weavatrix 0.2.15 → 0.2.16

package/src/analysis/internal-audit/dependency-health.js

@@ -10,6 +10,7 @@ export function buildDependencyHealth({
   goDep,
   pyDep,
   jvmDependencies,
+  cargoDep,
   externalImports,
   findings,
   packageScopes,
@@ -20,8 +21,8 @@ export function buildDependencyHealth({
   const dependencyFindings = findings.filter((finding) => ["unused-dep", "missing-dep", "duplicate-dep"].includes(finding.rule));
   const graphComplete = !((graph.graphBuildMode && graph.graphBuildMode !== "full") || graph.graphBuildScope);
   const npmManifests = repoFiles.filter((file) => /(^|\/)package\.json$/i.test(file));
-  const goManifests = repoFiles.filter((file) => /(^|\/)go\.mod$/i.test(file));
   const pythonManifests = [...new Set((pyManifest.scopes || []).flatMap((scope) => scope.manifests || []))];
+  const publicEvidence = ({ findings: _findings, ...item }) => item;
   const ecosystems = {
     npm: {
       ecosystem: "npm",
@@ -36,28 +37,29 @@ export function buildDependencyHealth({
     },
     go: {
       ecosystem: "go",
-      present: goManifests.length > 0,
-      status: goManifests.length ? "CHECKED" : "NOT_PRESENT",
-      completeness: goManifests.length ? "PARTIAL" : "NOT_APPLICABLE",
-      manifests: goManifests,
+      present: goDep.present,
+      status: goDep.status,
+      completeness: graphComplete && goDep.completeness === "COMPLETE" ? "COMPLETE" : goDep.completeness,
+      manifests: goDep.manifests,
       declared: goDep.declared.size,
-      reason: goManifests.length
-        ? "Go dependency checks use indexed imports and the root go.mod; nested modules and build-tag-specific resolution are not fully modeled."
-        : "No go.mod was discovered.",
+      reason: goDep.reason,
     },
     python: {
       ecosystem: "python",
       present: pyManifest.present,
       status: pyManifest.present ? "CHECKED" : "NOT_PRESENT",
-      completeness: pyManifest.present ? "PARTIAL" : "NOT_APPLICABLE",
+      completeness: pyManifest.present ? (graphComplete && pyManifest.completeness === "COMPLETE" ? "COMPLETE" : "PARTIAL") : "NOT_APPLICABLE",
       manifests: pythonManifests,
       declared: pyDep.declared.size,
       reason: pyManifest.present
-        ? "Python declarations were compared with indexed imports; environment markers, extras and dynamic imports remain bounded static evidence."
+        ? pyManifest.reasons?.length
+          ? `Python declarations were compared with indexed imports, but ${pyManifest.reasons.join("; ")}.`
+          : "Every discovered supported Python manifest scope was compared with indexed imports. Environment markers and extras are normalized as declarations; runtime-computed imports remain outside static proof."
         : "No supported Python dependency manifest was discovered.",
     },
-    maven: { ecosystem: "maven", ...jvmDependencies.maven },
-    gradle: { ecosystem: "gradle", ...jvmDependencies.gradle },
+    maven: { ecosystem: "maven", ...publicEvidence(jvmDependencies.maven), completeness: jvmDependencies.maven.present && !graphComplete ? "PARTIAL" : jvmDependencies.maven.completeness },
+    gradle: { ecosystem: "gradle", ...publicEvidence(jvmDependencies.gradle), completeness: jvmDependencies.gradle.present && !graphComplete ? "PARTIAL" : jvmDependencies.gradle.completeness },
+    rust: { ecosystem: "rust", ...publicEvidence(cargoDep), declared: cargoDep.declared.size, completeness: cargoDep.present && !graphComplete ? "PARTIAL" : cargoDep.completeness },
   };
   const present = Object.values(ecosystems).filter((item) => item.present);
   const status = present.length === 0
@@ -68,7 +70,7 @@ export function buildDependencyHealth({
   const importedPackages = new Set(externalImports
     .filter((entry) => entry?.pkg && !entry.builtin && !entry.unresolved)
     .map((entry) => `${entry.ecosystem || (/\.java$/i.test(entry.file || "") ? "maven-unresolved" : "npm")}:${entry.pkg}`));
-  const supportedDeclared = dep.declared.size + goDep.declared.size + pyDep.declared.size;
+  const supportedDeclared = dep.declared.size + goDep.declared.size + pyDep.declared.size + cargoDep.declared.size;
   const jvmDeclared = jvmDependencies.maven.declared + jvmDependencies.gradle.declared;
   const measuredCoverage = readCoverageForRepo(repoPath, sourceFiles);
   const healthCapabilities = buildHealthCapabilityMatrix({

package/src/analysis/internal-audit/python-manifests.js

@@ -1,4 +1,4 @@
-import {dirname} from 'node:path'
+import {dirname, posix} from 'node:path'
 import {createRepoBoundary} from '../../repo-path.js'
 import {parseRequirementsNames, parsePyprojectDeps, parsePipfileDeps, pep503} from '../manifests.js'
 import {listRepoFiles, readRepoText} from './repo-files.js'
@@ -25,6 +25,8 @@ export function collectPyManifest(repoRoot) {
         scope.deps.push(...parsedDeps.map((dep) => ({...dep, manifest})))
     }
     const files = listRepoFiles(repoRoot)
+    const fileSet = new Set(files.map((file) => file.replace(/\\/g, '/')))
+    const reasons = []
     for (const file of files.filter((name) => /(^|\/)requirements[\w.-]*\.(?:txt|in)$/i.test(name)
         || /(^|\/)requirements\/[^/]+\.(?:txt|in)$/i.test(name))) {
         const text = readRepoText(boundary, file)
@@ -33,14 +35,23 @@ export function collectPyManifest(repoRoot) {
         const root = /(^|\/)requirements$/i.test(parent) ? normalizeRoot(dirname(parent)) : parent
         const dev = /dev|test|lint|doc|ci/i.test(file.slice(file.lastIndexOf('/') + 1))
         addManifest(root, file, parseRequirementsNames(text).map((dep) => ({...dep, dev})))
+        for (const match of text.matchAll(/^\s*(?:-r|--requirement|-c|--constraint)\s+(?:=\s*)?([^\s#]+)/gmi)) {
+            const parentDir = normalizeRoot(dirname(file))
+            const target = normalizeRoot(posix.normalize(`${parentDir ? `${parentDir}/` : ''}${match[1].replace(/\\/g, '/')}`))
+            if (!target || target.startsWith('../') || !fileSet.has(target)) reasons.push(`${file}: referenced requirements file ${match[1]} was not discovered`)
+        }
     }
     for (const file of files.filter((name) => /(^|\/)pyproject\.toml$/i.test(name))) {
-        const parsed = parsePyprojectDeps(readRepoText(boundary, file))
-        addManifest(dirname(file), file, parsed.deps, parsed.present)
+        const text = readRepoText(boundary, file)
+        const parsed = parsePyprojectDeps(text)
+        const dependencyManifest = parsed.present || /^\s*\[(?:project|tool\.poetry)\]/m.test(text || '')
+        addManifest(dirname(file), file, parsed.deps, dependencyManifest)
+        if (/\bdynamic\s*=\s*\[[^\]]*["']dependencies["']/s.test(text || '')) reasons.push(`${file}: project dependencies are dynamic`)
     }
     for (const file of files.filter((name) => /(^|\/)Pipfile$/i.test(name))) {
-        const parsed = parsePipfileDeps(readRepoText(boundary, file))
-        addManifest(dirname(file), file, parsed.deps, parsed.present)
+        const text = readRepoText(boundary, file)
+        const parsed = parsePipfileDeps(text)
+        addManifest(dirname(file), file, parsed.deps, parsed.present || /^\s*\[(?:packages|dev-packages)\]/mi.test(text || ''))
     }
     const normalizedScopes = [...scopes.values()]
         .map((scope) => {
@@ -61,5 +72,7 @@ export function collectPyManifest(repoRoot) {
         present: normalizedScopes.some((scope) => scope.present),
         deps: normalizedScopes.flatMap((scope) => scope.deps),
         scopes: normalizedScopes,
+        completeness: reasons.length ? 'PARTIAL' : 'COMPLETE',
+        reasons: [...new Set(reasons)].sort(),
     }
 }

package/src/analysis/internal-audit/supply-chain.js

@@ -12,6 +12,8 @@ const removalHint = (pkg) => {
   if (pkg?.ecosystem === "npm") return `npm uninstall ${pkg.name} and audit what it touched`;
   if (pkg?.ecosystem === "PyPI") return `remove ${pkg.name} from the Python environment/manifest and audit what it touched`;
   if (pkg?.ecosystem === "Go") return `remove ${pkg.name} from the Go module graph, run go mod tidy, and audit what it touched`;
+  if (pkg?.ecosystem === "crates.io") return `cargo remove ${pkg.name}, rebuild every feature/target, and audit what it touched`;
+  if (pkg?.ecosystem === "Maven") return `remove or upgrade ${pkg.name} in Maven/Gradle, refresh the resolved graph, and audit what it touched`;
   return `remove ${pkg?.name || "the package"} with its ecosystem's package manager and audit what it touched`;
 };
 

package/src/analysis/internal-audit.run.js

@@ -1,7 +1,7 @@
 import { existsSync } from "node:fs";
 import { basename, join } from "node:path";
 import { computeDead, computeUnusedExports } from "./dead-check.js";
-import { computeGoDepFindings, computePyDepFindings, computeScopedDepFindings } from "./dep-check.js";
+import { computePyDepFindings, computeScopedDepFindings } from "./dep-check.js";
 import { computeStructureFindings } from "./dep-rules.js";
 import { makeFinding, sortFindings, summarizeFindings } from "./findings.js";
 import { graphOutDirForRepo } from "../graph/layout.js";
@@ -15,17 +15,17 @@ import {
   listRepoFiles,
   readJson,
   readRepoJson,
-  readRepoText,
   workspacePkgNames,
 } from "./internal-audit.collect.js";
 import { computeReachability, entryFiles } from "./internal-audit.reach.js";
-import { parseGoMod } from "./manifests.js";
 import { PATH_CLASS_NAMES, createPathClassifier, hasPathClass } from "../path-classification.js";
 import { createRepoBoundary } from "../repo-path.js";
 import { analyzeSourceCorrectness } from "./source-correctness.js";
 import { collectJvmDependencyEvidence } from "./jvm-dependency-evidence.js";
 import { buildDependencyHealth } from "./internal-audit/dependency-health.js";
 import { runSupplyChainChecks } from "./internal-audit/supply-chain.js";
+import { collectGoDependencyEvidence } from "./go-dependency-evidence.js";
+import { collectCargoDependencyEvidence } from "./cargo-dependency-evidence.js";
 
 export async function runInternalAudit(repoPath, {
   graph,
@@ -90,8 +90,7 @@ export async function runInternalAudit(repoPath, {
     nonRuntimeRoots,
     sourceFiles: [...sources.keys()],
   });
-  const goModText = readRepoText(boundary, "go.mod");
-  const goDep = computeGoDepFindings({ externalImports, goMod: goModText != null ? parseGoMod(goModText) : null, nonRuntimeRoots });
+  const goDep = collectGoDependencyEvidence(repoPath, { files: repoFiles, externalImports, nonRuntimeRoots });
   const asList = (value) => Array.isArray(value) ? value : typeof value === "string" ? [value] : [];
   const pyRules = rules.python || {}, depRules = rules.dependencies || {};
   const managedPython = [...new Set([
@@ -109,12 +108,17 @@ export async function runInternalAudit(repoPath, {
     ignoredDependencies: ignoredPython,
     nonRuntimeRoots,
   });
-  const jvmDependencies = collectJvmDependencyEvidence(repoPath, { files: repoFiles });
+  const jvmDependencies = collectJvmDependencyEvidence(repoPath, { files: repoFiles, externalImports });
+  const cargoDep = collectCargoDependencyEvidence(repoPath, { files: repoFiles, externalImports });
 
   const externalImportFiles = new Set(externalImports.filter((entry) => entry.pkg && !entry.builtin).map((entry) => entry.file));
   const structure = computeStructureFindings(graph, { rules, entrySet: entries, externalImportFiles });
   const correctness = analyzeSourceCorrectness(sources, { isNonProductPath });
-  const findings = [...dep.findings, ...goDep.findings, ...pyDep.findings, ...correctness.findings];
+  const findings = [
+    ...dep.findings, ...goDep.findings, ...pyDep.findings,
+    ...jvmDependencies.maven.findings, ...jvmDependencies.gradle.findings, ...cargoDep.findings,
+    ...correctness.findings,
+  ];
   const deadFileSet = new Set(dead.deadFiles.map((finding) => finding.file));
   for (const finding of structure.findings) {
     if (!(finding.rule === "orphan-file" && deadFileSet.has(finding.file))) findings.push(finding);
@@ -190,6 +194,7 @@ export async function runInternalAudit(repoPath, {
     goDep,
     pyDep,
     jvmDependencies,
+    cargoDep,
     externalImports,
     findings: sorted,
     packageScopes,

package/src/analysis/jvm-dependency-evidence.js

@@ -1,69 +1,115 @@
-// Maven/Gradle manifest presence and bounded declaration counts. We intentionally do not map Java
-// imports to artifacts: package-to-artifact resolution needs a real build model and claiming 0/0 from
-// source regexes would be worse than an explicit NOT_SUPPORTED/PARTIAL state.
 import { createRepoBoundary } from "../repo-path.js";
+import { dependencyVerification, makeFinding } from "./findings.js";
+import { parseGradleDependencies, parseGradleVersionCatalog, parseMavenPom } from "./jvm-manifests.js";
 import { listRepoFiles, readRepoText } from "./internal-audit.collect.js";
 
-function mavenDeclarations(text) {
-  const source = String(text || "")
-    .replace(/<!--[\s\S]*?-->/g, " ")
-    .replace(/<dependencyManagement\b[\s\S]*?<\/dependencyManagement>/gi, " ");
-  const identities = [];
-  const re = /<dependency\b[^>]*>([\s\S]*?)<\/dependency>/gi;
-  let match;
-  while ((match = re.exec(source))) {
-    const group = /<groupId>\s*([^<]+?)\s*<\/groupId>/i.exec(match[1])?.[1]?.trim() || "";
-    const artifact = /<artifactId>\s*([^<]+?)\s*<\/artifactId>/i.exec(match[1])?.[1]?.trim() || "";
-    if (artifact) identities.push(group ? `${group}:${artifact}` : artifact);
-  }
-  return identities;
+const normalize = (value) => String(value || "").toLowerCase().replace(/[^a-z0-9]+/g, "");
+const javaBuiltin = (name) => /^(?:java|jdk|sun)\.|^(?:org\.w3c\.dom|org\.xml\.sax)(?:\.|$)/.test(name);
+
+function mappingScore(spec, dependency) {
+  const imported = String(spec || "").replace(/\.\*$/, "");
+  if (!imported || !dependency.group) return 0;
+  if (imported === dependency.group || imported.startsWith(`${dependency.group}.`)) return 1_000 + dependency.group.length;
+  const compactImport = normalize(imported), compactArtifact = normalize(dependency.artifact);
+  if (compactArtifact.length >= 4 && compactImport.includes(compactArtifact)) return 500 + compactArtifact.length;
+  const artifactTokens = String(dependency.artifact).toLowerCase().split(/[-_.]+/).filter((part) => part.length >= 4 && !["core", "java", "client", "common", "api"].includes(part));
+  const hits = artifactTokens.filter((part) => imported.toLowerCase().split(".").some((segment) => normalize(segment) === normalize(part))).length;
+  return hits ? 100 + hits : 0;
+}
+
+function bestDependency(spec, dependencies) {
+  const ranked = dependencies.map((dependency) => ({ dependency, score: mappingScore(spec, dependency) }))
+    .filter((item) => item.score > 0).sort((left, right) => right.score - left.score || left.dependency.name.localeCompare(right.dependency.name));
+  if (!ranked.length || (ranked[1] && ranked[1].score === ranked[0].score)) return null;
+  return ranked[0].dependency;
 }
 
-function gradleDeclarations(text) {
-  const source = String(text || "")
-    .replace(/\/\*[\s\S]*?\*\//g, " ")
-    .replace(/(^|\s)\/\/.*$/gm, "$1");
-  const declarations = [];
-  const configurations = "api|implementation|compileOnly|runtimeOnly|annotationProcessor|kapt|testImplementation|testCompileOnly|testRuntimeOnly|androidTestImplementation";
-  const line = new RegExp(`^\\s*(?:${configurations})\\s*(?:\\(\\s*)?([^\\r\\n]+)`, "gmi");
-  let match;
-  while ((match = line.exec(source))) {
-    const expression = match[1].trim().replace(/[),;]+\s*$/, "");
-    const coordinate = /["']([^"']+:[^"']+)["']/.exec(expression)?.[1] || "";
-    const catalog = /\blibs(?:\.[A-Za-z_]\w*)+/.exec(expression)?.[0] || "";
-    declarations.push(coordinate || catalog || "unresolved-declaration");
+function analyze(ecosystem, manifests, dependencies, imports, unresolvedDeclarations, mappingDependencies = dependencies, includeMissing = true) {
+  const findings = [], used = new Map(), missing = new Map();
+  const owned = new Set(dependencies.map((dependency) => dependency.name));
+  for (const item of imports) {
+    const dependency = bestDependency(item.spec || item.pkg, mappingDependencies);
+    if (dependency) {
+      if (owned.has(dependency.name)) {
+        const list = used.get(dependency.name) || [];
+        list.push(item); used.set(dependency.name, list);
+      }
+    } else {
+      const key = item.spec || item.pkg;
+      const list = missing.get(key) || [];
+      list.push(item); missing.set(key, list);
+    }
   }
-  return declarations;
+  const runtimeOnly = /runtime|provided|classpath|annotationProcessor|kapt/i;
+  for (const dependency of dependencies) {
+    const evidence = used.get(dependency.name) || [];
+    if (evidence.length || dependency.optional || runtimeOnly.test(dependency.scope || "")) continue;
+    findings.push(makeFinding({
+      category: "unused", rule: "unused-dep", severity: "low", confidence: "low",
+      title: `Unused ${ecosystem} dependency: ${dependency.name}`,
+      reason: "No indexed Java import mapped to this declared artifact; reflection, service loading, generated code and runtime-only use remain possible.",
+      detail: `"${dependency.name}" is declared in ${dependency.file}, but no indexed Java import maps to it. Review framework, reflection, ServiceLoader and generated-source use before removal.`,
+      package: dependency.name, version: dependency.version, manifest: dependency.file, source: "internal",
+      verification: dependencyVerification(dependency.file, [], "REVIEW_REQUIRED", "group-prefix/artifact-token"),
+      fixHint: `remove ${dependency.name} only after the ${ecosystem} build and tests confirm it is unused`,
+    }));
+  }
+  for (const [spec, evidence] of includeMissing ? missing : []) {
+    if (javaBuiltin(spec)) continue;
+    findings.push(makeFinding({
+      category: "unused", rule: "missing-dep", severity: "medium", confidence: "medium",
+      title: `Unmapped Java import: ${spec}`,
+      reason: `The indexed Java import did not map to any declared ${ecosystem} artifact.`,
+      detail: `"${spec}" is imported by ${evidence.length} file(s), but no ${ecosystem} declaration has a matching group prefix or artifact token. Add the owning artifact or configure/build the source that supplies it.`,
+      package: spec, file: evidence[0].file, line: evidence[0].line || 0,
+      evidence: evidence.slice(0, 5).map((item) => ({ file: item.file, line: item.line || 0, snippet: item.spec || "" })),
+      source: "internal",
+      verification: { evidenceModel: "MANIFEST_PLUS_INDEXED_SOURCE", decision: "ACTION_REQUIRED", manifestDeclaration: { status: "NOT_FOUND", files: manifests }, indexedSourceImports: { status: "FOUND", count: evidence.length, files: evidence.map((item) => item.file).slice(0, 10) }, mapping: "group-prefix/artifact-token" },
+      fixHint: `identify the artifact that owns ${spec} and declare it in the nearest ${ecosystem} manifest`,
+    }));
+  }
+  const present = manifests.length > 0;
+  return {
+    present,
+    status: present ? "CHECKED" : "NOT_PRESENT",
+    completeness: present ? (unresolvedDeclarations ? "PARTIAL" : "COMPLETE") : "NOT_APPLICABLE",
+    manifests,
+    declared: dependencies.length,
+    mappedImports: [...used.values()].reduce((sum, list) => sum + list.length, 0),
+    unmappedImports: [...missing.values()].reduce((sum, list) => sum + list.length, 0),
+    unresolvedDeclarations,
+    sample: dependencies.slice(0, 20).map(({ file, name, version }) => ({ file, identity: name, version })),
+    reason: !present
+      ? `No ${ecosystem === "maven" ? "pom.xml" : "Gradle build file"} was discovered.`
+      : unresolvedDeclarations
+        ? `${dependencies.length} declarations and all indexed Java imports were checked, but ${unresolvedDeclarations} dynamic/property/catalog declaration(s) could not be resolved statically.`
+        : `${dependencies.length} declarations were compared with every indexed non-JDK Java import using bounded group-prefix and artifact-token evidence. Missing and unused results remain review evidence, not compiler proof.`,
+    findings,
+  };
 }
 
-export function collectJvmDependencyEvidence(repoRoot, { files = listRepoFiles(repoRoot) } = {}) {
+export function collectJvmDependencyEvidence(repoRoot, { files = listRepoFiles(repoRoot), externalImports = [] } = {}) {
   const boundary = createRepoBoundary(repoRoot);
   const mavenFiles = files.filter((file) => /(^|\/)pom\.xml$/i.test(file));
-  const gradleFiles = files.filter((file) => /(^|\/)build\.gradle(?:\.kts)?$/i.test(file));
-  const maven = mavenFiles.flatMap((file) => mavenDeclarations(readRepoText(boundary, file)).map((identity) => ({ file, identity })));
-  const gradle = gradleFiles.flatMap((file) => gradleDeclarations(readRepoText(boundary, file)).map((identity) => ({ file, identity })));
+  const gradleFiles = files.filter((file) => /(^|\/)(?:build|settings|[^/]+)\.gradle(?:\.kts)?$/i.test(file));
+  const catalogFiles = files.filter((file) => /(^|\/)libs\.versions\.toml$/i.test(file));
+  const catalog = new Map();
+  for (const file of catalogFiles) for (const [alias, entry] of parseGradleVersionCatalog(readRepoText(boundary, file))) catalog.set(alias, entry);
+  let mavenUnresolved = 0, gradleUnresolved = 0;
+  const mavenDependencies = mavenFiles.flatMap((file) => {
+    const parsed = parseMavenPom(readRepoText(boundary, file));
+    mavenUnresolved += parsed.unresolvedDeclarations;
+    return parsed.dependencies.map((dependency) => ({ ...dependency, file }));
+  });
+  const gradleDependencies = gradleFiles.flatMap((file) => {
+    const parsed = parseGradleDependencies(readRepoText(boundary, file), catalog);
+    gradleUnresolved += parsed.unresolvedDeclarations || 0;
+    return parsed.map((dependency) => ({ ...dependency, file }));
+  });
+  const javaImports = externalImports.filter((entry) => entry.ecosystem === "Maven" && entry.pkg && !entry.builtin && !entry.unresolved);
+  const allDependencies = [...mavenDependencies, ...gradleDependencies];
   return {
-    maven: {
-      present: mavenFiles.length > 0,
-      status: mavenFiles.length ? "NOT_SUPPORTED" : "NOT_PRESENT",
-      completeness: mavenFiles.length ? "PARTIAL" : "NOT_APPLICABLE",
-      manifests: mavenFiles,
-      declared: maven.length,
-      sample: maven.slice(0, 20),
-      reason: mavenFiles.length
-        ? "Maven manifests and declaration counts were detected, but Java package imports were not mapped to Maven artifacts; unused/missing dependency verdicts are not supported."
-        : "No pom.xml was discovered.",
-    },
-    gradle: {
-      present: gradleFiles.length > 0,
-      status: gradleFiles.length ? "NOT_SUPPORTED" : "NOT_PRESENT",
-      completeness: gradleFiles.length ? "PARTIAL" : "NOT_APPLICABLE",
-      manifests: gradleFiles,
-      declared: gradle.length,
-      sample: gradle.slice(0, 20),
-      reason: gradleFiles.length
-        ? "Gradle manifests and bounded dependency declarations were detected, but version catalogs/build logic and Java package-to-artifact mapping were not resolved; unused/missing dependency verdicts are not supported."
-        : "No build.gradle/build.gradle.kts was discovered.",
-    },
+    maven: analyze("maven", mavenFiles, mavenDependencies, javaImports, mavenUnresolved, allDependencies, true),
+    gradle: analyze("gradle", [...gradleFiles, ...catalogFiles], gradleDependencies, javaImports, gradleUnresolved, allDependencies, mavenFiles.length === 0),
   };
 }

package/src/analysis/jvm-manifests.js

@@ -0,0 +1,114 @@
+const stripComments = (value) => String(value || "").replace(/<!--[\s\S]*?-->/g, " ");
+const clean = (value) => String(value || "").trim().replace(/^['"]|['"]$/g, "");
+
+function xmlValue(body, name) {
+  return new RegExp(`<${name}>\\s*([^<]+?)\\s*</${name}>`, "i").exec(body)?.[1]?.trim() || "";
+}
+
+function resolveMavenValue(value, properties) {
+  let output = String(value || "");
+  for (let pass = 0; pass < 8; pass++) {
+    let changed = false;
+    output = output.replace(/\$\{([^}]+)}/g, (whole, key) => {
+      if (!properties.has(key)) return whole;
+      changed = true;
+      return properties.get(key);
+    });
+    if (!changed) break;
+  }
+  return /\$\{/.test(output) ? "" : output.trim();
+}
+
+export function parseMavenPom(text) {
+  const source = stripComments(text);
+  const properties = new Map();
+  const propertyBlock = /<properties\b[^>]*>([\s\S]*?)<\/properties>/i.exec(source)?.[1] || "";
+  for (const match of propertyBlock.matchAll(/<([A-Za-z0-9_.-]+)>\s*([^<]+?)\s*<\/\1>/g)) properties.set(match[1], match[2].trim());
+  const parent = /<parent\b[^>]*>([\s\S]*?)<\/parent>/i.exec(source)?.[1] || "";
+  const beforeDependencies = source.split(/<dependencies\b/i)[0];
+  const projectVersion = xmlValue(beforeDependencies, "version") || xmlValue(parent, "version");
+  const projectGroup = xmlValue(beforeDependencies, "groupId") || xmlValue(parent, "groupId");
+  properties.set("project.version", projectVersion); properties.set("pom.version", projectVersion);
+  properties.set("project.groupId", projectGroup); properties.set("pom.groupId", projectGroup);
+  const managed = new Map();
+  for (const block of source.matchAll(/<dependencyManagement\b[^>]*>([\s\S]*?)<\/dependencyManagement>/gi)) {
+    for (const dep of block[1].matchAll(/<dependency\b[^>]*>([\s\S]*?)<\/dependency>/gi)) {
+      const group = resolveMavenValue(xmlValue(dep[1], "groupId"), properties);
+      const artifact = resolveMavenValue(xmlValue(dep[1], "artifactId"), properties);
+      const version = resolveMavenValue(xmlValue(dep[1], "version"), properties);
+      if (group && artifact && version) managed.set(`${group}:${artifact}`, version);
+    }
+  }
+  const directSource = source.replace(/<dependencyManagement\b[^>]*>[\s\S]*?<\/dependencyManagement>/gi, " ");
+  const dependencies = [];
+  const directBlocks = [...directSource.matchAll(/<dependency\b[^>]*>([\s\S]*?)<\/dependency>/gi)];
+  for (const match of directBlocks) {
+    const group = resolveMavenValue(xmlValue(match[1], "groupId"), properties);
+    const artifact = resolveMavenValue(xmlValue(match[1], "artifactId"), properties);
+    if (!group || !artifact) continue;
+    dependencies.push({
+      group, artifact, name: `${group}:${artifact}`,
+      version: resolveMavenValue(xmlValue(match[1], "version"), properties) || managed.get(`${group}:${artifact}`) || "",
+      scope: xmlValue(match[1], "scope") || "compile",
+      optional: xmlValue(match[1], "optional") === "true",
+    });
+  }
+  return { projectGroup, projectVersion, dependencies, unresolvedDeclarations: directBlocks.length - dependencies.length };
+}
+
+export function parseGradleVersionCatalog(text) {
+  const versions = new Map(), libraries = new Map();
+  let section = "";
+  for (const raw of String(text || "").split(/\r?\n/)) {
+    const line = raw.replace(/(^|\s)#.*$/, "").trim();
+    const header = /^\[([^\]]+)]$/.exec(line);
+    if (header) { section = header[1]; continue; }
+    const kv = /^([A-Za-z0-9_.-]+)\s*=\s*(.+)$/.exec(line);
+    if (!kv) continue;
+    if (section === "versions") { versions.set(kv[1], clean(kv[2])); continue; }
+    if (section !== "libraries") continue;
+    const alias = kv[1], value = kv[2];
+    const module = /\bmodule\s*=\s*["']([^"']+)["']/.exec(value)?.[1]
+      || /\bgroup\s*=\s*["']([^"']+)["'][\s\S]*?\bname\s*=\s*["']([^"']+)["']/.exec(value)?.slice(1, 3).join(":")
+      || (/^["'][^"']+:[^"']+["']$/.test(value) ? clean(value) : "");
+    if (!module) continue;
+    const explicit = /\bversion\s*=\s*["']([^"']+)["']/.exec(value)?.[1] || "";
+    const reference = /\bversion\.ref\s*=\s*["']([^"']+)["']/.exec(value)?.[1] || "";
+    libraries.set(alias.replace(/[_.]/g, "-"), { module, version: explicit || versions.get(reference) || "" });
+  }
+  return libraries;
+}
+
+export function parseGradleDependencies(text, catalog = new Map()) {
+  const source = String(text || "").replace(/\/\*[\s\S]*?\*\//g, " ").replace(/(^|\s)\/\/.*$/gm, "$1");
+  const dependencies = [];
+  const configurations = "api|implementation|compile|compileOnly|runtimeOnly|annotationProcessor|kapt|classpath|testImplementation|testCompileOnly|testRuntimeOnly|androidTestImplementation";
+  const matcher = new RegExp(`^\\s*(${configurations})\\s*(?:\\(\\s*)?([^\\r\\n]+)`, "gmi");
+  const declarations = [...source.matchAll(matcher)];
+  for (const match of declarations) {
+    const expression = match[2].trim().replace(/[),;]+\s*$/, "");
+    const coordinate = /["']([^"']+:[^"']+)["']/.exec(expression)?.[1] || "";
+    if (coordinate) {
+      const [group, artifact, version = ""] = coordinate.split(":");
+      if (group && artifact) dependencies.push({ group, artifact, name: `${group}:${artifact}`, version, scope: match[1] });
+      continue;
+    }
+    const alias = /\blibs((?:\.[A-Za-z_]\w*)+)/.exec(expression)?.[1]?.slice(1).replace(/\./g, "-") || "";
+    const entry = catalog.get(alias);
+    if (entry) {
+      const [group, artifact] = entry.module.split(":");
+      dependencies.push({ group, artifact, name: entry.module, version: entry.version, scope: match[1], catalogAlias: alias });
+    }
+  }
+  dependencies.unresolvedDeclarations = declarations.length - dependencies.length;
+  return dependencies;
+}
+
+export function parseGradleLockPackages(text) {
+  const packages = [];
+  for (const raw of String(text || "").split(/\r?\n/)) {
+    const match = /^([^#=\s:]+(?:\.[^#=\s:]+)*):([^#=\s:]+):([^#=\s=]+)=/.exec(raw.trim());
+    if (match) packages.push({ ecosystem: "Maven", name: `${match[1]}:${match[2]}`, version: match[3], dev: false, integrity: "", source: "gradle-lock" });
+  }
+  return packages;
+}

package/src/analysis/source-correctness.js

@@ -3,12 +3,9 @@
 // the surrounding behavior is wrong.
 import { makeFinding } from "./findings.js";
 import {retryFindings} from './source-correctness/retry-patterns.js'
+import {lineNumberAt} from '../util.js'
 
-const lineAt = (text, index) => {
-  let line = 1;
-  for (let i = 0; i < index && i < text.length; i++) if (text[i] === "\n") line++;
-  return line;
-};
+const lineAt = lineNumberAt;
 
 const lineText = (text, index) => {
   const start = text.lastIndexOf("\n", Math.max(0, index - 1)) + 1;