weavatrix 0.1.2 → 0.1.4

package/src/analysis/internal-audit.reach.js

@@ -1,6 +1,7 @@
 // internal-audit.reach.js — entry-point discovery + file-level reachability BFS for the internal
 // audit. Split from internal-audit.js.
-import { ENTRY_FILE } from "./dead-check.js";
+import { posix } from "node:path";
+import { ENTRY_FILE, isFrameworkEntryFile } from "./dead-check.js";
 import { TEST_FILE_RE } from "./internal-audit.collect.js";
 
 const isFileNode = (n) => !String(n.id).includes("#");
@@ -8,20 +9,60 @@ const isFileNode = (n) => !String(n.id).includes("#");
 // Entry set for reachability: conventional entry names + package.json main/module/browser/bin/exports +
 // html pages (they root classic-script apps) + test files (the runner enters them) + root config files +
 // dynamic-import targets. Anything reachable from here is "used"; the rest corroborates unused-file.
-export function entryFiles(graph, pkg, dynamicTargets) {
+export function entryFiles(graph, pkgOrScopes, dynamicTargets = new Set(), { declaredEntries = [], sources = new Map() } = {}) {
   const entries = new Set();
-  const pkgEntries = [];
-  for (const k of ["main", "module", "browser"]) if (typeof pkg[k] === "string") pkgEntries.push(pkg[k]);
-  if (pkg.bin) pkgEntries.push(...(typeof pkg.bin === "string" ? [pkg.bin] : Object.values(pkg.bin)));
-  (function walkExports(e) {
-    if (typeof e === "string") pkgEntries.push(e);
-    else if (e && typeof e === "object") Object.values(e).forEach(walkExports);
-  })(pkg.exports);
-  const pe = new Set(pkgEntries.map((p) => String(p).replace(/^\.\//, "").replace(/\\/g, "/")));
+  const scopes = Array.isArray(pkgOrScopes)
+    ? pkgOrScopes
+    : [{ root: "", manifest: "package.json", pkg: pkgOrScopes || {} }];
+  const fileSet = new Set((graph.nodes || []).filter(isFileNode).map((n) => String(n.source_file || n.id).replace(/\\/g, "/")));
+  const pe = new Set();
+  const resolveEntry = (root, raw) => {
+    let p = String(raw || "").trim().replace(/^['"]|['"]$/g, "").replace(/^file:/, "").replace(/\\/g, "/");
+    if (!p || p.startsWith("-") || /^https?:/.test(p)) return "";
+    p = p.replace(/^\.\//, "");
+    const joined = posix.normalize(root ? posix.join(root, p) : p).replace(/^\.\//, "");
+    if (fileSet.has(joined)) return joined;
+    for (const ext of [".js", ".mjs", ".cjs", ".ts", ".tsx", ".jsx", ".py"]) if (fileSet.has(joined + ext)) return joined + ext;
+    return joined;
+  };
+  for (const scope of scopes) {
+    const pkg = scope.pkg || {};
+    const root = String(scope.root || "").replace(/\\/g, "/").replace(/^\/+|\/+$/g, "");
+    const pkgEntries = [];
+    for (const k of ["main", "module", "browser"]) if (typeof pkg[k] === "string") pkgEntries.push(pkg[k]);
+    if (pkg.bin) pkgEntries.push(...(typeof pkg.bin === "string" ? [pkg.bin] : Object.values(pkg.bin)));
+    (function walkExports(e) {
+      if (typeof e === "string") pkgEntries.push(e);
+      else if (e && typeof e === "object") Object.values(e).forEach(walkExports);
+    })(pkg.exports);
+    // Script commands are external entry surfaces. Extract only path-shaped source tokens; package names,
+    // flags and shell operators are intentionally ignored.
+    for (const script of Object.values(pkg.scripts || {})) {
+      const re = /(?:^|[\s'"=])((?:\.?\.?\/)?[\w@./-]+\.(?:[cm]?[jt]sx?|py|go))(?=$|[\s'";,)&|])/gi;
+      let m;
+      while ((m = re.exec(String(script)))) pkgEntries.push(m[1]);
+      const runner = /\b(?:node|bun|deno|tsx|ts-node|python\d*|electron)\s+(?!-)([\w@./\\-]+)/gi;
+      while ((m = runner.exec(String(script)))) if (/[./\\]/.test(m[1])) pkgEntries.push(m[1]);
+    }
+    for (const p of pkgEntries) pe.add(resolveEntry(root, p));
+  }
   for (const n of graph.nodes || []) {
     if (!isFileNode(n)) continue;
     const f = n.source_file;
-    if (ENTRY_FILE.test(f) || TEST_FILE_RE.test(f) || /\.html?$/i.test(f) || pe.has(f) || /(^|\/)[^/]*\.config\.[a-z]+$/i.test(f)) entries.add(f);
+    if (ENTRY_FILE.test(f) || isFrameworkEntryFile(f) || /\.d\.[cm]?ts$/i.test(f) || TEST_FILE_RE.test(f) || /\.html?$/i.test(f) || pe.has(f) || /(^|\/)[^/]*\.config\.[a-z]+$/i.test(f)) entries.add(f);
+  }
+  for (const raw of Array.isArray(declaredEntries) ? declaredEntries : [declaredEntries]) {
+    const resolved = resolveEntry("", raw);
+    if (resolved && fileSet.has(resolved)) entries.add(resolved);
+  }
+  // Bundled helper programs are often launched by filename (`resolveResource("worker.py")`) rather than
+  // imported. A quoted basename reference from another source file is enough to establish that a code file
+  // under resources/ is a runtime entry, without treating arbitrary prose/config files as roots.
+  for (const file of fileSet) {
+    if (!/(^|\/)resources\/.*\.(?:py|[cm]?[jt]s)$/i.test(file)) continue;
+    const base = posix.basename(file).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const quoted = new RegExp(`["'\x60]${base}["'\x60]`);
+    if ([...sources].some(([other, text]) => other !== file && quoted.test(String(text || "")))) entries.add(file);
   }
   for (const t of dynamicTargets) entries.add(t);
   return entries;

package/src/analysis/internal-audit.run.js

@@ -4,19 +4,19 @@
 import { existsSync } from "node:fs";
 import { join, basename } from "node:path";
 import { computeDead, computeUnusedExports } from "./dead-check.js";
-import { computeDepFindings, computeGoDepFindings, computePyDepFindings } from "./dep-check.js";
+import { computeScopedDepFindings, computeGoDepFindings, computePyDepFindings } from "./dep-check.js";
 import { parseGoMod } from "./manifests.js";
 import { computeStructureFindings } from "./dep-rules.js";
 import { makeFinding, summarizeFindings, sortFindings } from "./findings.js";
 import { graphOutDirForRepo } from "../graph/layout.js";
 import { collectInstalled } from "../security/installed.js";
-import { loadStore, queryStore } from "../security/advisory-store.js";
+import { loadStore, queryStore, advisoryQueryFingerprint } from "../security/advisory-store.js";
 import { matchAdvisories } from "../security/match.js";
 import { scanMalware } from "../security/malware-heuristics.js";
 import { classifyTyposquat } from "../security/typosquat.js";
 import {
   readJson, readRepoText, readRepoJson, collectSourceTexts, collectConfigTexts, workspacePkgNames,
-  collectPyManifest, TEST_FILE_RE,
+  collectPackageScopes, collectPyManifest, collectNonRuntimeRoots, TEST_FILE_RE,
 } from "./internal-audit.collect.js";
 import { entryFiles, computeReachability } from "./internal-audit.reach.js";
 import { createRepoBoundary } from "../repo-path.js";
@@ -33,26 +33,48 @@ export async function runInternalAudit(repoPath, { graph, advisoryStorePath, ski
     if (!graph) return { ok: false, error: "Build the graph first (no graph.json)" };
   }
   const pkg = readRepoJson(boundary, "package.json") || {};
+  const packageScopes = collectPackageScopes(repoPath, pkg);
   const externalImports = graph.externalImports || [];
   const dynamicTargets = new Set(externalImports.filter((e) => e.dynamic && e.target).map((e) => e.target));
+  const rules = readRepoJson(boundary, ".weavatrix-deps.json") || {};
 
   // Graphs can be stale or miss a helper file; text fallbacks must scan the real repo tree too.
   const sources = collectSourceTexts(repoPath, graph);
+  const nonRuntimeRoots = collectNonRuntimeRoots(repoPath, rules);
 
-  const dead = computeDead(graph, sources);
-  const unusedExports = computeUnusedExports(graph, sources, { dynamicTargets });
-  const entries = entryFiles(graph, pkg, dynamicTargets);
+  const entries = entryFiles(graph, packageScopes, dynamicTargets, {
+    declaredEntries: rules.entrypoints || rules.entries || [],
+    sources,
+  });
+  for (const file of sources.keys()) {
+    if (nonRuntimeRoots.some((root) => file === root || file.startsWith(`${root}/`))) entries.add(file);
+  }
+  const dead = computeDead(graph, sources, { entrySet: entries });
+  const unusedExports = computeUnusedExports(graph, sources, { dynamicTargets, entrySet: entries });
   const reachable = computeReachability(graph, entries);
   const configTexts = collectConfigTexts(repoPath);
-  const dep = computeDepFindings({ externalImports, pkg, workspacePkgNames: workspacePkgNames(repoPath, pkg), configTexts });
+  const dep = computeScopedDepFindings({ externalImports, packageScopes, workspacePkgNames: workspacePkgNames(repoPath, pkg), configTexts, nonRuntimeRoots });
   // non-npm ecosystems: Go (go.mod) + Python (requirements/pyproject/Pipfile) — same findings shape
   const goModText = readRepoText(boundary, "go.mod");
-  const goDep = computeGoDepFindings({ externalImports, goMod: goModText != null ? parseGoMod(goModText) : null });
-  const pyDep = computePyDepFindings({ externalImports, pyManifest: collectPyManifest(repoPath), configTexts });
+  const goDep = computeGoDepFindings({ externalImports, goMod: goModText != null ? parseGoMod(goModText) : null, nonRuntimeRoots });
+  const asList = (v) => Array.isArray(v) ? v : typeof v === "string" ? [v] : [];
+  const pyRules = rules.python || {};
+  const depRules = rules.dependencies || {};
+  const managedPython = [...new Set([
+    ...asList(rules.managedPythonDependencies), ...asList(pyRules.managed), ...asList(pyRules.managedDependencies),
+    ...asList(depRules.managedPython),
+  ])];
+  const ignoredPython = [...new Set([
+    ...asList(rules.ignorePythonDependencies), ...asList(pyRules.ignore), ...asList(pyRules.ignoreDependencies),
+    ...asList(depRules.ignorePython),
+  ])];
+  const pyDep = computePyDepFindings({
+    externalImports, pyManifest: collectPyManifest(repoPath), configTexts,
+    managedDependencies: managedPython, ignoredDependencies: ignoredPython, nonRuntimeRoots,
+  });
 
   // structure: cycles / orphans / boundary rules. Rules come from the repo's optional .weavatrix-deps.json
   // (the depcruise-config analogue); no bundled default rules — cycles+orphans are always on.
-  const rules = readRepoJson(boundary, ".weavatrix-deps.json") || {};
   const externalImportFiles = new Set(externalImports.filter((e) => e.pkg && !e.builtin).map((e) => e.file));
   const structure = computeStructureFindings(graph, { rules, entrySet: entries, externalImportFiles });
 
@@ -61,7 +83,7 @@ export async function runInternalAudit(repoPath, { graph, advisoryStorePath, ski
   const deadFileSet = new Set(dead.deadFiles.map((f) => f.file));
   for (const f of structure.findings) if (!(f.rule === "orphan-file" && deadFileSet.has(f.file))) findings.push(f);
   for (const f of dead.deadFiles) {
-    if (dynamicTargets.has(f.file) || TEST_FILE_RE.test(f.file)) continue;
+    if (entries.has(f.file) || dynamicTargets.has(f.file) || TEST_FILE_RE.test(f.file)) continue;
     findings.push(makeFinding({
       category: "unused",
       rule: "unused-file",
@@ -75,6 +97,7 @@ export async function runInternalAudit(repoPath, { graph, advisoryStorePath, ski
       fixHint: "review, then delete the file",
     }));
   }
+  let unusedExportCount = 0;
   for (const s of unusedExports) {
     if (s.test) continue; // exports from test files are runner-visible noise
     if (/(^|\/)[^/]*\.config\.[a-z0-9]+$|(^|\/)\.[^/]+rc(\.[a-z]+)?$/i.test(s.file)) continue; // config exports are consumed by their tool
@@ -90,6 +113,7 @@ export async function runInternalAudit(repoPath, { graph, advisoryStorePath, ski
       graphNodeId: s.id,
       source: "internal",
     }));
+    unusedExportCount++;
   }
 
   // ---- supply-chain: installed packages × cached OSV advisories. 100% OFFLINE here — the cache is
@@ -97,14 +121,31 @@ export async function runInternalAudit(repoPath, { graph, advisoryStorePath, ski
   let advisoryDbDate = null;
   let installedCount = 0;
   let inst = { installed: [], drift: [] };
+  const checks = {
+    osv: { status: "NOT_CHECKED", detail: "Advisory cache was never refreshed for this repository. The refresh_advisories tool belongs to the optional online capability group: enable that group in the MCP registration, then call the tool explicitly to opt in to sending pinned package names and versions to OSV.dev." },
+    malware: { status: skipMalwareScan ? "NOT_CHECKED" : "PENDING", detail: skipMalwareScan ? "Installed-package malware scan is opt-in and was not requested." : "" },
+  };
   try {
     inst = collectInstalled(repoPath);
     installedCount = inst.installed.length;
     const store = advisoryStorePath ? loadStore(advisoryStorePath) : loadStore();
-    // per-repo date when the store tracks it (cache only covers QUERIED packages); legacy stores
-    // without the repos map keep the old global-date behavior
-    advisoryDbDate = store.meta?.repos ? store.meta.repos[repoPath] || null : store.meta?.fetched_at || null;
+    // Only a per-repo stamp proves that this repository's installed versions were queried. A legacy
+    // global fetched_at may belong to another repo and must never certify this one as clean.
+    const repoStamp = store.meta?.repos?.[repoPath] || null;
+    advisoryDbDate = typeof repoStamp === "string" ? repoStamp : repoStamp?.fetched_at || null;
     if (advisoryDbDate) {
+      let status = typeof repoStamp === "object" && ["OK", "PARTIAL", "ERROR"].includes(repoStamp.status) ? repoStamp.status : "PARTIAL";
+      const fingerprintMatches = typeof repoStamp === "object" && repoStamp.query_fingerprint === advisoryQueryFingerprint(inst.installed);
+      if (!fingerprintMatches && status === "OK") status = "PARTIAL";
+      const coverage = typeof repoStamp === "object" && Number.isFinite(repoStamp.queried)
+        ? ` (${repoStamp.queried_ok ?? repoStamp.queried}/${repoStamp.queried} package versions queried successfully)`
+        : "";
+      const drift = fingerprintMatches ? "" : " Dependency versions changed, or this is a legacy stamp without a package fingerprint; enable the optional online capability group and call refresh_advisories for complete coverage.";
+      checks.osv = {
+        status,
+        detail: `${status === "PARTIAL" ? "Partially matched" : "Matched"} installed packages against the cached OSV snapshot from ${advisoryDbDate}${coverage}.${drift}`,
+        checkedAt: advisoryDbDate,
+      };
       for (const h of matchAdvisories(inst.installed, (eco, name) => queryStore(store, eco, name))) {
         const mal = h.adv.kind === "malicious";
         findings.push(makeFinding({
@@ -123,7 +164,8 @@ export async function runInternalAudit(repoPath, { graph, advisoryStorePath, ski
       }
     }
     // direct-dependency typosquat (dev-chosen names, small set → low FP): surface quietly even alone.
-    for (const name of Object.keys({ ...(pkg.dependencies || {}), ...(pkg.devDependencies || {}) })) {
+    const directDependencyNames = new Set(packageScopes.flatMap((s) => Object.keys({ ...(s.pkg?.dependencies || {}), ...(s.pkg?.devDependencies || {}) })));
+    for (const name of directDependencyNames) {
       const sq = classifyTyposquat(name);
       if (!sq) continue;
       findings.push(makeFinding({
@@ -152,7 +194,9 @@ export async function runInternalAudit(repoPath, { graph, advisoryStorePath, ski
         fixHint: "npm ci (clean install from the lockfile)",
       }));
     }
-  } catch { /* supply-chain layer is best-effort */ }
+  } catch (error) {
+    checks.osv = { status: "ERROR", detail: `Offline advisory matching failed: ${error instanceof Error ? error.message : String(error)}` };
+  }
 
   // ---- malware heuristics: install-script beacons / miners / exfil / obfuscation across installed libs.
   // Local + offline (ripgrep or a bounded Node fallback). Scans node_modules, Python venvs, Go vendor/cache.
@@ -163,7 +207,10 @@ export async function runInternalAudit(repoPath, { graph, advisoryStorePath, ski
       const scan = await scanMalware(repoPath, { installed: inst.installed, importedPkgs, malwareExclusions, rgPath });
       findings.push(...scan.findings);
       malwareScan = { scanMode: scan.scanMode, packagesScanned: scan.packagesScanned, findings: scan.findings.length, excludedSignals: scan.excludedSignals || 0 };
-    } catch { /* heuristic scan is best-effort */ }
+      checks.malware = { status: "OK", detail: `Scanned ${scan.packagesScanned} installed package(s) using ${scan.scanMode}.` };
+    } catch (error) {
+      checks.malware = { status: "ERROR", detail: `Installed-package malware scan failed: ${error instanceof Error ? error.message : String(error)}` };
+    }
   }
 
   const sorted = sortFindings(findings);
@@ -181,12 +228,18 @@ export async function runInternalAudit(repoPath, { graph, advisoryStorePath, ski
       nodeModulesPresent: boundary.resolve("node_modules").ok,
       installedPackages: installedCount,
       advisoryDbDate,
+      advisoryStatus: checks.osv.status,
       malwareScanMode: malwareScan?.scanMode || "skipped",
+      malwareStatus: checks.malware.status,
+      packageScopes: packageScopes.length,
+      managedPythonDependencies: managedPython.length,
+      nonRuntimeRoots,
     },
     summary: summarizeFindings(sorted),
     findings: sorted,
-    deadReport: { deadSymbols: dead.deadSymbols.length, deadFiles: dead.deadFiles.length, unusedExports: unusedExports.length },
+    deadReport: { deadSymbols: dead.deadSymbols.length, deadFiles: dead.deadFiles.length, unusedExports: unusedExportCount },
     structureReport: structure.stats,
+    checks,
     malwareScan,
   };
 }

package/src/graph/builder/lang-java.js

@@ -1,29 +1,192 @@
-// Java extractor. Symbols: class/interface/enum + method/constructor + fields.
-// Imports: `import a.b.C;` → the C.java file (package path = dir; suffix-matched). Calls: `x.method()` /
-// `method()` (name only). Heritage: `extends` + `implements`.
-const SYMS = `
+// Java extractor. Keeps file-level imports/calls while modelling the Java ownership and type system:
+// classes/interfaces/enums/records own their methods, heritage distinguishes extends from implements,
+// and project-local type references resolve to the declaration node (never to synthetic type-name nodes).
+const TYPE_CORE = `
   (class_declaration name: (identifier) @class)
-  (interface_declaration name: (identifier) @class)
-  (enum_declaration name: (identifier) @class)
+  (interface_declaration name: (identifier) @interface)
+  (enum_declaration name: (identifier) @enum)`;
+// Keep grammar-version-dependent declarations separate: one unknown node type invalidates a whole query.
+const TYPE_OPTIONAL = [
+  `(record_declaration name: (identifier) @record)`,
+  `(annotation_type_declaration name: (identifier) @annotation)`,
+];
+const MEMBERS = `
   (method_declaration name: (identifier) @method)
-  (constructor_declaration name: (identifier) @method)
+  (constructor_declaration name: (identifier) @constructor)
   (field_declaration declarator: (variable_declarator name: (identifier) @field))`;
 
+const TYPE_DECLARATIONS = new Set([
+  "class_declaration", "interface_declaration", "enum_declaration",
+  "record_declaration", "annotation_type_declaration",
+]);
+const FIELD_DECLARATIONS = new Set(["field_declaration"]);
+
+const ancestor = (node, accepted) => {
+  let current = node?.parent;
+  for (let hops = 0; current && hops < 12; hops++, current = current.parent) {
+    if (accepted.has(current.type)) return current;
+  }
+  return null;
+};
+
+const visibilityOf = (declaration, owner) => {
+  const modifiers = declaration?.namedChildren?.find((node) => node.type === "modifiers")?.text || "";
+  if (/\bprivate\b/.test(modifiers)) return "private";
+  if (/\bprotected\b/.test(modifiers)) return "protected";
+  if (/\bpublic\b/.test(modifiers)) return "public";
+  if (["interface_declaration", "annotation_type_declaration"].includes(owner?.type)) return "public";
+  return "package";
+};
+
+const lineOf = (node) => node.startPosition.row + 1;
+const symbolBaseId = (fileRel, nameNode) => `${fileRel}#${nameNode.text}@${lineOf(nameNode)}`;
+const declarationKey = (node) => `${node?.startIndex ?? -1}:${node?.endIndex ?? -1}`;
+const exactJavaTarget = (resolveJavaImport, parts) => {
+  const target = resolveJavaImport(parts);
+  const suffix = parts.join("/") + ".java";
+  return target && (target === suffix || target.endsWith("/" + suffix)) ? target : null;
+};
+
 export default {
   family: "java",
   grammars: ["java"],
   exts: { ".java": "java" },
   isWeb: false,
   calls: `(method_invocation name: (identifier) @callee)`,
-  heritage: [`(superclass (type_identifier) @super)`, `(super_interfaces (type_list (type_identifier) @super))`],
+  // Capturing the base type_identifier (rather than the whole generic/scoped type) gives the shared
+  // resolver the imported/local declaration name. Each query is deliberately non-overlapping.
+  heritage: [
+    { relation: "inherits", query: `(superclass (type_identifier) @super)` },
+    { relation: "inherits", query: `(superclass (generic_type (type_identifier) @super))` },
+    { relation: "inherits", query: `(superclass (scoped_type_identifier name: (type_identifier) @super))` },
+    { relation: "inherits", query: `(superclass (generic_type (scoped_type_identifier name: (type_identifier) @super)))` },
+    { relation: "inherits", query: `(extends_interfaces (type_list (type_identifier) @super))` },
+    { relation: "inherits", query: `(extends_interfaces (type_list (generic_type (type_identifier) @super)))` },
+    { relation: "inherits", query: `(extends_interfaces (type_list (scoped_type_identifier name: (type_identifier) @super)))` },
+    { relation: "inherits", query: `(extends_interfaces (type_list (generic_type (scoped_type_identifier name: (type_identifier) @super))))` },
+    { relation: "implements", query: `(super_interfaces (type_list (type_identifier) @super))` },
+    { relation: "implements", query: `(super_interfaces (type_list (generic_type (type_identifier) @super)))` },
+    { relation: "implements", query: `(super_interfaces (type_list (scoped_type_identifier name: (type_identifier) @super)))` },
+    { relation: "implements", query: `(super_interfaces (type_list (generic_type (scoped_type_identifier name: (type_identifier) @super))))` },
+  ],
 
   pass1(ctx) {
-    const { grammar, tree, caps, addSym, addImportEdge, imports, resolveJavaImport } = ctx;
-    for (const cap of caps(grammar, SYMS, tree.rootNode)) addSym(cap.node.text, cap.node.startPosition.row + 1, cap.name === "method", { sourceNode: cap.node.parent });
-    for (const cap of caps(grammar, `(import_declaration (scoped_identifier) @imp)`, tree.rootNode)) {
-      const parts = cap.node.text.split("."); const cls = parts[parts.length - 1];
-      const tgt = resolveJavaImport(parts); if (!tgt) continue;
-      addImportEdge(tgt); imports.set(cls, { imported: "*", targetFile: tgt });
+    const {
+      grammar, tree, fileRel, caps, field, addSym, addImportEdge, imports,
+      resolveJavaImport, fileSet, links, nodeIds,
+    } = ctx;
+    const ownerIds = new Map();
+    const addJavaSym = (nameNode, callable, extra) => {
+      const base = symbolBaseId(fileRel, nameNode);
+      // Compact/generated Java can put an owner, constructor and overloads with the same name on one
+      // line. Preserve historical IDs normally; disambiguate only an actual collision by source column.
+      const id = nodeIds.has(base) ? `${base}:c${nameNode.startPosition.column + 1}` : base;
+      addSym(nameNode.text, lineOf(nameNode), callable, {
+        ...extra,
+        ...(id === base ? {} : { idSuffix: id.slice(base.length) }),
+      });
+      return nodeIds.has(id) ? id : null;
+    };
+
+    // Add owners first even though tree-sitter captures are source-ordered. This makes ownership edges
+    // deterministic for nested types and methods declared before/after other nested declarations.
+    for (const src of [TYPE_CORE, ...TYPE_OPTIONAL]) {
+      for (const cap of caps(grammar, src, tree.rootNode)) {
+        const declaration = cap.node.parent;
+        const id = addJavaSym(cap.node, false, {
+          sourceNode: cap.node.parent,
+          symbolKind: cap.name,
+        });
+        if (id) ownerIds.set(declarationKey(declaration), id);
+      }
+    }
+
+    for (const cap of caps(grammar, MEMBERS, tree.rootNode)) {
+      const declaration = cap.name === "field" ? ancestor(cap.node, FIELD_DECLARATIONS) : cap.node.parent;
+      const owner = ancestor(cap.node, TYPE_DECLARATIONS);
+      const ownerNameNode = owner && field(owner, "name");
+      const memberKind = cap.name === "constructor" ? "constructor" : cap.name;
+      const memberId = addJavaSym(cap.node, cap.name !== "field", {
+        sourceNode: declaration,
+        symbolKind: memberKind,
+        ...(ownerNameNode ? { memberOf: ownerNameNode.text } : {}),
+        visibility: visibilityOf(declaration, owner),
+      });
+      if (!ownerNameNode || cap.name === "field") continue;
+      const ownerId = ownerIds.get(declarationKey(owner));
+      if (ownerId && memberId && ownerId !== memberId) {
+        links.push({ source: ownerId, target: memberId, relation: "method", confidence: "EXTRACTED" });
+      }
+    }
+
+    const wildcardPackages = [];
+    const staticWildcardTargets = [];
+    const importStatements = caps(grammar, `(import_declaration) @imp`, tree.rootNode);
+    for (const cap of importStatements) {
+      const match = cap.node.text.match(/^\s*import\s+(static\s+)?([\w.]+?)(\.\*)?\s*;?\s*$/);
+      if (!match) continue;
+      const isStatic = !!match[1];
+      const parts = match[2].split(".").filter(Boolean);
+      const wildcard = !!match[3];
+      const line = lineOf(cap.node);
+      if (!isStatic && wildcard) {
+        wildcardPackages.push(parts);
+        continue;
+      }
+      if (!isStatic) {
+        const target = exactJavaTarget(resolveJavaImport, parts);
+        if (!target) continue;
+        const local = parts[parts.length - 1];
+        addImportEdge(target, { line, specifier: parts.join("."), compileOnly: true });
+        imports.set(local, { imported: local, targetFile: target });
+        continue;
+      }
+
+      // Static imports end in a member name. Walk prefixes until the declaring project class resolves.
+      let target = null; let classParts = null;
+      const max = wildcard ? parts.length : parts.length - 1;
+      for (let take = max; take > 0 && !target; take--) {
+        const candidate = parts.slice(0, take);
+        target = exactJavaTarget(resolveJavaImport, candidate);
+        if (target) classParts = candidate;
+      }
+      if (!target) continue;
+      addImportEdge(target, { line, specifier: `${isStatic ? "static " : ""}${parts.join(".")}${wildcard ? ".*" : ""}`, compileOnly: true });
+      if (wildcard) staticWildcardTargets.push(target);
+      else {
+        const member = parts[classParts.length];
+        if (member) imports.set(member, { imported: member, targetFile: target });
+      }
+    }
+
+    // Seed the shared pass-2 resolver with Java's implicit same-package types and wildcard imports.
+    // Exact-path validation is important: the general basename fallback is useful for explicit imports,
+    // but must not bind an unimported Foo to an unrelated package's Foo.java.
+    const slash = fileRel.lastIndexOf("/");
+    const ownDir = slash < 0 ? "" : fileRel.slice(0, slash);
+    const bindType = (name) => {
+      if (!name || imports.has(name)) return;
+      const samePackage = `${ownDir ? ownDir + "/" : ""}${name}.java`;
+      if (fileSet.has(samePackage)) {
+        imports.set(name, { imported: name, targetFile: samePackage });
+        return;
+      }
+      for (const pkg of wildcardPackages) {
+        const target = exactJavaTarget(resolveJavaImport, [...pkg, name]);
+        if (target) { imports.set(name, { imported: name, targetFile: target }); return; }
+      }
+    };
+    for (const cap of caps(grammar, `(type_identifier) @type`, tree.rootNode)) bindType(cap.node.text);
+    for (const cap of caps(grammar, `(scoped_type_identifier) @type`, tree.rootNode)) {
+      const parts = cap.node.text.split(".").filter(Boolean);
+      const target = exactJavaTarget(resolveJavaImport, parts);
+      const name = parts[parts.length - 1];
+      if (target && name && !imports.has(name)) imports.set(name, { imported: name, targetFile: target });
+    }
+    if (staticWildcardTargets.length === 1) {
+      for (const cap of caps(grammar, `(method_invocation name: (identifier) @callee)`, tree.rootNode)) {
+        if (!imports.has(cap.node.text)) imports.set(cap.node.text, { imported: cap.node.text, targetFile: staticWildcardTargets[0] });
+      }
     }
   },
 };

package/src/graph/builder/lang-js.js

@@ -32,37 +32,56 @@ export default {
     // on deeply-nested / minified / bundled JS (regression). An export_statement is always a NEAR ancestor of
     // the declaration head (≤ ~5 hops), and hitting a statement_block means we're nested inside a function →
     // not a module-level export → bail immediately. See [[graph-builder-internalization]].
-    // early-out on statement_block (we're nested inside a function → not a module-level export) keeps this
-    // O(1) for nested symbols; program is the top; the hop cap is the backstop. A method of an EXPORTED class
-    // is only ~4 hops to its export_statement (method → class_body → class_declaration → export_statement),
-    // so we do NOT bail at class_body — that preserves the exported flag for such methods.
+    // Early-out for nested scopes keeps this O(1); class members are intentionally never module exports even
+    // when their owner class is exported. The hop cap remains a backstop for malformed/deep syntax trees.
     const isExportedDecl = (node) => {
       let p = node.parent;
       for (let hops = 0; p && hops < 6; hops++) {
         if (p.type === "export_statement") return true;
-        if (p.type === "program" || p.type === "statement_block") return false;
+        if (p.type === "program" || p.type === "statement_block" || p.type === "class_body") return false;
+        p = p.parent;
+      }
+      return false;
+    };
+    const isModuleDeclaration = (node) => {
+      let p = node.parent;
+      for (let hops = 0; p && hops < 8; hops++) {
+        if (p.type === "program") return true;
+        if (p.type === "statement_block" || p.type === "class_body") return false;
         p = p.parent;
       }
       return false;
     };
     // a bare (package) specifier = non-relative AND not a path alias; alias-that-missed is a broken local, not a dep
-    const isBareSpec = (spec) => !!spec && !spec.startsWith(".") && resolveAlias(spec) == null;
+    const isBareSpec = (spec) => !!spec && !spec.startsWith(".") && resolveAlias(fileRel, spec) == null;
     // broken local import (relative or alias path resolving to no file) — recorded for the "unresolved-import"
     // finding. Asset imports (svg/css-modules-adjacent/fonts/…) and ?query-suffixed specs that resolve once
     // the query is stripped (Vite ?raw/?url/?worker) are NOT code-graph concerns.
     const ASSET_RE = /\.(svg|png|jpe?g|gif|webp|avif|ico|bmp|woff2?|ttf|eot|otf|mp[34]|webm|wasm|pdf|txt|md|html?)$/i;
-    const recordUnresolved = (rawSpec, kind, line) => {
+    const recordUnresolved = (rawSpec, kind, line, typeOnly = false) => {
       const clean = String(rawSpec || "").split("?")[0];
       if (!clean || ASSET_RE.test(clean)) return;
       if (clean !== rawSpec && resolveJsImport(fileRel, clean)) return; // only the ?query broke resolution
-      addExternalImport({ spec: rawSpec, kind, line, unresolved: true });
+      addExternalImport({ spec: rawSpec, kind, line, unresolved: true, typeOnly });
     };
 
     // ---- symbols (export flag captured at declaration time) ----
+    const methodMetadata = (nameNode) => {
+      let method = nameNode.parent;
+      while (method && method.type !== "method_definition") method = method.parent;
+      let owner = method?.parent;
+      while (owner && !["class_declaration", "class"].includes(owner.type)) owner = owner.parent;
+      const ownerName = owner && field(owner, "name")?.text;
+      const visibility = /^\s*private\b/.test(method?.text || "") ? "private"
+        : /^\s*protected\b/.test(method?.text || "") ? "protected" : "public";
+      return { symbolKind: "method", ...(ownerName ? { memberOf: ownerName } : {}), visibility };
+    };
     for (const cap of caps(grammar, FUNCS, tree.rootNode)) {
+      const isMethod = cap.name === "method";
       addSym(cap.node.text, cap.node.startPosition.row + 1, cap.name !== "class", {
         sourceNode: cap.node.parent,
-        ...(isExportedDecl(cap.node) ? { exported: true } : {})
+        ...(!isMethod && isExportedDecl(cap.node) ? { exported: true } : {}),
+        ...(isMethod ? methodMetadata(cap.node) : { symbolKind: cap.name === "class" ? "class" : "function", moduleDeclaration: isModuleDeclaration(cap.node) })
       });
     }
     for (const cap of caps(grammar, TOPVARS, tree.rootNode)) {
@@ -70,26 +89,47 @@ export default {
       const val = field(cap.node, "value");
       addSym(nameNode.text, nameNode.startPosition.row + 1, !!(val && CALLABLE.test(val.type)), {
         sourceNode: val || cap.node,
-        ...(isExportedDecl(cap.node) ? { exported: true } : {})
+        ...(isExportedDecl(cap.node) ? { exported: true } : {}),
+        symbolKind: "variable",
+        moduleDeclaration: true
       });
     }
 
+    const importTypeOnly = (node) => {
+      if (/^\s*import\s+type\b/.test(node.text)) return true;
+      const clause = node.namedChildren.find((c) => c.type === "import_clause");
+      if (!clause) return false; // side-effect import executes the target module
+      const parts = clause.namedChildren;
+      if (parts.some((c) => c.type === "identifier" || c.type === "namespace_import")) return false;
+      const named = parts.find((c) => c.type === "named_imports");
+      const specs = named?.namedChildren.filter((c) => c.type === "import_specifier") || [];
+      return specs.length > 0 && specs.every((s) => /^\s*type\b/.test(s.text));
+    };
+    const reexportTypeOnly = (node) => {
+      if (/^\s*export\s+type\b/.test(node.text)) return true;
+      const clause = node.namedChildren.find((c) => c.type === "export_clause");
+      const specs = clause?.namedChildren.filter((c) => c.type === "export_specifier") || [];
+      return specs.length > 0 && specs.every((s) => /^\s*type\b/.test(s.text));
+    };
+
     // ---- ESM imports ----
     for (const cap of caps(grammar, `(import_statement) @imp`, tree.rootNode)) {
       const node = cap.node; const srcNode = field(node, "source");
       const rawSpec = srcNode ? srcNode.text.replace(/^['"`]|['"`]$/g, "") : "";
+      const line = node.startPosition.row + 1;
+      const typeOnly = importTypeOnly(node);
       const tgt = resolveJsImport(fileRel, rawSpec);
       if (!tgt) {
-        if (isBareSpec(rawSpec)) addExternalImport({ spec: rawSpec, kind: "esm", line: node.startPosition.row + 1 });
-        else if (rawSpec) recordUnresolved(rawSpec, "esm", node.startPosition.row + 1);
+        if (isBareSpec(rawSpec)) addExternalImport({ spec: rawSpec, kind: "esm", line, typeOnly });
+        else if (rawSpec) recordUnresolved(rawSpec, "esm", line, typeOnly);
         continue;
       }
-      addImportEdge(tgt);
+      addImportEdge(tgt, { typeOnly, line, specifier: rawSpec });
       const clause = node.namedChildren.find((c) => c.type === "import_clause"); if (!clause) continue;
       for (const c of clause.namedChildren) {
-        if (c.type === "identifier") imports.set(c.text, { imported: "default", targetFile: tgt });
-        else if (c.type === "namespace_import") { const id = c.namedChildren.find((x) => x.type === "identifier"); if (id) imports.set(id.text, { imported: "*", targetFile: tgt }); }
-        else if (c.type === "named_imports") for (const s of c.namedChildren) { if (s.type !== "import_specifier") continue; const nm = field(s, "name"), al = field(s, "alias"); if (nm) imports.set((al || nm).text, { imported: nm.text, targetFile: tgt }); }
+        if (c.type === "identifier") imports.set(c.text, { imported: "default", targetFile: tgt, typeOnly });
+        else if (c.type === "namespace_import") { const id = c.namedChildren.find((x) => x.type === "identifier"); if (id) imports.set(id.text, { imported: "*", targetFile: tgt, typeOnly }); }
+        else if (c.type === "named_imports") for (const s of c.namedChildren) { if (s.type !== "import_specifier") continue; const nm = field(s, "name"), al = field(s, "alias"); if (nm) imports.set((al || nm).text, { imported: nm.text, targetFile: tgt, typeOnly: typeOnly || /^\s*type\b/.test(s.text) }); }
       }
     }
 
@@ -98,7 +138,7 @@ export default {
       if (cap.name !== "src") continue;
       let dv = cap.node; while (dv && dv.type !== "variable_declarator") dv = dv.parent;
       const tgt = resolveJsImport(fileRel, cap.node.text); if (!tgt) continue;
-      addImportEdge(tgt);
+      addImportEdge(tgt, { typeOnly: false, line: cap.node.startPosition.row + 1, specifier: cap.node.text });
       const lhs = dv && field(dv, "name");
       if (lhs && lhs.type === "identifier") imports.set(lhs.text, { imported: "*", targetFile: tgt });
       else if (lhs && lhs.type === "object_pattern") for (const p of lhs.namedChildren) { const key = field(p, "key") || (p.type === "shorthand_property_identifier_pattern" ? p : null); const val = field(p, "value"); const local = (val && val.type === "identifier") ? val : key; if (key && local) imports.set(local.text, { imported: key.text, targetFile: tgt }); }
@@ -139,13 +179,16 @@ export default {
     }
 
     // ---- re-exports (barrel/index files): edge so the real target isn't falsely DEAD; bare source → external ----
-    for (const cap of caps(grammar, `(export_statement source: (string (string_fragment) @src))`, tree.rootNode)) {
-      if (cap.name !== "src") continue;
-      const rawSpec = cap.node.text;
+    for (const cap of caps(grammar, `(export_statement) @exp`, tree.rootNode)) {
+      const node = cap.node; const srcNode = field(node, "source");
+      if (!srcNode) continue;
+      const rawSpec = srcNode.text.replace(/^['"`]|['"`]$/g, "");
+      const line = node.startPosition.row + 1;
+      const typeOnly = reexportTypeOnly(node);
       const tgt = resolveJsImport(fileRel, rawSpec);
-      if (tgt) addImportEdge(tgt);
-      else if (isBareSpec(rawSpec)) addExternalImport({ spec: rawSpec, kind: "reexport", line: cap.node.startPosition.row + 1 });
-      else if (rawSpec) recordUnresolved(rawSpec, "reexport", cap.node.startPosition.row + 1);
+      if (tgt) addImportEdge(tgt, { relation: "re_exports", typeOnly, line, specifier: rawSpec });
+      else if (isBareSpec(rawSpec)) addExternalImport({ spec: rawSpec, kind: "reexport", line, typeOnly });
+      else if (rawSpec) recordUnresolved(rawSpec, "reexport", line, typeOnly);
     }
 
     // ---- export markers beyond declarations: `export { a, b }`, `export default X`, CJS module.exports ----