gitnexus 1.6.8-rc.9 → 1.6.8

package/dist/core/ingestion/taint/summary-model.d.ts

@@ -0,0 +1,200 @@
+/**
+ * Per-function taint SUMMARY model (#2084 M4 U2).
+ *
+ * A {@link FunctionSummary} is the compact, context-insensitive abstraction of
+ * one function's taint behaviour — the input to the interprocedural fixpoint
+ * (`interproc-solver.ts`). It is the GitNexus analogue of Pysa's `.pysa`
+ * models, Mariana Trench's "propagations", and CodeQL Models-as-Data summary
+ * rows: a function is reduced to how taint enters (params / generated sources),
+ * how it moves through (param→return, param→callee-arg), and where it lands
+ * (param→sink). The fixpoint composes these across resolved `CALLS` edges so a
+ * source in one function reaches a sink in another.
+ *
+ * ## Why summaries (not whole-program IFDS)
+ *
+ * The functional/summary method (Sharir-Pnueli 1981) analyses each function
+ * ONCE and propagates the result over the call graph — the same shape Pysa,
+ * Mariana Trench, and Infer use in production. GitNexus already resolves the
+ * call graph (`CALLS` edges carry final node ids), so the summary IS the only
+ * new artifact; propagation is graph reachability over a finite lattice.
+ *
+ * ## Granularity (first cut)
+ *
+ * WHOLE-PARAMETER. Ports are `param i`, `return`, and `receiver` — no field
+ * access paths (`arg0.field.sub`). Field sensitivity, callback-parameter ports
+ * (`Argument[0].Parameter[0]`), and context sensitivity are deferred (plan
+ * KTD; the largest JS/TS FN class — closures — stays a documented gap).
+ *
+ * ## Plain-data discipline
+ *
+ * A summary is a JSON-plain value type (no functions, class instances, Maps, or
+ * Symbols) so it survives `RunScopeResolutionStats` → `ScopeResolutionOutput`
+ * threading and any future worker/cache boundary unchanged — the same
+ * `Cloneable` constraint the CFG side channel obeys.
+ */
+import type { SinkKind, SourceKind } from './source-sink-config.js';
+/**
+ * Source-relative parameter index (0-based, in declaration order). A
+ * function's first parameter is `0`. Destructured / rest params map each bound
+ * name to the index of the formal parameter that introduced it (so
+ * `function f([a, b]) {}` binds both `a` and `b` to param `0`).
+ */
+export type ParamIndex = number;
+/**
+ * `param i` flows into argument `argIndex` of a call at source line `callLine`.
+ * The interprocedural solver joins this to the caller's outgoing `CALLS` edges
+ * by CALLEE NAME (`calleeName`) — NOT by `callLine` — because line-base parity
+ * between the CFG harvest (1-based) and the resolved reference site is fragile,
+ * while the callee identity is exact. It then applies the callee's summary at
+ * port `param argIndex`. This is the TITO ("taint-in-taint-out") propagation
+ * edge — a param laundered into a callee, the callee's behaviour deciding what
+ * happens next.
+ *
+ * `calleeName` is the site's dotted-callee tail (best-effort); absent when the
+ * callee chain was not statically resolvable, in which case the solver
+ * conservatively matches every outgoing call (sound over-approximation).
+ * `callLine` is the 1-based statement line as harvested (`StatementFacts.line`)
+ * — carried for hop display and as a TIE-BREAKER among several same-named
+ * callees of one caller, never as the primary join key.
+ */
+export interface ParamToCallArg {
+    readonly param: ParamIndex;
+    readonly callLine: number;
+    readonly argIndex: number;
+    readonly calleeName?: string;
+    /**
+     * Sink kinds neutralised on EVERY harvested path from the param to this call
+     * argument (intersection-over-paths, #2084 review P1-2). A sanitizer between
+     * the param and the callee arg (`relay(x){ const y=escape(x); sinkFn(y); }`)
+     * must carry across the boundary so the callee's `paramToSink` of a
+     * neutralised kind does not fire (the cross-function false positive). Absent
+     * means none neutralised.
+     */
+    readonly neutralized?: readonly SinkKind[];
+}
+/**
+ * `param i` flows to the function's return value (a `return <expr>` use).
+ *
+ * RESERVED — not yet consumed by the fixpoint (#2084 review P1-1). The M3
+ * statement-level floor already treats every call as propagate-through, so it
+ * taints a callee's RESULT whenever the caller passes tainted input; param→
+ * return recall is therefore already covered, and consuming `paramToReturn`
+ * would only add PRECISION (avoiding the floor's over-approximation for
+ * functions that don't actually return their param) — a larger refactor
+ * deferred. Harvested + version-stamped so the precision pass can land without
+ * a cache-namespace bump.
+ */
+export interface ParamToReturn {
+    readonly param: ParamIndex;
+    /** Sink kinds neutralised on EVERY path param→return (intersection). */
+    readonly neutralized?: readonly SinkKind[];
+}
+/** `param i` reaches a modelled sink of kind `sinkKind` inside this function. */
+export interface ParamToSink {
+    readonly param: ParamIndex;
+    readonly sinkKind: SinkKind;
+}
+/**
+ * The function itself GENERATES a source (a modelled source read, e.g.
+ * `req.body`) that reaches its return value — calling it yields tainted data
+ * with no tainted input required. The generative analogue of Pysa's
+ * `TaintSource[...]` return model. CONSUMED by the fixpoint via the caller's
+ * {@link CallResult} edges (#2084 review P1-1): a caller that uses such a
+ * function's result composes this into a finding/propagation. This is the
+ * genuinely-additive recall the floor cannot cover (the source is inside the
+ * callee — the caller passes no tainted input for the floor to propagate).
+ */
+export interface SourceToReturn {
+    readonly sourceKind: SourceKind;
+}
+/**
+ * What a user-function call's RESULT flows into, in the CALLER (#2084 review
+ * P1-1). Recorded when a call to a (potentially generative) user function has
+ * its return value used by the caller. The fixpoint composes it with the
+ * callee's {@link SourceToReturn}: if the callee returns a generated source,
+ * the caller's downstream use of the result is tainted.
+ */
+export type CallResultDest = {
+    readonly to: 'sink';
+    readonly sinkKind: SinkKind;
+} | {
+    readonly to: 'return';
+} | {
+    readonly to: 'callArg';
+    readonly toCallee?: string;
+    readonly argIndex: ParamIndex;
+};
+/** The result of a call to `calleeName` flows to `dest` in this function. */
+export interface CallResult {
+    readonly calleeName: string;
+    readonly dest: CallResultDest;
+}
+/**
+ * A modelled source generated in this function flows into argument `argIndex`
+ * of a call at `callLine`. This SEEDS the interprocedural fixpoint: the source
+ * taints the callee's parameter, which the callee's summary then carries to a
+ * sink (one or more hops away). The cross-function analogue of an intra-
+ * procedural `source → sink` partial flow whose sink lives in the callee.
+ */
+export interface SourceToCallArg {
+    readonly sourceKind: SourceKind;
+    /** Carried for hop display + same-name tie-break; NOT the join key (see
+     *  {@link ParamToCallArg} — the solver joins by `calleeName`). */
+    readonly callLine: number;
+    readonly argIndex: number;
+    readonly calleeName?: string;
+    /** Sink kinds neutralised on EVERY path from the generated source to this
+     *  call argument (intersection; #2084 review P1-2 — see {@link ParamToCallArg}). */
+    readonly neutralized?: readonly SinkKind[];
+}
+/**
+ * The compact taint abstraction of one function. All arrays are deterministically
+ * sorted by the harvester and deduped, so two structurally-equal summaries
+ * serialise identically (the {@link summaryVersion} contract).
+ */
+export interface FunctionSummary {
+    /** The resolved `Function`/`Method` graph node id this summary describes. */
+    readonly fnId: string;
+    /** Repo-relative source path (carried for diagnostics + the join debug). */
+    readonly filePath: string;
+    /** 1-based function start line (mirrors `FunctionCfg.functionStartLine`). */
+    readonly startLine: number;
+    /** Number of declared formal parameters (port arity). */
+    readonly paramCount: number;
+    /** param→return TITO edges. */
+    readonly paramToReturn: readonly ParamToReturn[];
+    /** param→callee-arg TITO edges (composed across `CALLS` in the fixpoint). */
+    readonly paramToCallArg: readonly ParamToCallArg[];
+    /** param→sink partial flows (a source reaching this param triggers a finding). */
+    readonly paramToSink: readonly ParamToSink[];
+    /** Generative source→return models. */
+    readonly sourceToReturn: readonly SourceToReturn[];
+    /** Generative source→callee-arg seeds (fixpoint entry points). */
+    readonly sourceToCallArg: readonly SourceToCallArg[];
+    /** Caller-side call-result flows — compose with callee `sourceToReturn`. */
+    readonly callResults: readonly CallResult[];
+    /**
+     * Content version stamp — `hash(own-facts ∪ sorted callee versions)`. The
+     * incremental cache key (Infer's content-keyed summary): equal across two
+     * runs iff the function's own taint facts AND every callee summary it depends
+     * on are unchanged. NOTE (#2084 review P1-1): callee-version composition is
+     * RESERVED — the harvester stamps the own-facts portion only
+     * ({@link ownFactsDigest}); the fixpoint does not yet recompose it.
+     */
+    readonly version: string;
+}
+/**
+ * Deterministic digest of a summary's OWN taint facts (everything except
+ * `version`, which is derived). Order-independent within each edge category —
+ * the harvester already sorts, but the digest re-canonicalises so a reordering
+ * never changes the stamp. Used as the leaf of {@link summaryVersion}.
+ */
+export declare function ownFactsDigest(s: Pick<FunctionSummary, 'paramCount' | 'paramToReturn' | 'paramToCallArg' | 'paramToSink' | 'sourceToReturn' | 'sourceToCallArg' | 'callResults'>): string;
+/**
+ * Content version stamp for a summary: `hash(ownFactsDigest ∪ sorted callee
+ * versions)`. Order-independent over callee versions (sorted). Equal iff the
+ * function's own facts AND every callee dependency are unchanged — this is the
+ * incremental invalidation primitive (a changed callee changes its version,
+ * which changes every transitive caller's version).
+ */
+export declare function summaryVersion(ownDigest: string, calleeVersions: readonly string[]): string;

package/dist/core/ingestion/taint/summary-model.js

@@ -0,0 +1,86 @@
+/**
+ * Per-function taint SUMMARY model (#2084 M4 U2).
+ *
+ * A {@link FunctionSummary} is the compact, context-insensitive abstraction of
+ * one function's taint behaviour — the input to the interprocedural fixpoint
+ * (`interproc-solver.ts`). It is the GitNexus analogue of Pysa's `.pysa`
+ * models, Mariana Trench's "propagations", and CodeQL Models-as-Data summary
+ * rows: a function is reduced to how taint enters (params / generated sources),
+ * how it moves through (param→return, param→callee-arg), and where it lands
+ * (param→sink). The fixpoint composes these across resolved `CALLS` edges so a
+ * source in one function reaches a sink in another.
+ *
+ * ## Why summaries (not whole-program IFDS)
+ *
+ * The functional/summary method (Sharir-Pnueli 1981) analyses each function
+ * ONCE and propagates the result over the call graph — the same shape Pysa,
+ * Mariana Trench, and Infer use in production. GitNexus already resolves the
+ * call graph (`CALLS` edges carry final node ids), so the summary IS the only
+ * new artifact; propagation is graph reachability over a finite lattice.
+ *
+ * ## Granularity (first cut)
+ *
+ * WHOLE-PARAMETER. Ports are `param i`, `return`, and `receiver` — no field
+ * access paths (`arg0.field.sub`). Field sensitivity, callback-parameter ports
+ * (`Argument[0].Parameter[0]`), and context sensitivity are deferred (plan
+ * KTD; the largest JS/TS FN class — closures — stays a documented gap).
+ *
+ * ## Plain-data discipline
+ *
+ * A summary is a JSON-plain value type (no functions, class instances, Maps, or
+ * Symbols) so it survives `RunScopeResolutionStats` → `ScopeResolutionOutput`
+ * threading and any future worker/cache boundary unchanged — the same
+ * `Cloneable` constraint the CFG side channel obeys.
+ */
+/** Stable FNV-1a 32-bit hash → 8-char hex. Pure, deterministic, no deps. */
+function fnv1a(input) {
+    let h = 0x811c9dc5;
+    for (let i = 0; i < input.length; i++) {
+        h ^= input.charCodeAt(i);
+        // 32-bit FNV prime multiply via shifts (avoids BigInt; stays in int32 land).
+        h = (h + ((h << 1) + (h << 4) + (h << 7) + (h << 8) + (h << 24))) >>> 0;
+    }
+    return (h >>> 0).toString(16).padStart(8, '0');
+}
+/**
+ * Deterministic digest of a summary's OWN taint facts (everything except
+ * `version`, which is derived). Order-independent within each edge category —
+ * the harvester already sorts, but the digest re-canonicalises so a reordering
+ * never changes the stamp. Used as the leaf of {@link summaryVersion}.
+ */
+export function ownFactsDigest(s) {
+    const parts = [`p${s.paramCount}`];
+    parts.push(...s.paramToReturn
+        .map((r) => `r:${r.param}:${[...(r.neutralized ?? [])].sort().join(',')}`)
+        .sort());
+    parts.push(...s.paramToCallArg
+        .map((c) => `c:${c.param}:${c.callLine}:${c.argIndex}:${c.calleeName ?? ''}:${[...(c.neutralized ?? [])].sort().join(',')}`)
+        .sort());
+    parts.push(...s.paramToSink.map((k) => `k:${k.param}:${k.sinkKind}`).sort());
+    parts.push(...s.sourceToReturn.map((g) => `g:${g.sourceKind}`).sort());
+    parts.push(...s.sourceToCallArg
+        .map((g) => `s:${g.sourceKind}:${g.callLine}:${g.argIndex}:${g.calleeName ?? ''}:${[...(g.neutralized ?? [])].sort().join(',')}`)
+        .sort());
+    parts.push(...s.callResults
+        .map((cr) => {
+        const d = cr.dest;
+        const dest = d.to === 'sink'
+            ? `sink:${d.sinkKind}`
+            : d.to === 'return'
+                ? 'return'
+                : `arg:${d.toCallee ?? ''}:${d.argIndex}`;
+        return `cr:${cr.calleeName}:${dest}`;
+    })
+        .sort());
+    return fnv1a(parts.join('|'));
+}
+/**
+ * Content version stamp for a summary: `hash(ownFactsDigest ∪ sorted callee
+ * versions)`. Order-independent over callee versions (sorted). Equal iff the
+ * function's own facts AND every callee dependency are unchanged — this is the
+ * incremental invalidation primitive (a changed callee changes its version,
+ * which changes every transitive caller's version).
+ */
+export function summaryVersion(ownDigest, calleeVersions) {
+    return fnv1a(`${ownDigest}#${[...calleeVersions].sort().join(',')}`);
+}

package/dist/core/ingestion/taint/typescript-model.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Built-in TS/JS taint model (#2083 M3 U2, plan KTD7).
+ *
+ * The canonical Express/Node source/sink/sanitizer set, registered for the
+ * `typescript` and `javascript` language ids via the EXPLICIT
+ * {@link registerBuiltinTaintModels} seam — deliberately not an import
+ * side-effect, so the U4 emit path controls WHEN registration happens (call
+ * it once before the pdg window runs; it is idempotent — the registry is
+ * last-write-wins on the same language id).
+ *
+ * `taintModelVersion` is a deterministic digest of the FULL model content
+ * (entries, kinds, args, modules). It joins the RepoMeta `pdg` stamp in U5 so
+ * that ANY model change — adding an entry, relabeling a kind — trips full
+ * writeback on an existing `--pdg` index (R7): persisted findings must never
+ * outlive the model that produced them.
+ */
+import type { SourceSinkSanitizerSpec } from './source-sink-config.js';
+/**
+ * The built-in TS/JS model. Module provenance uses bare specifier names —
+ * the matcher normalizes the `node:` scheme prefix, so `import { exec } from
+ * 'node:child_process'` resolves identically.
+ */
+export declare const TS_JS_TAINT_MODEL: SourceSinkSanitizerSpec;
+/**
+ * Deterministic digest of a spec's full content. Key order is canonicalized
+ * (recursively sorted) so the version reflects CONTENT, not literal layout;
+ * array order is semantic (entry identity) and intentionally preserved.
+ */
+export declare function computeTaintModelVersion(spec: SourceSinkSanitizerSpec): string;
+/** Version stamp of the built-in TS/JS model (joins the RepoMeta pdg key in U5). */
+export declare const taintModelVersion: string;
+/**
+ * Register the built-in model for TypeScript and JavaScript. Explicit init
+ * seam for the U4 emit path (call before the pdg window consumes the
+ * registry); idempotent. Vue and other TS-adjacent language ids are
+ * deliberately NOT registered — the M3 scope is TS/JS only.
+ */
+export declare function registerBuiltinTaintModels(): void;

package/dist/core/ingestion/taint/typescript-model.js

@@ -0,0 +1,102 @@
+/**
+ * Built-in TS/JS taint model (#2083 M3 U2, plan KTD7).
+ *
+ * The canonical Express/Node source/sink/sanitizer set, registered for the
+ * `typescript` and `javascript` language ids via the EXPLICIT
+ * {@link registerBuiltinTaintModels} seam — deliberately not an import
+ * side-effect, so the U4 emit path controls WHEN registration happens (call
+ * it once before the pdg window runs; it is idempotent — the registry is
+ * last-write-wins on the same language id).
+ *
+ * `taintModelVersion` is a deterministic digest of the FULL model content
+ * (entries, kinds, args, modules). It joins the RepoMeta `pdg` stamp in U5 so
+ * that ANY model change — adding an entry, relabeling a kind — trips full
+ * writeback on an existing `--pdg` index (R7): persisted findings must never
+ * outlive the model that produced them.
+ */
+import { createHash } from 'node:crypto';
+import { SupportedLanguages } from '../../../_shared/index.js';
+import { registerSourceSinkConfig } from './source-sink-registry.js';
+/**
+ * The built-in TS/JS model. Module provenance uses bare specifier names —
+ * the matcher normalizes the `node:` scheme prefix, so `import { exec } from
+ * 'node:child_process'` resolves identically.
+ */
+export const TS_JS_TAINT_MODEL = {
+    sources: [
+        // Express-convention request member reads, matched name-based on the
+        // receiver (`req`/`request`) — the plan's accepted Semgrep-style trade.
+        {
+            kind: 'remote-input',
+            objects: ['req', 'request'],
+            properties: ['body', 'query', 'params', 'headers', 'cookies'],
+        },
+    ],
+    sinks: [
+        // Command execution — the command string is argument 0.
+        { name: 'exec', kind: 'command-injection', args: [0], module: 'child_process' },
+        { name: 'execSync', kind: 'command-injection', args: [0], module: 'child_process' },
+        { name: 'spawn', kind: 'command-injection', args: [0], module: 'child_process' },
+        // Code evaluation. `eval` takes code at 0; `new Function(...)` treats
+        // EVERY argument as source text (params + body), so `args` is omitted
+        // (= all positions) rather than pinned to 0.
+        { name: 'eval', kind: 'code-injection', args: [0], global: true },
+        { name: 'Function', kind: 'code-injection', global: true, newOnly: true },
+        // Filesystem path consumption — path argument 0.
+        { name: 'readFile', kind: 'path-traversal', args: [0], module: 'fs' },
+        { name: 'readFileSync', kind: 'path-traversal', args: [0], module: 'fs' },
+        { name: 'writeFile', kind: 'path-traversal', args: [0], module: 'fs' },
+        { name: 'writeFileSync', kind: 'path-traversal', args: [0], module: 'fs' },
+        // SQL — `.query(sql)` / `.execute(sql)` member calls on ANY receiver
+        // (mysql2/pg/knex handles go by many names; receiver-conventional).
+        { name: 'query', kind: 'sql-injection', args: [0], anyReceiver: true },
+        { name: 'execute', kind: 'sql-injection', args: [0], anyReceiver: true },
+        // Reflected XSS — Express response writes, conventional receiver `res`.
+        { name: 'send', kind: 'xss', args: [0], receivers: ['res'] },
+        { name: 'write', kind: 'xss', args: [0], receivers: ['res'] },
+    ],
+    sanitizers: [
+        // URL-encoding: neutralizes markup injection AND path separators
+        // (`%2F` is not a separator inside a path component).
+        { name: 'encodeURIComponent', neutralizes: ['xss', 'path-traversal'], global: true },
+        // `escape-html` exports its function as the module default — the
+        // `'default'` pseudo-name matches the default-imported / require'd
+        // module handle being invoked directly.
+        { name: 'default', neutralizes: ['xss'], module: 'escape-html' },
+        { name: 'encode', neutralizes: ['xss'], module: 'he' },
+        { name: 'basename', neutralizes: ['path-traversal'], module: 'path' },
+        { name: 'escape', neutralizes: ['xss'], module: 'validator' },
+    ],
+};
+/**
+ * Deterministic digest of a spec's full content. Key order is canonicalized
+ * (recursively sorted) so the version reflects CONTENT, not literal layout;
+ * array order is semantic (entry identity) and intentionally preserved.
+ */
+export function computeTaintModelVersion(spec) {
+    return createHash('sha256').update(canonicalJson(spec)).digest('hex').slice(0, 12);
+}
+function canonicalJson(value) {
+    if (Array.isArray(value))
+        return `[${value.map(canonicalJson).join(',')}]`;
+    if (value !== null && typeof value === 'object') {
+        const entries = Object.entries(value)
+            .filter(([, v]) => v !== undefined)
+            .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
+            .map(([k, v]) => `${JSON.stringify(k)}:${canonicalJson(v)}`);
+        return `{${entries.join(',')}}`;
+    }
+    return JSON.stringify(value);
+}
+/** Version stamp of the built-in TS/JS model (joins the RepoMeta pdg key in U5). */
+export const taintModelVersion = computeTaintModelVersion(TS_JS_TAINT_MODEL);
+/**
+ * Register the built-in model for TypeScript and JavaScript. Explicit init
+ * seam for the U4 emit path (call before the pdg window consumes the
+ * registry); idempotent. Vue and other TS-adjacent language ids are
+ * deliberately NOT registered — the M3 scope is TS/JS only.
+ */
+export function registerBuiltinTaintModels() {
+    registerSourceSinkConfig(SupportedLanguages.TypeScript, TS_JS_TAINT_MODEL);
+    registerSourceSinkConfig(SupportedLanguages.JavaScript, TS_JS_TAINT_MODEL);
+}

package/dist/core/ingestion/type-extractors/c-cpp.js

@@ -1,4 +1,5 @@
 import { extractSimpleTypeName, extractVarName, resolveIterableElementType, methodToTypeArgPosition, } from './shared.js';
+import { CPP_BRACED_INIT_TYPE_PREFIX } from '../languages/cpp/conversion-rank.js';
 const DECLARATION_NODE_TYPES = new Set(['declaration']);
 /** Smart pointer factory function names that create a typed object. */
 const SMART_PTR_FACTORIES = new Set(['make_shared', 'make_unique', 'make_shared_for_overwrite']);
@@ -447,6 +448,8 @@ const extractForLoopBinding = (node, { scopeEnv, declarationTypeNodes, scope })
 /** Infer the type of a literal AST node for C++ overload disambiguation. */
 const inferLiteralType = (node) => {
     switch (node.type) {
+        case 'initializer_list':
+            return inferBracedInitLiteralType(node);
         case 'number_literal': {
             const t = node.text;
             // Float suffixes
@@ -475,6 +478,24 @@ const inferLiteralType = (node) => {
             return undefined;
     }
 };
+function inferBracedInitLiteralType(node) {
+    const elementTypes = [];
+    for (const child of node.children) {
+        if (child.type === ',' || child.type === '{' || child.type === '}')
+            continue;
+        const elementType = inferLiteralType(child);
+        if (elementType === undefined || elementType.startsWith(CPP_BRACED_INIT_TYPE_PREFIX)) {
+            return `${CPP_BRACED_INIT_TYPE_PREFIX}unknown:${elementTypes.length + 1}`;
+        }
+        elementTypes.push(elementType);
+    }
+    if (elementTypes.length === 0)
+        return `${CPP_BRACED_INIT_TYPE_PREFIX}unknown:0`;
+    const first = elementTypes[0];
+    return elementTypes.every((type) => type === first)
+        ? `${CPP_BRACED_INIT_TYPE_PREFIX}${first}:${elementTypes.length}`
+        : `${CPP_BRACED_INIT_TYPE_PREFIX}unknown:${elementTypes.length}`;
+}
 /** C++: detect constructor type from smart pointer factory calls (make_shared<Dog>()).
  *  Extracts the template type argument as the constructor type for virtual dispatch. */
 const detectCppConstructorType = (node, classNames) => {

package/dist/core/ingestion/utils/env.d.ts

@@ -21,6 +21,13 @@ export declare const isDev: boolean;
  * conventions and serves a different purpose.
  */
 export declare const parseTruthyEnv: (raw: string | undefined) => boolean;
+/**
+ * Parse a positive-integer env-var value. Returns the integer when `raw` is a
+ * finite integer `> 0`; otherwise (`undefined`, empty, non-numeric, `0`, or
+ * negative) returns `undefined` so the caller falls back to its default. Used
+ * for numeric tuning knobs like `GITNEXUS_PDG_EMIT_CHUNK_SIZE` (#2202).
+ */
+export declare const parsePositiveIntEnv: (raw: string | undefined) => number | undefined;
 /**
  * Whether scope-resolution dev validators (e.g. `validateBindingsImmutability`)
  * should run AND emit warnings. Off by default in CLI runs to avoid silent

package/dist/core/ingestion/utils/env.js

@@ -26,6 +26,18 @@ export const parseTruthyEnv = (raw) => {
     const value = raw.trim().toLowerCase();
     return value === '1' || value === 'true' || value === 'yes';
 };
+/**
+ * Parse a positive-integer env-var value. Returns the integer when `raw` is a
+ * finite integer `> 0`; otherwise (`undefined`, empty, non-numeric, `0`, or
+ * negative) returns `undefined` so the caller falls back to its default. Used
+ * for numeric tuning knobs like `GITNEXUS_PDG_EMIT_CHUNK_SIZE` (#2202).
+ */
+export const parsePositiveIntEnv = (raw) => {
+    if (raw === undefined)
+        return undefined;
+    const n = Number(raw.trim());
+    return Number.isInteger(n) && n > 0 ? n : undefined;
+};
 /**
  * Whether scope-resolution dev validators (e.g. `validateBindingsImmutability`)
  * should run AND emit warnings. Off by default in CLI runs to avoid silent

package/dist/core/ingestion/utils/method-props.js

@@ -184,6 +184,7 @@ export function buildMethodProps(info) {
         ...(info.isAsync ? { isAsync: info.isAsync } : {}),
         ...(info.isPartial ? { isPartial: info.isPartial } : {}),
         ...(info.isConst ? { isConst: info.isConst } : {}),
+        ...(info.isDeleted ? { isDeleted: info.isDeleted } : {}),
         ...(info.annotations.length > 0 ? { annotations: info.annotations } : {}),
     };
 }

package/dist/core/ingestion/workers/parse-worker.d.ts

@@ -6,6 +6,7 @@ import type { ConstructorBinding } from '../type-env.js';
 import type { NodeLabel, ParameterTypeClass } from '../../../_shared/index.js';
 import type { ParsedFile } from '../../../_shared/index.js';
 import { type ExtractedRoute } from '../route-extractors/laravel.js';
+import { type CfgSkipCounts } from '../cfg/collect.js';
 export type { ExtractedRoute } from '../route-extractors/laravel.js';
 interface ParsedNode {
     id: string;
@@ -50,6 +51,7 @@ interface ParsedSymbol {
     isReadonly?: boolean;
     isAbstract?: boolean;
     isFinal?: boolean;
+    isDeleted?: boolean;
     annotations?: string[];
 }
 export interface ExtractedCall {
@@ -211,6 +213,17 @@ export interface ParseWorkerResult {
      * entries predate the field; consumers must guard with `?? []`.
      */
     skippedPaths?: SkippedPath[];
+    /**
+     * Per-language CFG-bearing functions skipped during the worker walk, bucketed
+     * by reason (#2195): too-many-lines, too-deeply-nested (the proactive
+     * depth-guard bail), or build-error. Survives the parse cache (a small number
+     * map, kept by `...result` in slimParseWorkerResultsForCache) and is merged +
+     * logged per-language in `dispatchChunkParse` (alongside `skippedLanguages`),
+     * so a CFG coverage gap is visible. Like that sibling telemetry the warn is
+     * emitted for freshly-parsed chunks, not re-emitted on a warm cache hit.
+     * Optional for cache backward-compatibility — older shards predate it.
+     */
+    cfgSkipped?: Record<string, CfgSkipCounts>;
     fileCount: number;
 }
 export interface ParseWorkerInput {