weavatrix 0.2.15 → 0.2.18

package/src/analysis/jvm-dependency-evidence.js

@@ -1,69 +1,115 @@
-// Maven/Gradle manifest presence and bounded declaration counts. We intentionally do not map Java
-// imports to artifacts: package-to-artifact resolution needs a real build model and claiming 0/0 from
-// source regexes would be worse than an explicit NOT_SUPPORTED/PARTIAL state.
 import { createRepoBoundary } from "../repo-path.js";
+import { dependencyVerification, makeFinding } from "./findings.js";
+import { parseGradleDependencies, parseGradleVersionCatalog, parseMavenPom } from "./jvm-manifests.js";
 import { listRepoFiles, readRepoText } from "./internal-audit.collect.js";
 
-function mavenDeclarations(text) {
-  const source = String(text || "")
-    .replace(/<!--[\s\S]*?-->/g, " ")
-    .replace(/<dependencyManagement\b[\s\S]*?<\/dependencyManagement>/gi, " ");
-  const identities = [];
-  const re = /<dependency\b[^>]*>([\s\S]*?)<\/dependency>/gi;
-  let match;
-  while ((match = re.exec(source))) {
-    const group = /<groupId>\s*([^<]+?)\s*<\/groupId>/i.exec(match[1])?.[1]?.trim() || "";
-    const artifact = /<artifactId>\s*([^<]+?)\s*<\/artifactId>/i.exec(match[1])?.[1]?.trim() || "";
-    if (artifact) identities.push(group ? `${group}:${artifact}` : artifact);
-  }
-  return identities;
+const normalize = (value) => String(value || "").toLowerCase().replace(/[^a-z0-9]+/g, "");
+const javaBuiltin = (name) => /^(?:java|jdk|sun)\.|^(?:org\.w3c\.dom|org\.xml\.sax)(?:\.|$)/.test(name);
+
+function mappingScore(spec, dependency) {
+  const imported = String(spec || "").replace(/\.\*$/, "");
+  if (!imported || !dependency.group) return 0;
+  if (imported === dependency.group || imported.startsWith(`${dependency.group}.`)) return 1_000 + dependency.group.length;
+  const compactImport = normalize(imported), compactArtifact = normalize(dependency.artifact);
+  if (compactArtifact.length >= 4 && compactImport.includes(compactArtifact)) return 500 + compactArtifact.length;
+  const artifactTokens = String(dependency.artifact).toLowerCase().split(/[-_.]+/).filter((part) => part.length >= 4 && !["core", "java", "client", "common", "api"].includes(part));
+  const hits = artifactTokens.filter((part) => imported.toLowerCase().split(".").some((segment) => normalize(segment) === normalize(part))).length;
+  return hits ? 100 + hits : 0;
+}
+
+function bestDependency(spec, dependencies) {
+  const ranked = dependencies.map((dependency) => ({ dependency, score: mappingScore(spec, dependency) }))
+    .filter((item) => item.score > 0).sort((left, right) => right.score - left.score || left.dependency.name.localeCompare(right.dependency.name));
+  if (!ranked.length || (ranked[1] && ranked[1].score === ranked[0].score)) return null;
+  return ranked[0].dependency;
 }
 
-function gradleDeclarations(text) {
-  const source = String(text || "")
-    .replace(/\/\*[\s\S]*?\*\//g, " ")
-    .replace(/(^|\s)\/\/.*$/gm, "$1");
-  const declarations = [];
-  const configurations = "api|implementation|compileOnly|runtimeOnly|annotationProcessor|kapt|testImplementation|testCompileOnly|testRuntimeOnly|androidTestImplementation";
-  const line = new RegExp(`^\\s*(?:${configurations})\\s*(?:\\(\\s*)?([^\\r\\n]+)`, "gmi");
-  let match;
-  while ((match = line.exec(source))) {
-    const expression = match[1].trim().replace(/[),;]+\s*$/, "");
-    const coordinate = /["']([^"']+:[^"']+)["']/.exec(expression)?.[1] || "";
-    const catalog = /\blibs(?:\.[A-Za-z_]\w*)+/.exec(expression)?.[0] || "";
-    declarations.push(coordinate || catalog || "unresolved-declaration");
+function analyze(ecosystem, manifests, dependencies, imports, unresolvedDeclarations, mappingDependencies = dependencies, includeMissing = true) {
+  const findings = [], used = new Map(), missing = new Map();
+  const owned = new Set(dependencies.map((dependency) => dependency.name));
+  for (const item of imports) {
+    const dependency = bestDependency(item.spec || item.pkg, mappingDependencies);
+    if (dependency) {
+      if (owned.has(dependency.name)) {
+        const list = used.get(dependency.name) || [];
+        list.push(item); used.set(dependency.name, list);
+      }
+    } else {
+      const key = item.spec || item.pkg;
+      const list = missing.get(key) || [];
+      list.push(item); missing.set(key, list);
+    }
   }
-  return declarations;
+  const runtimeOnly = /runtime|provided|classpath|annotationProcessor|kapt/i;
+  for (const dependency of dependencies) {
+    const evidence = used.get(dependency.name) || [];
+    if (evidence.length || dependency.optional || runtimeOnly.test(dependency.scope || "")) continue;
+    findings.push(makeFinding({
+      category: "unused", rule: "unused-dep", severity: "low", confidence: "low",
+      title: `Unused ${ecosystem} dependency: ${dependency.name}`,
+      reason: "No indexed Java import mapped to this declared artifact; reflection, service loading, generated code and runtime-only use remain possible.",
+      detail: `"${dependency.name}" is declared in ${dependency.file}, but no indexed Java import maps to it. Review framework, reflection, ServiceLoader and generated-source use before removal.`,
+      package: dependency.name, version: dependency.version, manifest: dependency.file, source: "internal",
+      verification: dependencyVerification(dependency.file, [], "REVIEW_REQUIRED", "group-prefix/artifact-token"),
+      fixHint: `remove ${dependency.name} only after the ${ecosystem} build and tests confirm it is unused`,
+    }));
+  }
+  for (const [spec, evidence] of includeMissing ? missing : []) {
+    if (javaBuiltin(spec)) continue;
+    findings.push(makeFinding({
+      category: "unused", rule: "missing-dep", severity: "medium", confidence: "medium",
+      title: `Unmapped Java import: ${spec}`,
+      reason: `The indexed Java import did not map to any declared ${ecosystem} artifact.`,
+      detail: `"${spec}" is imported by ${evidence.length} file(s), but no ${ecosystem} declaration has a matching group prefix or artifact token. Add the owning artifact or configure/build the source that supplies it.`,
+      package: spec, file: evidence[0].file, line: evidence[0].line || 0,
+      evidence: evidence.slice(0, 5).map((item) => ({ file: item.file, line: item.line || 0, snippet: item.spec || "" })),
+      source: "internal",
+      verification: { evidenceModel: "MANIFEST_PLUS_INDEXED_SOURCE", decision: "ACTION_REQUIRED", manifestDeclaration: { status: "NOT_FOUND", files: manifests }, indexedSourceImports: { status: "FOUND", count: evidence.length, files: evidence.map((item) => item.file).slice(0, 10) }, mapping: "group-prefix/artifact-token" },
+      fixHint: `identify the artifact that owns ${spec} and declare it in the nearest ${ecosystem} manifest`,
+    }));
+  }
+  const present = manifests.length > 0;
+  return {
+    present,
+    status: present ? "CHECKED" : "NOT_PRESENT",
+    completeness: present ? (unresolvedDeclarations ? "PARTIAL" : "COMPLETE") : "NOT_APPLICABLE",
+    manifests,
+    declared: dependencies.length,
+    mappedImports: [...used.values()].reduce((sum, list) => sum + list.length, 0),
+    unmappedImports: [...missing.values()].reduce((sum, list) => sum + list.length, 0),
+    unresolvedDeclarations,
+    sample: dependencies.slice(0, 20).map(({ file, name, version }) => ({ file, identity: name, version })),
+    reason: !present
+      ? `No ${ecosystem === "maven" ? "pom.xml" : "Gradle build file"} was discovered.`
+      : unresolvedDeclarations
+        ? `${dependencies.length} declarations and all indexed Java imports were checked, but ${unresolvedDeclarations} dynamic/property/catalog declaration(s) could not be resolved statically.`
+        : `${dependencies.length} declarations were compared with every indexed non-JDK Java import using bounded group-prefix and artifact-token evidence. Missing and unused results remain review evidence, not compiler proof.`,
+    findings,
+  };
 }
 
-export function collectJvmDependencyEvidence(repoRoot, { files = listRepoFiles(repoRoot) } = {}) {
+export function collectJvmDependencyEvidence(repoRoot, { files = listRepoFiles(repoRoot), externalImports = [] } = {}) {
   const boundary = createRepoBoundary(repoRoot);
   const mavenFiles = files.filter((file) => /(^|\/)pom\.xml$/i.test(file));
-  const gradleFiles = files.filter((file) => /(^|\/)build\.gradle(?:\.kts)?$/i.test(file));
-  const maven = mavenFiles.flatMap((file) => mavenDeclarations(readRepoText(boundary, file)).map((identity) => ({ file, identity })));
-  const gradle = gradleFiles.flatMap((file) => gradleDeclarations(readRepoText(boundary, file)).map((identity) => ({ file, identity })));
+  const gradleFiles = files.filter((file) => /(^|\/)(?:build|settings|[^/]+)\.gradle(?:\.kts)?$/i.test(file));
+  const catalogFiles = files.filter((file) => /(^|\/)libs\.versions\.toml$/i.test(file));
+  const catalog = new Map();
+  for (const file of catalogFiles) for (const [alias, entry] of parseGradleVersionCatalog(readRepoText(boundary, file))) catalog.set(alias, entry);
+  let mavenUnresolved = 0, gradleUnresolved = 0;
+  const mavenDependencies = mavenFiles.flatMap((file) => {
+    const parsed = parseMavenPom(readRepoText(boundary, file));
+    mavenUnresolved += parsed.unresolvedDeclarations;
+    return parsed.dependencies.map((dependency) => ({ ...dependency, file }));
+  });
+  const gradleDependencies = gradleFiles.flatMap((file) => {
+    const parsed = parseGradleDependencies(readRepoText(boundary, file), catalog);
+    gradleUnresolved += parsed.unresolvedDeclarations || 0;
+    return parsed.map((dependency) => ({ ...dependency, file }));
+  });
+  const javaImports = externalImports.filter((entry) => entry.ecosystem === "Maven" && entry.pkg && !entry.builtin && !entry.unresolved);
+  const allDependencies = [...mavenDependencies, ...gradleDependencies];
   return {
-    maven: {
-      present: mavenFiles.length > 0,
-      status: mavenFiles.length ? "NOT_SUPPORTED" : "NOT_PRESENT",
-      completeness: mavenFiles.length ? "PARTIAL" : "NOT_APPLICABLE",
-      manifests: mavenFiles,
-      declared: maven.length,
-      sample: maven.slice(0, 20),
-      reason: mavenFiles.length
-        ? "Maven manifests and declaration counts were detected, but Java package imports were not mapped to Maven artifacts; unused/missing dependency verdicts are not supported."
-        : "No pom.xml was discovered.",
-    },
-    gradle: {
-      present: gradleFiles.length > 0,
-      status: gradleFiles.length ? "NOT_SUPPORTED" : "NOT_PRESENT",
-      completeness: gradleFiles.length ? "PARTIAL" : "NOT_APPLICABLE",
-      manifests: gradleFiles,
-      declared: gradle.length,
-      sample: gradle.slice(0, 20),
-      reason: gradleFiles.length
-        ? "Gradle manifests and bounded dependency declarations were detected, but version catalogs/build logic and Java package-to-artifact mapping were not resolved; unused/missing dependency verdicts are not supported."
-        : "No build.gradle/build.gradle.kts was discovered.",
-    },
+    maven: analyze("maven", mavenFiles, mavenDependencies, javaImports, mavenUnresolved, allDependencies, true),
+    gradle: analyze("gradle", [...gradleFiles, ...catalogFiles], gradleDependencies, javaImports, gradleUnresolved, allDependencies, mavenFiles.length === 0),
   };
 }

package/src/analysis/jvm-manifests.js

@@ -0,0 +1,114 @@
+const stripComments = (value) => String(value || "").replace(/<!--[\s\S]*?-->/g, " ");
+const clean = (value) => String(value || "").trim().replace(/^['"]|['"]$/g, "");
+
+function xmlValue(body, name) {
+  return new RegExp(`<${name}>\\s*([^<]+?)\\s*</${name}>`, "i").exec(body)?.[1]?.trim() || "";
+}
+
+function resolveMavenValue(value, properties) {
+  let output = String(value || "");
+  for (let pass = 0; pass < 8; pass++) {
+    let changed = false;
+    output = output.replace(/\$\{([^}]+)}/g, (whole, key) => {
+      if (!properties.has(key)) return whole;
+      changed = true;
+      return properties.get(key);
+    });
+    if (!changed) break;
+  }
+  return /\$\{/.test(output) ? "" : output.trim();
+}
+
+export function parseMavenPom(text) {
+  const source = stripComments(text);
+  const properties = new Map();
+  const propertyBlock = /<properties\b[^>]*>([\s\S]*?)<\/properties>/i.exec(source)?.[1] || "";
+  for (const match of propertyBlock.matchAll(/<([A-Za-z0-9_.-]+)>\s*([^<]+?)\s*<\/\1>/g)) properties.set(match[1], match[2].trim());
+  const parent = /<parent\b[^>]*>([\s\S]*?)<\/parent>/i.exec(source)?.[1] || "";
+  const beforeDependencies = source.split(/<dependencies\b/i)[0];
+  const projectVersion = xmlValue(beforeDependencies, "version") || xmlValue(parent, "version");
+  const projectGroup = xmlValue(beforeDependencies, "groupId") || xmlValue(parent, "groupId");
+  properties.set("project.version", projectVersion); properties.set("pom.version", projectVersion);
+  properties.set("project.groupId", projectGroup); properties.set("pom.groupId", projectGroup);
+  const managed = new Map();
+  for (const block of source.matchAll(/<dependencyManagement\b[^>]*>([\s\S]*?)<\/dependencyManagement>/gi)) {
+    for (const dep of block[1].matchAll(/<dependency\b[^>]*>([\s\S]*?)<\/dependency>/gi)) {
+      const group = resolveMavenValue(xmlValue(dep[1], "groupId"), properties);
+      const artifact = resolveMavenValue(xmlValue(dep[1], "artifactId"), properties);
+      const version = resolveMavenValue(xmlValue(dep[1], "version"), properties);
+      if (group && artifact && version) managed.set(`${group}:${artifact}`, version);
+    }
+  }
+  const directSource = source.replace(/<dependencyManagement\b[^>]*>[\s\S]*?<\/dependencyManagement>/gi, " ");
+  const dependencies = [];
+  const directBlocks = [...directSource.matchAll(/<dependency\b[^>]*>([\s\S]*?)<\/dependency>/gi)];
+  for (const match of directBlocks) {
+    const group = resolveMavenValue(xmlValue(match[1], "groupId"), properties);
+    const artifact = resolveMavenValue(xmlValue(match[1], "artifactId"), properties);
+    if (!group || !artifact) continue;
+    dependencies.push({
+      group, artifact, name: `${group}:${artifact}`,
+      version: resolveMavenValue(xmlValue(match[1], "version"), properties) || managed.get(`${group}:${artifact}`) || "",
+      scope: xmlValue(match[1], "scope") || "compile",
+      optional: xmlValue(match[1], "optional") === "true",
+    });
+  }
+  return { projectGroup, projectVersion, dependencies, unresolvedDeclarations: directBlocks.length - dependencies.length };
+}
+
+export function parseGradleVersionCatalog(text) {
+  const versions = new Map(), libraries = new Map();
+  let section = "";
+  for (const raw of String(text || "").split(/\r?\n/)) {
+    const line = raw.replace(/(^|\s)#.*$/, "").trim();
+    const header = /^\[([^\]]+)]$/.exec(line);
+    if (header) { section = header[1]; continue; }
+    const kv = /^([A-Za-z0-9_.-]+)\s*=\s*(.+)$/.exec(line);
+    if (!kv) continue;
+    if (section === "versions") { versions.set(kv[1], clean(kv[2])); continue; }
+    if (section !== "libraries") continue;
+    const alias = kv[1], value = kv[2];
+    const module = /\bmodule\s*=\s*["']([^"']+)["']/.exec(value)?.[1]
+      || /\bgroup\s*=\s*["']([^"']+)["'][\s\S]*?\bname\s*=\s*["']([^"']+)["']/.exec(value)?.slice(1, 3).join(":")
+      || (/^["'][^"']+:[^"']+["']$/.test(value) ? clean(value) : "");
+    if (!module) continue;
+    const explicit = /\bversion\s*=\s*["']([^"']+)["']/.exec(value)?.[1] || "";
+    const reference = /\bversion\.ref\s*=\s*["']([^"']+)["']/.exec(value)?.[1] || "";
+    libraries.set(alias.replace(/[_.]/g, "-"), { module, version: explicit || versions.get(reference) || "" });
+  }
+  return libraries;
+}
+
+export function parseGradleDependencies(text, catalog = new Map()) {
+  const source = String(text || "").replace(/\/\*[\s\S]*?\*\//g, " ").replace(/(^|\s)\/\/.*$/gm, "$1");
+  const dependencies = [];
+  const configurations = "api|implementation|compile|compileOnly|runtimeOnly|annotationProcessor|kapt|classpath|testImplementation|testCompileOnly|testRuntimeOnly|androidTestImplementation";
+  const matcher = new RegExp(`^\\s*(${configurations})\\s*(?:\\(\\s*)?([^\\r\\n]+)`, "gmi");
+  const declarations = [...source.matchAll(matcher)];
+  for (const match of declarations) {
+    const expression = match[2].trim().replace(/[),;]+\s*$/, "");
+    const coordinate = /["']([^"']+:[^"']+)["']/.exec(expression)?.[1] || "";
+    if (coordinate) {
+      const [group, artifact, version = ""] = coordinate.split(":");
+      if (group && artifact) dependencies.push({ group, artifact, name: `${group}:${artifact}`, version, scope: match[1] });
+      continue;
+    }
+    const alias = /\blibs((?:\.[A-Za-z_]\w*)+)/.exec(expression)?.[1]?.slice(1).replace(/\./g, "-") || "";
+    const entry = catalog.get(alias);
+    if (entry) {
+      const [group, artifact] = entry.module.split(":");
+      dependencies.push({ group, artifact, name: entry.module, version: entry.version, scope: match[1], catalogAlias: alias });
+    }
+  }
+  dependencies.unresolvedDeclarations = declarations.length - dependencies.length;
+  return dependencies;
+}
+
+export function parseGradleLockPackages(text) {
+  const packages = [];
+  for (const raw of String(text || "").split(/\r?\n/)) {
+    const match = /^([^#=\s:]+(?:\.[^#=\s:]+)*):([^#=\s:]+):([^#=\s=]+)=/.exec(raw.trim());
+    if (match) packages.push({ ecosystem: "Maven", name: `${match[1]}:${match[2]}`, version: match[3], dev: false, integrity: "", source: "gradle-lock" });
+  }
+  return packages;
+}

package/src/analysis/manifests.js

@@ -99,55 +99,6 @@ export function parsePyprojectDeps(text) {
   return { present, deps };
 }
 
-// ---- poetry.lock → [{name, version, deps}] — [[package]] blocks + their [package.dependencies] keys ----
-export function parsePoetryLockDeps(text) {
-  const out = [];
-  let cur = null, inDeps = false;
-  for (const raw of String(text || "").split(/\r?\n/)) {
-    const line = raw.trim();
-    if (line === "[[package]]") { cur = { name: "", version: "", deps: [] }; out.push(cur); inDeps = false; continue; }
-    if (line.startsWith("[")) { inDeps = cur != null && line === "[package.dependencies]"; if (line.startsWith("[[")) cur = null; continue; }
-    if (!cur) continue;
-    if (inDeps) { const m = line.match(/^["']?([A-Za-z0-9][\w.-]*)["']?\s*=/); if (m) cur.deps.push(m[1]); continue; }
-    let m = line.match(/^name\s*=\s*"([^"]+)"/); if (m && !cur.name) { cur.name = m[1]; continue; }
-    m = line.match(/^version\s*=\s*"([^"]+)"/); if (m && !cur.version) cur.version = m[1];
-  }
-  return out.filter((p) => p.name);
-}
-
-// ---- uv.lock → [{name, version, deps}] — [[package]] blocks with dependencies = [{ name = "x" }, …] ----
-export function parseUvLockDeps(text) {
-  const out = [];
-  let cur = null, inArr = false;
-  for (const raw of String(text || "").split(/\r?\n/)) {
-    const line = raw.trim();
-    if (line === "[[package]]") { cur = { name: "", version: "", deps: [] }; out.push(cur); inArr = false; continue; }
-    if (line.startsWith("[") && !inArr) { if (line.startsWith("[[")) cur = null; continue; }
-    if (!cur) continue;
-    if (inArr) { for (const m of line.matchAll(/name\s*=\s*"([^"]+)"/g)) cur.deps.push(m[1]); if (/\]\s*$/.test(line)) inArr = false; continue; }
-    if (/^dependencies\s*=\s*\[/.test(line)) { for (const m of line.matchAll(/name\s*=\s*"([^"]+)"/g)) cur.deps.push(m[1]); inArr = !/\]\s*$/.test(line); continue; }
-    let m = line.match(/^name\s*=\s*"([^"]+)"/); if (m && !cur.name) { cur.name = m[1]; continue; }
-    m = line.match(/^version\s*=\s*"([^"]+)"/); if (m && !cur.version) cur.version = m[1];
-  }
-  return out.filter((p) => p.name);
-}
-
-// ---- installed dist-info METADATA → { name, version, deps, repository } (headers until the first blank
-// line; Requires-Dist entries gated behind `extra ==` markers are optional extras — skipped) ----
-export function parseDistMetadata(text) {
-  const out = { name: "", version: "", deps: [], repository: "" };
-  for (const raw of String(text || "").split(/\r?\n/)) {
-    if (raw.trim() === "") break;
-    let m = raw.match(/^Name:\s*(.+)$/i); if (m) { out.name = m[1].trim(); continue; }
-    m = raw.match(/^Version:\s*(.+)$/i); if (m) { out.version = m[1].trim(); continue; }
-    m = raw.match(/^Requires-Dist:\s*([A-Za-z0-9][\w.-]*)(.*)$/i);
-    if (m) { if (!/extra\s*==/.test(m[2])) out.deps.push(m[1]); continue; }
-    m = raw.match(/^(?:Home-page:\s*|Project-URL:\s*(?:Source|Repository|Homepage|Home|Code)[^,]*,\s*)(https?:\/\/\S+)/i);
-    if (m && !out.repository) out.repository = m[1];
-  }
-  return out;
-}
-
 // ---- Pipfile → { present, deps: [{name, dev}] } — [packages] / [dev-packages] table keys ----
 export function parsePipfileDeps(text) {
   const deps = [];

package/src/analysis/source-correctness.js

@@ -3,12 +3,9 @@
 // the surrounding behavior is wrong.
 import { makeFinding } from "./findings.js";
 import {retryFindings} from './source-correctness/retry-patterns.js'
+import {lineNumberAt} from '../util.js'
 
-const lineAt = (text, index) => {
-  let line = 1;
-  for (let i = 0; i < index && i < text.length; i++) if (text[i] === "\n") line++;
-  return line;
-};
+const lineAt = lineNumberAt;
 
 const lineText = (text, index) => {
   const start = text.lastIndexOf("\n", Math.max(0, index - 1)) + 1;

package/src/analysis/structure/dependency-graph.js

@@ -1,13 +1,8 @@
 import {ENTRY_FILE} from '../dead-check.js'
+import {fileOfId, graphEndpointId} from '../../graph/node-id.js'
 
 const TEST_FILE_RE = /(^|[/])(test|tests|__tests__|spec|e2e|__mocks__)([/]|$)|[._-](test|spec)\.[a-z0-9]+$/i
 const NON_CODE_RE = /\.(json|ya?ml|sh|ps1|md|txt|html?|css|scss|less)$|(^|[/])(dockerfile|containerfile)/i
-const endpoint = (value) => String(value && typeof value === 'object' ? value.id : value)
-const fileOf = (value) => {
-    const id = endpoint(value)
-    const hash = id.indexOf('#')
-    return hash < 0 ? id : id.slice(0, hash)
-}
 const dirOf = (file) => file.includes('/') ? file.slice(0, file.lastIndexOf('/')) : ''
 
 export function buildFileImportGraph(graph, {includeTypeOnly = false, includeCompileOnly = false} = {}) {
@@ -23,7 +18,7 @@ export function buildFileImportGraph(graph, {includeTypeOnly = false, includeCom
     }
     for (const link of graph.links || []) {
         if (link.relation !== 'imports' && link.relation !== 're_exports') continue
-        const source = endpoint(link.source), target = endpoint(link.target)
+        const source = graphEndpointId(link.source), target = graphEndpointId(link.target)
         if (!fileIds.has(source) || !fileIds.has(target) || source === target) continue
         if (source.endsWith('.go') && target.endsWith('.go') && dirOf(source) === dirOf(target)) continue
         const key = `${source}\0${target}`
@@ -112,7 +107,7 @@ export function findOrphans(graph, {entrySet = new Set(), externalImportFiles =
     const degree = new Map()
     for (const link of graph.links || []) {
         if (link.relation === 'contains') continue
-        const source = fileOf(link.source), target = fileOf(link.target)
+        const source = fileOfId(graphEndpointId(link.source)), target = fileOfId(graphEndpointId(link.target))
         if (source === target) continue
         degree.set(source, (degree.get(source) || 0) + 1)
         degree.set(target, (degree.get(target) || 0) + 1)

package/src/analysis/transport-contracts.js

@@ -0,0 +1,157 @@
+import { createRepoBoundary } from "../repo-path.js";
+import { lineNumberAt, uniqueBy } from "../util.js";
+import { listRepoFiles, readRepoText } from "./internal-audit/repo-files.js";
+import { affectedForEndpoint, reverseRuntimeImports } from "./http-contracts/graph-context.js";
+
+const TEST_RE = /(^|\/)(?:test|tests|__tests__|spec|e2e|fixtures?)(\/|$)|[._-](?:test|spec)\.[a-z0-9]+$/i;
+const SOURCE_RE = /\.(?:[cm]?[jt]sx?|py|go|java|rs|cs|proto|graphql|gql)$/i;
+const lineAt = lineNumberAt;
+const norm = (value) => String(value || "").toLowerCase().replace(/[^a-z0-9]+/g, "");
+
+function sourcesFor(descriptor, { includeTests, maxFiles }) {
+  const boundary = createRepoBoundary(descriptor.repoRoot);
+  if (!boundary.root) return { sources: [], reasons: [`${descriptor.id}: repository boundary is unreadable`] };
+  const candidates = listRepoFiles(boundary.root).filter((file) => SOURCE_RE.test(file) && (includeTests || !TEST_RE.test(file))).sort();
+  const sources = [];
+  for (const file of candidates.slice(0, maxFiles)) {
+    const text = readRepoText(boundary, file);
+    if (text != null) sources.push({ file, text });
+  }
+  return { sources, reasons: candidates.length > maxFiles ? [`${descriptor.id}: transport file cap reached`] : [] };
+}
+
+function graphQlEvidence(source, role) {
+  const contracts = [], uncertain = [];
+  for (const schema of source.text.matchAll(/\btype\s+(Query|Mutation|Subscription)\s*(?:extends\s+\w+\s*)?\{([\s\S]*?)\}/gi)) {
+    for (const field of schema[2].matchAll(/^\s*([A-Za-z_]\w*)\s*(?:\([^)]*\))?\s*:/gm)) contracts.push({
+      transport: "graphql", side: "server", operation: schema[1].toUpperCase(), name: field[1], file: source.file,
+      line: lineAt(source.text, schema.index + schema[0].indexOf(field[0])), detector: "graphql-schema",
+    });
+  }
+  for (const operation of source.text.matchAll(/\b(query|mutation|subscription)\s*(?:[A-Za-z_]\w*\s*)?(?:\([^)]*\)\s*)?\{\s*([A-Za-z_]\w*)/gi)) contracts.push({
+    transport: "graphql", side: role === "backend" ? "server-call" : "client", operation: operation[1].toUpperCase(), name: operation[2],
+    file: source.file, line: lineAt(source.text, operation.index), detector: "graphql-operation",
+  });
+  for (const dynamic of source.text.matchAll(/\b(?:gql|graphql)\s*(?:\(|`)\s*\$\{|\b(?:query|mutate)\s*\(\s*(?!["'`])/gi)) uncertain.push({
+    transport: "graphql", file: source.file, line: lineAt(source.text, dynamic.index), reason: "GraphQL document or operation is runtime-computed",
+  });
+  return { contracts, uncertain };
+}
+
+function grpcEvidence(source, role) {
+  const contracts = [], uncertain = [], aliases = new Map();
+  for (const service of source.text.matchAll(/\bservice\s+([A-Za-z_]\w*)\s*\{([\s\S]*?)\}/g)) {
+    for (const rpc of service[2].matchAll(/\brpc\s+([A-Za-z_]\w*)\s*\(/g)) contracts.push({
+      transport: "grpc", side: "server", service: service[1], name: rpc[1], file: source.file,
+      line: lineAt(source.text, service.index + service[0].indexOf(rpc[0])), detector: "proto-service",
+    });
+  }
+  const aliasPatterns = [
+    /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*new\s+([A-Za-z_]\w*(?:Service)?Client)\b/g,
+    /\b([A-Za-z_]\w*)\s*=\s*([A-Za-z_]\w*Stub)\s*\(/g,
+    /\b([A-Za-z_]\w*)\s*:?=\s*\w*\.New([A-Za-z_]\w*)Client\s*\(/g,
+    /\b(?:[A-Za-z_]\w*\.)*([A-Za-z_]\w*(?:Blocking|Future|Async)?Stub)\s+([A-Za-z_]\w*)\s*[=;]/g,
+  ];
+  for (const [index, pattern] of aliasPatterns.entries()) for (const match of source.text.matchAll(pattern)) {
+    const alias = index === 3 ? match[2] : match[1];
+    const type = index === 3 ? match[1] : match[2];
+    aliases.set(alias, type.replace(/(?:Service)?Client$|(?:Blocking|Future|Async)?Stub$/i, ""));
+  }
+  for (const call of source.text.matchAll(/\b([A-Za-z_$][\w$]*)\s*(?:\.|->)\s*([A-Za-z_]\w*)\s*\(/g)) {
+    if (!aliases.has(call[1])) continue;
+    contracts.push({ transport: "grpc", side: role === "backend" ? "server-call" : "client", service: aliases.get(call[1]), name: call[2], file: source.file, line: lineAt(source.text, call.index), detector: "grpc-stub-call" });
+  }
+  for (const dynamic of source.text.matchAll(/\b(?:ServerReflection|ProtoReflection|grpc\.reflection|Class\.forName|Method\.invoke|reflect\.Value|dynamicStub)\b/g)) uncertain.push({
+    transport: "grpc", file: source.file, line: lineAt(source.text, dynamic.index), reason: "gRPC/reflection target is runtime-resolved",
+  });
+  return { contracts, uncertain };
+}
+
+function eventEvidence(source, role) {
+  const contracts = [], uncertain = [];
+  const add = (side, kind, match, topicIndex = 2) => contracts.push({
+    transport: "event", side, kind, name: match[topicIndex], file: source.file, line: lineAt(source.text, match.index), detector: "static-topic",
+  });
+  const subscriptions = [
+    /\b(?:consumer|kafka|bus|events?|eventBus)\s*(?:\.|->)\s*(subscribe|on|consume)\s*\(\s*["'`]([^"'`]+)["'`]/gi,
+    /@KafkaListener\s*\([^)]*\btopics?\s*=\s*["']([^"']+)["']/gi,
+    /\bsubscribe\s*\(\s*\{\s*topic\s*:\s*["'`]([^"'`]+)["'`]/gi,
+  ];
+  for (const [index, pattern] of subscriptions.entries()) for (const match of source.text.matchAll(pattern)) add("subscriber", index === 0 ? match[1] : "subscribe", match, index === 0 ? 2 : 1);
+  const publications = [
+    /\b(?:producer|kafka|bus|events?|eventBus|kafkaTemplate)\s*(?:\.|->)\s*(publish|emit|send|produce)\s*\(\s*["'`]([^"'`]+)["'`]/gi,
+    /\b(?:producer|kafka)\s*(?:\.|->)\s*send\s*\(\s*\{\s*topic\s*:\s*["'`]([^"'`]+)["'`]/gi,
+  ];
+  for (const [index, pattern] of publications.entries()) for (const match of source.text.matchAll(pattern)) add("publisher", index === 0 ? match[1] : "send", match, index === 0 ? 2 : 1);
+  for (const dynamic of source.text.matchAll(/\b(?:subscribe|publish|emit|consume|produce)\s*\(\s*(?!["'`{])([A-Za-z_$][\w$]*)/gi)) uncertain.push({
+    transport: "event", file: source.file, line: lineAt(source.text, dynamic.index), reason: `Event topic is runtime-computed (${dynamic[1]})`, role,
+  });
+  return { contracts, uncertain };
+}
+
+function detect(descriptor, role, options) {
+  const loaded = sourcesFor(descriptor, options), contracts = [], uncertain = [];
+  for (const source of loaded.sources) {
+    for (const detector of [graphQlEvidence, grpcEvidence, eventEvidence]) {
+      const result = detector(source, role);
+      contracts.push(...result.contracts); uncertain.push(...result.uncertain);
+    }
+  }
+  return {
+    contracts: uniqueBy(contracts, (item) => `${item.transport}|${item.side}|${item.service || ""}|${item.operation || ""}|${item.name}|${item.file}|${item.line}`),
+    uncertain: uniqueBy(uncertain, (item) => `${item.transport}|${item.file}|${item.line}|${item.reason}`),
+    reasons: loaded.reasons,
+    filesScanned: loaded.sources.length,
+  };
+}
+
+function contractMatch(server, caller, backendServers) {
+  if (server.transport !== caller.transport) return null;
+  if (server.transport === "graphql" && caller.side === "client" && server.operation === caller.operation && server.name === caller.name) return { confidence: "high", kind: "operation-field" };
+  if (server.transport === "grpc" && caller.side === "client" && norm(server.name) === norm(caller.name)) {
+    if (caller.service && norm(server.service) === norm(caller.service)) return { confidence: "high", kind: "service-method" };
+    const sameMethod = backendServers.filter((item) => item.transport === "grpc" && norm(item.name) === norm(caller.name));
+    if (!caller.service && sameMethod.length === 1) return { confidence: "medium", kind: "unique-method" };
+  }
+  if (server.transport === "event" && server.name === caller.name && server.side !== caller.side) return { confidence: "high", kind: "topic-direction" };
+  return null;
+}
+
+export function analyzeTransportContracts(input = {}) {
+  const transport = ["all", "graphql", "grpc", "event"].includes(input.transport) ? input.transport : "all";
+  const options = { includeTests: input.includeTests === true, maxFiles: Math.max(1, Math.min(10_000, Number(input.maxFiles) || 3_000)) };
+  const backend = detect(input.backend, "backend", options);
+  const clients = (input.clients || []).map((descriptor) => ({ descriptor, evidence: detect(descriptor, "client", options), reverse: reverseRuntimeImports(descriptor.graph) }));
+  const selected = (item) => transport === "all" || item.transport === transport;
+  const backendContracts = backend.contracts.filter(selected);
+  const servers = backendContracts.filter((item) => item.side === "server" || item.transport === "event");
+  const results = [];
+  for (const server of servers) {
+    const callsites = [];
+    for (const client of clients) for (const caller of client.evidence.contracts.filter(selected)) {
+      const match = contractMatch(server, caller, servers);
+      if (!match) continue;
+      callsites.push({ clientRepo: client.descriptor.id, file: caller.file, line: caller.line, detector: caller.detector, match });
+    }
+    const affected = affectedForEndpoint(callsites, clients.map((item) => ({ id: item.descriptor.id, reverse: item.reverse })), {
+      maxImpactDepth: Math.max(0, Math.min(5, Number(input.maxImpactDepth) || 2)),
+      maxAffectedFiles: Math.max(1, Math.min(500, Number(input.maxAffectedFiles) || 100)), maxScreens: 50, maxModules: 50,
+    });
+    results.push({ ...server, callsites, affected, liveness: callsites.length ? "NOT_DEAD_EXTERNAL_USE" : "UNKNOWN" });
+  }
+  const uncertain = [
+    ...backend.uncertain.map((item) => ({ repository: input.backend.id, ...item })),
+    ...clients.flatMap((item) => item.evidence.uncertain.map((entry) => ({ repository: item.descriptor.id, ...entry }))),
+  ].filter(selected);
+  const reasons = [...backend.reasons, ...clients.flatMap((item) => item.evidence.reasons)];
+  if (uncertain.length) reasons.push(`${uncertain.length} dynamic/reflection contract expression(s) remain UNKNOWN`);
+  return {
+    transportContractsV: 1,
+    transport,
+    status: reasons.length ? "PARTIAL" : "COMPLETE",
+    completeness: { complete: reasons.length === 0, reasons: [...new Set(reasons)] },
+    totals: { contracts: results.length, matches: results.reduce((sum, item) => sum + item.callsites.length, 0), uncertain: uncertain.length, filesScanned: backend.filesScanned + clients.reduce((sum, item) => sum + item.evidence.filesScanned, 0) },
+    contracts: results,
+    uncertain: uncertain.slice(0, 200),
+  };
+}

package/src/graph/builder/lang-go.js

@@ -72,7 +72,9 @@ export default {
   heritage: [],
 
   pass1(ctx) {
-    const { grammar, tree, fileRel, caps, addSym, addImportEdge, addExternalImport, imports, resolveGoImport, dirFiles, goModule, goRequires } = ctx;
+    const { grammar, tree, fileRel, caps, addSym, addImportEdge, addExternalImport, imports, resolveGoImport, dirFiles, goModule, goModules, goRequires } = ctx;
+    const owningModule = (goModules || []).filter((item) => !item.root || fileRel === item.root || fileRel.startsWith(`${item.root}/`))
+      .sort((left, right) => right.root.length - left.root.length)[0];
 
     // ---- symbols ----
     for (const cap of caps(grammar, `(function_declaration name: (identifier) @fn)`, tree.rootNode)) {
@@ -124,7 +126,7 @@ export default {
       if (!d) {
         // not a repo package: stdlib (builtin) or an external module — record for dependency analysis
         const line = pathNode.startPosition.row + 1;
-        const r = goSpecToPkg(importPath, { requires: goRequires || [], ownModule: goModule || "" });
+        const r = goSpecToPkg(importPath, { requires: owningModule?.requires || goRequires || [], ownModule: owningModule?.module || goModule || "" });
         if (r) addExternalImport({ spec: importPath, pkg: r.pkg, builtin: r.builtin, ecosystem: "Go", kind: "go-import", line });
         else addExternalImport({ spec: importPath, kind: "go-import", line, unresolved: true }); // own-module path with no matching dir
         continue;

package/src/graph/builder/lang-java.js

@@ -83,7 +83,7 @@ export default {
   pass1(ctx) {
     const {
       grammar, tree, fileRel, caps, field, addSym, addImportEdge, imports,
-      resolveJavaImport, fileSet, links, nodeIds,
+      resolveJavaImport, fileSet, links, nodeIds, addExternalImport,
     } = ctx;
     const ownerIds = new Map();
     const addJavaSym = (nameNode, callable, extra) => {
@@ -143,11 +143,17 @@ export default {
       const line = lineOf(cap.node);
       if (!isStatic && wildcard) {
         wildcardPackages.push(parts);
+        const packagePath = `${parts.join("/")}/`;
+        const projectLocal = [...fileSet].some((file) => file.startsWith(packagePath) || file.includes(`/${packagePath}`));
+        if (!projectLocal) addExternalImport({ spec: `${parts.join(".")}.*`, pkg: parts.join("."), builtin: ["java", "jdk", "sun"].includes(parts[0]), ecosystem: "Maven", kind: "java-import", line });
         continue;
       }
       if (!isStatic) {
         const target = exactJavaTarget(resolveJavaImport, parts);
-        if (!target) continue;
+        if (!target) {
+          addExternalImport({ spec: parts.join("."), pkg: parts.join("."), builtin: ["java", "jdk", "sun"].includes(parts[0]), ecosystem: "Maven", kind: "java-import", line });
+          continue;
+        }
         const local = parts[parts.length - 1];
         addImportEdge(target, { line, specifier: parts.join("."), compileOnly: true });
         imports.set(local, { imported: local, targetFile: target });
@@ -162,7 +168,10 @@ export default {
         target = exactJavaTarget(resolveJavaImport, candidate);
         if (target) classParts = candidate;
       }
-      if (!target) continue;
+      if (!target) {
+        addExternalImport({ spec: parts.join("."), pkg: parts.join("."), builtin: ["java", "jdk", "sun"].includes(parts[0]), ecosystem: "Maven", kind: "java-static-import", line });
+        continue;
+      }
       addImportEdge(target, { line, specifier: `${isStatic ? "static " : ""}${parts.join(".")}${wildcard ? ".*" : ""}`, compileOnly: true });
       if (wildcard) staticWildcardTargets.push(target);
       else {