gitnexus 1.6.8-rc.8 → 1.6.8

package/dist/core/group/extractors/include-extractor.js

@@ -1,19 +1,19 @@
 import * as path from 'node:path';
 import * as fs from 'node:fs/promises';
-import { createRequire } from 'node:module';
 import { glob } from 'glob';
 import Parser from 'tree-sitter';
 import Cpp from 'tree-sitter-cpp';
-// `tree-sitter-c` is vendored prebuild-only (#2116) and may be absent on a
-// toolchain-less / `--ignore-scripts` install. Load it via a guarded `_require`
-// rather than a top-level `import C from 'tree-sitter-c'`, which would throw
-// ERR_MODULE_NOT_FOUND at module-load and crash analyze (#2091/#2093). When the
+import { requireVendoredGrammar } from '../../tree-sitter/vendored-grammars.js';
+// `tree-sitter-c` is vendored (#2116), loaded from `vendor/` by absolute path
+// (NEVER copied into node_modules — see vendored-grammars.ts / #2111). Load it
+// via a guarded call rather than a top-level `import C from 'tree-sitter-c'`,
+// which would throw ERR_MODULE_NOT_FOUND at module-load and crash analyze
+// (#2091/#2093). It may be absent on a platform without a prebuild; when the
 // binding is absent, `getLanguageForFile` returns null for `.c`/`.h` so C
 // include-extraction is skipped (C++ is unaffected — its binding always ships).
-const _require = createRequire(import.meta.url);
 let C = null;
 try {
-    C = _require('tree-sitter-c');
+    C = requireVendoredGrammar('tree-sitter-c');
 }
 catch {
     /* C grammar unavailable — C include extraction degrades to a no-op. */
@@ -27,7 +27,7 @@ import { logger } from '../../logger.js';
 /**
  * Cross-repo C/C++ `#include` dependency extractor.
  *
- * **Provider side:** registers every `.h/.hpp/.hxx/.hh` file in the repo
+ * **Provider side:** registers every `.h/.hpp/.hxx/.hh/.cuh` file in the repo
  * as a provider contract with `include::<relative-path>`.
  *
  * **Consumer side:** parses all C/C++ source/header files for `#include "…"`
@@ -40,12 +40,19 @@ import { logger } from '../../logger.js';
  * exact contract-id equality in `runExactMatch`.
  */
 // ---------- constants ----------
-const HEADER_EXTENSIONS = new Set(['.h', '.hpp', '.hxx', '.hh']);
-// Source = headers (provider-eligible) ∪ implementation files (.c/.cpp/.cc/.cxx).
+const HEADER_EXTENSIONS = new Set(['.h', '.hpp', '.hxx', '.hh', '.cuh']);
+// Source = headers (provider-eligible) ∪ implementation files (.c/.cpp/.cc/.cxx/.cu).
 // Spread keeps the subset relationship explicit so a future contributor adding
 // a new header extension to HEADER_EXTENSIONS does not have to remember to
 // also add it here.
-const SOURCE_EXTENSIONS = new Set([...HEADER_EXTENSIONS, '.c', '.cpp', '.cc', '.cxx']);
+const SOURCE_EXTENSIONS = new Set([
+    ...HEADER_EXTENSIONS,
+    '.c',
+    '.cpp',
+    '.cc',
+    '.cxx',
+    '.cu',
+]);
 const INCLUDE_QUERY_SRC = '(preproc_include path: (_) @import.source) @import';
 /**
  * Well-known C/C++ standard library headers that can appear in `#include "…"`
@@ -259,6 +266,8 @@ function getLanguageForFile(filePath) {
         case '.hpp':
         case '.hxx':
         case '.hh':
+        case '.cu':
+        case '.cuh':
             return Cpp;
         default:
             return null;
@@ -281,7 +290,7 @@ function getLanguageForFile(filePath) {
 function isLocalInclude(cleaned, suffixIndex) {
     const candidates = [cleaned];
     if (!/\.[a-zA-Z0-9]+$/.test(cleaned)) {
-        for (const ext of ['.h', '.hpp', '.hxx', '.hh'])
+        for (const ext of HEADER_EXTENSIONS)
             candidates.push(cleaned + ext);
     }
     for (const c of candidates) {
@@ -386,7 +395,7 @@ export class IncludeExtractor {
     async extractProvidersGraph(db, repoPath) {
         try {
             const rows = await db(`MATCH (f:File)
-         WHERE f.filePath =~ '.*\\\\.(h|hpp|hxx|hh)$'
+         WHERE f.filePath =~ '.*\\\\.(h|hpp|hxx|hh|cuh)$'
          RETURN f.filePath AS filePath, f.id AS fileId`);
             // gitnexus analyze stores absolute paths in the File.filePath column.
             // Provider contract IDs MUST be repo-relative — otherwise the consumer

package/dist/core/group/sync.d.ts

@@ -1,5 +1,5 @@
 import { type RegistryEntry } from '../../storage/repo-manager.js';
-import type { GroupConfig, RepoHandle, RepoSnapshot, StoredContract, CrossLink } from './types.js';
+import type { GroupConfig, RepoHandle, RepoSnapshot, StoredContract, CrossLink, GroupManifestLink } from './types.js';
 export interface SyncOptions {
     extractorOverride?: ((repo: RepoHandle) => Promise<StoredContract[]>) | (() => Promise<StoredContract[]>);
     resolveRepoHandle?: (registryName: string, groupPath: string) => Promise<RepoHandle | null>;
@@ -18,4 +18,30 @@ export interface SyncResult {
     repoSnapshots: Record<string, RepoSnapshot>;
 }
 export declare function stableRepoPoolId(entry: RegistryEntry, allEntries: RegistryEntry[]): string;
+/** A batch of manifest links whose referenced in-group repos fit one resident window. */
+export interface ManifestWindow {
+    links: GroupManifestLink[];
+    /** In-group repos (group paths) this window's links reference; size ≤ maxResident. */
+    repos: Set<string>;
+}
+/**
+ * Partition manifest links into windows so each window references at most
+ * `maxResident` distinct in-group repos. Manifest resolution then materializes
+ * only one window's repos at a time, bounding peak pool residency regardless of
+ * group size (PR #2191 review, Finding 3 — windowed deferred resolution).
+ *
+ * Each link references ≤2 in-group repos, so every link fits a window when
+ * `maxResident ≥ 2`. Links are pre-sorted by their referenced-repo key so links
+ * sharing a repo land in contiguous windows — combined with release-not-close
+ * pooling, a hub repo stays warm across the windows that reference it (its
+ * lease is released, not closed, so the next window's initLbug fast-paths it).
+ * Every link lands in EXACTLY one window (a true partition): downstream
+ * dedupeCrossLinks dedupes cross-links but not contracts, so a link in two
+ * windows would emit duplicate contracts nothing absorbs.
+ *
+ * Repos not in `knownRepos` (dangling / unresolved) add 0 to a window's repo
+ * budget — the link is still placed (so it yields synthetic-UID contracts), it
+ * just consumes no residency.
+ */
+export declare function partitionManifestWindows(links: GroupManifestLink[], knownRepos: Set<string>, maxResident: number): ManifestWindow[];
 export declare function syncGroup(config: GroupConfig, opts?: SyncOptions): Promise<SyncResult>;

package/dist/core/incremental/subgraph-extract.js

@@ -49,6 +49,21 @@
  */
 import { createKnowledgeGraph } from '../graph/graph.js';
 const isGraphWide = (label) => label === 'Community' || label === 'Process';
+/**
+ * Relationship types whose VALIDITY is a whole-program property, not a
+ * function of their endpoints' files (#2084 M4 U6). `TAINT_PATH` (cross-
+ * function taint) can be invalidated by a change to an INTERMEDIATE function
+ * on a third file, so the endpoint-writability rule below would skip a stale
+ * A→C edge. These are always extracted (and the orchestrator delete-alls them
+ * first, like Community/Process) so they rebuild from the fresh graph.
+ */
+// `CALL_SUMMARY` (PDG FU-C) is intra-procedural (a callee's RETURN-VALUE ASCENT
+// depends only on its OWN body), but the orchestrator delete-alls it on an
+// incremental `--pdg` writeback to keep the emit path single — so it must be
+// re-included from the FULL fresh graph (which the emit phase recomputes every
+// run) or an unchanged function's summary would be lost. Cheap: one self-loop
+// edge per return-flowing function.
+const isGraphWideRelType = (type) => type === 'TAINT_PATH' || type === 'CALL_SUMMARY';
 /**
  * Build a Map<nodeId, filePath> for every File-bound node in the graph.
  * Graph-wide nodes (Community/Process) have no filePath and are filtered.
@@ -74,7 +89,9 @@ export const extractChangedSubgraph = (fullGraph, toWriteSet) => {
         }
     });
     fullGraph.forEachRelationship((r) => {
-        if (writableNodeIds.has(r.sourceId) || writableNodeIds.has(r.targetId)) {
+        if (writableNodeIds.has(r.sourceId) ||
+            writableNodeIds.has(r.targetId) ||
+            isGraphWideRelType(r.type)) {
             sub.addRelationship(r);
         }
     });

package/dist/core/ingestion/cfg/cfg-builder.d.ts

@@ -0,0 +1,114 @@
+/**
+ * CfgBuilder (issue #2081, M1) — the language-agnostic accumulator.
+ *
+ * A per-language `CfgVisitor` drives this: it creates blocks as it walks
+ * statements, wires edges (including back-edges and break/continue/return/throw
+ * targets resolved via {@link ControlFlowContext}), and calls {@link finish} to
+ * produce the serializable {@link FunctionCfg}. The builder owns the synthetic
+ * ENTRY (index 0) and EXIT blocks and de-duplicates identical edges so repeated
+ * `connect` calls (common when wiring a set of dangling exits) stay idempotent.
+ *
+ * It has no knowledge of any AST — it is exercised directly in unit tests with
+ * hand-built block sequences, which is how the classic CFG hazards are pinned
+ * before the tree-sitter visitor (U2) drives it.
+ */
+import type { BasicBlockData, BindingEntry, CfgEdgeKind, FunctionCfg, StatementFacts } from './types.js';
+/**
+ * Hard ceiling on CFG recursive-descent scope-entry depth (#2195). A language
+ * `CfgVisitor` wraps each nested block scope in {@link CfgBuilder.withNesting} (its
+ * `visitBody` / `visitSeq` choke points), so the live count tracks scope entries,
+ * not statement width. NOTE the count is ~2× LEXICAL nesting for block-bodied
+ * constructs (visitBody → visitSeq both enter), so the effective lexical ceiling
+ * is ~250 levels for block bodies (~500 for single-statement bodies / bare
+ * blocks). Real source nests ≤ ~50 deep, so this fires only on machine-generated
+ * / adversarial input. Both effective ceilings sit far below the engine's native
+ * stack limit (~1.2k+ nesting even on the raised worker `stackSizeMb`), so the
+ * bail is a DETERMINISTIC, language-independent {@link CfgNestingDepthError}
+ * rather than a nondeterministic `RangeError` thrown somewhere mid-walk.
+ */
+export declare const MAX_CFG_NESTING_DEPTH = 500;
+/**
+ * Thrown by the visitor nesting-depth guard ({@link CfgBuilder.enterNesting})
+ * when lexical nesting exceeds {@link MAX_CFG_NESTING_DEPTH}. `collectFunctionCfgs`
+ * catches it and counts the function under `skipped.tooDeeplyNested`, isolating
+ * the bail to one function instead of risking a worker-wide stack overflow.
+ */
+export declare class CfgNestingDepthError extends Error {
+    readonly limit: number;
+    constructor(limit: number);
+}
+export declare class CfgBuilder {
+    private readonly filePath;
+    private readonly functionStartLine;
+    private readonly functionEndLine;
+    /** Start column of the owning function — disambiguates same-line functions
+     *  in the BasicBlock ids (see {@link FunctionCfg.functionStartColumn}).
+     *  Defaults to 0 for hand-built test CFGs that don't model columns. */
+    private readonly functionStartColumn;
+    private readonly blocks;
+    private readonly edges;
+    private readonly edgeKeys;
+    /** Live recursive-descent nesting depth — see {@link enterNesting}. */
+    private nesting;
+    readonly entryIndex: number;
+    readonly exitIndex: number;
+    constructor(filePath: string, functionStartLine: number, functionEndLine: number, 
+    /** Start column of the owning function — disambiguates same-line functions
+     *  in the BasicBlock ids (see {@link FunctionCfg.functionStartColumn}).
+     *  Defaults to 0 for hand-built test CFGs that don't model columns. */
+    functionStartColumn?: number);
+    /** Create a block and return its index. */
+    newBlock(startLine: number, endLine: number, text: string, kind?: BasicBlockData['kind'], facts?: StatementFacts): number;
+    /** Add a single edge (idempotent on from+to+kind). */
+    edge(from: number, to: number, kind: CfgEdgeKind): void;
+    /** Wire a set of dangling exits to a single target block with one kind. */
+    connect(exits: readonly number[], to: number, kind?: CfgEdgeKind): void;
+    /** Extend a block's end line as more statements accrue to it. */
+    extendBlock(index: number, endLine: number, appendText?: string, facts?: StatementFacts): void;
+    /**
+     * Attach a facts-only statement record to a block WITHOUT touching its text
+     * or line span (#2082 M2 U1) — bench fingerprints and CFG snapshots include
+     * block text, so harvesting must never perturb it (ENTRY-block param defs
+     * are the canonical use; records that must precede a walked body get their
+     * own facts-only block instead, see the catch-param handling in visitTry).
+     */
+    attachFacts(index: number, facts: StatementFacts): void;
+    get blockCount(): number;
+    /**
+     * Run `fn` inside ONE nested block scope (#2195) — the single choke every
+     * visitor's `visitBody` / `visitSeq` funnels through. Enters on the way in and
+     * exits in a `finally`, so the live depth is balanced on every return AND every
+     * throw and the enter/exit can never drift out of pair (the reason this is one
+     * helper, not 24 hand-paired call sites). Throws {@link CfgNestingDepthError}
+     * when nesting exceeds {@link MAX_CFG_NESTING_DEPTH} — a proactive, deterministic
+     * bail before the native stack can overflow on a pathologically nested function.
+     *
+     * A block-bodied construct passes through BOTH visitBody and visitSeq, so it
+     * costs TWO scopes per lexical level: the effective structural ceiling is
+     * ~MAX_CFG_NESTING_DEPTH/2 (~250) lexical levels for block bodies (~500 for
+     * single-statement bodies / bare blocks, which hit only one of the two). Still
+     * an order of magnitude below the native limit and far above real code (≤ ~50).
+     */
+    withNesting<T>(fn: () => T): T;
+    /**
+     * Increment the nesting counter, throwing {@link CfgNestingDepthError} past the
+     * cap. Prefer {@link withNesting}, which pairs the exit in a `finally`; this is
+     * exposed for direct depth-accounting tests only.
+     */
+    enterNesting(): void;
+    /** Decrement the nesting counter — the partner of {@link enterNesting}. */
+    exitNesting(): void;
+    /** Produce the serializable CFG. Caller is responsible for having wired the
+     *  function's dangling exits to {@link exitIndex} before calling.
+     *
+     *  Pass `bindings` (the function's binding table, possibly empty) to emit
+     *  statement facts (#2082 M2 U1) — every block then carries a `statements`
+     *  array. Omit it (hand-built test CFGs, pre-M2 producers) and both fields
+     *  are absent, which the reaching-defs solver reports as `no-facts`. */
+    finish(bindings?: readonly BindingEntry[]): FunctionCfg;
+}
+/**
+ * Block indices reachable from `entryIndex` by following edges. Backs the
+ * reachability property tests (R9) over hand-built and visitor-produced CFGs.
+ */
+export declare const reachableBlocks: (cfg: FunctionCfg) => Set<number>;

package/dist/core/ingestion/cfg/cfg-builder.js

@@ -0,0 +1,196 @@
+/**
+ * Hard ceiling on CFG recursive-descent scope-entry depth (#2195). A language
+ * `CfgVisitor` wraps each nested block scope in {@link CfgBuilder.withNesting} (its
+ * `visitBody` / `visitSeq` choke points), so the live count tracks scope entries,
+ * not statement width. NOTE the count is ~2× LEXICAL nesting for block-bodied
+ * constructs (visitBody → visitSeq both enter), so the effective lexical ceiling
+ * is ~250 levels for block bodies (~500 for single-statement bodies / bare
+ * blocks). Real source nests ≤ ~50 deep, so this fires only on machine-generated
+ * / adversarial input. Both effective ceilings sit far below the engine's native
+ * stack limit (~1.2k+ nesting even on the raised worker `stackSizeMb`), so the
+ * bail is a DETERMINISTIC, language-independent {@link CfgNestingDepthError}
+ * rather than a nondeterministic `RangeError` thrown somewhere mid-walk.
+ */
+export const MAX_CFG_NESTING_DEPTH = 500;
+/**
+ * Thrown by the visitor nesting-depth guard ({@link CfgBuilder.enterNesting})
+ * when lexical nesting exceeds {@link MAX_CFG_NESTING_DEPTH}. `collectFunctionCfgs`
+ * catches it and counts the function under `skipped.tooDeeplyNested`, isolating
+ * the bail to one function instead of risking a worker-wide stack overflow.
+ */
+export class CfgNestingDepthError extends Error {
+    limit;
+    constructor(limit) {
+        super(`CFG nesting depth exceeded ${limit}`);
+        this.limit = limit;
+        this.name = 'CfgNestingDepthError';
+    }
+}
+export class CfgBuilder {
+    filePath;
+    functionStartLine;
+    functionEndLine;
+    functionStartColumn;
+    blocks = [];
+    edges = [];
+    edgeKeys = new Set();
+    /** Live recursive-descent nesting depth — see {@link enterNesting}. */
+    nesting = 0;
+    entryIndex;
+    exitIndex;
+    constructor(filePath, functionStartLine, functionEndLine, 
+    /** Start column of the owning function — disambiguates same-line functions
+     *  in the BasicBlock ids (see {@link FunctionCfg.functionStartColumn}).
+     *  Defaults to 0 for hand-built test CFGs that don't model columns. */
+    functionStartColumn = 0) {
+        this.filePath = filePath;
+        this.functionStartLine = functionStartLine;
+        this.functionEndLine = functionEndLine;
+        this.functionStartColumn = functionStartColumn;
+        this.entryIndex = this.newBlock(functionStartLine, functionStartLine, '', 'entry');
+        this.exitIndex = this.newBlock(functionEndLine, functionEndLine, '', 'exit');
+    }
+    /** Create a block and return its index. */
+    newBlock(startLine, endLine, text, kind = 'normal', facts) {
+        this.blocks.push({
+            startLine,
+            endLine,
+            textParts: text ? [text] : [],
+            kind,
+            statements: facts ? [facts] : [],
+        });
+        return this.blocks.length - 1;
+    }
+    /** Add a single edge (idempotent on from+to+kind). */
+    edge(from, to, kind) {
+        const key = `${from}->${to}:${kind}`;
+        if (this.edgeKeys.has(key))
+            return;
+        this.edgeKeys.add(key);
+        this.edges.push({ from, to, kind });
+    }
+    /** Wire a set of dangling exits to a single target block with one kind. */
+    connect(exits, to, kind = 'seq') {
+        for (const from of exits)
+            this.edge(from, to, kind);
+    }
+    /** Extend a block's end line as more statements accrue to it. */
+    extendBlock(index, endLine, appendText, facts) {
+        const b = this.blocks[index];
+        if (!b)
+            return;
+        if (endLine > b.endLine)
+            b.endLine = endLine;
+        if (appendText)
+            b.textParts.push(appendText);
+        if (facts)
+            b.statements.push(facts);
+    }
+    /**
+     * Attach a facts-only statement record to a block WITHOUT touching its text
+     * or line span (#2082 M2 U1) — bench fingerprints and CFG snapshots include
+     * block text, so harvesting must never perturb it (ENTRY-block param defs
+     * are the canonical use; records that must precede a walked body get their
+     * own facts-only block instead, see the catch-param handling in visitTry).
+     */
+    attachFacts(index, facts) {
+        const b = this.blocks[index];
+        if (!b)
+            return;
+        b.statements.push(facts);
+    }
+    get blockCount() {
+        return this.blocks.length;
+    }
+    /**
+     * Run `fn` inside ONE nested block scope (#2195) — the single choke every
+     * visitor's `visitBody` / `visitSeq` funnels through. Enters on the way in and
+     * exits in a `finally`, so the live depth is balanced on every return AND every
+     * throw and the enter/exit can never drift out of pair (the reason this is one
+     * helper, not 24 hand-paired call sites). Throws {@link CfgNestingDepthError}
+     * when nesting exceeds {@link MAX_CFG_NESTING_DEPTH} — a proactive, deterministic
+     * bail before the native stack can overflow on a pathologically nested function.
+     *
+     * A block-bodied construct passes through BOTH visitBody and visitSeq, so it
+     * costs TWO scopes per lexical level: the effective structural ceiling is
+     * ~MAX_CFG_NESTING_DEPTH/2 (~250) lexical levels for block bodies (~500 for
+     * single-statement bodies / bare blocks, which hit only one of the two). Still
+     * an order of magnitude below the native limit and far above real code (≤ ~50).
+     */
+    withNesting(fn) {
+        this.enterNesting();
+        try {
+            return fn();
+        }
+        finally {
+            this.exitNesting();
+        }
+    }
+    /**
+     * Increment the nesting counter, throwing {@link CfgNestingDepthError} past the
+     * cap. Prefer {@link withNesting}, which pairs the exit in a `finally`; this is
+     * exposed for direct depth-accounting tests only.
+     */
+    enterNesting() {
+        if (++this.nesting > MAX_CFG_NESTING_DEPTH)
+            throw new CfgNestingDepthError(MAX_CFG_NESTING_DEPTH);
+    }
+    /** Decrement the nesting counter — the partner of {@link enterNesting}. */
+    exitNesting() {
+        this.nesting--;
+    }
+    /** Produce the serializable CFG. Caller is responsible for having wired the
+     *  function's dangling exits to {@link exitIndex} before calling.
+     *
+     *  Pass `bindings` (the function's binding table, possibly empty) to emit
+     *  statement facts (#2082 M2 U1) — every block then carries a `statements`
+     *  array. Omit it (hand-built test CFGs, pre-M2 producers) and both fields
+     *  are absent, which the reaching-defs solver reports as `no-facts`. */
+    finish(bindings) {
+        const withFacts = bindings !== undefined;
+        return {
+            filePath: this.filePath,
+            functionStartLine: this.functionStartLine,
+            functionEndLine: this.functionEndLine,
+            functionStartColumn: this.functionStartColumn,
+            entryIndex: this.entryIndex,
+            exitIndex: this.exitIndex,
+            blocks: this.blocks.map((b, index) => ({
+                index,
+                startLine: b.startLine,
+                endLine: b.endLine,
+                text: b.textParts.join('\n'),
+                kind: b.kind,
+                ...(withFacts ? { statements: b.statements } : {}),
+            })),
+            edges: [...this.edges],
+            ...(withFacts ? { bindings } : {}),
+        };
+    }
+}
+/**
+ * Block indices reachable from `entryIndex` by following edges. Backs the
+ * reachability property tests (R9) over hand-built and visitor-produced CFGs.
+ */
+export const reachableBlocks = (cfg) => {
+    const adj = new Map();
+    for (const e of cfg.edges) {
+        const list = adj.get(e.from);
+        if (list)
+            list.push(e.to);
+        else
+            adj.set(e.from, [e.to]);
+    }
+    const seen = new Set([cfg.entryIndex]);
+    const stack = [cfg.entryIndex];
+    while (stack.length) {
+        const n = stack.pop();
+        for (const next of adj.get(n) ?? []) {
+            if (!seen.has(next)) {
+                seen.add(next);
+                stack.push(next);
+            }
+        }
+    }
+    return seen;
+};

package/dist/core/ingestion/cfg/collect.d.ts

@@ -0,0 +1,51 @@
+/**
+ * collectFunctionCfgs (issue #2081, M1).
+ *
+ * Walks a parsed file's tree-sitter tree and builds one {@link FunctionCfg} per
+ * CFG-bearing function via the language's {@link CfgVisitor}. Runs IN THE PARSE
+ * WORKER (where the AST lives — KTD1/KTD7); the result rides on
+ * `ParsedFile.cfgSideChannel` across the worker→main boundary.
+ *
+ * Nested functions are enumerated independently — each gets its own CFG, and
+ * appears as an opaque straight-line block in its enclosing function's CFG (the
+ * visitor does not descend into nested function bodies). `maxFunctionLines`
+ * bounds per-function cost: a function whose source span exceeds the cap is
+ * skipped (and counted) rather than walked, so a pathological mega-function
+ * cannot blow up worker time/memory. A cap of `0` means no limit.
+ */
+import type { SyntaxNode } from '../utils/ast-helpers.js';
+import type { CfgVisitor, FunctionCfg } from './types.js';
+/**
+ * Default per-function source-line cap used by the worker when the `--pdg` run
+ * does not specify `pdgMaxFunctionLines`. A function longer than this (almost
+ * always minified/generated code) is skipped rather than walked — its CFG is
+ * both expensive and low-value. Overridable via `PipelineOptions.pdgMaxFunctionLines`.
+ */
+export declare const DEFAULT_PDG_MAX_FUNCTION_LINES = 2000;
+/**
+ * CFG-bearing functions skipped during the walk, bucketed by reason (#2195).
+ * Surfaced per-language in the parse telemetry (parsing-processor.ts) so a CFG
+ * coverage gap is observable, not silent. All-zero ⇒ nothing skipped.
+ */
+export interface CfgSkipCounts {
+    /** Source span exceeded `maxFunctionLines` (minified / generated code). */
+    readonly tooManyLines: number;
+    /**
+     * Recursive-descent nesting hit {@link MAX_CFG_NESTING_DEPTH} — a proactive,
+     * deterministic bail (see {@link CfgNestingDepthError}) before a worker stack
+     * overflow.
+     */
+    readonly tooDeeplyNested: number;
+    /**
+     * `buildFunctionCfg` threw an unexpected error. Caught PER FUNCTION so one
+     * malformed function no longer drops the whole file's CFGs (the throw used to
+     * escape to the worker's language-group catch).
+     */
+    readonly buildError: number;
+}
+export interface CollectedCfgs {
+    readonly cfgs: readonly FunctionCfg[];
+    /** Per-reason skip counts (#2195). */
+    readonly skipped: CfgSkipCounts;
+}
+export declare function collectFunctionCfgs(root: SyntaxNode, visitor: CfgVisitor<SyntaxNode>, filePath: string, maxFunctionLines?: number, lineOffset?: number): CollectedCfgs;

package/dist/core/ingestion/cfg/collect.js

@@ -0,0 +1,77 @@
+import { CfgNestingDepthError } from './cfg-builder.js';
+/**
+ * Default per-function source-line cap used by the worker when the `--pdg` run
+ * does not specify `pdgMaxFunctionLines`. A function longer than this (almost
+ * always minified/generated code) is skipped rather than walked — its CFG is
+ * both expensive and low-value. Overridable via `PipelineOptions.pdgMaxFunctionLines`.
+ */
+export const DEFAULT_PDG_MAX_FUNCTION_LINES = 2000;
+/**
+ * Convert a CFG built from an EXTRACTED sub-document's AST (script-relative
+ * tree-sitter rows) into the enclosing file's coordinates by adding `offset` to
+ * every source-line field. Needed for embedded scripts — a Vue SFC `<script>`
+ * block parses at row 0 but lives at `lineOffset` in the `.vue` file, and every
+ * other worker-emitted graph node is already file-relative; without this, the
+ * CFG's `functionStartLine` would never join its Function/Method graph node
+ * (inter-procedural taint silently resolves nothing) and BasicBlock source
+ * lines would point at the wrong `.vue` line. A 0 offset returns the input
+ * unchanged (the common case: `.ts`/`.js`/etc. parse at the file root), keeping
+ * non-embedded languages byte-identical. Synthetic bindings keep `declLine` 0.
+ */
+function shiftCfgLines(cfg, offset) {
+    if (offset === 0)
+        return cfg;
+    return {
+        ...cfg,
+        functionStartLine: cfg.functionStartLine + offset,
+        functionEndLine: cfg.functionEndLine + offset,
+        blocks: cfg.blocks.map((b) => ({
+            ...b,
+            startLine: b.startLine + offset,
+            endLine: b.endLine + offset,
+            statements: b.statements?.map((s) => ({ ...s, line: s.line + offset })),
+        })),
+        bindings: cfg.bindings?.map((bd) => bd.declLine > 0 ? { ...bd, declLine: bd.declLine + offset } : bd),
+    };
+}
+export function collectFunctionCfgs(root, visitor, filePath, maxFunctionLines = 0, lineOffset = 0) {
+    const cfgs = [];
+    let tooManyLines = 0;
+    let tooDeeplyNested = 0;
+    let buildError = 0;
+    const stack = [root];
+    while (stack.length) {
+        const node = stack.pop();
+        if (visitor.isFunction(node)) {
+            const lines = node.endPosition.row - node.startPosition.row + 1;
+            if (maxFunctionLines > 0 && lines > maxFunctionLines) {
+                tooManyLines++;
+            }
+            else {
+                // Isolate the per-function build: a proactive deep-nesting bail
+                // (CfgNestingDepthError) or any other visitor throw is counted and
+                // skipped HERE, so it can't escape to the worker's language-group catch
+                // and silently drop every remaining function's CFG (#2195).
+                try {
+                    const cfg = visitor.buildFunctionCfg(node, filePath);
+                    if (cfg)
+                        cfgs.push(shiftCfgLines(cfg, lineOffset));
+                }
+                catch (err) {
+                    if (err instanceof CfgNestingDepthError)
+                        tooDeeplyNested++;
+                    else
+                        buildError++;
+                }
+            }
+        }
+        // Descend regardless (a skipped mega-function may still contain small
+        // nested functions that are worth a CFG of their own).
+        for (let i = node.namedChildCount - 1; i >= 0; i--) {
+            const child = node.namedChild(i);
+            if (child)
+                stack.push(child);
+        }
+    }
+    return { cfgs, skipped: { tooManyLines, tooDeeplyNested, buildError } };
+}

package/dist/core/ingestion/cfg/control-dependence.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Control dependence (#2085 M5 U3) — Ferrante, Ottenstein & Warren §3.1.1
+ * semantics. A block `dependent` is control-dependent on a branch block
+ * `controller` when `controller` decides whether `dependent` executes: formally,
+ * there is a CFG edge `controller → B` such that `dependent` post-dominates `B`
+ * but does NOT strictly post-dominate `controller`.
+ *
+ * Construction — the reverse-CFG dominance-frontier formulation (Cytron,
+ * Ferrante, Rosen, Wegman & Zadeck 1991): control dependence IS the dominance
+ * frontier of the reverse CFG, so `A ∈ PDF(X)` (the post-dominance frontier)
+ * ⟺ `X` is control-dependent on `A`. The PDF is computed bottom-up over the
+ * post-dom tree (`PDF_local` from a node's CFG predecessors + `PDF_up` from its
+ * post-dom-tree children) in O(N + E + output) — each up-step is charged to a
+ * distinct emitted edge, NOT re-walked per CFG edge as the original §3.1.1
+ * up-walk did (which was Θ(N²) on a deep post-dom chain). The two formulations
+ * enumerate the IDENTICAL full `(controller, dependent, label)` set (verified
+ * byte-identical on 3203 CFGs + ~1M-case differential fuzz); LLVM, Joern and WALA
+ * use the reverse-DF form. (Only the rare TRUNCATED prefix — when a function
+ * exceeds `maxEdges` — differs from the old prefix: it is now a sorted
+ * deterministic prefix rather than CFG-edge-iteration order. Both are valid,
+ * deterministic subsets; the full untruncated output is unchanged.)
+ * The branch SENSE ('T' | 'F') of the controlling edge becomes the edge label
+ * (KTD4 / KTD3 — it rides the persisted relation's `reason` column).
+ *
+ * PURE AND DETERMINISTIC (mirrors post-dominators.ts / reaching-defs.ts): no
+ * graph, no logger, importable outside the worker; output is deduped per
+ * (controller, dependent, label) and sorted, so snapshot tests and
+ * content-derived edge ids are stable. The loop header legitimately appears as
+ * control-dependent on ITSELF (`controller === dependent`) — the loop predicate
+ * gates its own re-execution; this is standard PDG behavior, not a bug.
+ */
+import { type PostDomTree } from './post-dominators.js';
+import type { FunctionCfg } from './types.js';
+export type CdgLabel = 'T' | 'F';
+export interface ControlDepEdge {
+    /** The branch block whose outcome controls `dependentBlock`. */
+    readonly controllerBlock: number;
+    /** The block that executes only because `controllerBlock` took `label`. */
+    readonly dependentBlock: number;
+    /** Branch sense of the controlling CFG edge — see {@link branchSense}. */
+    readonly label: CdgLabel;
+}
+export interface ControlDepResult {
+    /** Deduped, sorted (controller, dependent, label) control-dependence edges. */
+    readonly edges: readonly ControlDepEdge[];
+    /**
+     * True when the `maxEdges` ceiling was reached; `edges` is then a
+     * deterministic prefix (CFG-edge iteration order, sorted), never a silent
+     * drop. Mirrors {@link computeReachingDefs}'s `truncated`.
+     */
+    readonly truncated: boolean;
+}
+/**
+ * Compute control-dependence edges for one function's CFG. `postDom` may be
+ * supplied to reuse an already-built tree; otherwise it is computed. See the
+ * module doc for the purity/determinism contract.
+ */
+export declare function computeControlDependence(cfg: FunctionCfg, postDom?: PostDomTree, maxEdges?: number): ControlDepResult;