gitnexus 1.6.12-rc.20 → 1.6.12-rc.22

package/dist/cli/eval-server.js

@@ -501,8 +501,20 @@ export function formatImpactResult(result) {
     }
     // #1858 — an interface / indirection boundary on the path makes this a lower
     // bound; surface it so the count is not read as exhaustive.
+    //
+    // The header names no cause AND asserts no omitted caller, because it cannot
+    // know either. DI / dynamic dispatch was the only producer of `lower-bound`
+    // when this was written; #3399 added callables named in VALUE position (a
+    // registration table, a callback argument), and one of its producers is a
+    // probe that could not RUN — `callableValueReferenceBoundaries` hedges on a
+    // failed query and says in so many words that whether the symbol is
+    // registered is unknown. A header claiming "some callers are not traced"
+    // would there assert an omission nothing established, and would contradict
+    // the bullet printed directly under it. The bullets carry the cause — they
+    // are generated per-cause by `computeEpistemicBoundary` — so the header only
+    // has to say the count is a floor.
     if (result.epistemic === 'lower-bound') {
-        lines.push('⚠️  Lower bound — unresolved indirection on the path (callers binding via DI / dynamic dispatch are not traced; actual impact may be higher):');
+        lines.push('⚠️  Lower bound — impact may be incomplete and actual impact may be higher:');
         for (const b of result.boundaries || [])
             lines.push(`    • ${b}`);
     }

package/dist/core/ingestion/language-config.d.ts

@@ -71,13 +71,24 @@ export interface SwiftPackageConfig {
 /** Zig package config parsed from build.zig.zon and the root build.zig */
 export interface ZigBuildZonConfig {
     /**
-     * Map of dependency name -> the raw `.path = "..."` value, exactly as
-     * written in build.zig.zon (relative to the repo root, and possibly
-     * escaping it: `../local_dep`). Consumers normalize — see
-     * `normalizeZigDepPath` below, which rejects absolute
-     * and repo-escaping values. `.url`-based deps cannot be resolved to a
-     * repo-local file (they unpack into a build cache outside the repo) and so
-     * are not included here.
+     * Map of dependency name -> the dep's directory, in one of two spellings
+     * depending on which package this config describes:
+     *
+     *   - ROOT package (`pkg === ''`): the raw `.path = "..."` value, exactly as
+     *     written in build.zig.zon (relative to the repo root, and possibly
+     *     escaping it: `../local_dep`). This is what `parseZigBuildZon` promises
+     *     and what its tests pin.
+     *   - NESTED package: repo-relative and already normalized, because a nested
+     *     package's `.path` is written relative to ITS directory and means
+     *     nothing against the repo-relative keys consumers match on
+     *     (`packages/app`'s `../core` is stored as `packages/core`). A dep
+     *     escaping the REPO root is dropped rather than stored.
+     *
+     * Either spelling is safe to hand to `normalizeZigDepPath` below — it rejects
+     * absolute and repo-escaping values and is idempotent on an already
+     * normalized one, which is what `resolveZigImportInternal` relies on.
+     * `.url`-based deps cannot be resolved to a repo-local file (they unpack into
+     * a build cache outside the repo) and so are not included here.
      */
     pathDeps: Map<string, string>;
     /**
@@ -116,6 +127,27 @@ export interface ZigBuildZonConfig {
      */
     buildModules?: readonly ZigBuildModule[];
 }
+/**
+ * One Zig build package: the directory whose `build.zig` / `build.zig.zon`
+ * declare the config, and that config with every path REPO-relative.
+ *
+ * A Zig module's import table is declared by the `build.zig` of the package it
+ * belongs to, so a repo holding several packages holds several import tables —
+ * the same shape a TypeScript monorepo has with a `tsconfig.json` per package.
+ */
+export interface ZigPackageScope {
+    /** Repo-relative directory the package governs (`''` for the repo root). */
+    readonly dir: string;
+    readonly config: ZigBuildZonConfig;
+}
+/**
+ * Every Zig build package in the repo, indexed so the nearest one to a file
+ * wins — the `TsconfigIndex` analogue, and for the same reason.
+ */
+export interface ZigWorkspaceIndex {
+    /** Deepest-first, so the first `dir` that prefixes a file path governs it. */
+    readonly packages: readonly ZigPackageScope[];
+}
 /** One build module of the root `build.zig` — see `ZigBuildZonConfig.buildModules`. */
 export interface ZigBuildModule {
     /** The `addModule("<name>", …)` name; absent for `createModule` bindings
@@ -189,14 +221,51 @@ export declare function loadSwiftPackageConfig(repoRoot: string): Promise<SwiftP
  *     string literals — a commented-out `.path` or a `}` inside a comment
  *     or string cannot declare a dep or truncate the block.
  */
-export declare function loadZigBuildConfig(repoRoot: string): Promise<ZigBuildZonConfig | null>;
+export declare function loadZigBuildConfig(repoRoot: string, packageDir?: string): Promise<ZigBuildZonConfig | null>;
 /**
- * Normalize a `.path` value from build.zig.zon into a repo-relative form.
- * Returns null for paths that escape the repo root (start with `..`) or
- * are absolute — those point to files we don't index. `.` / `./` normalize
- * to the empty string (the repo root itself). Shared with the import
- * resolver so both sides agree on which deps are in-repo.
+ * The Zig build package governing `filePath` — the nearest one at or above it.
+ *
+ * A Zig module's import table is declared by the `build.zig` of the package the
+ * file belongs to, so the nearest enclosing package is the faithful reading of
+ * `@import("name")` at that site, exactly as `tsconfigFor` reads a non-relative
+ * specifier against the nearest enclosing project.
+ *
+ * There is deliberately NO fall-through to an enclosing package when the nearest
+ * one does not bind the name. Falling through is how a vendored dependency's
+ * `@import("config")` silently resolved to the outer repo's `config` module —
+ * the same failure `loadTsconfigIndex` documents for a package whose own
+ * tsconfig declares no `baseUrl`, and the same failure the per-module import
+ * tables in `resolveZigImportInternal` already exist to prevent one level down.
+ */
+export declare function zigPackageFor(index: ZigWorkspaceIndex | null | undefined, filePath: string): ZigBuildZonConfig | null;
+/**
+ * Load every Zig build package in the repo, nearest-first.
+ *
+ * Called with no `packageDir` — which is how every call site read it before
+ * this function existed — `loadZigBuildConfig` reads the ROOT `build.zig` /
+ * `build.zig.zon` and nothing else. That is the whole configuration of a
+ * single-package repo and none of the configuration of a monorepo: a repo
+ * laying its packages out as `packages/<name>/build.zig` has no root build
+ * files at all, so the loader answers `null` and EVERY bare
+ * `@import("<module>")` in it goes unresolved — cross-file resolution silently
+ * degrades to relative imports only. Measured on a two-package fixture:
+ * `config = null`, `@import("core")` → `null`.
+ *
+ * The loader itself is not root-bound any more: this function is what supplies
+ * it a `packageDir`, one per package below.
+ *
+ * So the packages are discovered the way tsconfigs are (`findTsconfigFiles`):
+ * one bounded breadth-first walk that skips the hardcoded ignore set, then
+ * deepest-first ordering so `zigPackageFor` can take the first match.
+ *
+ * Called from `ScopeResolver.loadResolutionConfig`, which the orchestrator runs
+ * once per LANGUAGE workspace pass — so the walk happens only for repos that
+ * actually contain Zig. `loadImportConfigs`, which runs unconditionally for
+ * every repo, keeps calling `loadZigBuildConfig` for the root package alone;
+ * that is the same split TypeScript already has between the cheap
+ * `loadTsconfigPaths` and the repo-walking `loadTsconfigIndex`.
  */
+export declare function loadZigWorkspaceIndex(repoRoot: string): Promise<ZigWorkspaceIndex | null>;
 export declare function normalizeZigDepPath(depPath: string): string | null;
 /**
  * The `root_source_file` paths a `build.zig` declares, dep-relative, with the

package/dist/core/ingestion/language-config.js

@@ -3,6 +3,7 @@ import { createReadStream } from 'fs';
 import { createInterface } from 'readline';
 import path from 'path';
 import { isDev } from './utils/env.js';
+import { isHardcodedIgnoredDirectoryAtPath } from '../../config/ignore-service.js';
 import { mapConcurrent } from '../../lib/utils.js';
 import { logger } from '../logger.js';
 function normalizeComposerDirectory(baseDir, directory) {
@@ -475,10 +476,18 @@ export async function loadSwiftPackageConfig(repoRoot) {
  *     string literals — a commented-out `.path` or a `}` inside a comment
  *     or string cannot declare a dep or truncate the block.
  */
-export async function loadZigBuildConfig(repoRoot) {
+export async function loadZigBuildConfig(repoRoot, packageDir = '') {
+    // Every path this function returns is REPO-relative, because that is the
+    // keyspace `allFilePaths` uses. The parsers below answer package-relative, so
+    // a nested package rebases them through `inPackage`. For the root package
+    // (`packageDir === ''`) the prefix is empty and every value is byte-identical
+    // to what this function returned before nested packages existed.
+    const pkg = packageDir === '' ? '' : `${packageDir}/`;
+    const inPackage = (relToPackage) => `${pkg}${relToPackage}`;
+    const packageFile = (name) => path.join(repoRoot, packageDir, name);
     let config = null;
     try {
-        const raw = await fs.readFile(path.join(repoRoot, 'build.zig.zon'), 'utf-8');
+        const raw = await fs.readFile(packageFile('build.zig.zon'), 'utf-8');
         config = parseZigBuildZon(raw);
     }
     catch {
@@ -490,10 +499,11 @@ export async function loadZigBuildConfig(repoRoot) {
     let rootModules;
     let rootBuildZig = null;
     try {
-        rootBuildZig = await fs.readFile(path.join(repoRoot, 'build.zig'), 'utf-8');
+        rootBuildZig = await fs.readFile(packageFile('build.zig'), 'utf-8');
         const parsed = parseZigRootModules(rootBuildZig);
-        if (parsed.size > 0)
-            rootModules = parsed;
+        if (parsed.size > 0) {
+            rootModules = new Map(Array.from(parsed, ([name, root]) => [name, inPackage(root)]));
+        }
     }
     catch {
         // No root build.zig — nothing to declare.
@@ -502,7 +512,7 @@ export async function loadZigBuildConfig(repoRoot) {
         if (rootBuildZig === null)
             return null;
         // No zon: no path deps, so `dep.module(…)` operands resolve to nothing.
-        const buildModules = parseZigBuildModules(rootBuildZig);
+        const buildModules = rebaseZigBuildModules(parseZigBuildModules(rootBuildZig), inPackage);
         if (!rootModules && buildModules.length === 0)
             return null;
         return {
@@ -519,10 +529,25 @@ export async function loadZigBuildConfig(repoRoot) {
     // Per path dep: the modules its build.zig NAMES (`addModule("core", …)`),
     // repo-relative — what a root-build.zig `dep.module("core")` operand means.
     const depModules = new Map();
+    // A nested package's `.path` values are written relative to ITS directory, so
+    // they are rebased here and stored repo-relative; `resolveZigImportInternal`
+    // then reads them through the same `normalizeZigDepPath`, which is idempotent
+    // on an already-normalized value. A dep that escapes the REPO root (not merely
+    // the package) resolves to nothing and is dropped. The root package keeps its
+    // raw spelling, which is what `parseZigBuildZon` promises and its tests pin.
+    const pathDeps = pkg === '' ? config.pathDeps : new Map();
     for (const [depName, depPath] of config.pathDeps) {
-        const rel = normalizeZigDepPath(depPath);
+        // Asked of the value AS WRITTEN, before the package prefix goes on: an
+        // absolute `.path` points outside the repository whichever package declared
+        // it, and prefixing hides that from `normalizeZigDepPath`. See
+        // `isAbsoluteZigDepPath`.
+        if (isAbsoluteZigDepPath(depPath))
+            continue;
+        const rel = normalizeZigDepPath(`${pkg}${depPath}`);
         if (rel === null)
             continue;
+        if (pkg !== '')
+            pathDeps.set(depName, rel);
         let buildZig;
         try {
             buildZig = await fs.readFile(path.join(repoRoot, rel, 'build.zig'), 'utf-8');
@@ -542,14 +567,169 @@ export async function loadZigBuildConfig(repoRoot) {
         if (named.size > 0)
             depModules.set(depName, named);
     }
-    const buildModules = rootBuildZig === null ? [] : parseZigBuildModules(rootBuildZig, depModules);
+    const buildModules = rootBuildZig === null
+        ? []
+        : rebaseZigBuildModules(parseZigBuildModules(rootBuildZig, depModules), inPackage, depModules);
     return {
         ...config,
+        pathDeps,
         ...(moduleRoots.size > 0 ? { moduleRoots } : {}),
         ...(rootModules ? { rootModules } : {}),
         ...(buildModules.length > 0 ? { buildModules } : {}),
     };
 }
+/**
+ * Rebase a package's own build modules to repo-relative paths.
+ *
+ * `parseZigBuildModules` answers package-relative for everything it read out of
+ * the `build.zig` it was handed, with one exception: an alias resolved through
+ * `depModules` (`addImport("api", dep.module("core"))`) is already repo-relative,
+ * because `depModules` was built that way. Prefixing that a second time would
+ * point the alias at a path no file has. The already-repo-relative values are
+ * therefore identified by membership in `depModules`, not guessed at from their
+ * shape.
+ */
+function rebaseZigBuildModules(modules, inPackage, depModules) {
+    if (inPackage('') === '')
+        return [...modules];
+    const fromDep = new Set();
+    for (const named of depModules?.values() ?? [])
+        for (const root of named.values())
+            fromDep.add(root);
+    return modules.map((mod) => ({
+        ...(mod.name !== undefined ? { name: mod.name } : {}),
+        root: inPackage(mod.root),
+        imports: new Map(Array.from(mod.imports, ([alias, root]) => [
+            alias,
+            fromDep.has(root) ? root : inPackage(root),
+        ])),
+    }));
+}
+/** Bounds for the package walk, mirroring the tsconfig scan. */
+const ZIG_SCAN_MAX_DIRS = 20_000;
+const ZIG_SCAN_MAX_DEPTH = 24;
+/**
+ * The Zig build package governing `filePath` — the nearest one at or above it.
+ *
+ * A Zig module's import table is declared by the `build.zig` of the package the
+ * file belongs to, so the nearest enclosing package is the faithful reading of
+ * `@import("name")` at that site, exactly as `tsconfigFor` reads a non-relative
+ * specifier against the nearest enclosing project.
+ *
+ * There is deliberately NO fall-through to an enclosing package when the nearest
+ * one does not bind the name. Falling through is how a vendored dependency's
+ * `@import("config")` silently resolved to the outer repo's `config` module —
+ * the same failure `loadTsconfigIndex` documents for a package whose own
+ * tsconfig declares no `baseUrl`, and the same failure the per-module import
+ * tables in `resolveZigImportInternal` already exist to prevent one level down.
+ */
+export function zigPackageFor(index, filePath) {
+    if (index === null || index === undefined)
+        return null;
+    for (const scope of index.packages) {
+        if (scope.dir === '')
+            return scope.config;
+        if (filePath.startsWith(`${scope.dir}/`))
+            return scope.config;
+    }
+    return null;
+}
+/**
+ * Load every Zig build package in the repo, nearest-first.
+ *
+ * Called with no `packageDir` — which is how every call site read it before
+ * this function existed — `loadZigBuildConfig` reads the ROOT `build.zig` /
+ * `build.zig.zon` and nothing else. That is the whole configuration of a
+ * single-package repo and none of the configuration of a monorepo: a repo
+ * laying its packages out as `packages/<name>/build.zig` has no root build
+ * files at all, so the loader answers `null` and EVERY bare
+ * `@import("<module>")` in it goes unresolved — cross-file resolution silently
+ * degrades to relative imports only. Measured on a two-package fixture:
+ * `config = null`, `@import("core")` → `null`.
+ *
+ * The loader itself is not root-bound any more: this function is what supplies
+ * it a `packageDir`, one per package below.
+ *
+ * So the packages are discovered the way tsconfigs are (`findTsconfigFiles`):
+ * one bounded breadth-first walk that skips the hardcoded ignore set, then
+ * deepest-first ordering so `zigPackageFor` can take the first match.
+ *
+ * Called from `ScopeResolver.loadResolutionConfig`, which the orchestrator runs
+ * once per LANGUAGE workspace pass — so the walk happens only for repos that
+ * actually contain Zig. `loadImportConfigs`, which runs unconditionally for
+ * every repo, keeps calling `loadZigBuildConfig` for the root package alone;
+ * that is the same split TypeScript already has between the cheap
+ * `loadTsconfigPaths` and the repo-walking `loadTsconfigIndex`.
+ */
+export async function loadZigWorkspaceIndex(repoRoot) {
+    const dirs = await findZigPackageDirs(repoRoot);
+    if (dirs.length === 0)
+        return null;
+    const packages = [];
+    for (const dir of dirs) {
+        const config = await loadZigBuildConfig(repoRoot, dir);
+        // A `build.zig` that declares no module and no path dep contributes nothing
+        // a lookup could answer with. Keeping it as an empty scope would be worse
+        // than dropping it: it would shadow an enclosing package that DOES declare
+        // the name, and answer nothing in its place.
+        if (config !== null)
+            packages.push({ dir, config });
+    }
+    if (packages.length === 0)
+        return null;
+    // Deepest first, so `zigPackageFor` takes the most specific package rather
+    // than whichever the walk reached first.
+    packages.sort((a, b) => b.dir.length - a.dir.length || a.dir.localeCompare(b.dir));
+    return { packages };
+}
+/** Repo-relative directories holding a `build.zig` and/or a `build.zig.zon`. */
+async function findZigPackageDirs(repoRoot) {
+    const found = [];
+    const queue = [{ dir: repoRoot, depth: 0 }];
+    // A HEAD INDEX rather than `queue.shift()`. The queue is pushed to while it is
+    // drained, which keeps the array in a mode where `shift()` memmoves the whole
+    // remainder instead of taking V8's left-trimming fast path — so the walk is
+    // quadratic in the frontier, and `ZIG_SCAN_MAX_DIRS` is the bound on how bad
+    // that gets. Measured at that bound (20,000 dequeues): 53 ms at fan-out 4 and
+    // 81 ms at fan-out 20, against 0.8 ms here — 66-106x, paid before any config
+    // is read. Memory is unchanged: entries were already retained by the pushes,
+    // `shift()` only dropped the head.
+    let queueHead = 0;
+    let dirsScanned = 0;
+    while (queueHead < queue.length && dirsScanned < ZIG_SCAN_MAX_DIRS) {
+        const { dir, depth } = queue[queueHead++];
+        dirsScanned++;
+        let entries;
+        try {
+            entries = await fs.readdir(dir, { withFileTypes: true });
+        }
+        catch {
+            continue;
+        }
+        let isPackage = false;
+        for (const entry of entries) {
+            if (entry.isDirectory()) {
+                const childDir = path.join(dir, entry.name);
+                if (isHardcodedIgnoredDirectoryAtPath(repoRoot, childDir))
+                    continue;
+                if (depth < ZIG_SCAN_MAX_DEPTH)
+                    queue.push({ dir: childDir, depth: depth + 1 });
+                continue;
+            }
+            if (!entry.isFile())
+                continue;
+            // Either marker declares a package: a `build.zig` with no zon still names
+            // modules, and a zon with no build.zig still names path deps.
+            if (entry.name === 'build.zig' || entry.name === 'build.zig.zon')
+                isPackage = true;
+        }
+        if (isPackage) {
+            const rel = path.relative(repoRoot, dir).split(path.sep).join('/');
+            found.push(rel === '.' || rel === '' ? '' : rel);
+        }
+    }
+    return found;
+}
 /**
  * Normalize a `.path` value from build.zig.zon into a repo-relative form.
  * Returns null for paths that escape the repo root (start with `..`) or
@@ -557,13 +737,37 @@ export async function loadZigBuildConfig(repoRoot) {
  * to the empty string (the repo root itself). Shared with the import
  * resolver so both sides agree on which deps are in-repo.
  */
+/**
+ * Does this `.path` value point outside the repository BY ITS SPELLING —
+ * POSIX absolute (`/dep`), Windows drive-qualified (`C:\dep`, `C:/dep`),
+ * root-relative (`\dep`) or UNC (`\\server\share`)?
+ *
+ * Separators are normalized first so every Windows spelling is visible to the
+ * one test. Exported-in-spirit rather than inlined because it must be asked in
+ * TWO places and the two must not drift: `normalizeZigDepPath` asks it of the
+ * value it is given, and `loadZigBuildConfig` asks it of a NESTED package's
+ * value BEFORE prefixing the package directory. That second call is the whole
+ * point — prefixing turns `/dep` into `packages/app//dep`, which is relative by
+ * inspection, so the check inside `normalizeZigDepPath` no longer sees an
+ * absolute path and the empty segment is simply dropped, mapping an
+ * out-of-repo dependency onto a real in-repo directory if one happens to exist.
+ *
+ * `path.posix.join` is NOT a substitute: it strips the leading slash too
+ * (`join('packages/app/', '/dep')` is `packages/app/dep`), so it produces the
+ * same fabricated path without ever rejecting anything.
+ *
+ * A `..` prefix is deliberately NOT handled here. `../core` escapes the
+ * package but not necessarily the repo, and rebasing it is exactly what the
+ * nested-package branch exists to do; `normalizeZigDepPath` rejects the ones
+ * that still escape the ROOT after rebasing.
+ */
+function isAbsoluteZigDepPath(depPath) {
+    const normalized = depPath.replace(/\\/g, '/');
+    return normalized.startsWith('/') || /^[A-Za-z]:\//.test(normalized);
+}
 export function normalizeZigDepPath(depPath) {
-    // Normalize separators BEFORE the absolute check so every Windows spelling
-    // is visible to it: POSIX (`/x`), drive (`C:\x`, `C:/x`), root-relative
-    // (`\x` → `/x`) and UNC (`\\server\share` → `//server/share`) paths all
-    // point outside the repository.
     const normalized = depPath.replace(/\\/g, '/');
-    if (normalized.startsWith('/') || /^[A-Za-z]:\//.test(normalized))
+    if (isAbsoluteZigDepPath(depPath))
         return null;
     const parts = [];
     for (const part of normalized.split('/')) {

package/dist/core/ingestion/languages/typescript/query.d.ts

@@ -51,6 +51,37 @@
  */
 import Parser from 'tree-sitter';
 export declare const TYPESCRIPT_SCOPE_QUERY: string;
+/**
+ * JSX-only query suffix. Appended to the base query when compiling
+ * against the TSX grammar; NOT compiled against the plain TS grammar
+ * (which has no \`jsx_*\` node types and would reject these patterns).
+ *
+ * Why JSX as a CALLS edge: \`<Foo />\` is syntactic sugar for \`Foo(props)\`
+ * and the React component is invoked by the renderer, so for blast-radius
+ * (\`gitnexus_impact("Badge", direction: "upstream")\`) and call-graph
+ * (\`gitnexus_context("Foo")\`) purposes JSX usage IS a call. Routing
+ * through \`@reference.call.free\` / \`@reference.call.member\` makes the
+ * downstream caller-walk + edge-emission paths handle JSX uniformly with
+ * ordinary call expressions — no new edge type, no schema changes.
+ *
+ * Identifier-only JSX is filtered to PascalCase via \`(#match? ... "^[A-Z]")\`
+ * so \`<div>\`, \`<span>\`, \`<button>\` and other native HTML elements (which
+ * by JSX convention start lowercase) don't emit edges to nonexistent
+ * "div" / "span" symbols. Member-form JSX (\`<Foo.Bar />\`) is always a
+ * component (HTML element names can't contain dots), so no predicate
+ * filter is applied there.
+ *
+ * Both \`jsx_self_closing_element\` (\`<Foo />\`) and \`jsx_opening_element\`
+ * (\`<Foo>...</Foo>\`) emit; the closing tag is intentionally NOT captured —
+ * each JSX element should emit exactly one CALLS edge per use site.
+ */
+/**
+ * Exported alongside `TYPESCRIPT_SCOPE_QUERY` so
+ * `value-ref-dispatchability.test.ts` checks the whole query a `.tsx` file is
+ * analyzed with. Checking the base alone would miss a `value-ref` rule added
+ * here. Not part of the provider surface — use `getTsScopeQuery`.
+ */
+export declare const TSX_JSX_QUERY_SUFFIX = "\n;; <Foo />\n((jsx_self_closing_element\n  name: (identifier) @reference.name) @reference.call.free\n  (#match? @reference.name \"^[A-Z]\"))\n\n;; <Foo> ... </Foo>  (paired form \u2014 match the opening tag only)\n((jsx_opening_element\n  name: (identifier) @reference.name) @reference.call.free\n  (#match? @reference.name \"^[A-Z]\"))\n\n;; <Foo.Bar />  /  <Container.Section.Title />  \u2014 namespaced JSX\n(jsx_self_closing_element\n  name: (member_expression\n    object: (_) @reference.receiver\n    property: (property_identifier) @reference.name)) @reference.call.member\n\n(jsx_opening_element\n  name: (member_expression\n    object: (_) @reference.receiver\n    property: (property_identifier) @reference.name)) @reference.call.member\n";
 /**
  * Return the right tree-sitter parser for `filePath` (or the TS parser
  * when no path is given — the legacy callsite shape).

package/dist/core/ingestion/languages/typescript/query.js

@@ -1338,7 +1338,13 @@ export const TYPESCRIPT_SCOPE_QUERY = `
  * (\`<Foo>...</Foo>\`) emit; the closing tag is intentionally NOT captured —
  * each JSX element should emit exactly one CALLS edge per use site.
  */
-const TSX_JSX_QUERY_SUFFIX = `
+/**
+ * Exported alongside `TYPESCRIPT_SCOPE_QUERY` so
+ * `value-ref-dispatchability.test.ts` checks the whole query a `.tsx` file is
+ * analyzed with. Checking the base alone would miss a `value-ref` rule added
+ * here. Not part of the provider surface — use `getTsScopeQuery`.
+ */
+export const TSX_JSX_QUERY_SUFFIX = `
 ;; <Foo />
 ((jsx_self_closing_element
   name: (identifier) @reference.name) @reference.call.free

package/dist/core/ingestion/languages/zig/query.d.ts

@@ -1,3 +1,29 @@
 import Parser from 'tree-sitter';
+/**
+ * Zig scope-resolution query (RFC #909 Ring 3).
+ *
+ * The grammar is vendored (`vendor/tree-sitter-zig`) and may be absent on a
+ * platform without a prebuild, so the language module is required lazily and
+ * `getZigParser` / `getZigScopeQuery` throw only when actually invoked without
+ * the grammar installed. That is safe: the parse pipeline filters `.zig` files
+ * through `parser-loader.isLanguageAvailable` before any scope extraction runs.
+ *
+ * Zig specifics encoded here:
+ *   - Containers (struct/enum/union/opaque) are anonymous nodes bound by the
+ *     enclosing `variable_declaration`; declarations capture the binding
+ *     identifier from the wrapper.
+ *   - `@import` is a builtin call, not import-statement syntax; the
+ *     `#eq?` predicate keeps other builtins (@sizeOf, @as, …) out.
+ *   - A plain `(variable_declaration (identifier))` rule would also match
+ *     container and import bindings — `emitZigScopeCaptures` filters those
+ *     groups out so a name binds exactly once.
+ */
+/**
+ * Exported for `value-ref-dispatchability.test.ts`, which reads every language's
+ * scope query to enforce the keyed/unkeyed partition that
+ * `callableValueReferenceBoundaries`' dispatch exclusion depends on. Not part of
+ * the provider surface — nothing else should import it.
+ */
+export declare const ZIG_SCOPE_QUERY = "\n;; Scopes\n(source_file) @scope.module\n(struct_declaration) @scope.class\n(enum_declaration) @scope.class\n(union_declaration) @scope.class\n(opaque_declaration) @scope.class\n(function_declaration) @scope.function\n(test_declaration) @scope.function\n(block) @scope.block\n\n;; Declarations \u2014 functions (relabeled @declaration.method inside containers\n;; by emitZigScopeCaptures, mirroring the provider's labelOverride)\n(function_declaration\n  name: (identifier) @declaration.name) @declaration.function\n\n;; Declarations \u2014 named tests. Same naming rule as ZIG_QUERIES: the string\n;; node WITH quotes, so the def joins the graph node and never collides with\n;; a same-named fn. Anonymous / decl-form tests are scopes without a def.\n(test_declaration\n  (string) @declaration.name) @declaration.function\n\n;; Declarations \u2014 containers. The binding name lives on the wrapper\n;; variable_declaration, but the ANCHOR is the container node itself so its\n;; range equals the @scope.class range: the extractor then attaches the def\n;; to the class scope (walkers.populateClassOwnedMembers expects the\n;; class-like def among the class scope's ownedDefs) and auto-hoists the\n;; name binding to the parent scope. Keyword-gated like the ordinary\n;; binding rules: a keyword-less `x = struct {\u2026};` is an assignment\n;; (tree-sitter-zig 1.1.2 reuses variable_declaration), not a container def.\n(variable_declaration\n  \"const\" . (identifier) @declaration.name\n  (struct_declaration) @declaration.struct)\n(variable_declaration\n  \"var\" . (identifier) @declaration.name\n  (struct_declaration) @declaration.struct)\n(variable_declaration\n  \"const\" . (identifier) @declaration.name\n  (enum_declaration) @declaration.enum)\n(variable_declaration\n  \"var\" . (identifier) @declaration.name\n  (enum_declaration) @declaration.enum)\n(variable_declaration\n  \"const\" . (identifier) @declaration.name\n  (union_declaration) @declaration.union)\n(variable_declaration\n  \"var\" . (identifier) @declaration.name\n  (union_declaration) @declaration.union)\n;; opaque {} is a fieldless container that may own methods \u2014 Struct, as in\n;; ZIG_QUERIES (see the rationale there).\n(variable_declaration\n  \"const\" . (identifier) @declaration.name\n  (opaque_declaration) @declaration.struct)\n(variable_declaration\n  \"var\" . (identifier) @declaration.name\n  (opaque_declaration) @declaration.struct)\n\n;; Declarations \u2014 generic type constructors. `fn List(comptime T: type) type\n;; { return struct {\u2026}; }` is Zig's only spelling of a generic type; the\n;; returned container is anonymous in the grammar but every reader (and every\n;; caller: `List(u8)`) names it after the function. Anchor on the container\n;; so the def sits in its own class scope; the name binding is hoisted to the\n;; MODULE scope by `zigBindingScopeFor` (not the fn body, where the name\n;; would be invisible to callers) and coexists with the Function def of the\n;; same name \u2014 `List` really is both a callable and a type.\n((function_declaration\n  name: (identifier) @declaration.name\n  type: (builtin_type) @_ret\n  body: (block (expression_statement (return_expression\n    (struct_declaration) @declaration.struct))))\n  (#eq? @_ret \"type\"))\n((function_declaration\n  name: (identifier) @declaration.name\n  type: (builtin_type) @_ret\n  body: (block (expression_statement (return_expression\n    (union_declaration) @declaration.union))))\n  (#eq? @_ret \"type\"))\n((function_declaration\n  name: (identifier) @declaration.name\n  type: (builtin_type) @_ret\n  body: (block (expression_statement (return_expression\n    (enum_declaration) @declaration.enum))))\n  (#eq? @_ret \"type\"))\n\n;; Declarations \u2014 container fields (struct fields, enum/union variants).\n;; The #not-eq? guard drops the MISSING placeholder identifier tree-sitter-zig\n;; recovers for an empty container body (see ZIG_QUERIES). The optional\n;; `type:` (absent on enum variants) is captured as @declaration.field-type:\n;; `emitZigScopeCaptures` turns it into a @type-binding.field on the\n;; container's Class scope so `self.session.name()` can walk the field's\n;; type (Rust/Go parity \u2014 see the F5 block in captures.ts).\n((container_field\n  name: (identifier) @declaration.name\n  type: (_)? @declaration.field-type) @declaration.field\n  (#not-eq? @declaration.name \"\"))\n\n;; Declarations \u2014 const/var bindings (import/container groups filtered in TS).\n;; The `.` anchor pins the FIRST named child: without it the pattern also\n;; matched the initializer of `const first = target;`, minting a phantom\n;; local named `target` that shadowed the real callee for every later\n;; reference in the block. The literal keyword is load-bearing too:\n;; tree-sitter-zig 1.1.2 parses statement assignments (`x = 5;`, `x += 1;`,\n;; `_ = expr;`) as `variable_declaration` WITHOUT a keyword child, and\n;; without the keyword every assignment and every discard minted a phantom\n;; local (one `_` per statement).\n(variable_declaration\n  \"const\" . (identifier) @declaration.name) @declaration.variable\n(variable_declaration\n  \"var\" . (identifier) @declaration.name) @declaration.variable\n\n;; Imports \u2014 const x = @import(\"...\") / var x = @import(\"...\"). Keyword-gated\n;; like every binding rule: a keyword-less `x = @import(\"...\")` is a\n;; statement (see the side-effect rule below), not a binding.\n(variable_declaration\n  \"const\" . (identifier) @import.name\n  (builtin_function\n    (builtin_identifier) @_builtin\n    (arguments (string) @import.source))\n  (#eq? @_builtin \"@import\")) @import.statement\n(variable_declaration\n  \"var\" . (identifier) @import.name\n  (builtin_function\n    (builtin_identifier) @_builtin\n    (arguments (string) @import.source))\n  (#eq? @_builtin \"@import\")) @import.statement\n\n;; Imports \u2014 const X = @import(\"...\").X : a NAMED import of one member. The\n;; local name is whatever the user chose (`const Alloc = @import(\"std\").mem;`\n;; is a rename), the imported name is the member. A deeper chain\n;; (`@import(\"std\").mem.Allocator`, `@import(\"lib.zig\").B.work`) is matched\n;; by the second rule below but is NOT bound as a named import of the\n;; innermost member: that discarded the written owner (`B`) and let a\n;; same-named `A.work` answer first. `emitZigScopeCaptures` binds the module\n;; under the builtin's text instead and rewrites the alias's use sites to the\n;; full path (`collectZigDeepAliases`, PR #1432 review 8.4).\n(variable_declaration\n  \"const\" . (identifier) @import.name\n  (field_expression\n    object: (builtin_function\n      (builtin_identifier) @_builtin\n      (arguments (string) @import.source))\n    member: (identifier) @import.imported)\n  (#eq? @_builtin \"@import\")) @import.statement\n(variable_declaration\n  \"const\" . (identifier) @import.name\n  (field_expression\n    object: (field_expression\n      object: (builtin_function\n        (builtin_identifier) @_builtin\n        (arguments (string) @import.source)))\n    member: (identifier) @import.imported)\n  (#eq? @_builtin \"@import\")) @import.statement\n\n;; Imports \u2014 a keyword-less `<ident> = @import(\"...\");` statement\n;; (`_ = @import(\"all_tests.zig\");` in a test block, the refAllDecls\n;; idiom): tree-sitter-zig reuses `variable_declaration` for assignments, so\n;; the shape is a declaration minus the keyword. It references the file\n;; without binding a name \u2014 a side-effect import. Tree-sitter queries cannot\n;; say \"no keyword child\", so this rule matches the keyword-bearing shapes\n;; too; `emitZigScopeCaptures` keeps it only when `isZigKeywordDeclaration`\n;; is false (the keyword shapes are the binding rules above).\n(variable_declaration\n  . (identifier)\n  (builtin_function\n    (builtin_identifier) @_builtin\n    (arguments (string) @import.source))\n  (#eq? @_builtin \"@import\")) @import.side-effect\n\n;; Aliases of a namespace member \u2014 const Counter = counter.Counter; where\n;; `counter` is an @import binding of THIS file. The query cannot know which\n;; identifiers are import bindings, so it captures every one-level member\n;; alias and `emitZigScopeCaptures` promotes the ones whose object is a\n;; known @import to a named import (same fact as `const Counter =\n;; @import(\"counter.zig\").Counter;`); the rest stay ordinary variables.\n;; Only the ONE-level shape is promoted; a deeper chain (`lib.B.work`,\n;; `std.mem.Allocator`) is a deep alias \u2014 a Const whose use sites are\n;; rewritten to the written owner path (see the import rule above, 8.4).\n(variable_declaration\n  \"const\" . (identifier) @alias.name\n  (field_expression\n    object: (identifier) @alias.namespace\n    member: (identifier) @alias.member) .) @alias.statement\n(variable_declaration\n  \"const\" . (identifier) @alias.name\n  (field_expression\n    object: (field_expression\n      object: (identifier) @alias.namespace)\n    member: (identifier) @alias.member) .) @alias.statement\n\n;; Imports \u2014 pub usingnamespace @import(\"...\"); : every pub decl of the target\n;; becomes a decl of this container (removed from the language in 0.15, still\n;; everywhere in 0.11\u20130.14 code). Modelled as a wildcard import.\n(using_namespace_declaration\n  (builtin_function\n    (builtin_identifier) @_builtin\n    (arguments (string) @import.source))\n  (#eq? @_builtin \"@import\")) @import.wildcard\n\n;; Imports \u2014 `@import(\"...\")` in ANY other position: a tuple element\n;; (`pub const Interfaces = .{ @import(\"a.zig\"), @import(\"b.zig\") }`, the\n;; JS-API registration table), a call argument (`event.is(@import(\"x.zig\"))`),\n;; a comparison operand (`T == @import(\"x.zig\").T`), the receiver of a\n;; member call (`try @import(\"dump.zig\").root(...)`), a 3-deep member chain\u2026\n;; Every one of them is a file dependency; only the const/var/usingnamespace\n;; shapes above bind a name. This rule matches EVERY `@import` builtin, the\n;; bound shapes included \u2014 `emitZigScopeCaptures` drops the matches whose\n;; string node a binding rule (or the keyword-less side-effect rule) already\n;; claimed, so a bound import is never doubled, and emits the rest as\n;; side-effect imports (file edge, no binding) \u2014 except the member-call\n;; receiver, which becomes a namespace import keyed by its own source text so\n;; the call resolves into the imported module (see the emitter).\n((builtin_function\n  (builtin_identifier) @_builtin\n  (arguments (string) @import.source))\n  (#eq? @_builtin \"@import\")) @import.inline\n\n;; Type bindings \u2014 parameter annotations (incl. self: *T receivers)\n(parameter\n  name: (identifier) @type-binding.name\n  type: (_) @type-binding.type) @type-binding.parameter\n\n;; Type bindings \u2014 constructor inference: const p = T{ ... }. Keyword-gated\n;; like every binding rule: a keyword-less `p = T{ ... };` is a\n;; re-assignment (same node type in tree-sitter-zig 1.1.2), and Zig's static\n;; typing means `p` already carries its type from its declaration\n;; (annotation, constructor or inferred value) \u2014 the assignment declares\n;; nothing, and `_ = T{ ... };` must not bind `_`.\n(variable_declaration\n  \"const\" . (identifier) @type-binding.name\n  (struct_initializer\n    (identifier) @type-binding.type)) @type-binding.constructor\n(variable_declaration\n  \"var\" . (identifier) @type-binding.name\n  (struct_initializer\n    (identifier) @type-binding.type)) @type-binding.constructor\n\n;; Type bindings \u2014 qualified constructor: const p = mod.T{ ... }. The whole\n;; field_expression is captured so the dotted text \"mod.T\" survives \u2014\n;; receiver dispatch resolves the namespace prefix through the import\n;; binding (emitReceiverBoundCalls Case 3).\n(variable_declaration\n  \"const\" . (identifier) @type-binding.name\n  (struct_initializer\n    (field_expression) @type-binding.type)) @type-binding.constructor\n(variable_declaration\n  \"var\" . (identifier) @type-binding.name\n  (struct_initializer\n    (field_expression) @type-binding.type)) @type-binding.constructor\n\n;; Type bindings \u2014 generic instantiation literal: const l = List(u8){ ... }.\n;; The callee is the type constructor; `normalizeZigTypeName` drops the\n;; comptime argument list so `List(u8)` looks up `List`.\n(variable_declaration\n  \"const\" . (identifier) @type-binding.name\n  (struct_initializer\n    (call_expression) @type-binding.type)) @type-binding.constructor\n(variable_declaration\n  \"var\" . (identifier) @type-binding.name\n  (struct_initializer\n    (call_expression) @type-binding.type)) @type-binding.constructor\n\n;; Type bindings \u2014 declared type: var x: T = \u2026; const x: T = .init(\u2026);\n;; The annotation is the ONLY type source for `= undefined` and for 0.14+\n;; decl literals (`.init`, `.empty`), which are the idiomatic\n;; constructors in current std. Ranked below constructor inference by the\n;; shared resolver (source 'annotation'), so a literal on the right still\n;; wins when both are present.\n(variable_declaration\n  . (identifier) @type-binding.name\n  type: (_) @type-binding.type) @type-binding.annotation\n\n;; Type bindings \u2014 value inference (F6): const t = <value>; where <value> is a\n;; call (`Counter.init()`, `makeThing()`, `node.asElement()`), possibly\n;; wrapped in `try` / `catch \u2026` / `\u2026 orelse \u2026` / parentheses \u2014 the shape of\n;; nearly every Zig constructor call (`const p = try Page.init(\u2026)`). The\n;; query only pins the declaration; `emitZigScopeCaptures` unwraps the\n;; wrappers and rewrites `@type-binding.type` to the type source (see\n;; `zigCallReturnTypeOf`). Keyword-gated: `_ = e.top();` is an assignment\n;; (same node type), not a binding of `_`. Rust's twin is\n;; `let x = Foo::new()` / `let x = foo().await`.\n(variable_declaration\n  \"const\" . (identifier) @type-binding.name\n  (_) @type-binding.value .) @type-binding.call-return\n(variable_declaration\n  \"var\" . (identifier) @type-binding.name\n  (_) @type-binding.value .) @type-binding.call-return\n\n;; Type bindings \u2014 return-type annotation (F6): `fn make() !*Thing` binds\n;; `make \u21A6 Thing` in the enclosing scope (Module for free fns, the container's\n;; Class scope for methods \u2014 that is where the compound resolver reads a\n;; method's return type for `node.asElement()`), so `const t = makeThing()`\n;; chains to `Thing`. Rust: `(function_item \u2026 return_type:) @type-binding.return`.\n;; `emitZigScopeCaptures` drops builtin / `type` returns (a `List \u21A6 type`\n;; binding would hijack the `List(u8){}` constructor chain).\n(function_declaration\n  name: (identifier) @type-binding.name\n  type: (_) @type-binding.type) @type-binding.return\n\n;; Type bindings \u2014 aliases (F5 field-access aliases + F7 type aliases):\n;; `const page = self.page;` (F5: the RHS path is kept verbatim as the\n;; \"type\", the compound resolver's member-alias branch re-resolves it as a\n;; receiver chain \u2014 head `self` \u2192 class \u2192 field type), `const LocalAlias = Local;`,\n;; `const Proto = HtmlElement;`, `const T2 = Thing;` (alias of an alias /\n;; import), `const B = util.List(u8);` (an INSTANTIATED generic type\n;; constructor). Zig has no `type X = Y` syntax \u2014 a type alias is a const\n;; whose value is a type expression, and it stays a Const in the graph. What\n;; must change is the scope side: bind the alias NAME to the value's type\n;; text (Rust's `let x = y` / JS's `const B = Foo` `@type-binding.alias`,\n;; source 'assignment-inferred'), so `LocalAlias.mk()` types through Case 4,\n;; `B.init()` / `x: B` / `B{}` through Case 3 once `normalizeZigTypeName`\n;; drops the comptime arguments (`util.List(u8)` \u2192 `util.List`), and every\n;; binding that names the alias (`var l = LocalAlias.mk()`, `var x: B`) is\n;; chained to the target by the shared `followChainedRef` /\n;; `followChainPostFinalize`. The identifier / member shapes take `var` too:\n;; `var node = orig_node;` is the same value alias as Rust's `let x = y`\n;; and chains to the type of `orig_node` (a Zig type is comptime and never\n;; `var`, so the type-alias reading only ever applies to `const`). The\n;; call shape is `const`-only and kept only when the callee's last\n;; identifier is TitleCase \u2014 see `emitZigScopeCaptures` (a value call\n;; `const t = util.makeThing()` belongs to the call-return rules above and\n;; must not receive a competing binding). A promoted namespace-member alias\n;; (`const Counter = counter.Counter;` \u2192 named import) is skipped there too:\n;; the import binding already carries the type.\n(variable_declaration\n  \"const\" . (identifier) @type-binding.name\n  (identifier) @type-binding.type .) @type-binding.alias\n(variable_declaration\n  \"var\" . (identifier) @type-binding.name\n  (identifier) @type-binding.type .) @type-binding.alias\n(variable_declaration\n  \"const\" . (identifier) @type-binding.name\n  (field_expression) @type-binding.type .) @type-binding.alias\n(variable_declaration\n  \"var\" . (identifier) @type-binding.name\n  (field_expression) @type-binding.type .) @type-binding.alias\n(variable_declaration\n  \"const\" . (identifier) @type-binding.name\n  (call_expression) @type-binding.type .) @type-binding.alias\n\n;; References \u2014 VALUE positions (#3399): a callable named where a value is\n;; expected rather than where a callee is. Zig's JS bridge is built entirely\n;; out of this shape \u2014\n;;\n;;     pub const namespaceURI = bridge.accessor(Element.getNamespaceUri, null, .{});\n;;\n;; \u2014 2,047 such declarations across 257 files in lightpanda-io/browser, the\n;; project's whole JS\u2194Zig surface, and NONE of them reached the graph: Zig\n;; emitted no `value-ref` capture at all, so a public DOM accessor's only\n;; recorded callers were the two internal ones and `impact` called that `exact`.\n;;\n;; These become reference-class USES edges through the existing\n;; `mapReferenceKindToEdgeType` mapping \u2014 a registration is not an invocation\n;; (Kythe `ref` vs `ref/call`; Joern `METHOD_REF`) \u2014 resolved by the\n;; property-dispatch pass, which keeps ONLY callable targets. That callable gate\n;; is what makes these deliberately broad rules safe: `js.Bridge(Element)` and\n;; `register(count)` match too, and emit nothing, exactly as TypeScript's\n;; `{ port: DEFAULT_PORT }` does.\n;;\n;; No `@reference.property-key` is attached: Zig has no object-literal key to\n;; dispatch through, so these register a reference and never synthesize CALLS.\n;; The terminal invoke \u2014 `Accessor.init` \u2192 a struct field \u2192 `Factory.zig`'s\n;; `inline for`/`@typeInfo` \u2192 `@call(.auto, func, args)` \u2014 needs comptime\n;; evaluation and is deliberately NOT modelled; `impact` reports the shortfall\n;; as `epistemic: \"lower-bound\"` instead of pretending to certainty.\n\n;; Call ARGUMENTS. In tree-sitter-zig arguments are direct children of\n;; `call_expression`, NOT wrapped in an `arguments` node (only builtins have\n;; one), so the callee has to be consumed explicitly by `function:` \u2014 without\n;; that binding the same rule also matches the callee of `foo(bar)` and mints a\n;; USES edge duplicating the call.\n(call_expression\n  function: (_)\n  (identifier) @reference.name @reference.value-ref)\n\n;; Qualified argument \u2014 `bridge.accessor(Element.getNamespaceUri, \u2026)`. The\n;; RECEIVER is captured alongside the member so the site carries the owner it\n;; was written with; `@reference.name` stays the member, which is the name the\n;; scope walk resolves.\n(call_expression\n  function: (_)\n  (field_expression\n    object: (_) @reference.receiver\n    member: (identifier) @reference.name) @reference.value-ref)\n\n;; Const binding initialiser \u2014 `pub const defaultHandler = onReset;`. Both\n;; anchors are load-bearing: the leading `.` pins the bound name to the first\n;; named child (see the declaration rules above), and the trailing `.` keeps the\n;; initializer as the LAST child, so a `const x: T = y` annotation shape cannot\n;; put the TYPE in value position.\n(variable_declaration\n  \"const\" . (identifier)\n  (identifier) @reference.name @reference.value-ref .)\n\n;; References \u2014 free calls: foo(...)\n(call_expression\n  function: (identifier) @reference.name) @reference.call.free\n\n;; References \u2014 member calls: obj.method(...) / mod.fn(...)\n(call_expression\n  function: (field_expression\n    object: (_) @reference.receiver\n    member: (identifier) @reference.name)) @reference.call.member\n\n;; References \u2014 constructor uses: T{ ... }\n(struct_initializer\n  (identifier) @reference.name) @reference.call.constructor\n\n;; References \u2014 qualified constructor uses: mod.T{ ... } / hub.sub.T{ ... }\n;; Captured with the RECEIVER, not as a free constructor with a raw qualified\n;; name, on purpose: the free-call fallback resolves a qualified constructor by\n;; its simple tail, and a workspace-unique `Thing` then answers for\n;; `other.Thing{}` whichever module the source named (measured: `c.Thing{}`\n;; with no `Thing` in c.zig bound to a.zig's). With the receiver the site goes\n;; through the receiver-bound namespace case, which resolves the member inside\n;; the module the receiver is bound to \u2014 the same path `mod.fn()` takes \u2014 so\n;; `a.Thing{}` and `b.Thing{}` each bind their own file and `std.Thread.Mutex{}`\n;; binds nothing even when a local `Mutex` exists.\n(struct_initializer\n  (field_expression\n    object: (_) @reference.receiver\n    member: (identifier) @reference.name)) @reference.call.constructor\n\n;; References \u2014 generic instantiation literals: List(u8){ ... } /\n;; lists.List(u8){ ... }. The type head is a call_expression \u2014 the\n;; instantiation of the type constructor \u2014 which neither constructor rule\n;; above matches, so the OUTER aggregate event had no site: only the inner\n;; `List(u8)` call (a free / member call reference on the call node) reached\n;; the graph (PR #1432 review, 8.11). Two sites on two anchors: the call\n;; (an invocation of `List`) and this initializer (a construction of the\n;; container `List` returns, marked `(constructor)`). The receiver form goes\n;; through the same namespace path as `mod.T{}`.\n(struct_initializer\n  (call_expression\n    function: (identifier) @reference.name)) @reference.call.constructor\n(struct_initializer\n  (call_expression\n    function: (field_expression\n      object: (_) @reference.receiver\n      member: (identifier) @reference.name))) @reference.call.constructor\n";
 export declare function getZigParser(): Parser;
 export declare function getZigScopeQuery(): Parser.Query;

package/dist/core/ingestion/languages/zig/query.js

@@ -19,7 +19,13 @@ import { requireVendoredGrammar } from '../../../tree-sitter/vendored-grammars.j
  *     container and import bindings — `emitZigScopeCaptures` filters those
  *     groups out so a name binds exactly once.
  */
-const ZIG_SCOPE_QUERY = `
+/**
+ * Exported for `value-ref-dispatchability.test.ts`, which reads every language's
+ * scope query to enforce the keyed/unkeyed partition that
+ * `callableValueReferenceBoundaries`' dispatch exclusion depends on. Not part of
+ * the provider surface — nothing else should import it.
+ */
+export const ZIG_SCOPE_QUERY = `
 ;; Scopes
 (source_file) @scope.module
 (struct_declaration) @scope.class
@@ -358,6 +364,60 @@ const ZIG_SCOPE_QUERY = `
   "const" . (identifier) @type-binding.name
   (call_expression) @type-binding.type .) @type-binding.alias
 
+;; References — VALUE positions (#3399): a callable named where a value is
+;; expected rather than where a callee is. Zig's JS bridge is built entirely
+;; out of this shape —
+;;
+;;     pub const namespaceURI = bridge.accessor(Element.getNamespaceUri, null, .{});
+;;
+;; — 2,047 such declarations across 257 files in lightpanda-io/browser, the
+;; project's whole JS↔Zig surface, and NONE of them reached the graph: Zig
+;; emitted no \`value-ref\` capture at all, so a public DOM accessor's only
+;; recorded callers were the two internal ones and \`impact\` called that \`exact\`.
+;;
+;; These become reference-class USES edges through the existing
+;; \`mapReferenceKindToEdgeType\` mapping — a registration is not an invocation
+;; (Kythe \`ref\` vs \`ref/call\`; Joern \`METHOD_REF\`) — resolved by the
+;; property-dispatch pass, which keeps ONLY callable targets. That callable gate
+;; is what makes these deliberately broad rules safe: \`js.Bridge(Element)\` and
+;; \`register(count)\` match too, and emit nothing, exactly as TypeScript's
+;; \`{ port: DEFAULT_PORT }\` does.
+;;
+;; No \`@reference.property-key\` is attached: Zig has no object-literal key to
+;; dispatch through, so these register a reference and never synthesize CALLS.
+;; The terminal invoke — \`Accessor.init\` → a struct field → \`Factory.zig\`'s
+;; \`inline for\`/\`@typeInfo\` → \`@call(.auto, func, args)\` — needs comptime
+;; evaluation and is deliberately NOT modelled; \`impact\` reports the shortfall
+;; as \`epistemic: "lower-bound"\` instead of pretending to certainty.
+
+;; Call ARGUMENTS. In tree-sitter-zig arguments are direct children of
+;; \`call_expression\`, NOT wrapped in an \`arguments\` node (only builtins have
+;; one), so the callee has to be consumed explicitly by \`function:\` — without
+;; that binding the same rule also matches the callee of \`foo(bar)\` and mints a
+;; USES edge duplicating the call.
+(call_expression
+  function: (_)
+  (identifier) @reference.name @reference.value-ref)
+
+;; Qualified argument — \`bridge.accessor(Element.getNamespaceUri, …)\`. The
+;; RECEIVER is captured alongside the member so the site carries the owner it
+;; was written with; \`@reference.name\` stays the member, which is the name the
+;; scope walk resolves.
+(call_expression
+  function: (_)
+  (field_expression
+    object: (_) @reference.receiver
+    member: (identifier) @reference.name) @reference.value-ref)
+
+;; Const binding initialiser — \`pub const defaultHandler = onReset;\`. Both
+;; anchors are load-bearing: the leading \`.\` pins the bound name to the first
+;; named child (see the declaration rules above), and the trailing \`.\` keeps the
+;; initializer as the LAST child, so a \`const x: T = y\` annotation shape cannot
+;; put the TYPE in value position.
+(variable_declaration
+  "const" . (identifier)
+  (identifier) @reference.name @reference.value-ref .)
+
 ;; References — free calls: foo(...)
 (call_expression
   function: (identifier) @reference.name) @reference.call.free