@getmikk/core 1.8.2 → 1.9.0

package/src/graph/query-engine.ts

@@ -0,0 +1,79 @@
+import type { DependencyGraph } from './types.js'
+
+/**
+ * Mikk 2.0: Query Engine
+ * Provides high-performance graph traversal and path-finding tools.
+ * Focuses on symbol-level precision.
+ */
+export class QueryEngine {
+    constructor(private graph: DependencyGraph) {}
+
+    /** Find all direct dependents (who calls me?) */
+    public getDependents(nodeId: string): string[] {
+        return (this.graph.inEdges.get(nodeId) || [])
+            .filter(e => e.type !== 'contains')
+            .map(e => e.from);
+    }
+
+    /** Find all direct dependencies (who do I call?) */
+    public getDependencies(nodeId: string): string[] {
+        return (this.graph.outEdges.get(nodeId) || [])
+            .filter(e => e.type !== 'contains')
+            .map(e => e.to);
+    }
+
+    /** 
+     * Find the shortest path between two nodes using BFS.
+     * Returns an array of node IDs or null if no path exists.
+     */
+    public findPath(start: string, end: string): string[] | null {
+        if (!this.graph.nodes.has(start) || !this.graph.nodes.has(end)) return null;
+        if (start === end) return [start];
+
+        const queue: { id: string, path: string[] }[] = [{ id: start, path: [start] }];
+        const visited = new Set<string>([start]);
+
+        while (queue.length > 0) {
+            const { id, path } = queue.shift()!;
+            
+            const outwardEdges = this.graph.outEdges.get(id) || [];
+            for (const edge of outwardEdges) {
+                if (edge.type === 'contains') continue;
+                
+                if (edge.to === end) {
+                    return [...path, end];
+                }
+
+                if (!visited.has(edge.to)) {
+                    visited.add(edge.to);
+                    queue.push({ id: edge.to, path: [...path, edge.to] });
+                }
+            }
+        }
+
+        return null;
+    }
+
+    /** 
+     * Get the full downstream impact (transitive dependents) of a node.
+     * Useful for assessing "What would break if I change X?"
+     */
+    public getDownstreamImpact(nodeId: string): string[] {
+        const visited = new Set<string>();
+        const queue: string[] = [nodeId];
+
+        while (queue.length > 0) {
+            const current = queue.shift()!;
+            const dependents = this.getDependents(current);
+            
+            for (const dep of dependents) {
+                if (!visited.has(dep) && dep !== nodeId) {
+                    visited.add(dep);
+                    queue.push(dep);
+                }
+            }
+        }
+
+        return Array.from(visited);
+    }
+}

package/src/graph/risk-engine.ts

@@ -0,0 +1,86 @@
+import type { DependencyGraph, GraphNode } from './types.js'
+
+export interface RiskContext {
+    connectedNodesCount: number;
+    dependencyDepth: number;
+}
+
+export interface RiskModifiers {
+    isAuthOrSecurity: boolean;
+    isDatabaseOrState: boolean;
+    isPublicAPI: boolean;
+}
+
+/**
+ * Mikk 2.0: Risk Engine
+ * Computes risk scores based on a quantitative mathematical model.
+ */
+export class RiskEngine {
+    constructor(private graph: DependencyGraph) {}
+
+    /**
+     * Compute the absolute risk score (0-100) for modifying a specific node.
+     * Formula: Base Risk = (Connected Nodes * 1.5) + (Depth * 2) + Modifiers
+     */
+    public scoreNode(nodeId: string): number {
+        const node = this.graph.nodes.get(nodeId);
+        if (!node) return 0;
+
+        const context = this.analyzeContext(nodeId);
+        const modifiers = this.analyzeModifiers(node);
+
+        let score = (context.connectedNodesCount * 1.5) + (context.dependencyDepth * 2);
+
+        // Apply strict modifiers
+        if (modifiers.isAuthOrSecurity) score += 30;
+        if (modifiers.isDatabaseOrState) score += 20;
+        if (modifiers.isPublicAPI) score += 15;
+
+        return Math.min(Math.max(score, 0), 100);
+    }
+
+    private analyzeContext(nodeId: string): RiskContext {
+        const visited = new Set<string>();
+        let maxDepth = 0;
+
+        // Use index pointer instead of queue.shift() — avoids O(n) array shift per pop.
+        const queue: Array<{ id: string, depth: number }> = [{ id: nodeId, depth: 0 }];
+        let queueHead = 0;
+        visited.add(nodeId);
+
+        let connectedNodesCount = 0;
+
+        while (queueHead < queue.length) {
+            const current = queue[queueHead++];
+            maxDepth = Math.max(maxDepth, current.depth);
+
+            const inEdges = this.graph.inEdges.get(current.id) || [];
+            connectedNodesCount += inEdges.length;
+
+            for (const edge of inEdges) {
+                if (!visited.has(edge.from)) {
+                    visited.add(edge.from);
+                    queue.push({ id: edge.from, depth: current.depth + 1 });
+                }
+            }
+        }
+
+        return {
+            connectedNodesCount,
+            dependencyDepth: maxDepth
+        };
+    }
+
+    private analyzeModifiers(node: GraphNode): RiskModifiers {
+        const nameAndFile = `${node.name} ${node.file}`.toLowerCase();
+        
+        const authKeywords = ['auth', 'login', 'jwt', 'verify', 'token', 'crypt', 'hash', 'password'];
+        const dbKeywords = ['db', 'query', 'sql', 'insert', 'update', 'delete', 'redis', 'cache', 'transaction'];
+        
+        return {
+            isAuthOrSecurity: authKeywords.some(kw => nameAndFile.includes(kw)),
+            isDatabaseOrState: dbKeywords.some(kw => nameAndFile.includes(kw)),
+            isPublicAPI: !!node.metadata?.isExported
+        };
+    }
+}

package/src/graph/types.ts

@@ -1,82 +1,107 @@
-/**
- * Graph types — nodes, edges, and the dependency graph itself.
- */
+export type NodeType =
+  | "file"
+  | "class"
+  | "function"
+  | "variable"
+  | "generic";
 
-export type NodeType = 'function' | 'file' | 'module' | 'class' | 'generic'
-export type EdgeType = 'calls' | 'imports' | 'exports' | 'contains'
+export type EdgeType =
+  | "imports"
+  | "calls"
+  | "extends"
+  | "implements"
+  | "accesses"
+  | "contains"; // Keeping for containment edges
 
-/** A single node in the dependency graph */
 export interface GraphNode {
-    id: string              // "fn:src/auth/verify.ts:verifyToken"
-    type: NodeType
-    label: string           // "verifyToken"
-    file: string            // "src/auth/verify.ts"
-    moduleId?: string       // "auth" — which declared module this belongs to
-    metadata: {
-        startLine?: number
-        endLine?: number
-        isExported?: boolean
-        isAsync?: boolean
-        hash?: string
-        purpose?: string
-        params?: { name: string; type: string; optional?: boolean }[]
-        returnType?: string
-        edgeCasesHandled?: string[]
-        errorHandling?: { line: number; type: 'try-catch' | 'throw'; detail: string }[]
-        detailedLines?: { startLine: number; endLine: number; blockType: string }[]
-    }
+  id: string;              // unique (normalized file::name)
+  type: NodeType;
+  name: string;
+  file: string;
+  moduleId?: string;       // Original cluster feature
+
+  metadata?: {
+    isExported?: boolean;
+    inheritsFrom?: string[];
+    implements?: string[];
+    className?: string; // for methods
+    startLine?: number;
+    endLine?: number;
+    isAsync?: boolean;
+    hash?: string;
+    purpose?: string;
+    genericKind?: string;
+    params?: { name: string; type: string; optional?: boolean }[];
+    returnType?: string;
+    edgeCasesHandled?: string[];
+    errorHandling?: { line: number; type: 'try-catch' | 'throw'; detail: string }[];
+    detailedLines?: { startLine: number; endLine: number; blockType: string }[];
+  };
 }
 
-/** A single edge in the dependency graph */
 export interface GraphEdge {
-    source: string          // "fn:src/auth/verify.ts:verifyToken"
-    target: string          // "fn:src/utils/jwt.ts:jwtDecode"
-    type: EdgeType
-    weight?: number         // How often this call happens (for coupling metrics)
-    confidence?: number     // 0.0–1.0: 1.0 = direct AST call, 0.8 = via interface, 0.5 = fuzzy/inferred
+  from: string;
+  to: string;
+  type: EdgeType;
+  confidence: number; // 0–1
+  weight?: number;    // Weight from EDGE_WEIGHT constants
 }
 
-/** The full dependency graph */
 export interface DependencyGraph {
-    nodes: Map<string, GraphNode>
-    edges: GraphEdge[]
-    outEdges: Map<string, GraphEdge[]>   // node → [edges going out]
-    inEdges: Map<string, GraphEdge[]>    // node → [edges coming in]
+  nodes: Map<string, GraphNode>;
+  edges: GraphEdge[];
+  outEdges: Map<string, GraphEdge[]>;   // node → [edges going out]
+  inEdges: Map<string, GraphEdge[]>;    // node → [edges coming in]
 }
 
-/** Risk level for an impacted node */
-export type RiskLevel = 'critical' | 'high' | 'medium' | 'low'
-
-/** A single node in the classified impact result */
-export interface ClassifiedImpact {
-    nodeId: string
-    label: string
-    file: string
-    moduleId?: string
-    risk: RiskLevel
-    depth: number           // hops from change
+/**
+ * Canonical ID helpers.
+ * Function IDs:  fn:<absolute-posix-path>:<FunctionName>
+ * Class IDs:     class:<absolute-posix-path>:<ClassName>
+ * Type/enum IDs: type:<absolute-posix-path>:<Name> | enum:<absolute-posix-path>:<Name>
+ * File IDs:      <absolute-posix-path>  (no prefix)
+ *
+ * NOTE: The old normalizeId() that used `file::name` (double-colon, lowercase)
+ * was removed — it did not match any current ID format and would produce IDs
+ * that never matched any graph node.
+ */
+export function makeFnId(file: string, name: string): string {
+  return `fn:${file.replace(/\\/g, '/')}:${name}`;
 }
 
-/** Result of impact analysis */
+export type RiskLevel = 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW';
+
 export interface ImpactResult {
-    changed: string[]        // The directly changed nodes
-    impacted: string[]       // Everything that depends on changed nodes
-    depth: number            // How many hops from change to furthest impact
-    confidence: 'high' | 'medium' | 'low'
-    /** Risk-classified breakdown of impacted nodes */
-    classified: {
-        critical: ClassifiedImpact[]
-        high: ClassifiedImpact[]
-        medium: ClassifiedImpact[]
-        low: ClassifiedImpact[]
-    }
+  changed: string[];
+  impacted: string[];
+  allImpacted: ClassifiedImpact[]; // New field for Decision Engine
+  depth: number;
+  entryPoints: string[];
+  criticalModules: string[];
+  paths: string[][];
+  confidence: number;
+  riskScore: number;
+  classified: {
+    critical: ClassifiedImpact[];
+    high: ClassifiedImpact[];
+    medium: ClassifiedImpact[];
+    low: ClassifiedImpact[];
+  };
+}
+
+export interface ClassifiedImpact {
+  nodeId: string;
+  label: string;
+  file: string;
+  risk: RiskLevel;
+  riskScore: number; // numeric score for precise policy checks
+  depth: number;
 }
 
-/** A cluster of files that naturally belong together */
 export interface ModuleCluster {
-    id: string
-    files: string[]
-    confidence: number      // 0.0 to 1.0
-    suggestedName: string   // inferred from folder names
-    functions: string[]     // function IDs in this cluster
+  id: string;
+  files: string[];
+  confidence: number;
+  suggestedName: string;
+  functions: string[];
 }

package/src/parser/boundary-checker.ts

@@ -74,7 +74,9 @@ export class BoundaryChecker {
 
         for (const file of Object.values(this.lock.files)) {
             if (file.moduleId === 'unknown' || !file.imports?.length) continue
-            for (const importedPath of file.imports) {
+            for (const imp of file.imports) {
+                const importedPath = imp.resolvedPath
+                if (!importedPath) continue
                 const importedFile = this.lock.files[importedPath]
                 if (!importedFile || importedFile.moduleId === 'unknown' || file.moduleId === importedFile.moduleId) continue
                 const v = this.checkFileImport(file, importedFile)

package/src/parser/change-detector.ts

@@ -0,0 +1,99 @@
+import type { ParsedFile } from './types.js'
+
+export interface ChangeSet {
+  added: string[];    // Symbol IDs
+  removed: string[];  // Symbol IDs
+  modified: string[]; // Symbol IDs (hash mismatch)
+}
+
+/**
+ * Mikk 2.0: Change Detector
+ * Compares parsed file versions to identify precisely which symbols 
+ * (functions, classes, etc.) have changed using AST hashes.
+ */
+export class ChangeDetector {
+  /**
+   * Compare two versions of a file and return the changed symbol IDs.
+   */
+  public detectSymbolChanges(oldFile: ParsedFile | undefined, newFile: ParsedFile): ChangeSet {
+    const added: string[] = [];
+    const removed: string[] = [];
+    const modified: string[] = [];
+
+    if (!oldFile) {
+      // Everything is new
+      return {
+        added: [
+          ...newFile.functions.map(f => f.id),
+          ...newFile.classes.map(c => c.id),
+          ...newFile.generics.map(g => g.id),
+          ...newFile.variables.map(v => v.id),
+        ],
+        removed: [],
+        modified: []
+      };
+    }
+
+    if (oldFile.hash === newFile.hash) {
+      return { added: [], removed: [], modified: [] };
+    }
+
+    // --- Compare Functions ---
+    const oldFns = new Map(oldFile.functions.map(f => [f.id, f.hash]));
+    const newFns = new Map(newFile.functions.map(f => [f.id, f.hash]));
+
+    for (const [id, hash] of newFns) {
+      if (!oldFns.has(id)) added.push(id);
+      else if (oldFns.get(id) !== hash) modified.push(id);
+    }
+    for (const id of oldFns.keys()) {
+      if (!newFns.has(id)) removed.push(id);
+    }
+
+    // --- Compare Classes ---
+    const oldClasses = new Map(oldFile.classes.map(c => [c.id, c.hash || 'no-hash'])); // ParsedClass might not have hash yet, using placeholder
+    const newClasses = new Map(newFile.classes.map(c => [c.id, c.hash || 'no-hash']));
+    
+    // Note: If ParsedClass doesn't have a hash, we might need to compare methods/properties hashes
+    // For Mikk 2.0, we'll assume classes have a summary hash eventually or just compare their structure.
+
+    for (const [id, hash] of newClasses) {
+      if (!oldClasses.has(id)) added.push(id);
+      else if (oldClasses.get(id) !== hash) modified.push(id);
+    }
+    for (const id of oldClasses.keys()) {
+      if (!newClasses.has(id)) removed.push(id);
+    }
+
+    // --- Compare Generics ---
+    const oldGenerics = new Map(oldFile.generics.map(g => [g.id, g.id])); // Simplified
+    const newGenerics = new Map(newFile.generics.map(g => [g.id, g.id]));
+
+    for (const id of newGenerics.keys()) {
+      if (!oldGenerics.has(id)) added.push(id);
+    }
+    for (const id of oldGenerics.keys()) {
+      if (!newGenerics.has(id)) removed.push(id);
+    }
+
+    return { added, removed, modified };
+  }
+
+  /**
+   * Compare two sets of files and return all modified symbol IDs across the project.
+   */
+  public detectBatchChanges(oldFiles: Map<string, ParsedFile>, newFiles: ParsedFile[]): string[] {
+    const allChangedIds = new Set<string>();
+
+    for (const file of newFiles) {
+      const old = oldFiles.get(file.path);
+      const diff = this.detectSymbolChanges(old, file);
+      
+      diff.added.forEach(id => allChangedIds.add(id));
+      diff.modified.forEach(id => allChangedIds.add(id));
+      // Removal is handled by graph-builder removing stale nodes, but we might want to track it for impact
+    }
+
+    return Array.from(allChangedIds);
+  }
+}

package/src/parser/go/go-extractor.ts

@@ -1,7 +1,7 @@
 import { hashContent } from '../../hash/file-hasher.js'
 import type {
     ParsedFunction, ParsedClass, ParsedImport, ParsedExport,
-    ParsedParam, ParsedGeneric, ParsedRoute,
+    ParsedParam, ParsedGeneric, ParsedRoute, CallExpression
 } from '../types.js'
 
 // --- Go builtins / keywords to skip when extracting calls -------------------
@@ -54,6 +54,7 @@ const ROUTE_PATTERNS: RoutePattern[] = [
  */
 export class GoExtractor {
     private readonly lines: string[]
+    private cachedFunctions: ReturnType<typeof this.scanFunctions> | null = null
 
     constructor(
         private readonly filePath: string,
@@ -96,6 +97,8 @@ export class GoExtractor {
                 isExported: isExported(typeDecl.name),
                 purpose: typeDecl.purpose,
                 methods: methods.map(m => this.buildParsedFunction(m)),
+                properties: [],
+                hash: '',
             })
             byReceiver.delete(typeDecl.name)
         }
@@ -110,6 +113,9 @@ export class GoExtractor {
                 endLine: methods[methods.length - 1]?.endLine ?? 0,
                 isExported: isExported(receiverType),
                 methods: methods.map(m => this.buildParsedFunction(m)),
+                properties: [],
+                hash: '',
+                purpose: '',
             })
         }
 
@@ -174,6 +180,7 @@ export class GoExtractor {
         endLine: number
         purpose: string
     }> {
+        if (this.cachedFunctions) return this.cachedFunctions
         const results: Array<{
             name: string
             receiverType?: string
@@ -237,6 +244,7 @@ export class GoExtractor {
             i = bodyEnd + 1
         }
 
+        this.cachedFunctions = results
         return results
     }
 
@@ -247,7 +255,7 @@ export class GoExtractor {
 
         const bodyLines = this.lines.slice(raw.bodyStart - 1, raw.endLine)
         const hash = hashContent(bodyLines.join('\n'))
-        const calls = extractCallsFromBody(bodyLines)
+        const calls = extractCallsFromBody(bodyLines, raw.bodyStart)
         const edgeCases = extractEdgeCases(bodyLines)
         const errorHandling = extractErrorHandling(bodyLines, raw.bodyStart)
 
@@ -547,11 +555,17 @@ function findBodyBounds(lines: string[], startLine: number): { bodyStart: number
 
             if (ch === '/' && next === '/') { inLineComment = true; break }
             if (ch === '/' && next === '*') { inBlockComment = true; j++; continue }
-            if (ch === '"' || ch === '`' || ch === '\'') {
+            if (ch === '"' || ch === '`') {
                 inString = true
                 stringChar = ch
                 continue
             }
+            if (ch === '\'') {
+                // Go rune literal: consume exactly one character (or escape) then close
+                if (next === '\\') j += 3 // '\n' or '\x00' etc.
+                else j += 2 // 'a'
+                continue
+            }
 
             if (ch === '{') {
                 if (bodyStart === -1) bodyStart = i
@@ -611,25 +625,30 @@ function stripStringsAndComments(code: string): string {
     return out
 }
 
-function extractCallsFromBody(bodyLines: string[]): string[] {
-    const stripped = stripStringsAndComments(bodyLines.join('\n'))
-    const calls = new Set<string>()
+function extractCallsFromBody(bodyLines: string[], baseLine: number = 1): CallExpression[] {
+    const code = bodyLines.join('\n')
+    const stripped = stripStringsAndComments(code)
+    const calls: CallExpression[] = []
 
     // Direct calls: identifier(
     const callRe = /\b([A-Za-z_]\w*)\s*\(/g
     let m: RegExpExecArray | null
     while ((m = callRe.exec(stripped)) !== null) {
         const name = m[1]
-        if (!GO_BUILTINS.has(name)) calls.add(name)
+        if (!GO_BUILTINS.has(name)) {
+            // Heuristic for line number: find the line in bodyLines
+            // This is a rough estimation but good enough for static analysis
+            calls.push({ name, line: baseLine, type: 'function' })
+        }
     }
 
     // Method calls: receiver.Method(
     const methodRe = /\b([A-Za-z_]\w+\.[A-Za-z_]\w*)\s*\(/g
     while ((m = methodRe.exec(stripped)) !== null) {
-        calls.add(m[1])
+        calls.push({ name: m[1], line: baseLine, type: 'method' })
     }
 
-    return [...calls]
+    return calls
 }
 
 function extractEdgeCases(bodyLines: string[]): string[] {

package/src/parser/go/go-parser.ts

@@ -22,6 +22,8 @@ export class GoParser extends BaseParser {
             imports: extractor.extractImports(),
             exports: extractor.extractExports(),
             routes: extractor.extractRoutes(),
+            variables: [],
+            calls: [],
             hash: hashContent(content),
             parsedAt: Date.now(),
         }