@quolu/lattice 0.70.0 → 0.71.1

package/sensor/dist/resolution/import-resolver.js

@@ -50,10 +50,13 @@ exports.extractImportMappings = extractImportMappings;
 exports.clearImportMappingCache = clearImportMappingCache;
 exports.extractReExports = extractReExports;
 exports.resolveJvmImport = resolveJvmImport;
+exports.resolvePhpImportedStaticCall = resolvePhpImportedStaticCall;
 exports.resolveViaImport = resolveViaImport;
+exports.isBoundToOutOfRepoImport = isBoundToOutOfRepoImport;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const path_aliases_1 = require("./path-aliases");
+const alias_binding_1 = require("./alias-binding");
 const workspace_packages_1 = require("./workspace-packages");
 const name_matcher_1 = require("./name-matcher");
 /**
@@ -73,7 +76,7 @@ exports.EXTENSION_RESOLUTION = {
     // module-entry convention, hit when a bare workspace import ("data") is
     // rewritten to the member's directory; lowercase variants for safety.
     arkts: ['.ets', '.ts', '.d.ts', '.js', '/Index.ets', '/index.ets', '/index.ts', '/index.js'],
-    javascript: ['.js', '.jsx', '.mjs', '.cjs', '/index.js', '/index.jsx'],
+    javascript: ['.js', '.jsx', '.mjs', '.cjs', '.xsjs', '.xsjslib', '/index.js', '/index.jsx'],
     tsx: ['.tsx', '.ts', '.d.ts', '.js', '.jsx', '/index.tsx', '/index.ts', '/index.js'],
     jsx: ['.jsx', '.js', '/index.jsx', '/index.js'],
     // SFC consumers import plain TS/JS, sibling components, and barrels
@@ -110,6 +113,18 @@ function isNixPathImportRef(ref) {
 // there, so the staleness discipline matches the resolver's own caches.
 const importPathMemos = new WeakMap();
 const exportedSymbolMemos = new WeakMap();
+const DEFAULT_BINDING_KINDS = new Set(['function', 'class', 'component', 'constant', 'variable']);
+const DEFAULT_EXPORT_BINDING_RE = /^[ \t]*export\s+default\s+([A-Za-z_$][\w$]*)\s*;?[ \t]*$/m;
+const JS_FAMILY_FILE = /\.(?:[cm]?[jt]sx?)$/;
+/** The identifier `export default NAME` names in a JS-family file, or null. */
+function defaultExportBinding(filePath, context) {
+    if (!JS_FAMILY_FILE.test(filePath))
+        return null;
+    const source = context.readFile(filePath);
+    if (!source || !source.includes('export default'))
+        return null;
+    return source.match(DEFAULT_EXPORT_BINDING_RE)?.[1] ?? null;
+}
 const fileExportIndexes = new WeakMap();
 function getFileExportIndex(filePath, context) {
     let perFile = fileExportIndexes.get(context);
@@ -120,9 +135,8 @@ function getFileExportIndex(filePath, context) {
     let idx = perFile.get(filePath);
     if (!idx) {
         idx = { byName: new Map(), defaultComponent: undefined, defaultFnClass: undefined };
-        for (const n of context.getNodesInFile(filePath)) {
-            if (!n.isExported)
-                continue;
+        const exported = context.getExportedNodesInFile?.(filePath) ?? context.getNodesInFile(filePath).filter((n) => n.isExported);
+        for (const n of exported) {
             if (!idx.byName.has(n.name))
                 idx.byName.set(n.name, n);
             if (idx.defaultComponent === undefined && n.kind === 'component')
@@ -134,6 +148,47 @@ function getFileExportIndex(filePath, context) {
     }
     return idx;
 }
+/** The file's nodes named `name`, in `getNodesInFile` order. */
+function nodesInFileNamed(filePath, name, context) {
+    return context.getNodesInFileNamed?.(filePath, name) ?? context.getNodesInFile(filePath).filter((n) => n.name === name);
+}
+/** The declaration `export default NAME` names in this file (see FileExportIndex.defaultBinding). */
+function defaultExportBindingNode(filePath, idx, context) {
+    if (idx.defaultBinding === undefined) {
+        const bound = defaultExportBinding(filePath, context);
+        idx.defaultBinding =
+            bound === null
+                ? null
+                : (nodesInFileNamed(filePath, bound, context)
+                    .filter((n) => DEFAULT_BINDING_KINDS.has(n.kind))
+                    .sort((a, b) => a.startLine - b.startLine || a.startColumn - b.startColumn)[0] ?? null);
+    }
+    return idx.defaultBinding ?? undefined;
+}
+/** What this file exports as `name`: an exported declaration, else a local export clause's binding. */
+function exportedByName(filePath, idx, name, context) {
+    const direct = idx.byName.get(name);
+    if (direct)
+        return direct;
+    if (idx.clauseAliases === undefined) {
+        // Bind names introduced by a local export clause to their declarations, so
+        // an importer asking for the renamed name gets the real symbol instead of
+        // falling through to the name-matcher (which cannot cross the rename).
+        // The declaration is the file's first node of that name, exported or not.
+        idx.clauseAliases = new Map();
+        const content = context.readFile(filePath);
+        if (content && content.includes('export')) {
+            for (const { exportedName, localName } of (0, alias_binding_1.extractLocalExportAliases)(content)) {
+                if (idx.byName.has(exportedName) || idx.clauseAliases.has(exportedName))
+                    continue;
+                const decl = nodesInFileNamed(filePath, localName, context)[0];
+                if (decl)
+                    idx.clauseAliases.set(exportedName, decl);
+            }
+        }
+    }
+    return idx.clauseAliases.get(name);
+}
 /** Drop the per-context memo tables (see ReferenceResolver.clearCaches). */
 function clearImportResolverMemos(context) {
     importPathMemos.delete(context);
@@ -141,6 +196,7 @@ function clearImportResolverMemos(context) {
     fileExportIndexes.delete(context);
     luaFileBasenameIndexes.delete(context);
     cobolCopybookIndexes.delete(context);
+    pythonModuleFileMemos.delete(context);
 }
 function resolveImportPath(importPath, fromFile, language, context) {
     let memo = importPathMemos.get(context);
@@ -300,6 +356,19 @@ const C_CPP_STDLIB_HEADERS = new Set([
     'unordered_set', 'utility', 'valarray', 'variant', 'vector',
     'version',
 ]);
+/**
+ * Languages whose imports are ES-module specifiers, extracted by
+ * `extractJSImports` and therefore classified by the same bare-specifier /
+ * alias / workspace rules. Svelte, Vue and Astro belong here: an SFC imports
+ * inside its `<script>` block (Astro: the `---` frontmatter) with exactly the
+ * same syntax, and leaving them out made `isExternalImport` answer "not
+ * external" for every npm specifier in an SFC.
+ */
+const ESM_IMPORT_LANGUAGES = new Set([
+    'typescript', 'tsx', 'javascript', 'jsx', 'arkts', 'svelte', 'vue', 'astro',
+]);
+/** Rust path roots that always name a standard-library crate. */
+const RUST_STDLIB_ROOTS = new Set(['std', 'core', 'alloc', 'proc_macro']);
 /**
  * Check if an import is external (npm package, etc.)
  *
@@ -322,7 +391,7 @@ function isExternalImport(importPath, language, context) {
         return false;
     }
     // Common external patterns
-    if (language === 'typescript' || language === 'javascript' || language === 'tsx' || language === 'jsx' || language === 'arkts') {
+    if (ESM_IMPORT_LANGUAGES.has(language)) {
         // Node built-ins
         if (['fs', 'path', 'os', 'crypto', 'http', 'https', 'url', 'util', 'events', 'stream', 'child_process', 'buffer'].includes(importPath)) {
             return true;
@@ -420,8 +489,44 @@ function resolveRelativeImport(importPath, fromDir, language, context) {
     if (context.fileExists(relativePath)) {
         return relativePath;
     }
+    return findSourceForEmittedSpecifier(relativePath, language, context);
+}
+/**
+ * TypeScript under `moduleResolution: node16 | nodenext | bundler` writes the
+ * EMITTED extension in the specifier (`import x from './util.js'` for
+ * `util.ts`, `.mjs` for `.mts`, `.cjs` for `.cts`), and the source file with that
+ * exact name never exists in the repo. Without this remap the import resolver
+ * returned null for every such import, so each imported name fell through to
+ * bare-name matching: a method wrapping the same-named helper it imports
+ * (`renderDockStyles() { return renderDockStyles() }`) resolved to ITSELF, and
+ * any repo-wide same-named symbol could win the cross-module edge.
+ */
+const EMITTED_TO_SOURCE_EXTENSIONS = [
+    [/\.js$/, ['.ts', '.tsx', '.d.ts']],
+    [/\.jsx$/, ['.tsx']],
+    [/\.mjs$/, ['.mts', '.d.mts']],
+    [/\.cjs$/, ['.cts', '.d.cts']],
+];
+function findSourceForEmittedSpecifier(relativePath, language, context) {
+    if (!EMITTED_SPECIFIER_LANGUAGES.has(language))
+        return null;
+    for (const [emitted, sources] of EMITTED_TO_SOURCE_EXTENSIONS) {
+        if (!emitted.test(relativePath))
+            continue;
+        const stem = relativePath.replace(emitted, '');
+        for (const ext of sources) {
+            const candidate = stem + ext;
+            if (context.fileExists(candidate))
+                return candidate;
+        }
+        return null;
+    }
     return null;
 }
+/** Languages whose import specifiers can name the emitted `.js` of a `.ts` source. */
+const EMITTED_SPECIFIER_LANGUAGES = new Set([
+    'typescript', 'tsx', 'javascript', 'jsx', 'vue', 'svelte', 'astro', 'arkts',
+]);
 /**
  * Resolve an aliased/absolute import.
  *
@@ -443,7 +548,7 @@ function resolveAliasedImport(importPath, projectRoot, language, context) {
         }
         if (context.fileExists(basePath))
             return basePath;
-        return null;
+        return findSourceForEmittedSpecifier(basePath, language, context);
     };
     // 1. Project tsconfig/jsconfig paths.
     const aliasMap = context.getProjectAliases?.();
@@ -1256,6 +1361,47 @@ function pickClosestJvmCandidate(candidates, fromPath) {
     }
     return best;
 }
+/**
+ * PHP scoped calls are encoded as "Alias.method" by both extractors. A use
+ * mapping names a namespace, not a filesystem path, so resolve the receiver
+ * through its localName and look up the method on that exact imported type.
+ * undefined means this is not an imported static call; null means the import
+ * owns the call but its method is unavailable, so name fallbacks must not guess.
+ */
+function resolvePhpImportedStaticCall(ref, context) {
+    if (ref.language !== 'php' || ref.referenceKind !== 'calls')
+        return undefined;
+    const call = /^(\w+)\.(\w+)$/.exec(ref.referenceName);
+    if (!call)
+        return undefined;
+    const [, receiver, member] = call;
+    const imp = context.getImportMappings(ref.filePath, ref.language)
+        .find((i) => i.localName === receiver);
+    if (!imp)
+        return undefined;
+    // PHP variables occupy a different namespace from class imports. Extraction
+    // strips the leading "$" from "$Alias->method()" too; leave that receiver to
+    // local type inference even when a class import has the same local name.
+    const lines = context.getFileLines?.(ref.filePath) ?? context.readFile(ref.filePath)?.split('\n');
+    const line = lines?.[ref.line - 1];
+    if (line?.slice(ref.column).startsWith('$'))
+        return undefined;
+    const fqn = imp.source.replace(/^\\/, '');
+    const separator = fqn.lastIndexOf('\\');
+    const typeName = separator < 0
+        ? fqn
+        : `${fqn.slice(0, separator)}::${fqn.slice(separator + 1)}`;
+    const owners = context.getNodesByQualifiedName(typeName)
+        .filter((n) => n.language === 'php' && STATIC_MEMBER_CONTAINERS.has(n.kind));
+    if (owners.length !== 1)
+        return null;
+    const owner = owners[0];
+    const methods = context.getNodesByQualifiedName(`${owner.qualifiedName}::${member}`)
+        .filter((n) => n.language === 'php' && n.kind === 'method' && n.filePath === owner.filePath);
+    if (methods.length !== 1)
+        return null;
+    return { original: ref, targetNodeId: methods[0].id, confidence: 0.95, resolvedBy: 'import' };
+}
 function resolveViaImport(ref, context) {
     // C/C++ #include references — resolve directly to the included file
     // (file→file edge), bypassing symbol lookup. The extractor emits these
@@ -1450,13 +1596,21 @@ function resolveViaImport(ref, context) {
     for (const imp of imports) {
         if (imp.localName === ref.referenceName || ref.referenceName.startsWith(imp.localName + '.')) {
             // Resolve the import path
-            const resolvedPath = resolveImportPath(imp.source, ref.filePath, ref.language, context);
+            let resolvedPath = resolveImportPath(imp.source, ref.filePath, ref.language, context);
+            // Named Python imports need the same absolute-module lookup as namespace
+            // imports, including aliases used as receiver types (#1820).
+            if (!resolvedPath && ref.language === 'python') {
+                resolvedPath = findPythonModuleFile(imp.source, context, ref.filePath)?.filePath ?? null;
+            }
             if (resolvedPath) {
                 const exportedName = imp.isDefault ? 'default' : imp.exportedName;
                 const memberName = imp.isNamespace
                     ? ref.referenceName.replace(imp.localName + '.', '')
                     : null;
-                const targetNode = findExportedSymbol(resolvedPath, { isDefault: imp.isDefault, isNamespace: imp.isNamespace, exportedName, memberName }, ref.language, context, new Set());
+                const targetNode = findExportedSymbol(resolvedPath, { isDefault: imp.isDefault, isNamespace: imp.isNamespace, exportedName, memberName }, ref.language, context, new Set()) ?? (ref.language === 'python'
+                    ? context.getNodesInFile(resolvedPath).find(n => n.name === (memberName ?? exportedName) && !n.qualifiedName.includes('::') &&
+                        (n.kind === 'class' || n.kind === 'function' || n.kind === 'variable' || n.kind === 'constant'))
+                    : undefined);
                 if (targetNode) {
                     // `Foo.bar()` / `Foo.CONST` — a NAMED (non-namespace) class import
                     // accessed through a member. `findExportedSymbol` resolved `Foo` to
@@ -1475,6 +1629,24 @@ function resolveViaImport(ref, context) {
                                 resolvedBy: 'import',
                             };
                         }
+                        // An imported object literal used as a namespace (#1573):
+                        // `api.call()` after `import { api } from './api'` where `api` is
+                        // `export const api = { call() {…} }`. Its members have bare
+                        // qualified names inside the constant's extent, so the
+                        // `Container::member` lookup above can't see them and the edge
+                        // landed on the constant — every cross-file caller of the method
+                        // went missing. Resolve the member by containment instead.
+                        if (targetNode.kind === 'constant' || targetNode.kind === 'variable') {
+                            const member = ref.referenceName.slice(imp.localName.length + 1).split('.')[0];
+                            if (member) {
+                                const literalMember = (0, name_matcher_1.resolveObjectLiteralMember)(targetNode, member, ref, context, 0.9, 'import');
+                                if (literalMember)
+                                    return literalMember;
+                                const aliasMember = resolveObjectLiteralAlias(targetNode, member, ref, context);
+                                if (aliasMember)
+                                    return aliasMember;
+                            }
+                        }
                         // An imported VALUE (singleton constant / shared instance) called
                         // through a member: `reproStore.notifyJoinGuildStatus()` after
                         // `import { reproStore } from './store'`. findExportedSymbol
@@ -1488,6 +1660,13 @@ function resolveViaImport(ref, context) {
                         const instanceMember = resolveImportedInstanceMember(targetNode, ref, imp.localName, context);
                         if (instanceMember)
                             return instanceMember;
+                        // Finding a named Python import proves the receiver exists, not
+                        // its requested attribute. In particular, task.delay() enqueues
+                        // work; it does not call the imported task function directly.
+                        // Keep unknown members unresolved (including callback values)
+                        // instead of falling back to the receiver as their target.
+                        if (ref.language === 'python')
+                            return null;
                     }
                     return {
                         original: ref,
@@ -1603,11 +1782,19 @@ function resolvePythonModuleMember(ref, imports, context) {
         // `import mod` / `import numpy as np` bind the module at `source` itself;
         // `from . import certs` / `from pkg import mod` bind a SUBMODULE whose
         // dotted path is the source joined with the imported name.
+        //
+        // Join with the EXPORTED name, not the local one: under
+        // `from pkg import mod as alias` the receiver is `alias` but the module on
+        // disk is `pkg.mod`, and building `pkg.alias` looked for a file that does
+        // not exist — so the aliased form dropped its `calls` edge while the plain
+        // form (where the two names coincide) worked (#1626). For an unaliased
+        // import the two are identical, so this changes nothing there.
+        const moduleName = imp.exportedName === '*' ? imp.localName : imp.exportedName;
         const modulePath = imp.isNamespace
             ? imp.source
             : imp.source.endsWith('.')
-                ? imp.source + imp.localName
-                : imp.source + '.' + imp.localName;
+                ? imp.source + moduleName
+                : imp.source + '.' + moduleName;
         // resolveImportPath only maps RELATIVE dotted paths (`.mod`, `..pkg.mod`); an
         // ABSOLUTE package path (`pkg.module` from `from pkg import module`, or a bare
         // `import pkg.mod`) resolves to null there, so fall back to the dotted-module
@@ -1696,6 +1883,30 @@ function resolveLuaRequire(ref, context) {
     }
     return null;
 }
+/**
+ * `UploadApi.uploadARCapture()` where `UploadApi` is a NAMESPACE OBJECT — the
+ * default-export façade most React Native API layers are written as:
+ *
+ *   import { uploadARCapture } from './frames'
+ *   const UploadApi = { uploadARCapture, createFolder }
+ *   export default UploadApi
+ *
+ * The member is a shorthand (or `key: ident`) property whose value is a
+ * binding of the object's file, not a function defined inside the literal,
+ * so containment (`resolveObjectLiteralMember`) finds nothing and the call
+ * landed on the constant — every cross-file caller of the API function went
+ * missing. Read the literal's source, take the binding the member names, and
+ * resolve it where the object's file would: a symbol declared there, else
+ * through its own imports. Calls accept callable targets only.
+ */
+function resolveObjectLiteralAlias(container, member, ref, context) {
+    if (container.kind !== 'constant' && container.kind !== 'variable')
+        return null;
+    if (!JS_FAMILY_FILE.test(container.filePath))
+        return null;
+    const resolved = (0, name_matcher_1.resolveObjectLiteralBinding)(container, member, ref, context);
+    return resolved ? { ...resolved, confidence: 0.9, resolvedBy: 'import' } : null;
+}
 function resolveModuleImportToFile(ref, imports, context) {
     if (ref.referenceKind !== 'imports')
         return null;
@@ -1717,9 +1928,12 @@ function resolveModuleImportToFile(ref, imports, context) {
         }
         else if (ref.language === 'python') {
             // `from . import certs` — the imported NAME is a submodule of the source.
+            // As in resolvePythonModuleMember, use the exported name so an alias
+            // still links to the real module file (#1626).
+            const moduleName = imp.exportedName === '*' ? imp.localName : imp.exportedName;
             modulePath = imp.source.endsWith('.')
-                ? imp.source + imp.localName
-                : imp.source + '.' + imp.localName;
+                ? imp.source + moduleName
+                : imp.source + '.' + moduleName;
         }
         else {
             // A named TS/JS import binds a symbol, not a module — leave it alone.
@@ -1753,21 +1967,42 @@ function resolveModuleImportToFile(ref, imports, context) {
  * no edge. Shared by absolute `import a.b.c` and absolute `from a.b import c`
  * (where `c` is a submodule) resolution.
  */
+/**
+ * Per-context memo for findPythonModuleFile: module path → the `<mod>.py` and
+ * `<mod>/__init__.py` file nodes whose path ends with it, in name-lookup
+ * order. Only the importing file's own path is excluded per call, so taking
+ * the first survivor returns the node the unmemoized scan found. Without it,
+ * every ref naming a module outside the project (`from unittest import mock`)
+ * rescanned every `__init__.py` in the tree. Same stable window as the name
+ * caches; dropped by clearImportResolverMemos.
+ */
+const pythonModuleFileMemos = new WeakMap();
 function findPythonModuleFile(mod, context, excludeFilePath) {
     if (!mod || mod.startsWith('.'))
         return null; // relative imports handled elsewhere
-    const rel = mod.replace(/\./g, '/');
-    const lastSeg = mod.split('.').pop();
-    const endsWith = (p, want) => p === want || p.endsWith('/' + want);
-    const moduleFile = context
-        .getNodesByName(`${lastSeg}.py`)
-        .find((n) => n.kind === 'file' && n.filePath !== excludeFilePath && endsWith(n.filePath, `${rel}.py`));
-    if (moduleFile)
-        return moduleFile;
-    const pkgFile = context
-        .getNodesByName('__init__.py')
-        .find((n) => n.kind === 'file' && n.filePath !== excludeFilePath && endsWith(n.filePath, `${rel}/__init__.py`));
-    return pkgFile ?? null;
+    let memo = pythonModuleFileMemos.get(context);
+    if (!memo) {
+        memo = new Map();
+        pythonModuleFileMemos.set(context, memo);
+    }
+    let files = memo.get(mod);
+    if (!files) {
+        const rel = mod.replace(/\./g, '/');
+        const lastSeg = mod.split('.').pop();
+        const endsWith = (p, want) => p === want || p.endsWith('/' + want);
+        files = {
+            module: context
+                .getNodesByName(`${lastSeg}.py`)
+                .filter((n) => n.kind === 'file' && endsWith(n.filePath, `${rel}.py`)),
+            pkg: context
+                .getNodesByName('__init__.py')
+                .filter((n) => n.kind === 'file' && endsWith(n.filePath, `${rel}/__init__.py`)),
+        };
+        memo.set(mod, files);
+    }
+    return (files.module.find((n) => n.filePath !== excludeFilePath) ??
+        files.pkg.find((n) => n.filePath !== excludeFilePath) ??
+        null);
 }
 /**
  * Resolve a Python ABSOLUTE dotted module import (`import a.b.c`) to its file —
@@ -1807,6 +2042,7 @@ function resolveRustPathReference(ref, context) {
     const target = context.getNodesInFile(file).find((n) => n.name === leaf &&
         (n.kind === 'function' ||
             n.kind === 'struct' ||
+            n.kind === 'union' ||
             n.kind === 'enum' ||
             n.kind === 'trait' ||
             n.kind === 'type_alias' ||
@@ -2079,17 +2315,19 @@ function findExportedSymbolWalk(filePath, want, language, context, visited, dept
         // `.ts`/`.tsx` `export default fn`/`class` case. Without the component
         // branch, an `export { default as X } from './X.svelte'` barrel never
         // resolves and the component shows a false 0 callers (#629).
-        const direct = exportIndex.defaultComponent ?? exportIndex.defaultFnClass;
+        // A component file IS its default export; otherwise the statement that
+        // names the binding beats the first-exported-function guess.
+        const direct = exportIndex.defaultComponent ?? defaultExportBindingNode(filePath, exportIndex, context) ?? exportIndex.defaultFnClass;
         if (direct)
             return direct;
     }
     else if (want.isNamespace && want.memberName) {
-        const direct = exportIndex.byName.get(want.memberName);
+        const direct = exportedByName(filePath, exportIndex, want.memberName, context);
         if (direct)
             return direct;
     }
     else {
-        const direct = exportIndex.byName.get(want.exportedName);
+        const direct = exportedByName(filePath, exportIndex, want.exportedName, context);
         if (direct)
             return direct;
     }
@@ -2132,7 +2370,7 @@ function findExportedSymbolWalk(filePath, want, language, context, visited, dept
 }
 /** Node kinds that own static members reachable as `Container.member`. */
 const STATIC_MEMBER_CONTAINERS = new Set([
-    'class', 'struct', 'interface', 'enum', 'trait', 'protocol',
+    'class', 'struct', 'union', 'interface', 'enum', 'trait', 'protocol',
 ]);
 /**
  * Resolve `Container.member` — a static method/property access on a NAMED class
@@ -2209,4 +2447,132 @@ function resolveStaticMember(container, ref, localName, context) {
     }
     return candidates[0];
 }
+/**
+ * Rust `use` declarations, flattened to `localName → full path`.
+ *
+ * Rust is the one supported language with NO `ImportMapping` extraction (see
+ * `extractImportMappings`), so this is the only channel that can tell whether
+ * a bare type name in a Rust file was brought in by a `use`. Handles nested
+ * groups (`use a::{b::C, d as E}`), globs (skipped — they bind no single
+ * name), and `as` aliases.
+ */
+function collectRustUseBindings(content) {
+    const out = new Map();
+    // Expand one level of `{...}` at a time so `a::{b::{C, D}, E}` flattens.
+    const expand = (spec) => {
+        const open = spec.indexOf('{');
+        if (open === -1)
+            return [spec.trim()];
+        const prefix = spec.slice(0, open);
+        let depth = 0;
+        let close = -1;
+        for (let i = open; i < spec.length; i++) {
+            if (spec[i] === '{')
+                depth++;
+            else if (spec[i] === '}') {
+                depth--;
+                if (depth === 0) {
+                    close = i;
+                    break;
+                }
+            }
+        }
+        if (close === -1)
+            return [];
+        const suffix = spec.slice(close + 1);
+        const inner = spec.slice(open + 1, close);
+        const parts = [];
+        let depth2 = 0;
+        let start = 0;
+        for (let i = 0; i <= inner.length; i++) {
+            const ch = inner[i];
+            if (ch === '{')
+                depth2++;
+            else if (ch === '}')
+                depth2--;
+            if (i === inner.length || (ch === ',' && depth2 === 0)) {
+                const seg = inner.slice(start, i).trim();
+                if (seg)
+                    parts.push(seg);
+                start = i + 1;
+            }
+        }
+        return parts.flatMap((p) => expand(prefix + p + suffix));
+    };
+    // `use` items end at the first `;`. Attributes/visibility (`pub use`) are
+    // irrelevant to the binding itself.
+    const useRe = /(^|\n)\s*(?:pub(?:\([^)]*\))?\s+)?use\s+([^;]+);/g;
+    let m;
+    while ((m = useRe.exec(content)) !== null) {
+        for (const spec of expand(m[2].replace(/\s+/g, ' '))) {
+            const aliasMatch = /^(.*?)\s+as\s+([A-Za-z_]\w*)$/.exec(spec);
+            const rawPath = (aliasMatch ? aliasMatch[1] : spec).trim();
+            if (!rawPath || rawPath.endsWith('*'))
+                continue;
+            const segments = rawPath.split('::').map((s) => s.trim()).filter(Boolean);
+            const leaf = segments[segments.length - 1];
+            if (!leaf)
+                continue;
+            const local = aliasMatch ? aliasMatch[2] : leaf;
+            out.set(local, segments.join('::'));
+        }
+    }
+    return out;
+}
+/**
+ * Is `name`, as used in `ref`'s file, bound by an import whose module lives
+ * OUTSIDE the repository?
+ *
+ * When it is, no in-repo node can be the referent: the symbol is defined in a
+ * third-party crate/package, and any same-named local symbol the name-matcher
+ * finds is a coincidence. Rust `use std::error::Error;` + `impl Error for
+ * MapperError {}` bound to a local `MapperError::Error` variant, and once
+ * non-type kinds were filtered out it simply moved to an unrelated local
+ * `type Error` alias — restricting kinds alone RELOCATES the false edge
+ * instead of removing it, so locality has to be checked too.
+ *
+ * Answers only when it can be CERTAIN, because a false "yes" deletes a real
+ * edge. Two languages qualify, each with an oracle that cannot be wrong:
+ *
+ *  - **Rust** — the `use` path is rooted at a standard-library crate
+ *    (`std`/`core`/`alloc`/`proc_macro`), which by definition ships outside
+ *    any repository. Deliberately NOT generalized to "the module path doesn't
+ *    resolve to a file": a crate can re-export another workspace crate's
+ *    modules (`pub use pupil_core::{ports, domain};`), so `crate::ports::X`
+ *    has no `src/ports/` directory to walk yet is entirely in-repo — that
+ *    generalization measured 13 real trait implementations deleted.
+ *  - **ES modules** — `isExternalImport`, which already accounts for tsconfig
+ *    path aliases and monorepo workspace packages.
+ *
+ * Everything else returns false and resolves exactly as before. JVM and Python
+ * imports notably do NOT go through `resolveImportPath` (they have dedicated
+ * FQN/module matchers), so there is no trustworthy oracle to consult here.
+ */
+function isBoundToOutOfRepoImport(ref, context) {
+    const name = ref.referenceName;
+    if (name.includes('::') || name.includes('.'))
+        return false; // qualified refs resolve by path
+    if (ref.language === 'rust') {
+        const content = context.readFile(ref.filePath);
+        if (!content)
+            return false;
+        const usePath = collectRustUseBindings(content).get(name);
+        if (!usePath)
+            return false;
+        const segments = usePath.split('::');
+        if (segments.length < 2 || !RUST_STDLIB_ROOTS.has(segments[0]))
+            return false;
+        // 2015-edition crate-relative paths can shadow a stdlib root with a local
+        // module of the same name — if the path walks to a real file, it's local.
+        return resolveRustModuleFile(segments.slice(0, -1), ref.filePath, context) === null;
+    }
+    if (!ESM_IMPORT_LANGUAGES.has(ref.language))
+        return false;
+    for (const imp of context.getImportMappings(ref.filePath, ref.language)) {
+        if (imp.localName !== name)
+            continue;
+        return isExternalImport(imp.source, ref.language, context);
+    }
+    return false;
+}
 //# sourceMappingURL=import-resolver.js.map