'GITNEXUS_EMBEDDING_DEVICE',
     'GITNEXUS_ANALYZE_PROGRESS_ACTIVE',
+    'GITNEXUS_ANALYZER_IDENTITY_IN_PROCESS_GUARDS',
+    'GITNEXUS_RESOLVE_DEF_GRAPH_ID_MEMO',
     'GITNEXUS_EMBEDDING_URL',
     'GITNEXUS_EMBEDDING_MODEL',
     'GITNEXUS_EMBEDDING_API_KEY',

package/dist/core/analyzer-identity.js

@@ -13,12 +13,13 @@
  * different entry files inside the same build tree; alternating between them
  * must not make an otherwise identical index stale.
  */
-import { closeSync, constants as fsConstants, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readSync, readFileSync, readdirSync, readlinkSync, realpathSync, renameSync, statSync, unlinkSync, writeFileSync, } from 'node:fs';
+import { accessSync, closeSync, constants as fsConstants, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readSync, readFileSync, readdirSync, readlinkSync, realpathSync, renameSync, statSync, unlinkSync, writeFileSync, } from 'node:fs';
 import { createHash, randomBytes } from 'node:crypto';
 import { spawnSync } from 'node:child_process';
 import { isDeepStrictEqual } from 'node:util';
 import os from 'node:os';
 import path from 'node:path';
+import { parseTruthyEnv } from './ingestion/utils/env.js';
 import { fileURLToPath } from 'node:url';
 export const ANALYZER_RUNNER_IDENTITY_SCHEMA_VERSION = 4;
 const BUILD_CANONICALIZATION = 'gitnexus-analyzer-build-v2';
@@ -1754,9 +1755,26 @@ function snapshotCacheGuardDirect(request) {
         return null;
     }
 }
-function snapshotCacheGuards(requests) {
+function installTreeUnwritable(packageRoot, buildRoot) {
+    for (const dir of [packageRoot, buildRoot]) {
+        try {
+            accessSync(dir, fsConstants.W_OK);
+        }
+        catch (err) {
+            const code = err.code;
+            if (code === 'EACCES' || code === 'EROFS')
+                return true;
+        }
+    }
+    return false;
+}
+function snapshotCacheGuards(requests, packageRoot, buildRoot) {
     if (requests.length < 128)
         return requests.map(snapshotCacheGuardDirect);
+    if (parseTruthyEnv(process.env.GITNEXUS_ANALYZER_IDENTITY_IN_PROCESS_GUARDS) ||
+        installTreeUnwritable(packageRoot, buildRoot)) {
+        return requests.map(snapshotCacheGuardDirect);
+    }
     try {
         const probe = spawnSync(process.execPath, ['--input-type=commonjs', '-e', CACHE_GUARD_PROBE_SCRIPT], {
             input: JSON.stringify(requests),
@@ -1857,7 +1875,7 @@ function validateIdentityCache(cache, options) {
         return { mode, absolutePath };
     });
     options.onCacheValidationPass?.({ guardCount: requests.length });
-    const actual = snapshotCacheGuards(requests);
+    const actual = snapshotCacheGuards(requests, cache.packageRoot, cache.buildRoot);
     const mismatch = actual.findIndex((result, index) => !isDeepStrictEqual(result, entries[index][1]));
     if (mismatch !== -1) {
         const [mode, absolutePath] = JSON.parse(entries[mismatch][0]);

package/dist/core/incremental/spring-config-drift.d.ts

@@ -0,0 +1,12 @@
+import type { KnowledgeGraph } from '../graph/types.js';
+export interface PersistedSpringConfigConsumerRow {
+    readonly id?: unknown;
+    readonly description?: unknown;
+}
+/**
+ * Find unchanged Spring consumer files whose unresolved markers changed.
+ *
+ * A removed config key also removes the old USES edge from the fresh graph, so
+ * ordinary new-graph boundary expansion cannot discover the consumer file.
+ */
+export declare function collectSpringConfigConsumerDriftFiles(graph: KnowledgeGraph, persistedRows: readonly PersistedSpringConfigConsumerRow[]): Set<string>;

package/dist/core/incremental/spring-config-drift.js

@@ -0,0 +1,46 @@
+import { SPRING_CONFIG_UNRESOLVED_PREFIX } from '../ingestion/frameworks/spring/config-bindings.js';
+const CONSUMER_LABELS = new Set(['Property', 'Class', 'Record']);
+function unresolvedKeys(description) {
+    if (typeof description !== 'string')
+        return [];
+    return description
+        .split(';')
+        .map((part) => part.trim())
+        .filter((part) => part.startsWith(SPRING_CONFIG_UNRESOLVED_PREFIX))
+        .map((part) => part.slice(SPRING_CONFIG_UNRESOLVED_PREFIX.length))
+        .sort();
+}
+/**
+ * Find unchanged Spring consumer files whose unresolved markers changed.
+ *
+ * A removed config key also removes the old USES edge from the fresh graph, so
+ * ordinary new-graph boundary expansion cannot discover the consumer file.
+ */
+export function collectSpringConfigConsumerDriftFiles(graph, persistedRows) {
+    const persistedById = new Map();
+    for (const row of persistedRows) {
+        if (typeof row.id !== 'string')
+            continue;
+        persistedById.set(row.id, unresolvedKeys(row.description));
+    }
+    const driftFiles = new Set();
+    graph.forEachNode((node) => {
+        if (!CONSUMER_LABELS.has(node.label))
+            return;
+        const filePath = node.properties.filePath;
+        if (typeof filePath !== 'string')
+            return;
+        const description = node.properties.description;
+        const persisted = persistedById.get(node.id);
+        if (persisted === undefined &&
+            (typeof description !== 'string' || !description.includes(SPRING_CONFIG_UNRESOLVED_PREFIX))) {
+            return;
+        }
+        const current = unresolvedKeys(description);
+        const prior = persisted ?? [];
+        if (current.length !== prior.length || current.some((key, index) => key !== prior[index])) {
+            driftFiles.add(filePath);
+        }
+    });
+    return driftFiles;
+}

package/dist/core/ingestion/frameworks/spring/config-bindings.d.ts

@@ -1,5 +1,6 @@
 import type { KnowledgeGraph } from '../../../graph/types.js';
 export declare const SPRING_CONFIG_DESCRIPTION = "Spring configuration property";
+export declare const SPRING_CONFIG_UNRESOLVED_PREFIX = "Spring config unresolved: ";
 export interface SpringValueConsumer {
     readonly kind: 'value';
     readonly fieldName: string;

package/dist/core/ingestion/frameworks/spring/config-bindings.js

@@ -1,5 +1,6 @@
 import { generateId } from '../../../../lib/utils.js';
 export const SPRING_CONFIG_DESCRIPTION = 'Spring configuration property';
+export const SPRING_CONFIG_UNRESOLVED_PREFIX = 'Spring config unresolved: ';
 function closestNode(candidates, filePath, name, line) {
     return candidates
         .filter((node) => node.properties.filePath === filePath && node.properties.name === name)
@@ -7,7 +8,7 @@ function closestNode(candidates, filePath, name, line) {
         Math.abs(Number(right.properties.startLine ?? 0) - line))[0];
 }
 function markUnresolved(node, key) {
-    const marker = `Spring config unresolved: ${key}`;
+    const marker = `${SPRING_CONFIG_UNRESOLVED_PREFIX}${key}`;
     const existing = typeof node.properties.description === 'string' ? node.properties.description : '';
     if (existing.includes(marker))
         return;

package/dist/core/ingestion/languages/java/analysis-features.d.ts

@@ -1,5 +1,5 @@
 import type { AnalysisFeatureDescriptor } from '../../../analysis-features.js';
-/** Durable completeness contract for Java Spring configuration bindings. */
+/** Durable completeness contract for Java and Kotlin Spring configuration bindings. */
 export declare const SPRING_CONFIG_BINDINGS_FEATURE: AnalysisFeatureDescriptor;
 /** Durable completeness contract for implicit Java record-component accessors. */
 export declare const JAVA_RECORD_COMPONENT_ACCESSORS_FEATURE: AnalysisFeatureDescriptor;

package/dist/core/ingestion/languages/java/analysis-features.js

@@ -2,14 +2,22 @@ function isSpringApplicationConfig(filePath) {
     const base = filePath.replaceAll('\\', '/').split('/').pop() ?? '';
     return /^application(?:-[^.]+)?\.(?:properties|ya?ml)$/i.test(base);
 }
-/** Durable completeness contract for Java Spring configuration bindings. */
+/** Durable completeness contract for Java and Kotlin Spring configuration bindings. */
 export const SPRING_CONFIG_BINDINGS_FEATURE = {
     id: 'spring.config-bindings',
-    version: 1,
-    // Java sources need consumer extraction even without config files (missing
-    // placeholders still get unresolved markers). Config-only repositories also
-    // need a one-time rebuild to backfill language-agnostic Property nodes.
-    appliesTo: (filePaths) => filePaths.some((filePath) => filePath.toLowerCase().endsWith('.java') || isSpringApplicationConfig(filePath)),
+    version: 2,
+    // Java and Kotlin sources need consumer extraction even without config files
+    // (missing placeholders still get unresolved markers). Config-only
+    // repositories also need a one-time rebuild to backfill language-agnostic
+    // Property nodes. Gradle Kotlin DSL is not a consumer source.
+    appliesTo: (filePaths) => filePaths.some((filePath) => {
+        const normalized = filePath.replaceAll('\\', '/').toLowerCase();
+        if (normalized.endsWith('.gradle.kts'))
+            return false;
+        return (normalized.endsWith('.java') ||
+            normalized.endsWith('.kt') ||
+            isSpringApplicationConfig(filePath));
+    }),
 };
 /** Durable completeness contract for implicit Java record-component accessors. */
 export const JAVA_RECORD_COMPONENT_ACCESSORS_FEATURE = {

package/dist/core/ingestion/languages/kotlin/capture-side-channel.d.ts

@@ -44,6 +44,7 @@ import type { KotlinSpringAopFact } from './spring-aop.js';
 import type { KotlinSpringConditionalFact } from './spring-conditionals.js';
 import type { KotlinSpringDiClassFact } from './spring-di.js';
 import type { KotlinSpringNonHttpHandlerFact } from './spring-non-http-handlers.js';
+import type { KotlinSpringConfigConsumerFact } from './spring-config-bindings.js';
 /**
  * Plain JSON-serializable snapshot of the per-file Kotlin capture-time
  * side-channel. Carried opaquely on `ParsedFile.captureSideChannel`. The
@@ -68,6 +69,8 @@ export interface KotlinCaptureSideChannel {
     readonly springDynamicLookupFacts?: readonly SpringDynamicLookupFact[];
     /** Scheduled, event, messaging, and managed-job handler syntax captured per callable. */
     readonly springNonHttpHandlerFacts?: readonly KotlinSpringNonHttpHandlerFact[];
+    /** `@Value` / `@ConfigurationProperties` syntax captured per owner. */
+    readonly springConfigConsumerFacts?: readonly KotlinSpringConfigConsumerFact[];
 }
 export declare function clearKotlinClassAnnotationFacts(): void;
 export declare function setKotlinSpringAopFacts(filePath: string, facts: readonly KotlinSpringAopFact[]): void;
@@ -82,6 +85,8 @@ export declare function setKotlinSpringDynamicLookupFacts(filePath: string, fact
 export declare function getKotlinSpringDynamicLookupFacts(filePath: string): readonly SpringDynamicLookupFact[];
 export declare function setKotlinSpringNonHttpHandlerFacts(filePath: string, facts: readonly KotlinSpringNonHttpHandlerFact[]): void;
 export declare function getKotlinSpringNonHttpHandlerFacts(filePath: string): readonly KotlinSpringNonHttpHandlerFact[];
+export declare function setKotlinSpringConfigConsumerFacts(filePath: string, facts: readonly KotlinSpringConfigConsumerFact[]): void;
+export declare function getKotlinSpringConfigConsumerFacts(filePath: string): readonly KotlinSpringConfigConsumerFact[];
 /**
  * `LanguageProvider.collectCaptureSideChannel` implementation for Kotlin.
  * Returns `undefined` when this file recorded no side-channel state at all, so

package/dist/core/ingestion/languages/kotlin/capture-side-channel.js

@@ -46,6 +46,7 @@ const springConditionalFacts = new Map();
 const springDiFacts = new Map();
 const springDynamicLookupFacts = new Map();
 const springNonHttpHandlerFacts = new Map();
+const springConfigConsumerFacts = new Map();
 export function clearKotlinClassAnnotationFacts() {
     classAnnotations.clear();
     springAopFacts.clear();
@@ -53,6 +54,7 @@ export function clearKotlinClassAnnotationFacts() {
     springDiFacts.clear();
     springDynamicLookupFacts.clear();
     springNonHttpHandlerFacts.clear();
+    springConfigConsumerFacts.clear();
 }
 export function setKotlinSpringAopFacts(filePath, facts) {
     if (facts.length === 0)
@@ -105,6 +107,15 @@ export function setKotlinSpringNonHttpHandlerFacts(filePath, facts) {
 export function getKotlinSpringNonHttpHandlerFacts(filePath) {
     return springNonHttpHandlerFacts.get(filePath) ?? [];
 }
+export function setKotlinSpringConfigConsumerFacts(filePath, facts) {
+    if (facts.length === 0)
+        springConfigConsumerFacts.delete(filePath);
+    else
+        springConfigConsumerFacts.set(filePath, facts);
+}
+export function getKotlinSpringConfigConsumerFacts(filePath) {
+    return springConfigConsumerFacts.get(filePath) ?? [];
+}
 /**
  * `LanguageProvider.collectCaptureSideChannel` implementation for Kotlin.
  * Returns `undefined` when this file recorded no side-channel state at all, so
@@ -118,6 +129,7 @@ export function collectKotlinCaptureSideChannel(filePath) {
     const diFacts = springDiFacts.get(filePath) ?? [];
     const dynamicLookupFacts = springDynamicLookupFacts.get(filePath) ?? [];
     const nonHttpHandlerFacts = springNonHttpHandlerFacts.get(filePath) ?? [];
+    const configConsumerFacts = springConfigConsumerFacts.get(filePath) ?? [];
     const packageFact = getKotlinPackageFact(filePath);
     if (companionScopes.length === 0 &&
         annotationFacts.length === 0 &&
@@ -126,6 +138,7 @@ export function collectKotlinCaptureSideChannel(filePath) {
         diFacts.length === 0 &&
         dynamicLookupFacts.length === 0 &&
         nonHttpHandlerFacts.length === 0 &&
+        configConsumerFacts.length === 0 &&
         packageFact === undefined) {
         return undefined;
     }
@@ -139,6 +152,7 @@ export function collectKotlinCaptureSideChannel(filePath) {
         ...(diFacts.length > 0 ? { springDiFacts: diFacts } : {}),
         ...(dynamicLookupFacts.length > 0 ? { springDynamicLookupFacts: dynamicLookupFacts } : {}),
         ...(nonHttpHandlerFacts.length > 0 ? { springNonHttpHandlerFacts: nonHttpHandlerFacts } : {}),
+        ...(configConsumerFacts.length > 0 ? { springConfigConsumerFacts: configConsumerFacts } : {}),
     };
 }
 /**
@@ -163,6 +177,7 @@ export function applyKotlinCaptureSideChannel(parsed) {
         setKotlinSpringDiFacts(parsed.filePath, []);
         setKotlinSpringDynamicLookupFacts(parsed.filePath, []);
         setKotlinSpringNonHttpHandlerFacts(parsed.filePath, []);
+        setKotlinSpringConfigConsumerFacts(parsed.filePath, []);
         setKotlinPackageFact(parsed.filePath, UNKNOWN_JVM_PACKAGE_FACT);
         return;
     }
@@ -175,5 +190,6 @@ export function applyKotlinCaptureSideChannel(parsed) {
     setKotlinSpringDiFacts(parsed.filePath, Array.isArray(data.springDiFacts) ? data.springDiFacts : []);
     setKotlinSpringDynamicLookupFacts(parsed.filePath, Array.isArray(data.springDynamicLookupFacts) ? data.springDynamicLookupFacts : []);
     setKotlinSpringNonHttpHandlerFacts(parsed.filePath, Array.isArray(data.springNonHttpHandlerFacts) ? data.springNonHttpHandlerFacts : []);
+    setKotlinSpringConfigConsumerFacts(parsed.filePath, Array.isArray(data.springConfigConsumerFacts) ? data.springConfigConsumerFacts : []);
     setKotlinPackageFact(parsed.filePath, isJvmPackageFact(data.packageFact) ? data.packageFact : UNKNOWN_JVM_PACKAGE_FACT);
 }

package/dist/core/ingestion/languages/kotlin/captures.js

@@ -10,11 +10,12 @@ import { normalizeKotlinType } from './interpret.js';
 import { synthesizeKotlinReceiverBinding } from './receiver-binding.js';
 import { getKotlinParser, getKotlinScopeQuery } from './query.js';
 import { markCompanionScope } from './companion-scopes.js';
-import { setKotlinClassAnnotationFacts, setKotlinSpringAopFacts, setKotlinSpringConditionalFacts, setKotlinSpringDiFacts, setKotlinSpringDynamicLookupFacts, setKotlinSpringNonHttpHandlerFacts, } from './capture-side-channel.js';
+import { setKotlinClassAnnotationFacts, setKotlinSpringAopFacts, setKotlinSpringConditionalFacts, setKotlinSpringDiFacts, setKotlinSpringDynamicLookupFacts, setKotlinSpringNonHttpHandlerFacts, setKotlinSpringConfigConsumerFacts, } from './capture-side-channel.js';
 import { captureKotlinPackageFact } from './package-facts.js';
 import { synthesizeCallableFlowCaptures } from '../../utils/callable-flow-captures.js';
 import { synthesizeLombokAccessorCaptures } from './lombok-synthesizer.js';
 import { captureKotlinSpringDiClassFact } from './spring-di.js';
+import { captureKotlinSpringConfigConsumerFacts } from './spring-config-bindings.js';
 import { captureKotlinSpringDynamicLookupFact } from './spring-dynamic-lookup.js';
 import { synthesizeReceiverChainCapture } from '../../utils/receiver-chain-captures.js';
 import { captureKotlinSpringAopFacts } from './spring-aop.js';
@@ -292,6 +293,7 @@ export function emitKotlinScopeCaptures(sourceText, filePath, cachedTree) {
     setKotlinSpringDiFacts(filePath, springDiFacts);
     setKotlinSpringDynamicLookupFacts(filePath, springDynamicLookupFacts);
     setKotlinSpringNonHttpHandlerFacts(filePath, springNonHttpHandlerFacts);
+    setKotlinSpringConfigConsumerFacts(filePath, captureKotlinSpringConfigConsumerFacts(tree.rootNode, filePath));
     out.push(...synthesizeLombokAccessorCaptures(tree.rootNode));
     out.push(...synthesizeCallableFlowCaptures(tree.rootNode, KOTLIN_CALLABLE_CAPTURE_OPTIONS));
     return out;

package/dist/core/ingestion/languages/kotlin/scope-resolver.js

@@ -15,6 +15,7 @@ import { clearKotlinPackageFacts } from './package-facts.js';
 import { attachKotlinSpringDiMetadata } from './spring-di.js';
 import { attachKotlinSpringConditionalMetadata } from './spring-conditionals.js';
 import { attachKotlinSpringNonHttpHandlerMetadata } from './spring-non-http-handlers.js';
+import { attachKotlinSpringConfigBindings } from './spring-config-bindings.js';
 import { attachKotlinSpringDynamicLookup } from './spring-dynamic-lookup.js';
 /**
  * Kotlin scope resolver for RFC #909 Ring 3.
@@ -123,6 +124,7 @@ export const kotlinScopeResolver = {
         attachKotlinSpringDiMetadata(graph, parsedFiles, nodeLookup, indexes);
         attachKotlinSpringNonHttpHandlerMetadata(graph, parsedFiles, nodeLookup, indexes);
         attachKotlinSpringDynamicLookup(graph, parsedFiles, nodeLookup, indexes);
+        attachKotlinSpringConfigBindings(graph, parsedFiles, nodeLookup, indexes);
     },
 };
 /**

package/dist/core/ingestion/languages/kotlin/spring-config-bindings.d.ts

@@ -0,0 +1,18 @@
+import type { KnowledgeGraph } from '../../../graph/types.js';
+import type { GraphNodeLookup } from '../../scope-resolution/graph-bridge/node-lookup.js';
+import type { ScopeResolutionIndexes } from '../../model/scope-resolution-indexes.js';
+import { type ParsedFile, type ScopeId } from '../../../../_shared/index.js';
+import { type SpringConfigConsumer } from '../../frameworks/spring/config-bindings.js';
+import { type SyntaxNode } from '../../utils/ast-helpers.js';
+export interface KotlinSpringConfigConsumerFact {
+    readonly consumer: SpringConfigConsumer;
+    readonly annotationName: string;
+    readonly classScopeId: ScopeId;
+}
+/** Collect config facts from the Kotlin parser's existing AST (no reparse). */
+export declare function captureKotlinSpringConfigConsumerFacts(root: SyntaxNode, filePath: string): KotlinSpringConfigConsumerFact[];
+/** Parse Kotlin consumers for focused unit tests; production reuses the worker AST. */
+export declare function extractKotlinSpringConfigConsumers(source: string): SpringConfigConsumer[];
+export declare function extractKotlinSpringConfigConsumerFacts(source: string): KotlinSpringConfigConsumerFact[];
+/** Kotlin ScopeResolver post-resolution hook for Spring configuration consumers. */
+export declare function attachKotlinSpringConfigBindings(graph: KnowledgeGraph, parsedFiles: readonly ParsedFile[], _nodeLookup: GraphNodeLookup, indexes: ScopeResolutionIndexes): void;

package/dist/core/ingestion/languages/kotlin/spring-config-bindings.js

@@ -0,0 +1,411 @@
+import { makeScopeId } from '../../../../_shared/index.js';
+import { bindSpringConfigConsumers, } from '../../frameworks/spring/config-bindings.js';
+import { createSpringAnnotationNameResolver } from '../../frameworks/spring/bean-candidates.js';
+import { parseSpringAnnotationArguments, parseStaticStringLiteral, } from '../../frameworks/spring/annotation-arguments.js';
+import { parseSourceSafe } from '../../../tree-sitter/safe-parse.js';
+import { nodeToCapture } from '../../utils/ast-helpers.js';
+import { getKotlinParser } from './query.js';
+import { getKotlinSpringConfigConsumerFacts } from './capture-side-channel.js';
+import { isKotlinPackageSiblingVisibilityIncomplete } from './package-siblings.js';
+const VALUE_ANNOTATION = 'org.springframework.beans.factory.annotation.Value';
+const CONFIGURATION_PROPERTIES_ANNOTATION = 'org.springframework.boot.context.properties.ConfigurationProperties';
+const VALUE_SIMPLE = 'Value';
+const CONFIGURATION_PROPERTIES_SIMPLE = 'ConfigurationProperties';
+const SKIP_USE_SITES = new Set(['get', 'property', 'file']);
+const BIND_USE_SITES = new Set(['field', 'set', 'param']);
+const OWNER_TYPES = new Set(['class_declaration', 'object_declaration', 'companion_object']);
+const INTERPOLATION_TYPES = new Set([
+    'interpolated_identifier',
+    'interpolated_expression',
+    'interpolation_expression_start',
+]);
+const STRING_LITERAL_TYPES = new Set(['string_literal', 'character_literal']);
+function firstDescendantOfType(node, type) {
+    const stack = [...node.namedChildren].reverse();
+    while (stack.length > 0) {
+        const current = stack.pop();
+        if (current === undefined)
+            continue;
+        if (current.type === type)
+            return current;
+        for (let index = current.namedChildren.length - 1; index >= 0; index--) {
+            const child = current.namedChildren[index];
+            if (child !== undefined)
+                stack.push(child);
+        }
+    }
+    return undefined;
+}
+function ownerName(declaration) {
+    if (declaration.type === 'companion_object') {
+        const named = declaration.namedChildren.find((child) => child.type === 'type_identifier');
+        return named?.text.trim() || 'Companion';
+    }
+    return (declaration.namedChildren.find((child) => child.type === 'type_identifier')?.text.trim() ??
+        declaration.namedChildren.find((child) => child.type === 'simple_identifier')?.text.trim());
+}
+function enclosingOwner(node) {
+    let current = node.parent;
+    while (current !== null) {
+        if (OWNER_TYPES.has(current.type))
+            return current;
+        current = current.parent;
+    }
+    return undefined;
+}
+function classScopeId(filePath, declaration) {
+    return makeScopeId({
+        filePath,
+        range: nodeToCapture('@scope.class', declaration).range,
+        kind: 'Class',
+    });
+}
+function collectKotlinImports(root) {
+    const exact = new Map();
+    const wildcard = new Set();
+    const localTypes = new Map();
+    for (const header of root.descendantsOfType('import_header')) {
+        const text = header.text.replace(/^import\s+/, '').trim();
+        const aliasMatch = text.match(/^([\w.]+)\s+as\s+(\w+)\s*$/);
+        if (aliasMatch !== null) {
+            exact.set(aliasMatch[2], aliasMatch[1]);
+            continue;
+        }
+        if (text.endsWith('.*'))
+            wildcard.add(text.slice(0, -2));
+        else {
+            const simple = text.slice(text.lastIndexOf('.') + 1);
+            if (simple.length > 0)
+                exact.set(simple, text);
+        }
+    }
+    for (const type of ['class_declaration', 'object_declaration']) {
+        for (const declaration of root.descendantsOfType(type)) {
+            const name = ownerName(declaration);
+            if (name) {
+                const declarations = localTypes.get(name) ?? [];
+                declarations.push(declaration);
+                localTypes.set(name, declarations);
+            }
+        }
+    }
+    return { exact, wildcard, localTypes };
+}
+function annotationFromNode(annotation) {
+    const nameNode = firstDescendantOfType(annotation, 'user_type') ??
+        firstDescendantOfType(annotation, 'type_identifier') ??
+        firstDescendantOfType(annotation, 'simple_identifier');
+    if (nameNode === undefined)
+        return null;
+    const useSiteTarget = annotation.namedChildren
+        .find((child) => child.type === 'use_site_target')
+        ?.text.replace(/:\s*$/, '')
+        .trim();
+    return {
+        name: nameNode.text.trim(),
+        node: annotation,
+        ...(useSiteTarget === undefined || useSiteTarget.length === 0 ? {} : { useSiteTarget }),
+    };
+}
+function annotationsOn(node) {
+    const annotations = [];
+    for (const child of node.namedChildren) {
+        if (child.type === 'annotation') {
+            const fact = annotationFromNode(child);
+            if (fact !== null)
+                annotations.push(fact);
+            continue;
+        }
+        if (child.type !== 'modifiers' && child.type !== 'parameter_modifiers')
+            continue;
+        for (const nested of child.namedChildren) {
+            if (nested.type !== 'annotation')
+                continue;
+            const fact = annotationFromNode(nested);
+            if (fact !== null)
+                annotations.push(fact);
+        }
+    }
+    return annotations;
+}
+function simpleName(rawName) {
+    const parts = rawName.split('.');
+    return parts[parts.length - 1] ?? rawName;
+}
+function importedAs(imports, simple, fqn, wildcardPackage) {
+    if (imports.exact.get(simple) === fqn)
+        return true;
+    // An explicit import wins over a star import in Kotlin, so a conflicting
+    // binding for the same simple name rules the Spring annotation out even when
+    // its package is wildcard-imported.
+    return imports.exact.get(simple) === undefined && imports.wildcard.has(wildcardPackage);
+}
+function hasVisibleLocalType(imports, simple, annotation) {
+    for (const declaration of imports.localTypes.get(simple) ?? []) {
+        const declarationOwner = enclosingOwner(declaration);
+        if (declarationOwner === undefined)
+            return true;
+        let current = annotation;
+        while (current !== null) {
+            if (current.id === declarationOwner.id)
+                return true;
+            current = current.parent;
+        }
+    }
+    return false;
+}
+const SIMPLE_CONFIG_ANNOTATIONS = [
+    {
+        simple: VALUE_SIMPLE,
+        kind: 'value',
+        fqn: VALUE_ANNOTATION,
+        wildcardPackage: 'org.springframework.beans.factory.annotation',
+    },
+    {
+        simple: CONFIGURATION_PROPERTIES_SIMPLE,
+        kind: 'configuration-properties',
+        fqn: CONFIGURATION_PROPERTIES_ANNOTATION,
+        wildcardPackage: 'org.springframework.boot.context.properties',
+    },
+];
+function configAnnotationKind(annotation, imports) {
+    const rawName = annotation.name;
+    if (rawName === VALUE_ANNOTATION)
+        return 'value';
+    if (rawName === CONFIGURATION_PROPERTIES_ANNOTATION)
+        return 'configuration-properties';
+    const simple = simpleName(rawName);
+    const aliased = imports.exact.get(simple);
+    if (aliased === VALUE_ANNOTATION)
+        return 'value';
+    if (aliased === CONFIGURATION_PROPERTIES_ANNOTATION)
+        return 'configuration-properties';
+    for (const candidate of SIMPLE_CONFIG_ANNOTATIONS) {
+        if (simple !== candidate.simple)
+            continue;
+        if (hasVisibleLocalType(imports, simple, annotation.node) && !imports.exact.has(simple)) {
+            return null;
+        }
+        return importedAs(imports, simple, candidate.fqn, candidate.wildcardPackage)
+            ? candidate.kind
+            : null;
+    }
+    return null;
+}
+function hasInterpolation(annotation) {
+    const stack = [...annotation.namedChildren];
+    while (stack.length > 0) {
+        const current = stack.pop();
+        if (current === undefined)
+            continue;
+        if (INTERPOLATION_TYPES.has(current.type))
+            return true;
+        stack.push(...current.namedChildren);
+    }
+    return false;
+}
+function decodeKotlinStringLiteral(literal) {
+    const raw = literal.startsWith('"""') && literal.endsWith('"""');
+    const delimiterLength = raw ? 3 : 1;
+    if (literal.length < delimiterLength * 2)
+        return null;
+    const body = literal.slice(delimiterLength, -delimiterLength);
+    if (!raw && /(?<!\\)\$\{/.test(body))
+        return null;
+    if (raw)
+        return body;
+    return body
+        .replace(/\\u([0-9a-fA-F]{4})/g, (_match, hex) => String.fromCharCode(Number.parseInt(hex, 16)))
+        .replace(/\\(["'\\$btnfr])/g, (_match, escaped) => {
+        const controls = {
+            b: '\b',
+            t: '\t',
+            n: '\n',
+            f: '\f',
+            r: '\r',
+            $: '$',
+        };
+        return controls[escaped] ?? escaped;
+    });
+}
+function kotlinStringLiterals(annotation) {
+    const literals = [];
+    const stack = [...annotation.namedChildren];
+    while (stack.length > 0) {
+        const current = stack.pop();
+        if (current === undefined)
+            continue;
+        if (STRING_LITERAL_TYPES.has(current.type)) {
+            const decoded = decodeKotlinStringLiteral(current.text);
+            if (decoded !== null)
+                literals.push(decoded);
+            continue;
+        }
+        stack.push(...current.namedChildren);
+    }
+    return literals;
+}
+function parseValuePlaceholderKeys(annotation) {
+    if (hasInterpolation(annotation))
+        return [];
+    const keys = new Set();
+    for (const literal of kotlinStringLiterals(annotation)) {
+        for (const match of literal.matchAll(/\$\{([^{}]+)\}/g)) {
+            const key = match[1].split(':', 1)[0].trim();
+            if (/^[A-Za-z0-9_.-]+$/.test(key))
+                keys.add(key);
+        }
+    }
+    return [...keys];
+}
+function parseConfigurationPropertiesPrefix(annotation) {
+    if (hasInterpolation(annotation))
+        return null;
+    const argumentsList = parseSpringAnnotationArguments(annotation.text);
+    if (argumentsList !== null) {
+        const named = argumentsList.filter((argument) => argument.name === 'prefix' || argument.name === 'value');
+        const positional = argumentsList.filter((argument) => argument.name === undefined);
+        const chosen = named.length === 1 ? named[0] : named.length === 0 ? positional[0] : undefined;
+        if (chosen !== undefined) {
+            const decoded = parseStaticStringLiteral(chosen.value);
+            if (decoded === null)
+                return null;
+            const prefix = decoded.replace(/^\.+|\.+$/g, '');
+            if (/^[A-Za-z0-9_.-]+$/.test(prefix))
+                return prefix;
+            return null;
+        }
+        if (argumentsList.length > 0)
+            return null;
+    }
+    const literals = kotlinStringLiterals(annotation);
+    if (literals.length !== 1)
+        return null;
+    const prefix = literals[0].trim().replace(/^\.+|\.+$/g, '');
+    return /^[A-Za-z0-9_.-]+$/.test(prefix) ? prefix : null;
+}
+function allowedUseSite(useSiteTarget) {
+    if (useSiteTarget === undefined)
+        return true;
+    if (SKIP_USE_SITES.has(useSiteTarget))
+        return false;
+    return BIND_USE_SITES.has(useSiteTarget);
+}
+function hasBindingPattern(parameter) {
+    return parameter.namedChildren.some((child) => child.type === 'binding_pattern_kind');
+}
+function propertyName(node) {
+    if (node.type === 'class_parameter') {
+        return node.namedChildren.find((child) => child.type === 'simple_identifier')?.text.trim();
+    }
+    const variable = node.namedChildren.find((child) => child.type === 'variable_declaration');
+    return variable?.namedChildren.find((child) => child.type === 'simple_identifier')?.text.trim();
+}
+function underFileAnnotation(node) {
+    let current = node;
+    while (current !== null) {
+        if (current.type === 'file_annotation')
+            return true;
+        current = current.parent;
+    }
+    return false;
+}
+function pushValueFacts(facts, member, filePath, imports) {
+    if (underFileAnnotation(member))
+        return;
+    const owner = enclosingOwner(member);
+    if (owner === undefined)
+        return;
+    const fieldName = propertyName(member);
+    if (fieldName === undefined)
+        return;
+    for (const annotation of annotationsOn(member)) {
+        if (!allowedUseSite(annotation.useSiteTarget))
+            continue;
+        if (configAnnotationKind(annotation, imports) !== 'value')
+            continue;
+        const keys = parseValuePlaceholderKeys(annotation.node);
+        if (keys.length === 0)
+            continue;
+        facts.push({
+            consumer: {
+                kind: 'value',
+                fieldName,
+                line: member.startPosition.row + 1,
+                keys,
+            },
+            annotationName: annotation.name,
+            classScopeId: classScopeId(filePath, owner),
+        });
+    }
+}
+/** Collect config facts from the Kotlin parser's existing AST (no reparse). */
+export function captureKotlinSpringConfigConsumerFacts(root, filePath) {
+    const imports = collectKotlinImports(root);
+    const facts = [];
+    for (const property of root.descendantsOfType('property_declaration')) {
+        pushValueFacts(facts, property, filePath, imports);
+    }
+    for (const parameter of root.descendantsOfType('class_parameter')) {
+        if (!hasBindingPattern(parameter))
+            continue;
+        pushValueFacts(facts, parameter, filePath, imports);
+    }
+    for (const type of ['class_declaration', 'object_declaration']) {
+        for (const declaration of root.descendantsOfType(type)) {
+            const className = ownerName(declaration);
+            if (className === undefined)
+                continue;
+            for (const annotation of annotationsOn(declaration)) {
+                if (configAnnotationKind(annotation, imports) !== 'configuration-properties') {
+                    continue;
+                }
+                const prefix = parseConfigurationPropertiesPrefix(annotation.node);
+                if (prefix === null)
+                    continue;
+                facts.push({
+                    consumer: {
+                        kind: 'configuration-properties',
+                        className,
+                        line: declaration.startPosition.row + 1,
+                        prefix,
+                    },
+                    annotationName: annotation.name,
+                    classScopeId: classScopeId(filePath, declaration),
+                });
+            }
+        }
+    }
+    return facts;
+}
+/** Parse Kotlin consumers for focused unit tests; production reuses the worker AST. */
+export function extractKotlinSpringConfigConsumers(source) {
+    const tree = parseSourceSafe(getKotlinParser(), source);
+    return captureKotlinSpringConfigConsumerFacts(tree.rootNode, '<memory>').map((fact) => fact.consumer);
+}
+export function extractKotlinSpringConfigConsumerFacts(source) {
+    const tree = parseSourceSafe(getKotlinParser(), source);
+    return captureKotlinSpringConfigConsumerFacts(tree.rootNode, '<memory>');
+}
+/** Kotlin ScopeResolver post-resolution hook for Spring configuration consumers. */
+export function attachKotlinSpringConfigBindings(graph, parsedFiles, _nodeLookup, indexes) {
+    const resolveAnnotation = createSpringAnnotationNameResolver(indexes);
+    const recognizedAnnotations = new Set([VALUE_ANNOTATION, CONFIGURATION_PROPERTIES_ANNOTATION]);
+    const batches = [];
+    for (const parsed of parsedFiles) {
+        const consumers = [];
+        for (const fact of getKotlinSpringConfigConsumerFacts(parsed.filePath)) {
+            const classScope = indexes.scopeTree.getScope(fact.classScopeId);
+            if (classScope === undefined || classScope.kind !== 'Class')
+                continue;
+            const expectedAnnotation = fact.consumer.kind === 'value' ? VALUE_ANNOTATION : CONFIGURATION_PROPERTIES_ANNOTATION;
+            const enclosingScope = fact.consumer.kind === 'value' ? classScope.id : classScope.parent;
+            const resolved = resolveAnnotation(fact.annotationName, parsed, enclosingScope, recognizedAnnotations, isKotlinPackageSiblingVisibilityIncomplete(parsed.filePath));
+            if (resolved === expectedAnnotation)
+                consumers.push(fact.consumer);
+        }
+        if (consumers.length > 0)
+            batches.push({ filePath: parsed.filePath, consumers });
+    }
+    bindSpringConfigConsumers(graph, batches);
+}

package/dist/core/ingestion/model/field-registry.d.ts

@@ -2,9 +2,9 @@
  * Field Registry
  *
  * Owner-scoped field/property index extracted from SymbolTable.
- * Stores Property / Variable / Const / Static symbols keyed by
- * `ownerNodeId\0fieldName` for O(1) lookup. Supports multiple defs
- * under the same (owner, name) — e.g. legacy Property plus a
+ * Stores Property / Variable / Const / Static symbols in a nested
+ * `Map<ownerNodeId, Map<fieldName, defs[]>>` for O(1) lookup. Supports
+ * multiple defs under the same (owner, name) — e.g. legacy Property plus a
  * scope-resolution Variable reconciliation entry.
  */
 import type { SymbolDefinition } from '../../../_shared/index.js';

package/dist/core/ingestion/model/field-registry.js

@@ -2,9 +2,9 @@
  * Field Registry
  *
  * Owner-scoped field/property index extracted from SymbolTable.
- * Stores Property / Variable / Const / Static symbols keyed by
- * `ownerNodeId\0fieldName` for O(1) lookup. Supports multiple defs
- * under the same (owner, name) — e.g. legacy Property plus a
+ * Stores Property / Variable / Const / Static symbols in a nested
+ * `Map<ownerNodeId, Map<fieldName, defs[]>>` for O(1) lookup. Supports
+ * multiple defs under the same (owner, name) — e.g. legacy Property plus a
  * scope-resolution Variable reconciliation entry.
  */
 const EMPTY = Object.freeze([]);
@@ -14,20 +14,24 @@ const EMPTY = Object.freeze([]);
 export const createFieldRegistry = () => {
     const fieldByOwner = new Map();
     const lookupAllByOwner = (ownerNodeId, fieldName) => {
-        return fieldByOwner.get(`${ownerNodeId}\0${fieldName}`) ?? EMPTY;
+        return fieldByOwner.get(ownerNodeId)?.get(fieldName) ?? EMPTY;
     };
     const lookupFieldByOwner = (ownerNodeId, fieldName) => {
         const pool = lookupAllByOwner(ownerNodeId, fieldName);
         return pool.length === 0 ? undefined : pool[0];
     };
     const register = (ownerNodeId, fieldName, def) => {
-        const key = `${ownerNodeId}\0${fieldName}`;
-        const existing = fieldByOwner.get(key);
+        let byName = fieldByOwner.get(ownerNodeId);
+        if (!byName) {
+            byName = new Map();
+            fieldByOwner.set(ownerNodeId, byName);
+        }
+        const existing = byName.get(fieldName);
         if (existing) {
             existing.push(def);
         }
         else {
-            fieldByOwner.set(key, [def]);
+            byName.set(fieldName, [def]);
         }
     };
     const clear = () => {

package/dist/core/ingestion/model/method-registry.d.ts

@@ -2,9 +2,9 @@
  * Method Registry
  *
  * Owner-scoped method index extracted from SymbolTable.
- * Stores Method/Constructor/Function-with-ownerId symbols keyed by
- * `ownerNodeId\0methodName` for O(1) lookup. Supports overloads
- * (array values) and arity-based filtering.
+ * Stores Method/Constructor/Function-with-ownerId symbols in a nested
+ * `Map<ownerNodeId, Map<methodName, defs[]>>` for O(1) lookup. Supports
+ * overloads (array values) and arity-based filtering.
  */
 import type { SymbolDefinition } from '../../../_shared/index.js';
 export interface MethodRegistry {

package/dist/core/ingestion/model/method-registry.js

@@ -2,9 +2,9 @@
  * Method Registry
  *
  * Owner-scoped method index extracted from SymbolTable.
- * Stores Method/Constructor/Function-with-ownerId symbols keyed by
- * `ownerNodeId\0methodName` for O(1) lookup. Supports overloads
- * (array values) and arity-based filtering.
+ * Stores Method/Constructor/Function-with-ownerId symbols in a nested
+ * `Map<ownerNodeId, Map<methodName, defs[]>>` for O(1) lookup. Supports
+ * overloads (array values) and arity-based filtering.
  */
 // ---------------------------------------------------------------------------
 // Factory
@@ -19,8 +19,9 @@ export const createMethodRegistry = () => {
     // Set once when a Function+ownerId def lands here, powers the Tier 3
     // dedup fast-path. Monotonic: never unset except on `clear()`.
     let hasFunctionMethodsFlag = false;
+    const ownerDefs = (ownerNodeId, methodName) => methodByOwner.get(ownerNodeId)?.get(methodName);
     const lookupMethodByOwner = (ownerNodeId, methodName, argCount) => {
-        const defs = methodByOwner.get(`${ownerNodeId}\0${methodName}`);
+        const defs = ownerDefs(ownerNodeId, methodName);
         if (!defs || defs.length === 0)
             return undefined;
         // Arity narrowing: when an argCount is provided and there are multiple
@@ -89,16 +90,20 @@ export const createMethodRegistry = () => {
         return methodsByName.get(name) ?? EMPTY;
     };
     const lookupAllByOwner = (ownerNodeId, methodName) => {
-        return methodByOwner.get(`${ownerNodeId}\0${methodName}`) ?? EMPTY;
+        return ownerDefs(ownerNodeId, methodName) ?? EMPTY;
     };
     const register = (ownerNodeId, methodName, def) => {
-        const key = `${ownerNodeId}\0${methodName}`;
-        const existing = methodByOwner.get(key);
+        let owned = methodByOwner.get(ownerNodeId);
+        if (!owned) {
+            owned = new Map();
+            methodByOwner.set(ownerNodeId, owned);
+        }
+        const existing = owned.get(methodName);
         if (existing) {
             existing.push(def);
         }
         else {
-            methodByOwner.set(key, [def]);
+            owned.set(methodName, [def]);
         }
         const byName = methodsByName.get(methodName);
         if (byName) {

package/dist/core/ingestion/model/type-registry.js

@@ -24,7 +24,7 @@ export const createTypeRegistry = () => {
         return implByName.get(name) ?? [];
     };
     const lookupAllByOwner = (ownerNodeId, simpleName) => {
-        return nestedByOwner.get(`${ownerNodeId}\0${simpleName}`) ?? EMPTY;
+        return nestedByOwner.get(ownerNodeId)?.get(simpleName) ?? EMPTY;
     };
     const registerClass = (name, qualifiedName, def) => {
         const existing = classByName.get(name);
@@ -52,13 +52,17 @@ export const createTypeRegistry = () => {
         }
     };
     const registerByOwner = (ownerNodeId, simpleName, def) => {
-        const key = `${ownerNodeId}\0${simpleName}`;
-        const existing = nestedByOwner.get(key);
+        let byName = nestedByOwner.get(ownerNodeId);
+        if (!byName) {
+            byName = new Map();
+            nestedByOwner.set(ownerNodeId, byName);
+        }
+        const existing = byName.get(simpleName);
         if (existing) {
             existing.push(def);
         }
         else {
-            nestedByOwner.set(key, [def]);
+            byName.set(simpleName, [def]);
         }
     };
     const clear = () => {

package/dist/core/ingestion/scope-resolution/graph-bridge/ids.js

@@ -22,6 +22,15 @@ import { isOverloadableCallable, isPositionQualifiedLocalLabel, } from '../../ut
 import { templateConstraintsIdTag } from '../../utils/template-arguments.js';
 import { parameterShapeIdTag } from '../../utils/method-props.js';
 import { definitionIdPosition } from '../utils/definition-id.js';
+const defGraphIdMemoByLookup = new WeakMap();
+const isResolveDefGraphIdMemoEnabled = () => {
+    const raw = process.env.GITNEXUS_RESOLVE_DEF_GRAPH_ID_MEMO;
+    if (raw === undefined || raw.trim() === '')
+        return true;
+    const value = raw.trim().toLowerCase();
+    return value !== '0' && value !== 'false' && value !== 'off' && value !== 'no';
+};
+const defGraphIdMemoKey = (filePath, def) => `${filePath}\0${def.nodeId ?? ''}\0${def.type ?? ''}\0${def.qualifiedName ?? ''}\0${def.parameterCount ?? ''}\0${(def.parameterTypes ?? []).join(',')}\0${(def.parameterTypeClasses ?? []).join(',')}\0${def.namespacePrefix ?? ''}\0${(def.templateArguments ?? []).join(',')}\0${templateConstraintsIdTag(def.templateConstraints)}`;
 /**
  * Labels that may legitimately ANCHOR a CALLS/ACCESSES edge as the
  * source ("caller"). A Variable / Property can be the TARGET of an
@@ -188,6 +197,25 @@ function siblingCallableLabel(label) {
     return undefined;
 }
 export function resolveDefGraphId(filePath, def, nodeLookup) {
+    if (!isResolveDefGraphIdMemoEnabled()) {
+        return resolveDefGraphIdUncached(filePath, def, nodeLookup);
+    }
+    const qn = def.qualifiedName;
+    if (qn === undefined || qn.length === 0)
+        return undefined;
+    let bucket = defGraphIdMemoByLookup.get(nodeLookup);
+    if (bucket === undefined) {
+        bucket = new Map();
+        defGraphIdMemoByLookup.set(nodeLookup, bucket);
+    }
+    const key = defGraphIdMemoKey(filePath, def);
+    if (bucket.has(key))
+        return bucket.get(key);
+    const resolved = resolveDefGraphIdUncached(filePath, def, nodeLookup);
+    bucket.set(key, resolved);
+    return resolved;
+}
+function resolveDefGraphIdUncached(filePath, def, nodeLookup) {
     const qn = def.qualifiedName;
     if (qn === undefined || qn.length === 0)
         return undefined;

package/dist/core/ingestion/scope-resolution/passes/callable-value-flow.d.ts

@@ -3,7 +3,7 @@
  * values. Providers own syntax recognition; this pass consumes only the
  * JSON-safe facts carried by ParsedFile.
  */
-import type { ParsedFile, SymbolDefinition } from '../../../../_shared/index.js';
+import type { CallableFlowExpectedSignature, ParsedFile, SymbolDefinition } from '../../../../_shared/index.js';
 import type { KnowledgeGraph } from '../../../graph/types.js';
 import type { ScopeResolutionIndexes } from '../../model/scope-resolution-indexes.js';
 import type { GraphNodeLookup } from '../graph-bridge/node-lookup.js';
@@ -44,6 +44,14 @@ export interface EmitCallableValueFlowInput {
     readonly isCallableValueTarget?: (def: SymbolDefinition) => boolean;
     readonly hasFileLocalCallableLinkage?: (def: SymbolDefinition) => boolean;
     readonly onWarn?: (warning: CallableValueFlowWarning) => void;
+    /** When set, skip a second `collectDeferredIndirectSites` walk. */
+    readonly deferredIndirectSites?: ReadonlySet<string>;
+    /** When set, skip a second `referenceSites` signature walk. */
+    readonly callSignaturesBySite?: ReadonlyMap<string, CallableFlowExpectedSignature>;
+}
+export interface DeferredIndirectCollection {
+    readonly sites: ReadonlySet<string>;
+    readonly callSignaturesBySite: ReadonlyMap<string, CallableFlowExpectedSignature>;
 }
 /** Position key shared with the existing free/reference skip-set contract. */
 export declare function callableFlowSiteKey(filePath: string, range: {
@@ -55,6 +63,8 @@ export declare function callableFlowSiteKey(filePath: string, range: {
  * Malformed/stale facts never suppress ordinary resolution.
  */
 export declare function collectDeferredIndirectSites(parsedFiles: readonly ParsedFile[], scopes?: ScopeResolutionIndexes): ReadonlySet<string>;
+/** One `referenceSites` walk for deferred keys and call-signature evidence. */
+export declare function collectDeferredIndirectCollection(parsedFiles: readonly ParsedFile[], scopes?: ScopeResolutionIndexes): DeferredIndirectCollection;
 export declare function emitCallableValueFlow(input: EmitCallableValueFlowInput): CallableValueFlowResult;
 /**
  * Pure — exported for `bench/callable-value-flow/measure.mjs`, which guards its

package/dist/core/ingestion/scope-resolution/passes/callable-value-flow.js

@@ -28,7 +28,12 @@ export function callableFlowSiteKey(filePath, range) {
  * Malformed/stale facts never suppress ordinary resolution.
  */
 export function collectDeferredIndirectSites(parsedFiles, scopes) {
+    return collectDeferredIndirectCollection(parsedFiles, scopes).sites;
+}
+/** One `referenceSites` walk for deferred keys and call-signature evidence. */
+export function collectDeferredIndirectCollection(parsedFiles, scopes) {
     const out = new Set();
+    const callSignaturesBySite = new Map();
     const flowCells = new Set();
     if (scopes !== undefined) {
         for (const parsed of parsedFiles) {
@@ -41,9 +46,24 @@ export function collectDeferredIndirectSites(parsedFiles, scopes) {
         }
     }
     for (const parsed of parsedFiles) {
-        const canonical = new Set(parsed.referenceSites
-            .filter((site) => site.kind === 'call')
-            .map((site) => callableFlowSiteKey(parsed.filePath, site.atRange)));
+        const canonical = new Set();
+        for (const site of parsed.referenceSites) {
+            if (site.kind !== 'call')
+                continue;
+            const key = callableFlowSiteKey(parsed.filePath, site.atRange);
+            canonical.add(key);
+            const signature = {
+                ...(site.arity !== undefined ? { parameterCount: site.arity } : {}),
+                ...(site.argumentTypes !== undefined ? { parameterTypes: site.argumentTypes } : {}),
+                ...(site.argumentTypeClasses !== undefined
+                    ? { parameterTypeClasses: site.argumentTypeClasses }
+                    : {}),
+            };
+            const previous = callSignaturesBySite.get(key);
+            if (previous === undefined || signatureEvidence(signature) > signatureEvidence(previous)) {
+                callSignaturesBySite.set(key, signature);
+            }
+        }
         for (const site of parsed.callableFlowSites ?? []) {
             if (site.kind !== 'invoke')
                 continue;
@@ -58,7 +78,7 @@ export function collectDeferredIndirectSites(parsedFiles, scopes) {
             }
         }
     }
-    return out;
+    return { sites: out, callSignaturesBySite };
 }
 function flowCellOperand(site) {
     switch (site.kind) {
@@ -80,7 +100,7 @@ function flowCellOperand(site) {
 export function emitCallableValueFlow(input) {
     const facts = [];
     const invokes = [];
-    const canonicalInvokeKeys = collectDeferredIndirectSites(input.parsedFiles, input.scopes);
+    const canonicalInvokeKeys = input.deferredIndirectSites ?? collectDeferredIndirectSites(input.parsedFiles, input.scopes);
     let unmatchedInvokes = 0;
     for (const parsed of input.parsedFiles) {
         for (const site of parsed.callableFlowSites ?? []) {
@@ -347,7 +367,7 @@ export function emitCallableValueFlow(input) {
         addAddress(bindingKey(fact.filePath, fact.site.destination), bindingKey(fact.filePath, fact.site.source), `address:${fact.filePath}:${fact.site.source.name}`);
     }
     const formalsByGraphId = indexFormalsByGraphId(input.parsedFiles, input.scopes, input.nodeLookup, targetIndexes, aliasesByTargetId);
-    const callSignaturesBySite = indexCallSignatures(input.parsedFiles);
+    const callSignaturesBySite = input.callSignaturesBySite ?? indexCallSignatures(input.parsedFiles);
     const dynamicCallees = new Map();
     const dynamicOverflow = new Set();
     const dynamicTargetHistory = new Map();

package/dist/core/ingestion/scope-resolution/pipeline/run.js

@@ -49,7 +49,7 @@ import { emitReturnShapeMemberAccesses } from '../passes/return-shape-members.js
 import { emitImportedValueReferences } from '../passes/imported-value-refs.js';
 import { createCalleeIdAccumulator, } from '../graph-bridge/callee-id-sink.js';
 import { emitImportEdges } from '../graph-bridge/imports-to-edges.js';
-import { callableFlowSiteKey, collectDeferredIndirectSites, emitCallableValueFlow, } from '../passes/callable-value-flow.js';
+import { callableFlowSiteKey, collectDeferredIndirectCollection, emitCallableValueFlow, } from '../passes/callable-value-flow.js';
 import { findEnclosingClassDef, resolveInheritanceBaseInScope } from '../scope/walkers.js';
 import { heritageTypeArgumentsKey, } from '../utils/generic-instantiation.js';
 import { buildWorkspaceResolutionIndex } from '../workspace-index.js';
@@ -614,7 +614,8 @@ export function runScopeResolution(input, provider) {
     // ── Phase 4: emit graph edges (LOAD-BEARING ORDER — see I1) ────────────
     input.onProgress?.('linking symbols', files.length, files.length);
     const handledSites = new Set(preEmittedInheritanceSites);
-    const deferredIndirectSites = collectDeferredIndirectSites(emitParsedFiles, indexes);
+    const deferredIndirectCollection = collectDeferredIndirectCollection(emitParsedFiles, indexes);
+    const deferredIndirectSites = deferredIndirectCollection.sites;
     const callableArgumentSites = new Set();
     if (input.pdg !== true && deferredIndirectSites.size > 0) {
         for (const parsed of emitParsedFiles) {
@@ -788,6 +789,8 @@ export function runScopeResolution(input, provider) {
             collapseByCallerTarget: provider.collapseMemberCallsByCallerTarget === true,
             isCallableValueTarget: provider.isCallableValueTarget,
             hasFileLocalCallableLinkage: provider.hasFileLocalCallableLinkage,
+            deferredIndirectSites,
+            callSignaturesBySite: deferredIndirectCollection.callSignaturesBySite,
             onWarn: (warning) => logger.warn(warning, 'callable-value-flow: candidate set exceeded the cap; no partial CALLS emitted'),
         });
     const importsEmitted = callableFlowOnly

package/dist/core/lbug/csv-generator.js

@@ -152,14 +152,15 @@ export const isBinaryContent = (content) => {
     }
     return nonPrintable / end > 0.1;
 };
+const EMPTY_PREPARED = { content: '', lines: [''], isBinary: false };
 /**
  * LRU content cache — avoids re-reading the same source file for every
  * symbol defined in it. Sized generously so most files stay cached during
- * the single-pass node iteration.
+ * the single-pass node iteration. Insertion order on the Map is LRU
+ * (delete+set on touch).
  */
 class FileContentCache {
     cache = new Map();
-    accessOrder = [];
     maxSize;
     repoPath;
     constructor(repoPath, maxSize = 3000) {
@@ -168,36 +169,36 @@ class FileContentCache {
     }
     async get(relativePath) {
         if (!relativePath)
-            return '';
+            return EMPTY_PREPARED;
         const cached = this.cache.get(relativePath);
         if (cached !== undefined) {
-            // Move to end of accessOrder (LRU promotion)
-            const idx = this.accessOrder.indexOf(relativePath);
-            if (idx !== -1) {
-                this.accessOrder.splice(idx, 1);
-                this.accessOrder.push(relativePath);
-            }
+            this.cache.delete(relativePath);
+            this.cache.set(relativePath, cached);
             return cached;
         }
         try {
             const fullPath = path.join(this.repoPath, relativePath);
             const content = await fs.readFile(fullPath, 'utf-8');
-            this.set(relativePath, content);
-            return content;
+            const prepared = {
+                content,
+                lines: content.split('\n'),
+                isBinary: isBinaryContent(content),
+            };
+            this.set(relativePath, prepared);
+            return prepared;
         }
         catch {
-            this.set(relativePath, '');
-            return '';
+            this.set(relativePath, EMPTY_PREPARED);
+            return EMPTY_PREPARED;
         }
     }
     set(key, value) {
-        if (this.cache.size >= this.maxSize) {
-            const oldest = this.accessOrder.shift();
-            if (oldest)
+        if (this.cache.size >= this.maxSize && !this.cache.has(key)) {
+            const oldest = this.cache.keys().next().value;
+            if (oldest !== undefined)
                 this.cache.delete(oldest);
         }
         this.cache.set(key, value);
-        this.accessOrder.push(key);
     }
 }
 /**
@@ -247,12 +248,13 @@ const formatFtsDescription = (description) => isBinaryContent(description) ? ''
 const EXACT_SYMBOL_CONTENT_LABELS = SYMBOL_NODE_LABELS;
 const extractContent = async (node, contentCache) => {
     const filePath = node.properties.filePath;
-    const content = await contentCache.get(filePath);
+    const prepared = await contentCache.get(filePath);
+    const content = prepared.content;
     if (!content)
         return '';
     if (node.label === 'Folder')
         return '';
-    if (isBinaryContent(content))
+    if (prepared.isBinary)
         return '[Binary file - content not stored]';
     // File content is stored in full — intentionally NOT length-capped here, so
     // text past the old 10KB cutoff stays FTS-searchable (#2317). It is already
@@ -266,7 +268,7 @@ const extractContent = async (node, contentCache) => {
     const endLine = node.properties.endLine;
     if (startLine === undefined || endLine === undefined)
         return '';
-    const lines = content.split('\n');
+    const lines = prepared.lines;
     const exactSymbolContent = EXACT_SYMBOL_CONTENT_LABELS.has(node.label);
     const start = Math.max(0, exactSymbolContent ? startLine : startLine - 2);
     const end = Math.min(lines.length - 1, exactSymbolContent ? endLine : endLine + 2);

package/dist/core/run-analyze.js

@@ -41,6 +41,7 @@ import { taintModelVersion } from './ingestion/taint/typescript-model.js';
 import { parseTruthyEnv, parsePositiveIntEnv } from './ingestion/utils/env.js';
 import { computeFileHashes, diffFileHashes } from '../storage/file-hash.js';
 import { extractChangedSubgraph, computeEffectiveWriteSet, } from './incremental/subgraph-extract.js';
+import { collectSpringConfigConsumerDriftFiles, } from './incremental/spring-config-drift.js';
 import { shadowCandidatesFor } from './incremental/shadow-candidates.js';
 import { shouldEscalateIncrementalWrite } from './incremental/escalation-gate.js';
 import { ftsTablesAmong, incrementalFtsTablesFromGraph, nodeTablesForIncrementalDelete, shouldPreservePersistedDerivedGraph, } from './incremental/derived-writeback.js';
@@ -55,6 +56,8 @@ import { sanitizeDetectedBranch } from '../cli/analyze-config.js';
 import { EMBEDDING_TABLE_NAME, EMBEDDING_DIMS, STALE_HASH_SENTINEL, SCHEMA_FINGERPRINT, schemaFingerprintMismatch, isSchemaFingerprintShaped, embeddingDimsMismatch, } from './lbug/schema.js';
 import { isSpringBeanCandidateSourceFile } from './ingestion/frameworks/spring/bean-catalog.js';
 import { isSpringBeanFactoryDeclaration } from './ingestion/frameworks/spring/bean-factories.js';
+import { SPRING_CONFIG_UNRESOLVED_PREFIX } from './ingestion/frameworks/spring/config-bindings.js';
+import { classifySpringConfigFile } from './ingestion/pipeline-phases/spring-config.js';
 import { SPRING_AOP_FEATURE, SPRING_BEAN_INVENTORY_FEATURE, SPRING_CONDITIONALS_FEATURE, SPRING_NON_HTTP_HANDLERS_FEATURE, } from './ingestion/frameworks/spring/analysis-features.js';
 import { JAVA_ENUM_INTERFACE_HERITAGE_FEATURE, JAVA_RECORD_COMPONENT_ACCESSORS_FEATURE, SPRING_CONFIG_BINDINGS_FEATURE, } from './ingestion/languages/java/analysis-features.js';
 import { CLASS_FRAMEWORK_ANNOTATIONS_FEATURE, findAnalysisFeatureMismatches, resolveAnalysisFeatureVersions, } from './analysis-features.js';
@@ -1812,6 +1815,29 @@ async function runFullAnalysisInner(repoPath, options, callbacks, writeTarget, r
             //    and extractChangedSubgraph — asymmetry between the two would
             //    leave stale rows or PK-conflict at COPY time.
             const effectiveWriteSet = computeEffectiveWriteSet(pipelineResult.graph, writableFiles);
+            const springConfigChanged = hashDiff.toWrite.some((filePath) => classifySpringConfigFile(filePath) !== null) ||
+                hashDiff.deleted.some((filePath) => classifySpringConfigFile(filePath) !== null);
+            if (springConfigChanged) {
+                const unresolvedPrefix = escapeCypherString(SPRING_CONFIG_UNRESOLVED_PREFIX);
+                const persistedSpringConfigConsumers = (await executeQuery('MATCH (n:Property) ' +
+                    `WHERE n.description CONTAINS '${unresolvedPrefix}' ` +
+                    'RETURN n.id AS id, n.description AS description ' +
+                    'UNION ALL ' +
+                    'MATCH (n:Class) ' +
+                    `WHERE n.description CONTAINS '${unresolvedPrefix}' ` +
+                    'RETURN n.id AS id, n.description AS description ' +
+                    'UNION ALL ' +
+                    'MATCH (n:Record) ' +
+                    `WHERE n.description CONTAINS '${unresolvedPrefix}' ` +
+                    'RETURN n.id AS id, n.description AS description'));
+                const springConfigConsumerDriftFiles = collectSpringConfigConsumerDriftFiles(pipelineResult.graph, persistedSpringConfigConsumers);
+                for (const filePath of springConfigConsumerDriftFiles)
+                    effectiveWriteSet.add(filePath);
+                if (springConfigConsumerDriftFiles.size > 0) {
+                    log(`Incremental: +${springConfigConsumerDriftFiles.size} file(s) added for ` +
+                        'Spring config consumer property drift');
+                }
+            }
             // `frameworkAnnotations` is derived from cross-file JVM visibility, so
             // an unchanged Class row can change when a same-package declaration is
             // added or removed without producing an IMPORTS edge. Compare the fresh

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gitnexus",
-  "version": "1.6.11-rc.27",
+  "version": "1.6.11-rc.29",
   "description": "Graph-powered code intelligence for AI agents. Index any codebase, query via MCP or CLI.",
   "author": "Abhigyan Patwari",
   "license": "PolyForm-Noncommercial-1.0.0",