gitnexus 1.6.8-rc.2 → 1.6.8-rc.21

package/dist/core/ingestion/language-provider.d.ts

@@ -19,7 +19,10 @@ import type { MethodExtractor } from './method-types.js';
 import type { VariableExtractor } from './variable-types.js';
 import type { ImportResolverFn } from './import-resolvers/types.js';
 import type { SyntaxNode } from './utils/ast-helpers.js';
+import type { CfgVisitor } from './cfg/types.js';
 import type { NodeLabel } from '../../_shared/index.js';
+import type Parser from 'tree-sitter';
+import type { ExtractedDecoratorRoute } from './workers/parse-worker.js';
 /** Tree-sitter query captures: capture name → AST node (or undefined if not captured). */
 export type CaptureMap = Record<string, SyntaxNode | undefined>;
 /** Configuration for AST-based framework detection patterns. */
@@ -145,6 +148,12 @@ interface LanguageProviderConfig {
      * `undefined` when no constraints exist / the node isn't a templated
      * function. Languages without SFINAE / concept semantics leave this
      * undefined and the disambiguation is a pass-through.
+     *
+     * Cloneability contract: the returned payload crosses the worker boundary
+     * via structured clone, so it MUST be structured-clone-safe (no functions,
+     * symbols, or tree-sitter `SyntaxNode`s — only plain data). Wrap the return
+     * with `assertCloneable` from `workers/clone-safety.ts` so a future leak is a
+     * compile error at the source instead of a runtime DataCloneError (#2143).
      */
     readonly extractTemplateConstraints?: (definitionNode: SyntaxNode) => unknown;
     /** Override the default node label for definition.function captures.
@@ -185,6 +194,17 @@ interface LanguageProviderConfig {
      *  When true, the worker extracts routes via the language's route extraction logic.
      *  Default: undefined (no route files). */
     readonly isRouteFile?: (filePath: string) => boolean;
+    /**
+     * Extract decorator-style route annotations from a parsed file.
+     *
+     * When defined, the parse worker calls this after per-file capture processing
+     * to extract framework route definitions that require AST-level analysis beyond
+     * generic `@decorator` captures (e.g., Java Spring class-level prefix joining,
+     * multi-class handling). The returned routes are appended to `decoratorRoutes`.
+     *
+     * Default: undefined (no language-specific decorator route extraction).
+     */
+    readonly extractDecoratorRoutes?: (tree: Parser.Tree, filePath: string, lineOffset: number) => ExtractedDecoratorRoute[];
     /** Built-in/stdlib names that should be filtered from the call graph for this language.
      *  Default: undefined (no language-specific filtering). */
     readonly builtInNames?: ReadonlySet<string>;
@@ -255,12 +275,26 @@ interface LanguageProviderConfig {
      * disk store WITHOUT a main-thread re-parse. The main thread restores them
      * via the matching `ScopeResolver.applyCaptureSideChannel` hook.
      *
-     * MUST return plain data (objects / arrays / primitives) so it round-trips
-     * through `JSON.stringify` + the parsedfile-store interning reviver.
+     * Cloneability contract: MUST return plain data (objects / arrays /
+     * primitives — no functions, symbols, or tree-sitter `SyntaxNode`s) so it
+     * survives BOTH the worker→main structured clone AND `JSON.stringify` + the
+     * parsedfile-store interning reviver. Wrap the return with `assertCloneable`
+     * from `workers/clone-safety.ts` so a future non-serializable leak is a
+     * compile error at the source instead of a runtime DataCloneError (#2143).
      *
      * Default: undefined (provider has no capture-time module-level side effects).
      */
     readonly collectCaptureSideChannel?: (filePath: string) => unknown;
+    /**
+     * Per-language control-flow-graph builder (#2081 M1, PDG/taint substrate).
+     * Invoked IN THE PARSE WORKER (where the AST lives) for each function node,
+     * gated on the `--pdg` opt-in; the resulting per-function CFGs are serialized
+     * onto `ParsedFile.cfgSideChannel` and emitted as BasicBlock nodes + CFG
+     * edges during scope-resolution. `TNode` is `SyntaxNode` for the tree-sitter
+     * languages. Default: undefined (language has no CFG support yet — TS/JS are
+     * the M1 set).
+     */
+    readonly cfgVisitor?: CfgVisitor<SyntaxNode>;
     /**
      * Interpret a raw `@import.statement` capture group into a `ParsedImport`.
      * The central finalize algorithm resolves `ParsedImport.targetRaw` to a

package/dist/core/ingestion/languages/c-cpp.js

@@ -38,7 +38,8 @@ import { cCallConfig, cppCallConfig } from '../call-extractors/configs/c-cpp.js'
 import { stripUeMacros } from '../cpp-ue-preprocessor.js';
 import { emitCScopeCaptures, interpretCImport, interpretCTypeBinding, cArityCompatibility, cBindingScopeFor, cImportOwningScope, cReceiverBinding, collectCStaticLinkageSideChannel, } from './c/index.js';
 import { emitCppScopeCaptures, interpretCppImport, interpretCppTypeBinding, cppArityCompatibility, cppBindingScopeFor, cppImportOwningScope, cppReceiverBinding, collectCppCaptureSideChannel, } from './cpp/index.js';
-import { extractCppTemplateConstraints } from './cpp/constraint-extractor.js';
+import { extractCppTemplateConstraints, } from './cpp/constraint-extractor.js';
+import { assertCloneable } from '../workers/clone-safety.js';
 const C_BUILT_INS = new Set([
     'printf',
     'fprintf',
@@ -358,7 +359,10 @@ export const cProvider = defineLanguage({
     // `static` functions look non-file-local on the main thread and leak into
     // cross-file global free-call resolution / wildcard imports. See
     // `c/capture-side-channel.ts`.
-    collectCaptureSideChannel: collectCStaticLinkageSideChannel,
+    // `assertCloneable` is a runtime identity; it makes a future non-serializable
+    // value in the side-channel payload a compile error here, at the source, rather
+    // than a DataCloneError at the worker boundary (#2143).
+    collectCaptureSideChannel: (filePath) => assertCloneable(collectCStaticLinkageSideChannel(filePath)),
     interpretImport: interpretCImport,
     interpretTypeBinding: interpretCTypeBinding,
     bindingScopeFor: cBindingScopeFor,
@@ -431,7 +435,7 @@ export const cppProvider = defineLanguage({
     // just populated for this file into plain data on `ParsedFile.captureSideChannel`,
     // so the main thread can restore them via `applyCaptureSideChannel` WITHOUT a
     // re-parse (#1983). See `cpp/capture-side-channel.ts`.
-    collectCaptureSideChannel: collectCppCaptureSideChannel,
+    collectCaptureSideChannel: (filePath) => assertCloneable(collectCppCaptureSideChannel(filePath)),
     interpretImport: interpretCppImport,
     interpretTypeBinding: interpretCppTypeBinding,
     bindingScopeFor: cppBindingScopeFor,
@@ -482,5 +486,8 @@ function extractCppTemplateConstraintsForProvider(definitionNode) {
         }
         break;
     }
-    return extractCppTemplateConstraints(templateDecl, declarator);
+    // Guard the boundary at the source: a future non-cloneable member of the
+    // constraint payload becomes a compile error here, not a runtime
+    // DataCloneError at the worker post (#2143).
+    return assertCloneable(extractCppTemplateConstraints(templateDecl, declarator));
 }

package/dist/core/ingestion/languages/cpp/arity-metadata.js

@@ -193,8 +193,12 @@ function findFuncDeclarator(node) {
         }
         return null;
     }
-    // Unwrap pointer_declarator / reference_declarator
-    while (decl.type === 'pointer_declarator' || decl.type === 'reference_declarator') {
+    // Unwrap declarator wrappers. Deleted free functions are represented as
+    // `init_declarator(function_declarator, delete_expression)` by
+    // tree-sitter-cpp 0.23.
+    while (decl.type === 'pointer_declarator' ||
+        decl.type === 'reference_declarator' ||
+        decl.type === 'init_declarator') {
         const next = decl.childForFieldName('declarator');
         if (next === null) {
             // reference_declarator may not use field name

package/dist/core/ingestion/languages/cpp/captures.js

@@ -113,6 +113,9 @@ export function emitCppScopeCaptures(sourceText, filePath, cachedTree) {
                 if (hasExplicitSpecifier(fnNode)) {
                     grouped['@declaration.is-explicit'] = syntheticCapture('@declaration.is-explicit', fnNode, 'true');
                 }
+                if (hasDeletedMethodClause(fnNode, grouped['@declaration.name']?.text)) {
+                    grouped['@declaration.is-deleted'] = syntheticCapture('@declaration.is-deleted', fnNode, 'true');
+                }
                 // Detect static storage class (file-local linkage)
                 if (hasStaticStorageClass(fnNode)) {
                     const nameText = grouped['@declaration.name']?.text;
@@ -1562,8 +1565,11 @@ function extractDeclaratorLeafName(node) {
     let cur = node;
     let safety = 16;
     while (safety-- > 0) {
-        if (cur.type === 'identifier' || cur.type === 'type_identifier')
+        if (cur.type === 'identifier' ||
+            cur.type === 'type_identifier' ||
+            cur.type === 'operator_name') {
             return cur.text;
+        }
         // Common wrapper nodes — follow the 'declarator' field when present.
         const next = cur.childForFieldName('declarator') ??
             // parenthesized_declarator: single named child
@@ -1590,6 +1596,23 @@ function hasExplicitSpecifier(node) {
     }
     return /\bexplicit\b/.test(node.text.slice(0, 128));
 }
+function hasDeletedMethodClause(node, callableName) {
+    for (let i = 0; i < node.namedChildCount; i++) {
+        const child = node.namedChild(i);
+        if (child?.type === 'delete_method_clause')
+            return true;
+        // tree-sitter-cpp 0.23 parses a deleted free-function declaration as
+        // `declaration > init_declarator > delete_expression`, while class
+        // members use the dedicated `delete_method_clause`.
+        if (child?.type === 'init_declarator' &&
+            child.childForFieldName('value')?.type === 'delete_expression' &&
+            callableName !== undefined &&
+            extractDeclaratorLeafName(child.childForFieldName('declarator') ?? child) === callableName) {
+            return true;
+        }
+    }
+    return false;
+}
 /**
  * Check if a C++ function_definition or declaration has `static` storage class.
  */

package/dist/core/ingestion/languages/cpp/query.js

@@ -193,6 +193,29 @@ const CPP_SCOPE_QUERY = `
   declarator: (function_declarator
     declarator: (identifier) @declaration.name)) @declaration.function
 
+;; tree-sitter-cpp 0.23 represents a deleted free function as an
+;; init_declarator whose value is a delete_expression.
+(declaration
+  declarator: (init_declarator
+    declarator: (function_declarator
+      declarator: (identifier) @declaration.name)
+    value: (delete_expression))) @declaration.function
+
+;; Deleted free operator declaration.
+(declaration
+  declarator: (init_declarator
+    declarator: (function_declarator
+      declarator: (operator_name) @declaration.name)
+    value: (delete_expression))) @declaration.function
+
+;; Deleted free function with a pointer return type.
+(declaration
+  declarator: (init_declarator
+    declarator: (pointer_declarator
+      declarator: (function_declarator
+        declarator: (identifier) @declaration.name))
+    value: (delete_expression))) @declaration.function
+
 ;; Free operator prototype: std::ostream& operator<<(std::ostream&, T)
 (declaration
   declarator: (function_declarator

package/dist/core/ingestion/languages/java.js

@@ -11,6 +11,7 @@ import { createClassExtractor } from '../class-extractors/generic.js';
 import { javaClassConfig } from '../class-extractors/configs/jvm.js';
 import { defineLanguage } from '../language-provider.js';
 import { javaTypeConfig } from '../type-extractors/jvm.js';
+import { extractSpringRoutes } from '../route-extractors/spring.js';
 import { javaExportChecker } from '../export-detection.js';
 import { createImportResolver } from '../import-resolvers/resolver-factory.js';
 import { javaImportConfig } from '../import-resolvers/configs/jvm.js';
@@ -103,4 +104,6 @@ export const javaProvider = defineLanguage({
     arityCompatibility: javaArityCompatibility,
     resolveImportTarget: resolveJavaImportTarget,
     orderSameNameTypeCandidates: orderJavaSameNameTypeCandidates,
+    // ── Route extraction ──
+    extractDecoratorRoutes: extractSpringRoutes,
 });

package/dist/core/ingestion/languages/kotlin/query.js

@@ -1,7 +1,8 @@
 import Parser from 'tree-sitter';
 import { SupportedLanguages } from '../../../../_shared/index.js';
-// `tree-sitter-kotlin` is an optionalDependency that may be absent on a default
-// install (or fail its native build). Loaded lazily + guarded via parser-loader
+// `tree-sitter-kotlin` is a vendored grammar (loaded from vendor/ by absolute
+// path, never node_modules — vendored-grammars.ts / #2111) that may be absent on
+// a platform without a matching prebuild. Loaded lazily + guarded via parser-loader
 // rather than statically imported: this module is pulled onto the main thread
 // eagerly by the scope-resolution registry and the language-provider index, so
 // a top-level `import Kotlin from 'tree-sitter-kotlin'` would throw

package/dist/core/ingestion/languages/kotlin.js

@@ -10,6 +10,7 @@ import { SupportedLanguages } from '../../../_shared/index.js';
 import { createClassExtractor } from '../class-extractors/generic.js';
 import { kotlinClassConfig } from '../class-extractors/configs/jvm.js';
 import { defineLanguage } from '../language-provider.js';
+import { assertCloneable } from '../workers/clone-safety.js';
 import { kotlinTypeConfig } from '../type-extractors/jvm.js';
 import { kotlinExportChecker } from '../export-detection.js';
 import { createImportResolver } from '../import-resolvers/resolver-factory.js';
@@ -166,7 +167,10 @@ export const kotlinProvider = defineLanguage({
     // so the main thread can restore them via `applyCaptureSideChannel` WITHOUT a
     // re-parse (#1983). Without this, companion/static dispatch emits no CALLS
     // edges on the worker path. See `kotlin/capture-side-channel.ts`.
-    collectCaptureSideChannel: collectKotlinCaptureSideChannel,
+    // `assertCloneable` is a runtime identity; it makes a future non-serializable
+    // value in the side-channel payload a compile error here, at the source, rather
+    // than a DataCloneError at the worker boundary (#2143).
+    collectCaptureSideChannel: (filePath) => assertCloneable(collectKotlinCaptureSideChannel(filePath)),
     interpretImport: interpretKotlinImport,
     interpretTypeBinding: interpretKotlinTypeBinding,
     bindingScopeFor: kotlinBindingScopeFor,

package/dist/core/ingestion/languages/typescript.js

@@ -9,6 +9,7 @@ import { SupportedLanguages } from '../../../_shared/index.js';
 import { defineLanguage } from '../language-provider.js';
 import { createClassExtractor } from '../class-extractors/generic.js';
 import { typescriptClassConfig, javascriptClassConfig, } from '../class-extractors/configs/typescript-javascript.js';
+import { createTypeScriptCfgVisitor } from '../cfg/visitors/typescript.js';
 import { typeConfig as typescriptConfig } from '../type-extractors/typescript.js';
 import { tsExportChecker } from '../export-detection.js';
 import { createImportResolver } from '../import-resolvers/resolver-factory.js';
@@ -293,6 +294,8 @@ export const typescriptProvider = defineLanguage({
     // canonical capture vocabulary in ./typescript/query.ts
     // (TYPESCRIPT_SCOPE_QUERY constant).
     emitScopeCaptures: emitTsScopeCaptures,
+    // CFG/PDG substrate (#2081 M1) — runs in the worker on a --pdg run.
+    cfgVisitor: createTypeScriptCfgVisitor(),
     interpretImport: interpretTsImport,
     interpretTypeBinding: interpretTsTypeBinding,
     bindingScopeFor: tsBindingScopeFor,
@@ -352,6 +355,8 @@ export const javascriptProvider = defineLanguage({
     // JSDoc type bindings) live in ./javascript/captures.ts.
     // See ./javascript/index.ts for the full per-module rationale.
     emitScopeCaptures: emitJsScopeCaptures,
+    // CFG/PDG substrate (#2081 M1) — TS and JS share the same grammar family.
+    cfgVisitor: createTypeScriptCfgVisitor(),
     interpretImport: interpretJsImport,
     interpretTypeBinding: interpretJsTypeBinding,
     bindingScopeFor: jsBindingScopeFor,

package/dist/core/ingestion/method-extractors/configs/c-cpp.js

@@ -33,18 +33,12 @@ function findFunctionDeclarator(node) {
     }
     return null;
 }
-/**
- * Detect `= delete` and `= default` special member function declarations.
- * These are not callable methods and should be suppressed from extraction.
- * tree-sitter-cpp ^0.23.4 emits `delete_method_clause` / `default_method_clause`
- * as named children of the function_definition node.
- */
-function isDeletedOrDefaulted(node) {
+/** Detect a C++ special member clause by its tree-sitter node type. */
+function hasSpecialMethodClause(node, clauseType) {
     for (let i = 0; i < node.namedChildCount; i++) {
         const child = node.namedChild(i);
-        if (child?.type === 'delete_method_clause' || child?.type === 'default_method_clause') {
+        if (child?.type === clauseType)
             return true;
-        }
     }
     return false;
 }
@@ -57,10 +51,6 @@ function extractCppMethodName(node) {
     const funcDecl = findFunctionDeclarator(node);
     if (!funcDecl)
         return undefined;
-    // Suppress `= delete` and `= default` special members — these are not callable
-    // methods and should not appear in HAS_METHOD edges.
-    if (isDeletedOrDefaulted(node))
-        return undefined;
     const nameNode = funcDecl.childForFieldName('declarator');
     if (!nameNode)
         return undefined;
@@ -360,6 +350,9 @@ export const cppMethodConfig = {
         }
         return false;
     },
+    isDeleted(node) {
+        return hasSpecialMethodClause(node, 'delete_method_clause');
+    },
 };
 // ---------------------------------------------------------------------------
 // C config (minimal — C has no classes/methods, only struct function pointers)

package/dist/core/ingestion/method-extractors/generic.js

@@ -198,6 +198,7 @@ function buildMethod(node, ownerNode, context, config) {
         ...(config.isAsync?.(node) ? { isAsync: true } : {}),
         ...(config.isPartial?.(node) ? { isPartial: true } : {}),
         ...(config.isConst?.(node) ? { isConst: true } : {}),
+        ...(config.isDeleted?.(node) ? { isDeleted: true } : {}),
         annotations: config.extractAnnotations?.(node) ?? [],
         sourceFile: context.filePath,
         line: node.startPosition.row + 1,

package/dist/core/ingestion/method-types.d.ts

@@ -27,6 +27,7 @@ export interface MethodInfo {
     isAsync?: boolean;
     isPartial?: boolean;
     isConst?: boolean;
+    isDeleted?: boolean;
     annotations: string[];
     sourceFile: string;
     line: number;
@@ -74,6 +75,7 @@ export interface MethodExtractionConfig {
     isAsync?: (node: SyntaxNode) => boolean;
     isPartial?: (node: SyntaxNode) => boolean;
     isConst?: (node: SyntaxNode) => boolean;
+    isDeleted?: (node: SyntaxNode) => boolean;
     /** Owner node types where member functions are effectively static (e.g.
      *  Ruby singleton_class, Kotlin companion_object / object_declaration).
      *  When the ownerNode matches one of these types, isStatic is forced true. */

package/dist/core/ingestion/model/symbol-table.d.ts

@@ -102,6 +102,7 @@ export interface AddMetadata {
     templateArguments?: string[];
     ownerId?: string;
     qualifiedName?: string;
+    isDeleted?: boolean;
 }
 /**
  * Pure read-only view over the file and callable indexes. Does NOT

package/dist/core/ingestion/model/symbol-table.js

@@ -136,6 +136,7 @@ export const createSymbolTable = () => {
                 ? { templateArguments: metadata.templateArguments }
                 : {}),
             ...(metadata?.ownerId !== undefined ? { ownerId: metadata.ownerId } : {}),
+            ...(metadata?.isDeleted === true ? { isDeleted: true } : {}),
         };
         // A. File Index — unconditional.
         if (!fileIndex.has(filePath)) {

package/dist/core/ingestion/parsing-processor.js

@@ -49,6 +49,7 @@ export const mergeChunkResults = (graph, symbolTable, chunkResults, exportedType
                 templateArguments: sym.templateArguments,
                 ownerId: sym.ownerId,
                 qualifiedName: sym.qualifiedName,
+                isDeleted: sym.isDeleted,
             });
         }
         if (exportedTypeMap) {
@@ -144,6 +145,27 @@ chunkHash) => {
             .join(', ');
         logger.warn(`  Skipped unsupported languages: ${summary}`);
     }
+    // Clone-safety telemetry (#2112): files whose parse output carried a value
+    // the structured-clone algorithm couldn't serialize across the worker
+    // boundary. The worker sanitized/dropped the offending value so the run
+    // could complete; surface the (rare) data loss so it's visible and the
+    // offending extractor can be fixed at source.
+    const skippedPaths = [];
+    for (const result of chunkResults) {
+        for (const entry of result.skippedPaths ?? [])
+            skippedPaths.push(entry);
+    }
+    if (skippedPaths.length > 0) {
+        // Keep the per-file reason ("stripped N value(s) from nodes" /
+        // "dropped non-serializable parsedFiles entry") — it distinguishes a
+        // recoverable strip from a whole-record drop, which a path-only line loses.
+        const shown = skippedPaths
+            .slice(0, 10)
+            .map((e) => `${e.path} (${e.reason})`)
+            .join(', ');
+        const more = skippedPaths.length > 10 ? ` …and ${skippedPaths.length - 10} more` : '';
+        logger.warn(`  Sanitized ${skippedPaths.length} file(s) with non-serializable parse output: ${shown}${more}`);
+    }
     onFileProgress?.(total, total, 'done');
     return chunkResults;
 };

package/dist/core/ingestion/pipeline-phases/parse-impl.js

@@ -18,6 +18,7 @@ import { BindingAccumulator, enrichExportedTypeMap, } from '../binding-accumulat
 import { mergeChunkResults, dispatchChunkParse } from '../parsing-processor.js';
 import { fileContentHash, computeChunkHash, loadParseCacheChunk, persistParseCacheChunk, PARSE_CACHE_VERSION, } from '../../../storage/parse-cache.js';
 import { clearParsedFileStore, persistParsedFileChunk, getDurableParsedFileDir, loadDurableParsedFileIndex, restoreDurableParsedFileShard, } from '../../../storage/parsedfile-store.js';
+import { DEFAULT_PDG_MAX_FUNCTION_LINES } from '../cfg/collect.js';
 import { processRoutesFromExtracted, buildExportedTypeMapFromGraph, } from '../call-processor.js';
 import { createSemanticModel } from '../model/index.js';
 import { getLanguageFromFilename, } from '../../../_shared/index.js';
@@ -319,6 +320,10 @@ export async function runChunkedParseAndResolve(graph, scannedFiles, allPaths, t
                 // Initialized below before the chunk loop (same deferred-init pattern
                 // as `parsedFileStorePath`); this closure only runs from the loop.
                 durableParsedFileStoragePath: durableParsedFileDir,
+                // CFG/PDG opt-in (#2081 M1) — baked into each worker's workerData so the
+                // worker builds + attaches cfgSideChannel. Off by default.
+                pdg: options?.pdg === true,
+                pdgMaxFunctionLines: options?.pdgMaxFunctionLines,
                 // Fan each chunk across the whole pool (#worker-idle): without this a
                 // chunk smaller than the 8 MB sub-batch cap became a single job on a
                 // single worker. Honors an explicit `subBatchMaxBytes` / env override.
@@ -566,7 +571,19 @@ export async function runChunkedParseAndResolve(graph, scannedFiles, allPaths, t
                     filePath: f.path,
                     contentHash: fileContentHash(f.content),
                 }));
-                chunkHash = computeChunkHash(entries);
+                chunkHash = computeChunkHash(entries, 
+                // Only worker-visible pdg config participates in the key —
+                // pdgMaxEdgesPerFunction is emit-time-only and deliberately
+                // excluded (see PdgCacheKey in parse-cache.ts; #2099 F3). The line
+                // cap is RESOLVED to the worker's default before folding so an
+                // explicit-default run shares the default run's keys (the worker
+                // output is byte-identical either way).
+                options?.pdg === true
+                    ? {
+                        pdg: true,
+                        maxFunctionLines: options?.pdgMaxFunctionLines ?? DEFAULT_PDG_MAX_FUNCTION_LINES,
+                    }
+                    : false);
             }
             const cachedRaw = chunkHash && parseCache ? await loadParseCacheChunk(parseCache, chunkHash) : undefined;
             // Track every chunk hash we touched so the orchestrator can

package/dist/core/ingestion/pipeline-phases/routes.js

@@ -297,22 +297,72 @@ export const routesPhase = {
         // scan JS/TS consumer files for calls to those wrapper functions with
         // URL-like string arguments and add them to allFetchCalls so
         // processNextjsFetchRoutes can create FETCHES edges.
-        if (allFetchWrapperDefs && allFetchWrapperDefs.length > 0 && routeRegistry.size > 0) {
-            const wrapperNames = new Set(allFetchWrapperDefs.map((d) => d.functionName));
+        // Wrapper names come from two sources: functions the parse phase
+        // auto-detected as calling the bare global `fetch()`, plus any names the
+        // user declared in `.gitnexusrc` `fetchWrappers` (#1589/#1852 residual).
+        // Config names let an axios/custom-client wrapper — or one named outside the
+        // built-in convention — still produce route_map consumers; without them it
+        // silently falls back to `consumers: []`. Configured names alone are enough
+        // to run the scan even when nothing was auto-detected.
+        // Configured names are already validated/trimmed/de-duped/capped by
+        // analyze-config.ts — trusted as-is (#1589/#1852 review F9, dropped the
+        // redundant re-trim/re-filter). The single filter below guards only the
+        // auto-detected `functionName`s, which have no shape guarantee.
+        const configuredWrappers = ctx.options?.fetchWrappers ?? [];
+        const wrapperNames = new Set([...(allFetchWrapperDefs ?? []).map((d) => d.functionName), ...configuredWrappers].filter((n) => typeof n === 'string' && n.trim().length > 0));
+        if (wrapperNames.size > 0 && routeRegistry.size > 0) {
             const jsFiles = allPaths.filter((p) => /\.[jt]sx?$/.test(p));
-            if (jsFiles.length > 0 && wrapperNames.size > 0) {
-                const jsContents = await readFileContents(ctx.repoPath, jsFiles);
-                for (const [filePath, content] of jsContents) {
-                    for (const name of wrapperNames) {
-                        const regex = new RegExp(`\\b${escapeRegex(name)}\\s*\\(\\s*['"\`](/[^'"\`\\s)]+)['"\`]`, 'g');
-                        let match;
-                        while ((match = regex.exec(content)) !== null) {
-                            allFetchCalls.push({
-                                filePath,
-                                fetchURL: match[1],
-                                lineNumber: content.substring(0, match.index).split('\n').length,
-                            });
+            if (jsFiles.length > 0) {
+                // Reuse contents already read for handler extraction; only read the
+                // remainder (mirrors the Expo block above). Avoids a second full read of
+                // files we already have in memory.
+                const unreadJsFiles = jsFiles.filter((p) => !handlerContents?.has(p));
+                const extraContents = unreadJsFiles.length > 0
+                    ? await readFileContents(ctx.repoPath, unreadJsFiles)
+                    : new Map();
+                // One alternation regex over every wrapper name per file — O(files), not
+                // O(files × wrappers) (#1852 review F3). Names are escaped and grouped
+                // non-capturing so capture group 1 stays the URL. The left boundary is a
+                // negative lookbehind, not `\b`: a bare configured name like `get` must
+                // match the free call `get('/x')` but NOT a member access `client.get(`
+                // (a `.get(` on an unrelated object), and `apiFetch` must not match
+                // `myApiFetch`. Member-style wrappers are configured with the dot
+                // (`client.get`), where the `.` is part of the pattern. The `u` flag +
+                // Unicode property classes make the boundary cover non-ASCII identifier
+                // characters too — ASCII `\w` would let `caféget('/x')` match `get`
+                // (#1852 review F10).
+                const alternation = [...wrapperNames].map(escapeRegex).join('|');
+                const wrapperCallRegex = new RegExp(`(?<![.\\p{L}\\p{N}_$])(?:${alternation})\\s*\\(\\s*['"\`](/[^'"\`\\s)]+)['"\`]`, 'gu');
+                const scanContent = (filePath, content) => {
+                    wrapperCallRegex.lastIndex = 0;
+                    // 1-based line number via a running newline counter: matches arrive in
+                    // ascending index, so accumulate newlines incrementally instead of
+                    // re-allocating `content.substring(0, match.index).split('\n')` on
+                    // every match (#1852 review F12). Output is identical.
+                    let line = 1;
+                    let scanned = 0;
+                    let match;
+                    while ((match = wrapperCallRegex.exec(content)) !== null) {
+                        for (; scanned < match.index; scanned++) {
+                            if (content.charCodeAt(scanned) === 10 /* '\n' */)
+                                line++;
                         }
+                        allFetchCalls.push({
+                            filePath,
+                            fetchURL: match[1],
+                            lineNumber: line,
+                        });
+                    }
+                };
+                for (const [filePath, content] of extraContents)
+                    scanContent(filePath, content);
+                // Also scan already-read JS/TS handler files (a handler can itself
+                // consume another route through a wrapper).
+                if (handlerContents) {
+                    for (const p of jsFiles) {
+                        const cached = handlerContents.get(p);
+                        if (cached !== undefined)
+                            scanContent(p, cached);
                     }
                 }
             }

package/dist/core/ingestion/pipeline.d.ts

@@ -25,6 +25,54 @@ export interface PipelineOptions {
      * to retain those nodes under `skipGraphPhases`.
      */
     skipGraphPhases?: boolean;
+    /**
+     * Build the control-flow-graph / PDG substrate (#2081 M1, opt-in via `--pdg`).
+     * Off by default: workers skip all CFG work and emit no `cfgSideChannel`, and
+     * scope-resolution emits no BasicBlock nodes or CFG edges — so the default
+     * graph is byte-identical to a pre-#2081 run. Folded into the parse-cache key
+     * so a pdg-off warm cache is not reused on a `--pdg` run.
+     */
+    pdg?: boolean;
+    /**
+     * Per-function source-line cap for worker-side CFG construction.
+     * `undefined` ⇒ the worker applies `DEFAULT_PDG_MAX_FUNCTION_LINES`; `0` ⇒ no
+     * cap (unlimited). Bounds the cost of a pathological mega-function; over-cap
+     * functions are skipped (no CFG emitted for them). No CLI flag in M1 —
+     * programmatic / server analyze-worker path only.
+     */
+    pdgMaxFunctionLines?: number;
+    /**
+     * Per-function CFG edge cap for the scope-resolution emit step.
+     * `undefined` ⇒ `DEFAULT_MAX_CFG_EDGES_PER_FUNCTION`; `0` ⇒ no cap (unlimited).
+     * Over-cap functions stop at the cap and log a structured drop warning (no
+     * silent truncation). No CLI flag in M1 — programmatic / server path only.
+     */
+    pdgMaxEdgesPerFunction?: number;
+    /**
+     * Per-function REACHING_DEF edge cap for the scope-resolution emit step
+     * (#2082 M2). `undefined` ⇒ `DEFAULT_PDG_MAX_REACHING_DEF_EDGES_PER_FUNCTION`
+     * (4000); `0` ⇒ no cap (unlimited). Emit-time-only — NOT folded into the
+     * parse-cache chunk key (the worker never sees it); recorded in
+     * `RepoMeta.pdg` so a cap change forces a full writeback. No CLI flag —
+     * programmatic / server path only, like the M1 caps.
+     */
+    pdgMaxReachingDefEdgesPerFunction?: number;
+    /**
+     * Per-function taint findings cap for the scope-resolution taint pass
+     * (#2083 M3). `undefined` ⇒ `DEFAULT_PDG_MAX_TAINT_FINDINGS_PER_FUNCTION`
+     * (200); `0` ⇒ no cap (unlimited). Emit-time-only — NOT folded into the
+     * parse-cache chunk key; recorded resolved in `RepoMeta.pdg` so a cap
+     * change forces a full writeback. No CLI flag or rc key (KTD8) —
+     * programmatic / server path only, like the other pdg caps.
+     */
+    pdgMaxTaintFindingsPerFunction?: number;
+    /**
+     * Per-finding taint hop cap (#2083 M3, KTD6 — bounds the persisted
+     * hop-encoded `reason`). `undefined` ⇒ `DEFAULT_PDG_MAX_TAINT_HOPS` (32);
+     * `0` ⇒ no cap (unlimited). Same emit-time-only / RepoMeta-stamped /
+     * no-CLI-flag discipline as `pdgMaxTaintFindingsPerFunction`.
+     */
+    pdgMaxTaintHops?: number;
     /**
      * Request parsing with the worker pool disabled. The sequential parser was
      * removed — the worker pool is the sole parse path — so setting this now
@@ -104,6 +152,15 @@ export interface PipelineOptions {
      * `process.env` state across invocations. When undefined, the env var decides.
      */
     keepLocalValueSymbols?: boolean;
+    /**
+     * Extra fetch-wrapper function names to treat as HTTP consumers, threaded
+     * from `.gitnexusrc` `fetchWrappers` via `AnalyzeOptions` (#1589/#1852
+     * residual). The routes phase unions these with the auto-detected `fetch()`
+     * wrappers when scanning for `route_map` consumers, so a wrapper named outside
+     * the built-in convention (or built on axios / a custom client) is still
+     * traced. Empty/undefined leaves behavior unchanged.
+     */
+    fetchWrappers?: readonly string[];
 }
 /**
  * All pipeline phases with their dependency relationships.