gitnexus 1.6.9-rc.3 → 1.6.9-rc.5

package/dist/core/group/extractors/http-patterns/java-static-path.d.ts

@@ -0,0 +1,39 @@
+import Parser from 'tree-sitter';
+/**
+ * Resolve a statically-derivable path argument to a literal path: a bare
+ * string literal, a `URI.create("/x")` call, or a `UriComponentsBuilder`
+ * fluent chain. Genuinely dynamic arguments → null.
+ */
+export declare function extractStaticPathExpression(node: Parser.SyntaxNode): string | null;
+/**
+ * Infer an OkHttp request verb by scanning the builder chain around the matched
+ * `.url(...)` call: a `.get()/.head()/.post()/.put()/.delete()/.patch()` helper
+ * (before or after `.url()`), or a `.method("VERB", …)` literal, wins. Returns
+ * `'GET'` only when the chain has NO verb call at all (a bare `.url(...).build()`
+ * — OkHttp's real default). Returns `null` for an explicit `.method(verb, …)`
+ * whose verb is a non-literal: the verb is set but not statically resolvable, so
+ * the caller skips the call rather than asserting a wrong GET (parity with the
+ * WebClient long-form variable-bound-verb behavior, which also skips).
+ */
+export declare function inferOkHttpMethod(urlCall: Parser.SyntaxNode): string | null;
+/**
+ * Infer a Java-`HttpClient` request verb by walking UP the builder chain from the
+ * matched `.uri(URI.create("..."))` call: the first `.GET()/.POST()/.PUT()/`
+ * `.DELETE()/.HEAD()` verb-helper, or a `.method("VERB", body)` literal, wins.
+ * Returns `'GET'` only when the chain has no verb call (a bare `.build()` — the
+ * builder's real default). Returns `null` for an explicit `.method(verb, …)` with
+ * a non-literal verb (skip, not a guessed GET). The scan is transparent to
+ * neutral calls anywhere in the chain (`.header()`/`.timeout()`/`.version()`),
+ * before or after `.uri()`, so neither a header/timeout hop nor a verb call's
+ * position drops the contract.
+ */
+export declare function inferHttpClientMethod(uriCall: Parser.SyntaxNode): string | null;
+/** True when `urlCall`'s receiver chain bottoms out on a `new Request.Builder()`
+ *  object-creation (descending the `.object` chain past any intervening calls). */
+export declare function okHttpUrlRootsAtBuilder(urlCall: Parser.SyntaxNode): boolean;
+/** True when `uriCall`'s receiver chain includes a `HttpRequest.newBuilder()`. */
+export declare function httpClientUriRootsAtNewBuilder(uriCall: Parser.SyntaxNode): boolean;
+/** True when a `HttpRequest.newBuilder(URI.create(...))` chain ALSO calls `.uri(...)`
+ *  later — a later `.uri()` overrides the constructor URI at runtime, so the
+ *  constructor-arg path must NOT be emitted (the `.uri()` query emits the override). */
+export declare function httpClientChainHasUriCall(newBuilderCall: Parser.SyntaxNode): boolean;

package/dist/core/group/extractors/http-patterns/java-static-path.js

@@ -0,0 +1,248 @@
+import { unquoteLiteral } from '../tree-sitter-scanner.js';
+// ─── Statically-resolvable consumer path + builder verb-walk helpers ──────
+// RestTemplate calls increasingly pass a non-literal path argument that is
+// still statically derivable — `URI.create("/x")` or a `UriComponentsBuilder`
+// fluent chain. These helpers resolve those shapes to a literal path; a
+// genuinely dynamic argument (a variable, a non-`URI`/`UriComponentsBuilder`
+// call) resolves to null and the call site is skipped. This module also owns
+// the OkHttp / Java-HttpClient builder verb-walks (`inferOkHttpMethod` /
+// `inferHttpClientMethod`), which recover the request verb by walking UP the
+// fluent chain from the matched `.url(...)` / `.uri(...)` call. Extracted from
+// java.ts (#2268) so that plugin stays under ~1000 lines; the `methodInvocation*`
+// primitives + `firstLiteralArgument` are module-internal (shared by the path
+// resolvers and the verb-walks), while the path resolver and the two verb-walks
+// are java.ts's only entry points here.
+function methodInvocationName(node) {
+    return node.type === 'method_invocation' ? (node.childForFieldName('name')?.text ?? null) : null;
+}
+function methodInvocationObject(node) {
+    return node.type === 'method_invocation' ? node.childForFieldName('object') : null;
+}
+function methodInvocationArguments(node) {
+    const argsNode = node.type === 'method_invocation' ? node.childForFieldName('arguments') : null;
+    return argsNode?.namedChildren ?? [];
+}
+function firstLiteralArgument(node) {
+    const first = methodInvocationArguments(node)[0];
+    return first?.type === 'string_literal' ? unquoteLiteral(first.text) : null;
+}
+/** Resolve a `URI.create("/path")` call to its literal path; null otherwise. */
+function extractUriCreatePath(node) {
+    if (node.type !== 'method_invocation')
+        return null;
+    if (methodInvocationObject(node)?.text !== 'URI' || methodInvocationName(node) !== 'create')
+        return null;
+    return firstLiteralArgument(node);
+}
+// Join a builder base with a sub-path using exactly one separating slash. This
+// is intentionally NOT the shared `joinPath`: `joinPath` force-prepends `/`,
+// whereas `appendPath` must preserve an absolute/host base (`fromHttpUrl`
+// "https://host/api") so the host survives until `normalizeConsumerPath` strips
+// it downstream. Do not unify the two.
+function appendPath(base, subPath) {
+    if (!base)
+        return subPath.startsWith('/') ? subPath : `/${subPath}`;
+    if (!subPath)
+        return base;
+    return `${base.replace(/\/+$/, '')}/${subPath.replace(/^\/+/, '')}`;
+}
+/**
+ * Resolve a `UriComponentsBuilder` fluent chain to its literal path. Seed
+ * methods (`fromPath`/`fromUriString`/`fromHttpUrl`) return the literal arg
+ * VERBATIM — a `fromHttpUrl("https://host/api")` seed keeps its host, which the
+ * shared `normalizeConsumerPath` later reduces to the path (the same single
+ * normalization point every other consumer path goes through). `path` and
+ * `pathSegment` append literal segments; `build`/`toUriString`/`toUri`/`encode`
+ * and the `query*` family pass through (query attributes do not change the
+ * path). Any non-literal segment or unknown call → null.
+ */
+// A UriComponentsBuilder chain deeper than this is not realistic source; cap the
+// recursion so a pathological / machine-generated chain returns null instead of
+// overflowing the stack (mirrors the project's other AST-depth guards).
+const MAX_BUILDER_DEPTH = 100;
+function extractUriComponentsBuilderPath(node, depth = 0) {
+    if (depth > MAX_BUILDER_DEPTH)
+        return null;
+    if (node.type !== 'method_invocation')
+        return null;
+    const name = methodInvocationName(node);
+    const objectNode = methodInvocationObject(node);
+    if ((name === 'fromPath' || name === 'fromUriString' || name === 'fromHttpUrl') &&
+        objectNode?.text === 'UriComponentsBuilder') {
+        // Strip any `?query` baked into the seed literal so a later `.path()` appends
+        // to a clean base; otherwise the sub-path is glued after the query
+        // (`/base?x=1/sub`) and normalizeHttpPath truncates the whole tail at `?`.
+        // A host prefix (`https://h/api`) is preserved and stripped downstream by
+        // normalizeConsumerPath.
+        const seed = firstLiteralArgument(node);
+        return seed === null ? null : seed.split('?')[0];
+    }
+    if (!objectNode)
+        return null;
+    if (name === 'path') {
+        const base = extractUriComponentsBuilderPath(objectNode, depth + 1);
+        const subPath = firstLiteralArgument(node);
+        if (base === null || subPath === null)
+            return null;
+        // Spring `UriComponentsBuilder.path(p)` appends `p` VERBATIM (no slash
+        // inserted — unlike `pathSegment`, which slash-joins), then normalizes the
+        // full path to collapse duplicate slashes. So `fromPath("/api").path("users")`
+        // → `/apiusers`, while `.path("/users")` → `/api/users`, and a trailing-slash
+        // base collapses (`/api/` + `/users` → `/api/users`). The `(?<!:)` keeps a
+        // scheme `://` in a host seed intact; the downstream normalizer is the other
+        // slash-collapser for consumer paths (see KTD2 — do not remove it).
+        return (base + subPath).replace(/(?<!:)\/{2,}/g, '/');
+    }
+    if (name === 'pathSegment') {
+        const base = extractUriComponentsBuilderPath(objectNode, depth + 1);
+        if (base === null)
+            return null;
+        const args = methodInvocationArguments(node);
+        const segments = args
+            .map((arg) => (arg.type === 'string_literal' ? unquoteLiteral(arg.text) : null))
+            .filter((segment) => segment !== null);
+        if (segments.length !== args.length)
+            return null; // a non-literal segment defeats static resolution
+        return segments.reduce((acc, segment) => appendPath(acc, segment), base);
+    }
+    if (name === 'build' ||
+        name === 'toUriString' ||
+        name === 'toUri' ||
+        name === 'encode' ||
+        name === 'query' ||
+        name === 'queryParam' ||
+        name === 'queryParams' ||
+        name === 'replaceQuery' ||
+        name === 'replaceQueryParam' ||
+        name === 'replaceQueryParams')
+        return extractUriComponentsBuilderPath(objectNode, depth + 1);
+    return null;
+}
+/**
+ * Resolve a statically-derivable path argument to a literal path: a bare
+ * string literal, a `URI.create("/x")` call, or a `UriComponentsBuilder`
+ * fluent chain. Genuinely dynamic arguments → null.
+ */
+export function extractStaticPathExpression(node) {
+    if (node.type === 'string_literal')
+        return unquoteLiteral(node.text);
+    return extractUriCreatePath(node) ?? extractUriComponentsBuilderPath(node);
+}
+// ─── Builder verb-walks ───────────────────────────────────────────────
+// OkHttp / Java-HttpClient encode the request verb on a SIBLING call elsewhere in
+// the fluent chain, not on the matched path call. Both queries capture the path
+// call (`.url(...)` / `.uri(...)`); these helpers recover the verb by scanning
+// the WHOLE chain — transparent to neutral calls (`.addHeader()`/`.header()`/
+// `.timeout()`/`.version()`) wherever they sit relative to the path call, so the
+// verb resolves whether it precedes or follows the path call.
+/** Every `method_invocation` in the fluent chain `pathCall` belongs to, ordered
+ *  innermost (next to the construction) → outermost (terminal). Lets the verb-walk
+ *  find the verb wherever it sits, and lets the root gates inspect the chain base. */
+function builderChainCalls(pathCall) {
+    let innermost = pathCall;
+    let obj = methodInvocationObject(innermost);
+    while (obj?.type === 'method_invocation') {
+        innermost = obj;
+        obj = methodInvocationObject(innermost);
+    }
+    const calls = [innermost];
+    let cur = innermost;
+    let parent = cur.parent;
+    while (parent?.type === 'method_invocation' && methodInvocationObject(parent)?.id === cur.id) {
+        calls.push(parent);
+        cur = parent;
+        parent = parent.parent;
+    }
+    return calls;
+}
+/** Scan the chain for the verb a `name`-matching helper or a `.method("LITERAL")`
+ *  call sets, resolving the LAST such call — each verb-setter overwrites the
+ *  previous at runtime, so on the (non-idiomatic) chain that sets two verbs the
+ *  one nearest the terminal wins. `null` means "verb is set but not statically
+ *  resolvable" (a non-literal/empty `.method(verb)`) → the caller skips rather
+ *  than guessing. `defaultVerb` is returned only when the chain has no verb call
+ *  at all (a bare build). `verbHelpers` are matched on the method NAME (OkHttp
+ *  helpers are lowercase, HttpClient helpers uppercase). */
+function inferBuilderVerb(pathCall, verbHelpers, defaultVerb) {
+    let lastVerbCall = null;
+    for (const call of builderChainCalls(pathCall)) {
+        if (call.id === pathCall.id)
+            continue; // the path call itself is never the verb
+        const name = methodInvocationName(call);
+        if (name === 'method' || (name !== null && verbHelpers.includes(name)))
+            lastVerbCall = call;
+    }
+    if (lastVerbCall === null)
+        return defaultVerb; // no verb call → builder default
+    const name = methodInvocationName(lastVerbCall);
+    // Explicit `.method(...)`: a non-empty string-literal verb resolves; a
+    // non-literal (variable-bound) OR empty-string verb is unresolvable → null
+    // (skip), NOT a guessed default or a malformed empty-method contract.
+    if (name === 'method') {
+        const verb = firstLiteralArgument(lastVerbCall);
+        return verb ? verb.toUpperCase() : null;
+    }
+    return name === null ? defaultVerb : name.toUpperCase(); // a verb-helper name
+}
+const OK_HTTP_VERB_HELPERS = ['get', 'head', 'post', 'put', 'delete', 'patch'];
+const HTTP_CLIENT_VERB_HELPERS = ['GET', 'POST', 'PUT', 'DELETE', 'HEAD'];
+/**
+ * Infer an OkHttp request verb by scanning the builder chain around the matched
+ * `.url(...)` call: a `.get()/.head()/.post()/.put()/.delete()/.patch()` helper
+ * (before or after `.url()`), or a `.method("VERB", …)` literal, wins. Returns
+ * `'GET'` only when the chain has NO verb call at all (a bare `.url(...).build()`
+ * — OkHttp's real default). Returns `null` for an explicit `.method(verb, …)`
+ * whose verb is a non-literal: the verb is set but not statically resolvable, so
+ * the caller skips the call rather than asserting a wrong GET (parity with the
+ * WebClient long-form variable-bound-verb behavior, which also skips).
+ */
+export function inferOkHttpMethod(urlCall) {
+    return inferBuilderVerb(urlCall, OK_HTTP_VERB_HELPERS, 'GET');
+}
+/**
+ * Infer a Java-`HttpClient` request verb by walking UP the builder chain from the
+ * matched `.uri(URI.create("..."))` call: the first `.GET()/.POST()/.PUT()/`
+ * `.DELETE()/.HEAD()` verb-helper, or a `.method("VERB", body)` literal, wins.
+ * Returns `'GET'` only when the chain has no verb call (a bare `.build()` — the
+ * builder's real default). Returns `null` for an explicit `.method(verb, …)` with
+ * a non-literal verb (skip, not a guessed GET). The scan is transparent to
+ * neutral calls anywhere in the chain (`.header()`/`.timeout()`/`.version()`),
+ * before or after `.uri()`, so neither a header/timeout hop nor a verb call's
+ * position drops the contract.
+ */
+export function inferHttpClientMethod(uriCall) {
+    return inferBuilderVerb(uriCall, HTTP_CLIENT_VERB_HELPERS, 'GET');
+}
+// ─── Builder-chain root gates (anti-overreach) ────────────────────────
+// The path queries match a bare `.url(...)` / `.uri(URI.create(...))` call on ANY
+// receiver so that a builder call BEFORE the path call (`new Request.Builder()`
+// `.addHeader(...).url(...)`, `HttpRequest.newBuilder().version(v).uri(...)`) is
+// still captured. These gates re-impose the framework anchor in JS — only a chain
+// that bottoms out on the right construction emits, so a `.url(...)`/`.uri(...)`
+// on an unrelated object does not.
+/** True when `urlCall`'s receiver chain bottoms out on a `new Request.Builder()`
+ *  object-creation (descending the `.object` chain past any intervening calls). */
+export function okHttpUrlRootsAtBuilder(urlCall) {
+    let obj = methodInvocationObject(urlCall);
+    while (obj?.type === 'method_invocation')
+        obj = methodInvocationObject(obj);
+    return (obj?.type === 'object_creation_expression' &&
+        obj.childForFieldName('type')?.text === 'Request.Builder');
+}
+/** True when `uriCall`'s receiver chain includes a `HttpRequest.newBuilder()`. */
+export function httpClientUriRootsAtNewBuilder(uriCall) {
+    let obj = methodInvocationObject(uriCall);
+    while (obj?.type === 'method_invocation') {
+        if (methodInvocationName(obj) === 'newBuilder' &&
+            methodInvocationObject(obj)?.text === 'HttpRequest')
+            return true;
+        obj = methodInvocationObject(obj);
+    }
+    return false;
+}
+/** True when a `HttpRequest.newBuilder(URI.create(...))` chain ALSO calls `.uri(...)`
+ *  later — a later `.uri()` overrides the constructor URI at runtime, so the
+ *  constructor-arg path must NOT be emitted (the `.uri()` query emits the override). */
+export function httpClientChainHasUriCall(newBuilderCall) {
+    return builderChainCalls(newBuilderCall).some((call) => call.id !== newBuilderCall.id && methodInvocationName(call) === 'uri');
+}

package/dist/core/group/extractors/http-patterns/java.js

@@ -2,6 +2,7 @@ import Java from 'tree-sitter-java';
 import { compilePatterns, runCompiledPatterns, unquoteLiteral, } from '../tree-sitter-scanner.js';
 import { METHOD_ANNOTATION_TO_HTTP, isRouteMemberKey, findEnclosingClass, } from '../../../ingestion/route-extractors/spring-shared.js';
 import { REST_TEMPLATE_TO_HTTP, WEB_CLIENT_SHORT_TO_HTTP, WEB_CLIENT_LONG_VERB_RE, EXCHANGE_ANNOTATION_TO_HTTP, parseRequestLine, pushPrefix, joinPath, scanSpringInheritanceProject, OPENFEIGN_FRAMEWORK, HTTP_INTERFACE_FRAMEWORK, FEIGN_CONFIDENCE, REQUEST_LINE_CONFIDENCE, EXCHANGE_CONFIDENCE, } from './spring-consumer-shared.js';
+import { extractStaticPathExpression, inferOkHttpMethod, inferHttpClientMethod, okHttpUrlRootsAtBuilder, httpClientUriRootsAtNewBuilder, httpClientChainHasUriCall, } from './java-static-path.js';
 /**
  * Java HTTP plugin. Handles:
  *   - Spring `@RequestMapping` class prefixes + `@(Get|Post|...)Mapping` method annotations
@@ -64,17 +65,15 @@ import { REST_TEMPLATE_TO_HTTP, WEB_CLIENT_SHORT_TO_HTTP, WEB_CLIENT_LONG_VERB_R
 // sidesteps that hazard entirely; all name/key discrimination lives in the
 // for-loop, where it reads as straight-line code.
 //
-// KNOWN LIMITATION — fully-qualified route annotations are not matched. `@ann`
-// binds `name: (identifier)`, but a FQN annotation (`@org.springframework…
-// GetMapping("/x")`) parses its name as a `scoped_identifier`, which this query
-// does not match, so its route is not extracted. (The class is still recognized
-// as a controller — `hasAnnotation` trailing-segment-matches the FQN — only the
-// route-string extraction is missed.) In practice annotations are imported and
-// written by simple name, so this is rare. It is a minor asymmetry with the
-// Kotlin plugin, whose grammar models a FQN as separate `type_identifier`
-// segments that its route queries DO match. Aligning Java would mean matching
-// `scoped_identifier` too; that is deferred to avoid re-keying existing Java
-// contracts via the predicate hazard above. Pinned by an anti-overreach test.
+// FULLY-QUALIFIED route annotations ARE matched. `@ann` binds either an
+// `identifier` (simple name) or a `scoped_identifier` (a FQN annotation such as
+// `@org.springframework…GetMapping("/x")`); the for-loop normalizes the name to
+// its trailing segment via `simpleName` before discriminating. This is a node-
+// type widening only — the query stays predicate-free, so it does NOT reintroduce
+// the bucket hazard above, and a simple name maps to itself so existing Java
+// contracts are unchanged (only previously-unmatched FQN annotations gain
+// routes). This brings Java to parity with the Kotlin plugin, whose grammar
+// already matches FQN route annotations.
 const JAVA_ROUTE_ANNOTATION_PATTERNS = compilePatterns({
     name: 'java-route-annotation',
     language: Java,
@@ -86,17 +85,17 @@ const JAVA_ROUTE_ANNOTATION_PATTERNS = compilePatterns({
           (class_declaration
             (modifiers
               (annotation
-                name: (identifier) @ann
+                name: [(identifier) (scoped_identifier)] @ann
                 arguments: (annotation_argument_list [(string_literal) @value (element_value_array_initializer (string_literal) @value)])))) @node
           (interface_declaration
             (modifiers
               (annotation
-                name: (identifier) @ann
+                name: [(identifier) (scoped_identifier)] @ann
                 arguments: (annotation_argument_list [(string_literal) @value (element_value_array_initializer (string_literal) @value)])))) @node
           (class_declaration
             (modifiers
               (annotation
-                name: (identifier) @ann
+                name: [(identifier) (scoped_identifier)] @ann
                 arguments: (annotation_argument_list
                   (element_value_pair
                     key: (identifier) @key
@@ -104,7 +103,7 @@ const JAVA_ROUTE_ANNOTATION_PATTERNS = compilePatterns({
           (interface_declaration
             (modifiers
               (annotation
-                name: (identifier) @ann
+                name: [(identifier) (scoped_identifier)] @ann
                 arguments: (annotation_argument_list
                   (element_value_pair
                     key: (identifier) @key
@@ -112,13 +111,13 @@ const JAVA_ROUTE_ANNOTATION_PATTERNS = compilePatterns({
           (method_declaration
             (modifiers
               (annotation
-                name: (identifier) @ann
+                name: [(identifier) (scoped_identifier)] @ann
                 arguments: (annotation_argument_list [(string_literal) @value (element_value_array_initializer (string_literal) @value)])))
             name: (identifier) @member) @node
           (method_declaration
             (modifiers
               (annotation
-                name: (identifier) @ann
+                name: [(identifier) (scoped_identifier)] @ann
                 arguments: (annotation_argument_list
                   (element_value_pair
                     key: (identifier) @key
@@ -154,7 +153,7 @@ const REST_TEMPLATE_PATTERNS = compilePatterns({
         (method_invocation
           object: (identifier) @obj (#eq? @obj "restTemplate")
           name: (identifier) @method
-          arguments: (argument_list . (string_literal) @path))
+          arguments: (argument_list . (_) @path))
       `,
         },
     ],
@@ -170,7 +169,7 @@ const REST_TEMPLATE_EXCHANGE_PATTERNS = compilePatterns({
           object: (identifier) @obj (#eq? @obj "restTemplate")
           name: (identifier) @method (#eq? @method "exchange")
           arguments: (argument_list
-            . (string_literal) @path
+            . (_) @path
             (field_access
               object: (identifier) @httpMethodCls (#eq? @httpMethodCls "HttpMethod")
               field: (identifier) @http_method)))
@@ -226,10 +225,14 @@ const WEB_CLIENT_LONG_FORM_PATTERNS = compilePatterns({
         },
     ],
 });
-// ─── Consumer: OkHttp `new Request.Builder().url("path")` ─────────────
-// Note: `Request.Builder` is a `scoped_type_identifier` whose text includes
-// the dot, so `#eq?` against the literal string matches cleanly (no need
-// to escape a regex dot).
+// ─── Consumer: OkHttp `Request.Builder()…url("path")` ─────────────────
+// Match a bare `.url("literal")` call on ANY receiver, capturing it as `@call`.
+// `okHttpUrlRootsAtBuilder` (JS) then verifies the receiver chain bottoms out on
+// `new Request.Builder()` — re-imposing the framework anchor while allowing
+// builder calls BEFORE `.url()` (`new Request.Builder().addHeader(...).url("/x")`)
+// that the old object-direct query dropped, and rejecting a `.url(...)` on an
+// unrelated object. The verb is recovered by `inferOkHttpMethod` scanning the
+// whole chain (java-static-path.ts).
 const OK_HTTP_PATTERNS = compilePatterns({
     name: 'java-okhttp',
     language: Java,
@@ -238,14 +241,21 @@ const OK_HTTP_PATTERNS = compilePatterns({
             meta: {},
             query: `
         (method_invocation
-          object: (object_creation_expression
-            type: (scoped_type_identifier) @type (#eq? @type "Request.Builder"))
           name: (identifier) @method (#eq? @method "url")
-          arguments: (argument_list . (string_literal) @path))
+          arguments: (argument_list . (string_literal) @path)) @call
       `,
         },
     ],
 });
+// Match a bare `.uri(URI.create("literal"))` call on ANY receiver, capturing it
+// as `@call`. `httpClientUriRootsAtNewBuilder` (JS) verifies the chain includes
+// `HttpRequest.newBuilder()` — allowing calls BEFORE `.uri()` (`.version(v)`
+// `.uri(...)`) that the old object-direct query dropped, and rejecting a `.uri(...)`
+// on an unrelated object (e.g. WebClient). The verb (a `.GET()/.POST()/.PUT()/`
+// `.DELETE()/.HEAD()` helper, a `.method("VERB", body)` literal, or the bare-build
+// default) is recovered by `inferHttpClientMethod` scanning the whole chain.
+// Matching `.uri(...)` regardless of a trailing `.build()` mirrors the accepted
+// OkHttp over-match posture.
 const JAVA_HTTP_CLIENT_PATTERNS = compilePatterns({
     name: 'java-http-client',
     language: Java,
@@ -254,18 +264,35 @@ const JAVA_HTTP_CLIENT_PATTERNS = compilePatterns({
             meta: {},
             query: `
         (method_invocation
-          object: (method_invocation
-            object: (method_invocation
-              object: (identifier) @builderCls (#eq? @builderCls "HttpRequest")
-              name: (identifier) @newBuilder (#eq? @newBuilder "newBuilder")
-              arguments: (argument_list))
-            name: (identifier) @uri_method (#eq? @uri_method "uri")
-            arguments: (argument_list
-              (method_invocation
-                object: (identifier) @uriCls (#eq? @uriCls "URI")
-                name: (identifier) @create (#eq? @create "create")
-                arguments: (argument_list . (string_literal) @path))))
-          name: (identifier) @http_method (#match? @http_method "^(GET|POST|PUT|DELETE)$"))
+          name: (identifier) @uri_method (#eq? @uri_method "uri")
+          arguments: (argument_list
+            (method_invocation
+              object: (identifier) @uriCls (#eq? @uriCls "URI")
+              name: (identifier) @create (#eq? @create "create")
+              arguments: (argument_list . (string_literal) @path)))) @call
+      `,
+        },
+    ],
+});
+// Constructor-arg form: `HttpRequest.newBuilder(URI.create("..."))` — the path is
+// the `newBuilder(...)` argument, with no `.uri()` call. Captures the `newBuilder`
+// call as `@call`; the emission skips it when a later `.uri(...)` overrides the
+// constructor URI (`httpClientChainHasUriCall`), so the `.uri()` query owns that case.
+const JAVA_HTTP_CLIENT_CTOR_PATTERNS = compilePatterns({
+    name: 'java-http-client-ctor',
+    language: Java,
+    patterns: [
+        {
+            meta: {},
+            query: `
+        (method_invocation
+          object: (identifier) @builderCls (#eq? @builderCls "HttpRequest")
+          name: (identifier) @newBuilder (#eq? @newBuilder "newBuilder")
+          arguments: (argument_list
+            (method_invocation
+              object: (identifier) @uriCls (#eq? @uriCls "URI")
+              name: (identifier) @create (#eq? @create "create")
+              arguments: (argument_list . (string_literal) @path)))) @call
       `,
         },
     ],
@@ -307,6 +334,17 @@ function findEnclosingInterface(node) {
 function getNodeName(node) {
     return node.childForFieldName('name')?.text ?? null;
 }
+/**
+ * Trailing segment of a possibly fully-qualified annotation name
+ * (`org.springframework.web.bind.annotation.GetMapping` → `GetMapping`). The
+ * route query binds `@ann` to either an `identifier` (simple) or a
+ * `scoped_identifier` (FQN); normalizing here lets the one for-loop discriminate
+ * on the simple name in both cases. A simple name maps to itself, so this never
+ * changes how a non-FQN annotation is classified.
+ */
+function simpleName(text) {
+    return text.split('.').pop() ?? text;
+}
 function hasAnnotation(node, names) {
     const modifiers = node.namedChildren.find((child) => child.type === 'modifiers');
     if (!modifiers)
@@ -316,9 +354,8 @@ function hasAnnotation(node, names) {
     while (stack.length > 0) {
         const cur = stack.pop();
         const annotationName = cur.childForFieldName('name')?.text ?? '';
-        const simpleName = annotationName.split('.').pop() ?? annotationName;
         if ((cur.type === 'annotation' || cur.type === 'marker_annotation') &&
-            (allowed.has(annotationName) || allowed.has(simpleName))) {
+            (allowed.has(annotationName) || allowed.has(simpleName(annotationName)))) {
             return true;
         }
         stack.push(...cur.namedChildren);
@@ -359,7 +396,13 @@ function scanRouteAnnotations(tree) {
         const valueNode = captures.value;
         if (!annNode || !node || !valueNode)
             continue;
-        const ann = annNode.text;
+        // Discrimination is on the trailing segment only (`simpleName`), so a
+        // non-Spring annotation whose last segment collides with a route annotation
+        // (e.g. `@com.evil.GetMapping("/x")`) is treated as a route. This is the
+        // same accepted trailing-segment trade-off `hasAnnotation` already makes and
+        // the intended parity with the Kotlin plugin — package-origin gating would
+        // break that parity and is deliberately not done.
+        const ann = simpleName(annNode.text);
         const keyNode = captures.key; // undefined for the positional shape
         if (node.type === 'method_declaration') {
             // Method-level: a Spring `@(Get|...)Mapping` route, or native `@RequestLine`.
@@ -630,7 +673,7 @@ export const JAVA_HTTP_PLUGIN = {
             const httpMethod = REST_TEMPLATE_TO_HTTP[methodNode.text];
             if (!httpMethod)
                 continue;
-            const path = unquoteLiteral(pathNode.text);
+            const path = extractStaticPathExpression(pathNode);
             if (path === null)
                 continue;
             out.push({
@@ -647,7 +690,7 @@ export const JAVA_HTTP_PLUGIN = {
             const pathNode = match.captures.path;
             if (!httpMethodNode || !pathNode)
                 continue;
-            const path = unquoteLiteral(pathNode.text);
+            const path = extractStaticPathExpression(pathNode);
             if (path === null)
                 continue;
             out.push({
@@ -709,37 +752,84 @@ export const JAVA_HTTP_PLUGIN = {
             });
         }
         // ─── Consumers: OkHttp Request.Builder().url("path") ────────────
+        // Match any `.url("literal")`, gate to chains rooting at `new Request.Builder()`
+        // (so a call before `.url()` is captured but an unrelated `.url()` is not), then
+        // recover the verb (`.post()`/`.method("X")`) by scanning the builder chain.
         for (const match of runCompiledPatterns(OK_HTTP_PATTERNS, tree)) {
+            const callNode = match.captures.call;
             const pathNode = match.captures.path;
-            if (!pathNode)
+            if (!callNode || !pathNode)
+                continue;
+            if (!okHttpUrlRootsAtBuilder(callNode))
                 continue;
             const path = unquoteLiteral(pathNode.text);
             if (path === null)
                 continue;
+            const method = inferOkHttpMethod(callNode);
+            // An explicit `.method(verb, …)` with a non-literal or empty verb is
+            // unresolvable (null) — emit nothing rather than a wrong GET or an empty
+            // `http::::/path` contract.
+            if (!method)
+                continue;
             out.push({
                 role: 'consumer',
                 framework: 'okhttp',
-                method: 'GET',
+                method,
                 path,
                 name: null,
                 confidence: 0.7,
             });
         }
         // ─── Consumers: Java HttpClient request builder ─────────────────
-        // Java's builder exposes GET/POST/PUT/DELETE helpers. PATCH uses
-        // `.method("PATCH", body)`, which is intentionally deferred.
+        // Match any `.uri(URI.create("..."))`, gate to chains including `HttpRequest`
+        // `.newBuilder()` (so a call before `.uri()` is captured but an unrelated
+        // `.uri()` is not); `inferHttpClientMethod` scans the chain for the verb — a
+        // `.GET()/.POST()/.PUT()/.DELETE()/.HEAD()` helper, a `.method("VERB", body)`
+        // literal, or the bare-build default GET. A variable-bound `.method(verb, …)`
+        // is unresolvable → emit nothing. Mirrors the OkHttp loop above. The
+        // constructor-arg form (`newBuilder(URI.create(...))`, no `.uri()`) follows.
         for (const match of runCompiledPatterns(JAVA_HTTP_CLIENT_PATTERNS, tree)) {
-            const httpMethodNode = match.captures.http_method;
+            const callNode = match.captures.call;
             const pathNode = match.captures.path;
-            if (!httpMethodNode || !pathNode)
+            if (!callNode || !pathNode)
+                continue;
+            if (!httpClientUriRootsAtNewBuilder(callNode))
                 continue;
             const path = unquoteLiteral(pathNode.text);
             if (path === null)
                 continue;
+            const method = inferHttpClientMethod(callNode);
+            if (!method)
+                continue;
             out.push({
                 role: 'consumer',
                 framework: 'java-http-client',
-                method: httpMethodNode.text.toUpperCase(),
+                method,
+                path,
+                name: null,
+                confidence: 0.65,
+            });
+        }
+        // Constructor-arg form: `HttpRequest.newBuilder(URI.create("..."))` with the
+        // path in the constructor and no overriding `.uri(...)` later in the chain
+        // (a later `.uri()` wins at runtime, so the loop above owns that case).
+        for (const match of runCompiledPatterns(JAVA_HTTP_CLIENT_CTOR_PATTERNS, tree)) {
+            const callNode = match.captures.call;
+            const pathNode = match.captures.path;
+            if (!callNode || !pathNode)
+                continue;
+            if (httpClientChainHasUriCall(callNode))
+                continue;
+            const path = unquoteLiteral(pathNode.text);
+            if (path === null)
+                continue;
+            const method = inferHttpClientMethod(callNode);
+            if (!method)
+                continue;
+            out.push({
+                role: 'consumer',
+                framework: 'java-http-client',
+                method,
                 path,
                 name: null,
                 confidence: 0.65,