gitnexus 1.6.13-rc.7 → 1.6.13-rc.8

package/README.md

@@ -431,7 +431,7 @@ TypeScript, JavaScript, Python, Java, C, C++, C#, Go, Rust, PHP, Kotlin, Swift,
 | Kotlin     | ✓       | ✓              | ✓       | ✓        | ✓                | ✓                     | —      | ✓          | ✓            |
 | C#         | ✓       | ✓              | ✓       | ✓        | ✓                | ✓                     | ✓      | ✓          | ✓            |
 | Go         | ✓       | —              | ✓       | ✓        | ✓                | ✓                     | ✓      | ✓          | ✓            |
-| Rust       | ✓       | ✓              | ✓       | ✓        | ✓                | ✓                     | —      | ✓          | ✓            |
+| Rust       | ✓       | ✓              | ✓       | ✓        | ✓                | ✓                     | ✓      | ✓          | ✓            |
 | PHP        | ✓       | ✓              | ✓       | —        | ✓                | ✓                     | ✓      | ✓          | ✓            |
 | Ruby       | ✓       | —              | ✓       | ✓        | —                | ✓                     | —      | ✓          | ✓            |
 | Swift      | —       | —              | ✓       | ✓        | ✓                | ✓                     | ✓      | ✓          | ✓            |

package/dist/core/ingestion/languages/rust/cargo-module-files.d.ts

@@ -0,0 +1,9 @@
+import type Parser from 'tree-sitter';
+/** Public use evidence from the same AST used for membership. Keeps restricted
+ * and private globs distinct without changing the shared import/cache shape. */
+export declare function rustPublicUses(root: Parser.SyntaxNode): ReadonlySet<string>;
+/** External modules reachable from one source file; undefined is incomplete. */
+export declare function rustModuleFiles(root: Parser.SyntaxNode, file: string, ownsDirectory: boolean, files: ReadonlySet<string>, missingFiles?: Set<string>, isCrateRoot?: boolean): readonly {
+    file: string;
+    ownsDirectory: boolean;
+}[] | undefined;

package/dist/core/ingestion/languages/rust/cargo-module-files.js

@@ -0,0 +1,319 @@
+import path from 'node:path';
+import { splitRustUseDeclaration } from './import-decomposer.js';
+// Built-in attributes cannot expand to new module declarations. cfg is a union:
+// visiting both alternatives is conservative; cfg_attr may change a path.
+const NON_EXPANDING_ATTRIBUTES = new Set([
+    'cfg',
+    'path',
+    'allow',
+    'warn',
+    'deny',
+    'forbid',
+    'expect',
+    'doc',
+    'test',
+    'should_panic',
+    'ignore',
+    'automatically_derived',
+    'proc_macro',
+    'proc_macro_derive',
+    'proc_macro_attribute',
+    'inline',
+    'cold',
+    'no_mangle',
+    'export_name',
+    'repr',
+    'non_exhaustive',
+    'must_use',
+    'deprecated',
+    'no_std',
+    'no_main',
+    'feature',
+    'crate_type',
+    'crate_name',
+    'recursion_limit',
+    'type_length_limit',
+]);
+const BUILTIN_DERIVES = new Set([
+    'Clone',
+    'Copy',
+    'Debug',
+    'Default',
+    'Eq',
+    'Hash',
+    'Ord',
+    'PartialEq',
+    'PartialOrd',
+]);
+const EXPRESSION_MACROS = new Set([
+    'print',
+    'println',
+    'eprint',
+    'eprintln',
+    'assert',
+    'assert_eq',
+    'assert_ne',
+    'debug_assert',
+    'debug_assert_eq',
+    'debug_assert_ne',
+    'vec',
+    'format',
+    'format_args',
+    'write',
+    'writeln',
+    'panic',
+    'todo',
+    'unimplemented',
+    'unreachable',
+    'dbg',
+    'matches',
+]);
+/** Token arguments can contain blocks/modules or further macro expansion.
+ * Inspect token nodes, never strings/comments that merely mention those words. */
+function hasExpandingArguments(tokens) {
+    for (let i = 0; i < tokens.childCount; i++) {
+        const child = tokens.child(i);
+        if (child.type === 'mod' || child.type === '#')
+            return true;
+        if (child.type === '!' && tokens.child(i - 1)?.type === 'identifier')
+            return true;
+        if (child.type === 'token_tree' && hasExpandingArguments(child))
+            return true;
+    }
+    return false;
+}
+/** Public use evidence from the same AST used for membership. Keeps restricted
+ * and private globs distinct without changing the shared import/cache shape. */
+export function rustPublicUses(root) {
+    const uses = new Set();
+    const pending = [{ node: root, module: '' }];
+    while (pending.length > 0) {
+        const { node, module } = pending.pop();
+        for (const child of node.namedChildren) {
+            if (child.type === 'mod_item') {
+                const body = child.childForFieldName('body');
+                const name = child.childForFieldName('name')?.text;
+                if (body && name)
+                    pending.push({ node: body, module: [module, name].filter(Boolean).join('::') });
+            }
+            else if (child.type === 'use_declaration' &&
+                child.namedChildren.some((part) => part.type === 'visibility_modifier' && part.text === 'pub')) {
+                for (const capture of splitRustUseDeclaration(child)) {
+                    uses.add(JSON.stringify([
+                        module,
+                        capture['@import.source']?.text,
+                        capture['@import.kind']?.text,
+                        capture['@import.name']?.text,
+                    ]));
+                }
+            }
+        }
+    }
+    return uses;
+}
+/** Decode a literal path without mistaking strings/comments for Rust syntax. */
+function literalPath(text) {
+    const raw = /^r(#+)?"([\s\S]*)"\1$/.exec(text);
+    if (raw)
+        return raw[2];
+    // Escape forms beyond JSON's subset remain unknown, never a guessed path.
+    try {
+        const value = JSON.parse(text);
+        return typeof value === 'string' ? value : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** External modules reachable from one source file; undefined is incomplete. */
+export function rustModuleFiles(root, file, ownsDirectory, files, missingFiles, isCrateRoot = false) {
+    if (root.hasError)
+        return undefined;
+    // Built-in spellings are not proof when an import/local macro can shadow
+    // them. Cross-file macro_use/macro_export remain unknown attributes below.
+    const shadowed = new Set();
+    const globs = [];
+    const scan = [root];
+    while (scan.length) {
+        const node = scan.pop();
+        if (node.type === 'macro_definition' || node.type === 'mod_item') {
+            const name = node.childForFieldName('name')?.text;
+            if (name)
+                shadowed.add(name);
+            // macro_rules textual scope can extend into child module files. Without
+            // expansion/scope receipts, do not assume their same-named calls are std.
+            if (node.type === 'macro_definition' && name && EXPRESSION_MACROS.has(name))
+                return undefined;
+        }
+        if (node.type === 'use_declaration') {
+            for (const capture of splitRustUseDeclaration(node)) {
+                if (capture['@import.kind']?.text === 'wildcard')
+                    globs.push({ node, path: capture['@import.source']?.text ?? '' });
+                const name = capture['@import.name']?.text;
+                if (name)
+                    shadowed.add(name);
+            }
+        }
+        if (node.type !== 'macro_definition' && node.type !== 'token_tree')
+            scan.push(...node.namedChildren);
+    }
+    const wildcard = globs.some(({ node, path: imported }) => {
+        const parts = imported.split('::').filter(Boolean);
+        // Cargo aliases for these names are rejected by the loader. A local
+        // module/import can still shadow a standard-library path in this file.
+        if (['std', 'core', 'alloc'].includes(parts[0] ?? '') && !shadowed.has(parts[0]))
+            return false;
+        let depth = 0;
+        let localModuleScope = true;
+        for (let parent = node.parent; parent && parent !== root; parent = parent.parent) {
+            if (parent.type === 'mod_item')
+                depth++;
+            if (parent.type === 'function_item' ||
+                parent.type === 'block' ||
+                parent.type === 'closure_expression')
+                localModuleScope = false;
+        }
+        // The common inline unit-test `use super::*` stays within this AST.
+        // A file-level super glob has an external parent and remains unknown.
+        if (localModuleScope &&
+            parts.length > 0 &&
+            parts.every((part) => part === 'super') &&
+            parts.length <= depth)
+            return false;
+        // At a Cargo root, bare/self/crate paths to inline modules have the same
+        // meaning across editions. Do not extend this assumption to file modules.
+        if (isCrateRoot && node.parent === root) {
+            if (parts[0] === 'self' || parts[0] === 'crate')
+                parts.shift();
+            let body = root;
+            for (const part of parts) {
+                body =
+                    body?.namedChildren
+                        .find((child) => child.type === 'mod_item' && child.childForFieldName('name')?.text === part)
+                        ?.childForFieldName('body') ?? undefined;
+            }
+            if (parts.length > 0 && body !== undefined)
+                return false;
+        }
+        return true;
+    });
+    const builtin = (name) => !wildcard && !shadowed.has(name);
+    const fileDir = path.posix.dirname(file);
+    const moduleDir = ownsDirectory || path.posix.basename(file) === 'mod.rs'
+        ? fileDir
+        : file.slice(0, -'.rs'.length);
+    const pending = [{ node: root, moduleDir, attributeDir: fileDir }];
+    const result = [];
+    let unresolved = false;
+    while (pending.length) {
+        const context = pending.pop();
+        let attributes = [];
+        for (const node of context.node.namedChildren) {
+            if (node.type === 'line_comment' || node.type === 'block_comment')
+                continue;
+            if (node.type === 'attribute_item' || node.type === 'inner_attribute_item') {
+                const attribute = node.namedChildren[0];
+                const name = attribute?.namedChildren[0]?.text;
+                if (name === 'derive') {
+                    const argumentsNode = attribute?.childForFieldName('arguments');
+                    if (!argumentsNode ||
+                        !builtin('derive') ||
+                        argumentsNode.namedChildren.length === 0 ||
+                        argumentsNode.namedChildren.some((item) => item.type !== 'identifier' ||
+                            !BUILTIN_DERIVES.has(item.text) ||
+                            !builtin(item.text)) ||
+                        argumentsNode.children.some((item) => !['(', ')', ',', 'identifier', 'line_comment', 'block_comment'].includes(item.type)))
+                        return undefined;
+                }
+                else if (!name || !NON_EXPANDING_ATTRIBUTES.has(name))
+                    return undefined;
+                if (node.type === 'attribute_item')
+                    attributes.push(node);
+                continue;
+            }
+            const attrs = attributes;
+            attributes = [];
+            // The current scope captures do not carry extern-crate aliases. Do not
+            // certify a negative import-root proof from an incomplete namespace view.
+            if (node.type === 'extern_crate_declaration' && node.childForFieldName('alias') !== null) {
+                return undefined;
+            }
+            const macro = node.type === 'macro_invocation'
+                ? node
+                : node.type === 'expression_statement' &&
+                    node.namedChildren[0]?.type === 'macro_invocation'
+                    ? node.namedChildren[0]
+                    : undefined;
+            if (macro) {
+                const name = macro.childForFieldName('macro')?.text;
+                const tokens = macro.namedChildren.find((child) => child.type === 'token_tree');
+                const parts = name?.split('::').filter(Boolean) ?? [];
+                const standard = parts.length === 1 ||
+                    (parts.length === 2 && ['std', 'core', 'alloc'].includes(parts[0]));
+                if (!standard ||
+                    !EXPRESSION_MACROS.has(parts.at(-1) ?? '') ||
+                    !parts.every(builtin) ||
+                    !tokens ||
+                    hasExpandingArguments(tokens) ||
+                    context.node.type === 'source_file' ||
+                    context.node.type === 'declaration_list')
+                    return undefined;
+                continue;
+            }
+            if (node.type !== 'mod_item') {
+                // Items (including external #[path] modules) can also occur in blocks.
+                // Inspect them too; a macro expansion there can add shared membership.
+                // Macro definitions/token trees and literal contents are not expansions.
+                if (node.type !== 'macro_definition' &&
+                    node.type !== 'token_tree' &&
+                    node.namedChildCount > 0) {
+                    pending.push({ ...context, node });
+                }
+                continue;
+            }
+            const name = node.childForFieldName('name')?.text;
+            if (!name)
+                return undefined;
+            let override;
+            for (const attr of attrs) {
+                const attribute = attr.namedChildren[0];
+                if (attribute.namedChildren[0]?.text !== 'path')
+                    continue;
+                const value = attribute.childForFieldName('value');
+                if (!value || override !== undefined)
+                    return undefined;
+                override = literalPath(value.text);
+                if (override === undefined || path.posix.isAbsolute(override) || override.includes('\\'))
+                    return undefined;
+            }
+            const body = node.childForFieldName('body');
+            if (body) {
+                const dir = override === undefined
+                    ? path.posix.join(context.moduleDir, name)
+                    : path.posix.join(context.attributeDir, override);
+                pending.push({ node: body, moduleDir: dir, attributeDir: dir });
+                continue;
+            }
+            const candidates = override !== undefined
+                ? [path.posix.normalize(path.posix.join(context.attributeDir, override))]
+                : [
+                    path.posix.join(context.moduleDir, `${name}.rs`),
+                    path.posix.join(context.moduleDir, name, 'mod.rs'),
+                ];
+            const existing = candidates.filter((candidate) => files.has(candidate));
+            if (existing.length === 0) {
+                if (!missingFiles)
+                    return undefined;
+                for (const candidate of candidates)
+                    missingFiles.add(candidate);
+                unresolved = true;
+                continue;
+            }
+            // Union conditional alternatives; shared membership must never be erased.
+            // #[path] makes the loaded file own its containing directory, just like
+            // a crate root; its children do NOT acquire the file stem as a prefix.
+            result.push(...existing.map((file) => ({ file, ownsDirectory: override !== undefined })));
+        }
+    }
+    return unresolved ? undefined : result;
+}

package/dist/core/ingestion/languages/rust/cargo-targets.d.ts

@@ -0,0 +1,21 @@
+/** A target is identified by its entry file, not its package directory. */
+export declare function cargoTargetRoots(manifest: string, content: string, files: ReadonlySet<string>, workspaceEditions?: ReadonlyMap<string, string>): readonly string[] | undefined;
+/** Exact public-use evidence, independent of the capture's coarse reexport kind. */
+export declare function rustCargoPubliclyReexports(config: unknown, file: string, module: string, target: string, kind: string, name: string): boolean;
+/** Positive evidence that this import names this library's ROOT, not a module
+ *  elsewhere (or a binary/test entry point that cannot be imported as a lib). */
+export declare function rustImportNamesCargoRoot(config: unknown, caller: string, candidate: string, importedModule: string): boolean;
+/** Every known membership must identify this file as the entry point. A file
+ *  shared as a module in another target does not have a single root role. */
+export declare function rustIsExclusiveCargoRoot(config: unknown, file: string): boolean;
+/** Establish crate identity before the existing module-path plausibility test. */
+export declare function rustImportReachesCargoTarget(config: unknown, caller: string, candidate: string, importedModule: string): boolean;
+/** Undefined means no complete membership proof; never interpret it as disjoint. */
+export declare function rustFilesShareCargoTarget(config: unknown, caller: string, candidate: string): boolean | undefined;
+/**
+ * Static, bounded, one-shot provider loader. No cargo/rustc, build scripts,
+ * repository wrappers, or network. Parse only files reachable from Cargo roots.
+ * Unknown expansion anywhere can add shared membership, so it invalidates the
+ * negative proof for this snapshot rather than producing a partial veto.
+ */
+export declare function loadRustCargoTargets(repoPath: string): Promise<unknown>;

package/dist/core/ingestion/languages/rust/cargo-targets.js

@@ -0,0 +1,473 @@
+/** Cargo target evidence for the name-guess veto, never a directory heuristic. */
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { glob, escape } from 'glob';
+import { parse } from 'smol-toml';
+import Parser from 'tree-sitter';
+import { SupportedLanguages } from '../../../../_shared/index.js';
+import { getLanguageGrammar } from '../../../tree-sitter/parser-loader.js';
+import { parseSourceSafe } from '../../../tree-sitter/safe-parse.js';
+import { readRepoControlFile } from '../../../../config/repo-control-file.js';
+import { rustModuleFiles, rustPublicUses } from './cargo-module-files.js';
+const MAX_FILES = 100_000;
+const table = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
+/** A target is identified by its entry file, not its package directory. */
+export function cargoTargetRoots(manifest, content, files, workspaceEditions) {
+    let data;
+    try {
+        data = parse(content);
+    }
+    catch {
+        return undefined;
+    }
+    if (!table(data.package))
+        return table(data.workspace) ? [] : undefined;
+    const pkg = data.package;
+    if (typeof pkg.name !== 'string')
+        return undefined;
+    if (pkg.build !== undefined && typeof pkg.build !== 'string' && typeof pkg.build !== 'boolean')
+        return undefined;
+    const dir = path.posix.dirname(manifest);
+    let edition = pkg.edition ?? '2015';
+    if (table(edition) && edition.workspace === true) {
+        let workspace = typeof pkg.workspace === 'string' ? path.posix.join(dir, pkg.workspace, '.') : dir;
+        while (!workspaceEditions?.has(workspace) &&
+            typeof pkg.workspace !== 'string' &&
+            workspace !== '.') {
+            workspace = path.posix.dirname(workspace);
+        }
+        edition = workspaceEditions?.get(workspace);
+    }
+    if (typeof edition !== 'string' || !['2015', '2018', '2021', '2024'].includes(edition))
+        return undefined;
+    const relative = (file) => path.posix.normalize(path.posix.join(dir, file));
+    const roots = new Set();
+    for (const [kind, folder] of [
+        ['lib', 'src'],
+        ['bin', 'src/bin'],
+        ['test', 'tests'],
+        ['bench', 'benches'],
+        ['example', 'examples'],
+    ]) {
+        const autoKey = {
+            lib: 'autolib',
+            bin: 'autobins',
+            test: 'autotests',
+            bench: 'autobenches',
+            example: 'autoexamples',
+        }[kind];
+        if (pkg[autoKey] !== undefined && typeof pkg[autoKey] !== 'boolean')
+            return undefined;
+        const discovered = new Map();
+        if (kind === 'lib') {
+            if (files.has(relative('src/lib.rs')))
+                discovered.set(pkg.name, relative('src/lib.rs'));
+        }
+        else {
+            if (kind === 'bin' && files.has(relative('src/main.rs'))) {
+                discovered.set(pkg.name, relative('src/main.rs'));
+            }
+            const prefix = `${relative(folder)}/`;
+            for (const file of files) {
+                if (!file.startsWith(prefix))
+                    continue;
+                const tail = file.slice(prefix.length);
+                const match = /^([^/]+)\.rs$/.exec(tail) ?? /^([^/]+)\/main\.rs$/.exec(tail);
+                if (match)
+                    discovered.set(match[1], file);
+            }
+        }
+        const explicit = data[kind] === undefined ? [] : kind === 'lib' ? [data[kind]] : data[kind];
+        if (!Array.isArray(explicit))
+            return undefined;
+        // Cargo 2015's opt-in discovery rule is PER target kind: an explicit
+        // binary does not disable integration tests, examples, benches or the lib.
+        const legacy = edition === '2015' && explicit.length > 0;
+        const overridden = new Set();
+        for (const entry of explicit) {
+            if (!table(entry))
+                return undefined;
+            const name = kind === 'lib' ? pkg.name : entry.name;
+            if (typeof name !== 'string')
+                return undefined;
+            if (entry.path !== undefined && typeof entry.path !== 'string')
+                return undefined;
+            if (typeof entry.path === 'string' && path.posix.isAbsolute(entry.path))
+                return undefined;
+            const file = typeof entry.path === 'string' ? relative(entry.path) : discovered.get(name);
+            if (!file || !files.has(file))
+                return undefined;
+            roots.add(file);
+            overridden.add(name);
+        }
+        if (pkg[autoKey] === true || (pkg[autoKey] !== false && !legacy)) {
+            for (const [name, file] of discovered)
+                if (!overridden.has(name))
+                    roots.add(file);
+        }
+    }
+    // Build scripts are crates too, even when located outside src/.
+    if (typeof pkg.build === 'string') {
+        const file = relative(pkg.build);
+        if (!files.has(file))
+            return undefined;
+        if (roots.has(file))
+            return undefined; // Multiple target roles need separate identities.
+        roots.add(file);
+    }
+    else if (pkg.build !== false && files.has(relative('build.rs'))) {
+        if (roots.has(relative('build.rs')))
+            return undefined;
+        roots.add(relative('build.rs'));
+    }
+    return [...roots];
+}
+class RustCargoTargets {
+    targetsByFile;
+    rootImports;
+    publicUsesByFile;
+    constructor(targetsByFile, rootImports, publicUsesByFile) {
+        this.targetsByFile = targetsByFile;
+        this.rootImports = rootImports;
+        this.publicUsesByFile = publicUsesByFile;
+    }
+}
+/** Exact public-use evidence, independent of the capture's coarse reexport kind. */
+export function rustCargoPubliclyReexports(config, file, module, target, kind, name) {
+    return (config instanceof RustCargoTargets &&
+        config.publicUsesByFile.get(file)?.has(JSON.stringify([module, target, kind, name])) === true);
+}
+/** Positive evidence that this import names this library's ROOT, not a module
+ *  elsewhere (or a binary/test entry point that cannot be imported as a lib). */
+export function rustImportNamesCargoRoot(config, caller, candidate, importedModule) {
+    if (!(config instanceof RustCargoTargets))
+        return false;
+    const segments = importedModule.split('::').filter(Boolean);
+    if (segments.length !== 1)
+        return false;
+    for (const target of config.targetsByFile.get(caller) ?? []) {
+        if (config.rootImports.get(target)?.get(segments[0])?.has(candidate))
+            return true;
+    }
+    return false;
+}
+/** Every known membership must identify this file as the entry point. A file
+ *  shared as a module in another target does not have a single root role. */
+export function rustIsExclusiveCargoRoot(config, file) {
+    if (!(config instanceof RustCargoTargets))
+        return false;
+    const targets = config.targetsByFile.get(file);
+    return targets?.size === 1 && targets.has(file);
+}
+/** Establish crate identity before the existing module-path plausibility test. */
+export function rustImportReachesCargoTarget(config, caller, candidate, importedModule) {
+    if (!(config instanceof RustCargoTargets))
+        return false;
+    const name = importedModule.split('::').filter(Boolean)[0];
+    if (!name)
+        return false;
+    const candidates = config.targetsByFile.get(candidate);
+    for (const target of config.targetsByFile.get(caller) ?? []) {
+        for (const imported of config.rootImports.get(target)?.get(name) ?? []) {
+            if (candidates?.has(imported))
+                return true;
+        }
+    }
+    return false;
+}
+/** Import names are target/package-relative. A dependency alias in another
+ *  package must not authorize a guess here merely because its spelling matches. */
+function cargoRootImports(manifests, targets) {
+    const libraries = new Map();
+    for (const [manifest, data] of manifests) {
+        if (!table(data.package))
+            continue;
+        const lib = table(data.lib) ? data.lib : undefined;
+        if (!lib && data.package.autolib === false)
+            continue;
+        const root = path.posix.join(path.posix.dirname(manifest), typeof lib?.path === 'string' ? lib.path : 'src/lib.rs');
+        const name = lib?.name ?? data.package.name;
+        if (typeof name === 'string' && targets.get(manifest)?.includes(root)) {
+            libraries.set(manifest, {
+                root,
+                name: name.replaceAll('-', '_'),
+            });
+        }
+    }
+    const result = new Map();
+    for (const [manifest, data] of manifests) {
+        if (!table(data.package))
+            continue;
+        const dir = path.posix.dirname(manifest);
+        let workspace = typeof data.package.workspace === 'string'
+            ? path.posix.join(dir, data.package.workspace, '.')
+            : dir;
+        while (!table(manifests.get(path.posix.join(workspace, 'Cargo.toml'))?.workspace) &&
+            typeof data.package.workspace !== 'string' &&
+            workspace !== '.')
+            workspace = path.posix.dirname(workspace);
+        const workspaceData = manifests.get(path.posix.join(workspace, 'Cargo.toml'))?.workspace;
+        const workspaceDeps = table(workspaceData) && table(workspaceData.dependencies) ? workspaceData.dependencies : {};
+        const sections = [
+            data,
+            ...(table(data.target) ? Object.values(data.target).filter(table) : []),
+        ];
+        for (const target of targets.get(manifest) ?? []) {
+            let imports = result.get(target);
+            if (!imports)
+                result.set(target, (imports = new Map()));
+            const add = (name, root) => {
+                let roots = imports.get(name);
+                if (!roots)
+                    imports.set(name, (roots = new Set()));
+                roots.add(root);
+            };
+            const own = libraries.get(manifest);
+            const buildRoot = path.posix.join(dir, typeof data.package.build === 'string' ? data.package.build : 'build.rs');
+            const isBuild = data.package.build !== false && target === buildRoot;
+            if (own && !isBuild)
+                add(own.name, own.root);
+            for (const section of sections) {
+                // Libraries/binaries can also compile as unit-test targets, so retain
+                // dev dependencies across cfg modes. Build scripts have their own
+                // dependency namespace and cannot import the package's own library.
+                const kinds = isBuild ? ['build-dependencies'] : ['dependencies', 'dev-dependencies'];
+                for (const kind of kinds) {
+                    const deps = section[kind];
+                    if (!table(deps))
+                        continue;
+                    for (const [key, declared] of Object.entries(deps)) {
+                        const inherited = table(declared) && declared.workspace === true;
+                        const dep = inherited ? workspaceDeps[key] : declared;
+                        if (!table(dep) || typeof dep.path !== 'string')
+                            continue;
+                        const dependency = libraries.get(path.posix.join(inherited ? workspace : dir, dep.path, 'Cargo.toml'));
+                        if (!dependency)
+                            continue;
+                        // Cargo uses the dependency key whenever `package` is explicit,
+                        // even if it equals the package name and [lib].name differs.
+                        const renamed = typeof dep.package === 'string';
+                        add(renamed ? key.replaceAll('-', '_') : dependency.name, dependency.root);
+                    }
+                }
+            }
+        }
+    }
+    return result;
+}
+/** Undefined means no complete membership proof; never interpret it as disjoint. */
+export function rustFilesShareCargoTarget(config, caller, candidate) {
+    if (!(config instanceof RustCargoTargets))
+        return undefined;
+    const callers = config.targetsByFile.get(caller);
+    const candidates = config.targetsByFile.get(candidate);
+    if (!callers || !candidates)
+        return undefined;
+    return [...callers].some((root) => candidates.has(root));
+}
+/**
+ * Static, bounded, one-shot provider loader. No cargo/rustc, build scripts,
+ * repository wrappers, or network. Parse only files reachable from Cargo roots.
+ * Unknown expansion anywhere can add shared membership, so it invalidates the
+ * negative proof for this snapshot rather than producing a partial veto.
+ */
+export async function loadRustCargoTargets(repoPath) {
+    try {
+        const root = await fs.realpath(repoPath);
+        const files = new Set();
+        const manifests = [];
+        for await (const entry of glob.iterate('**/Cargo.toml', {
+            // Cargo metadata must include targets the graph scanner omits (notably
+            // src/bin). An omitted target can share a source file with another crate.
+            cwd: root,
+            nodir: true,
+            follow: false,
+            posix: true,
+            dot: true,
+            ignore: [
+                '**/.git/**',
+                '**/node_modules/**',
+                '**/.gitnexus/**',
+                '**/target/debug/**',
+                '**/target/release/**',
+                '**/target/incremental/**',
+                '**/target/doc/**',
+                '**/target/tmp/**',
+                '**/target/.fingerprint/**',
+                '**/target/CACHEDIR.TAG',
+            ],
+        })) {
+            if (files.size >= MAX_FILES)
+                return undefined;
+            files.add(entry);
+            manifests.push(entry);
+        }
+        if (manifests.length === 0)
+            return undefined;
+        // Artifact-layout pruning (`target/debug`, `target/release`, …) must not
+        // erase a source path whose segment is named `target` (`src/target/mod.rs`,
+        // `[lib] path = "target/entry.rs"`, `src/bin/target/main.rs`). Re-scan
+        // Cargo's auto-target slots without that filter.
+        for (const manifest of manifests) {
+            for await (const entry of glob.iterate([
+                'src/lib.rs',
+                'src/main.rs',
+                'src/bin/*.rs',
+                'src/bin/*/main.rs',
+                'tests/*.rs',
+                'tests/*/main.rs',
+                'benches/*.rs',
+                'benches/*/main.rs',
+                'examples/*.rs',
+                'examples/*/main.rs',
+                'build.rs',
+            ], {
+                cwd: path.join(root, path.posix.dirname(manifest)),
+                nodir: true,
+                follow: false,
+                posix: true,
+            })) {
+                if (files.size >= MAX_FILES)
+                    return undefined;
+                files.add(path.posix.join(path.posix.dirname(manifest), entry));
+            }
+        }
+        const read = async (file) => {
+            const requested = path.resolve(root, file);
+            const absolute = await fs.realpath(requested);
+            const rel = path.relative(root, absolute);
+            if (rel === '..' || rel.startsWith(`..${path.sep}`) || path.isAbsolute(rel)) {
+                throw new Error('Cargo module outside repository');
+            }
+            if (absolute !== requested)
+                throw new Error('Cargo module alias has unknown membership');
+            // The shared reader validates its opened descriptor and bounds streamed
+            // bytes; the outer realpath check is a separate containment/alias guard.
+            const content = await readRepoControlFile(root, file);
+            if (content === null)
+                throw new Error('Cargo source disappeared');
+            return content;
+        };
+        const contents = new Map();
+        const manifestData = new Map();
+        const workspaceEditions = new Map();
+        for (const manifest of manifests) {
+            const content = await read(manifest);
+            contents.set(manifest, content);
+            const data = parse(content);
+            // A dependency alias can replace a std/core/alloc extern-prelude entry.
+            // In that case the module walker cannot identify standard macros safely.
+            const sections = [
+                data,
+                ...(table(data.target) ? Object.values(data.target).filter(table) : []),
+            ];
+            if (sections.some((section) => ['dependencies', 'dev-dependencies', 'build-dependencies'].some((kind) => table(section[kind]) &&
+                ['std', 'core', 'alloc'].some((name) => Object.hasOwn(section[kind], name)))))
+                return undefined;
+            manifestData.set(manifest, data);
+            if (table(data.workspace) &&
+                table(data.workspace.package) &&
+                typeof data.workspace.package.edition === 'string') {
+                workspaceEditions.set(path.posix.dirname(manifest), data.workspace.package.edition);
+            }
+        }
+        // Manifest discovery prunes artifacts, but explicit source paths and mod
+        // declarations are authoritative candidates even beneath a `target` folder.
+        // Probe only those literal paths; never crawl the artifact tree recursively.
+        const discover = async (candidates) => {
+            const patterns = [...candidates].map((file) => {
+                if (path.posix.isAbsolute(file) ||
+                    file === '..' ||
+                    file.startsWith('../') ||
+                    file.includes('\\'))
+                    throw new Error('Cargo source outside repository');
+                if (!file.endsWith('.rs') ||
+                    file
+                        .split('/')
+                        .some((part) => ['.git', '.gitnexus', 'node_modules'].includes(part.toLowerCase())))
+                    throw new Error('Cargo source excluded from inventory');
+                return escape(file);
+            });
+            for await (const entry of glob.iterate(patterns, {
+                cwd: root,
+                nodir: true,
+                follow: false,
+                posix: true,
+                dot: true,
+            })) {
+                if (files.size >= MAX_FILES)
+                    throw new Error('Cargo file limit');
+                files.add(entry);
+            }
+        };
+        for (const [manifest, data] of manifestData) {
+            const explicit = [
+                data.lib,
+                ...['bin', 'test', 'bench', 'example'].flatMap((kind) => Array.isArray(data[kind]) ? data[kind] : []),
+            ];
+            const paths = explicit
+                .filter(table)
+                .map((entry) => entry.path)
+                .filter((value) => typeof value === 'string');
+            if (table(data.package) && typeof data.package.build === 'string')
+                paths.push(data.package.build);
+            await discover(paths.map((file) => path.posix.join(path.posix.dirname(manifest), file)));
+        }
+        const roots = new Set();
+        const targetsByManifest = new Map();
+        for (const [manifest, content] of contents) {
+            const targets = cargoTargetRoots(manifest, content, files, workspaceEditions);
+            if (targets === undefined)
+                return undefined;
+            targetsByManifest.set(manifest, targets);
+            for (const target of targets)
+                roots.add(target);
+        }
+        const parser = new Parser();
+        parser.setLanguage(getLanguageGrammar(SupportedLanguages.Rust));
+        const targetsByFile = new Map();
+        const publicUsesByFile = new Map();
+        // A file may be reached conventionally AND through #[path]. Those have
+        // different submodule bases, so cache and visit both contexts separately.
+        const childrenByFile = new Map();
+        let visits = 0;
+        for (const target of roots) {
+            const pending = [{ file: target, ownsDirectory: true }];
+            const visited = new Set();
+            while (pending.length > 0) {
+                if (++visits > MAX_FILES)
+                    return undefined;
+                const { file, ownsDirectory } = pending.pop();
+                const key = `${file === target ? 'root' : ownsDirectory ? 'owned' : 'module'}:${file}`;
+                if (visited.has(key))
+                    continue;
+                visited.add(key);
+                let owners = targetsByFile.get(file);
+                if (!owners)
+                    targetsByFile.set(file, (owners = new Set()));
+                owners.add(target);
+                let children = childrenByFile.get(key);
+                if (!children) {
+                    const tree = parseSourceSafe(parser, await read(file));
+                    const missing = new Set();
+                    let result = rustModuleFiles(tree.rootNode, file, ownsDirectory, files, missing, file === target);
+                    if (result === undefined && missing.size > 0) {
+                        await discover(missing);
+                        result = rustModuleFiles(tree.rootNode, file, ownsDirectory, files, undefined, file === target);
+                    }
+                    if (result === undefined)
+                        return undefined;
+                    publicUsesByFile.set(file, rustPublicUses(tree.rootNode));
+                    children = result;
+                    childrenByFile.set(key, children);
+                }
+                pending.push(...children);
+            }
+        }
+        return new RustCargoTargets(targetsByFile, cargoRootImports(manifestData, targetsByManifest), publicUsesByFile);
+    }
+    catch {
+        // I/O, parse or containment failure cannot establish target separation.
+        return undefined;
+    }
+}

package/dist/core/ingestion/languages/rust/import-decomposer.js

@@ -7,15 +7,18 @@ import { syntheticCapture } from '../../utils/ast-helpers.js';
 export function splitRustUseDeclaration(node) {
     if (node.type !== 'use_declaration')
         return [];
-    const isReexport = hasVisibilityModifier(node);
+    const isReexport = hasUnrestrictedPub(node);
     const argument = getUseArgument(node);
     if (argument === null)
         return [];
     return decomposeUseArgument(argument, '', isReexport, node);
 }
-function hasVisibilityModifier(node) {
+function hasUnrestrictedPub(node) {
     for (let i = 0; i < node.childCount; i++) {
-        if (node.child(i)?.type === 'visibility_modifier')
+        const child = node.child(i);
+        // `pub(crate)` / `pub(super)` / `pub(in …)` / `crate` are not the crate's
+        // public surface, so they must not walk as `pub use` re-export evidence.
+        if (child?.type === 'visibility_modifier' && child.text === 'pub')
             return true;
     }
     return false;
@@ -106,7 +109,9 @@ function buildScopedPath(node) {
     if (node.type === 'scoped_identifier') {
         const parts = [];
         collectScopedParts(node, parts);
-        return parts.join('::');
+        // An absolute extern-prelude path bypasses a same-named local module.
+        // Keep that evidence when flattening the AST into an import specifier.
+        return `${node.text.startsWith('::') ? '::' : ''}${parts.join('::')}`;
     }
     return node.text;
 }
@@ -136,7 +141,7 @@ function buildWildcardPath(node) {
             continue;
         if (child.type === 'scoped_identifier')
             return buildScopedPath(child);
-        if (child.type === 'identifier')
+        if (['identifier', 'crate', 'self', 'super'].includes(child.type))
             return child.text;
     }
     return '';

package/dist/core/ingestion/languages/rust/name-fallback-visibility.d.ts

@@ -22,6 +22,8 @@ import type { ParsedFile, ScopeId, SymbolDefinition } from '../../../../_shared/
 export declare function rustIsGlobalNameFallbackPlausible(ctx: {
     readonly callerParsed: ParsedFile;
     readonly candidate: SymbolDefinition;
+    readonly resolutionConfig?: unknown;
+    readonly parsedFileOf?: (filePath: string) => ParsedFile | undefined;
     readonly site: {
         readonly name: string;
         readonly rawQualifiedName?: string;

package/dist/core/ingestion/languages/rust/name-fallback-visibility.js

@@ -18,6 +18,7 @@
  * `a::b`). `crate::` names the root; `self::` and `super::` resolve relative
  * to the caller's module before comparison.
  */
+import { rustFilesShareCargoTarget, rustImportNamesCargoRoot, rustIsExclusiveCargoRoot, rustImportReachesCargoTarget, rustCargoPubliclyReexports, } from './cargo-targets.js';
 import { modulePathReaches, stripExtension, } from '../../scope-resolution/utils/name-fallback-visibility.js';
 /** File-stems that name their PARENT directory as the module, not themselves. */
 const RUST_DIRECTORY_MODULE_STEMS = new Set(['mod', 'lib', 'main']);
@@ -26,6 +27,16 @@ const RUST_DIRECTORY_MODULE_STEMS = new Set(['mod', 'lib', 'main']);
 const RUST_CRATE_ROOT_DIRS = new Set(['src', 'tests', 'benches', 'examples']);
 /** Path prefixes of a `use` that name a root rather than a module segment. */
 const RUST_USE_ROOT_PREFIXES = new Set(['crate', '$crate']);
+const RUST_TYPE_NAMESPACE_KINDS = new Set([
+    'Namespace',
+    'Class',
+    'Struct',
+    'Enum',
+    'Trait',
+    'Interface',
+    'TypeAlias',
+    'Union',
+]);
 // One scope lookup per immutable parsed-file snapshot, not per fallback site.
 // Weak keys release both the snapshot and its index at the end of ingestion.
 const scopeLookupByFile = new WeakMap();
@@ -92,12 +103,64 @@ export function rustIsGlobalNameFallbackPlausible(ctx) {
     if (ctx.site.rawQualifiedName !== undefined)
         return true;
     const candidateModule = rustModulePathOf(ctx.candidate.filePath);
-    // A candidate whose file maps to no module path (a crate root reduced to '')
-    // is not something this rule can speak about; allow the labeled edge rather
-    // than refuse on an unanswered question.
-    if (candidateModule === '')
-        return true;
+    const sharesTarget = rustFilesShareCargoTarget(ctx.resolutionConfig, ctx.callerParsed.filePath, ctx.candidate.filePath);
+    const separateRoot = sharesTarget === false &&
+        rustIsExclusiveCargoRoot(ctx.resolutionConfig, ctx.candidate.filePath);
+    // Cargo membership does not establish cross-file lexical visibility.
+    // Root candidates must also pass the import checks below; same-file and
+    // explicitly qualified calls have already been handled above.
     const candidateName = rustSimpleNameOf(ctx.candidate);
+    const exportModules = new Set([(ctx.candidate.namespacePrefix ?? '').replaceAll('.', '::')]);
+    const candidateParsed = sharesTarget === false ? ctx.parsedFileOf?.(ctx.candidate.filePath) : undefined;
+    if (candidateParsed !== undefined) {
+        const moduleByScope = new Map();
+        const moduleScopes = new Set();
+        for (const scope of candidateParsed.scopes) {
+            const parent = scope.parent === null ? '' : (moduleByScope.get(scope.parent) ?? '');
+            const own = scope.kind === 'Namespace'
+                ? scope.ownedDefs.find((def) => def.type === 'Namespace')?.qualifiedName
+                : undefined;
+            moduleByScope.set(scope.id, [parent, own].filter(Boolean).join('::'));
+            if (scope.kind === 'Namespace' || scope.kind === 'Module')
+                moduleScopes.add(scope.id);
+        }
+        // Follow same-file re-exports without confusing the defining module with
+        // the module an importer sees. Each iteration adds a known module scope,
+        // so cycles terminate. Cargo's AST snapshot supplies public visibility,
+        // which the coarse parsed reexport/wildcard kind does not preserve.
+        let changed = true;
+        while (changed) {
+            changed = false;
+            for (const imp of candidateParsed.parsedImports) {
+                if (imp.declaredAtScope === undefined || !moduleScopes.has(imp.declaredAtScope))
+                    continue;
+                if (imp.kind !== 'wildcard' &&
+                    (imp.kind !== 'reexport' ||
+                        imp.localName !== candidateName ||
+                        imp.importedName !== candidateName))
+                    continue;
+                if (imp.targetRaw.startsWith('::'))
+                    continue;
+                const owner = moduleByScope.get(imp.declaredAtScope);
+                if (!rustCargoPubliclyReexports(ctx.resolutionConfig, ctx.candidate.filePath, owner, imp.targetRaw, imp.kind, imp.kind === 'wildcard' ? '*' : imp.localName))
+                    continue;
+                const parts = imp.targetRaw.split('::').filter(Boolean);
+                if (imp.kind !== 'wildcard')
+                    parts.pop();
+                const base = parts[0] === 'self' || parts[0] === 'super' ? owner.split('::').filter(Boolean) : [];
+                if (parts[0] === 'crate' || parts[0] === 'self')
+                    parts.shift();
+                while (parts[0] === 'super') {
+                    base.pop();
+                    parts.shift();
+                }
+                if (exportModules.has([...base, ...parts].join('::')) && !exportModules.has(owner)) {
+                    exportModules.add(owner);
+                    changed = true;
+                }
+            }
+        }
+    }
     // Imports are lexical evidence, not a file-wide allowlist. Legacy/synthetic
     // imports without a scope receipt retain the previous conservative behavior.
     let visibleScopes;
@@ -117,24 +180,95 @@ export function rustIsGlobalNameFallbackPlausible(ctx) {
             current = scope.parent;
         }
     }
-    for (const imp of ctx.callerParsed.parsedImports) {
-        if (imp.declaredAtScope !== undefined &&
-            visibleScopes !== undefined &&
-            !visibleScopes.has(imp.declaredAtScope))
-            continue;
+    const visibleImports = ctx.callerParsed.parsedImports.filter((imp) => imp.declaredAtScope === undefined ||
+        visibleScopes === undefined ||
+        visibleScopes.has(imp.declaredAtScope));
+    const scopeRanks = new Map([...(visibleScopes ?? [])].map((scope, rank) => [scope, rank]));
+    const namesCandidateRoot = (module, entryOnly) => {
+        const pending = [module];
+        const seen = new Set();
+        while (pending.length > 0) {
+            const name = pending.pop();
+            const parts = name.split('::').filter(Boolean);
+            const head = parts[0];
+            const bindingName = name.startsWith('::') ? name : head;
+            if (!bindingName || seen.has(bindingName))
+                continue;
+            seen.add(bindingName);
+            const aliases = visibleImports.filter((imported) => 'localName' in imported && imported.localName === bindingName);
+            const rank = (imported) => imported.declaredAtScope === undefined
+                ? Infinity
+                : (scopeRanks.get(imported.declaredAtScope) ?? Infinity);
+            const nearest = aliases.length > 0 ? Math.min(...aliases.map(rank)) : Infinity;
+            let localTypeRank = Infinity;
+            for (const [scopeId, depth] of scopeRanks) {
+                const bindings = scopeLookupByFile
+                    .get(ctx.callerParsed)
+                    ?.get(scopeId)
+                    ?.bindings.get(bindingName);
+                if (bindings?.some((binding) => binding.origin === 'local' && RUST_TYPE_NAMESPACE_KINDS.has(binding.def.type))) {
+                    localTypeRank = depth;
+                    break;
+                }
+            }
+            // A local module/type shadows the extern prelude, but a nearer import
+            // can shadow that declaration. Value-namespace functions do not block it.
+            if (localTypeRank !== Infinity && localTypeRank <= nearest)
+                continue;
+            if (aliases.length > 0) {
+                const destinations = new Set(aliases
+                    .filter((imported) => rank(imported) === nearest)
+                    .map((imported) => imported.targetRaw));
+                if (destinations.size !== 1)
+                    continue;
+                const destination = [...destinations][0];
+                if (destination !== bindingName) {
+                    pending.push([destination, ...parts.slice(1)].join('::'));
+                    continue;
+                }
+            }
+            // A root FILE can also contain inline modules. Its Cargo identity names
+            // the crate, while the scope model supplies the member's module suffix.
+            if (rustImportNamesCargoRoot(ctx.resolutionConfig, ctx.callerParsed.filePath, ctx.candidate.filePath, head)) {
+                if (exportModules.has(parts.slice(1).join('::')))
+                    return 'root';
+                continue;
+            }
+            if (!entryOnly &&
+                rustImportReachesCargoTarget(ctx.resolutionConfig, ctx.callerParsed.filePath, ctx.candidate.filePath, name))
+                return 'module';
+        }
+        return false;
+    };
+    for (const imp of visibleImports) {
+        let importedRoot = false;
         // `crate::` is the caller's crate. A same trailing module in another
         // workspace crate is a different item and cannot authorize the guess.
         if (imp.targetRaw === 'crate' || imp.targetRaw.startsWith('crate::')) {
+            if (sharesTarget === false)
+                continue;
             const callerRoot = rustCrateRootOf(ctx.callerParsed.filePath);
             const candidateRoot = rustCrateRootOf(ctx.candidate.filePath);
-            if (callerRoot !== '' && candidateRoot !== '' && callerRoot !== candidateRoot)
+            if (sharesTarget === undefined &&
+                callerRoot !== '' &&
+                candidateRoot !== '' &&
+                callerRoot !== candidateRoot)
+                continue;
+        }
+        if (sharesTarget === false) {
+            const module = imp.kind === 'wildcard'
+                ? imp.targetRaw
+                : imp.targetRaw.slice(0, Math.max(0, imp.targetRaw.lastIndexOf('::')));
+            const reached = namesCandidateRoot(module, separateRoot);
+            if (!reached)
                 continue;
+            importedRoot = reached === 'root';
         }
         const usePath = rustUsePathOf(imp.targetRaw, ctx.callerParsed.filePath);
         // Only a glob introduces every bare item of a module. A named import must
         // match both the candidate's original name and the call's local spelling.
         if (imp.kind === 'wildcard') {
-            if (modulePathReaches(usePath, candidateModule))
+            if (importedRoot || candidateModule === '' || modulePathReaches(usePath, candidateModule))
                 return true;
             continue;
         }
@@ -147,9 +281,14 @@ export function rustIsGlobalNameFallbackPlausible(ctx) {
         // An alias authorizes only the local spelling checked above.
         if (importedNameOf(imp) !== candidateName)
             continue;
+        // A different target may import the library crate's root exports. Even
+        // when that root has no path segment to compare, a named import must name
+        // THIS callable: `use std::fmt` cannot revive a rejected `crate::helper`.
+        const parent = usePath.slice(0, Math.max(0, usePath.lastIndexOf('::')));
+        if (importedRoot || candidateModule === '')
+            return true;
         if (modulePathReaches(usePath, candidateModule))
             return true;
-        const parent = usePath.slice(0, Math.max(0, usePath.lastIndexOf('::')));
         if (parent !== '' && modulePathReaches(parent, candidateModule))
             return true;
     }

package/dist/core/ingestion/languages/rust/scope-resolver.js

@@ -10,6 +10,7 @@ import { isClassLike, findClassBindingInScope, resolveAmbiguousInheritanceBaseVi
 import { resolveDefGraphId } from '../../scope-resolution/graph-bridge/ids.js';
 import { generateId } from '../../../../lib/utils.js';
 import { rustIsGlobalNameFallbackPlausible } from './name-fallback-visibility.js';
+import { loadRustCargoTargets } from './cargo-targets.js';
 /**
  * Emit Rust `S IMPLEMENTS T` edges from `impl T for S` trait implementations.
  *
@@ -131,6 +132,7 @@ export const rustScopeResolver = {
     language: SupportedLanguages.Rust,
     languageProvider: rustProvider,
     importEdgeReason: 'rust-scope: use',
+    loadResolutionConfig: loadRustCargoTargets,
     resolveImportTarget: (targetRaw, fromFile, allFilePaths, resolutionConfig) => resolveRustImportTarget(targetRaw, fromFile, allFilePaths, resolutionConfig),
     mergeBindings: (existing, incoming, scopeId) => rustMergeBindings(existing, incoming, scopeId),
     arityCompatibility: (callsite, def) => rustArityCompatibility(def, callsite),

package/dist/core/ingestion/scope-resolution/contract/scope-resolver.d.ts

@@ -819,6 +819,8 @@ export interface ScopeResolver {
     readonly isGlobalNameFallbackPlausible?: (ctx: {
         readonly callerParsed: ParsedFile;
         readonly candidate: SymbolDefinition;
+        /** Opaque workspace metadata from this provider's loadResolutionConfig. */
+        readonly resolutionConfig?: unknown;
         readonly parsedFileOf: (filePath: string) => ParsedFile | undefined;
         /**
          * Raw source of any parsed file, for languages whose visibility rule needs

package/dist/core/ingestion/scope-resolution/passes/free-call-fallback.d.ts

@@ -37,6 +37,7 @@ export declare function emitFreeCallFallback(graph: KnowledgeGraph, scopes: Scop
     /** Per-language veto on a name guess — see
      *  `ScopeResolver.isGlobalNameFallbackPlausible`. */
     readonly isGlobalNameFallbackPlausible?: ScopeResolver['isGlobalNameFallbackPlausible'];
+    readonly resolutionConfig?: unknown;
     /** Raw source lookup handed to `isGlobalNameFallbackPlausible` (optional). */
     readonly sourceTextOf?: (filePath: string) => string | undefined;
     /** When true, `Type(...)` constructor calls link to the Class def

package/dist/core/ingestion/scope-resolution/passes/free-call-fallback.js

@@ -469,6 +469,7 @@ export function emitFreeCallFallback(graph, scopes, parsedFiles, nodeLookup, _re
                     options.isGlobalNameFallbackPlausible?.({
                         callerParsed: parsed,
                         candidate: vetoCandidate,
+                        resolutionConfig: options.resolutionConfig,
                         parsedFileOf: parsedFileByPath(),
                         sourceTextOf: options.sourceTextOf,
                         site: {

package/dist/core/ingestion/scope-resolution/pipeline/run.js

@@ -695,6 +695,7 @@ export function runScopeResolution(input, provider) {
             allowGlobalFallback: provider.allowGlobalFreeCallFallback === true,
             language: provider.language,
             isGlobalNameFallbackPlausible: provider.isGlobalNameFallbackPlausible,
+            resolutionConfig,
             sourceTextOf: provider.isGlobalNameFallbackPlausible !== undefined
                 ? (filePath) => getFileContents().get(filePath)
                 : undefined,

package/dist/storage/parse-cache.js

@@ -758,7 +758,13 @@ import { copyV8CacheIfPresent, tryLoadV8Cache, writeV8CacheFile } from './v8-sid
 // #3190. Old durable ParsedFiles lack the facts needed for scoped binding;
 // invalidate both stores so warm indexing actually applies the correction.
 // origin/main took 98 for #3219; 99 is the next free value.
-const SCHEMA_BUMP = 99;
+// v100 (#3253): Rust import captures preserve the leading `::` that selects
+// the extern prelude. Old warm captures erase it and cannot distinguish an
+// absolute library import from a same-named local module. Reparse both stores.
+// v101 (#3294 review): Rust bare-keyword glob imports retain crate/self/super
+// instead of an empty target path; restricted pub(...) imports are no longer
+// captured as unrestricted reexports. Re-extract both facts on warm indexes.
+const SCHEMA_BUMP = 101;
 const GITNEXUS_PKG_VERSION = (() => {
     try {
         // package.json sits at gitnexus/package.json — two levels up from

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gitnexus",
-  "version": "1.6.13-rc.7",
+  "version": "1.6.13-rc.8",
   "description": "Graph-powered code intelligence for AI agents. Index any codebase, query via MCP or CLI.",
   "author": "Abhigyan Patwari",
   "license": "PolyForm-Noncommercial-1.0.0",
@@ -92,6 +92,7 @@
     "pino": "^10.3.1",
     "pino-pretty": "^13.1.3",
     "proxy-addr": "^2.0.7",
+    "smol-toml": "^1.8.0",
     "tree-sitter": "0.21.1",
     "tree-sitter-c-sharp": "0.23.1",
     "tree-sitter-cpp": "0.23.2",

package/scripts/cross-platform-tests.ts

@@ -305,6 +305,9 @@ const NATIVE_ADDON_SMOKE = [
 // Filesystem behavior tests — exercise operations that vary across
 // platforms (CRLF, symlinks, permissions, temp dirs)
 const FILESYSTEM = [
+  // Cargo membership uses path normalization, descriptor validation, symlinks,
+  // and Rust native parsing (including long Windows source strings).
+  'test/unit/scope-resolution/rust-cargo-targets.test.ts',
   // The durable ParsedFile store's prune tolerates a chunk directory it cannot
   // delete (#3204). The failures that motivate it — held handles, read-only
   // mounts — are Windows- and macOS-flavored, and the permission-based case