gitnexus 1.6.11-rc.36 → 1.6.11-rc.38

package/README.md

@@ -349,6 +349,12 @@ anchors are deliberately omitted. Add common infrastructure fields such as `/hea
 
 `--spring-actuator` is explicitly opt-in. The path may be a JSON bundle keyed by `mappings`, `beans`, `conditions`, `configprops`, and/or `env`, or a directory containing endpoint-named JSON files. Runtime mappings and beans confirm matching static nodes; conditions and configuration property keys enrich existing evidence, with conservative runtime-only nodes added when no match exists. The configured input is excluded from source scanning; only normalized repository-relative exclusions are retained for future scans, never absolute paths. Env/configprops values, origins, condition messages, and source names are never persisted or printed. Enabled runs always rebuild because runtime snapshots are external to git freshness; omitting the option later rebuilds once to remove runtime evidence. Project config can set the same path with `springActuator` in `.gitnexusrc`.
 
+`--asyncapi-spec` is explicitly opt-in and accepts a directory of AsyncAPI documents or a single document; the path is resolved against the repository root, so a committed `docs/asyncapi` and an absolute cache written by something else both work. Each `operations[]` entry of an **AsyncAPI 3.x** document can contribute a `Destination` node keyed by broker and address, with `action: send` emitting `PUBLISHES_TO` and `action: receive` emitting `CONSUMES_FROM`, so a document and source code that name one address on one broker land on the same node. Edges start at the document, not at a callable — a document states that the service talks to an address, not which method does — and no address a document names is ever attached to an unresolved source site.
+
+An operation must name a protocol, either through its own `bindings` or through the `servers[].protocol` of the servers its channel resolves to (a channel that lists no `servers` resolves to all of them); operations that name none are refused, as are operations whose two readings name different brokers, and channels that inherit a multi-protocol server set without choosing. HTTP and WebSocket documents are refused for destination minting: there the host rather than the address names the place, and an HTTP endpoint is already modelled as a `Route`. A parameterized address — a channel declaring `parameters`, or an address containing `{` — is refused rather than keyed: two services publishing `{env}.orders` share a pattern, not a queue. AsyncAPI **2.x is refused** under its own counted reason and never mapped, because its `publish`/`subscribe` are inverted relative to 3.x `send`/`receive` and a naive mapping would reverse the async graph while leaving it connected. Every refusal is counted, and a configured path that yields nothing is reported rather than passed over in silence.
+
+Like Actuator snapshots, documents are external to git freshness — replacing one moves no commit and dirties no file — so an enabled run always rebuilds, and the first later run without the option rebuilds once to remove document-derived evidence. There is no glob-based auto-discovery, and the option is unsupported with `--watch`.
+
 > **`gitnexus uninstall`** reverses `gitnexus setup` — it removes the GitNexus MCP entries, hooks, and skill directories it added to each detected editor. Skill directories are identified **by bundled gitnexus skill name** (e.g. `gitnexus-cli/`), so if you customized files inside an installed skill directory, back them up first. It is a dry-run preview by default and prints the exact paths it would remove; pass `--force` to apply. Per-repo indexes (`gitnexus clean --all`) and the global npm package (`npm uninstall -g gitnexus`) are left for you to remove.
 
 ## Remote Embeddings

package/dist/cli/analyze-options.d.ts

@@ -129,6 +129,13 @@ export interface AnalyzeOptions {
      * bundle or a directory containing endpoint JSON files. Disabled by default.
      */
     springActuator?: string;
+    /**
+     * Explicit local AsyncAPI 3.x document input. Accepts a directory of
+     * documents or a single document, resolved against the repository root so an
+     * out-of-band cache and a committed directory are equally usable. Disabled by
+     * default.
+     */
+    asyncapiSpec?: string;
     /** OpenAI-compatible embeddings base URL (incl. /v1). Overrides GITNEXUS_EMBEDDING_URL. */
     embeddingBaseUrl?: string;
     /** Embedding model name. Overrides GITNEXUS_EMBEDDING_MODEL. */

package/dist/cli/analyze-watch.js

@@ -76,6 +76,11 @@ export async function resolveWatchOptions(repoPath, cli, baseline, reportIgnored
         ['--index-only', cli.indexOnly],
         ['--skip-git', cli.skipGit],
         ['--spring-actuator', cli.springActuator],
+        // Rejected under --watch for the same reason as --spring-actuator: the
+        // watcher reacts to source changes, and nothing watches an out-of-band
+        // document directory. Honouring the flag here would read the documents once
+        // and then quietly serve a stale answer for the rest of the session.
+        ['--asyncapi-spec', cli.asyncapiSpec],
         ['walCheckpointThreshold', cli.walCheckpointThreshold],
         ['embeddingThreads', cli.embeddingThreads],
         ['embeddingBatchSize', cli.embeddingBatchSize],

package/dist/cli/analyze.js

@@ -786,6 +786,16 @@ const analyzeCommandImpl = async (inputPath, cliOptions, runnerIdentityAtBootstr
         !setPositiveEnv('--embedding-sub-batch-size', 'GITNEXUS_EMBEDDING_SUB_BATCH_SIZE', options.embeddingSubBatchSize)) {
         return;
     }
+    // An empty value resolves to the repository root, so `--asyncapi-spec ""`
+    // walks the whole tree — defeating the module's own rule that there is no
+    // glob-based auto-discovery, and spending the walk budget on `node_modules`.
+    // The HTTP entry point already rejects exactly this value; two doors onto one
+    // option must not hold different rules.
+    if (options.asyncapiSpec !== undefined && options.asyncapiSpec.trim() === '') {
+        cliError('  --asyncapi-spec must be a non-empty path.\n');
+        process.exitCode = 1;
+        return;
+    }
     if (options.embeddingDevice) {
         const allowed = new Set(['auto', 'cpu', 'dml', 'cuda', 'wasm']);
         if (!allowed.has(options.embeddingDevice)) {
@@ -1115,6 +1125,7 @@ const analyzeCommandImpl = async (inputPath, cliOptions, runnerIdentityAtBootstr
             // forwarded to the routes phase consumer scan.
             fetchWrappers: options.fetchWrappers,
             springActuatorPath: options.springActuator,
+            asyncApiSpecPath: options.asyncapiSpec,
             // The CLI always process.exit()s after this returns (success path at the
             // end of analyzeCommandImpl, error/interrupt paths via process.exit too),
             // so the finalize close skips the native conn/db close — it can double-free

package/dist/cli/index.js

@@ -85,6 +85,8 @@ program
     .option('--workers <n>', 'Parse worker pool size (>=1). Default: cores-1 capped at 16, auto-sized to the repo.')
     .option('--spring-actuator <path>', 'Import local Spring Boot Actuator JSON snapshots (mappings, beans, conditions, ' +
     'configprops, env). Explicit opt-in; disabled by default.')
+    .option('--asyncapi-spec <path>', 'Read AsyncAPI 3.x documents from this directory or file and resolve broker ' +
+    'addresses from them. Explicit opt-in; disabled by default.')
     .option('--embedding-threads <n>', 'Limit local ONNX embedding CPU threads')
     .option('--embedding-batch-size <n>', 'Number of nodes per embedding batch')
     .option('--embedding-sub-batch-size <n>', 'Number of chunks per embedding model call')

package/dist/core/analysis-feature-registry.d.ts

@@ -0,0 +1,2 @@
+/** Production registry of independently versioned analysis capabilities. */
+export declare const ANALYSIS_FEATURES: readonly [import("./analysis-features.js").AnalysisFeatureDescriptor, import("./analysis-features.js").AnalysisFeatureDescriptor, import("./analysis-features.js").AnalysisFeatureDescriptor, import("./analysis-features.js").AnalysisFeatureDescriptor, import("./analysis-features.js").AnalysisFeatureDescriptor, import("./analysis-features.js").AnalysisFeatureDescriptor, import("./analysis-features.js").AnalysisFeatureDescriptor, import("./analysis-features.js").AnalysisFeatureDescriptor, import("./analysis-features.js").AnalysisFeatureDescriptor];

package/dist/core/analysis-feature-registry.js

@@ -0,0 +1,15 @@
+import { CLASS_FRAMEWORK_ANNOTATIONS_FEATURE } from './analysis-features.js';
+import { SPRING_AOP_FEATURE, SPRING_BEAN_INVENTORY_FEATURE, SPRING_CONDITIONALS_FEATURE, SPRING_NON_HTTP_HANDLERS_FEATURE, SPRING_ROUTE_BINDINGS_FEATURE, } from './ingestion/frameworks/spring/analysis-features.js';
+import { JAVA_ENUM_INTERFACE_HERITAGE_FEATURE, JAVA_RECORD_COMPONENT_ACCESSORS_FEATURE, SPRING_CONFIG_BINDINGS_FEATURE, } from './ingestion/languages/java/analysis-features.js';
+/** Production registry of independently versioned analysis capabilities. */
+export const ANALYSIS_FEATURES = [
+    CLASS_FRAMEWORK_ANNOTATIONS_FEATURE,
+    SPRING_AOP_FEATURE,
+    SPRING_BEAN_INVENTORY_FEATURE,
+    SPRING_CONDITIONALS_FEATURE,
+    SPRING_NON_HTTP_HANDLERS_FEATURE,
+    SPRING_ROUTE_BINDINGS_FEATURE,
+    SPRING_CONFIG_BINDINGS_FEATURE,
+    JAVA_ENUM_INTERFACE_HERITAGE_FEATURE,
+    JAVA_RECORD_COMPONENT_ACCESSORS_FEATURE,
+];

package/dist/core/group/extractors/http-patterns/java.js

@@ -1,6 +1,6 @@
 import Java from 'tree-sitter-java';
 import { compilePatterns, runCompiledPatterns, unquoteLiteral, } from '../tree-sitter-scanner.js';
-import { springAnnotationHttpMethods, intersectSpringHttpMethods, isRouteMemberKey, findEnclosingClass, joinPath, } from '../../../ingestion/route-extractors/spring-shared.js';
+import { springAnnotationHttpMethods, intersectSpringHttpMethods, isRouteMemberKey, findEnclosingClass, isClassLevelMappingAnnotation, joinPath, } from '../../../ingestion/route-extractors/spring-shared.js';
 import { REST_TEMPLATE_TO_HTTP, WEB_CLIENT_SHORT_TO_HTTP, WEB_CLIENT_LONG_VERB_RE, EXCHANGE_ANNOTATION_TO_HTTP, parseRequestLine, pushPrefix, scanSpringInheritanceProject, OPENFEIGN_FRAMEWORK, HTTP_INTERFACE_FRAMEWORK, FEIGN_CONFIDENCE, REQUEST_LINE_CONFIDENCE, EXCHANGE_CONFIDENCE, } from './spring-consumer-shared.js';
 import { expandJavaWildcardStaticImports, extractJavaModuleConstants, foldJavaOperands, isJavaConstantFile, parseJavaConstOperands, prepareJavaRouteConstants, } from '../../../ingestion/route-extractors/java-const-resolver.js';
 import { extractStaticPathExpression, inferOkHttpMethod, inferHttpClientMethod, okHttpUrlRootsAtBuilder, httpClientUriRootsAtNewBuilder, httpClientChainHasUriCall, } from './java-static-path.js';
@@ -394,12 +394,12 @@ function annotationHasRouteMember(annotation) {
     return false;
 }
 function typeRequestMethods(typeNode) {
-    const mappings = declarationAnnotations(typeNode).filter((annotation) => simpleName(annotation.childForFieldName('name')?.text ?? '') === 'RequestMapping');
+    const mappings = declarationAnnotations(typeNode).filter((annotation) => isClassLevelMappingAnnotation(simpleName(annotation.childForFieldName('name')?.text ?? '')));
     if (mappings.length === 0)
         return ['*'];
     if (mappings.length !== 1)
         return [];
-    return springAnnotationHttpMethods('RequestMapping', mappings[0].text);
+    return springAnnotationHttpMethods(simpleName(mappings[0].childForFieldName('name')?.text ?? 'RequestMapping'), mappings[0].text);
 }
 function hasAnnotation(node, names) {
     const modifiers = node.namedChildren.find((child) => child.type === 'modifiers');
@@ -551,7 +551,7 @@ function scanRouteAnnotations(tree) {
         }
         // Type-level (class or interface): a Spring `@RequestMapping` URL prefix, or
         // — on an interface — an OpenFeign `@FeignClient(path = "...")` prefix.
-        if (ann === 'RequestMapping') {
+        if (isClassLevelMappingAnnotation(ann)) {
             if (!isRouteMemberKey(keyNode))
                 continue;
             if (!valueNode) {

package/dist/core/group/extractors/http-patterns/kotlin.js

@@ -1,6 +1,6 @@
 import { requireVendoredGrammar } from '../../../tree-sitter/vendored-grammars.js';
 import { compilePatterns, runCompiledPatterns, unquoteLiteral, } from '../tree-sitter-scanner.js';
-import { METHOD_ANNOTATION_TO_HTTP, findEnclosingClass, joinPath, } from '../../../ingestion/route-extractors/spring-shared.js';
+import { findEnclosingClass, intersectSpringHttpMethods, isClassLevelMappingAnnotation, joinPath, springAnnotationHttpMethods, } from '../../../ingestion/route-extractors/spring-shared.js';
 import { buildKotlinConstantIndex, extractKotlinModuleConstants, foldKotlinOperands, isKotlinConstantFile, overlayKotlinConstantIndex, parseKotlinConstOperands, unfoldableDeclarationsOf, unquoteKotlinIdentifier, } from '../../../ingestion/route-extractors/kotlin-const-resolver.js';
 import { REST_TEMPLATE_TO_HTTP, WEB_CLIENT_SHORT_TO_HTTP, WEB_CLIENT_LONG_VERB_RE, EXCHANGE_ANNOTATION_TO_HTTP, parseRequestLine, pushPrefix, scanSpringInheritanceProject, OPENFEIGN_FRAMEWORK, HTTP_INTERFACE_FRAMEWORK, FEIGN_CONFIDENCE, REQUEST_LINE_CONFIDENCE, EXCHANGE_CONFIDENCE, } from './spring-consumer-shared.js';
 /**
@@ -392,6 +392,13 @@ function inferKotlinOkHttpMethod(urlCall) {
     }
     return name === null ? 'GET' : name.toUpperCase();
 }
+function enclosingAnnotationText(node) {
+    for (let current = node; current; current = current.parent) {
+        if (current.type === 'annotation')
+            return current.text;
+    }
+    return node.text;
+}
 /**
  * Build the plugin only if the Kotlin grammar is available. Compiling
  * the queries against a null grammar would throw at module load time
@@ -429,7 +436,7 @@ function buildKotlinPlugin(language) {
             (modifiers
               (annotation
                 (constructor_invocation
-                  (user_type (type_identifier) @ann (#eq? @ann "RequestMapping"))
+                  (user_type (type_identifier) @ann (#match? @ann "RequestMapping$"))
                   (value_arguments
                     (value_argument . [(string_literal) @prefix (collection_literal (string_literal) @prefix)])))))
             (type_identifier) @cls) @class
@@ -442,7 +449,7 @@ function buildKotlinPlugin(language) {
             (modifiers
               (annotation
                 (constructor_invocation
-                  (user_type (type_identifier) @ann (#eq? @ann "RequestMapping"))
+                  (user_type (type_identifier) @ann (#match? @ann "RequestMapping$"))
                   (value_arguments
                     (value_argument
                       (simple_identifier) @key (#match? @key "^(path|value)$")
@@ -457,7 +464,7 @@ function buildKotlinPlugin(language) {
             (modifiers
               (annotation
                 (constructor_invocation
-                  (user_type (type_identifier) @ann (#eq? @ann "RequestMapping"))
+                  (user_type (type_identifier) @ann (#match? @ann "RequestMapping$"))
                   (value_arguments
                     (value_argument . ${arrayOfArg('@prefix')})))))
             (type_identifier) @cls) @class
@@ -470,7 +477,7 @@ function buildKotlinPlugin(language) {
             (modifiers
               (annotation
                 (constructor_invocation
-                  (user_type (type_identifier) @ann (#eq? @ann "RequestMapping"))
+                  (user_type (type_identifier) @ann (#match? @ann "RequestMapping$"))
                   (value_arguments
                     (value_argument
                       (simple_identifier) @key (#match? @key "^(path|value)$")
@@ -495,7 +502,7 @@ function buildKotlinPlugin(language) {
             (modifiers
               (annotation
                 (constructor_invocation
-                  (user_type (type_identifier) @ann (#match? @ann "^(Get|Post|Put|Delete|Patch)Mapping$"))
+                  (user_type (type_identifier) @ann (#match? @ann "(Request|Get|Post|Put|Delete|Patch)Mapping$"))
                   (value_arguments
                     (value_argument . [(string_literal) @path (collection_literal (string_literal) @path)])))))
             (simple_identifier) @method_name) @method
@@ -508,7 +515,7 @@ function buildKotlinPlugin(language) {
             (modifiers
               (annotation
                 (constructor_invocation
-                  (user_type (type_identifier) @ann (#match? @ann "^(Get|Post|Put|Delete|Patch)Mapping$"))
+                  (user_type (type_identifier) @ann (#match? @ann "(Request|Get|Post|Put|Delete|Patch)Mapping$"))
                   (value_arguments
                     (value_argument
                       (simple_identifier) @key (#match? @key "^(path|value)$")
@@ -523,7 +530,7 @@ function buildKotlinPlugin(language) {
             (modifiers
               (annotation
                 (constructor_invocation
-                  (user_type (type_identifier) @ann (#match? @ann "^(Get|Post|Put|Delete|Patch)Mapping$"))
+                  (user_type (type_identifier) @ann (#match? @ann "(Request|Get|Post|Put|Delete|Patch)Mapping$"))
                   (value_arguments
                     (value_argument . ${arrayOfArg('@path')})))))
             (simple_identifier) @method_name) @method
@@ -536,7 +543,7 @@ function buildKotlinPlugin(language) {
             (modifiers
               (annotation
                 (constructor_invocation
-                  (user_type (type_identifier) @ann (#match? @ann "^(Get|Post|Put|Delete|Patch)Mapping$"))
+                  (user_type (type_identifier) @ann (#match? @ann "(Request|Get|Post|Put|Delete|Patch)Mapping$"))
                   (value_arguments
                     (value_argument
                       (simple_identifier) @key (#match? @key "^(path|value)$")
@@ -571,7 +578,7 @@ function buildKotlinPlugin(language) {
             (modifiers
               (annotation
                 (constructor_invocation
-                  (user_type (type_identifier) @ann (#eq? @ann "RequestMapping"))
+                  (user_type (type_identifier) @ann (#match? @ann "RequestMapping$"))
                   (value_arguments (value_argument) @arg))))
             (type_identifier) @cls) @class
         `,
@@ -589,7 +596,7 @@ function buildKotlinPlugin(language) {
             (modifiers
               (annotation
                 (constructor_invocation
-                  (user_type (type_identifier) @ann (#match? @ann "^(Get|Post|Put|Delete|Patch)Mapping$"))
+                  (user_type (type_identifier) @ann (#match? @ann "(Request|Get|Post|Put|Delete|Patch)Mapping$"))
                   (value_arguments (value_argument) @arg))))
             (simple_identifier) @method_name) @method
         `,
@@ -649,8 +656,11 @@ function buildKotlinPlugin(language) {
         for (const match of runCompiledPatterns(SPRING_CONST_CLASS_PREFIX_PATTERNS, tree)) {
             const argNode = match.captures.arg;
             const classNode = match.captures.class;
+            const annNode = match.captures.ann;
             if (!argNode || !classNode)
                 continue;
+            if (annNode && !isClassLevelMappingAnnotation(annNode.text))
+                continue;
             if ((resolvedPrefixes.get(classNode.id) ?? []).length > 0)
                 continue;
             const expr = kotlinRouteArgumentExpression(argNode);
@@ -1145,14 +1155,37 @@ function buildKotlinPlugin(language) {
         return body.namedChildren.filter((c) => c.type === 'function_declaration');
     };
     const kotlinFunctionName = (fn) => fn.namedChildren.find((c) => c.type === 'simple_identifier')?.text ?? null;
+    const kotlinTypeRequestMethods = (typeNode) => {
+        const modifiers = typeNode.namedChildren.find((child) => child.type === 'modifiers');
+        const mappings = (modifiers?.namedChildren ?? []).filter((annotation) => {
+            if (annotation.type !== 'annotation')
+                return false;
+            return isClassLevelMappingAnnotation(kotlinAnnotationName(annotation) ?? '');
+        });
+        if (mappings.length === 0)
+            return ['*'];
+        if (mappings.length !== 1)
+            return [];
+        const mapping = mappings[0];
+        const mappingName = kotlinAnnotationName(mapping);
+        if (!mappingName)
+            return [];
+        return springAnnotationHttpMethods(mappingName, mapping.text);
+    };
+    const kotlinClassHttpMethodsById = (tree) => new Map(tree.rootNode
+        .descendantsOfType('class_declaration')
+        .map((typeNode) => [typeNode.id, kotlinTypeRequestMethods(typeNode)]));
     const collectKotlinSpringTypes = (filePath, tree) => {
         // Class-level @RequestMapping prefixes (reuse the provider class-prefix query).
         const prefixByClassId = new Map();
         for (const match of runCompiledPatterns(SPRING_CLASS_PREFIX_PATTERNS, tree)) {
             const prefixNode = match.captures.prefix;
             const classNode = match.captures.class;
+            const annNode = match.captures.ann;
             if (!prefixNode || !classNode)
                 continue;
+            if (annNode && !isClassLevelMappingAnnotation(annNode.text))
+                continue;
             // An INTERPOLATED literal (`"${ApiPaths.BASE}"`) is not a path — unquoting
             // its raw text would carry the source spelling into the shared type view
             // as a served prefix. Refusing it here is also what lets the unfoldable
@@ -1172,6 +1205,7 @@ function buildKotlinPlugin(language) {
         // noise into the shared type view, so it is left out — the same skip floor
         // `java.ts`'s `collectSpringTypes` keeps.
         const routesByMethodId = new Map();
+        const classHttpMethodsById = kotlinClassHttpMethodsById(tree);
         const unfoldablePrefixClassIds = collectUnfoldablePrefixClassIds(tree, prefixByClassId);
         for (const match of runCompiledPatterns(SPRING_METHOD_ROUTE_PATTERNS, tree)) {
             const annNode = match.captures.ann;
@@ -1179,8 +1213,8 @@ function buildKotlinPlugin(language) {
             const methodNode = match.captures.method;
             if (!annNode || !pathNode || !methodNode)
                 continue;
-            const httpMethod = METHOD_ANNOTATION_TO_HTTP[annNode.text];
-            if (!httpMethod)
+            const httpMethods = springAnnotationHttpMethods(annNode.text, enclosingAnnotationText(annNode));
+            if (httpMethods.length === 0)
                 continue;
             const rawPath = unquoteLiteral(pathNode.text);
             if (rawPath === null)
@@ -1190,8 +1224,11 @@ function buildKotlinPlugin(language) {
             const owner = findEnclosingClass(methodNode);
             if (owner && unfoldablePrefixClassIds.has(owner.id))
                 continue;
+            const constrainedMethods = intersectSpringHttpMethods(owner ? (classHttpMethodsById.get(owner.id) ?? ['*']) : ['*'], httpMethods);
             const arr = routesByMethodId.get(methodNode.id) ?? [];
-            arr.push({ method: httpMethod, path: rawPath });
+            for (const httpMethod of constrainedMethods) {
+                arr.push({ method: httpMethod, path: rawPath });
+            }
             routesByMethodId.set(methodNode.id, arr);
         }
         const out = [];
@@ -1319,8 +1356,11 @@ function buildKotlinPlugin(language) {
             for (const match of runCompiledPatterns(SPRING_CLASS_PREFIX_PATTERNS, tree)) {
                 const prefixNode = match.captures.prefix;
                 const classNode = match.captures.class;
+                const annNode = match.captures.ann;
                 if (!prefixNode || !classNode)
                     continue;
+                if (annNode && !isClassLevelMappingAnnotation(annNode.text))
+                    continue;
                 // An INTERPOLATED literal (`"${ApiPaths.BASE}"`) is not a path — see
                 // `isPlainStringLiteral`. Refusing it here also lets the unfoldable
                 // analysis below mark such a class, since that skips classes whose
@@ -1366,24 +1406,27 @@ function buildKotlinPlugin(language) {
             // Literal and constant-valued paths are normalized into one candidate list
             // so both reach the same Feign/interface/prefix classification below.
             const methodRoutes = [];
+            const classHttpMethodsById = kotlinClassHttpMethodsById(tree);
             for (const match of runCompiledPatterns(SPRING_METHOD_ROUTE_PATTERNS, tree)) {
                 const annNode = match.captures.ann;
                 const pathNode = match.captures.path;
                 const methodNode = match.captures.method;
                 if (!annNode || !pathNode || !methodNode)
                     continue;
-                const httpMethod = METHOD_ANNOTATION_TO_HTTP[annNode.text];
-                if (!httpMethod)
+                const httpMethods = springAnnotationHttpMethods(annNode.text, enclosingAnnotationText(annNode));
+                if (httpMethods.length === 0)
                     continue;
                 const rawPath = unquoteLiteral(pathNode.text);
                 if (rawPath === null)
                     continue;
-                methodRoutes.push({
-                    httpMethod,
-                    rawPath,
-                    nameNode: match.captures.method_name,
-                    methodNode,
-                });
+                for (const httpMethod of httpMethods) {
+                    methodRoutes.push({
+                        httpMethod,
+                        rawPath,
+                        nameNode: match.captures.method_name,
+                        methodNode,
+                    });
+                }
             }
             for (const match of runCompiledPatterns(SPRING_CONST_METHOD_ROUTE_PATTERNS, tree)) {
                 const annNode = match.captures.ann;
@@ -1391,8 +1434,8 @@ function buildKotlinPlugin(language) {
                 const methodNode = match.captures.method;
                 if (!annNode || !argNode || !methodNode)
                     continue;
-                const httpMethod = METHOD_ANNOTATION_TO_HTTP[annNode.text];
-                if (!httpMethod)
+                const httpMethods = springAnnotationHttpMethods(annNode.text, enclosingAnnotationText(annNode));
+                if (httpMethods.length === 0)
                     continue;
                 const expr = kotlinRouteArgumentExpression(argNode);
                 if (!expr || !FOLDABLE_PATH_EXPRESSIONS.has(expr.type))
@@ -1413,14 +1456,24 @@ function buildKotlinPlugin(language) {
                 const rawPath = foldKotlinOperands(fileKey, operands, index.repo, kotlinEnclosingTypeNames(methodNode), index);
                 if (rawPath === null)
                     continue;
-                methodRoutes.push({
-                    httpMethod,
-                    rawPath,
-                    nameNode: match.captures.method_name,
-                    methodNode,
-                });
+                for (const httpMethod of httpMethods) {
+                    methodRoutes.push({
+                        httpMethod,
+                        rawPath,
+                        nameNode: match.captures.method_name,
+                        methodNode,
+                    });
+                }
             }
-            for (const { httpMethod, rawPath, nameNode, methodNode } of methodRoutes) {
+            const constrainedMethodRoutes = methodRoutes.flatMap((route) => {
+                const owner = findEnclosingClass(route.methodNode);
+                const classMethods = owner ? (classHttpMethodsById.get(owner.id) ?? ['*']) : ['*'];
+                return intersectSpringHttpMethods(classMethods, [route.httpMethod]).map((httpMethod) => ({
+                    ...route,
+                    httpMethod,
+                }));
+            });
+            for (const { httpMethod, rawPath, nameNode, methodNode } of constrainedMethodRoutes) {
                 const enclosingClass = findEnclosingClass(methodNode);
                 // A @(Get|...)Mapping inside a @FeignClient interface is an OpenFeign
                 // consumer (a remote call), not a route this service serves.

package/dist/core/group/extractors/http-patterns/node.js

@@ -3,7 +3,7 @@ import JavaScript from 'tree-sitter-javascript';
 import TypeScript from 'tree-sitter-typescript';
 import { compilePatterns, runCompiledPatterns, unquoteLiteral, } from '../tree-sitter-scanner.js';
 import { MAX_FOLD_LENGTH } from '../../../ingestion/route-extractors/constant-resolver.js';
-import { DATA_ROUTE_TABLE_SOURCE, scanDataRouteTables, } from '../../../ingestion/route-extractors/data-route-table.js';
+import { DATA_ROUTE_TABLE_SOURCE, propertyName, scanDataRouteTables, } from '../../../ingestion/route-extractors/data-route-table.js';
 import { extractNestRoutes } from '../../../ingestion/route-extractors/nest.js';
 import { normalizeExtractedRoutePath } from '../../../ingestion/route-extractors/route-path.js';
 import { buildJsRepoFacts, extractJsModuleFacts, isAxiosNamespace, isHttpClientRef, resolveJsPathExpression, } from '../../../ingestion/route-extractors/js-const-resolver.js';
@@ -123,6 +123,35 @@ const AXIOS_OBJECT_SPEC = {
       arguments: (arguments (object) @options))
   `,
 };
+// ─── Consumer: wrapped client X.request({ url, method }) ────────────
+// Enterprise wrapper shape: an axios instance (or a named request helper)
+// re-exported under a local name — `httpClient.request({ url, method })`
+// from `@winex-plugin/win-request`, `$http.request(...)`. Generic names
+// like `api` need axios.create/import proof (`isHttpClientRef`); spelling
+// alone is too common (graphql-request helpers, domain `api` objects).
+// The member property is `request` (not an HTTP verb), so this cannot
+// collide with the Express provider pattern (`router.get`) or the axios
+// member form (`axios.get`). Option keys are resolved programmatically,
+// same as the jQuery ajax / axios object forms.
+//
+// The query captures the receiver so scan can reject unrelated
+// `.request({ url })` APIs (`cy.request`, `queue.request`).
+const REQUEST_OBJECT_SPEC = {
+    meta: {},
+    query: `
+    (call_expression
+      function: (member_expression
+        object: (_) @obj
+        property: (property_identifier) @fn (#eq? @fn "request"))
+      arguments: (arguments . (object) @options))
+  `,
+};
+/**
+ * Receivers admitted as wrapped HTTP clients without axios.create proof.
+ * Spelling-only: the last identifier in `obj.text` (`this.$http` → `$http`).
+ * Keep this set small — every extra name is a false-positive surface.
+ */
+const WRAPPED_REQUEST_RECEIVERS = new Set(['httpClient', '$http']);
 function compileBundle(language, name) {
     const mk = (spec, suffix) => compilePatterns({
         name: `${name}-${suffix}`,
@@ -137,6 +166,7 @@ function compileBundle(language, name) {
         jqueryShorthand: mk(JQUERY_SHORTHAND_SPEC, 'jquery-shorthand'),
         jqueryAjax: mk(JQUERY_AJAX_SPEC, 'jquery-ajax'),
         axiosObject: mk(AXIOS_OBJECT_SPEC, 'axios-object'),
+        requestObject: mk(REQUEST_OBJECT_SPEC, 'request-object'),
     };
 }
 const JAVASCRIPT_BUNDLE = compileBundle(JavaScript, 'javascript-http');
@@ -148,6 +178,7 @@ const TSX_BUNDLE = compileBundle(TypeScript.tsx, 'tsx-http');
  * of `keyNames`. Returns null when no matching pair is present or the
  * value is not a string literal. Used by the jQuery ajax / axios object
  * consumers to resolve `url` / `method` / `type` keys in any order.
+ * Keys use shared `propertyName` so quoted `"method"` matches `method`.
  */
 function readStringProp(objectNode, keyNames) {
     for (let i = 0; i < objectNode.namedChildCount; i++) {
@@ -158,7 +189,8 @@ function readStringProp(objectNode, keyNames) {
         const valueNode = pair.childForFieldName('value');
         if (!keyNode || !valueNode)
             continue;
-        if (!keyNames.includes(keyNode.text))
+        const key = propertyName(keyNode);
+        if (key === null || !keyNames.includes(key))
             continue;
         if (valueNode.type !== 'string' && valueNode.type !== 'template_string')
             continue;
@@ -168,6 +200,77 @@ function readStringProp(objectNode, keyNames) {
     }
     return null;
 }
+/**
+ * Verb for wrapped `X.request({ url, method|type })`. Absent key → GET
+ * (same default as fetch-without-options / jQuery ajax). Present but not a
+ * string/template, supplied only via object spread, or later overwritten by
+ * a duplicate key / spread → `*` so matching can still link without pinning GET.
+ * Later properties win, matching JavaScript object-literal evaluation.
+ */
+function readRequestMethod(objectNode, keyNames = ['method', 'type']) {
+    let last = { kind: 'absent' };
+    for (let i = 0; i < objectNode.namedChildCount; i++) {
+        const child = objectNode.namedChild(i);
+        if (!child)
+            continue;
+        if (child.type === 'spread_element') {
+            last = { kind: 'unknown' };
+            continue;
+        }
+        if (child.type === 'shorthand_property_identifier' ||
+            child.type === 'shorthand_property_identifier_pattern') {
+            if (keyNames.includes(child.text))
+                last = { kind: 'unknown' };
+            continue;
+        }
+        if (child.type !== 'pair')
+            continue;
+        const keyNode = child.childForFieldName('key');
+        const valueNode = child.childForFieldName('value');
+        if (!keyNode)
+            continue;
+        const key = propertyName(keyNode);
+        if (key === null || !keyNames.includes(key))
+            continue;
+        if (!valueNode || (valueNode.type !== 'string' && valueNode.type !== 'template_string')) {
+            last = { kind: 'unknown' };
+            continue;
+        }
+        const lit = unquoteLiteral(valueNode.text);
+        if (lit === null || lit.includes('${')) {
+            last = { kind: 'unknown' };
+            continue;
+        }
+        last = { kind: 'literal', value: lit };
+    }
+    if (last.kind === 'literal')
+        return last.value.toUpperCase();
+    if (last.kind === 'unknown')
+        return '*';
+    return 'GET';
+}
+function wrappedRequestReceiverName(receiver) {
+    const parts = receiver.split('.');
+    return parts[parts.length - 1] ?? receiver;
+}
+/** Axios module / axios.create instance, or a registered wrapper identifier. */
+function isAdmittedWrappedRequestReceiver(receiver, fileKey, facts) {
+    if (WRAPPED_REQUEST_RECEIVERS.has(wrappedRequestReceiverName(receiver)))
+        return true;
+    try {
+        const isModule = facts === null || fileKey === undefined
+            ? receiver === 'axios'
+            : isAxiosNamespace(fileKey, receiver, facts);
+        if (isModule)
+            return true;
+        if (!facts || fileKey === undefined)
+            return false;
+        return isHttpClientRef(fileKey, receiver, facts);
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Map each named import's LOCAL binding to its DECLARED export name and source
  * module, by walking the file's `import { x as y } from 'm'` statements. Lets
@@ -335,9 +438,10 @@ function resolveFactsFor(repoContext, fileRel) {
  *
  * `/{param}` matches every one-segment provider route in the group, and
  * `matching.exclude_links_param_only_paths` defaults to `false`. A path whose
- * leading term is an unresolved placeholder is refused for the same reason —
- * nothing pins where it starts. (`resolveJsPathExpression` already refuses those
- * it folded itself; this also covers the literal fallback below.)
+ * leading term is an unresolved placeholder is refused unless the next
+ * character is `/` — that is the gateway-prefix shape
+ * `` `${serviceClient}/api/v1/x` `` that `stripLeadingTemplatePrefix` keeps.
+ * Bare `{param}` and `{param}api/x` stay rejected: nothing pins a route.
  */
 function looksLikeHttpPath(path) {
     if (path === '')
@@ -352,7 +456,7 @@ function looksLikeHttpPath(path) {
     const shape = path.replace(/\$\{[^}]+\}/g, '{param}');
     if (/\s/.test(shape))
         return false;
-    if (shape.startsWith('{param}'))
+    if (shape.startsWith('{param}') && !shape.startsWith('{param}/'))
         return false;
     // An all-digit string is a path only when it is written as one. A leading
     // slash is that evidence: `client.get('/123')` is a route whose segment the
@@ -613,8 +717,7 @@ function scanBundle(bundle, tree, repoContext, fileRel) {
         const path = readStringProp(optionsNode, ['url']);
         if (path === null)
             continue;
-        const rawMethod = readStringProp(optionsNode, ['method']);
-        const method = (rawMethod ?? 'GET').toUpperCase();
+        const method = readRequestMethod(optionsNode, ['method']);
         out.push({
             role: 'consumer',
             framework: 'axios',
@@ -625,6 +728,40 @@ function scanBundle(bundle, tree, repoContext, fileRel) {
             confidence: 0.7,
         });
     }
+    // Consumer: wrapped client `X.request({ url, method })` — the shared
+    // enterprise axios-instance shape (`httpClient.request` from
+    // win-request and friends). Emit the raw url (templates intact) so
+    // shared `normalizeConsumerPath` can strip a leading `${…}` gateway
+    // prefix and fold mid/tail interpolations to `{param}`. A plugin-side
+    // longest-slash-segment reducer would truncate those mid-templates
+    // before the shared normalizer ever saw them. This scan drops only
+    // static relative urls (no `${`, no leading `/`, not `https?://`).
+    // That filter is request-wrapper-specific: fetch/axios member forms
+    // already admit absolute urls and leave host stripping to
+    // `normalizeConsumerPath`.
+    for (const match of runCompiledPatterns(bundle.requestObject, tree)) {
+        const optionsNode = match.captures.options;
+        const objNode = match.captures.obj;
+        if (!optionsNode || !objNode)
+            continue;
+        if (!isAdmittedWrappedRequestReceiver(objNode.text, fileKey, facts))
+            continue;
+        const rawUrl = readStringProp(optionsNode, ['url']);
+        if (rawUrl === null)
+            continue;
+        const url = rawUrl.trim();
+        if (!url.includes('${') && !url.startsWith('/') && !/^https?:\/\//i.test(url))
+            continue;
+        out.push({
+            role: 'consumer',
+            framework: 'request',
+            method: readRequestMethod(optionsNode),
+            path: url,
+            name: null,
+            line: optionsNode.startPosition.row + 1,
+            confidence: 0.65,
+        });
+    }
     for (const route of scanDataRouteTables(tree)) {
         const imported = route.handlerLocalName === undefined ? undefined : importMap.get(route.handlerLocalName);
         out.push({