gitnexus 1.6.11-rc.37 → 1.6.11-rc.38

package/README.md

@@ -349,6 +349,12 @@ anchors are deliberately omitted. Add common infrastructure fields such as `/hea
 
 `--spring-actuator` is explicitly opt-in. The path may be a JSON bundle keyed by `mappings`, `beans`, `conditions`, `configprops`, and/or `env`, or a directory containing endpoint-named JSON files. Runtime mappings and beans confirm matching static nodes; conditions and configuration property keys enrich existing evidence, with conservative runtime-only nodes added when no match exists. The configured input is excluded from source scanning; only normalized repository-relative exclusions are retained for future scans, never absolute paths. Env/configprops values, origins, condition messages, and source names are never persisted or printed. Enabled runs always rebuild because runtime snapshots are external to git freshness; omitting the option later rebuilds once to remove runtime evidence. Project config can set the same path with `springActuator` in `.gitnexusrc`.
 
+`--asyncapi-spec` is explicitly opt-in and accepts a directory of AsyncAPI documents or a single document; the path is resolved against the repository root, so a committed `docs/asyncapi` and an absolute cache written by something else both work. Each `operations[]` entry of an **AsyncAPI 3.x** document can contribute a `Destination` node keyed by broker and address, with `action: send` emitting `PUBLISHES_TO` and `action: receive` emitting `CONSUMES_FROM`, so a document and source code that name one address on one broker land on the same node. Edges start at the document, not at a callable — a document states that the service talks to an address, not which method does — and no address a document names is ever attached to an unresolved source site.
+
+An operation must name a protocol, either through its own `bindings` or through the `servers[].protocol` of the servers its channel resolves to (a channel that lists no `servers` resolves to all of them); operations that name none are refused, as are operations whose two readings name different brokers, and channels that inherit a multi-protocol server set without choosing. HTTP and WebSocket documents are refused for destination minting: there the host rather than the address names the place, and an HTTP endpoint is already modelled as a `Route`. A parameterized address — a channel declaring `parameters`, or an address containing `{` — is refused rather than keyed: two services publishing `{env}.orders` share a pattern, not a queue. AsyncAPI **2.x is refused** under its own counted reason and never mapped, because its `publish`/`subscribe` are inverted relative to 3.x `send`/`receive` and a naive mapping would reverse the async graph while leaving it connected. Every refusal is counted, and a configured path that yields nothing is reported rather than passed over in silence.
+
+Like Actuator snapshots, documents are external to git freshness — replacing one moves no commit and dirties no file — so an enabled run always rebuilds, and the first later run without the option rebuilds once to remove document-derived evidence. There is no glob-based auto-discovery, and the option is unsupported with `--watch`.
+
 > **`gitnexus uninstall`** reverses `gitnexus setup` — it removes the GitNexus MCP entries, hooks, and skill directories it added to each detected editor. Skill directories are identified **by bundled gitnexus skill name** (e.g. `gitnexus-cli/`), so if you customized files inside an installed skill directory, back them up first. It is a dry-run preview by default and prints the exact paths it would remove; pass `--force` to apply. Per-repo indexes (`gitnexus clean --all`) and the global npm package (`npm uninstall -g gitnexus`) are left for you to remove.
 
 ## Remote Embeddings

package/dist/cli/analyze-options.d.ts

@@ -129,6 +129,13 @@ export interface AnalyzeOptions {
      * bundle or a directory containing endpoint JSON files. Disabled by default.
      */
     springActuator?: string;
+    /**
+     * Explicit local AsyncAPI 3.x document input. Accepts a directory of
+     * documents or a single document, resolved against the repository root so an
+     * out-of-band cache and a committed directory are equally usable. Disabled by
+     * default.
+     */
+    asyncapiSpec?: string;
     /** OpenAI-compatible embeddings base URL (incl. /v1). Overrides GITNEXUS_EMBEDDING_URL. */
     embeddingBaseUrl?: string;
     /** Embedding model name. Overrides GITNEXUS_EMBEDDING_MODEL. */

package/dist/cli/analyze-watch.js

@@ -76,6 +76,11 @@ export async function resolveWatchOptions(repoPath, cli, baseline, reportIgnored
         ['--index-only', cli.indexOnly],
         ['--skip-git', cli.skipGit],
         ['--spring-actuator', cli.springActuator],
+        // Rejected under --watch for the same reason as --spring-actuator: the
+        // watcher reacts to source changes, and nothing watches an out-of-band
+        // document directory. Honouring the flag here would read the documents once
+        // and then quietly serve a stale answer for the rest of the session.
+        ['--asyncapi-spec', cli.asyncapiSpec],
         ['walCheckpointThreshold', cli.walCheckpointThreshold],
         ['embeddingThreads', cli.embeddingThreads],
         ['embeddingBatchSize', cli.embeddingBatchSize],

package/dist/cli/analyze.js

@@ -786,6 +786,16 @@ const analyzeCommandImpl = async (inputPath, cliOptions, runnerIdentityAtBootstr
         !setPositiveEnv('--embedding-sub-batch-size', 'GITNEXUS_EMBEDDING_SUB_BATCH_SIZE', options.embeddingSubBatchSize)) {
         return;
     }
+    // An empty value resolves to the repository root, so `--asyncapi-spec ""`
+    // walks the whole tree — defeating the module's own rule that there is no
+    // glob-based auto-discovery, and spending the walk budget on `node_modules`.
+    // The HTTP entry point already rejects exactly this value; two doors onto one
+    // option must not hold different rules.
+    if (options.asyncapiSpec !== undefined && options.asyncapiSpec.trim() === '') {
+        cliError('  --asyncapi-spec must be a non-empty path.\n');
+        process.exitCode = 1;
+        return;
+    }
     if (options.embeddingDevice) {
         const allowed = new Set(['auto', 'cpu', 'dml', 'cuda', 'wasm']);
         if (!allowed.has(options.embeddingDevice)) {
@@ -1115,6 +1125,7 @@ const analyzeCommandImpl = async (inputPath, cliOptions, runnerIdentityAtBootstr
             // forwarded to the routes phase consumer scan.
             fetchWrappers: options.fetchWrappers,
             springActuatorPath: options.springActuator,
+            asyncApiSpecPath: options.asyncapiSpec,
             // The CLI always process.exit()s after this returns (success path at the
             // end of analyzeCommandImpl, error/interrupt paths via process.exit too),
             // so the finalize close skips the native conn/db close — it can double-free

package/dist/cli/index.js

@@ -85,6 +85,8 @@ program
     .option('--workers <n>', 'Parse worker pool size (>=1). Default: cores-1 capped at 16, auto-sized to the repo.')
     .option('--spring-actuator <path>', 'Import local Spring Boot Actuator JSON snapshots (mappings, beans, conditions, ' +
     'configprops, env). Explicit opt-in; disabled by default.')
+    .option('--asyncapi-spec <path>', 'Read AsyncAPI 3.x documents from this directory or file and resolve broker ' +
+    'addresses from them. Explicit opt-in; disabled by default.')
     .option('--embedding-threads <n>', 'Limit local ONNX embedding CPU threads')
     .option('--embedding-batch-size <n>', 'Number of nodes per embedding batch')
     .option('--embedding-sub-batch-size <n>', 'Number of chunks per embedding model call')

package/dist/core/analysis-feature-registry.d.ts

@@ -0,0 +1,2 @@
+/** Production registry of independently versioned analysis capabilities. */
+export declare const ANALYSIS_FEATURES: readonly [import("./analysis-features.js").AnalysisFeatureDescriptor, import("./analysis-features.js").AnalysisFeatureDescriptor, import("./analysis-features.js").AnalysisFeatureDescriptor, import("./analysis-features.js").AnalysisFeatureDescriptor, import("./analysis-features.js").AnalysisFeatureDescriptor, import("./analysis-features.js").AnalysisFeatureDescriptor, import("./analysis-features.js").AnalysisFeatureDescriptor, import("./analysis-features.js").AnalysisFeatureDescriptor, import("./analysis-features.js").AnalysisFeatureDescriptor];

package/dist/core/analysis-feature-registry.js

@@ -0,0 +1,15 @@
+import { CLASS_FRAMEWORK_ANNOTATIONS_FEATURE } from './analysis-features.js';
+import { SPRING_AOP_FEATURE, SPRING_BEAN_INVENTORY_FEATURE, SPRING_CONDITIONALS_FEATURE, SPRING_NON_HTTP_HANDLERS_FEATURE, SPRING_ROUTE_BINDINGS_FEATURE, } from './ingestion/frameworks/spring/analysis-features.js';
+import { JAVA_ENUM_INTERFACE_HERITAGE_FEATURE, JAVA_RECORD_COMPONENT_ACCESSORS_FEATURE, SPRING_CONFIG_BINDINGS_FEATURE, } from './ingestion/languages/java/analysis-features.js';
+/** Production registry of independently versioned analysis capabilities. */
+export const ANALYSIS_FEATURES = [
+    CLASS_FRAMEWORK_ANNOTATIONS_FEATURE,
+    SPRING_AOP_FEATURE,
+    SPRING_BEAN_INVENTORY_FEATURE,
+    SPRING_CONDITIONALS_FEATURE,
+    SPRING_NON_HTTP_HANDLERS_FEATURE,
+    SPRING_ROUTE_BINDINGS_FEATURE,
+    SPRING_CONFIG_BINDINGS_FEATURE,
+    JAVA_ENUM_INTERFACE_HERITAGE_FEATURE,
+    JAVA_RECORD_COMPONENT_ACCESSORS_FEATURE,
+];

package/dist/core/group/extractors/http-patterns/java.js

@@ -1,6 +1,6 @@
 import Java from 'tree-sitter-java';
 import { compilePatterns, runCompiledPatterns, unquoteLiteral, } from '../tree-sitter-scanner.js';
-import { springAnnotationHttpMethods, intersectSpringHttpMethods, isRouteMemberKey, findEnclosingClass, joinPath, } from '../../../ingestion/route-extractors/spring-shared.js';
+import { springAnnotationHttpMethods, intersectSpringHttpMethods, isRouteMemberKey, findEnclosingClass, isClassLevelMappingAnnotation, joinPath, } from '../../../ingestion/route-extractors/spring-shared.js';
 import { REST_TEMPLATE_TO_HTTP, WEB_CLIENT_SHORT_TO_HTTP, WEB_CLIENT_LONG_VERB_RE, EXCHANGE_ANNOTATION_TO_HTTP, parseRequestLine, pushPrefix, scanSpringInheritanceProject, OPENFEIGN_FRAMEWORK, HTTP_INTERFACE_FRAMEWORK, FEIGN_CONFIDENCE, REQUEST_LINE_CONFIDENCE, EXCHANGE_CONFIDENCE, } from './spring-consumer-shared.js';
 import { expandJavaWildcardStaticImports, extractJavaModuleConstants, foldJavaOperands, isJavaConstantFile, parseJavaConstOperands, prepareJavaRouteConstants, } from '../../../ingestion/route-extractors/java-const-resolver.js';
 import { extractStaticPathExpression, inferOkHttpMethod, inferHttpClientMethod, okHttpUrlRootsAtBuilder, httpClientUriRootsAtNewBuilder, httpClientChainHasUriCall, } from './java-static-path.js';
@@ -394,12 +394,12 @@ function annotationHasRouteMember(annotation) {
     return false;
 }
 function typeRequestMethods(typeNode) {
-    const mappings = declarationAnnotations(typeNode).filter((annotation) => simpleName(annotation.childForFieldName('name')?.text ?? '') === 'RequestMapping');
+    const mappings = declarationAnnotations(typeNode).filter((annotation) => isClassLevelMappingAnnotation(simpleName(annotation.childForFieldName('name')?.text ?? '')));
     if (mappings.length === 0)
         return ['*'];
     if (mappings.length !== 1)
         return [];
-    return springAnnotationHttpMethods('RequestMapping', mappings[0].text);
+    return springAnnotationHttpMethods(simpleName(mappings[0].childForFieldName('name')?.text ?? 'RequestMapping'), mappings[0].text);
 }
 function hasAnnotation(node, names) {
     const modifiers = node.namedChildren.find((child) => child.type === 'modifiers');
@@ -551,7 +551,7 @@ function scanRouteAnnotations(tree) {
         }
         // Type-level (class or interface): a Spring `@RequestMapping` URL prefix, or
         // — on an interface — an OpenFeign `@FeignClient(path = "...")` prefix.
-        if (ann === 'RequestMapping') {
+        if (isClassLevelMappingAnnotation(ann)) {
             if (!isRouteMemberKey(keyNode))
                 continue;
             if (!valueNode) {

package/dist/core/group/extractors/http-patterns/kotlin.js

@@ -1,6 +1,6 @@
 import { requireVendoredGrammar } from '../../../tree-sitter/vendored-grammars.js';
 import { compilePatterns, runCompiledPatterns, unquoteLiteral, } from '../tree-sitter-scanner.js';
-import { METHOD_ANNOTATION_TO_HTTP, findEnclosingClass, joinPath, } from '../../../ingestion/route-extractors/spring-shared.js';
+import { findEnclosingClass, intersectSpringHttpMethods, isClassLevelMappingAnnotation, joinPath, springAnnotationHttpMethods, } from '../../../ingestion/route-extractors/spring-shared.js';
 import { buildKotlinConstantIndex, extractKotlinModuleConstants, foldKotlinOperands, isKotlinConstantFile, overlayKotlinConstantIndex, parseKotlinConstOperands, unfoldableDeclarationsOf, unquoteKotlinIdentifier, } from '../../../ingestion/route-extractors/kotlin-const-resolver.js';
 import { REST_TEMPLATE_TO_HTTP, WEB_CLIENT_SHORT_TO_HTTP, WEB_CLIENT_LONG_VERB_RE, EXCHANGE_ANNOTATION_TO_HTTP, parseRequestLine, pushPrefix, scanSpringInheritanceProject, OPENFEIGN_FRAMEWORK, HTTP_INTERFACE_FRAMEWORK, FEIGN_CONFIDENCE, REQUEST_LINE_CONFIDENCE, EXCHANGE_CONFIDENCE, } from './spring-consumer-shared.js';
 /**
@@ -392,6 +392,13 @@ function inferKotlinOkHttpMethod(urlCall) {
     }
     return name === null ? 'GET' : name.toUpperCase();
 }
+function enclosingAnnotationText(node) {
+    for (let current = node; current; current = current.parent) {
+        if (current.type === 'annotation')
+            return current.text;
+    }
+    return node.text;
+}
 /**
  * Build the plugin only if the Kotlin grammar is available. Compiling
  * the queries against a null grammar would throw at module load time
@@ -429,7 +436,7 @@ function buildKotlinPlugin(language) {
             (modifiers
               (annotation
                 (constructor_invocation
-                  (user_type (type_identifier) @ann (#eq? @ann "RequestMapping"))
+                  (user_type (type_identifier) @ann (#match? @ann "RequestMapping$"))
                   (value_arguments
                     (value_argument . [(string_literal) @prefix (collection_literal (string_literal) @prefix)])))))
             (type_identifier) @cls) @class
@@ -442,7 +449,7 @@ function buildKotlinPlugin(language) {
             (modifiers
               (annotation
                 (constructor_invocation
-                  (user_type (type_identifier) @ann (#eq? @ann "RequestMapping"))
+                  (user_type (type_identifier) @ann (#match? @ann "RequestMapping$"))
                   (value_arguments
                     (value_argument
                       (simple_identifier) @key (#match? @key "^(path|value)$")
@@ -457,7 +464,7 @@ function buildKotlinPlugin(language) {
             (modifiers
               (annotation
                 (constructor_invocation
-                  (user_type (type_identifier) @ann (#eq? @ann "RequestMapping"))
+                  (user_type (type_identifier) @ann (#match? @ann "RequestMapping$"))
                   (value_arguments
                     (value_argument . ${arrayOfArg('@prefix')})))))
             (type_identifier) @cls) @class
@@ -470,7 +477,7 @@ function buildKotlinPlugin(language) {
             (modifiers
               (annotation
                 (constructor_invocation
-                  (user_type (type_identifier) @ann (#eq? @ann "RequestMapping"))
+                  (user_type (type_identifier) @ann (#match? @ann "RequestMapping$"))
                   (value_arguments
                     (value_argument
                       (simple_identifier) @key (#match? @key "^(path|value)$")
@@ -495,7 +502,7 @@ function buildKotlinPlugin(language) {
             (modifiers
               (annotation
                 (constructor_invocation
-                  (user_type (type_identifier) @ann (#match? @ann "^(Get|Post|Put|Delete|Patch)Mapping$"))
+                  (user_type (type_identifier) @ann (#match? @ann "(Request|Get|Post|Put|Delete|Patch)Mapping$"))
                   (value_arguments
                     (value_argument . [(string_literal) @path (collection_literal (string_literal) @path)])))))
             (simple_identifier) @method_name) @method
@@ -508,7 +515,7 @@ function buildKotlinPlugin(language) {
             (modifiers
               (annotation
                 (constructor_invocation
-                  (user_type (type_identifier) @ann (#match? @ann "^(Get|Post|Put|Delete|Patch)Mapping$"))
+                  (user_type (type_identifier) @ann (#match? @ann "(Request|Get|Post|Put|Delete|Patch)Mapping$"))
                   (value_arguments
                     (value_argument
                       (simple_identifier) @key (#match? @key "^(path|value)$")
@@ -523,7 +530,7 @@ function buildKotlinPlugin(language) {
             (modifiers
               (annotation
                 (constructor_invocation
-                  (user_type (type_identifier) @ann (#match? @ann "^(Get|Post|Put|Delete|Patch)Mapping$"))
+                  (user_type (type_identifier) @ann (#match? @ann "(Request|Get|Post|Put|Delete|Patch)Mapping$"))
                   (value_arguments
                     (value_argument . ${arrayOfArg('@path')})))))
             (simple_identifier) @method_name) @method
@@ -536,7 +543,7 @@ function buildKotlinPlugin(language) {
             (modifiers
               (annotation
                 (constructor_invocation
-                  (user_type (type_identifier) @ann (#match? @ann "^(Get|Post|Put|Delete|Patch)Mapping$"))
+                  (user_type (type_identifier) @ann (#match? @ann "(Request|Get|Post|Put|Delete|Patch)Mapping$"))
                   (value_arguments
                     (value_argument
                       (simple_identifier) @key (#match? @key "^(path|value)$")
@@ -571,7 +578,7 @@ function buildKotlinPlugin(language) {
             (modifiers
               (annotation
                 (constructor_invocation
-                  (user_type (type_identifier) @ann (#eq? @ann "RequestMapping"))
+                  (user_type (type_identifier) @ann (#match? @ann "RequestMapping$"))
                   (value_arguments (value_argument) @arg))))
             (type_identifier) @cls) @class
         `,
@@ -589,7 +596,7 @@ function buildKotlinPlugin(language) {
             (modifiers
               (annotation
                 (constructor_invocation
-                  (user_type (type_identifier) @ann (#match? @ann "^(Get|Post|Put|Delete|Patch)Mapping$"))
+                  (user_type (type_identifier) @ann (#match? @ann "(Request|Get|Post|Put|Delete|Patch)Mapping$"))
                   (value_arguments (value_argument) @arg))))
             (simple_identifier) @method_name) @method
         `,
@@ -649,8 +656,11 @@ function buildKotlinPlugin(language) {
         for (const match of runCompiledPatterns(SPRING_CONST_CLASS_PREFIX_PATTERNS, tree)) {
             const argNode = match.captures.arg;
             const classNode = match.captures.class;
+            const annNode = match.captures.ann;
             if (!argNode || !classNode)
                 continue;
+            if (annNode && !isClassLevelMappingAnnotation(annNode.text))
+                continue;
             if ((resolvedPrefixes.get(classNode.id) ?? []).length > 0)
                 continue;
             const expr = kotlinRouteArgumentExpression(argNode);
@@ -1145,14 +1155,37 @@ function buildKotlinPlugin(language) {
         return body.namedChildren.filter((c) => c.type === 'function_declaration');
     };
     const kotlinFunctionName = (fn) => fn.namedChildren.find((c) => c.type === 'simple_identifier')?.text ?? null;
+    const kotlinTypeRequestMethods = (typeNode) => {
+        const modifiers = typeNode.namedChildren.find((child) => child.type === 'modifiers');
+        const mappings = (modifiers?.namedChildren ?? []).filter((annotation) => {
+            if (annotation.type !== 'annotation')
+                return false;
+            return isClassLevelMappingAnnotation(kotlinAnnotationName(annotation) ?? '');
+        });
+        if (mappings.length === 0)
+            return ['*'];
+        if (mappings.length !== 1)
+            return [];
+        const mapping = mappings[0];
+        const mappingName = kotlinAnnotationName(mapping);
+        if (!mappingName)
+            return [];
+        return springAnnotationHttpMethods(mappingName, mapping.text);
+    };
+    const kotlinClassHttpMethodsById = (tree) => new Map(tree.rootNode
+        .descendantsOfType('class_declaration')
+        .map((typeNode) => [typeNode.id, kotlinTypeRequestMethods(typeNode)]));
     const collectKotlinSpringTypes = (filePath, tree) => {
         // Class-level @RequestMapping prefixes (reuse the provider class-prefix query).
         const prefixByClassId = new Map();
         for (const match of runCompiledPatterns(SPRING_CLASS_PREFIX_PATTERNS, tree)) {
             const prefixNode = match.captures.prefix;
             const classNode = match.captures.class;
+            const annNode = match.captures.ann;
             if (!prefixNode || !classNode)
                 continue;
+            if (annNode && !isClassLevelMappingAnnotation(annNode.text))
+                continue;
             // An INTERPOLATED literal (`"${ApiPaths.BASE}"`) is not a path — unquoting
             // its raw text would carry the source spelling into the shared type view
             // as a served prefix. Refusing it here is also what lets the unfoldable
@@ -1172,6 +1205,7 @@ function buildKotlinPlugin(language) {
         // noise into the shared type view, so it is left out — the same skip floor
         // `java.ts`'s `collectSpringTypes` keeps.
         const routesByMethodId = new Map();
+        const classHttpMethodsById = kotlinClassHttpMethodsById(tree);
         const unfoldablePrefixClassIds = collectUnfoldablePrefixClassIds(tree, prefixByClassId);
         for (const match of runCompiledPatterns(SPRING_METHOD_ROUTE_PATTERNS, tree)) {
             const annNode = match.captures.ann;
@@ -1179,8 +1213,8 @@ function buildKotlinPlugin(language) {
             const methodNode = match.captures.method;
             if (!annNode || !pathNode || !methodNode)
                 continue;
-            const httpMethod = METHOD_ANNOTATION_TO_HTTP[annNode.text];
-            if (!httpMethod)
+            const httpMethods = springAnnotationHttpMethods(annNode.text, enclosingAnnotationText(annNode));
+            if (httpMethods.length === 0)
                 continue;
             const rawPath = unquoteLiteral(pathNode.text);
             if (rawPath === null)
@@ -1190,8 +1224,11 @@ function buildKotlinPlugin(language) {
             const owner = findEnclosingClass(methodNode);
             if (owner && unfoldablePrefixClassIds.has(owner.id))
                 continue;
+            const constrainedMethods = intersectSpringHttpMethods(owner ? (classHttpMethodsById.get(owner.id) ?? ['*']) : ['*'], httpMethods);
             const arr = routesByMethodId.get(methodNode.id) ?? [];
-            arr.push({ method: httpMethod, path: rawPath });
+            for (const httpMethod of constrainedMethods) {
+                arr.push({ method: httpMethod, path: rawPath });
+            }
             routesByMethodId.set(methodNode.id, arr);
         }
         const out = [];
@@ -1319,8 +1356,11 @@ function buildKotlinPlugin(language) {
             for (const match of runCompiledPatterns(SPRING_CLASS_PREFIX_PATTERNS, tree)) {
                 const prefixNode = match.captures.prefix;
                 const classNode = match.captures.class;
+                const annNode = match.captures.ann;
                 if (!prefixNode || !classNode)
                     continue;
+                if (annNode && !isClassLevelMappingAnnotation(annNode.text))
+                    continue;
                 // An INTERPOLATED literal (`"${ApiPaths.BASE}"`) is not a path — see
                 // `isPlainStringLiteral`. Refusing it here also lets the unfoldable
                 // analysis below mark such a class, since that skips classes whose
@@ -1366,24 +1406,27 @@ function buildKotlinPlugin(language) {
             // Literal and constant-valued paths are normalized into one candidate list
             // so both reach the same Feign/interface/prefix classification below.
             const methodRoutes = [];
+            const classHttpMethodsById = kotlinClassHttpMethodsById(tree);
             for (const match of runCompiledPatterns(SPRING_METHOD_ROUTE_PATTERNS, tree)) {
                 const annNode = match.captures.ann;
                 const pathNode = match.captures.path;
                 const methodNode = match.captures.method;
                 if (!annNode || !pathNode || !methodNode)
                     continue;
-                const httpMethod = METHOD_ANNOTATION_TO_HTTP[annNode.text];
-                if (!httpMethod)
+                const httpMethods = springAnnotationHttpMethods(annNode.text, enclosingAnnotationText(annNode));
+                if (httpMethods.length === 0)
                     continue;
                 const rawPath = unquoteLiteral(pathNode.text);
                 if (rawPath === null)
                     continue;
-                methodRoutes.push({
-                    httpMethod,
-                    rawPath,
-                    nameNode: match.captures.method_name,
-                    methodNode,
-                });
+                for (const httpMethod of httpMethods) {
+                    methodRoutes.push({
+                        httpMethod,
+                        rawPath,
+                        nameNode: match.captures.method_name,
+                        methodNode,
+                    });
+                }
             }
             for (const match of runCompiledPatterns(SPRING_CONST_METHOD_ROUTE_PATTERNS, tree)) {
                 const annNode = match.captures.ann;
@@ -1391,8 +1434,8 @@ function buildKotlinPlugin(language) {
                 const methodNode = match.captures.method;
                 if (!annNode || !argNode || !methodNode)
                     continue;
-                const httpMethod = METHOD_ANNOTATION_TO_HTTP[annNode.text];
-                if (!httpMethod)
+                const httpMethods = springAnnotationHttpMethods(annNode.text, enclosingAnnotationText(annNode));
+                if (httpMethods.length === 0)
                     continue;
                 const expr = kotlinRouteArgumentExpression(argNode);
                 if (!expr || !FOLDABLE_PATH_EXPRESSIONS.has(expr.type))
@@ -1413,14 +1456,24 @@ function buildKotlinPlugin(language) {
                 const rawPath = foldKotlinOperands(fileKey, operands, index.repo, kotlinEnclosingTypeNames(methodNode), index);
                 if (rawPath === null)
                     continue;
-                methodRoutes.push({
-                    httpMethod,
-                    rawPath,
-                    nameNode: match.captures.method_name,
-                    methodNode,
-                });
+                for (const httpMethod of httpMethods) {
+                    methodRoutes.push({
+                        httpMethod,
+                        rawPath,
+                        nameNode: match.captures.method_name,
+                        methodNode,
+                    });
+                }
             }
-            for (const { httpMethod, rawPath, nameNode, methodNode } of methodRoutes) {
+            const constrainedMethodRoutes = methodRoutes.flatMap((route) => {
+                const owner = findEnclosingClass(route.methodNode);
+                const classMethods = owner ? (classHttpMethodsById.get(owner.id) ?? ['*']) : ['*'];
+                return intersectSpringHttpMethods(classMethods, [route.httpMethod]).map((httpMethod) => ({
+                    ...route,
+                    httpMethod,
+                }));
+            });
+            for (const { httpMethod, rawPath, nameNode, methodNode } of constrainedMethodRoutes) {
                 const enclosingClass = findEnclosingClass(methodNode);
                 // A @(Get|...)Mapping inside a @FeignClient interface is an OpenFeign
                 // consumer (a remote call), not a route this service serves.

package/dist/core/ingestion/asyncapi/document.d.ts

@@ -0,0 +1,226 @@
+/**
+ * Read AsyncAPI 3.x documents off disk and normalize their operations into
+ * broker addresses.
+ *
+ * Deliberately OUTSIDE `frameworks/spring/`. An AsyncAPI document is a
+ * published artifact, not a Spring one: it is emitted by generators across
+ * Java, Kotlin, TypeScript, Go and Python toolchains, and it is written by hand
+ * as often as it is generated. The entry criterion here is therefore the
+ * DOCUMENT FORMAT — a root `asyncapi` key — and never the generator. Nothing in
+ * this module may branch on `x-generator`, on a vendor extension, or on the
+ * shape of an operation key: the moment it does, every service whose toolchain
+ * spells things differently stops being read, and the failure is silent.
+ *
+ * ── WHY THIS IS WORTH READING AT ALL ──────────────────────────────────────
+ *
+ * A `@KafkaListener(topics = "${app.topic.in}")` names a configuration key, not
+ * an address, and the address cascade correctly refuses to resolve it — two
+ * services that merely wrote the same placeholder have said nothing about each
+ * other. But the service's own published document states the address outright,
+ * fully resolved, because the generator ran with the configuration applied.
+ * That is a fact about the service that no amount of reading its source can
+ * recover.
+ *
+ * ── WHAT THIS MODULE IS AFRAID OF ─────────────────────────────────────────
+ *
+ * Everything it emits becomes half of a JOIN KEY. A destination minted here
+ * meets every other site in every other repository that names the same address
+ * on the same broker — that is the whole value, and it is the whole hazard. A
+ * missing destination is a visible gap; a wrong one is reported as a fact. So
+ * the refusals below are not defensive clutter: each one is a case where the
+ * document says something that LOOKS like an address and is not one, and where
+ * accepting it would connect two services that have said nothing about each
+ * other. The taxonomy is closed and countable for the same reason the source
+ * cascade's is — a feature judged on its unresolved fraction needs the fraction
+ * broken down by cause, or nobody can tell it what to go and fix.
+ *
+ * ── VERSION 2.x IS REFUSED, NOT MAPPED ────────────────────────────────────
+ *
+ * AsyncAPI 2.x describes a channel from the READER's point of view: `publish`
+ * means "you may publish here", so the documenting application RECEIVES, and
+ * `subscribe` means the application SENDS. Version 3.0 renamed these to the
+ * application's own `receive` / `send`. Mapping 2.x naively therefore reverses
+ * every direction in the async graph — and reverses it INVISIBLY, because both
+ * roles still exist, every edge is still emitted, and the graph stays
+ * connected. Nothing fails; the arrows simply point the wrong way.
+ *
+ * The inversion is one line to write and impossible to test against a real
+ * corpus we do not have, and the 2.x wording confused implementers badly enough
+ * that some generators emitted it backwards. So 2.x is refused under its own
+ * countable reason instead. A silent skip would be indistinguishable from "this
+ * service publishes no document", which is the one thing the count has to be
+ * able to tell us: if the refusal tally shows 2.x documents in the field, the
+ * inversion earns its way in with evidence behind it.
+ */
+/**
+ * Why a document, or one operation inside it, produced no address.
+ *
+ * A CLOSED, COUNTABLE set, and deliberately NOT `SpringDestinationRefusal`.
+ * That union is documented as the reasons a *source-level candidate* produced
+ * no address, and it is the denominator of the unresolved fraction the address
+ * work is judged on. Folding document-level failures into it would silently
+ * change what that number means — a repository whose specification directory
+ * was mistyped would report a worse SOURCE, which is the opposite of the truth.
+ *
+ * Members are split wherever two causes are different FACTS about the input.
+ * A tally whose member says "the document contradicts itself" when the document
+ * is merely multi-protocol sends an operator to fix the wrong thing, and this
+ * tally is the number the whole feature is judged on.
+ */
+export type AsyncApiRefusal = 
+/** The file parsed but has no root `asyncapi` key: not a document at all. */
+'not-a-document'
+/** Root `asyncapi: 2.x`. See the header — refused, never mapped. */
+ | 'asyncapi-2-unsupported'
+/** A root `asyncapi` key naming a version this module does not read. */
+ | 'unsupported-version'
+/** Malformed YAML/JSON, or a root that is not an object. */
+ | 'unparsable'
+/** The file could not be read, or is not a regular file (a FIFO, a device). */
+ | 'unreadable'
+/** A subdirectory could not be listed. Counted rather than skipped: under a
+ *  mixed-permission cache half the documents can be invisible while the run
+ *  otherwise reports a clean, complete read. */
+ | 'directory-unreadable'
+/** Larger than {@link MAX_DOCUMENT_BYTES}. */
+ | 'oversized'
+/** The document held more operations than one run will examine. */
+ | 'operation-cap'
+/** The run as a whole reached {@link MAX_TOTAL_OPERATIONS}. */
+ | 'total-operation-cap'
+/** The document declares more servers than the channel-inheritance rule will
+ *  read. */
+ | 'server-cap'
+/** The walk hit a bound before it finished, so the document set is a floor
+ *  rather than the whole of what the configured path holds. A truncated read
+ *  that reported nothing would be indistinguishable from a complete one. */
+ | 'walk-truncated'
+/** `operations[].channel.$ref` is absent or not a local channel pointer. */
+ | 'no-channel-reference'
+/** The `$ref` resolved to no channel in this document. */
+ | 'channel-not-found'
+/** The channel entry is itself a Reference Object, which this module does not
+ *  follow. Distinct from `no-address` on purpose: a `$ref`-ed channel HAS an
+ *  address, somewhere this reader did not look, and filing it under
+ *  `no-address` tells an operator their documents omit addresses when the
+ *  real answer is that the reader stops one hop short. */
+ | 'unresolved-channel-reference'
+/** The channel names no `address`, so there is nothing to key on. */
+ | 'no-address'
+/**
+ * The address is a TEMPLATE, not an address: the channel declares non-empty
+ * `parameters`, or the address carries a `{…}` placeholder.
+ *
+ * This is the document-side twin of the source cascade's
+ * `overridable-config-default`, and it exists for the identical reason. Two
+ * services that both publish `{env}.orders` have named a pattern they share,
+ * not a queue they share — one deploys with `env=prod` and the other with
+ * `env=staging`, and keying on the template text merges them into a single
+ * node with a publisher on one side and a subscriber on the other. That is a
+ * false connection built entirely from conformant AsyncAPI: `parameters` and
+ * `{param}` are core 3.x vocabulary, not a vendor quirk.
+ */
+ | 'templated-address'
+/** Longer than {@link MAX_ADDRESS_LENGTH}. */
+ | 'address-too-long'
+/** Longer than {@link MAX_OPERATION_ID_LENGTH}. */
+ | 'operation-id-too-long'
+/** `action` is neither `send` nor `receive`. */
+ | 'unrecognized-action'
+/** Neither the operation's bindings nor the servers its channel resolves to
+ *  name a protocol. Silence about the broker is not a claim about it, but a
+ *  `Destination` cannot be keyed without one. */
+ | 'protocol-unknown'
+/** The operation's OWN two statements about its broker — its bindings and the
+ *  servers its channel explicitly lists — name different brokers. The
+ *  document contradicts itself, and a destination keyed on the wrong broker
+ *  joins a stranger. */
+ | 'protocol-disagreement'
+/** The channel lists no `servers`, so it inherits all of them, and they do
+ *  not agree on one broker. The document does NOT contradict itself here —
+ *  it is simply multi-protocol and this channel did not choose — which is why
+ *  this is not `protocol-disagreement`. */
+ | 'ambiguous-server-default'
+/**
+ * The channel inherits the document's servers, but that map was CAPPED at
+ * {@link MAX_SERVERS_PER_DOCUMENT}, so the brokers read are a subset.
+ *
+ * Distinct from `ambiguous-server-default`, and the distinction is the whole
+ * point: unanimity across a subset is not unanimity. A document whose first
+ * thousand servers are Kafka and whose thousand-and-first is JMS reads as
+ * unanimously Kafka, and every operation inheriting it would be attributed to
+ * a broker the complete set does not agree on.
+ */
+ | 'capped-server-default'
+/**
+ * A server this operation depends on is a Reference Object this reader could
+ * not resolve — a pointer outside `#/servers` and `#/components/servers`, a
+ * name that is absent, or a reference to another reference.
+ *
+ * Refused rather than skipped. Skipping one server of several silently
+ * narrows the evidence, and a narrowed set is what makes a mixed document
+ * look like it agrees with itself.
+ */
+ | 'unresolved-server-reference'
+/** The broker is HTTP or WebSocket, where the host rather than the address is
+ *  the namespace. See `isNonDestinationBroker`. */
+ | 'not-a-destination-protocol';
+export interface AsyncApiOperation {
+    /** Absolute path of the document this operation came from. */
+    readonly documentPath: string;
+    /** The `operations` map key, kept for provenance and carried into the edge
+     *  `reason` so a reader can find the operation the edge came from. */
+    readonly operationId: string;
+    readonly action: 'send' | 'receive';
+    readonly address: string;
+    /** Normalized broker — the first half of the `Destination` key. */
+    readonly broker: string;
+}
+export interface AsyncApiReadResult {
+    readonly operations: readonly AsyncApiOperation[];
+    /** Files considered — every candidate extension under the configured path. */
+    readonly documentsScanned: number;
+    /** Files that parsed as an AsyncAPI 3.x document and yielded an operation. */
+    readonly documentsAccepted: number;
+    /** Entries skipped because they were symbolic links. Not a refusal — the skip
+     *  is deliberate — but counted, because a cache written by other tooling is
+     *  very often a symlink farm, and an operator whose whole cache was skipped
+     *  would otherwise see a result identical to a wrong path. */
+    readonly symlinksSkipped: number;
+    /** True when a bound stopped the walk or the operation count, so every number
+     *  here is a floor rather than a total. */
+    readonly truncated: boolean;
+    /** Every refusal, document-level and operation-level, by reason. */
+    readonly refusals: Readonly<Partial<Record<AsyncApiRefusal, number>>>;
+}
+export interface NormalizedDocument {
+    operations: AsyncApiOperation[];
+    refusals: Partial<Record<AsyncApiRefusal, number>>;
+    /** Operations EXAMINED, which is what the caps count. */
+    examined: number;
+    /** A bound stopped this document short. */
+    truncated: boolean;
+}
+/**
+ * Normalize one parsed document. Pure — no filesystem, so the whole refusal
+ * surface is testable from inline document literals.
+ *
+ * `budget` is the number of operations the RUN may still examine.
+ */
+export declare function normalizeAsyncApiDocument(parsed: unknown, documentPath: string, budget?: number): NormalizedDocument;
+/**
+ * Read every AsyncAPI 3.x document under an explicitly configured path.
+ *
+ * `configuredPath` is resolved against the repository root, so an absolute path
+ * to a cache populated out of band and a repo-relative directory of committed
+ * documents are both natural — the same shape `springActuatorPath` offers for
+ * Actuator snapshots. The READ is wider than that neighbour's, and the
+ * difference is worth stating rather than glossed as "the same contract": the
+ * Actuator loader probes five fixed filenames in one directory, while this
+ * walks recursively under the caps above and opens every candidate it finds.
+ *
+ * There is deliberately NO glob-based auto-discovery. Scanning a repository for
+ * anything that parses as a document would make every existing index grow nodes
+ * on its next run with nobody having asked for it.
+ */
+export declare function readAsyncApiDocuments(repoPath: string, configuredPath: string): Promise<AsyncApiReadResult>;