@archora/core 1.1.0 → 1.3.0

package/src/analyzer/__tests__/rsc.test.ts

@@ -43,6 +43,26 @@ describe('classifyModuleRuntime', () => {
     ).toBe('server');
   });
 
+  it("importing the 'server-only' package marks the module server (any framework)", () => {
+    expect(
+      classifyModuleRuntime({
+        relPath: 'lib/secret.ts',
+        framework: 'unknown',
+        importsServerOnly: true,
+      }),
+    ).toBe('server');
+  });
+
+  it("importing the 'client-only' package marks the module client", () => {
+    expect(
+      classifyModuleRuntime({
+        relPath: 'lib/browser.ts',
+        framework: 'next',
+        importsClientOnly: true,
+      }),
+    ).toBe('client');
+  });
+
   it('Next App Router defaults to server, pages/api server-only', () => {
     expect(classifyModuleRuntime({ relPath: 'app/page.tsx', framework: 'next' })).toBe('server');
     expect(classifyModuleRuntime({ relPath: 'pages/api/hello.ts', framework: 'next' })).toBe(
@@ -98,6 +118,57 @@ describe('detectRscLeaks', () => {
     expect(leaks[0]?.edge?.to).toBe('lib/db.ts');
   });
 
+  it("flags a client component importing a module poisoned with 'server-only'", async () => {
+    const fs = createInMemoryFileSource('/repo', {
+      'package.json': JSON.stringify({ dependencies: { next: '^14.0.0' } }),
+      'app/Form.tsx':
+        "'use client';\nimport { getSecret } from '../lib/secret';\nexport default function F(){ return getSecret(); }\n",
+      'lib/secret.ts': "import 'server-only';\nexport const getSecret = () => 1;\n",
+    });
+    const scan = await analyze(fs);
+    const leaks = scan.contractViolations.filter((v) => v.kind === 'rsc-leak');
+    expect(
+      leaks.some((l) => l.edge?.from === 'app/Form.tsx' && l.edge?.to === 'lib/secret.ts'),
+    ).toBe(true);
+  });
+
+  it('flags a transitive leak: client -> shared barrel -> server', () => {
+    const modules = [
+      mod('app/Form.tsx', 'client'),
+      mod('lib/index.ts', 'shared'), // barrel
+      mod('lib/db.ts', 'server'),
+    ];
+    const edges = [
+      edge('app/Form.tsx', 'lib/index.ts'), // client -> shared (legal alone)
+      edge('lib/index.ts', 'lib/db.ts'), // shared re-exports server
+    ];
+    const leaks = detectRscLeaks({ modules, edges });
+    const transitive = leaks.find(
+      (l) => l.edge?.from === 'app/Form.tsx' && l.edge?.to === 'lib/db.ts',
+    );
+    expect(transitive).toBeDefined();
+    expect(transitive?.kind).toBe('rsc-leak');
+  });
+
+  it('does not flag a client -> shared chain that never reaches a server module', () => {
+    const modules = [
+      mod('app/Form.tsx', 'client'),
+      mod('lib/index.ts', 'shared'),
+      mod('lib/util.ts', 'shared'),
+    ];
+    const edges = [edge('app/Form.tsx', 'lib/index.ts'), edge('lib/index.ts', 'lib/util.ts')];
+    expect(detectRscLeaks({ modules, edges })).toHaveLength(0);
+  });
+
+  it('does not double-report when a client directly imports a server module', () => {
+    const modules = [mod('app/Form.tsx', 'client'), mod('lib/db.ts', 'server')];
+    const edges = [edge('app/Form.tsx', 'lib/db.ts')];
+    const leaks = detectRscLeaks({ modules, edges }).filter(
+      (l) => l.edge?.from === 'app/Form.tsx' && l.edge?.to === 'lib/db.ts',
+    );
+    expect(leaks).toHaveLength(1);
+  });
+
   it('does not flag type-only edges or shared modules', () => {
     const modules = [mod('a.ts', 'client'), mod('b.ts', 'server'), mod('shared.ts', 'shared')];
     const edges = [

package/src/analyzer/archDebt.ts

@@ -8,20 +8,39 @@ interface Inputs {
   hotZoneCount: number;
 }
 
-// composite arch-debt 0..100 (higher = worse).
-// weights: cycles 35 / layers 30 / coupling 20 / hot zones 15. each saturates.
+// Composite **heuristic summary** arch-debt 0..100 (higher = worse). Not a
+// measurement but a weighted index of four proven components. Weights are ordered
+// by structural severity and cost-to-fix (not data-calibrated — that needs a
+// labeled corpus, see block A of the plan):
+//   - cycles 0.35   — heaviest and most expensive to fix, breaks isolation.
+//   - layers 0.30   — architectural erosion, but more local than a cycle.
+//   - coupling 0.20 — a continuous soft signal (instability), not a bug per se.
+//   - hotZones 0.15 — derived signal, partly overlaps coupling → lowest.
+// Sum = 1.0. Each component saturates, normalized to project size. Surfaced in
+// UI/reports as a "grade summary", not as a precise metric.
+const DEBT_WEIGHTS = { cycles: 0.35, layers: 0.3, coupling: 0.2, hotZones: 0.15 } as const;
+
+// Saturation divisors: the share of project modules at which a component nears
+// saturation. cycles: ~5% of modules in cycles is already "bad"; layers stricter (~3%).
+const CYCLE_SATURATION_RATIO = 0.05;
+const LAYER_SATURATION_RATIO = 0.03;
+
+// Letter-grade thresholds (score → grade). Ordinal cut-offs of the heuristic
+// summary: <15 A (healthy) … ≥70 F (systemic debt).
+const GRADE_THRESHOLDS = { A: 15, B: 30, C: 50, D: 70 } as const;
+
 export function computeArchDebt(inputs: Inputs): ArchDebt {
   const realModules = inputs.modules.filter((m) => !m.isInfra);
   const moduleCount = Math.max(1, realModules.length);
 
   const cycleWeight = inputs.cycles.reduce((acc, c) => acc + (c.severity === 'direct' ? 2 : 1), 0);
-  const cycleScore = saturate(cycleWeight / Math.max(1, moduleCount * 0.05));
+  const cycleScore = saturate(cycleWeight / Math.max(1, moduleCount * CYCLE_SATURATION_RATIO));
 
   const violationWeight = inputs.layerViolations.reduce(
     (acc, v) => acc + (v.severity === 'error' ? 3 : 1),
     0,
   );
-  const layerScore = saturate(violationWeight / Math.max(1, moduleCount * 0.03));
+  const layerScore = saturate(violationWeight / Math.max(1, moduleCount * LAYER_SATURATION_RATIO));
 
   const hotScore = saturate((inputs.hotZoneCount * 10) / moduleCount);
 
@@ -36,7 +55,11 @@ export function computeArchDebt(inputs: Inputs): ArchDebt {
   const couplingScore = instCount > 0 ? instSum / instCount : 0;
 
   const score = clamp(
-    100 * (cycleScore * 0.35 + layerScore * 0.3 + hotScore * 0.15 + couplingScore * 0.2),
+    100 *
+      (cycleScore * DEBT_WEIGHTS.cycles +
+        layerScore * DEBT_WEIGHTS.layers +
+        hotScore * DEBT_WEIGHTS.hotZones +
+        couplingScore * DEBT_WEIGHTS.coupling),
   );
 
   return {
@@ -60,9 +83,9 @@ function clamp(x: number): number {
 }
 
 function gradeOf(score: number): ArchDebt['grade'] {
-  if (score < 15) return 'A';
-  if (score < 30) return 'B';
-  if (score < 50) return 'C';
-  if (score < 70) return 'D';
+  if (score < GRADE_THRESHOLDS.A) return 'A';
+  if (score < GRADE_THRESHOLDS.B) return 'B';
+  if (score < GRADE_THRESHOLDS.C) return 'C';
+  if (score < GRADE_THRESHOLDS.D) return 'D';
   return 'F';
 }

package/src/analyzer/buildGraph.ts

@@ -108,6 +108,8 @@ export async function buildGraph(input: BuildGraphInput): Promise<BuildGraphResu
       relPath: p.relPath,
       framework: input.framework ?? 'unknown',
       ...(p.directives ? { directives: p.directives } : {}),
+      ...(p.imports.some((i) => i.specifier === 'server-only') ? { importsServerOnly: true } : {}),
+      ...(p.imports.some((i) => i.specifier === 'client-only') ? { importsClientOnly: true } : {}),
     }),
   }));
   const parserFacts = parsed.map((p) => toParsedFileSummary(p, input.framework ?? 'unknown'));
@@ -255,6 +257,33 @@ export async function buildGraph(input: BuildGraphInput): Promise<BuildGraphResu
     }
   }
 
+  // Nuxt auto-import: composables/** are exposed globally, a consumer calls
+  // useFoo() with no import. Resolve the call against a name -> composable file
+  // registry. unplugin-auto-import outside Nuxt is config-driven (see docs limitation).
+  const composableRegistry = buildComposableRegistry(parsed, framework);
+  if (composableRegistry.size > 0) {
+    for (const file of parsed) {
+      if (!file.callIdentifiers || file.callIdentifiers.length === 0) continue;
+      for (const name of file.callIdentifiers) {
+        const target = composableRegistry.get(name);
+        if (!target || target === file.relPath) continue;
+        const key = `${file.relPath}\u0001${target}`;
+        if (existingEdges.has(key)) continue;
+        existingEdges.add(key);
+        edges.push({
+          from: file.relPath,
+          to: target,
+          kind: 'auto-import',
+          specifier: name,
+          resolved: true,
+          confidence: 'medium',
+          resolutionKind: 'framework-auto',
+          approximate: true,
+        });
+      }
+    }
+  }
+
   return { modules, edges, parserFacts, warnings };
 }
 
@@ -365,6 +394,44 @@ function buildComponentRegistry(
   return registry;
 }
 
+// Nuxt auto-import: composables/**/*.{ts,js} are exposed globally. Registry name =
+// named exports + file basename (for `export default`). First-wins on collision.
+// Nuxt only: unplugin-auto-import outside Nuxt is config-driven (see docs limitation).
+const NUXT_COMPOSABLE_EXT = /\.[cm]?[jt]s$/u;
+
+// True when one of `rel`'s directory segments equals `segment`. Linear scan, used
+// instead of `(^|\/)<dir>\/.+` regexes: paths come from scanned, untrusted repos,
+// so a `.+`-based pattern that re-anchors on every `/<dir>/` is a ReDoS risk.
+function isUnderDirSegment(rel: string, segment: string): boolean {
+  const lastSlash = rel.lastIndexOf('/');
+  if (lastSlash < 0) return false;
+  return rel.slice(0, lastSlash).split('/').includes(segment);
+}
+
+// File under a `composables/` directory with a JS/TS extension (js/ts/mjs/mts/cjs/cts).
+export function isNuxtComposablePath(rel: string): boolean {
+  return NUXT_COMPOSABLE_EXT.test(rel) && isUnderDirSegment(rel, 'composables');
+}
+
+function buildComposableRegistry(
+  parsed: ParsedFile[],
+  framework: Framework | undefined,
+): Map<string, string> {
+  const registry = new Map<string, string>();
+  if (framework !== 'nuxt') return registry;
+  for (const file of parsed) {
+    if (!isNuxtComposablePath(file.relPath)) continue;
+    const names = new Set<string>();
+    for (const exp of file.exports) if (exp !== 'default') names.add(exp);
+    const slash = file.relPath.lastIndexOf('/');
+    const dot = file.relPath.lastIndexOf('.');
+    const base = file.relPath.slice(slash + 1, dot);
+    if (base.length > 0) names.add(base);
+    for (const name of names) if (!registry.has(name)) registry.set(name, file.relPath);
+  }
+  return registry;
+}
+
 function indexFilesByDir(files: string[]): Map<string, string[]> {
   const map = new Map<string, string[]>();
   for (const f of files) {
@@ -599,10 +666,14 @@ function frameworkFactsFromPath(
   ) {
     facts.push({ kind: 'sveltekit-route', value: relPath, confidence: 'medium' });
   }
-  if (framework === 'nuxt' && /(^|\/)components\/.+\.vue$/u.test(relPath)) {
+  if (
+    framework === 'nuxt' &&
+    relPath.endsWith('.vue') &&
+    isUnderDirSegment(relPath, 'components')
+  ) {
     facts.push({ kind: 'nuxt-auto-component', value: relPath, confidence: 'medium' });
   }
-  if (framework === 'nuxt' && /(^|\/)composables\/.+\.[cm]?[jt]s$/u.test(relPath)) {
+  if (framework === 'nuxt' && isNuxtComposablePath(relPath)) {
     facts.push({ kind: 'nuxt-auto-composable', value: relPath, confidence: 'medium' });
   }
   return facts;

package/src/analyzer/bundle/analyzeBundle.ts

@@ -6,7 +6,7 @@
 // are kept on the chunk for size accounting but don't surface as recs (we'd
 // flag them as "external" otherwise, which is noise on every chunk).
 
-import type { ModuleId, ModuleNode } from '../types';
+import type { DependencyEdge, ModuleId, ModuleNode } from '../types';
 import {
   DEFAULT_BUNDLE_THRESHOLDS,
   type BundleBloat,
@@ -22,6 +22,8 @@ export interface AnalyzeBundleInput {
   modules: ModuleNode[];
   stats: ParsedBundleStats;
   thresholds?: Partial<BundleThresholds>;
+  /** Edge graph: needed for barrel-leak (re-export hubs). Without it the signal is skipped. */
+  edges?: DependencyEdge[];
 }
 
 export function analyzeBundle(input: AnalyzeBundleInput): BundleReport {
@@ -48,6 +50,18 @@ export function analyzeBundle(input: AnalyzeBundleInput): BundleReport {
 
   const totalSize = chunks.reduce((acc, c) => acc + c.size, 0);
   const bloat = detectBloat(chunks, moduleToChunks, thresholds);
+  if (input.edges && input.edges.length > 0) {
+    bloat.push(
+      ...detectBarrelLeaks(
+        input.modules,
+        input.edges,
+        moduleToChunks,
+        chunks,
+        thresholds,
+        bloat.length,
+      ),
+    );
+  }
 
   return {
     format: input.stats.format,
@@ -140,6 +154,75 @@ function detectBloat(
   return out;
 }
 
+const BARREL_NAME_RE = /(^|\/)index\.[cm]?[jt]sx?$/u;
+
+// barrel-leak: a barrel (re-export hub `index.*`) pulls a large share of its
+// re-export targets into one chunk. Symptom of failed tree-shaking — importing the
+// barrel drags the whole directory into the bundle. A "graph × bundle" signal that
+// pure stats tools can't produce: targets come from the import graph, co-location
+// from the chunks.
+function detectBarrelLeaks(
+  modules: ModuleNode[],
+  edges: DependencyEdge[],
+  moduleToChunks: Record<ModuleId, string[]>,
+  chunks: BundleChunk[],
+  thresholds: BundleThresholds,
+  startSerial: number,
+): BundleBloat[] {
+  const out: BundleBloat[] = [];
+  let serial = startSerial;
+
+  const outgoing = new Map<ModuleId, Set<ModuleId>>();
+  for (const e of edges) {
+    if (e.kind === 'type-only') continue;
+    let bucket = outgoing.get(e.from);
+    if (!bucket) {
+      bucket = new Set();
+      outgoing.set(e.from, bucket);
+    }
+    bucket.add(e.to);
+  }
+
+  for (const b of modules) {
+    if (!BARREL_NAME_RE.test(b.id)) continue;
+    const bChunks = moduleToChunks[b.id];
+    if (!bChunks || bChunks.length === 0) continue;
+    const dir = b.id.slice(0, b.id.lastIndexOf('/') + 1);
+    // re-export targets in the barrel's subtree (a barrel almost always re-exports siblings)
+    const targets = [...(outgoing.get(b.id) ?? [])].filter((t) => t !== b.id && t.startsWith(dir));
+    if (targets.length < thresholds.barrelMinModules) continue;
+
+    const bChunkSet = new Set(bChunks);
+    const colocated = targets.filter((t) =>
+      (moduleToChunks[t] ?? []).some((c) => bChunkSet.has(c)),
+    );
+    const share = colocated.length / targets.length;
+    if (colocated.length < thresholds.barrelMinModules || share < thresholds.barrelLeakShare) {
+      continue;
+    }
+
+    const colocatedSet = new Set(colocated);
+    let sizeBytes = 0;
+    for (const c of chunks) {
+      if (!bChunkSet.has(c.id)) continue;
+      for (const m of c.modules)
+        if (m.moduleId && colocatedSet.has(m.moduleId)) sizeBytes += m.size;
+    }
+
+    out.push({
+      id: `bundle:barrel:${serial++}:${b.id}`,
+      kind: 'barrel-leak',
+      severity: colocated.length >= thresholds.barrelMinModules * 2 ? 'high' : 'medium',
+      message: `Barrel "${displayShortId(b.id)}" pulls ${colocated.length}/${targets.length} re-exported modules into the same chunk (tree-shaking leak)`,
+      modules: [b.id],
+      chunks: [...bChunkSet],
+      detail: { sizeBytes, moduleCount: colocated.length },
+    });
+  }
+
+  return out;
+}
+
 function formatBytes(bytes: number): string {
   if (bytes < 1024) return `${bytes} B`;
   if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;

package/src/analyzer/bundle/types.ts

@@ -29,7 +29,7 @@ export interface BundleChunkModule {
   size: number;
 }
 
-export type BundleBloatKind = 'duplicate' | 'heavy-chunk' | 'solo-hot';
+export type BundleBloatKind = 'duplicate' | 'heavy-chunk' | 'solo-hot' | 'barrel-leak';
 
 export interface BundleBloat {
   /** Stable id for grouping/diffing. */
@@ -47,6 +47,8 @@ export interface BundleBloat {
     sizeBytes?: number;
     chunkCount?: number;
     sharePercent?: number;
+    /** barrel-leak: number of the barrel's re-export targets that landed in the same chunk. */
+    moduleCount?: number;
   };
 }
 
@@ -70,12 +72,18 @@ export interface BundleThresholds {
   duplicateMinChunks: number;
   /** Module taking >= share of a heavy chunk triggers `solo-hot` (0..1). */
   soloHotShare: number;
+  /** Barrel re-exporting >= N same-tree modules is a `barrel-leak` candidate. */
+  barrelMinModules: number;
+  /** Share of a barrel's re-export targets co-located in its chunk to flag (0..1). */
+  barrelLeakShare: number;
 }
 
 export const DEFAULT_BUNDLE_THRESHOLDS: BundleThresholds = {
   heavyChunkBytes: 500_000,
   duplicateMinChunks: 2,
   soloHotShare: 0.8,
+  barrelMinModules: 8,
+  barrelLeakShare: 0.8,
 };
 
 /** Parsed-but-not-yet-analyzed stats. Produced by the format parsers. */

package/src/analyzer/incremental.ts

@@ -1,13 +1,12 @@
-// Инкрементальный пере-скан: на вход — предыдущий ScanResult и список
-// изменённых относительных путей. Если все изменения — это «pure modify»
-// существующих модулей со static-импортами, переразрешаем только их
-// outgoing-рёбра и пересчитываем downstream-метрики/циклы. Иначе fallback
-// на полный `analyze()`.
+// Incremental rescan: takes the previous ScanResult and a list of changed
+// relative paths. If every change is a "pure modify" of existing modules with
+// static imports, we only re-resolve their outgoing edges and recompute
+// downstream metrics/cycles. Otherwise we fall back to a full `analyze()`.
 //
-// Подход «простой вариант» из плана 15.2: оптимизация только для типичного
-// IDE-save сценария. Глоб/префикс-импорты, auto-import шаблонов, изменения
-// конфигов и добавление/удаление файлов перенаправляются в полный пайплайн —
-// корректность важнее скорости, а эти случаи редки на сохранении одного файла.
+// The "simple variant" from plan 15.2: optimize only the typical IDE-save
+// scenario. Glob/prefix imports, template auto-imports, config changes and
+// file add/remove are routed through the full pipeline - correctness matters
+// more than speed, and these cases are rare when saving a single file.
 
 import type { FileSource } from './fileSource';
 import type {
@@ -26,6 +25,7 @@ import { loadAliases } from './loadAliases';
 import { createResolver } from './resolve';
 import { createParserRegistry, isParseFailure } from './parsers';
 import { classifyKind, isInfra } from './classify';
+import { isNuxtComposablePath } from './buildGraph';
 import { classifyModuleRuntime, detectRscLeaks } from './rsc';
 import { detectCycles } from './cycles';
 import { computeMetrics } from './metrics';
@@ -148,6 +148,17 @@ export async function incrementalAnalyze(input: IncrementalAnalyzeInput): Promis
     if (result.templateRefs && result.templateRefs.length > 0) {
       return analyze(source, options);
     }
+    // Nuxt composable auto-import edges are built from the full file list
+    // (the composables/** registry crossed with consumer call identifiers) -
+    // like glob/templateRefs, they can only be safely recomputed by a cold scan.
+    if (prev.project.detectedFramework === 'nuxt') {
+      if (
+        isNuxtComposablePath(rel) ||
+        (result.callIdentifiers && result.callIdentifiers.length > 0)
+      ) {
+        return analyze(source, options);
+      }
+    }
     reparsed.set(rel, result);
   }
 
@@ -173,6 +184,12 @@ export async function incrementalAnalyze(input: IncrementalAnalyzeInput): Promis
         relPath: p.relPath,
         framework: prev.project.detectedFramework as Framework,
         ...(p.directives ? { directives: p.directives } : {}),
+        ...(p.imports.some((i) => i.specifier === 'server-only')
+          ? { importsServerOnly: true }
+          : {}),
+        ...(p.imports.some((i) => i.specifier === 'client-only')
+          ? { importsClientOnly: true }
+          : {}),
       }),
     });
   }

package/src/analyzer/index.ts

@@ -209,6 +209,7 @@ export async function analyze(
   const bundle = effectiveBundleStats
     ? analyzeBundle({
         modules,
+        edges,
         stats: effectiveBundleStats,
         ...(Object.keys(bundleThresholds).length > 0 ? { thresholds: bundleThresholds } : {}),
       })

package/src/analyzer/loadAliases.ts

@@ -1,7 +1,7 @@
-// Загрузка path-aliases из tsconfig (с цепочкой `extends`) и Vite-конфига.
-// Вынесено из `analyze()` для переиспользования в `incrementalAnalyze()` —
-// при пере-сканировании одного файла нам нужен тот же резолвер, что и при
-// полном анализе, иначе разрешение `@/*` сломается на ходу.
+// Loads path aliases from tsconfig (following the `extends` chain) and the
+// Vite config. Pulled out of `analyze()` so `incrementalAnalyze()` can reuse
+// it - a single-file rescan needs the same resolver as a full analysis,
+// otherwise `@/*` resolution breaks midway.
 
 import type { FileSource } from './fileSource';
 import type { ProjectRef } from './types';

package/src/analyzer/metrics.ts

@@ -1,5 +1,11 @@
 import type { Cycle, DependencyEdge, ModuleId, ModuleMetrics, ModuleNode } from './types';
 
+// Hotness premium for cycle membership: a module in an SCC is riskier than an
+// equally-coupled module outside one (changes ripple both ways). 1.5 = a modest
+// +50%: cycle membership lifts the score but does not override coupling itself.
+// Heuristic default, justified ordinally (cycle > non-cycle), not data-calibrated.
+const CYCLE_HOTNESS_MULTIPLIER = 1.5;
+
 export interface ComputeMetricsInput {
   modules: ModuleNode[];
   edges: DependencyEdge[];
@@ -56,8 +62,11 @@ export function computeMetrics(input: ComputeMetricsInput): Record<ModuleId, Mod
     const instability = sum === 0 ? 0 : fo / sum;
     const cycle = inCycle.has(id);
     const coupling = maxCoupling === 0 ? 0 : (rawCoupling.get(id) ?? 0) / maxCoupling;
+    // sizeFactor ∈ [1, 2]: size, log2-normalized against the largest file. log
+    // (not linear) so one giant file doesn't dominate; the upper bound of 2 caps
+    // the size contribution at a doubling.
     const sizeFactor = maxLoc === 0 ? 1 : 1 + Math.log2(1 + m.loc) / Math.log2(1 + maxLoc);
-    const hotness = coupling * (cycle ? 1.5 : 1) * sizeFactor;
+    const hotness = coupling * (cycle ? CYCLE_HOTNESS_MULTIPLIER : 1) * sizeFactor;
     result[id] = {
       fanIn: fi,
       fanOut: fo,

package/src/analyzer/parsers/svelteParser.ts

@@ -1,3 +1,8 @@
+// Beta: extracts script blocks with a regex, without svelte/compiler. Picks up
+// imports (static and dynamic) from `<script>` and `<script context="module">`;
+// the template and `$:` are not parsed (Svelte resolves components via script
+// imports anyway). First-class targets are Vue/React/Nuxt/Next; Svelte is
+// deliberately left short of full AST parsing.
 import type { ParsedFile } from '../types';
 import type { TsParser } from './tsParser';
 

package/src/analyzer/parsers/tsParser.ts

@@ -39,6 +39,7 @@ export function createTsParser(options: TsParserOptions = {}): TsParser {
 
       const imports: RawImport[] = [];
       const exports = new Set<string>();
+      const callees = new Set<string>();
       let hasDefineStore = false;
 
       visit(
@@ -46,6 +47,7 @@ export function createTsParser(options: TsParserOptions = {}): TsParser {
         sf,
         imports,
         exports,
+        callees,
         () => {
           hasDefineStore = true;
         },
@@ -62,6 +64,7 @@ export function createTsParser(options: TsParserOptions = {}): TsParser {
         exports: [...exports].sort(),
         hasDefineStore: hasDefineStore || /\bdefineStore\s*\(/.test(input.content),
         ...(directives.length > 0 ? { directives } : {}),
+        ...(callees.size > 0 ? { callIdentifiers: [...callees].sort() } : {}),
       };
     },
   };
@@ -78,9 +81,14 @@ function visit(
   sf: ts.SourceFile,
   imports: RawImport[],
   exports: Set<string>,
+  callees: Set<string>,
   markDefineStore: () => void,
   loaders: DynamicLoaderConfig[],
 ): void {
+  if (ts.isCallExpression(node) && ts.isIdentifier(node.expression)) {
+    callees.add(node.expression.text);
+  }
+
   if (ts.isImportDeclaration(node)) {
     const spec = literalText(node.moduleSpecifier);
     if (spec !== null) {
@@ -208,7 +216,9 @@ function visit(
     exports.add('default');
   }
 
-  ts.forEachChild(node, (child) => visit(child, sf, imports, exports, markDefineStore, loaders));
+  ts.forEachChild(node, (child) =>
+    visit(child, sf, imports, exports, callees, markDefineStore, loaders),
+  );
 }
 
 function literalText(node: ts.Node): string | null {

package/src/analyzer/recommendations.ts

@@ -271,8 +271,9 @@ export function computeRecommendations(inputs: {
           // Round to 2 decimals so i18n templates render `0.83` not `0.8333…`.
           score: Math.round(c.score * 100) / 100,
         },
-        // 0.5 .. 0.85 — same band as misplaced-by-layer / cycle-break candidates.
-        weight: 0.5 + Math.min(0.35, c.score * 0.4),
+        // 0.5 .. 0.9 — driven by risk (strength + evidence + hidden + cross-boundary),
+        // so a cross-boundary missing-abstraction outranks a same-folder pair.
+        weight: 0.5 + Math.min(0.4, c.risk * 0.45),
       });
     }
   }
@@ -393,12 +394,21 @@ function bundleParams(b: BundleBloat): Recommendation['params'] {
   if (b.detail?.sizeBytes !== undefined) p['sizeBytes'] = b.detail.sizeBytes;
   if (b.detail?.chunkCount !== undefined) p['chunkCount'] = b.detail.chunkCount;
   if (b.detail?.sharePercent !== undefined) p['sharePercent'] = b.detail.sharePercent;
+  if (b.detail?.moduleCount !== undefined) p['moduleCount'] = b.detail.moduleCount;
   return p;
 }
 
 function bundleWeight(b: BundleBloat): number {
   // duplicates feel more actionable than just-large chunks; weight them up.
-  const base = b.kind === 'duplicate' ? 0.85 : b.kind === 'heavy-chunk' ? 0.7 : 0.6;
+  // barrel-leak is a concrete, fixable tree-shaking miss - rank near duplicates.
+  const base =
+    b.kind === 'duplicate'
+      ? 0.85
+      : b.kind === 'barrel-leak'
+        ? 0.8
+        : b.kind === 'heavy-chunk'
+          ? 0.7
+          : 0.6;
   const bump = b.severity === 'high' ? 0.1 : b.severity === 'medium' ? 0.05 : 0;
   return Math.min(0.95, base + bump);
 }

package/src/analyzer/resolve.ts

@@ -199,6 +199,25 @@ export interface Resolver {
 
 export function createResolver(source: FileSource, config: ResolverConfig): Resolver {
   const cache = new Map<string, string | null>();
+  // Resolve an alias whose target is itself an alias (alias→alias chain).
+  // `visited` guards against cyclic aliases (@x→@y→@x).
+  const resolveAliased = async (spec: string, visited: Set<string>): Promise<string | null> => {
+    if (visited.has(spec)) return null;
+    visited.add(spec);
+    const aliased = applyAlias(spec, config.aliases);
+    if (aliased.length === 0) return null;
+    for (const candidate of aliased) {
+      const found = await tryFile(source, candidate);
+      if (found) return found;
+    }
+    for (const candidate of aliased) {
+      if (isBare(candidate) && hasAliasCandidate(candidate, config.aliases)) {
+        const chained = await resolveAliased(candidate, visited);
+        if (chained) return chained;
+      }
+    }
+    return null;
+  };
   return {
     hasLocalCandidate(specifier): boolean {
       return hasAliasCandidate(specifier, config.aliases);
@@ -207,20 +226,9 @@ export function createResolver(source: FileSource, config: ResolverConfig): Reso
       const cacheKey = `${fromRel}\u0001${specifier}`;
       if (cache.has(cacheKey)) return cache.get(cacheKey) ?? null;
       if (isBare(specifier)) {
-        const aliased = applyAlias(specifier, config.aliases);
-        if (aliased.length === 0) {
-          cache.set(cacheKey, null);
-          return null;
-        }
-        for (const candidate of aliased) {
-          const found = await tryFile(source, candidate);
-          if (found) {
-            cache.set(cacheKey, found);
-            return found;
-          }
-        }
-        cache.set(cacheKey, null);
-        return null;
+        const found = await resolveAliased(specifier, new Set());
+        cache.set(cacheKey, found);
+        return found;
       }
 
       const fromDir = posixDirname(fromRel);