feat(parsers): add Kotlin language support

Handles .kt and .kts files using tree-sitter-language-pack's kotlin
grammar (transitive dep, no new installs). Extracts:

- Top-level functions (fun main, suspend fun fetch, ...)
- Classes, interfaces, data classes, objects, enum classes
- Methods inside class_body and enum_class_body
- Parameters from function_value_parameters and their user_type /
  type_identifier / nullable_type annotations
- Return types from the type node following `:` on the signature
- Imports — captured as graph.dependencies

Entrypoint detectors for Kotlin:

- Spring MVC / WebFlux annotations (@GetMapping, @PostMapping, etc.)
  reusing the existing Java detector since the annotations are identical
  across the two languages.
- Android component lifecycle methods: onCreate, onStart, onResume,
  onNewIntent, onActivityResult, onReceive, onBind, onHandleIntent.
  These are attacker-reachable when the component is exported — we
  over-detect on purpose and rely on the override file to tighten.

Known gap (parallel to Swift, documented in parser docstring): `throw`
statements share their AST node type with `return`/`break`/`continue`
via `jump_expression`, so exception-type capture needs a Kotlin-specific
walk filtered by the leading `throw` token. Deferred.

14 new tests: Kotlin parser, Kotlin entrypoint detection. README
supported-languages and framework-coverage tables updated.

Roadmap left before v0.2.0: Dart/Flutter parser, Go/Ruby/C++ entrypoint
detectors (Option A), branches + docstring in JSON export (Option B).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: tob-scott-a

README.md

@@ -61,6 +61,7 @@ A language-specific parser walks the directory, parses each file into a tree-sit
 | Miden Assembly | `.masm` | procedures, entrypoints, constants, invocations |
 | Swift | `.swift` | functions, classes, structs, enums, protocols, extensions |
 | Objective-C | `.m`, `.mm`, `.h` | C functions, classes, methods (selector-based naming) |
+| Kotlin | `.kt`, `.kts` | functions, classes, interfaces, data classes, objects, methods |
 
 ```mermaid
 flowchart TD
@@ -293,6 +294,7 @@ Framework coverage:
 | Erlang | functions listed in `-export([...])` |
 | Swift | `@main` app attribute |
 | Objective-C | `UIApplicationDelegate` lifecycle selectors (e.g. `application:openURL:options:`) |
+| Kotlin | Spring MVC / WebFlux annotations (shared with Java), Android component lifecycle methods (`onCreate`, `onReceive`, `onBind`, ...) |
 
 For anything the heuristics miss, declare entrypoints explicitly in `.trailmark/entrypoints.toml` at the project root:
 

src/trailmark/analysis/entrypoints.py

@@ -168,6 +168,27 @@
     }
 )
 
+# Kotlin — Ktor routing DSL: `get("/path") { ... }`, `post`, etc.
+# These appear as call expressions inside a `routing { ... }` block. The
+# file-level heuristic matches the verb calls; without block-level context
+# we can't distinguish Ktor routes from bare HTTP client calls, so Ktor
+# detection is currently disabled in favor of the override file.
+
+# Kotlin — Android Activity lifecycle overrides. Names and signatures
+# are stable across Android SDK versions.
+_KOTLIN_ANDROID_LIFECYCLE_METHODS = frozenset(
+    {
+        "onCreate",
+        "onStart",
+        "onResume",
+        "onNewIntent",
+        "onActivityResult",
+        "onReceive",  # BroadcastReceiver
+        "onBind",  # Service
+        "onHandleIntent",  # IntentService
+    }
+)
+
 _KIND_BY_NAME = {k.value: k for k in EntrypointKind}
 _TRUST_BY_NAME = {t.value: t for t in TrustLevel}
 _ASSET_BY_NAME = {a.value: a for a in AssetValue}
@@ -260,6 +281,8 @@ def _detect_for_unit(
         return _detect_swift(cache, unit, path)
     if path.endswith((".m", ".mm", ".h")):
         return _detect_objc(unit)
+    if path.endswith((".kt", ".kts")):
+        return _detect_kotlin(cache, unit, path)
     return None
 
 
@@ -652,6 +675,41 @@ def _detect_swift(
     return None
 
 
+def _detect_kotlin(
+    cache: _SourceCache,
+    unit: CodeUnit,
+    path: str,
+) -> EntrypointTag | None:
+    """Detect Kotlin entrypoints.
+
+    Layers tried in order:
+    1. Spring MVC / WebFlux annotations (``@GetMapping``, ``@PostMapping``,
+       etc.) — shared with the Java detector because the annotations are
+       identical across the two languages.
+    2. Android Activity / Service / BroadcastReceiver lifecycle method
+       names. These are attacker-reachable when the component is exported
+       (``android:exported="true"`` in the manifest) — we over-detect
+       here and let the override file tighten when appropriate.
+    """
+    decorators = cache.decorators_above(path, unit.location.start_line)
+    for line in decorators:
+        if _JAVA_SPRING_HANDLER.match(line):
+            return EntrypointTag(
+                kind=EntrypointKind.API,
+                trust_level=TrustLevel.UNTRUSTED_EXTERNAL,
+                description="Spring MVC/WebFlux handler (Kotlin)",
+                asset_value=AssetValue.HIGH,
+            )
+    if unit.name in _KOTLIN_ANDROID_LIFECYCLE_METHODS:
+        return EntrypointTag(
+            kind=EntrypointKind.API,
+            trust_level=TrustLevel.UNTRUSTED_EXTERNAL,
+            description="Android component lifecycle method",
+            asset_value=AssetValue.HIGH,
+        )
+    return None
+
+
 def _detect_objc(unit: CodeUnit) -> EntrypointTag | None:
     """Detect Objective-C entrypoints: AppDelegate selectors and extern C.
 

src/trailmark/parsers/kotlin/__init__.py

@@ -0,0 +1,5 @@
+"""Kotlin language parser for Trailmark."""
+
+from trailmark.parsers.kotlin.parser import KotlinParser
+
+__all__ = ["KotlinParser"]