gitnexus 1.6.13-rc.25 → 1.6.13-rc.26

package/README.md

@@ -187,8 +187,8 @@ Your AI agent gets **17 tools** (15 per-repo + 2 group) automatically:
 | Tool             | What It Does                                                           |
 | ---------------- | ---------------------------------------------------------------------- |
 | `list_repos`     | Discover all indexed repositories (paginated — `limit`/`offset`)       |
-| `query`          | Process-grouped hybrid search (BM25 + semantic + RRF)                  |
-| `context`        | 360-degree symbol view — categorized refs, process participation       |
+| `query`          | Process-grouped hybrid search (BM25 + semantic + RRF); optional `chain_depth` expands each result's call chain |
+| `context`        | 360-degree symbol view — categorized refs, process participation, HTTP routes, `is_entry_point` flag; optional `chain_depth` call-chain expansion |
 | `impact`         | Blast radius analysis with depth grouping and confidence               |
 | `trace`          | Shortest directed path between two symbols (call + class-member edges) |
 | `detect_changes` | Git-diff impact — maps changed lines to affected processes             |

package/dist/core/group/service.d.ts

@@ -40,6 +40,7 @@ export interface GroupToolPort {
         limit?: number;
         max_symbols?: number;
         include_content?: boolean;
+        chain_depth?: number;
     }): Promise<unknown>;
     impactByUid(repoId: string, uid: string, direction: string, opts: {
         maxDepth: number;
@@ -53,6 +54,7 @@ export interface GroupToolPort {
         uid?: string;
         file_path?: string;
         include_content?: boolean;
+        chain_depth?: number;
     }): Promise<unknown>;
     trace?(repo: GroupRepoHandle, params: {
         from?: string;

package/dist/core/group/service.js

@@ -6,6 +6,7 @@ import fsp from 'node:fs/promises';
 import path from 'node:path';
 import { checkStaleness } from '../git-staleness.js';
 import { stalenessStatus } from '../staleness-status.js';
+import { mapConcurrent } from '../../lib/utils.js';
 import { canonicalizePath, loadMeta, readRegistryStrict, registryPathEquals, } from '../../storage/repo-manager.js';
 import { crossRepoCompleteness } from './completeness.js';
 import { recordedMatchStages, recordedRepoList } from './completeness.js';
@@ -246,6 +247,39 @@ function rejectRetiredSyncParams(params) {
     }
     return null;
 }
+/** Advertised MCP query page bounds (tools.ts schema). Mirrored so core stays MCP-free. */
+const GROUP_QUERY_DEFAULT_LIMIT = 10;
+const GROUP_QUERY_MAX_LIMIT = 100;
+const GROUP_QUERY_DEFAULT_MAX_SYMBOLS = 25;
+const GROUP_QUERY_MAX_SYMBOLS = 200;
+const GROUP_CHAIN_MAX_DEPTH = 3;
+/** Cap per-member fan-out for group query/context. Complements LocalBackend's per-query BFS cap. */
+const GROUP_MEMBER_CONCURRENCY = 4;
+function parseGroupQueryBound(value, field, fallback, max) {
+    if (value === undefined)
+        return { ok: true, value: fallback };
+    if (typeof value !== 'number' || !Number.isInteger(value) || value < 1 || value > max) {
+        return {
+            ok: false,
+            error: `Invalid "${field}": expected an integer in [1, ${max}], got ${describeValue(value)}.`,
+        };
+    }
+    return { ok: true, value };
+}
+function parseGroupChainDepth(value) {
+    if (value === undefined)
+        return { ok: true, value: undefined };
+    if (typeof value !== 'number' ||
+        !Number.isInteger(value) ||
+        value < 0 ||
+        value > GROUP_CHAIN_MAX_DEPTH) {
+        return {
+            ok: false,
+            error: `Invalid "chain_depth": expected an integer in [0, ${GROUP_CHAIN_MAX_DEPTH}], got ${describeValue(value)}.`,
+        };
+    }
+    return { ok: true, value };
+}
 export class GroupService {
     port;
     constructor(port) {
@@ -453,6 +487,11 @@ export class GroupService {
         if (!uid && !target) {
             return { group: name, error: 'target or uid is required', results: [] };
         }
+        const parsedChainDepth = parseGroupChainDepth(params.chain_depth);
+        if (parsedChainDepth.ok === false) {
+            return { group: name, error: parsedChainDepth.error, results: [] };
+        }
+        const chain_depth = parsedChainDepth.value;
         const groupDir = getGroupDir(getDefaultGitnexusDir(), name);
         let config;
         try {
@@ -476,7 +515,7 @@ export class GroupService {
             };
         }
         const memberEntries = Object.entries(config.repos).filter(([repoPath]) => repoInSubgroup(repoPath, subgroup, subgroupExact));
-        const results = await Promise.all(memberEntries.map(async ([repoPath, registryName]) => {
+        const results = (await mapConcurrent(memberEntries, async ([repoPath, registryName]) => {
             try {
                 const repoObj = await this.port.resolveRepo(registryName);
                 const payload = await this.port.context(repoObj, {
@@ -484,6 +523,7 @@ export class GroupService {
                     uid,
                     file_path,
                     include_content,
+                    chain_depth,
                 });
                 if (servicePrefix) {
                     const st = payload?.status;
@@ -501,7 +541,12 @@ export class GroupService {
                     payload: { error: e instanceof Error ? e.message : String(e) },
                 };
             }
-        }));
+        }, { concurrency: GROUP_MEMBER_CONCURRENCY })).map((result, index) => {
+            if (result)
+                return result;
+            const [repoPath, registryName] = memberEntries[index];
+            return { repoPath, registryName, payload: {} };
+        });
         return {
             group: name,
             target: target || uid,
@@ -520,7 +565,18 @@ export class GroupService {
             return { error: 'service must not be an empty string' };
         }
         const servicePrefix = normalizeServicePrefix(params.service);
-        const limit = typeof params.limit === 'number' && params.limit > 0 ? params.limit : 5;
+        const parsedLimit = parseGroupQueryBound(params.limit, 'limit', GROUP_QUERY_DEFAULT_LIMIT, GROUP_QUERY_MAX_LIMIT);
+        if (parsedLimit.ok === false)
+            return { error: parsedLimit.error };
+        const parsedMaxSymbols = parseGroupQueryBound(params.max_symbols, 'max_symbols', GROUP_QUERY_DEFAULT_MAX_SYMBOLS, GROUP_QUERY_MAX_SYMBOLS);
+        if (parsedMaxSymbols.ok === false)
+            return { error: parsedMaxSymbols.error };
+        const parsedChainDepth = parseGroupChainDepth(params.chain_depth);
+        if (parsedChainDepth.ok === false)
+            return { error: parsedChainDepth.error };
+        const limit = parsedLimit.value;
+        const max_symbols = parsedMaxSymbols.value;
+        const chain_depth = parsedChainDepth.value;
         const subgroup = typeof params.subgroup === 'string' ? params.subgroup : undefined;
         const subgroupExact = params.subgroupExact === true;
         const groupDir = getGroupDir(getDefaultGitnexusDir(), name);
@@ -534,14 +590,15 @@ export class GroupService {
             throw err;
         }
         const memberEntries = Object.entries(config.repos).filter(([repoPath]) => repoInSubgroup(repoPath, subgroup, subgroupExact));
-        const perRepo = await Promise.all(memberEntries.map(async ([repoPath, registryName]) => {
+        const perRepo = (await mapConcurrent(memberEntries, async ([repoPath, registryName]) => {
             try {
                 const repoObj = await this.port.resolveRepo(registryName);
                 const queryResult = (await this.port.query(repoObj, {
                     query: queryText,
                     limit,
-                    max_symbols: 10,
+                    max_symbols,
                     include_content: false,
+                    chain_depth,
                 }));
                 const processes = servicePrefix
                     ? filterQueryByServicePrefix(queryResult, servicePrefix).processes
@@ -556,7 +613,12 @@ export class GroupService {
             catch {
                 return { repo: repoPath, score: 0, processes: [] };
             }
-        }));
+        }, { concurrency: GROUP_MEMBER_CONCURRENCY })).map((result, index) => {
+            if (result)
+                return result;
+            const [repoPath] = memberEntries[index];
+            return { repo: repoPath, score: 0, processes: [] };
+        });
         const allProcesses = perRepo.flatMap((r) => r.processes);
         allProcesses.sort((a, b) => b._rrf_score - a._rrf_score);
         const topN = allProcesses.slice(0, limit);

package/dist/core/ingestion/call-processor.d.ts

@@ -31,6 +31,8 @@ interface RouteHandlerResolutionContext {
     readonly files: readonly RouteResolutionFile[];
     readonly resolveImportTarget: (parsedImport: ParsedImport, fromFile: string) => string | null;
     readonly isExportedSymbol: (nodeId: string) => boolean;
+    /** 0-based graph-node startLine for same-name tRPC handler disambiguation. */
+    readonly nodeStartLine?: (nodeId: string) => number | undefined;
 }
 /** Record one exported graph node into the incremental ExportedTypeMap. */
 export declare const accumulateExportedTypesFromParsedNode: (result: ExportedTypeMap, node: {

package/dist/core/ingestion/call-processor.js

@@ -20,8 +20,46 @@ import { normalizeFetchURL, routeMatches } from './route-extractors/nextjs.js';
 import { normalizeExtractedRoutePath, normalizeRouteMethod, routeNodeKey, } from './route-extractors/route-path.js';
 import { extractReturnTypeName } from './type-extractors/shared.js';
 import { DATA_ROUTE_TABLE_SOURCE } from './route-extractors/data-route-table.js';
+import { toZeroBasedLine } from './utils/line-base.js';
 const MAX_EXPORTS_PER_FILE = 500;
 const MAX_TYPE_NAME_LENGTH = 256;
+/** Same Function/Method gate as data-route resolution (`routeCallables`). */
+function routeCallableDefs(defs) {
+    return defs.filter((def) => def.type === 'Function' || def.type === 'Method');
+}
+/**
+ * Pick a same-file route handler from `lookupExactAll` hits.
+ *
+ * Graph nodes store 0-based `startLine`; `ExtractedRoute.lineNumber` is 1-based
+ * (`i + 1` in the tRPC scanner). File-index lookup is not callable-only, so
+ * drop Property/Variable/Const (and other non-callables) first. When several
+ * callables share a name, prefer the unique def whose node startLine equals
+ * `toZeroBasedLine(route.lineNumber)`. If that exact match is missing (common
+ * when the arrow starts on the line after `.mutation(`), take the unique def
+ * whose startLine is the nearest `>=` target. Zero or 2+ winners (or no line
+ * reader) → `undefined` (fail-open).
+ */
+function pickSameFileHandler(defs, route, getStartLine) {
+    defs = routeCallableDefs(defs);
+    if (defs.length === 1)
+        return defs[0];
+    if (defs.length > 1 && getStartLine !== undefined) {
+        const targetLine = toZeroBasedLine(route.lineNumber);
+        const withLines = defs
+            .map((def) => ({ def, startLine: Number(getStartLine(def.nodeId)) }))
+            .filter((entry) => Number.isFinite(entry.startLine));
+        const exact = withLines.filter((entry) => entry.startLine === targetLine);
+        if (exact.length === 1)
+            return exact[0].def;
+        const atOrAfter = withLines.filter((entry) => entry.startLine >= targetLine);
+        if (atOrAfter.length === 0)
+            return undefined;
+        const nearestLine = Math.min(...atOrAfter.map((entry) => entry.startLine));
+        const nearest = atOrAfter.filter((entry) => entry.startLine === nearestLine);
+        return nearest.length === 1 ? nearest[0].def : undefined;
+    }
+    return undefined;
+}
 /** Record one exported graph node into the incremental ExportedTypeMap. */
 export const accumulateExportedTypesFromParsedNode = (result, node, symbolTable) => {
     if (!node.properties?.isExported)
@@ -165,8 +203,32 @@ export const processRoutesFromExtracted = async (graph, extractedRoutes, model,
             onProgress?.(i, extractedRoutes.length);
             await yieldToEventLoop();
         }
-        if (!route.controllerName || !route.methodName)
+        if (!route.methodName)
+            continue;
+        // tRPC routes carry NO controller: a router is an object binding, not a
+        // class, so the extractor leaves controllerName unset and names the
+        // handler from the callback identifier when present, otherwise from its
+        // object-literal key. Bind the same-file symbol directly.
+        // No unique match → skip, fail-open. Laravel routes always set
+        // controllerName and Django routes leave methodName null, so this
+        // branch is tRPC-only by construction — the laravel guessed-method
+        // fallback below never sees a controller-less route.
+        if (!route.controllerName) {
+            const handler = pickSameFileHandler(model.symbols.lookupExactAll(route.filePath, route.methodName), route, (id) => graph.getNode(id)?.properties.startLine);
+            if (!handler)
+                continue;
+            const sourceId = generateId('File', route.filePath);
+            const relId = generateId('CALLS', sourceId + ':route->' + handler.nodeId);
+            graph.addRelationship({
+                id: relId,
+                sourceId,
+                targetId: handler.nodeId,
+                type: 'CALLS',
+                confidence: ROUTE_EDGE_CONFIDENCE,
+                reason: 'trpc-route',
+            });
             continue;
+        }
         // Resolve the controller class. Qualified-first: when the routes file
         // disambiguated the controller (a `use` import or inline `::class` FQN, both
         // normalized to the registry's dot-joined key shape by the extractor), look
@@ -249,8 +311,9 @@ export function resolveRouteHandlerSymbols(model, extractedRoutes, decoratorRout
     // Mirrors the routes phase `addRoute` first-writer-wins so the handler we
     // stamp always belongs to the route that actually won the Route node.
     const claimed = new Set();
-    // Resolve a single same-file symbol by name, refusing to guess on ambiguity:
-    // exactly one match → its nodeId; zero or many → undefined (fail-open).
+    // Resolve a single same-file symbol by name. Exactly one match → its nodeId.
+    // Zero or many matches → undefined (fail-open). tRPC same-name handlers
+    // use pickSameFileHandler at the controller-less call site instead.
     const uniqueSymbolId = (filePath, name) => {
         const defs = model.symbols.lookupExactAll(filePath, name);
         return defs.length === 1 ? defs[0]?.nodeId : undefined;
@@ -259,7 +322,7 @@ export function resolveRouteHandlerSymbols(model, extractedRoutes, decoratorRout
         const byId = new Map(defs.map((def) => [def.nodeId, def]));
         return byId.size === 1 ? byId.values().next().value : undefined;
     };
-    const routeCallables = (defs) => defs.filter((def) => def.type === 'Function' || def.type === 'Method');
+    const routeCallables = (defs) => routeCallableDefs(defs);
     const exportedRouteCallables = (defs) => routeContext === undefined
         ? []
         : routeCallables(defs).filter((def) => routeContext.isExportedSymbol(def.nodeId));
@@ -352,6 +415,9 @@ export function resolveRouteHandlerSymbols(model, extractedRoutes, decoratorRout
             if (controllerDef)
                 methodId = uniqueSymbolId(controllerDef.filePath, route.methodName);
         }
+        else if (!route.controllerName && route.methodName) {
+            methodId = pickSameFileHandler(model.symbols.lookupExactAll(route.filePath, route.methodName), route, routeContext?.nodeStartLine)?.nodeId;
+        }
         claim(route.routePath, route.prefix ?? null, route.httpMethod, methodId);
     }
     const dataHandlerByRoute = new Map();

package/dist/core/ingestion/entry-point-scoring.js

@@ -95,8 +95,24 @@ export function calculateEntryPointScore(name, language, isExported, callerCount
     }
     // Name pattern scoring
     let nameMultiplier = 1.0;
+    // tRPC procedures often use accessor-style names
+    // (`getX`, `setX`, `isX`) that legitimately ARE entry points. Without this
+    // exemption, the 0.3× utility penalty cancels the 3.0× tRPC framework boost
+    // (net 0.9, below baseline), preventing procedures like `setSettings`
+    // from becoming Process entry points and hiding them from `query` results.
+    // Only accessor/predicate names skip the penalty — helpers such as
+    // `formatDate`, `_internal`, or `parseInput` in the same router file still
+    // match UTILITY_PATTERNS. The 3.0× tRPC framework boost stays path-based.
+    // The exemption follows detectFrameworkFromPath so T3 (`/api/routers/`) and
+    // `/app/trpc/routers/` layouts get the same treatment as `/trpc/routers/`.
+    // Optional chaining still guards paths that fail the tRPC predicates
+    // (e.g. generic `/routers/*.js` without `/trpc/` or `/api/routers/`).
+    // JS/JSX routers that match those predicates get `framework: 'trpc'`
+    // the same way TS/TSX routers do.
+    const frameworkHint = filePath ? detectFrameworkFromPath(filePath) : null;
+    const trpcAccessorExemption = frameworkHint?.framework === 'trpc' && /^(get|set|is|has|can|should|will|did)[A-Z]/.test(name);
     // Check negative patterns first (utilities get penalized)
-    if (UTILITY_PATTERNS.some((p) => p.test(name))) {
+    if (!trpcAccessorExemption && UTILITY_PATTERNS.some((p) => p.test(name))) {
         nameMultiplier = 0.3; // Significant penalty
         reasons.push('utility-pattern');
     }
@@ -108,14 +124,10 @@ export function calculateEntryPointScore(name, language, isExported, callerCount
             reasons.push('entry-pattern');
         }
     }
-    // Framework detection bonus (Phase 2)
     let frameworkMultiplier = 1.0;
-    if (filePath) {
-        const frameworkHint = detectFrameworkFromPath(filePath);
-        if (frameworkHint) {
-            frameworkMultiplier = frameworkHint.entryPointMultiplier;
-            reasons.push(`framework:${frameworkHint.reason}`);
-        }
+    if (frameworkHint) {
+        frameworkMultiplier = frameworkHint.entryPointMultiplier;
+        reasons.push(`framework:${frameworkHint.reason}`);
     }
     // Calculate final score
     const finalScore = baseScore * exportMultiplier * nameMultiplier * frameworkMultiplier;

package/dist/core/ingestion/framework-detection.js

@@ -55,6 +55,14 @@ export function detectFrameworkFromPath(filePath) {
         (p.endsWith('layout.tsx') || p.endsWith('layout.ts'))) {
         return { framework: 'nextjs-app', entryPointMultiplier: 2.0, reason: 'nextjs-layout' };
     }
+    // tRPC router files — before the expo-router /app/ catch-all so
+    // `src/app/trpc/routers/*.ts` is tRPC, not an Expo screen. `/routers/`
+    // alone also matches Vue Router / Next.js-style folders and must not
+    // take the 3.0 entry-point multiplier.
+    if ((p.endsWith('.ts') || p.endsWith('.tsx') || p.endsWith('.js') || p.endsWith('.jsx')) &&
+        ((p.includes('/trpc/') && p.includes('/routers/')) || p.includes('/api/routers/'))) {
+        return { framework: 'trpc', entryPointMultiplier: 3.0, reason: 'trpc-router' };
+    }
     // Expo Router - screen/layout/api files in app/ directory
     if (p.includes('/app/') &&
         (p.endsWith('.tsx') || p.endsWith('.ts') || p.endsWith('.jsx') || p.endsWith('.js'))) {

package/dist/core/ingestion/language-provider.d.ts

@@ -406,6 +406,17 @@ interface LanguageProviderConfig {
      *  language's grammar, available for re-parsing included files.
      *  Default: undefined (no route extraction). */
     readonly extractRoutes?: (tree: Parser.Tree, filePath: string, reader: (relativePath: string) => string | null, parser?: Parser | null) => ExtractedRoute[];
+    /**
+     * Extract routes from file text without an AST.
+     *
+     * Content-based (regex / line scan), not tree-sitter. tRPC uses this hook:
+     * procedure routers are recognized from source text (`publicProcedure.query`)
+     * rather than grammar captures. The parse worker calls this when the hook is
+     * defined. Providers that need a path-gate apply it inside the hook.
+     *
+     * Default: undefined (no text-route extraction).
+     */
+    readonly extractTextRoutes?: (filePath: string, content: string) => ExtractedRoute[];
     /**
      * Extract routes that a parsed file declares in its own AST.
      *

package/dist/core/ingestion/languages/javascript/captures.js

@@ -49,7 +49,7 @@ import { getTreeSitterBufferSize } from '../../constants.js';
 import { parseSourceSafe } from '../../../tree-sitter/safe-parse.js';
 import { synthesizeCallableFlowCaptures } from '../../utils/callable-flow-captures.js';
 import { synthesizeReceiverChainCapture } from '../../utils/receiver-chain-captures.js';
-import { deriveDefaultExportHocName, isBlockedDefaultExportHoc, isDefaultExportHocFunctionNode, } from '../../ts-js-hoc-utils.js';
+import { deriveDefaultExportHocName, isBlockedDefaultExportHoc, isBlockedPairCallbackRegistration, isDefaultExportHocFunctionNode, } from '../../ts-js-hoc-utils.js';
 /** JS function-like node types that may carry a synthesized `this` binding.
  *  Kept in sync with the `@scope.function` patterns in `query.ts`. */
 export const FUNCTION_NODE_TYPES = [
@@ -1019,6 +1019,13 @@ export function emitJsScopeCaptures(sourceText, filePath, cachedTree) {
             if (arrowNode !== null && isBlockedDefaultExportHoc(arrowNode)) {
                 continue;
             }
+            // Pair-value built-in registrations (`{ timer: setTimeout(() => …) }`,
+            // `{ later: promise.then(() => …) }`) bind handles/values, not
+            // callables. See `isBlockedPairCallbackRegistration` for why this
+            // gate lives emit-side rather than in the query predicates.
+            if (arrowNode !== null && isBlockedPairCallbackRegistration(arrowNode)) {
+                continue;
+            }
             // #2723 — see the matching filter in `typescript/captures.ts`.
             if (arrowNode !== null && isShadowedCjsExportAssignment(arrowNode, tree.rootNode)) {
                 continue;

package/dist/core/ingestion/languages/javascript/query.js

@@ -234,6 +234,200 @@ export const JAVASCRIPT_SCOPE_QUERY = `
   key: (string (string_fragment) @declaration.name)
   value: (function_expression) @declaration.function)
 
+;; HOC-wrapped pair values: create: procedure.mutation(async ({ input }) => { ... }).
+;; tRPC, Express route definitions, and similar frameworks use this pattern where
+;; an object property's value is a call_expression (like .mutation()/.query()) that
+;; wraps an arrow_function or function_expression as a callback argument.
+;; Without these patterns, tRPC procedures are invisible — the arrow registers as
+;; anonymous and all calls inside fall back to file-level attribution.
+;;
+;; AST shape:
+;;   pair
+;;     key: property_identifier "create"
+;;     value: call_expression
+;;       function: identifier | member_expression
+;;       arguments: arguments
+;;         arrow_function | function_expression
+;;
+;; Anchor discipline: same as direct pairs — on the inner arrow/function, not
+;; the outer call_expression. The arrow's range matches its @scope.function range,
+;; so pass2AttachDeclarations auto-hoists the binding to the parent scope.
+((pair
+  key: (property_identifier) @declaration.name
+  value: (call_expression
+    function: (identifier) @hoc
+    arguments: (arguments
+      (arrow_function) @declaration.function)))
+  ${DEFAULT_EXPORT_IDENTIFIER_NOT_ANY_OF_PREDICATE})
+
+((pair
+  key: (property_identifier) @declaration.name
+  value: (call_expression
+    function: (identifier) @hoc
+    arguments: (arguments
+      (function_expression) @declaration.function)))
+  ${DEFAULT_EXPORT_IDENTIFIER_NOT_ANY_OF_PREDICATE})
+
+; Member-expression variants exclude callback-taking array methods —
+; '{ visible: items.filter(item => item.active) }' is a value holding an
+; array, not a Function — same exclusion as the HOC variable rules below.
+((pair
+  key: (property_identifier) @declaration.name
+  value: (call_expression
+    function: (member_expression
+      property: (property_identifier) @callee)
+    arguments: (arguments
+      (arrow_function) @declaration.function)))
+  ${ARRAY_METHOD_NOT_ANY_OF_PREDICATE})
+
+((pair
+  key: (property_identifier) @declaration.name
+  value: (call_expression
+    function: (member_expression
+      property: (property_identifier) @callee)
+    arguments: (arguments
+      (function_expression) @declaration.function)))
+  ${ARRAY_METHOD_NOT_ANY_OF_PREDICATE})
+
+;; String-key pair variants: { 'create': procedure.mutation(async () => ...) }.
+;; Quoted object keys are identical shapes to the identifier-key pairs above —
+;; a tRPC router that quotes its keys (lint-enforced or JSON-ish style) would
+;; otherwise leave its procedures anonymous and file-level attributed.
+;; Quoted-key identifier callees ({ 'handler': wrap(() => {}) }) match these
+;; string-key rules, not the identifier-key block above; member-expression
+;; callees keep the array-method exclusion.
+((pair
+  key: (string (string_fragment) @declaration.name)
+  value: (call_expression
+    function: (identifier) @hoc
+    arguments: (arguments
+      (arrow_function) @declaration.function)))
+  ${DEFAULT_EXPORT_IDENTIFIER_NOT_ANY_OF_PREDICATE})
+
+((pair
+  key: (string (string_fragment) @declaration.name)
+  value: (call_expression
+    function: (identifier) @hoc
+    arguments: (arguments
+      (function_expression) @declaration.function)))
+  ${DEFAULT_EXPORT_IDENTIFIER_NOT_ANY_OF_PREDICATE})
+
+((pair
+  key: (string (string_fragment) @declaration.name)
+  value: (call_expression
+    function: (member_expression
+      property: (property_identifier) @callee)
+    arguments: (arguments
+      (arrow_function) @declaration.function)))
+  ${ARRAY_METHOD_NOT_ANY_OF_PREDICATE})
+
+((pair
+  key: (string (string_fragment) @declaration.name)
+  value: (call_expression
+    function: (member_expression
+      property: (property_identifier) @callee)
+    arguments: (arguments
+      (function_expression) @declaration.function)))
+  ${ARRAY_METHOD_NOT_ANY_OF_PREDICATE})
+
+;; Curried pair HOC: create: publicProcedure.mutation(withAuth(async () => {})).
+;; Existing pair-HOC rules require the arrow to be a DIRECT argument of the
+;; pair's call_expression. They miss mutation's argument being another
+;; call_expression (withAuth(...)). Object-pair only — do NOT add a
+;; variable-level nested-HOC rule (\`const X = memo(forwardRef(...))\` must
+;; stay a Variable; see typescript-hoc-wrapped.test.ts).
+((pair
+  key: (property_identifier) @declaration.name
+  value: (call_expression
+    function: (identifier) @hoc
+    arguments: (arguments
+      (call_expression
+        function: (identifier)
+        arguments: (arguments
+          (arrow_function) @declaration.function)))))
+  ${DEFAULT_EXPORT_IDENTIFIER_NOT_ANY_OF_PREDICATE})
+
+((pair
+  key: (property_identifier) @declaration.name
+  value: (call_expression
+    function: (identifier) @hoc
+    arguments: (arguments
+      (call_expression
+        function: (identifier)
+        arguments: (arguments
+          (function_expression) @declaration.function)))))
+  ${DEFAULT_EXPORT_IDENTIFIER_NOT_ANY_OF_PREDICATE})
+
+((pair
+  key: (property_identifier) @declaration.name
+  value: (call_expression
+    function: (member_expression
+      property: (property_identifier) @callee)
+    arguments: (arguments
+      (call_expression
+        function: (identifier)
+        arguments: (arguments
+          (arrow_function) @declaration.function)))))
+  ${ARRAY_METHOD_NOT_ANY_OF_PREDICATE})
+
+((pair
+  key: (property_identifier) @declaration.name
+  value: (call_expression
+    function: (member_expression
+      property: (property_identifier) @callee)
+    arguments: (arguments
+      (call_expression
+        function: (identifier)
+        arguments: (arguments
+          (function_expression) @declaration.function)))))
+  ${ARRAY_METHOD_NOT_ANY_OF_PREDICATE})
+
+((pair
+  key: (string (string_fragment) @declaration.name)
+  value: (call_expression
+    function: (identifier) @hoc
+    arguments: (arguments
+      (call_expression
+        function: (identifier)
+        arguments: (arguments
+          (arrow_function) @declaration.function)))))
+  ${DEFAULT_EXPORT_IDENTIFIER_NOT_ANY_OF_PREDICATE})
+
+((pair
+  key: (string (string_fragment) @declaration.name)
+  value: (call_expression
+    function: (identifier) @hoc
+    arguments: (arguments
+      (call_expression
+        function: (identifier)
+        arguments: (arguments
+          (function_expression) @declaration.function)))))
+  ${DEFAULT_EXPORT_IDENTIFIER_NOT_ANY_OF_PREDICATE})
+
+((pair
+  key: (string (string_fragment) @declaration.name)
+  value: (call_expression
+    function: (member_expression
+      property: (property_identifier) @callee)
+    arguments: (arguments
+      (call_expression
+        function: (identifier)
+        arguments: (arguments
+          (arrow_function) @declaration.function)))))
+  ${ARRAY_METHOD_NOT_ANY_OF_PREDICATE})
+
+((pair
+  key: (string (string_fragment) @declaration.name)
+  value: (call_expression
+    function: (member_expression
+      property: (property_identifier) @callee)
+    arguments: (arguments
+      (call_expression
+        function: (identifier)
+        arguments: (arguments
+          (function_expression) @declaration.function)))))
+  ${ARRAY_METHOD_NOT_ANY_OF_PREDICATE})
+
 ;; HOC-wrapped variable declarations: const X = HOC((args) => { ... }).
 ;; Covers React.forwardRef, memo, useCallback, useMemo, observer,
 ;; debounce, and any user-defined HOC factory.

package/dist/core/ingestion/languages/typescript/captures.js

@@ -39,7 +39,7 @@ import { parseSourceSafe } from '../../../tree-sitter/safe-parse.js';
 import { synthesizeCallableFlowCaptures } from '../../utils/callable-flow-captures.js';
 import { synthesizeCjsModuleExports } from './cjs-module-exports.js';
 import { synthesizeReceiverChainCapture } from '../../utils/receiver-chain-captures.js';
-import { deriveDefaultExportHocName, isBlockedDefaultExportHoc, isDefaultExportHocFunctionNode, } from '../../ts-js-hoc-utils.js';
+import { deriveDefaultExportHocName, isBlockedDefaultExportHoc, isBlockedPairCallbackRegistration, isDefaultExportHocFunctionNode, } from '../../ts-js-hoc-utils.js';
 /** tree-sitter-typescript node types for function-like scopes that may
  *  carry a synthesized `this` binding. Kept in sync with the
  *  `@scope.function` patterns in `query.ts`. */
@@ -477,6 +477,13 @@ export function emitTsScopeCaptures(sourceText, filePath, cachedTree) {
             if (arrowNode !== null && isBlockedDefaultExportHoc(arrowNode)) {
                 continue;
             }
+            // Pair-value built-in registrations (`{ timer: setTimeout(() => …) }`,
+            // `{ later: promise.then(() => …) }`) bind handles/values, not
+            // callables. See `isBlockedPairCallbackRegistration` for why this
+            // gate lives emit-side rather than in the query predicates.
+            if (arrowNode !== null && isBlockedPairCallbackRegistration(arrowNode)) {
+                continue;
+            }
             // #2723: a CJS export assignment must not register a SECOND module-scope
             // declaration for a name the file already declares lexically — the name
             // would become ambiguous and the resolver would drop the intra-module