weavatrix 0.2.15 → 0.2.18

package/src/analysis/git-history/options.js

@@ -1,4 +1,5 @@
 import {isAbsolute} from 'node:path'
+import {boundedInteger} from '../../util.js'
 
 export const GIT_HISTORY_V = 1
 export const GIT_HISTORY_WINDOWS = Object.freeze([3, 6, 12])
@@ -28,10 +29,7 @@ export const roundHistoryNumber = (value, digits = 4) => {
     const scale = 10 ** digits
     return Math.round(value * scale) / scale
 }
-export const boundedHistoryInteger = (value, fallback, min, max) => {
-    const number = Number(value)
-    return Number.isInteger(number) ? Math.max(min, Math.min(max, number)) : fallback
-}
+export const boundedHistoryInteger = boundedInteger
 
 export function safeHistoryPath(value) {
     const path = String(value || '').replace(/\\/g, '/').replace(/^\.\//, '')

package/src/analysis/go-dependency-evidence.js

@@ -0,0 +1,62 @@
+import { createRepoBoundary } from "../repo-path.js";
+import { computeGoDepFindings } from "./dep-check-ecosystems.js";
+import { listRepoFiles, readRepoText } from "./internal-audit.collect.js";
+import { parseGoMod } from "./manifests.js";
+import { makeFinding } from "./findings.js";
+import { dependencyScopeOwnsFile, dependencyScopeRoot } from "./dependency/scoped-dependencies.js";
+
+export function collectGoDependencyEvidence(repoRoot, { files = listRepoFiles(repoRoot), externalImports = [], nonRuntimeRoots = [] } = {}) {
+  const boundary = createRepoBoundary(repoRoot);
+  const manifests = files.filter((file) => /(^|\/)go\.mod$/i.test(file));
+  const scopes = manifests.map((file) => ({ file, root: dependencyScopeRoot(file), parsed: parseGoMod(readRepoText(boundary, file)) }))
+    .sort((left, right) => right.root.length - left.root.length || left.root.localeCompare(right.root));
+  const importsByScope = new Map(scopes.map((scope) => [scope, []]));
+  for (const entry of externalImports) {
+    if (entry.ecosystem !== "Go") continue;
+    const owner = scopes.find((scope) => dependencyScopeOwnsFile(scope.root, entry.file));
+    if (owner) importsByScope.get(owner).push(entry);
+  }
+  const findings = [], declared = new Set(), issues = [];
+  if (!scopes.length) {
+    const missing = new Map();
+    for (const entry of externalImports.filter((item) => item.ecosystem === "Go" && item.pkg && !item.builtin && !item.unresolved)) {
+      if (!missing.has(entry.pkg)) missing.set(entry.pkg, entry);
+    }
+    for (const [name, entry] of missing) findings.push(makeFinding({
+      category: "unused", rule: "missing-dep", severity: "low", confidence: "high",
+      title: `Go import without a module manifest: ${name}`,
+      reason: "An indexed external Go import exists, but no go.mod was discovered.",
+      detail: `"${entry.spec || name}" is imported by ${entry.file}, but no go.mod exists in the repository.`,
+      package: name, file: entry.file, line: entry.line || 0, source: "internal",
+      verification: { evidenceModel: "MANIFEST_PLUS_INDEXED_SOURCE", decision: "ACTION_REQUIRED", manifestDeclaration: { status: "NOT_PRESENT" }, indexedSourceImports: { status: "FOUND", count: 1, files: [entry.file] }, mapping: "Go module prefix" },
+      fixHint: "initialize or restore the owning Go module manifest",
+    }));
+  }
+  for (const scope of scopes) {
+    if (!scope.parsed.module) issues.push(`${scope.file}: module directive is missing or unreadable`);
+    const result = computeGoDepFindings({ externalImports: importsByScope.get(scope), goMod: scope.parsed, nonRuntimeRoots });
+    findings.push(...result.findings.map((finding) => ({
+      ...finding,
+      manifest: scope.file,
+      verification: finding.rule === "missing-dep"
+        ? { evidenceModel: "MANIFEST_PLUS_INDEXED_SOURCE", decision: "ACTION_REQUIRED", manifestDeclaration: { status: "NOT_FOUND", file: scope.file }, indexedSourceImports: { status: "FOUND", count: finding.evidence?.length || 1, files: (finding.evidence || []).map((item) => item.file) }, mapping: "longest go.mod module prefix" }
+        : { evidenceModel: "MANIFEST_PLUS_INDEXED_SOURCE", decision: "REVIEW_REQUIRED", manifestDeclaration: { status: "FOUND", file: scope.file }, indexedSourceImports: { status: "ZERO_FOUND", completeness: "COMPLETE_FOR_GRAPH_SCOPE", count: 0, files: [] }, mapping: "longest go.mod module prefix" },
+    })));
+    for (const name of result.declared) declared.add(`${scope.root || "."}:${name}`);
+  }
+  const present = manifests.length > 0;
+  return {
+    present,
+    status: present ? "CHECKED" : "NOT_PRESENT",
+    completeness: present ? (issues.length ? "PARTIAL" : "COMPLETE") : "NOT_APPLICABLE",
+    manifests,
+    declared,
+    findings,
+    reasons: issues,
+    reason: !present
+      ? "No go.mod was discovered."
+      : issues.length
+        ? `Go imports and requirements were checked across ${manifests.length} module(s), but ${issues.length} module descriptor(s) were incomplete.`
+        : `Every discovered go.mod scope (${manifests.length}) was compared with indexed Go imports, including direct/indirect requirements and replace directives.`,
+  };
+}

package/src/analysis/health-capabilities.js

@@ -38,7 +38,7 @@ export function buildHealthCapabilityMatrix({
   const unsupportedDependencyRows = ecosystemRows.filter((item) => item.status === "NOT_SUPPORTED");
   const noDependencyEvidence = ecosystemRows.length === 0;
   const onlyUnsupportedDependencies = unsupportedDependencyRows.length > 0 && supportedDependencyRows.length === 0;
-  const advisorySupported = supportedDependencyRows.some((item) => ["npm", "go", "python"].includes(item.ecosystem));
+  const advisorySupported = supportedDependencyRows.some((item) => ["npm", "go", "python", "rust", "maven", "gradle"].includes(item.ecosystem));
   const malwareSupported = supportedDependencyRows.some((item) => ["npm", "go", "python"].includes(item.ecosystem));
   const coverageSupported = [...languages].some((language) => ["javascript/typescript", "python", "go"].includes(language));
   const runtimeFiles = Number(correctnessCoverage.runtimeCorrectnessFiles || 0);

package/src/analysis/hot-path-review.js

@@ -5,14 +5,12 @@ import {readCoverageForRepo, normalizeRepoParts} from './coverage-reports.js'
 import {computeStaticTestReachability} from './static-test-reachability.js'
 import {createPathClassifier, hasPathClass} from '../path-classification.js'
 import {isStructuralRelation} from '../graph/relations.js'
+import {boundedInteger} from '../util.js'
 
 const NON_PRODUCT = ['generated', 'mock', 'story', 'docs', 'benchmark', 'temp']
 const endpoint = (value) => String(value && typeof value === 'object' ? value.id : value || '')
 const normalize = (value) => String(value || '').replace(/\\/g, '/').replace(/^\.\//, '').replace(/\/+$/, '')
-const boundedInt = (value, fallback, min, max) => {
-    const number = Number(value)
-    return Number.isInteger(number) ? Math.max(min, Math.min(max, number)) : fallback
-}
+const boundedInt = boundedInteger
 const round = (value) => Math.round(Number(value || 0) * 100) / 100
 const clamp = (value, min = 0, max = 100) => Math.max(min, Math.min(max, Number(value) || 0))
 

package/src/analysis/http-contracts/analysis.js

@@ -67,6 +67,7 @@ export function analyzeHttpContracts(input = {}) {
       autoDiscoverWrappers: descriptor.autoDiscoverWrappers ?? input.autoDiscoverWrappers,
       graph: descriptor.graph,
       includeTests: descriptor.includeTests ?? input.includeTests,
+      runtimeValues: descriptor.runtimeValues || input.runtimeValues,
     });
     if (detected.truncated) completeness.push(`${id}: client scan cap reached`);
     for (const reason of detected.reasons || []) completeness.push(`${id}: ${reason}`);
@@ -141,6 +142,7 @@ export function analyzeHttpContracts(input = {}) {
     })))
     .sort((left, right) => left.clientRepo.localeCompare(right.clientRepo) || left.file.localeCompare(right.file) || left.line - right.line);
   if (uncertainAll.length > limits.maxUncertain) completeness.push("uncertain callsite cap reached");
+  if (uncertainAll.length) completeness.push(`${uncertainAll.length} dynamic HTTP callsite(s) remain UNKNOWN`);
   if (results.some((endpoint) => !endpoint.affected.complete)) completeness.push("affected-file traversal cap reached");
 
   return {

package/src/analysis/http-contracts/client-call-detection.js

@@ -55,6 +55,7 @@ export function detectHttpClientCalls(repoRoot, codeFiles, options = {}) {
       clientNames,
       normalizedWrappers: [...configured, ...scopedDiscovered],
       maxCalls: remaining,
+      runtimeValues: options.runtimeValues,
     });
     calls.push(...extracted.calls);
     if (extracted.truncated) truncated = true;

package/src/analysis/http-contracts/client-call-parser.js

@@ -91,7 +91,7 @@ function templateArgument(text, start, constants = null, requireStatic = false)
     }
     if (depth !== 0) return null;
     const expression = text.slice(index + 2, cursor - 1).trim();
-    if (/^[A-Za-z_$][\w$]*$/.test(expression) && constants?.has(expression)) {
+    if (/^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*$/.test(expression) && constants?.has(expression)) {
       value += constants.get(expression);
       index = cursor - 1;
       continue;
@@ -109,7 +109,7 @@ function templateArgument(text, start, constants = null, requireStatic = false)
   return null;
 }
 
-function extractStaticStringConstants(text) {
+function extractStaticStringConstants(text, runtimeValues = {}) {
   const source = String(text || "");
   const mask = maskNonCode(source);
   const declarations = [];
@@ -120,7 +120,8 @@ function extractStaticStringConstants(text) {
     while (/\s/.test(source[start] || "")) start++;
     declarations.push({ name: match[1], start });
   }
-  const constants = new Map();
+  const constants = new Map(Object.entries(runtimeValues || {})
+    .filter(([key, value]) => /^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*$/.test(key) && typeof value === "string" && value.length <= 2_048));
   for (const item of declarations) {
     const quote = source[item.start];
     if (quote !== "'" && quote !== '"') continue;
@@ -138,6 +139,19 @@ function extractStaticStringConstants(text) {
     }
     if (!changed) break;
   }
+  for (const item of declarations) {
+    if (constants.has(item.name)) continue;
+    const rest = source.slice(item.start);
+    const expression = /^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*/.exec(rest)?.[0];
+    if (expression && constants.has(expression)) constants.set(item.name, constants.get(expression));
+    if (constants.has(item.name)) continue;
+    const fallback = /(?:\|\||\?\?)\s*(["'])/.exec(rest.slice(0, 500));
+    if (fallback) {
+      const start = item.start + fallback.index + fallback[0].lastIndexOf(fallback[1]);
+      const parsed = quotedArgument(source, start, fallback[1]);
+      if (parsed && parsed.value.length <= 2_048) constants.set(item.name, parsed.value);
+    }
+  }
   return constants;
 }
 
@@ -211,7 +225,7 @@ const escapeRegex = (value) => String(value).replace(/[|\\{}()[\]^$+*?.-]/g, "\\
 export function extractHttpClientCallsFromText(text, file, options = {}) {
   const source = String(text || "");
   const mask = maskNonCode(source);
-  const constants = extractStaticStringConstants(source);
+  const constants = extractStaticStringConstants(source, options.runtimeValues);
   const allowed = normalizedClientNames(options.clientNames);
   const wrappers = normalizeHttpWrapperDescriptors(options.wrappers, "input").concat(Array.isArray(options.normalizedWrappers) ? options.normalizedWrappers : []);
   const maxCalls = boundedInteger(options.maxCalls, HTTP_CONTRACT_DEFAULTS.maxCallsPerClient, 1, HTTP_CONTRACT_HARD_LIMITS.maxCallsPerClient);

package/src/analysis/http-contracts/shared.js

@@ -1,3 +1,5 @@
+import { boundedInteger } from "../../util.js";
+
 export const HTTP_CONTRACTS_V = 2;
 export const HTTP_CONTRACT_METHODS = new Set(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"]);
 
@@ -38,10 +40,7 @@ export function normalizeContractFile(value) {
   return normalized.split("/").some((part) => !part || part === "." || part === "..") ? "" : normalized;
 }
 
-export function boundedInteger(value, fallback, min, max) {
-  const number = Number(value);
-  return Number.isInteger(number) ? Math.max(min, Math.min(max, number)) : fallback;
-}
+export { boundedInteger };
 
 export function safeContractName(value, fallback) {
   const text = String(value || "").trim();

package/src/analysis/internal-audit/dependency-health.js

@@ -10,6 +10,7 @@ export function buildDependencyHealth({
   goDep,
   pyDep,
   jvmDependencies,
+  cargoDep,
   externalImports,
   findings,
   packageScopes,
@@ -20,8 +21,8 @@ export function buildDependencyHealth({
   const dependencyFindings = findings.filter((finding) => ["unused-dep", "missing-dep", "duplicate-dep"].includes(finding.rule));
   const graphComplete = !((graph.graphBuildMode && graph.graphBuildMode !== "full") || graph.graphBuildScope);
   const npmManifests = repoFiles.filter((file) => /(^|\/)package\.json$/i.test(file));
-  const goManifests = repoFiles.filter((file) => /(^|\/)go\.mod$/i.test(file));
   const pythonManifests = [...new Set((pyManifest.scopes || []).flatMap((scope) => scope.manifests || []))];
+  const publicEvidence = ({ findings: _findings, ...item }) => item;
   const ecosystems = {
     npm: {
       ecosystem: "npm",
@@ -36,28 +37,29 @@ export function buildDependencyHealth({
     },
     go: {
       ecosystem: "go",
-      present: goManifests.length > 0,
-      status: goManifests.length ? "CHECKED" : "NOT_PRESENT",
-      completeness: goManifests.length ? "PARTIAL" : "NOT_APPLICABLE",
-      manifests: goManifests,
+      present: goDep.present,
+      status: goDep.status,
+      completeness: graphComplete && goDep.completeness === "COMPLETE" ? "COMPLETE" : goDep.completeness,
+      manifests: goDep.manifests,
       declared: goDep.declared.size,
-      reason: goManifests.length
-        ? "Go dependency checks use indexed imports and the root go.mod; nested modules and build-tag-specific resolution are not fully modeled."
-        : "No go.mod was discovered.",
+      reason: goDep.reason,
     },
     python: {
       ecosystem: "python",
       present: pyManifest.present,
       status: pyManifest.present ? "CHECKED" : "NOT_PRESENT",
-      completeness: pyManifest.present ? "PARTIAL" : "NOT_APPLICABLE",
+      completeness: pyManifest.present ? (graphComplete && pyManifest.completeness === "COMPLETE" ? "COMPLETE" : "PARTIAL") : "NOT_APPLICABLE",
       manifests: pythonManifests,
       declared: pyDep.declared.size,
       reason: pyManifest.present
-        ? "Python declarations were compared with indexed imports; environment markers, extras and dynamic imports remain bounded static evidence."
+        ? pyManifest.reasons?.length
+          ? `Python declarations were compared with indexed imports, but ${pyManifest.reasons.join("; ")}.`
+          : "Every discovered supported Python manifest scope was compared with indexed imports. Environment markers and extras are normalized as declarations; runtime-computed imports remain outside static proof."
         : "No supported Python dependency manifest was discovered.",
     },
-    maven: { ecosystem: "maven", ...jvmDependencies.maven },
-    gradle: { ecosystem: "gradle", ...jvmDependencies.gradle },
+    maven: { ecosystem: "maven", ...publicEvidence(jvmDependencies.maven), completeness: jvmDependencies.maven.present && !graphComplete ? "PARTIAL" : jvmDependencies.maven.completeness },
+    gradle: { ecosystem: "gradle", ...publicEvidence(jvmDependencies.gradle), completeness: jvmDependencies.gradle.present && !graphComplete ? "PARTIAL" : jvmDependencies.gradle.completeness },
+    rust: { ecosystem: "rust", ...publicEvidence(cargoDep), declared: cargoDep.declared.size, completeness: cargoDep.present && !graphComplete ? "PARTIAL" : cargoDep.completeness },
   };
   const present = Object.values(ecosystems).filter((item) => item.present);
   const status = present.length === 0
@@ -68,7 +70,7 @@ export function buildDependencyHealth({
   const importedPackages = new Set(externalImports
     .filter((entry) => entry?.pkg && !entry.builtin && !entry.unresolved)
     .map((entry) => `${entry.ecosystem || (/\.java$/i.test(entry.file || "") ? "maven-unresolved" : "npm")}:${entry.pkg}`));
-  const supportedDeclared = dep.declared.size + goDep.declared.size + pyDep.declared.size;
+  const supportedDeclared = dep.declared.size + goDep.declared.size + pyDep.declared.size + cargoDep.declared.size;
   const jvmDeclared = jvmDependencies.maven.declared + jvmDependencies.gradle.declared;
   const measuredCoverage = readCoverageForRepo(repoPath, sourceFiles);
   const healthCapabilities = buildHealthCapabilityMatrix({

package/src/analysis/internal-audit/python-manifests.js

@@ -1,4 +1,4 @@
-import {dirname} from 'node:path'
+import {dirname, posix} from 'node:path'
 import {createRepoBoundary} from '../../repo-path.js'
 import {parseRequirementsNames, parsePyprojectDeps, parsePipfileDeps, pep503} from '../manifests.js'
 import {listRepoFiles, readRepoText} from './repo-files.js'
@@ -25,6 +25,8 @@ export function collectPyManifest(repoRoot) {
         scope.deps.push(...parsedDeps.map((dep) => ({...dep, manifest})))
     }
     const files = listRepoFiles(repoRoot)
+    const fileSet = new Set(files.map((file) => file.replace(/\\/g, '/')))
+    const reasons = []
     for (const file of files.filter((name) => /(^|\/)requirements[\w.-]*\.(?:txt|in)$/i.test(name)
         || /(^|\/)requirements\/[^/]+\.(?:txt|in)$/i.test(name))) {
         const text = readRepoText(boundary, file)
@@ -33,14 +35,23 @@ export function collectPyManifest(repoRoot) {
         const root = /(^|\/)requirements$/i.test(parent) ? normalizeRoot(dirname(parent)) : parent
         const dev = /dev|test|lint|doc|ci/i.test(file.slice(file.lastIndexOf('/') + 1))
         addManifest(root, file, parseRequirementsNames(text).map((dep) => ({...dep, dev})))
+        for (const match of text.matchAll(/^\s*(?:-r|--requirement|-c|--constraint)\s+(?:=\s*)?([^\s#]+)/gmi)) {
+            const parentDir = normalizeRoot(dirname(file))
+            const target = normalizeRoot(posix.normalize(`${parentDir ? `${parentDir}/` : ''}${match[1].replace(/\\/g, '/')}`))
+            if (!target || target.startsWith('../') || !fileSet.has(target)) reasons.push(`${file}: referenced requirements file ${match[1]} was not discovered`)
+        }
     }
     for (const file of files.filter((name) => /(^|\/)pyproject\.toml$/i.test(name))) {
-        const parsed = parsePyprojectDeps(readRepoText(boundary, file))
-        addManifest(dirname(file), file, parsed.deps, parsed.present)
+        const text = readRepoText(boundary, file)
+        const parsed = parsePyprojectDeps(text)
+        const dependencyManifest = parsed.present || /^\s*\[(?:project|tool\.poetry)\]/m.test(text || '')
+        addManifest(dirname(file), file, parsed.deps, dependencyManifest)
+        if (/\bdynamic\s*=\s*\[[^\]]*["']dependencies["']/s.test(text || '')) reasons.push(`${file}: project dependencies are dynamic`)
     }
     for (const file of files.filter((name) => /(^|\/)Pipfile$/i.test(name))) {
-        const parsed = parsePipfileDeps(readRepoText(boundary, file))
-        addManifest(dirname(file), file, parsed.deps, parsed.present)
+        const text = readRepoText(boundary, file)
+        const parsed = parsePipfileDeps(text)
+        addManifest(dirname(file), file, parsed.deps, parsed.present || /^\s*\[(?:packages|dev-packages)\]/mi.test(text || ''))
     }
     const normalizedScopes = [...scopes.values()]
         .map((scope) => {
@@ -61,5 +72,7 @@ export function collectPyManifest(repoRoot) {
         present: normalizedScopes.some((scope) => scope.present),
         deps: normalizedScopes.flatMap((scope) => scope.deps),
         scopes: normalizedScopes,
+        completeness: reasons.length ? 'PARTIAL' : 'COMPLETE',
+        reasons: [...new Set(reasons)].sort(),
     }
 }

package/src/analysis/internal-audit/repo-files.js

@@ -12,15 +12,14 @@ export const readJson = (path) => {
     try { return JSON.parse(readFileSync(path, 'utf8')) } catch { return null }
 }
 
-export const readRepoText = (boundary, relativePath) => {
+const readRepoFile = (boundary, relativePath, reader) => {
     const resolved = boundary.resolve(relativePath)
-    return resolved.ok ? readText(resolved.path) : null
+    return resolved.ok ? reader(resolved.path) : null
 }
 
-export const readRepoJson = (boundary, relativePath) => {
-    const resolved = boundary.resolve(relativePath)
-    return resolved.ok ? readJson(resolved.path) : null
-}
+export const readRepoText = (boundary, relativePath) => readRepoFile(boundary, relativePath, readText)
+
+export const readRepoJson = (boundary, relativePath) => readRepoFile(boundary, relativePath, readJson)
 
 const SKIP_DIRS = new Set([
     '.git', '.hg', '.svn', 'node_modules', 'vendor', 'dist', 'build', 'coverage', '.next', 'out',

package/src/analysis/internal-audit/supply-chain.js

@@ -12,6 +12,8 @@ const removalHint = (pkg) => {
   if (pkg?.ecosystem === "npm") return `npm uninstall ${pkg.name} and audit what it touched`;
   if (pkg?.ecosystem === "PyPI") return `remove ${pkg.name} from the Python environment/manifest and audit what it touched`;
   if (pkg?.ecosystem === "Go") return `remove ${pkg.name} from the Go module graph, run go mod tidy, and audit what it touched`;
+  if (pkg?.ecosystem === "crates.io") return `cargo remove ${pkg.name}, rebuild every feature/target, and audit what it touched`;
+  if (pkg?.ecosystem === "Maven") return `remove or upgrade ${pkg.name} in Maven/Gradle, refresh the resolved graph, and audit what it touched`;
   return `remove ${pkg?.name || "the package"} with its ecosystem's package manager and audit what it touched`;
 };
 

package/src/analysis/internal-audit.reach.js

@@ -118,6 +118,20 @@ export function entryFiles(graph, pkgOrScopes, dynamicTargets = new Set(), { dec
       if (target) entries.add(target);
     }
   }
+  // Drizzle Kit loads schema modules from configuration strings rather than a
+  // runtime import. Resolve the bounded `schema:` value so the schema and its
+  // exported tables are not reported as orphan/test-only production code.
+  for (const [rawFile, rawText] of sources || []) {
+    const configFile = String(rawFile || "").replace(/\\/g, "/");
+    if (!/(^|\/)drizzle(?:\.[^/]*)?\.config\.[cm]?[jt]s$/i.test(configFile)) continue;
+    const value = /\bschema\s*:\s*(\[[\s\S]{0,1000}?\]|["'][^"']+["'])/i.exec(String(rawText || ""))?.[1] || "";
+    const quoted = /["']([^"']+)["']/g;
+    let match;
+    while ((match = quoted.exec(value))) {
+      const candidate = posix.normalize(posix.join(posix.dirname(configFile), match[1].replace(/^\.\//, "")));
+      if (fileSet.has(candidate)) entries.add(candidate);
+    }
+  }
   for (const evidence of springConventionEntries(sources, fileSet)) {
     entries.add(evidence.file);
     conventionEvidence.push(evidence);

package/src/analysis/internal-audit.run.js

@@ -1,7 +1,7 @@
 import { existsSync } from "node:fs";
 import { basename, join } from "node:path";
 import { computeDead, computeUnusedExports } from "./dead-check.js";
-import { computeGoDepFindings, computePyDepFindings, computeScopedDepFindings } from "./dep-check.js";
+import { computePyDepFindings, computeScopedDepFindings } from "./dep-check.js";
 import { computeStructureFindings } from "./dep-rules.js";
 import { makeFinding, sortFindings, summarizeFindings } from "./findings.js";
 import { graphOutDirForRepo } from "../graph/layout.js";
@@ -15,17 +15,17 @@ import {
   listRepoFiles,
   readJson,
   readRepoJson,
-  readRepoText,
   workspacePkgNames,
 } from "./internal-audit.collect.js";
 import { computeReachability, entryFiles } from "./internal-audit.reach.js";
-import { parseGoMod } from "./manifests.js";
 import { PATH_CLASS_NAMES, createPathClassifier, hasPathClass } from "../path-classification.js";
 import { createRepoBoundary } from "../repo-path.js";
 import { analyzeSourceCorrectness } from "./source-correctness.js";
 import { collectJvmDependencyEvidence } from "./jvm-dependency-evidence.js";
 import { buildDependencyHealth } from "./internal-audit/dependency-health.js";
 import { runSupplyChainChecks } from "./internal-audit/supply-chain.js";
+import { collectGoDependencyEvidence } from "./go-dependency-evidence.js";
+import { collectCargoDependencyEvidence } from "./cargo-dependency-evidence.js";
 
 export async function runInternalAudit(repoPath, {
   graph,
@@ -90,8 +90,7 @@ export async function runInternalAudit(repoPath, {
     nonRuntimeRoots,
     sourceFiles: [...sources.keys()],
   });
-  const goModText = readRepoText(boundary, "go.mod");
-  const goDep = computeGoDepFindings({ externalImports, goMod: goModText != null ? parseGoMod(goModText) : null, nonRuntimeRoots });
+  const goDep = collectGoDependencyEvidence(repoPath, { files: repoFiles, externalImports, nonRuntimeRoots });
   const asList = (value) => Array.isArray(value) ? value : typeof value === "string" ? [value] : [];
   const pyRules = rules.python || {}, depRules = rules.dependencies || {};
   const managedPython = [...new Set([
@@ -109,15 +108,20 @@ export async function runInternalAudit(repoPath, {
     ignoredDependencies: ignoredPython,
     nonRuntimeRoots,
   });
-  const jvmDependencies = collectJvmDependencyEvidence(repoPath, { files: repoFiles });
+  const jvmDependencies = collectJvmDependencyEvidence(repoPath, { files: repoFiles, externalImports });
+  const cargoDep = collectCargoDependencyEvidence(repoPath, { files: repoFiles, externalImports });
 
   const externalImportFiles = new Set(externalImports.filter((entry) => entry.pkg && !entry.builtin).map((entry) => entry.file));
   const structure = computeStructureFindings(graph, { rules, entrySet: entries, externalImportFiles });
   const correctness = analyzeSourceCorrectness(sources, { isNonProductPath });
-  const findings = [...dep.findings, ...goDep.findings, ...pyDep.findings, ...correctness.findings];
+  const findings = [
+    ...dep.findings, ...goDep.findings, ...pyDep.findings,
+    ...jvmDependencies.maven.findings, ...jvmDependencies.gradle.findings, ...cargoDep.findings,
+    ...correctness.findings,
+  ];
   const deadFileSet = new Set(dead.deadFiles.map((finding) => finding.file));
   for (const finding of structure.findings) {
-    if (!(finding.rule === "orphan-file" && deadFileSet.has(finding.file))) findings.push(finding);
+    if (!(finding.rule === "orphan-file" && (deadFileSet.has(finding.file) || entries.has(finding.file)))) findings.push(finding);
   }
 
   const actionableDeadFiles = dead.deadFiles.filter((finding) => !isNonProductPath(finding.file));
@@ -138,7 +142,7 @@ export async function runInternalAudit(repoPath, {
   }
   let unusedExportCount = 0;
   for (const symbol of unusedExports) {
-    if (symbol.test || isNonProductPath(symbol.file)) continue;
+    if (symbol.test || isNonProductPath(symbol.file) || entries.has(symbol.file) || dynamicTargets.has(symbol.file)) continue;
     if (/(^|\/)[^/]*\.config\.[a-z0-9]+$|(^|\/)\.[^/]+rc(\.[a-z]+)?$/i.test(symbol.file)) continue;
     findings.push(makeFinding({
       category: "unused",
@@ -155,7 +159,7 @@ export async function runInternalAudit(repoPath, {
     unusedExportCount++;
   }
   for (const symbol of dead.testOnlySymbols || []) {
-    if (isNonProductPath(symbol.file)) continue;
+    if (isNonProductPath(symbol.file) || entries.has(symbol.file) || dynamicTargets.has(symbol.file)) continue;
     findings.push(makeFinding({
       category: "unused",
       rule: "test-only-symbol",
@@ -190,6 +194,7 @@ export async function runInternalAudit(repoPath, {
     goDep,
     pyDep,
     jvmDependencies,
+    cargoDep,
     externalImports,
     findings: sorted,
     packageScopes,