weavatrix 0.2.7 → 0.2.9

package/src/analysis/duplicate-groups.js

@@ -37,6 +37,13 @@ function groupPairs(data, settings) {
   }).sort((a, b) => b.tokens - a.tokens)
 }
 
+export function isFrameworkBoilerplateCloneGroup(group) {
+  const members = Array.isArray(group?.members) ? group.members : []
+  if (members.length < 2) return false
+  return members.every((member) => /(?:^|\/)\w[^/]*\.router\.[cm]?[jt]s$/i.test(String(member.file || '').replace(/\\/g, '/'))
+    && /^(?:router|routes)\(?\)?$/i.test(String(member.label || '').trim()))
+}
+
 export function analyzeDuplicateGroups(repoRoot, graphPath, args = {}) {
   const settings = {
     simMin: Math.min(100, Math.max(50, Number(args.min_similarity) || 80)),
@@ -44,11 +51,13 @@ export function analyzeDuplicateGroups(repoRoot, graphPath, args = {}) {
     mode: args.mode === 'strict' ? 'strict' : 'renamed',
     skipTests: args.include_tests !== true,
     includeClassified: args.include_classified === true || args.include_non_product === true,
+    includeBoilerplate: args.include_boilerplate === true,
   }
   const data = computeDuplicates(repoRoot, graphPath, {includeStrings: args.include_strings === true, minTokens: settings.tokMin})
-  const groups = groupPairs(data, settings)
+  const allGroups = groupPairs(data, settings)
+  const groups = settings.includeBoilerplate ? allGroups : allGroups.filter((group) => !isFrameworkBoilerplateCloneGroup(group))
   const suppressed = (data.frags || []).filter((fragment) => !eligible(fragment, settings)).length
-  return {settings, groups, suppressed}
+  return {settings, groups, suppressed, boilerplateSuppressed: allGroups.length - groups.length}
 }
 
 const digest = (value) => createHash('sha256').update(value).digest('hex').slice(0, 20)

package/src/analysis/endpoints.js

@@ -11,8 +11,10 @@ import { safeRead } from "../util.js";
 import { createRepoBoundary } from "../repo-path.js";
 import { extractRustEndpoints } from "./endpoints-rust.js";
 import { extractSpringEndpoints } from "./endpoints-java.js";
+import { posix } from "node:path";
 
 const MAX_FILES = 3000;
+const MAX_ENDPOINTS = 2000;
 const HTTP_METHODS = new Set(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS", "TRACE", "CONNECT", "ALL", "ANY"]);
 // UNAMBIGUOUS HTTP CLIENTS (make requests) vs servers (define routes) — reject `axios.get("/x")`-style client
 // calls in frontend code. Ambiguous names (api/client/service — could be a server router) are NOT listed;
@@ -27,6 +29,38 @@ function lineAt(text, index) {
   return line;
 }
 
+// Regex extractors must never see commented-out routes. Preserve string literals and every source
+// offset, but replace comment bodies with spaces so endpoint line numbers still refer to the original
+// file. Python `#` comments are enabled only for .py files; Rust attributes such as #[get] stay intact.
+function maskComments(text, { hashComments = false } = {}) {
+  const chars = String(text || "").split("");
+  let quote = "", escaped = false, lineComment = false, blockComment = false;
+  for (let i = 0; i < chars.length; i++) {
+    const ch = chars[i], next = chars[i + 1];
+    if (lineComment) {
+      if (ch === "\n" || ch === "\r") lineComment = false;
+      else chars[i] = " ";
+      continue;
+    }
+    if (blockComment) {
+      if (ch === "*" && next === "/") { chars[i] = chars[i + 1] = " "; i++; blockComment = false; }
+      else if (ch !== "\n" && ch !== "\r") chars[i] = " ";
+      continue;
+    }
+    if (quote) {
+      if (escaped) escaped = false;
+      else if (ch === "\\") escaped = true;
+      else if (ch === quote) quote = "";
+      continue;
+    }
+    if (ch === '"' || ch === "'" || ch === "`") { quote = ch; continue; }
+    if (ch === "/" && next === "/") { chars[i] = chars[i + 1] = " "; i++; lineComment = true; continue; }
+    if (ch === "/" && next === "*") { chars[i] = chars[i + 1] = " "; i++; blockComment = true; continue; }
+    if (hashComments && ch === "#") { chars[i] = " "; lineComment = true; }
+  }
+  return chars.join("");
+}
+
 // best-effort bare handler name from a value expression: the LAST identifier, unwrapping wrappers like
 // executionRoute(queryHandlers.executeQuery) → executeQuery, asyncHandler(fn) → fn, a.b.c → c.
 // An INLINE handler (arrow / function literal) has no named method to join to, so it returns "" (the
@@ -52,6 +86,152 @@ const OPENAPI_BLOCK = /\boperationId\b|\bresponses\s*:|\brequestBody\b|\bschemaR
 const looksLikePath = (p) => typeof p === "string" && /^\/[\w\-./:{}*$?]*$/.test(p) && !p.includes("://");
 const cleanPath = (p) => String(p || "").replace(/\/+$/, "") || "/";
 
+const JS_ROUTE_EXTENSIONS = [".js", ".ts", ".tsx", ".jsx", ".cjs", ".mjs"];
+const normalizedFile = (file) => String(file || "").replace(/\\/g, "/").replace(/^\.\//, "");
+
+function importBindings(text) {
+  const bindings = new Map();
+  const add = (name, specifier) => {
+    if (/^[A-Za-z_$][\w$]*$/.test(name || "") && typeof specifier === "string") bindings.set(name, specifier);
+  };
+  let match;
+  const direct = /\bimport\s+([A-Za-z_$][\w$]*)\s*(?:,\s*\{[^}]*\})?\s+from\s*(["'`])([^"'`]+)\2/g;
+  while ((match = direct.exec(text))) add(match[1], match[3]);
+  const namespace = /\bimport\s+\*\s+as\s+([A-Za-z_$][\w$]*)\s+from\s*(["'`])([^"'`]+)\2/g;
+  while ((match = namespace.exec(text))) add(match[1], match[3]);
+  const named = /\bimport\s*\{([^}]+)\}\s*from\s*(["'`])([^"'`]+)\2/g;
+  while ((match = named.exec(text))) {
+    for (const item of match[1].split(",")) {
+      const binding = /^\s*[A-Za-z_$][\w$]*(?:\s+as\s+([A-Za-z_$][\w$]*))?\s*$/.exec(item);
+      if (binding) add(binding[1] || item.trim(), match[3]);
+    }
+  }
+  const commonJs = /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*require\s*\(\s*(["'`])([^"'`]+)\2\s*\)/g;
+  while ((match = commonJs.exec(text))) add(match[1], match[3]);
+  return bindings;
+}
+
+function handlerReference(expr) {
+  const s = String(expr || "").trim();
+  if (!s || /=>/.test(s) || /^\s*(async\s+)?function\b/.test(s)) return "";
+  const refs = [...s.matchAll(/([A-Za-z_$][\w$]*(?:\s*\.\s*[A-Za-z_$][\w$]*)+)/g)];
+  return refs.length ? refs.at(-1)[1].replace(/\s+/g, "") : "";
+}
+
+function resolveImportedFile(importer, specifier, availableFiles) {
+  if (!specifier?.startsWith(".")) return null;
+  const base = posix.normalize(posix.join(posix.dirname(importer), specifier));
+  const candidates = [base];
+  if (!JS_ROUTE_EXTENSIONS.some((extension) => base.endsWith(extension))) {
+    for (const extension of JS_ROUTE_EXTENSIONS) candidates.push(`${base}${extension}`);
+    for (const extension of JS_ROUTE_EXTENSIONS) candidates.push(`${base}/index${extension}`);
+  }
+  return candidates.find((candidate) => availableFiles.has(candidate)) || null;
+}
+
+function callArguments(text, openParen) {
+  let quote = "", escaped = false, depth = 0, start = openParen + 1;
+  const args = [];
+  for (let index = openParen; index < text.length; index++) {
+    const char = text[index];
+    if (quote) {
+      if (escaped) escaped = false;
+      else if (char === "\\") escaped = true;
+      else if (char === quote) quote = "";
+      continue;
+    }
+    if (char === '"' || char === "'" || char === "`") { quote = char; continue; }
+    if (char === "(") { depth++; continue; }
+    if (char === ")") {
+      depth--;
+      if (depth === 0) {
+        args.push(text.slice(start, index).trim());
+        return {args, end: index + 1};
+      }
+      continue;
+    }
+    if (char === "," && depth === 1) {
+      args.push(text.slice(start, index).trim());
+      start = index + 1;
+    }
+  }
+  return null;
+}
+
+function routerMounts(text, file, availableFiles) {
+  const scanText = maskComments(text);
+  const bindings = importBindings(scanText);
+  const mounts = [];
+  const useCall = /\b[A-Za-z_$][\w$]*\s*\.\s*use\s*\(/g;
+  let match;
+  while ((match = useCall.exec(scanText))) {
+    const openParen = scanText.indexOf("(", match.index);
+    const parsed = callArguments(scanText, openParen);
+    if (!parsed) continue;
+    useCall.lastIndex = parsed.end;
+    const args = parsed.args.filter(Boolean);
+    if (!args.length) continue;
+    const literal = /^(["'`])(\/[^"'`]*)\1$/.exec(args[0]);
+    const mountPath = literal ? cleanPath(literal[2]) : "/";
+    const childExpression = args.at(-1) || "";
+    const identifier = /^([A-Za-z_$][\w$]*)(?:\.[A-Za-z_$][\w$]*)?$/.exec(childExpression)?.[1];
+    const specifier = identifier ? bindings.get(identifier) : null;
+    const child = resolveImportedFile(file, specifier, availableFiles);
+    if (child && child !== file) mounts.push({parent: file, child, path: mountPath, line: lineAt(text, match.index)});
+  }
+  return mounts;
+}
+
+function joinEndpointPath(base, route) {
+  const left = cleanPath(base || "/");
+  const right = cleanPath(route || "/");
+  if (left === "/") return right;
+  if (right === "/") return left;
+  return cleanPath(`${left}/${right.replace(/^\/+/, "")}`.replace(/\/{2,}/g, "/"));
+}
+
+function mountedBasePaths(files, sources) {
+  const available = new Set(files);
+  const incoming = new Map();
+  const mounts = [];
+  for (const file of files) {
+    for (const mount of routerMounts(sources.get(file) || "", file, available)) {
+      mounts.push(mount);
+      if (!incoming.has(mount.child)) incoming.set(mount.child, []);
+      incoming.get(mount.child).push(mount);
+    }
+  }
+  const cache = new Map();
+  const resolve = (file, stack = new Set()) => {
+    if (cache.has(file)) return cache.get(file);
+    if (stack.has(file)) return [];
+    const parents = incoming.get(file) || [];
+    if (!parents.length) return [{path: "", chain: []}];
+    const nextStack = new Set(stack).add(file);
+    const paths = [];
+    for (const mount of parents) {
+      for (const base of resolve(mount.parent, nextStack)) {
+        const composed = joinEndpointPath(base.path, mount.path);
+        const key = `${composed}\0${base.chain.map((item) => `${item.file}:${item.line}:${item.path}`).join("|")}\0${mount.parent}:${mount.line}:${mount.path}`;
+        if (!paths.some((item) => item.key === key)) paths.push({
+          key,
+          path: composed,
+          chain: [...base.chain, {file: mount.parent, line: mount.line, path: mount.path, child: mount.child}],
+        });
+        if (paths.length >= 32) break;
+      }
+      if (paths.length >= 32) break;
+    }
+    const result = paths.length ? paths.map(({key, ...item}) => item) : [{path: "", chain: []}];
+    cache.set(file, result);
+    return result;
+  };
+  return {
+    paths: new Map(files.map((file) => [file, resolve(file)])),
+    mounts,
+  };
+}
+
 export function nextRoutePath(file) {
   const parts = String(file || "").replace(/\\/g, "/").split("/").filter(Boolean);
   if (!/^route\.[cm]?[jt]s$/i.test(parts.at(-1) || "")) return "";
@@ -75,12 +255,15 @@ export function extractEndpointsFromText(text, file) {
   const py = /\.py$/i.test(file);
   const rust = /\.rs$/i.test(file);
   const java = /\.java$/i.test(file);
+  const scanText = maskComments(text, { hashComments: py });
   const add = (method, path, expr, idx) => {
     const p = cleanPath(path);
     if (!looksLikePath(p)) return;
     const m = String(method || "ANY").toUpperCase();
     if (!HTTP_METHODS.has(m)) return;
-    out.push({ method: m, path: p, handler: handlerName(expr), file, line: lineAt(text, idx) });
+    const handler = handlerName(expr);
+    const handlerRef = handlerReference(expr);
+    out.push({ method: m, path: p, handler, ...(handlerRef ? {handlerRef} : {}), file, line: lineAt(text, idx) });
   };
 
   // Next.js App Router: the filesystem provides the path and exported HTTP-method functions provide the
@@ -90,13 +273,13 @@ export function extractEndpointsFromText(text, file) {
     const seen = new Set();
     const direct = /\bexport\s+(?:(?:async|declare)\s+)*(?:function\s+|(?:const|let|var)\s+)(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS)\b/g;
     let nm;
-    while ((nm = direct.exec(text))) {
+    while ((nm = direct.exec(scanText))) {
       const method = nm[1].toUpperCase();
       if (!seen.has(method)) { seen.add(method); add(method, nextPath, method, nm.index); }
     }
     const lists = /\bexport\s*\{([^}]+)\}/g;
     let lm;
-    while ((lm = lists.exec(text))) {
+    while ((lm = lists.exec(scanText))) {
       for (const item of lm[1].split(",")) {
         const mm = /^\s*([A-Za-z_$][\w$]*)(?:\s+as\s+(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS))?\s*$/.exec(item);
         if (!mm) continue;
@@ -108,9 +291,9 @@ export function extractEndpointsFromText(text, file) {
     }
   }
 
-  if (rust) extractRustEndpoints(text, add);
+  if (rust) extractRustEndpoints(scanText, add);
   if (java) {
-    out.push(...extractSpringEndpoints(text, file));
+    out.push(...extractSpringEndpoints(scanText, file));
     return out; // generic JS-style method calls would turn Java HTTP clients into fake server routes
   }
 
@@ -118,14 +301,14 @@ export function extractEndpointsFromText(text, file) {
   // find each  "…": {  or  "…": expr,  where the key looks like a path
   const objKeyRe = /(["'`])(\/[^"'`]*)\1\s*:\s*(\{)?/g;
   let m;
-  while ((m = objKeyRe.exec(text))) {
+  while ((m = objKeyRe.exec(scanText))) {
     const path = m[2], keyIdx = m.index;
     if (m[3]) {
       // object of METHOD: handler — scan to the matching close brace (routes objects are shallow)
       let i = objKeyRe.lastIndex, depth = 1;
       const start = i;
-      while (i < text.length && depth > 0) { const c = text[i]; if (c === "{") depth++; else if (c === "}") depth--; i++; }
-      const body = text.slice(start, i - 1);
+      while (i < scanText.length && depth > 0) { const c = scanText[i]; if (c === "{") depth++; else if (c === "}") depth--; i++; }
+      const body = scanText.slice(start, i - 1);
       objKeyRe.lastIndex = i;
       if (OPENAPI_BLOCK.test(body)) continue; // documentation, not a route table
       const methodRe = /\b(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS)\b\s*:\s*([^,\n}]+)/gi;
@@ -133,9 +316,10 @@ export function extractEndpointsFromText(text, file) {
       while ((mm = methodRe.exec(body))) add(mm[1], path, mm[2], keyIdx);
     } else {
       // "/path": handlerExpr — a direct handler (any method); grab up to the next , or }
-      const tail = text.slice(objKeyRe.lastIndex, objKeyRe.lastIndex + 200);
+      const tail = scanText.slice(objKeyRe.lastIndex, objKeyRe.lastIndex + 200);
       const em = /^([^,\n}]+)/.exec(tail);
-      if (em && !/^\s*\{/.test(em[1])) add("ANY", path, em[1], keyIdx);
+      // A string/number/array value is an ordinary path/name lookup, not an executable handler.
+      if (em && !/^\s*(?:\{|["'`\[]|[-+]?\d|true\b|false\b|null\b|undefined\b)/i.test(em[1])) add("ANY", path, em[1], keyIdx);
     }
   }
 
@@ -146,7 +330,7 @@ export function extractEndpointsFromText(text, file) {
   // FRONTEND code, not server routes. A server route also REQUIRES a handler arg (an identifier/function),
   // so a bare `client.get("/x")` or one whose 2nd arg is a config object literal `{…}` is skipped.
   const callRe = /(?<!@)\b([\w$]+)\s*\.\s*(get|post|put|patch|delete|head|options|all)\s*\(\s*(["'`])(\/[^"'`]*)\3\s*(?:,\s*([\s\S]{0,160}?))?\)/gi;
-  while ((m = callRe.exec(text))) {
+  while ((m = callRe.exec(scanText))) {
     const caller = m[1], arg2 = String(m[5] || "").trim();
     if (HTTP_CLIENT_CALLER.test(caller)) continue;          // axios/http/fetch/apiClient… → a client request
     if (!arg2 || arg2[0] === "{") continue;                 // no handler, or a config object → not a route def
@@ -155,14 +339,14 @@ export function extractEndpointsFromText(text, file) {
 
   // ---- Go net/http: mux.HandleFunc("/path", handler) / http.Handle("/path", h) ------------------
   const goRe = /\.\s*(?:HandleFunc|Handle)\s*\(\s*(["'`])(\/[^"'`]*)\1\s*,\s*([\s\S]{0,120}?)\)/g;
-  while ((m = goRe.exec(text))) add("ANY", m[2], m[3], m.index);
+  while ((m = goRe.exec(scanText))) add("ANY", m[2], m[3], m.index);
 
   // ---- decorators: @app.get("/path") / @router.post("/path") / @Get("/path") -------------------
   if (py || /\.(ts|js|tsx|jsx|cjs|mjs)$/i.test(file)) {
     const decoRe = /@[\w$]*\.?\s*(get|post|put|patch|delete|head|options)\s*\(\s*(["'`])(\/[^"'`]*)\2/gi;
-    while ((m = decoRe.exec(text))) {
+    while ((m = decoRe.exec(scanText))) {
       // the handler is the def/function on a following line — best-effort: next def name
-      const after = text.slice(decoRe.lastIndex, decoRe.lastIndex + 200);
+      const after = scanText.slice(decoRe.lastIndex, decoRe.lastIndex + 200);
       const fn = /\b(?:def|async\s+def|function|const|export\s+function)\s+([A-Za-z_$][\w$]*)/.exec(after);
       add(m[1], m[3], fn ? fn[1] : "", m.index);
     }
@@ -178,26 +362,76 @@ const normParamKey = (p) => String(p).replace(/\{([^/}]+)\}/g, ":$1");
 // Detect endpoints across the repo's code files (from the graph's file nodes, or a caller-supplied list
 // of {path, full}). Deduped by method+normalized-path; on a collision the entry with a resolvable
 // handler (and `:param` display) wins. Capped. Returns [{method, path, handler, file, line}].
-export function detectEndpoints(repoPath, codeFiles) {
+export function analyzeEndpointInventory(repoPath, codeFiles) {
   const files = (codeFiles || []).slice(0, MAX_FILES);
   const byKey = new Map();
+  const declarations = new Map();
   const boundary = createRepoBoundary(repoPath);
+  const sources = new Map();
+  const eligibleFiles = [];
   for (const f of files) {
-    const rel = f.path || f;
+    const rel = normalizedFile(f.path || f);
     if (!/\.(js|ts|tsx|jsx|cjs|mjs|py|go|rs|java)$/i.test(rel)) continue;
     const resolved = boundary.resolve(rel);
     if (!resolved.ok) continue;
     const text = safeRead(resolved.path);
+    sources.set(rel, text || "");
+    eligibleFiles.push(rel);
+  }
+  const mountAnalysis = mountedBasePaths(eligibleFiles, sources);
+  let truncated = false;
+  for (const rel of eligibleFiles) {
+    const text = sources.get(rel);
     if (!text || (!nextRoutePath(rel) && !/["'`]\/|\.(get|post|put|patch|delete)\s*\(|HandleFunc|@\w*\.?(get|post|put|patch|delete)|@(?:[\w$]+\.)*(?:Request|Get|Post|Put|Patch|Delete)Mapping\b/i.test(text))) continue;
     for (const e of extractEndpointsFromText(text, rel.replace(/\\/g, "/"))) {
-      const key = `${e.method} ${normParamKey(e.path)}`;
-      const prev = byKey.get(key);
-      if (!prev) { byKey.set(key, e); }
-      else if (preferEndpoint(e, prev)) { byKey.set(key, e); }
-      if (byKey.size >= 500) return [...byKey.values()].sort(sortEndpoints);
+      const declarationKey = `${e.file}\0${e.line}\0${e.method}\0${normParamKey(e.path)}`;
+      if (!declarations.has(declarationKey)) declarations.set(declarationKey, e);
+      const bases = mountAnalysis.paths.get(rel) || [{path: "", chain: []}];
+      for (const base of bases) {
+        const composed = base.path ? joinEndpointPath(base.path, e.path) : e.path;
+        const endpoint = {
+          ...e,
+          declaredPath: e.path,
+          path: composed,
+          mountState: base.chain.length ? "COMPOSED_STATIC" : "DECLARED_LOCAL",
+          confidence: base.chain.length ? "high" : "medium",
+          mountChain: base.chain,
+          ...(base.path ? {localPath: e.path} : {}),
+        };
+        const key = `${endpoint.method} ${normParamKey(endpoint.path)}`;
+        const prev = byKey.get(key);
+        if (!prev) { byKey.set(key, endpoint); }
+        else if (preferEndpoint(endpoint, prev)) { byKey.set(key, endpoint); }
+        if (byKey.size >= MAX_ENDPOINTS) { truncated = true; break; }
+      }
+      if (truncated) break;
     }
+    if (truncated) break;
   }
-  return [...byKey.values()].sort(sortEndpoints);
+  const endpoints = [...byKey.values()].sort(sortEndpoints);
+  const composed = endpoints.filter((endpoint) => endpoint.mountChain.length).length;
+  return {
+    endpoints,
+    declarations: [...declarations.values()].sort(sortEndpoints),
+    mounts: mountAnalysis.mounts,
+    stats: {
+      scannedFiles: eligibleFiles.length,
+      declaredRoutes: declarations.size,
+      emittedRoutes: endpoints.length,
+      reachableRoutes: composed,
+      reachableStaticRoutes: composed,
+      composedRoutes: composed,
+      localRoutes: endpoints.length - composed,
+      localDeclarations: endpoints.length - composed,
+      staticMounts: mountAnalysis.mounts.length,
+      truncated,
+      maxEndpoints: MAX_ENDPOINTS,
+    },
+  };
+}
+
+export function detectEndpoints(repoPath, codeFiles) {
+  return analyzeEndpointInventory(repoPath, codeFiles).endpoints;
 }
 
 // true when candidate `a` is a better representative of a route than the already-kept `b`:

package/src/analysis/internal-audit.collect.js

@@ -3,7 +3,7 @@
 import { readFileSync, readdirSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { spawnSync } from "node:child_process";
-import { parseRequirementsNames, parsePyprojectDeps, parsePipfileDeps } from "./manifests.js";
+import { parseRequirementsNames, parsePyprojectDeps, parsePipfileDeps, pep503 } from "./manifests.js";
 import { createRepoBoundary } from "../repo-path.js";
 import { childProcessEnv } from "../child-env.js";
 import { filterWeavatrixIgnored } from "../path-ignore.js";
@@ -254,28 +254,61 @@ export function workspacePkgNames(repoRoot, pkg) {
 
 export const TEST_FILE_RE = /(^|[/])(test|tests|__tests__|spec|e2e|__mocks__)([/]|$)|[._-](test|spec)\.[a-z0-9]+$/i;
 
-// Python declared deps: root requirements*.txt/.in + requirements/ dir + pyproject.toml + Pipfile.
+// Python declared deps are owned by the nearest manifest root, matching nested service/monorepo
+// layouts. `requirements/*.txt` belongs to the directory above `requirements`; a colocated
+// requirements.txt, pyproject.toml or Pipfile owns its own directory.
 // present=false (no manifest at all) softens missing-dep findings instead of suppressing them.
 export function collectPyManifest(repoRoot) {
-  const deps = [];
-  let present = false;
-  let names = [];
   const boundary = createRepoBoundary(repoRoot);
-  try { names = readdirSync(boundary.root).filter((n) => /^requirements[\w.-]*\.(txt|in)$/i.test(n)); } catch { /* unreadable root */ }
-  try {
-    const requirements = boundary.resolve("requirements");
-    if (requirements.ok) names.push(...readdirSync(requirements.path).filter((n) => /\.(txt|in)$/i.test(n)).map((n) => `requirements/${n}`));
-  } catch { /* no requirements dir */ }
-  for (const n of names) {
-    const t = readRepoText(boundary, n);
+  const scopes = new Map();
+  const scopeFor = (root) => {
+    const normalized = normRoot(root);
+    if (!scopes.has(normalized)) scopes.set(normalized, { root: normalized, present: false, deps: [], manifests: [] });
+    return scopes.get(normalized);
+  };
+  const addManifest = (root, manifest, parsedDeps, present = true) => {
+    if (!present) return;
+    const scope = scopeFor(root);
+    scope.present = true;
+    scope.manifests.push(manifest);
+    scope.deps.push(...parsedDeps.map((dep) => ({ ...dep, manifest })));
+  };
+  const files = listRepoFiles(repoRoot);
+  for (const file of files.filter((name) => /(^|\/)requirements[\w.-]*\.(?:txt|in)$/i.test(name)
+    || /(^|\/)requirements\/[^/]+\.(?:txt|in)$/i.test(name))) {
+    const t = readRepoText(boundary, file);
     if (t == null) continue;
-    present = true;
-    const dev = /dev|test|lint|doc|ci/i.test(n.replace(/^requirements[/\\]?/i, ""));
-    for (const d of parseRequirementsNames(t)) deps.push({ ...d, dev });
+    const parent = normRoot(dirname(file));
+    const root = /(^|\/)requirements$/i.test(parent) ? normRoot(dirname(parent)) : parent;
+    const dev = /dev|test|lint|doc|ci/i.test(file.slice(file.lastIndexOf("/") + 1));
+    addManifest(root, file, parseRequirementsNames(t).map((dep) => ({ ...dep, dev })));
   }
-  const pp = readRepoText(boundary, "pyproject.toml");
-  if (pp != null) { const r = parsePyprojectDeps(pp); if (r.present) { present = true; deps.push(...r.deps); } }
-  const pf = readRepoText(boundary, "Pipfile");
-  if (pf != null) { const r = parsePipfileDeps(pf); if (r.present) { present = true; deps.push(...r.deps); } }
-  return { present, deps };
+  for (const file of files.filter((name) => /(^|\/)pyproject\.toml$/i.test(name))) {
+    const parsed = parsePyprojectDeps(readRepoText(boundary, file));
+    addManifest(dirname(file), file, parsed.deps, parsed.present);
+  }
+  for (const file of files.filter((name) => /(^|\/)Pipfile$/i.test(name))) {
+    const parsed = parsePipfileDeps(readRepoText(boundary, file));
+    addManifest(dirname(file), file, parsed.deps, parsed.present);
+  }
+  const normalizedScopes = [...scopes.values()]
+    .map((scope) => {
+      const seen = new Set();
+      return {
+        ...scope,
+        manifests: [...new Set(scope.manifests)].sort(),
+        deps: scope.deps.filter((dep) => {
+          const key = pep503(dep.name);
+          if (!key || seen.has(key)) return false;
+          seen.add(key);
+          return true;
+        }),
+      };
+    })
+    .sort((left, right) => right.root.length - left.root.length || left.root.localeCompare(right.root));
+  return {
+    present: normalizedScopes.some((scope) => scope.present),
+    deps: normalizedScopes.flatMap((scope) => scope.deps),
+    scopes: normalizedScopes,
+  };
 }

package/src/graph/builder/lang-rust.js

@@ -4,23 +4,43 @@
 // `crate/self/super` paths resolve to repo-local .rs or */mod.rs files. External crates deliberately stay out
 // of this adapter; Cargo dependency analysis owns them.
 const SYMS_CORE = `
-  (function_item name: (identifier) @method)
-  (struct_item name: (type_identifier) @class)
-  (enum_item name: (type_identifier) @class)
-  (trait_item name: (type_identifier) @class)
-  (type_item name: (type_identifier) @class)
-  (mod_item name: (identifier) @class)
-  (const_item name: (identifier) @field)
-  (static_item name: (identifier) @field)`;
+  (function_item name: (identifier) @function)
+  (struct_item name: (type_identifier) @struct)
+  (enum_item name: (type_identifier) @enum)
+  (trait_item name: (type_identifier) @trait)
+  (type_item name: (type_identifier) @type)
+  (mod_item name: (identifier) @module)
+  (const_item name: (identifier) @constant)
+  (static_item name: (identifier) @static)`;
 // Grammar-version-dependent node types, compiled SEPARATELY (one unknown type voids its whole query).
 const SYMS_OPTIONAL = [
-  `(macro_definition name: (identifier) @method)`,
-  `(union_item name: (type_identifier) @class)`,
+  `(function_signature_item name: (identifier) @function)`,
+  `(macro_definition name: (identifier) @macro)`,
+  `(union_item name: (type_identifier) @union)`,
 ];
 
 const cleanSegment = (part) => String(part || "").trim().replace(/^r#/, "");
 const pathParts = (node) => String(node?.text || "").split("::").map(cleanSegment).filter(Boolean);
 const under = (node, type) => { for (let p = node?.parent; p; p = p.parent) if (p.type === type) return true; return false; };
+const ancestor = (node, types) => {
+  for (let parent = node?.parent; parent; parent = parent.parent) if (types.has(parent.type)) return parent;
+  return null;
+};
+const memberOwners = new Set(["impl_item", "trait_item"]);
+const publicVisibility = (declaration, owner) => {
+  if (owner?.type === "trait_item") return "public";
+  const source = String(declaration?.text || "").trimStart();
+  if (/^pub\s/.test(source)) return "public";
+  if (/^pub\s*\(/.test(source)) return "protected";
+  return "private";
+};
+const ownerName = (owner, field) => {
+  if (!owner) return "";
+  if (owner.type === "trait_item") return field(owner, "name")?.text || "";
+  const type = field(owner, "type")?.text || "";
+  const withoutGenerics = type.replace(/<[^<>]*>/g, "");
+  return (withoutGenerics.match(/[A-Za-z_]\w*/g) || []).at(-1) || "";
+};
 
 function pathAttribute(modNode) {
   for (let prev = modNode?.previousNamedSibling; prev?.type === "attribute_item"; prev = prev.previousNamedSibling) {
@@ -93,12 +113,29 @@ export default {
   ],
 
   pass1(ctx) {
-    const { grammar, tree, fileRel, caps, addSym, addImportEdge, imports, resolveRustMod, resolveRustPath } = ctx;
+    const { grammar, tree, fileRel, caps, field, addSym, addImportEdge, imports, resolveRustMod, resolveRustPath, links, nameToId } = ctx;
+    const owned = [];
     for (const src of [SYMS_CORE, ...SYMS_OPTIONAL]) {
       for (const cap of caps(grammar, src, tree.rootNode)) {
-        addSym(cap.node.text, cap.node.startPosition.row + 1, cap.name === "method", { sourceNode: cap.node.parent });
+        const declaration = cap.node.parent;
+        const owner = cap.name === "function" ? ancestor(cap.node, memberOwners) : null;
+        const memberOf = ownerName(owner, field);
+        const symbolKind = cap.name === "function" ? (memberOf ? "method" : "function") : cap.name;
+        const visibility = publicVisibility(declaration, owner);
+        const id = addSym(cap.node.text, cap.node.startPosition.row + 1, cap.name === "function", {
+          sourceNode: declaration,
+          selectionNode: cap.node,
+          symbolKind,
+          ...(memberOf ? { memberOf, visibility } : { moduleDeclaration: true }),
+          ...(!memberOf && visibility === "public" ? { exported: true } : {}),
+        });
+        if (id && memberOf) owned.push({owner: memberOf, id});
       }
     }
+    for (const member of owned) {
+      const ownerId = nameToId.get(member.owner);
+      if (ownerId && ownerId !== member.id) links.push({source: ownerId, target: member.id, relation: "method", confidence: "EXTRACTED"});
+    }
 
     // File dependency edges are intentionally unique per source/target/relation. A qualified path can be
     // nested in another qualified path and often repeats an existing `mod`/`use`; counting occurrences would