@ecoma-io/archkeep 0.15.0 → 0.16.1

package/src/analysis/jvm/packages.mjs

@@ -0,0 +1,209 @@
+/**
+ * The JVM package index — the content-derived `package → project` map every
+ * JVM resolution reads through.
+ *
+ * Java and Kotlin do not require directory = package. javac enforces nothing
+ * about where a `.java` file sits relative to its `package` line, and Kotlin's
+ * coding conventions state the layout is "recommended", unenforced. A resolver
+ * that derived importable names from directory layout would therefore answer
+ * confidently about a tree it had misread — the failure mode Python's reader
+ * avoids by reading its declared backend layout, and which has no manifest
+ * equivalent here to read instead. The declaration lives in the file, so the
+ * index reads the file.
+ *
+ * The index spans BOTH extensions from its first commit. A mixed Java/Kotlin
+ * module compiles jointly into one package namespace (one classpath, sources
+ * from `src/main/java` and `src/main/kotlin` together), so a `.java` import
+ * may reach a package only a `.kt` file declares and the other way round.
+ * Two per-extension indexes would disagree exactly there; one index over both
+ * is the model the compilers actually implement.
+ *
+ * One dotted name may be claimed by more than one project — a split package,
+ * or two projects that genuinely declare the same package. Like Python's PEP
+ * 420 namespace packages (`../python.mjs`'s `resolveModuleName`), ambiguity is
+ * not resolved by picking: the deepest matched prefix carries the owner set it
+ * was found with, and a caller turns a multi-owner answer into `resolved: null`
+ * plus a positioned failure naming the projects. Silence would be the worse
+ * direction: an unresolved first-party name classified external is a missed
+ * boundary crossing wearing an honest face.
+ *
+ * Reads are injected (`workspace.filesOf` / `workspace.readFile`) and memoized
+ * per workspace object through `perWorkspace`, so a whole-tree run builds the
+ * index once no matter how many files ask.
+ *
+ * An unreadable `.java`/`.kt` source is recorded as a whole-file failure
+ * rather than dropped: a file that silently left the index would make every
+ * import of a package only it declares classify external — a first-party
+ * crossing wearing an external face, with nothing anywhere naming why (the
+ * `../dotnet/namespaces.mjs` precedent one family over). The failure list is
+ * what the graph resolvers refuse the tree on (#364's posture,
+ * `../source-util.mjs`'s `refuseUnreadTree`) and what the CLI funnel merges
+ * beside the analyzers' own read failures.
+ */
+import { fileFailure, perWorkspace } from "../source-util.mjs";
+import { maskJavaComments, maskKotlinComments } from "./mask.mjs";
+
+/**
+ * The `package` declaration of an already-masked JVM source, with the offset
+ * of the name itself.
+ *
+ * Only the FIRST match counts. JLS §7.3 and the Kotlin grammar both confine
+ * the declaration to the compilation unit's header — before imports, before
+ * types — so any later `package` line in masked text is text the file holds
+ * but not a declaration, and honoring it could only move ownership to a lie.
+ * The worst case this parse allows is a spurious record naming text the file
+ * really contains, never a missed declaration.
+ *
+ * A UTF-8 BOM is tolerated the way `parseGoModulePath` tolerates one (#221):
+ * an anchored `^package` never matches through a leading `\uFEFF`, and a
+ * declaration lost to one byte drops the whole file out of the index — no
+ * owners for its package, every import reaching it classified external, a
+ * silent hole. The BOM is matched, not stripped, so every offset this parse
+ * returns is already an offset into the original text.
+ *
+ * Semicolon handling: Java requires the `;`; Kotlin ends the header at the
+ * newline instead. The declaration therefore terminates EITHER at a
+ * semicolon — anything may follow one on the same line (`package p; import
+ * q.R;` is legal Java) — OR at end of line. The keyword must be followed by
+ * same-line whitespace before the name, which is what keeps a Kotlin file
+ * with no package at all from reading its first `import` line as a package
+ * named "import".
+ *
+ * Kotlin backtick-quoted package segments (``package `odd name`.``) are a
+ * pinned limit: they do not match, the file contributes no index entry, and
+ * imports of its package resolve as external rather than to their project.
+ * Documented beside the other unread shapes when the language sections land;
+ * prevalence in real trees is negligible.
+ *
+ * @param {string} maskedText Comment-and-literal-blanked source (same length
+ *   as the original), so offsets index the original text.
+ * @returns {{ name: string, offset: number }|null} `null` for a default-
+ *   package file, which declares no name the index can carry.
+ */
+export function parseJvmPackageDeclaration(maskedText) {
+  // An identifier segment starts with a letter (Unicode, via \p{L}), `_`, or
+  // `$`, continues with those plus digits; segments join on optional spaces
+  // around the dot, because `com . example` is legal if absurd. The match is
+  // anchored to a line start (or behind an optional BOM at position 0) so a
+  // mid-line `package` token never reads as the declaration.
+  const JVM_PACKAGE_DECLARATION =
+    /(?:^\uFEFF?|\n)[ \t]*package[ \t]+([\p{L}_$][\p{L}\p{Nd}_$]*(?:[ \t]*\.[ \t]*[\p{L}_$][\p{L}\p{Nd}_$]*)*)[ \t]*(?:;|(?=[\r\n]|$))/u;
+  const match = JVM_PACKAGE_DECLARATION.exec(maskedText);
+  if (!match) return null;
+  // The mask preserved every byte's place, so the name's offset inside the
+  // match, plus where the match starts, is its offset in the original text.
+  return {
+    name: match[1].replace(/[ \t]*\.[ \t]*/g, "."),
+    offset: match.index + match[0].indexOf(match[1]),
+  };
+}
+
+const MASK_BY_EXTENSION = {
+  ".java": maskJavaComments,
+  ".kts": maskKotlinComments,
+  ".kt": maskKotlinComments,
+};
+
+/** The mask for a JVM source file's extension, or `undefined` elsewhere. */
+const maskFor = (file) => MASK_BY_EXTENSION[file.slice(file.lastIndexOf("."))];
+
+/**
+ * Build the index: every tracked JVM source's package, attributed by longest
+ * project root. Returns the map keyed by exact declared dotted name, each
+ * entry listing `{ project, file }` pairs in project order — beside one
+ * whole-file failure per JVM source that could not be read: a file dropped
+ * from the index silently would make every import of its package classify
+ * external, a first-party crossing wearing an external face, with nothing
+ * anywhere naming why (`../contract.md`'s I/O law). The same discipline the
+ * .NET twin holds for its namespace index (`../dotnet/namespaces.mjs`).
+ *
+ * @param {object} workspace `{ projects, filesOf(name), readFile(path) }`
+ * @returns {{ byName: Map<string, { project: string, file: string }[]>,
+ *            failures: { sourceFile: string, line: null, column: null, reason: string }[] }}
+ */
+function buildJvmPackageIndex(workspace) {
+  const byName = new Map();
+  const failures = [];
+  for (const project of workspace.projects) {
+    for (const file of workspace.filesOf(project.name)) {
+      const mask = maskFor(file);
+      if (!mask) continue;
+      const text = workspace.readFile(file);
+      if (text === null || text === undefined) {
+        failures.push(fileFailure(file, "JVM source could not be read for the package index"));
+        continue;
+      }
+      const declared = parseJvmPackageDeclaration(mask(text));
+      if (!declared) continue;
+      const owners = byName.get(declared.name) ?? [];
+      owners.push({ project: project.name, file });
+      byName.set(declared.name, owners);
+    }
+  }
+  return { byName, failures };
+}
+
+/**
+ * The workspace's package index, built once per workspace object. Every JVM
+ * consumer — the analyzers, the graph resolvers — reads resolution through
+ * this one map, so the layers can never disagree about who owns a name.
+ */
+export const jvmPackageIndex = perWorkspace(buildJvmPackageIndex);
+
+/**
+ * Whole-file failures for every JVM source the index could not read — the
+ * funnel `../../commands/context.mjs` merges beside the manifest failures, so
+ * an unreadable source refuses the verdict (exit 3) instead of quietly
+ * degrading every importer of its packages to external — and the graph
+ * resolvers' refusal input (#364's posture, `refuseUnreadTree`).
+ *
+ * @param {object} workspace
+ * @returns {{ sourceFile: string, line: null, column: null, reason: string }[]}
+ */
+export function jvmIndexFailures(workspace) {
+  return jvmPackageIndex(workspace).failures;
+}
+
+/**
+ * Longest-prefix resolution over the index — the single answer both layers
+ * read a specifier with, matching Go's `resolveGoModule` discipline: walk
+ * from the full name toward its head, stop at the first (deepest) prefix the
+ * index knows, and report the owner set found there. A shallower match under
+ * a deeper hit is invisible by construction; a nested-package project is a
+ * different project, and a first-shallow-match answer would name its parent.
+ *
+ * @param {string} specifier Dotted name as written after the `import`
+ *   keyword — the importable name, which for a single-type or member import
+ *   is everything before the imported member (stripped by the caller).
+ * @param {Map<string, { project: string, file: string }[]>} index As built
+ *   by `jvmPackageIndex`.
+ * @returns {{ owners: { project: string, file: string }[], prefix: string }}
+ *   | null `null` names no known prefix — the specifier is outside every
+ *   tracked project (external, or first-party code this run cannot see).
+ */
+export function resolveJvmPackagePrefix(specifier, index) {
+  const parts = specifier.split(".");
+  for (let depth = parts.length; depth >= 1; depth--) {
+    const prefix = parts.slice(0, depth).join(".");
+    const owners = index.get(prefix);
+    if (owners) return { owners, prefix };
+  }
+  return null;
+}
+
+/**
+ * The owning project of a resolved prefix, when exactly one project claims
+ * the matched name.
+ *
+ * @param {{ owners: { project: string }[], prefix: string }} resolution
+ * @returns {{ target: string, ambiguous?: undefined } |
+ *            { target: null, ambiguous: true, projects: string[] }} A single
+ *   target when the owners agree; otherwise every distinct claimant, for the
+ *   caller's failure record.
+ */
+export function projectOfResolution(resolution) {
+  const projects = [...new Set(resolution.owners.map((owner) => owner.project))];
+  return projects.length === 1
+    ? { target: projects[0] }
+    : { target: null, ambiguous: true, projects };
+}

package/src/analysis/jvm/resolve.mjs

@@ -0,0 +1,139 @@
+/**
+ * JVM specifier resolution — turning an imported dotted name into the record
+ * the analysis contract carries (`../contract.md`): a project target, or an
+ * external classification, or an ambiguity the caller reports rather than
+ * guesses past.
+ *
+ * The classification order is the language's, not a preference:
+ *
+ * 1. **Workspace packages first.** A name (or a prefix of it) some tracked
+ *    project declares resolves to that project through
+ *    `resolveJvmPackagePrefix`'s longest-prefix walk. First-party beats every
+ *    later answer: misreading first-party as external is the silent direction,
+ *    and no rule can see a crossing the resolver called a library.
+ * 2. **Default imports by table.** Each dialect auto-imports a fixed package
+ *    set (Java: `java.lang.*`; Kotlin adds its nine stdlib packages plus the
+ *    platform sets). An explicit import of one of these names is still legal
+ *    and still external — the tables make that classification explicit and
+ *    testable instead of incidental, and they change only across language
+ *    releases. Cited per table below; never extended by guesswork.
+ * 3. **Everything else is external**, with the whole written name standing in
+ *    as `packageName` — where a group ends and an artifact begins inside
+ *    `org.apache.commons.lang3` is not statically knowable (only the registry
+ *    knows), so the full name stands in exactly as Go's resolver lets the
+ *    whole module-prefixed path stand in. A `bannedExternalImports` glob
+ *    matches it the same way.
+ *
+ * What this module deliberately does NOT do: read files, hold caches, or know
+ * which extension wrote the specifier. The index comes in as an argument; the
+ * only language-aware input is the defaults table's name. That keeps the
+ * resolution rules identical for `.java`, `.kt`, and any future dotted-name
+ * frontend, which is the property a second frontend proves rather than
+ * promises.
+ */
+import { resolveJvmPackagePrefix } from "./packages.mjs";
+
+/**
+ * Java's single default-import package root (JLS §7.5.5: `java.lang` is
+ * automatically imported "as if by an import declaration" in every
+ * compilation unit). Sub-packages (`java.util`) are NOT included — they need
+ * their own explicit imports, which is why an explicit `import java.util.List`
+ * classifies as ordinary external rather than by this table.
+ */
+export const JAVA_DEFAULT_IMPORT_ROOTS = Object.freeze(["java.lang"]);
+
+/**
+ * Kotlin's default imports (kotlinlang.org, "Default imports", page dated
+ * 2026-07): nine stdlib roots always, `java.lang` and `kotlin.jvm` on the JVM
+ * target, `kotlin.js` on JS. The union is what an explicit import may legally
+ * restate; the table exists for the same reason Java's does — explicit,
+ * testable classification of names the compiler brings in unasked.
+ */
+export const KOTLIN_DEFAULT_IMPORT_ROOTS = Object.freeze([
+  "kotlin",
+  "kotlin.annotation",
+  "kotlin.collections",
+  "kotlin.comparisons",
+  "kotlin.io",
+  "kotlin.ranges",
+  "kotlin.sequences",
+  "kotlin.text",
+  "kotlin.math",
+  "java.lang",
+  "kotlin.jvm",
+  "kotlin.js",
+]);
+
+const DEFAULT_IMPORT_ROOTS_BY_LANGUAGE = {
+  java: JAVA_DEFAULT_IMPORT_ROOTS,
+  kotlin: KOTLIN_DEFAULT_IMPORT_ROOTS,
+};
+
+/** The default-import roots a language's files carry, or `[]` when unknown. */
+export const defaultImportRootsFor = (language) => DEFAULT_IMPORT_ROOTS_BY_LANGUAGE[language] ?? [];
+
+/**
+ * True when `specifier` falls under one of `roots`: equal to a root or a dot-
+ * delimited segment beneath it. Segment-delimited on purpose — `java.langx`
+ * must not match the `java.lang` root, and a plain prefix test would say it
+ * does.
+ *
+ * @param {string} specifier
+ * @param {string[]} roots
+ * @returns {boolean}
+ */
+export const underAnyRoot = (specifier, roots) =>
+  roots.some((root) => specifier === root || specifier.startsWith(`${root}.`));
+
+/**
+ * Classify one imported dotted name.
+ *
+ * @param {string} importableName Everything the resolution can see: for
+ *   `import a.b.C` the name `a.b.C`; for `import a.b.*` the package `a.b`;
+ *   for `import a.b.C as D` still `a.b.C` (the alias is local syntax).
+ * @param {{ language: string }} dialect Which defaults table applies.
+ * @param {Map<string, { project: string, file: string }[]>} index As built
+ *   by `./packages.mjs`'s `jvmPackageIndex`.
+ * @returns {JvmResolution} A project target; or an ambiguity the caller turns
+ *   into `resolved: null` + a positioned failure naming the projects; or an
+ *   external classification with `packageName` = the full written name.
+ */
+
+/**
+ * @typedef {object} JvmResolution
+ * @property {string|null} target The owning project, null when external or
+ *   ambiguous.
+ * @property {boolean} external True when no tracked project claims any
+ *   prefix of the name.
+ * @property {string|null} packageName The full written name for externals;
+ *   null otherwise.
+ * @property {string[]} [ambiguous] Every distinct claimant of the deepest
+ *   matched prefix, when several projects declare it.
+ * @property {string} [matchedPrefix] The deepest prefix the ambiguity was
+ *   found at.
+ * @property {boolean} [byDefaultImport] Externals only: true when the name
+ *   falls under the dialect's default-import roots rather than reaching a
+ *   registry anyone depends on explicitly.
+ */
+export function resolveJvmSpecifier(importableName, dialect, index) {
+  const matched = resolveJvmPackagePrefix(importableName, index);
+  if (matched) {
+    const projects = [...new Set(matched.owners.map((owner) => owner.project))];
+    if (projects.length === 1) {
+      return { target: projects[0], external: false, packageName: null };
+    }
+    return {
+      target: null,
+      external: false,
+      packageName: null,
+      ambiguous: projects,
+      matchedPrefix: matched.prefix,
+    };
+  }
+  return {
+    target: null,
+    external: true,
+    packageName: importableName,
+    byDefaultImport: underAnyRoot(importableName, defaultImportRootsFor(dialect.language)),
+  };
+}

package/src/analysis/kotlin.mjs

@@ -0,0 +1,210 @@
+/**
+ * Kotlin analyzer — header-region extraction over comment-and-literal-masked
+ * text, sharing the JVM core with `./java.mjs` and owning only what Kotlin's
+ * grammar makes different (`docs/adr/0005-jvm-language-integration.md`).
+ *
+ * The Kotlin grammar fixes an equivalent header:
+ * `shebang? NL* fileAnnotation* packageHeader importList`, so extraction stays
+ * line-anchored over masked text exactly as Java's is. What differs:
+ *
+ * - **Three import forms**: single (`import a.b.C`), on-demand
+ *   (`import a.b.*`), and aliased (`import a.b.C as D`) — the alias is local
+ *   syntax and resolves nothing differently.
+ * - **No statement terminator to rely on.** A newline ends the import (a
+ *   semicolon may, but Kotlin omits it), so the match ends at the line break;
+   a name must still start on the import's own line, which pins the multi-line
+ *   limit the same way Java's does.
+ * - **Backtick-quoted segments are identifiers** (``import a.`when`.B``) and
+ *   are read as such; the PACKAGE index does not carry backticked segments
+ *   (see `./jvm/packages.mjs`'s pinned limit), so an import THROUGH one
+ *   resolves by its plain prefix or classifies external.
+ * - **Shebang** lines (`.kts` scripts) and `@file:` annotations precede the
+ *   header; neither matches the anchored forms.
+ *
+ * Everything downstream is the shared answer: `kind` always `"static"`,
+ * `spelling.path` always false and `spelling.namesOnly` always true (a package
+ * name is a name, never a path — #376), `spelling.relative` true exactly when the
+ * import resolved into its own project, resolution through
+ * `./jvm/resolve.mjs` with Kotlin's default-import table, and graph edges via
+ * the same contract as every other language. There is no dynamic import, no
+ * type-only form, and no re-export syntax to model.
+ */
+import { maskKotlinComments } from "./jvm/mask.mjs";
+import { jvmPackageIndex } from "./jvm/packages.mjs";
+import { resolveJvmSpecifier } from "./jvm/resolve.mjs";
+import {
+  emptyResult,
+  fileFailure,
+  positionAt,
+  projectOwning,
+  refuseUnreadTree,
+} from "./source-util.mjs";
+
+/** One identifier segment: backtick-quoted (any non-backtick content) or a plain identifier. */
+const KOTLIN_SEGMENT = String.raw`(?:` + "`[^`\\n]*`" + String.raw`|[\p{L}_$][\p{L}\p{Nd}_$]*)`;
+
+// Anchored to a line head — through a leading UTF-8 BOM, matched rather than
+// stripped so offsets keep indexing the bytes on disk (#221's lesson, the same
+// anchor `./jvm/packages.mjs`'s package declaration and `./csharp.mjs` hold) —
+// or behind a semicolon; the name must start on the import's own line; the
+// optional alias is captured only to keep it out of the specifier. The
+// terminator is a lookahead over `\r` as well as `\n` (#406): on a CRLF file
+// the lookahead must succeed at the line break, or every import in the file
+// is dropped, byte-for-byte like a file with none.
+const KOTLIN_IMPORT = new RegExp(
+  String.raw`(?:^\uFEFF?|[\n;])[ \t]*(?:import[ \t]+)(` +
+    KOTLIN_SEGMENT +
+    String.raw`(?:\.` +
+    KOTLIN_SEGMENT +
+    String.raw`)*(?:\.\*)?)` +
+    String.raw`(?:[ \t]+as[ \t]+[\p{L}_$][\p{L}\p{Nd}_$]*)?[ \t]*(?=[\r\n;}]|$)`,
+  "gu",
+);
+
+/**
+ * Every import in a `.kt`/`.kts` file, in source order and WITHOUT
+ * deduplication. Offsets index the ORIGINAL text; the mask preserved length.
+ *
+ * @param {string} kotlinText Raw file contents.
+ * @returns {{ specifier: string, importableName: string, offset: number }[]}
+ */
+export function parseKotlinImportSites(kotlinText) {
+  // A shebang needs no handling of its own: `#!…` cannot anchor an import
+  // match (`import` must follow a line head, `;`, or newline), and masking
+  // runs before anything reads the text anyway.
+  const source = maskKotlinComments(kotlinText);
+  const sites = [];
+  for (const match of source.matchAll(KOTLIN_IMPORT)) {
+    const name = match[1];
+    sites.push({
+      specifier: name,
+      importableName: importableNameOf(name),
+      offset: match.index + match[0].indexOf(name),
+    });
+  }
+  return sites.sort((a, b) => a.offset - b.offset);
+}
+
+/**
+ * The dotted name resolution walks: the on-demand form drops its trailing
+ * `.*`; everything else resolves whole, longest declared prefix winning.
+ * Aliases never reach this function — they are stripped by the match itself.
+ *
+ * @param {string} name The dotted name as written.
+ * @returns {string}
+ */
+const importableNameOf = (name) => (name.endsWith(".*") ? name.slice(0, -2) : name);
+
+/**
+ * Analyzes one `.kt`/`.kts` file. Ambiguity resolves to null WITH a
+ * positioned failure naming every claimant, exactly as Java's does — the
+ * split-package rule cannot know which compiler unit order would win, and
+ * neither will this reader pretend to.
+ *
+ * The package index arrives through `jvmPackageIndex` — already memoized per
+ * workspace object — so one whole-tree run builds it once however many files
+ * ask, and the graph resolver below reads the same map through the same memo.
+ *
+ * @param {{ sourceFile: string, text: string, workspace: object }} request
+ * @returns {{ imports: object[], failures: object[] }}
+ */
+export function analyzeKotlin({ sourceFile, text, workspace }) {
+  const result = emptyResult();
+  try {
+    const { byName: index } = jvmPackageIndex(workspace);
+    const owner = projectOwning(workspace.projects, sourceFile);
+    for (const site of parseKotlinImportSites(text)) {
+      const { line, column } = positionAt(text, site.offset);
+      const resolved = resolveJvmSpecifier(site.importableName, { language: "kotlin" }, index);
+      let resolution;
+      if (resolved.external) {
+        resolution = {
+          target: null,
+          file: null,
+          external: true,
+          packageName: site.importableName,
+        };
+      } else if (resolved.ambiguous) {
+        resolution = null;
+        result.failures.push({
+          sourceFile,
+          line,
+          column,
+          reason:
+            `'${resolved.matchedPrefix}' is declared by more than one project ` +
+            `(${resolved.ambiguous.join(", ")}) — the compilers pick by classpath order, ` +
+            `which this static reader does not model`,
+        });
+      } else {
+        resolution = { target: resolved.target, file: null, external: false, packageName: null };
+      }
+      const target = resolution?.target ?? null;
+      result.imports.push({
+        sourceFile,
+        line,
+        column,
+        specifier: site.specifier,
+        kind: "static",
+        spelling: {
+          path: false,
+          relative: target !== null && owner !== null && target === owner.name,
+          namesOnly: true,
+        },
+        resolved: resolution,
+      });
+    }
+  } catch (cause) {
+    result.failures.push(
+      fileFailure(sourceFile, `Kotlin analysis failed: ${cause?.message ?? cause}`),
+    );
+  }
+  return result;
+}
+
+/**
+ * Static edges between JVM projects derived from written Kotlin imports —
+ * the same source-truth track `resolveJavaDependencies` runs, one namespace
+ * over. Takes ONE workspace-shaped object for the same reason it does: the
+ * package index is memoized on that object, so the caller's one object —
+ * shared with `analyzeKotlin`, the Java resolver and the manifest resolvers —
+ * is what makes the index build once per run (#363).
+ *
+ * An unreadable `.java`/`.kt` source refuses the whole graph (#364's posture
+ * — the index state corrupts every importer of its packages, so the failure
+ * cannot be attributed to the file's own edges), through the same
+ * `refuseUnreadTree` the manifest resolvers hold; this resolver and the Java
+ * one hold the identical check over the one shared index.
+ *
+ * @param {object} workspace `{ projects, filesOf(name), readFile(path) }`
+ * @returns {{ source: string, target: string, sourceFile: string, type: string }[]}
+ * @throws {Error} when `jvmPackageIndex` recorded any failure, naming each
+ *   unreadable JVM source.
+ */
+export function resolveKotlinDependencies(workspace) {
+  const { projects, filesOf, readFile } = workspace;
+  // The same refusal `./java.mjs`'s `resolveJavaDependencies` holds over the
+  // one shared index (#364's posture): an unreadable source corrupts every
+  // importer of its packages, so either resolver alone refuses the tree.
+  const { byName: index, failures: indexFailures } = jvmPackageIndex(workspace);
+  refuseUnreadTree("the JVM package index", indexFailures);
+  const dependencies = [];
+  for (const project of projects) {
+    for (const file of filesOf(project.name)) {
+      if (!file.endsWith(".kt") && !file.endsWith(".kts")) continue;
+      const text = readFile(file);
+      if (text === null) continue;
+      for (const site of parseKotlinImportSites(text)) {
+        const resolved = resolveJvmSpecifier(site.importableName, { language: "kotlin" }, index);
+        if (resolved.external || resolved.ambiguous) continue;
+        if (resolved.target === project.name) continue;
+        dependencies.push({
+          source: project.name,
+          target: resolved.target,
+          sourceFile: file,
+          type: "static",
+        });
+      }
+    }
+  }
+  return dependencies;
+}

package/src/analysis/manifest-util.mjs

@@ -66,3 +66,33 @@ export function resolveWithinWorkspace(baseDir, relative) {
   }
   return segments.join("/");
 }
+
+/** A pattern carrying any of these is a glob; anything else is a literal. */
+const GLOB_METACHARACTERS = /[*?[{\\]/;
+
+/**
+ * Does a file's basename match any of a manifest-name pattern list — the
+ * literal patterns by equality, only the glob patterns through `matchesGlob`.
+ *
+ * Why the split: the lists this serves (the polyglot manifest names, a
+ * workspace's `projects.infer.manifests`) are mostly literals — `go.mod`,
+ * `Cargo.toml`, `pom.xml` — with a wildcard like `*.csproj` riding beside
+ * them, and the filters run once per tracked file. Measured, handing every
+ * pattern to `path.posix.matchesGlob` costs seconds past ~100k files where
+ * the equality scan it replaced was nanoseconds, because each call compiles
+ * its pattern again. The matcher is injected so `../../providers/native/
+ * model.mjs`'s validated one and raw `path.posix.matchesGlob` ride the same
+ * fast path without this module reaching for either; semantics are
+ * unchanged, because a metacharacter-free pattern answers identically
+ * either way and every other pattern still reaches the glob.
+ *
+ * @param {string} base The basename under test.
+ * @param {readonly string[]} patterns
+ * @param {(value: string, pattern: string) => boolean} matchesGlob
+ * @returns {boolean}
+ */
+export function basenameMatches(base, patterns, matchesGlob) {
+  return patterns.some((pattern) =>
+    GLOB_METACHARACTERS.test(pattern) ? matchesGlob(base, pattern) : pattern === base,
+  );
+}

package/src/analysis/python.mjs

@@ -498,7 +498,8 @@ export function resolvePythonDependencies(projects, filesOf, readFile) {
  *
  * They are not filesystem paths, which is the other half: a dotted module name
  * is resolved on `sys.path`, never by path arithmetic against the source file,
- * so `spelling.path` is always false for Python. That distinction is what stops
+ * so `spelling.path` is always false for Python and `spelling.namesOnly` always
+ * true. That distinction is what stops
  * an unresolvable `from . import x` from being reported as
  * `noRelativeOrAbsoluteExternals` — a message about a path, aimed at a name.
  *
@@ -1177,7 +1178,7 @@ export function analyzePython({ sourceFile, text, workspace }) {
         column,
         specifier: site.specifier,
         kind: site.kind,
-        spelling: { path: false, relative: isRelativeImport(site.specifier) },
+        spelling: { path: false, relative: isRelativeImport(site.specifier), namesOnly: true },
         resolved: null,
       };
       result.imports.push(record);

package/src/analysis/registry.mjs

@@ -52,6 +52,17 @@ export const LANGUAGE_BY_EXTENSION = Object.freeze({
   ".go": "go",
   ".rs": "rust",
   ".py": "python",
+  // The JVM pair registers together with its analyzer: the shared core under
+  // `src/analysis/jvm/` reads both extensions through ONE package index, and
+  // ADR 0005 (`docs/adr/`) owns why they are two languages rather than one.
+  ".java": "java",
+  ".kt": "kotlin",
+  ".kts": "kotlin",
+  // C# joins the dotted-name family through the dotnet core (`src/analysis/
+  // dotnet/`, ADR 0006): one namespace index over `.cs` sources, one lexical
+  // mask, one manifest reader for the csproj family — with F# and VB.NET as
+  // later frontends of the same core rather than new stacks.
+  ".cs": "csharp",
 });
 
 /**