weavatrix 0.3.10 → 0.3.12

package/README.md

@@ -186,10 +186,18 @@ realpath escapes. Report suspected vulnerabilities privately as described in [SE
 
 ## Languages
 
-JavaScript · TypeScript · TSX · Python · Go · Java · C# · Rust · HTML · CSS — parsed with
+JavaScript · TypeScript · TSX · Python · Go · Java · C# · Rust · Solidity · HTML · CSS — parsed with
 [web-tree-sitter](https://github.com/tree-sitter/tree-sitter) WASM grammars; no Python install and no
 native compilation.
 
+SQL is indexed without a grammar: `.sql` files contribute tables, views, columns, functions, indexes
+and triggers as first-class graph symbols, and SQL found in string literals of any other language
+links the enclosing function to the table it queries. That makes schema objects visible to
+`change_impact`/`get_dependents` (who touches this table?) and lets the dead-code check flag columns
+no statement references — conservatively: verdicts require literal-SQL evidence in the repo, and
+`SELECT *`-consumed tables never have their columns judged by name (ORM-generated SQL stays invisible
+and is therefore never judged either).
+
 Test surfaces are classified per file (path conventions plus `.weavatrix.json` overrides) and, for
 Rust, per symbol: `#[cfg(test)]` modules and `#[test]`/`#[bench]` items inside production `.rs` files
 carry a node-level `test_surface` flag, so dead-code, query, hot-path and hub tools treat them as
@@ -204,9 +212,9 @@ npm run benchmark        # full TS/JS/Python/Go/Java/Rust + MCP lifecycle gate
 npm run benchmark:real   # locally available real repos vs source-free 0.2.1 baselines
 ```
 
-Maintained JavaScript/TypeScript under `src`, `bin`, `scripts`, `test` (and HTML/CSS/JS under `site`)
-has a hard 300-line physical ceiling enforced by the release suite; larger concerns split into
-owner-focused modules behind slim facades.
+Maintained JavaScript/TypeScript under `src`, `bin`, `scripts`, `test` has a hard 300-line physical
+ceiling enforced by the release suite; larger concerns split into owner-focused modules behind slim
+facades. The weavatrix.com landing site lives in its own repository (`weavatrix-site`).
 
 ## Release history
 

package/docs/releases/v0.3.11.md

@@ -0,0 +1,55 @@
+# Weavatrix 0.3.11
+
+0.3.11 teaches the graph two new surfaces. SQL schemas become first-class graph
+citizens with honest, evidence-gated dead-code verdicts, and Solidity joins the
+parsed languages at zero dependency cost. The weavatrix.com site moved to its
+own repository, so the engine repo now ships engine only.
+
+## SQL: the graph reaches the database schema
+
+No SQL grammar ships in the pinned tree-sitter-wasms, so `.sql` indexing runs
+on a dependency-free statement scanner (a new `textOnly` language-module class)
+built for the graph's needs — symbols and references, not SQL semantics.
+String literals and comments are blanked before structural scanning, so quoted
+text can never fabricate a reference.
+
+- `CREATE TABLE`/`VIEW`/`FUNCTION`/`PROCEDURE`/`INDEX`/`TRIGGER` become graph
+  symbols; table columns (including `ALTER TABLE ADD COLUMN`) are member
+  symbols with `member_of`, and tables carry their columns as `field_types`.
+- References resolve inside `.sql` files (a view's `SELECT`, an index's `ON`
+  table, a trigger's `EXECUTE FUNCTION`, foreign-key `REFERENCES`) — and, the
+  real point, from application code: literal SQL found in string literals of
+  any indexed language links the enclosing function to the table it queries.
+  `change_impact` and `get_dependents` on a table now answer "which code
+  touches this?"
+- Dead-code verdicts stay honest. Schema objects are judged only when the
+  repository demonstrably uses literal SQL the scanner can read — an
+  ORM-driven repo produces silence, not guesses. Columns of a
+  `SELECT *`-consumed table are never judged by name, and indexes/triggers
+  (DB-engine surface) are never judged at all. A flagged column reports
+  "no SQL statement in the indexed sources references it".
+
+## Solidity
+
+The tree-sitter-solidity grammar already shipped inside the pinned
+tree-sitter-wasms package — 0.3.11 registers it (and pins its SHA-256 in the
+parser-artifact allowlist), so Solidity support adds zero new dependencies.
+Contracts, interfaces, libraries, functions, constructors, modifiers, events,
+errors, structs, enums and state variables are extracted with visibility and
+membership; `is` inheritance, modifier invocations, `emit`, `new Contract()`
+and `using X for Y` all feed the call/heritage resolvers. Imports resolve
+through relative paths, Foundry remappings (`remappings.txt` / `foundry.toml`)
+and root-anchored specs; npm-style specs (`@openzeppelin/...`) are recorded as
+external dependencies. `.sol` files share directory scope like Go/C#/Rust,
+which makes Solidity's plain `import "./Base.sol"` — a statement that names no
+symbols — resolvable for siblings without guessing.
+
+`extractorSchemaV` 6 → 7; cached graphs rebuild once, automatically.
+
+## Repository
+
+The weavatrix.com landing site (pages, Cloudflare Worker config, deploy
+workflow and its asset checks) moved byte-identically to the separate
+`weavatrix-site` repository, removing ~1.2 MB of page assets from the engine
+repo. The MCPB icon the site used to own is vendored at `mcpb/icon.png`; the
+published npm package contents are unchanged.

package/docs/releases/v0.3.12.md

@@ -0,0 +1,44 @@
+# Weavatrix 0.3.12
+
+0.3.12 makes the read-only core the provably-pure base of a layered stack. The
+core stays exactly what it was for its users — the same 34 offline analysis tools
+— but it now exposes a small read-only analysis surface for the packages built on
+top of it, and machine gates prove it can neither modify code nor reach anything
+external. Rust cross-crate call resolution and a `query_graph` seeding fix round
+out the release.
+
+## The read-only base of the stack
+
+Weavatrix now anchors a stack of growing responsibility:
+`weavatrix-online ⊃ weavatrix-refactor ⊃ weavatrix`. You install one package and
+get everything below it. This release adds only what the base owes the layers
+above; it registers no new tools and changes no existing tool.
+
+- New `weavatrix/analysis-kit` export: a narrow, read-only surface (graph
+  identity, cycle detection, architecture verification, the bundled tree-sitter
+  grammars, the read-only TypeScript language-server client, dead-code signals)
+  that upper-layer packages compose. Nothing here writes, applies, or describes
+  an edit.
+- Two release gates make the base's guarantees machine-checked, alongside the
+  existing ADR 0001 no-network gate: the core source contains **no edit-plan,
+  applier, or refactoring-builder marker**, and **no literal URL** at all. A
+  vulnerability finding references the advisory id rather than an external link;
+  the URL-matching malware heuristics are matchers over scanned code, not links
+  the core follows. Installing the base alone can neither modify your code nor
+  reach the network.
+
+## Rust cross-crate call resolution
+
+Rust call edges now resolve across crates, inline-test coverage is reported
+honestly, and same-crate call noise is reduced — cross-crate `references` edges
+land where a caller reaches a definition in another crate.
+
+## query_graph seeding
+
+A `query_graph` question that reduced entirely to stop words (a bare
+`architecture`), or inferred a language absent from the repository (`contract`
+inferring Solidity where there are no `.sol` files), previously returned a
+misleading "No nodes matched". Both now fall back only when they would otherwise
+return nothing: the stop filter relaxes when every token is a stop word, and a
+requested language that matches zero nodes is dropped. Queries that already
+worked are unchanged.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "weavatrix",
-  "version": "0.3.10",
+  "version": "0.3.12",
   "type": "module",
   "description": "Local repository intelligence MCP for AI coding agents: an always-fresh architecture graph with production-first evidence — blast radius, dead code, endpoints, clones, history, Health and architecture safeguards, with honestly labeled precision.",
   "author": "Sergii Ziborov <sergii.ziborov@gmail.com>",
@@ -24,6 +24,7 @@
     "./mcp-runtime": "./src/mcp-runtime.mjs",
     "./extension-api": "./src/mcp/extension-api.mjs",
     "./extension/local-services": "./src/extension/local-services.mjs",
+    "./analysis-kit": "./src/analysis-kit.mjs",
     "./package.json": "./package.json"
   },
   "files": [
@@ -44,6 +45,8 @@
     "docs/releases/v0.3.8.md",
     "docs/releases/v0.3.9.md",
     "docs/releases/v0.3.10.md",
+    "docs/releases/v0.3.11.md",
+    "docs/releases/v0.3.12.md",
     "docs/releases/v0.2.19.md",
     "README.md",
     "SECURITY.md",

package/src/analysis/cargo-manifests.js

@@ -19,6 +19,13 @@ export function parseCargoToml(text) {
   for (const raw of source.split(/\r?\n/)) {
     const line = raw.replace(/(^|\s)#.*$/, "").trim();
     if (!line) continue;
+    // Array-of-tables headers ([[bin]], [[example]], [[test]], [[bench]]) are neither the [package]
+    // table nor a dependency table. Recognise them so their `name =`/`path =` keys are not mis-read:
+    // a [[bin]] renamed to a crate ([[bin]] name = "foo") would otherwise overwrite the package name and
+    // make every foo:: import look like a self-reference, and a [[bin]] after [dependencies] would leak
+    // phantom "name"/"path" dependencies.
+    const arrayHeader = /^\[\[([^\]]+)]]$/.exec(line);
+    if (arrayHeader) { section = arrayHeader[1].trim(); continue; }
     const header = /^\[([^\]]+)]$/.exec(line);
     if (header) { section = header[1].trim(); workspace ||= section === "workspace"; continue; }
     const kv = /^([A-Za-z0-9_-]+)\s*=\s*(.+)$/.exec(line);

package/src/analysis/dead-check.js

@@ -6,6 +6,7 @@
 // and is fully testable with no filesystem. It only needs {nodes, links} + source text. See [[graph-builder-internalization]].
 import { posix } from "node:path";
 import { isStructuralRelation } from "../graph/relations.js";
+import { createSqlDeadVerdict } from "../graph/builder/lang-sql.js";
 import { createPathClassifier, hasPathClass } from "../path-classification.js";
 
 const IDENT_RE = /[A-Za-z_$][\w$]*/g;
@@ -198,12 +199,11 @@ export function computeDead(graph, sources, { entrySet = new Set() } = {}) {
     return isDecorated(n);                                       // framework-registered via decorator
   };
 
+  const sqlVerdict = createSqlDeadVerdict({ nodes, links, ep, bareName });   // gated SQL verdicts — ORM blindness stays silent
   const deadSymbols = [];
   for (const n of symById.values()) {
-    if (isReferenced(n)) continue;
-    // test_surface: extractor-proven test-only symbols (Rust #[cfg(test)]) live in production paths.
-    const test = isTestFile(n.source_file) || n.test_surface === true;
-    deadSymbols.push({ id: n.id, file: n.source_file, label: n.label, test, reason: "no inbound edge and name unreferenced outside its file" });
+    if (isReferenced(n) || sqlVerdict.veto(n)) continue;
+    deadSymbols.push({ id: n.id, file: n.source_file, label: n.label, test: isTestFile(n.source_file) || n.test_surface === true, reason: sqlVerdict.reason(n) || "no inbound edge and name unreferenced outside its file" });
   }
   const deadSet = new Set(deadSymbols.map((s) => s.id));
 

package/src/analysis/duplicates.compute.js

@@ -111,7 +111,7 @@ function symbolRanges(graph) {
     if (!line) continue;
     let arr = byFile.get(n.source_file);
     if (!arr) byFile.set(n.source_file, (arr = []));
-    arr.push({ id: n.id, label: n.label || n.id, line, symbolKind: n.symbol_kind || "" });
+    arr.push({ id: n.id, label: n.label || n.id, line, symbolKind: n.symbol_kind || "", testSurface: n.test_surface === true });
   }
   for (const arr of byFile.values()) arr.sort((a, b) => a.line - b.line);
   return byFile;
@@ -184,6 +184,10 @@ export function computeDuplicates(repoPath, graphJsonPath, opts = {}) {
         id: syms[i].id, label: syms[i].label, file, start, end,
         n: toks.strict.length, declarative,
         ...classificationFields(pathInfo),
+        // Inline test surfaces (Rust `#[cfg(test)] mod tests`, `#[test]` fns) live in production files, so a
+        // path check alone misses them; the graph already flags the symbol. OR it in so skip-tests suppresses
+        // them by default and two #[test] fns are never reported as a production clone.
+        test: hasPathClass(pathInfo, "test", "e2e") || syms[i].testSurface === true,
         fp: { strict: fingerprints(toks.strict), renamed: fingerprints(toks.renamed) },
       });
     }

package/src/analysis/hot-path-review.js

@@ -36,7 +36,7 @@ function coverageForRange(record, startLine, endLine) {
     return total ? covered / total : Number.isFinite(record.pct) ? record.pct : null
 }
 
-function graphRiskBySymbol(graph, symbolIds) {
+function graphRiskBySymbol(graph, symbolIds, testCallerIds) {
     const state = new Map([...symbolIds].map((id) => [id, {
         incoming: 0, outgoing: 0, callers: new Set(), callees: new Set(),
     }]))
@@ -50,7 +50,10 @@ function graphRiskBySymbol(graph, symbolIds) {
             item.outgoing++
             item.callees.add(target)
         }
-        if (state.has(target)) {
+        // A test caller (inline #[cfg(test)] symbol or a test-path file) must not inflate a production
+        // symbol's fan-in — the same reason test symbols are excluded as candidates. Skipped only for the
+        // incoming/coupling side; unless the caller opted tests in (testCallerIds is then null).
+        if (state.has(target) && !(testCallerIds && testCallerIds.has(source))) {
             const item = state.get(target)
             item.incoming++
             item.callers.add(source)
@@ -135,7 +138,26 @@ export function computeHotPathReview(graph, options = {}) {
         eligible.push({node, complexity, file, classification: test ? 'test' : classified ? 'classified' : 'production'})
     }
 
-    const riskById = graphRiskBySymbol(graph, new Set(eligible.map(({node}) => String(node.id))))
+    // Test callers (inline test_surface symbols and test-path files) that must not count toward a
+    // production symbol's fan-in. Built over ALL nodes because a caller may sit outside the review scope.
+    const testCallerIds = options.includeTests === true ? null : (() => {
+        const ids = new Set()
+        const classifyCache = new Map()
+        for (const node of graph?.nodes || []) {
+            const id = String(node?.id || '')
+            if (!id.includes('#')) continue
+            let isTest = node?.test_surface === true
+            const file = normalize(node?.source_file)
+            if (!isTest && file) {
+                let info = classifyCache.get(file)
+                if (info === undefined) classifyCache.set(file, (info = classifier.explain(file)))
+                isTest = hasPathClass(info, 'test', 'e2e')
+            }
+            if (isTest) ids.add(id)
+        }
+        return ids
+    })()
+    const riskById = graphRiskBySymbol(graph, new Set(eligible.map(({node}) => String(node.id))), testCallerIds)
     const candidates = []
     for (const entry of eligible) {
         const {node, complexity, file} = entry

package/src/analysis/internal-audit/supply-chain.js

@@ -74,7 +74,7 @@ export async function runSupplyChainChecks(repoPath, {
           version: hit.pkg.version,
           reachability,
           evidence: [
-            { file: hit.adv.url, line: 0, snippet: `installed via ${hit.pkg.source}${hit.pkg.dev ? " (dev)" : ""}` },
+            { file: hit.adv.id, line: 0, snippet: `installed via ${hit.pkg.source}${hit.pkg.dev ? " (dev)" : ""}` },
             ...reachability.evidence.slice(0, 5).map((item) => ({ file: item.file, line: item.line, snippet: `${item.typeOnly ? "type-only " : ""}${item.kind}` })),
           ],
           source: "osv",

package/src/analysis/manifests.js

@@ -107,7 +107,10 @@ export function parsePipfileDeps(text) {
   let present = false;
   for (const raw of String(text || "").split(/\r?\n/)) {
     const line = raw.replace(/(^|\s)#.*$/, "").trim();
-    const sec = line.match(/^\[([^\]]+)\]$/);
+    // Match single [section] and array-of-tables [[section]] headers alike. Without the [[...]] case a
+    // `[[source]]` table following [packages] would leave section === "packages" and its name/url/verify_ssl
+    // keys would leak as phantom dependencies (the same blind spot fixed in the Cargo.toml parser).
+    const sec = line.match(/^\[+([^\]]+)\]+$/);
     if (sec) { section = sec[1].trim().toLowerCase(); continue; }
     if (section !== "packages" && section !== "dev-packages") continue;
     const kv = line.match(/^["']?([A-Za-z0-9][\w.-]*)["']?\s*=/);

package/src/analysis/static-test-reachability.js

@@ -37,6 +37,13 @@ export function computeStaticTestReachability(graph, {
     if (!classificationCache.has(normalized)) classificationCache.set(normalized, classifier.explain(normalized, { content: "" }));
     return classificationCache.get(normalized);
   };
+  // Files that carry inline test surfaces (Rust `#[cfg(test)]` modules / `#[test]` fns live inside the
+  // production file, so path classification alone never sees them). The graph flags these per symbol.
+  // These files are NOT seeded as whole-file BFS sources: at file granularity we cannot tell an inline
+  // test's out-edge from a same-file production call, so seeding the file would propagate its PRODUCTION
+  // call chains as if a test reached them. They are self-covered at distance 0 instead (an honest,
+  // conservative signal: "this file has its own tests"), never over-claiming reach to other files.
+  const testSurfaceFiles = new Set();
   const isTest = (file) => hasPathClass(classify(file), "test", "e2e");
   const isProduct = (file) => {
     const info = classify(file);
@@ -50,6 +57,7 @@ export function computeStaticTestReachability(graph, {
     if (!file) continue;
     idToFile.set(String(node.id), file);
     files.add(file);
+    if (node?.test_surface === true) testSurfaceFiles.add(file);
   }
 
   // Collapse symbol/file edges to directed file dependencies. Multiple symbol edges retain the best
@@ -73,6 +81,13 @@ export function computeStaticTestReachability(graph, {
   const productFiles = [...files].filter(isProduct).filter((file) => pathInScope(file, scope)).sort((a, b) => a.localeCompare(b));
   const productSet = new Set(productFiles);
   const nearest = new Map();
+  // A production file that carries its own inline tests is self-covered at distance 0: its tests exercise
+  // its own production symbols. This is the honest floor that fixes a false "0 reachable" for repos whose
+  // tests are all inline (Rust); it never asserts reach to OTHER files, so it cannot over-claim.
+  const inlineCovered = productFiles.filter((file) => testSurfaceFiles.has(file));
+  for (const file of inlineCovered) {
+    nearest.set(file, [{ test: file, distance: 0, score: 3, confidence: confidenceLabel(3), path: [file] }]);
+  }
   const queue = tests.map((test) => ({ file: test, test, distance: 0, score: 3, path: [test] }));
   const seen = new Map(tests.map((test) => [`${test}\0${test}`, 0]));
   let cursor = 0;
@@ -115,8 +130,10 @@ export function computeStaticTestReachability(graph, {
   return {
     kind: "staticTestReachability",
     actualCoverage: "NOT_AVAILABLE",
-    testFiles: tests.length,
-    totalTestFiles: allTests.length,
+    // Inline-test files self-cover rather than seed the traversal, but they ARE test-bearing files, so
+    // the reported counts include them — otherwise a Rust repo would read "0 test files" beside real reach.
+    testFiles: tests.length + inlineCovered.length,
+    totalTestFiles: allTests.length + inlineCovered.length,
     productFiles: productFiles.length,
     reachableFiles: reachable.length,
     unreachableFiles: unreachable.length,

package/src/analysis-kit.mjs

@@ -0,0 +1,17 @@
+// Read-only analysis primitives the weavatrix-refactor package composes into refactoring
+// plan producers. Everything exported here is PURE READ: graph identity helpers, cycle
+// detection, architecture verification, the bundled tree-sitter grammars, the read-only
+// TypeScript language-server client, and dead-code risk signals. None of it writes, applies,
+// or references applying a change — the core catalog and the release gate keep the core
+// provably free of any source-write or edit-plan path. The refactoring engines live in
+// weavatrix-refactor and import this surface.
+
+export {graphEndpointId, fileOfId} from './graph/node-id.js'
+export {Parser, Query, EXT_LANG, ensureParser} from './graph/internal-builder.langs.js'
+export {querySymbolPrecision} from './precision/symbol-query.js'
+export {createTypeScriptLspClient} from './precision/typescript-provider/client.js'
+export {verifyArchitecture} from './analysis/architecture/contract-verification.js'
+export {normalizeArchitectureContract} from './analysis/architecture-contract.js'
+export {buildFileImportGraph, findSccs} from './analysis/structure/dependency-graph.js'
+export {isFrameworkEntryFile} from './analysis/dead-check.js'
+export {hasDynamicCode, REFLECTION_CODE_RE} from './analysis/dead-code-review/policy.js'

package/src/graph/builder/lang-rust-calls.js

@@ -0,0 +1,63 @@
+// Rust scoped-call resolution (`Path::method()`), split from lang-rust.js. Resolved with the full
+// qualifier in hand so an external associated function (`OpenOptions::new()`, `Vec::from()`) never binds
+// its bare final name to an unrelated same-named function in the directory. Only heads with real evidence
+// produce an edge: crate/self/super anchors, `use`-bound names (including sibling-crate modules),
+// fully-qualified sibling crates, and local types whose exact impl method is indexed. A std/external
+// type head is left unresolved on purpose.
+
+// Symbol kinds that can own an associated function via `Type::method`.
+const TYPE_KINDS = new Set(["struct", "enum", "trait", "type", "union"]);
+
+// `pathParts` and `inlineAncestors` stay owned by lang-rust.js (pass 1 uses them too) and are passed in,
+// so this module never imports back from lang-rust.js.
+export function rustScopedCalls(ctx, { pathParts, inlineAncestors }) {
+  const { grammar, tree, fileRel, caps, enclosing, links, nodeById, importedLocals,
+          dirSymbols, resolveNamedSymbol, resolveRustMethod, resolveRustPath, resolveRustCratePath } = ctx;
+  const dir = fileRel.includes("/") ? fileRel.slice(0, fileRel.lastIndexOf("/")) : "";
+  const localSyms = dirSymbols?.get(dir);
+  const emitCall = (node, target) => {
+    const caller = enclosing(fileRel, node.startPosition.row + 1);
+    if (caller && target && target !== caller.id) {
+      links.push({ source: caller.id, target, relation: "calls", confidence: "INFERRED", line: node.startPosition.row + 1 });
+    }
+  };
+  for (const cap of caps(grammar, `(call_expression function: (scoped_identifier) @path)`, tree.rootNode)) {
+    const node = cap.node;
+    const segments = pathParts(node);
+    if (segments.length < 2) continue;
+    const head = segments[0];
+    const method = segments.at(-1);
+
+    if (["crate", "self", "super"].includes(head)) {
+      const resolved = resolveRustPath(fileRel, segments, { inlineModules: inlineAncestors(node), unqualified: false });
+      if (resolved) emitCall(node, resolveNamedSymbol(resolved.targetFile, method, "value"));
+      continue;
+    }
+
+    const bound = importedLocals?.get(fileRel)?.get(head);
+    if (bound?.targetFile) {
+      emitCall(node, resolveNamedSymbol(bound.targetFile, method, "value"));
+      continue;
+    }
+
+    const crateResolved = resolveRustCratePath ? resolveRustCratePath(head, segments.slice(1, -1)) : null;
+    if (crateResolved) {
+      emitCall(node, resolveNamedSymbol(crateResolved.targetFile, method, "value"));
+      continue;
+    }
+
+    // Local type's associated function: resolve the exact impl member. Nothing else (enum-variant
+    // construction, external types) has an indexed target, so it produces no edge.
+    const headId = localSyms?.get(head);
+    if (headId && TYPE_KINDS.has(nodeById.get(headId)?.symbol_kind)) {
+      emitCall(node, resolveRustMethod(dir, head, method));
+      continue;
+    }
+
+    // Head is a locally-declared outlined module used without `use` (`mod utils; utils::init()`), the
+    // dominant flat-file idiom. resolveRustPath matches only a REAL repo module file, so an external type
+    // head (OpenOptions, Vec) resolves to null and still produces no edge — no dir-scope mis-binding.
+    const modResolved = resolveRustPath?.(fileRel, segments.slice(0, -1), { inlineModules: inlineAncestors(node), unqualified: true });
+    if (modResolved) emitCall(node, resolveNamedSymbol(modResolved.targetFile, method, "value"));
+  }
+}

package/src/graph/builder/lang-rust.js

@@ -3,6 +3,8 @@
 // File dependencies follow Rust's module tree: outlined `mod`, `use` trees, public re-exports, and anchored
 // `crate/self/super` paths resolve to repo-local .rs or */mod.rs files. External crates deliberately stay out
 // of this adapter; Cargo dependency analysis owns them.
+import { rustScopedCalls } from "./lang-rust-calls.js";
+
 const SYMS_CORE = `
   (function_item name: (identifier) @function)
   (struct_item name: (type_identifier) @struct)
@@ -141,17 +143,19 @@ export default {
   grammars: ["rust"],
   exts: { ".rs": "rust" },
   isWeb: false,
+  // Bare `foo()` and method `x.foo()` calls resolve by name in the generic pass-2 loop. Scoped
+  // `Path::foo()` calls are handled in pass2() below with the full qualifier in hand, so an external
+  // `OpenOptions::new()` cannot bind its bare `new` to an unrelated same-named function in the folder.
   calls: `
     (call_expression function: (identifier) @callee)
-    (call_expression function: (field_expression field: (field_identifier) @callee))
-    (call_expression function: (scoped_identifier name: (identifier) @callee))`,
+    (call_expression function: (field_expression field: (field_identifier) @callee))`,
   heritage: [
     `(impl_item trait: (type_identifier) @super)`,
     `(impl_item trait: (generic_type type: (type_identifier) @super))`,
   ],
 
   pass1(ctx) {
-    const { grammar, tree, fileRel, caps, field, addSym, addImportEdge, addExternalImport, imports, resolveRustMod, resolveRustPath, links, nameToId } = ctx;
+    const { grammar, tree, fileRel, caps, field, addSym, addImportEdge, addExternalImport, imports, resolveRustMod, resolveRustPath, resolveRustCratePath, links, nameToId } = ctx;
     const owned = [];
     for (const src of [SYMS_CORE, ...SYMS_OPTIONAL]) {
       for (const cap of caps(grammar, src, tree.rootNode)) {
@@ -224,9 +228,16 @@ export default {
         // A `use` alias or imported item name shadows any same-named crate for the rest of this file. The
         // crate's OWN root name (e.g. `use anyhow::{self}`) is excluded so it still counts as a dependency.
         if (leaf.local && leaf.local !== "_" && cleanSegment(leaf.local) !== cleanSegment(leaf.segments[0])) localBindings.add(cleanSegment(leaf.local));
-        const resolved = resolveRustPath(fileRel, leaf.segments, { inlineModules: ancestors, unqualified: true });
+        const crate = cleanSegment(leaf.segments[0]);
+        let resolved = resolveRustPath(fileRel, leaf.segments, { inlineModules: ancestors, unqualified: true });
+        // A head that is not a local module may be a sibling workspace crate (`use radiochron::wlan`):
+        // resolve it INTO that crate so its items bind here and cross-crate calls resolve in pass 2. It is
+        // still recorded as a dependency import so the sibling crate is not flagged an unused Cargo dep.
+        if (!resolved && resolveRustCratePath && isExternalCrate(crate, localBindings)) {
+          resolved = resolveRustCratePath(crate, leaf.segments.slice(1));
+          if (resolved) addExternalImport({ spec: leaf.segments.join("::"), pkg: crate.replace(/_/g, "-"), builtin: false, ecosystem: "crates.io", kind: "rust-use", line: use.startPosition.row + 1 });
+        }
         if (!resolved) {
-          const crate = cleanSegment(leaf.segments[0]);
           if (isExternalCrate(crate, localBindings)) {
             addExternalImport({ spec: leaf.segments.join("::"), pkg: crate.replace(/_/g, "-"), builtin: false, ecosystem: "crates.io", kind: "rust-use", line: use.startPosition.row + 1 });
           }
@@ -250,7 +261,16 @@ export default {
       const segments = pathParts(node);
       if (!["crate", "self", "super"].includes(segments[0])) {
         const crate = cleanSegment(segments[0]);
-        if (isExternalCrate(crate, localBindings)) {
+        // A fully-qualified sibling-crate path (`radiochron::events::recent`) is a real cross-crate
+        // dependency: emit the file edge AND record the dependency import so the sibling crate still
+        // counts as used, rather than being logged as an external crates.io crate.
+        const crateResolved = resolveRustCratePath && isExternalCrate(crate, localBindings)
+          ? resolveRustCratePath(crate, segments.slice(1))
+          : null;
+        if (crateResolved) {
+          emit(crateResolved.targetFile, { line: node.startPosition.row + 1, specifier: node.text });
+          addExternalImport({ spec: segments.join("::"), pkg: crate.replace(/_/g, "-"), builtin: false, ecosystem: "crates.io", kind: "rust-path", line: node.startPosition.row + 1 });
+        } else if (isExternalCrate(crate, localBindings)) {
           addExternalImport({ spec: segments.join("::"), pkg: crate.replace(/_/g, "-"), builtin: false, ecosystem: "crates.io", kind: "rust-path", line: node.startPosition.row + 1 });
         }
         continue;
@@ -271,4 +291,9 @@ export default {
       }
     }
   },
+
+  // Scoped `Path::method()` calls are resolved in lang-rust-calls.js with the full qualifier in hand.
+  pass2(ctx) {
+    rustScopedCalls(ctx, { pathParts, inlineAncestors });
+  },
 };

package/src/graph/builder/lang-solidity.js

@@ -0,0 +1,126 @@
+// Solidity extractor. Symbols: contract/interface/library (space "both" so `is Base` heritage and
+// `new Vault()` both resolve through the value-space resolver), functions/constructors/modifiers/
+// events/errors/structs/enums/state vars (members carry memberOf + visibility). Imports: relative
+// paths, Foundry remappings (remappings.txt / foundry.toml), and root-anchored specs resolve to repo
+// files; everything else (npm-style @openzeppelin/…, absent lib/ submodules) is RECORDED as an
+// external import for dependency analysis. Calls: bare `f()`, modifier invocations, `emit Event(…)`,
+// `new Contract(…)`, and `using Lib for T` all feed the calls resolver. Same-dir symbols share scope
+// (see sharesDirScope): Solidity's flat project namespace makes plain `import "./Base.sol"` — which
+// names no symbols — resolvable for siblings without guessing; cross-dir plain imports still produce
+// the file-level import edge, so blast radius stays correct even where symbol edges are unknowable.
+import { specToPkg } from "./spec-pkg.js";
+
+const CONTAINERS = new Set(["contract_declaration", "interface_declaration", "library_declaration"]);
+const KIND_BY_CONTAINER = {
+  contract_declaration: "contract",
+  interface_declaration: "interface",
+  library_declaration: "library",
+};
+// external/public functions are the deployed ABI — callable by any transaction, not just repo code.
+const VISIBILITY = { external: "public", public: "public", internal: "protected", private: "private" };
+
+function enclosingContainer(node) {
+  for (let parent = node?.parent; parent; parent = parent.parent) {
+    if (CONTAINERS.has(parent.type)) return parent;
+  }
+  return null;
+}
+
+const identifierOf = (node) => node?.namedChildren?.find((child) => child.type === "identifier") || null;
+const childOfType = (node, type) => node?.namedChildren?.find((child) => child.type === type) || null;
+const parameterCount = (node) => (node?.namedChildren || []).filter((child) => child.type === "parameter").length;
+
+export default {
+  family: "solidity",
+  grammars: ["solidity"],
+  exts: { ".sol": "solidity" },
+  isWeb: false,
+  calls: `[(call_expression (identifier) @callee) (modifier_invocation (identifier) @callee) (emit_statement (identifier) @callee) (new_expression (type_name (user_defined_type (identifier) @callee))) (using_directive (type_alias (identifier) @callee))]`,
+  heritage: [`(inheritance_specifier (user_defined_type (identifier) @base))`],
+
+  pass1(ctx) {
+    const { grammar, tree, fileRel, caps, addSym, addImportEdge, addExternalImport, imports, links, nameToId, resolveSolidityImport } = ctx;
+
+    // ---- containers (contract/interface/library) ----
+    for (const cap of caps(grammar, `[(contract_declaration (identifier) @c) (interface_declaration (identifier) @c) (library_declaration (identifier) @c)]`, tree.rootNode)) {
+      addSym(cap.node.text, cap.node.startPosition.row + 1, false, {
+        sourceNode: cap.node.parent,
+        selectionNode: cap.node,
+        symbolKind: KIND_BY_CONTAINER[cap.node.parent.type],
+        symbolSpace: "both",
+        exported: true,
+        moduleDeclaration: true,
+      });
+    }
+
+    // ---- functions (free + members), constructors, modifiers ----
+    const ownedMembers = [];
+    const addMember = (name, node, selection, extra) => {
+      const container = enclosingContainer(node);
+      const ownerName = container ? identifierOf(container)?.text || null : null;
+      const id = addSym(name, (selection || node).startPosition.row + 1, extra.callable !== false, {
+        sourceNode: node,
+        selectionNode: selection || undefined,
+        ...(ownerName ? { memberOf: ownerName } : { exported: true, moduleDeclaration: true }),
+        ...extra,
+      });
+      if (ownerName && id) ownedMembers.push({ ownerName, id });
+      return id;
+    };
+    for (const cap of caps(grammar, `(function_definition (identifier) @fn)`, tree.rootNode)) {
+      const definition = cap.node.parent;
+      const visibility = VISIBILITY[childOfType(definition, "visibility")?.text || ""];
+      addMember(cap.node.text, definition, cap.node, {
+        symbolKind: enclosingContainer(definition) ? "method" : "function",
+        ...(visibility ? { visibility } : {}),
+        parameterCount: parameterCount(definition),
+      });
+    }
+    for (const cap of caps(grammar, `(constructor_definition) @ctor`, tree.rootNode))
+      addMember("constructor", cap.node, null, { symbolKind: "constructor", parameterCount: parameterCount(cap.node) });
+    for (const cap of caps(grammar, `(modifier_definition (identifier) @m)`, tree.rootNode))
+      addMember(cap.node.text, cap.node.parent, cap.node, { symbolKind: "modifier", parameterCount: parameterCount(cap.node.parent) });
+
+    // ---- data/type declarations ----
+    for (const cap of caps(grammar, `[(event_definition (identifier) @n) (error_declaration (identifier) @n)]`, tree.rootNode))
+      addMember(cap.node.text, cap.node.parent, cap.node, { callable: false, symbolKind: cap.node.parent.type === "event_definition" ? "event" : "error" });
+    for (const cap of caps(grammar, `[(struct_declaration (identifier) @n) (enum_declaration (identifier) @n)]`, tree.rootNode))
+      addMember(cap.node.text, cap.node.parent, cap.node, { callable: false, symbolKind: cap.node.parent.type === "struct_declaration" ? "struct" : "enum", symbolSpace: "both" });
+    // capture the DECLARATION and take its first identifier child (the name): an initializer such as
+    // `uint x = OTHER_CONST;` can place a second bare identifier under the same declaration node.
+    for (const cap of caps(grammar, `(constant_variable_declaration) @d`, tree.rootNode)) {
+      const name = identifierOf(cap.node);
+      if (name) addMember(name.text, cap.node, name, { callable: false, symbolKind: "constant" });
+    }
+    for (const cap of caps(grammar, `(state_variable_declaration) @d`, tree.rootNode)) {
+      const name = identifierOf(cap.node);
+      const visibility = VISIBILITY[childOfType(cap.node, "visibility")?.text || ""] || "protected"; // Solidity default: internal
+      if (name) addMember(name.text, cap.node, name, { callable: false, symbolKind: "variable", visibility });
+    }
+    for (const member of ownedMembers) {
+      const ownerId = nameToId.get(member.ownerName);
+      if (ownerId) links.push({ source: ownerId, target: member.id, relation: "contains", confidence: "EXTRACTED" });
+    }
+
+    // ---- imports ----
+    for (const cap of caps(grammar, `(import_directive) @imp`, tree.rootNode)) {
+      const specNode = childOfType(cap.node, "string");
+      if (!specNode) continue;
+      const spec = specNode.text.replace(/^["']|["']$/g, "");
+      const line = specNode.startPosition.row + 1;
+      const target = resolveSolidityImport(fileRel, spec);
+      if (target) {
+        addImportEdge(target, { specifier: spec, line });
+        // `import {A, B} from "./x.sol"` — bind each named symbol. A lone identifier may instead be a
+        // `* as Alias` namespace name; binding it the same way is harmless (no same-named symbol → no edge).
+        for (const named of cap.node.namedChildren.filter((child) => child.type === "identifier"))
+          imports.set(named.text, { imported: named.text, targetFile: target });
+        continue;
+      }
+      if (spec.startsWith(".")) { addExternalImport({ spec, kind: "sol-import", line, unresolved: true }); continue; }
+      const r = specToPkg(spec);
+      if (r) addExternalImport({ spec, pkg: r.pkg, builtin: false, kind: "sol-import", line });
+      else addExternalImport({ spec, kind: "sol-import", line, unresolved: true });
+    }
+  },
+};