code-auditor-mcp 4.1.0 → 5.0.1

package/dist/phase/rules/dry.js

@@ -0,0 +1,803 @@
+/**
+ * Spec 68 §3.2 — the DRY rules, migrated to `analyze(ctx)`.
+ *
+ * `duplicate-import` re-homes `UniversalDRYAnalyzer.checkDuplicateImports`:
+ * group the `imports` fact by `(file, source)` and flag any source imported more
+ * than once within a single file, anchored at the first import's location. The
+ * legacy detector ran per AST, so the `(file, …)` grouping is load-bearing — two
+ * files importing the same module once are not duplicates. The message and the
+ * first-import anchoring are verbatim from `checkDuplicateImports`; `symbol`
+ * carries the module source exactly as the legacy `createViolation` set
+ * `functionName` to it.
+ *
+ * `duplicate-string-literal` re-homes `checkDuplicateStrings`: group the
+ * `string-literals` fact by `(file, value)` and flag any raw string text that
+ * appears more than twice within a single file, anchored at the first
+ * occurrence. The same per-file grouping holds here (the legacy detector ran
+ * per AST), and `value` is the raw `getNodeText` (quotes included) so a
+ * `'…'` and `"…"` literal are distinct values — the same key the legacy code
+ * compared.
+ *
+ * The three block rules (`dry/duplicate`, `dry/structural-similarity`,
+ * `dry/similar-expression`) read the `code-block` fact — blocks and shape
+ * fragments the `codeBlocks.ts` producer extracted from the AST. They re-home
+ * `reportExactDuplicates` / `reportStructuralDuplicates` /
+ * `reportExpressionSimilarities` over the projected data. The legacy
+ * `analyzeAST` ran **once per file**, so each rule partitions the corpus fact by
+ * `file` and runs its filter → dedupe → compare within one file (a block in file
+ * A is never compared against a block in file B).
+ *
+ * `dry/diverging-clone` is the cross-run pair-tracking pass (Spec 13 R5): it
+ * reads the `clone-pair-history` fact — the `dry_pair_history` similarity series
+ * the DRY bundle seeds each run — and flags a pair whose similarity has fallen by
+ * `divergenceThreshold` for `divergenceRuns` consecutive runs. It re-homes the
+ * legacy auditRunner Phase 2 divergence pass verbatim, over the grouped fact.
+ */
+import { RULE_REGISTRY } from '../../analyzers/ruleRegistry.js';
+import * as crypto from 'crypto';
+const META = RULE_REGISTRY['duplicate-import'];
+const STRING_META = RULE_REGISTRY['duplicate-string-literal'];
+const DUP_META = RULE_REGISTRY['dry/duplicate'];
+const STRUCT_META = RULE_REGISTRY['dry/structural-similarity'];
+const EXPR_META = RULE_REGISTRY['dry/similar-expression'];
+const DIVERGING_META = RULE_REGISTRY['dry/diverging-clone'];
+/** Re-homes `checkDuplicateImports`, grouping per file. */
+function detectDuplicateImport(facts) {
+    const byFile = new Map();
+    for (const imp of facts) {
+        // The `imports` fact is shared with the Go `import-organization`/`import-style`
+        // rules (a mixed corpus concatenates both producers' output). This rule is
+        // TS/JS-only: the Go producer always sets `alias` (null for an unnamed
+        // import), the TS producer leaves it absent, so `alias !== undefined` marks
+        // a Go import and it is skipped here.
+        if (imp.alias !== undefined)
+            continue;
+        let fileMap = byFile.get(imp.file);
+        if (!fileMap) {
+            fileMap = new Map();
+            byFile.set(imp.file, fileMap);
+        }
+        const locs = fileMap.get(imp.source) ?? [];
+        locs.push({ line: imp.line, column: imp.column });
+        fileMap.set(imp.source, locs);
+    }
+    const findings = [];
+    for (const [file, fileMap] of byFile) {
+        for (const [source, locs] of fileMap) {
+            if (locs.length <= 1)
+                continue;
+            findings.push({
+                ruleId: 'duplicate-import',
+                severity: 'high',
+                message: `Module "${source}" is imported ${locs.length} times`,
+                file,
+                line: locs[0].line,
+                column: locs[0].column,
+                symbol: source,
+            });
+        }
+    }
+    return findings;
+}
+/**
+ * A single identifier-like token is code *vocabulary*, not a duplicated *value*:
+ * `'typescript'`, `'function_declaration'`, `'conventions/usage-pair'`,
+ * `'margin-top'` name concepts in the code's own vocabulary (a format name, a
+ * tree-sitter node type, a rule id, a CSS property) and are correct to repeat
+ * inline — extracting them to a constant adds indirection, not clarity. A magic
+ * string worth naming is a value with *content*: whitespace (a message, a query,
+ * a sentence) or punctuation outside the slug set (an email, a URL, a format
+ * string). This is the precision boundary the legacy `checkDuplicateStrings`
+ * lacked — it flagged any repeated string, so a code-analysis tool's own source
+ * (full of node-type and fact-name literals) read as hundreds of false positives.
+ */
+const VOCABULARY_TOKEN = /^[A-Za-z_$][A-Za-z0-9_$./:-]*$/;
+/** A relative module specifier (`'./x.js'`, `'../x.js'`) names a file, not a value. */
+const RELATIVE_MODULE = /^\.\.?\//;
+/** A CLI flag/option spec (`--overwrite`, `-p, --path <path>`, `--limit <n>`):
+ *  the commander `.option()` signature string, repeated verbatim across the
+ *  option definition, help text and docs. A flag *name* (with an optional
+ *  `<arg>`/`[arg]` placeholder), not a duplicated value — extracting it to a
+ *  constant adds indirection, not clarity (the same rationale as a vocabulary
+ *  token). */
+const CLI_OPTION = /^--?[A-Za-z][\w-]*(?:, --?[A-Za-z][\w-]*)*(?:\s+<[^>]+>|\s+\[[^\]]+\])*$/;
+/** A decorative separator — a run of box-drawing/punctuation with no alphanumeric
+ *  content (`════…`, `──…`). Pure presentation, never a value worth extracting. */
+const SEPARATOR_ONLY = /^[^A-Za-z0-9]*$/;
+/** A dotted/versioned name or IP literal (`.codeauditor.json`, `127.0.0.1`,
+ *  `v1.2.3`): an identifier-like token whose first character is a digit or dot
+ *  rather than a letter, so `VOCABULARY_TOKEN` (which starts `[A-Za-z_$]`) misses
+ *  it. A filename or constant address is a *name*, not a duplicated value. */
+const DOTTED_NAME = /^\.?[A-Za-z0-9_$][A-Za-z0-9_$./:-]*$/;
+/** True when a quoted literal is a *name*, not a duplicated value: a single
+ *  identifier-like token (vocabulary), a relative module path, a CLI flag spec,
+ *  a decorative separator, or a dotted filename/IP. */
+function isNameLiteral(value) {
+    const inner = value.replace(/^['"`]/, '').replace(/['"`]$/, '');
+    return VOCABULARY_TOKEN.test(inner)
+        || RELATIVE_MODULE.test(inner)
+        || CLI_OPTION.test(inner)
+        || SEPARATOR_ONLY.test(inner)
+        || DOTTED_NAME.test(inner);
+}
+/** Re-homes `checkDuplicateStrings`, grouping per `(file, value)`. */
+function detectDuplicateStringLiteral(facts) {
+    const byFile = new Map();
+    for (const lit of facts) {
+        if (lit.value.length <= 10)
+            continue; // non-trivial strings only
+        if (isNameLiteral(lit.value))
+            continue; // a name (vocabulary/path), not a value
+        let fileMap = byFile.get(lit.file);
+        if (!fileMap) {
+            fileMap = new Map();
+            byFile.set(lit.file, fileMap);
+        }
+        const locs = fileMap.get(lit.value) ?? [];
+        locs.push({ line: lit.line, column: lit.column });
+        fileMap.set(lit.value, locs);
+    }
+    const findings = [];
+    for (const [file, fileMap] of byFile) {
+        for (const [value, locs] of fileMap) {
+            if (locs.length <= 2)
+                continue; // more than 2 occurrences
+            findings.push({
+                ruleId: 'duplicate-string-literal',
+                severity: 'high',
+                message: `String literal "${value.substring(0, 30)}..." is duplicated ${locs.length} times`,
+                file,
+                line: locs[0].line,
+                column: locs[0].column,
+                symbol: value.substring(0, 50),
+                fix: { oldText: value, newText: '// Consider extracting to a constant' },
+            });
+        }
+    }
+    return findings;
+}
+/**
+ * The defaults re-declared from `DEFAULT_DRY_CONFIG` (UniversalDRYAnalyzer.ts) —
+ * the same merge the legacy `analyzeAST` did before extraction. `excludePatterns`
+ * is verbatim (the test/spec/tests-dir globs). The `checkStructuralSimilarity` /
+ * `checkExpressionSimilarity` booleans are no longer read as gates (§10 — config
+ * tunes, never selects); they remain in the merged shape only for config-surface
+ * compatibility until the §15 deletions drop them.
+ */
+const DRY_BLOCK_DEFAULTS = {
+    minLineThreshold: 15,
+    similarityThreshold: 0.85,
+    excludePatterns: [
+        '**/*.test.ts', '**/*.spec.ts',
+        '**/*.test.tsx', '**/*.spec.tsx',
+        '**/*.test.js', '**/*.spec.js',
+        '**/*.test.jsx', '**/*.spec.jsx',
+        '**/test/**', '**/tests/**',
+    ],
+    checkStructuralSimilarity: false,
+    checkExpressionSimilarity: true,
+    minShapeNames: 4,
+};
+/** Merge the (default-merged) thresholds onto the block defaults. */
+export function resolveBlockConfig(t) {
+    return { ...DRY_BLOCK_DEFAULTS, ...t };
+}
+/** True if the two blocks share code spans (same file + overlapping lines). */
+function spansOverlap(a, b) {
+    if (a.file !== b.file)
+        return false;
+    return !(a.end.line < b.start.line || b.end.line < a.start.line);
+}
+/** Sort comparator: earliest file+line first. */
+function byFileAndLine(a, b) {
+    if (a.file !== b.file)
+        return a.file.localeCompare(b.file);
+    return a.start.line - b.start.line;
+}
+/**
+ * Deduplicate overlapping blocks (re-homed verbatim): prefer the innermost block
+ * when one fully contains another, the earliest when only partially overlapping.
+ */
+function deduplicateBlocks(blocks) {
+    if (blocks.length <= 1)
+        return blocks;
+    const sorted = [...blocks].sort(byFileAndLine);
+    const result = [];
+    let last = null;
+    for (const block of sorted) {
+        if (last && last.file === block.file) {
+            if (last.start.line <= block.start.line && last.end.line >= block.end.line) {
+                result.pop();
+                result.push(block);
+                last = block;
+                continue;
+            }
+            if (block.start.line <= last.start.line && block.end.line >= last.end.line) {
+                continue;
+            }
+            if (!(last.end.line < block.start.line)) {
+                continue;
+            }
+        }
+        result.push(block);
+        last = block;
+    }
+    return result;
+}
+/** Overlapping bigrams of a token sequence — an order-aware fingerprint.  A
+ *  sequence shorter than two tokens yields no bigrams (similarity 0). */
+function tokenBigrams(tokens) {
+    const out = [];
+    for (let i = 0; i + 1 < tokens.length; i++) {
+        out.push(tokens[i] + '' + tokens[i + 1]);
+    }
+    return out;
+}
+/** Jaccard similarity over the token *bigrams* of two whitespace-tokenized
+ *  strings, [0, 1].  Bigrams are order- and frequency-aware where a bare token
+ *  SET is not: two blocks sharing the same token vocabulary but in a different
+ *  order (or a large block whose vocabulary subsumes a smaller block's) no
+ *  longer compare as ~100% structurally similar. */
+function computeJaccardSimilarity(text1, text2) {
+    const grams1 = new Set(tokenBigrams(text1.split(/\s+/).filter(Boolean)));
+    const grams2 = new Set(tokenBigrams(text2.split(/\s+/).filter(Boolean)));
+    let intersection = 0;
+    for (const g of grams1) {
+        if (grams2.has(g))
+            intersection++;
+    }
+    const union = grams1.size + grams2.size - intersection;
+    return union === 0 ? 0 : intersection / union;
+}
+/** Translate a minimal glob (`*`, `**`, `?`) to an anchored regex (re-homed). */
+function globToRegExp(pattern) {
+    const out = ['^'];
+    for (let i = 0; i < pattern.length; i++) {
+        const ch = pattern[i];
+        if (ch === '*') {
+            if (pattern[i + 1] === '*') {
+                i += 1;
+                if (pattern[i + 1] === '/') {
+                    i += 1;
+                    out.push('(?:.*/)?');
+                }
+                else {
+                    out.push('.*');
+                }
+            }
+            else {
+                out.push('[^/]*');
+            }
+        }
+        else if (ch === '?') {
+            out.push('[^/]');
+        }
+        else if ('^$\\.+?()[]{}|'.includes(ch)) {
+            out.push('\\', ch);
+        }
+        else {
+            out.push(ch);
+        }
+    }
+    out.push('$');
+    return new RegExp(out.join(''));
+}
+/** True when a file path matches any of the given glob-ish exclude patterns. */
+function isExcluded(filePath, patterns) {
+    const normalized = filePath.replace(/\\/g, '/');
+    return patterns.some((pattern) => globToRegExp(pattern).test(normalized));
+}
+/** True when `outer`'s span fully contains `inner`'s span in the same file. */
+function shapeSpansContain(outer, inner) {
+    if (outer.file !== inner.file)
+        return false;
+    const startLte = outer.start.line < inner.start.line ||
+        (outer.start.line === inner.start.line && outer.start.column <= inner.start.column);
+    const endGte = outer.end.line > inner.end.line ||
+        (outer.end.line === inner.end.line && outer.end.column >= inner.end.column);
+    return startLte && endGte;
+}
+/** Drop nested fragments, keeping the outermost (re-homed `dedupeShapeFragments`). */
+function dedupeShapeFragments(fragments) {
+    const sorted = [...fragments].sort((a, b) => {
+        if (a.file !== b.file)
+            return a.file.localeCompare(b.file);
+        if (a.start.line !== b.start.line)
+            return a.start.line - b.start.line;
+        if (a.start.column !== b.start.column)
+            return a.start.column - b.start.column;
+        if (a.end.line !== b.end.line)
+            return b.end.line - a.end.line;
+        return b.end.column - a.end.column;
+    });
+    const kept = [];
+    for (const f of sorted) {
+        if (!kept.some((k) => shapeSpansContain(k, f)))
+            kept.push(f);
+    }
+    return kept;
+}
+/** Longest common subsequence of two string arrays, as the actual shared sequence. */
+function longestCommonSubsequence(a, b) {
+    const m = a.length;
+    const n = b.length;
+    const dp = Array.from({ length: m + 1 }, () => new Array(n + 1).fill(0));
+    for (let i = 1; i <= m; i++) {
+        for (let j = 1; j <= n; j++) {
+            dp[i][j] = a[i - 1] === b[j - 1] ? dp[i - 1][j - 1] + 1 : Math.max(dp[i - 1][j], dp[i][j - 1]);
+        }
+    }
+    const seq = [];
+    let i = m;
+    let j = n;
+    while (i > 0 && j > 0) {
+        if (a[i - 1] === b[j - 1]) {
+            seq.push(a[i - 1]);
+            i--;
+            j--;
+        }
+        else if (dp[i - 1][j] >= dp[i][j - 1]) {
+            i--;
+        }
+        else {
+            j--;
+        }
+    }
+    return seq.reverse();
+}
+/**
+ * Method names from well-known fluent APIs (query/schema builders, validators,
+ * commander, promises, DOM/stdlib chains) — "structurally similar by design",
+ * so the default-on expression rule stays quiet on them (re-homed verbatim).
+ */
+const FLUENT_CHAIN_METHODS = new Set([
+    // SQL query builders (knex, Kysely, Drizzle, …)
+    'select', 'selectDistinct', 'from', 'where', 'andWhere', 'orWhere', 'whereRaw',
+    'whereIn', 'whereNotIn', 'whereNull', 'whereNotNull', 'whereExists', 'whereBetween',
+    'orderBy', 'groupBy', 'having', 'join', 'innerJoin', 'leftJoin', 'rightJoin',
+    'crossJoin', 'fullOuterJoin', 'limit', 'offset', 'distinct', 'count', 'sum', 'avg',
+    'first', 'pluck', 'forUpdate', 'forShare', 'skipLocked', 'union', 'unionAll',
+    'insert', 'update', 'del', 'delete', 'into', 'returning', 'onConflict', 'ignore',
+    'merge', 'increment', 'decrement', 'transacting', 'using', 'updateFrom', 'testSql',
+    'toSQL', 'toQuery', 'raw', 'table', 'schemaBuilder', 'queryBuilder', 'partitionBy',
+    // Schema builders (knex `table.integer().unsigned().references()`)
+    'createTable', 'alterTable', 'dropTable', 'dropTableIfExists', 'renameTable',
+    'renameColumn', 'dropColumn', 'integer', 'bigInteger', 'text', 'boolean', 'float',
+    'double', 'decimal', 'date', 'dateTime', 'timestamp', 'timestamps', 'time',
+    'binary', 'json', 'jsonb', 'uuid', 'unsigned', 'references', 'inTable', 'defaultTo',
+    'index', 'unique', 'primary', 'comment', 'foreign', 'onDelete', 'onUpdate',
+    'deferrable', 'withKeyName', 'notNullable', 'collate', 'check',
+    // Zod / Valibot schema validators
+    'trim', 'min', 'max', 'length', 'int', 'positive', 'nonnegative', 'negative',
+    'regex', 'email', 'url', 'datetime', 'optional', 'nullish', 'nullable', 'default',
+    'describe', 'refine', 'superRefine', 'transform', 'safeParse', 'parse', 'array',
+    'object', 'enum', 'record', 'union', 'intersection', 'tuple', 'literal', 'number',
+    'string', 'nativeEnum', 'lazy', 'preprocess', 'brand',
+    // commander / CLI builders
+    'command', 'description', 'option', 'requiredOption', 'action', 'argument',
+    'version', 'usage', 'name', 'alias', 'allowUnknownOption', 'exitOverride',
+    // Promises
+    'then', 'catch', 'finally',
+    // DOM / jQuery traversal and JS stdlib array/string method chains
+    'closest', 'find', 'text', 'map', 'filter', 'reduce', 'forEach', 'slice', 'split',
+    'join', 'replace', 'replaceAll', 'toLowerCase', 'toUpperCase', 'flatMap', 'concat',
+]);
+/** True when the chain is a fluent library/builder API (not duplicated logic). */
+function isFluentChain(names) {
+    return names.some((n) => FLUENT_CHAIN_METHODS.has(n));
+}
+/** Partition the corpus `code-block` fact by file, dropping excluded files. */
+function perFileGroups(facts, patterns) {
+    const byFile = new Map();
+    for (const fact of facts) {
+        if (isExcluded(fact.file, patterns))
+            continue;
+        const group = byFile.get(fact.file) ?? { blocks: [], fragments: [] };
+        if (fact.kind === 'block')
+            group.blocks.push(fact);
+        else
+            group.fragments.push(fact);
+        byFile.set(fact.file, group);
+    }
+    return byFile;
+}
+/** Re-homes `reportExactDuplicates` (per file): group by hash, flag repeats. */
+function detectExactDuplicates(blocks, cfg) {
+    const minLine = cfg.minLineThreshold || 5;
+    const large = blocks.filter((b) => b.lineCount >= minLine);
+    const deduped = deduplicateBlocks(large);
+    const byHash = new Map();
+    for (const block of deduped) {
+        const group = byHash.get(block.hash) ?? [];
+        group.push(block);
+        byHash.set(block.hash, group);
+    }
+    const findings = [];
+    for (const group of byHash.values()) {
+        if (group.length < 2)
+            continue;
+        const sorted = [...group].sort(byFileAndLine);
+        const original = sorted[0];
+        for (let i = 1; i < sorted.length; i++) {
+            const block = sorted[i];
+            if (spansOverlap(original, block))
+                continue;
+            findings.push({
+                ruleId: 'dry/duplicate',
+                severity: 'high',
+                message: `Duplicate code block detected (${block.lineCount} lines). ` +
+                    `First occurrence at ${original.file}:${original.start.line}`,
+                file: block.file,
+                line: block.start.line,
+                column: block.start.column,
+                symbol: block.hash,
+                resolution: {
+                    action: 'extract-duplicate',
+                    summary: `Extract the ${block.lineCount}-line block duplicated at ${original.file}:${original.start.line} into a shared function both sites call.`,
+                    files: [block.file, original.file],
+                    lines: [block.start.line, original.start.line],
+                },
+                fix: { oldText: block.text, newText: '// Consider extracting to a shared function' },
+            });
+        }
+    }
+    return findings;
+}
+/** Re-homes `reportStructuralDuplicates` (per file): Jaccard over token-kind skeletons. */
+function detectStructuralDuplicates(blocks, cfg) {
+    const minLine = cfg.minLineThreshold || 5;
+    const threshold = cfg.similarityThreshold ?? 0.85;
+    const large = blocks.filter((b) => b.lineCount >= minLine);
+    const deduped = deduplicateBlocks(large);
+    const findings = [];
+    for (let i = 0; i < deduped.length; i++) {
+        const original = deduped[i];
+        for (let j = i + 1; j < deduped.length; j++) {
+            const block = deduped[j];
+            if (original.hash === block.hash)
+                continue;
+            if (spansOverlap(original, block))
+                continue;
+            const similarity = computeJaccardSimilarity(original.structuralSkeleton, block.structuralSkeleton);
+            if (similarity < threshold)
+                continue;
+            findings.push({
+                ruleId: 'dry/structural-similarity',
+                severity: 'high',
+                message: `Structurally similar code block detected (${Math.round(similarity * 100)}% similar). ` +
+                    `First occurrence at ${original.file}:${original.start.line}`,
+                file: block.file,
+                line: block.start.line,
+                column: block.start.column,
+                symbol: block.hash,
+                fix: { oldText: block.text, newText: '// Consider extracting to a shared function' },
+            });
+        }
+    }
+    return findings;
+}
+/** Build the `dry/similar-expression` finding for `fragment` resembling `first`. */
+function buildSimilarityViolation(fragment, first, shared) {
+    const isObject = fragment.fragmentKind === 'object';
+    const label = isObject ? 'object literal' : 'call chain';
+    const unit = isObject ? 'fields' : 'methods';
+    const targetClause = isObject && fragment.target
+        ? ` built for "${fragment.target}"`
+        : '';
+    return {
+        ruleId: 'dry/similar-expression',
+        severity: 'high',
+        message: `Near-identical ${label}${targetClause} detected (${shared.length} shared ${unit}: ${shared.join(', ')}). ` +
+            `First occurrence at ${first.file}:${first.start.line}`,
+        file: fragment.file,
+        line: fragment.start.line,
+        column: fragment.start.column,
+        symbol: shared.join('.'),
+        resolution: {
+            action: 'extract-shared-expression',
+            summary: `Extract the shared ${isObject ? 'field list' : 'method chain'} (${shared.join(', ')}) into a shared helper, builder, or constant both sites use.`,
+            files: [fragment.file, first.file],
+            lines: [fragment.start.line, first.start.line],
+        },
+        fix: { oldText: fragment.text, newText: `// Consider extracting the shared ${unit} into a shared helper` },
+    };
+}
+/** Re-homes `reportExpressionSimilarities` (per file): LCS over fragment names. */
+function detectExpressionSimilarities(fragments, cfg) {
+    const min = cfg.minShapeNames || 4;
+    // The legacy walk filtered fragments during collection: object literals were
+    // dropped only for having too few names, while call chains were also dropped
+    // when they were fluent library/builder APIs. Re-apply that same split here —
+    // a fluent-chain exclusion on an object literal would wrongly drop a
+    // `{ select, from, where, orderBy }` literal that the legacy code compared.
+    const eligible = fragments.filter((f) => {
+        if (f.names.length < min)
+            return false;
+        if (f.fragmentKind === 'chain' && isFluentChain(f.names))
+            return false;
+        return true;
+    });
+    const deduped = dedupeShapeFragments(eligible);
+    const reported = new Set();
+    const findings = [];
+    for (let j = 1; j < deduped.length; j++) {
+        if (reported.has(j))
+            continue;
+        for (let i = 0; i < j; i++) {
+            if (deduped[i].fragmentKind !== deduped[j].fragmentKind)
+                continue;
+            if (deduped[i].target !== deduped[j].target)
+                continue;
+            const shared = longestCommonSubsequence(deduped[i].names, deduped[j].names);
+            if (shared.length < min)
+                continue;
+            findings.push(buildSimilarityViolation(deduped[j], deduped[i], shared));
+            reported.add(j);
+            break;
+        }
+    }
+    return findings;
+}
+/**
+ * The legacy `computeJaccardSimilarity` (UniversalDRYAnalyzer.ts) — a bare
+ * token-SET Jaccard over the whitespace-split skeleton. The migrated
+ * `dry/structural-similarity` rule deliberately uses a *bigram* Jaccard
+ * (`computeJaccardSimilarity` above), but the seed write must reproduce the
+ * *legacy* `dry_pair_history` series byte-for-byte, so it re-homes the legacy
+ * bare-token-set metric rather than the migrated bigram.
+ */
+function computeBareTokenJaccard(text1, text2) {
+    const tokens1 = new Set(text1.split(/\s+/).filter(Boolean));
+    const tokens2 = new Set(text2.split(/\s+/).filter(Boolean));
+    let intersection = 0;
+    for (const t of tokens1) {
+        if (tokens2.has(t))
+            intersection++;
+    }
+    const union = tokens1.size + tokens2.size - intersection;
+    return union === 0 ? 0 : intersection / union;
+}
+/** The legacy order-independent pair identity: SHA256 of the sorted
+ *  `file|nodeType|line` ids. */
+function computePairFingerprint(original, block) {
+    const id1 = `${original.file}|${original.nodeType}|${original.start.line}`;
+    const id2 = `${block.file}|${block.nodeType}|${block.start.line}`;
+    const sorted = [id1, id2].sort();
+    return crypto.createHash('sha256').update(sorted.join('||')).digest('hex');
+}
+/**
+ * Seed the `dry_pair_history` rows the legacy `createDryVisitor` accumulated,
+ * from the phase `code-block` fact. This re-homes the pair half of the legacy
+ * `analyzeAST` — per-file filter → dedupe → compare — over the projected data,
+ * and writes the *legacy* gates:
+ *
+ *   - exact-duplicate pairs (`dry/duplicate`, similarity 1.0) always seed;
+ *   - structural pairs (`dry/structural-similarity`) seed only when
+ *     `checkStructuralSimilarity` is true, with the legacy bare-token-set Jaccard
+ *     (not the migrated rule's bigram) and the legacy `similarityThreshold`.
+ *
+ * The three block *rules* re-apply `minLineThreshold`/`similarityThreshold` in
+ * `detectExactDuplicates`/`detectStructuralDuplicates`; the seed repeats the
+ * same per-file filter/dedupe so the written `(fingerprint, contentHash, line)`
+ * tuple is byte-identical to what the legacy visitor accumulated.
+ *
+ * @param codeBlocks - The assembled `code-block` corpus fact.
+ * @param config - The default-merged dry config (the rule's `resolveBlockConfig`).
+ * @returns The seeded pairs, in per-file walk order.
+ */
+export function seedDryPairs(codeBlocks, config) {
+    const minLine = config.minLineThreshold || 5;
+    const threshold = config.similarityThreshold ?? 0.85;
+    const pairs = [];
+    const seed = (original, block, similarity, rule) => {
+        pairs.push({
+            pairFingerprint: computePairFingerprint(original, block),
+            file1: original.file,
+            symbol1: `${original.nodeType}:${original.start.line}`,
+            line1: original.start.line,
+            contentHash1: original.hash,
+            file2: block.file,
+            symbol2: `${block.nodeType}:${block.start.line}`,
+            line2: block.start.line,
+            contentHash2: block.hash,
+            similarity,
+            rule,
+        });
+    };
+    for (const { blocks } of perFileGroups(codeBlocks, config.excludePatterns ?? []).values()) {
+        const large = blocks.filter((b) => b.lineCount >= minLine);
+        const deduped = deduplicateBlocks(large);
+        // Exact duplicates — group by hash, seed each later block against the earliest.
+        const byHash = new Map();
+        for (const block of deduped) {
+            const group = byHash.get(block.hash) ?? [];
+            group.push(block);
+            byHash.set(block.hash, group);
+        }
+        for (const group of byHash.values()) {
+            if (group.length < 2)
+                continue;
+            const sorted = [...group].sort(byFileAndLine);
+            const original = sorted[0];
+            for (let i = 1; i < sorted.length; i++) {
+                const block = sorted[i];
+                if (spansOverlap(original, block))
+                    continue;
+                seed(original, block, 1.0, 'dry/duplicate');
+            }
+        }
+        // Structural similarity — legacy-gated, bare-token-set Jaccard.
+        if (config.checkStructuralSimilarity) {
+            for (let i = 0; i < deduped.length; i++) {
+                const original = deduped[i];
+                for (let j = i + 1; j < deduped.length; j++) {
+                    const block = deduped[j];
+                    if (original.hash === block.hash)
+                        continue;
+                    if (spansOverlap(original, block))
+                        continue;
+                    const similarity = computeBareTokenJaccard(original.structuralSkeleton, block.structuralSkeleton);
+                    if (similarity < threshold)
+                        continue;
+                    seed(original, block, similarity, 'dry/structural-similarity');
+                }
+            }
+        }
+    }
+    return pairs;
+}
+/** The fallback the legacy auditRunner Phase 2 hardcoded when no divergence
+ *  config was set (mirrors `DEFAULT_ANALYZER_CONFIGS.dry.divergence`). */
+const DIVERGENCE_DEFAULTS = {
+    divergenceThreshold: 0.05,
+    divergenceRuns: 2,
+    minPairSimilarity: 0.5,
+};
+/** Re-homes auditRunner Phase 2 verbatim: flag a pair whose similarity fell by
+ *  `divergenceThreshold` for `divergenceRuns` consecutive runs. The
+ *  `clone-pair-history` fact is grouped by fingerprint with its series already
+ *  in timestamp order, so the anchor (file/line) is the group's most recent row. */
+function detectDivergingClone(facts, cfg) {
+    const threshold = cfg.divergenceThreshold ?? 0.05;
+    const requiredDeclines = cfg.divergenceRuns ?? 2;
+    if (threshold <= 0)
+        return [];
+    const findings = [];
+    for (const group of facts) {
+        const rows = group.rows;
+        if (rows.length < requiredDeclines + 1)
+            continue;
+        // Check the last `requiredDeclines` consecutive pairs for a decline.
+        let consecutiveDeclines = 0;
+        for (let i = rows.length - requiredDeclines; i < rows.length; i++) {
+            if (rows[i].similarity < rows[i - 1].similarity - threshold) {
+                consecutiveDeclines++;
+            }
+        }
+        if (consecutiveDeclines >= requiredDeclines) {
+            const currentSim = rows[rows.length - 1].similarity;
+            const prevSim = rows[rows.length - 2].similarity;
+            const drop = Math.round((prevSim - currentSim) * 1000) / 1000;
+            const fp = group.fingerprint;
+            findings.push({
+                ruleId: 'dry/diverging-clone',
+                severity: 'severe',
+                message: `Clone pair has diverged: similarity dropped ${drop} (from ${prevSim.toFixed(3)} to ${currentSim.toFixed(3)}) across ${requiredDeclines} consecutive runs (pair: ${fp.slice(0, 12)}…). Review ${group.file1}:${group.line1} and ${group.file2}:${group.line2} for diverged logic.`,
+                file: group.file1,
+                line: group.line1,
+                // §7 — the pair fingerprint is the stable identity that located this finding.
+                symbol: fp,
+            });
+        }
+    }
+    return findings;
+}
+// ── The rules ─────────────────────────────────────────────────────────────────
+const duplicateImport = {
+    id: 'duplicate-import',
+    analyzer: 'dry',
+    needs: { formats: ['typescript', 'tsx', 'javascript'], facts: ['imports'] },
+    severity: 'high',
+    message: META.message,
+    docs: META.docs,
+    thresholds: META.thresholds,
+    samples: META.samples,
+    analyze(ctx) {
+        return detectDuplicateImport(ctx.facts['imports']);
+    },
+};
+const duplicateStringLiteral = {
+    id: 'duplicate-string-literal',
+    analyzer: 'dry',
+    needs: { formats: ['typescript', 'tsx', 'javascript'], facts: ['string-literals'] },
+    severity: 'high',
+    message: STRING_META.message,
+    docs: STRING_META.docs,
+    thresholds: STRING_META.thresholds,
+    samples: STRING_META.samples,
+    analyze(ctx) {
+        return detectDuplicateStringLiteral(ctx.facts['string-literals']);
+    },
+};
+const dryDuplicate = {
+    id: 'dry/duplicate',
+    analyzer: 'dry',
+    needs: { formats: ['typescript', 'tsx', 'javascript'], facts: ['code-block'] },
+    severity: 'high',
+    message: DUP_META.message,
+    docs: DUP_META.docs,
+    thresholds: DUP_META.thresholds,
+    samples: DUP_META.samples,
+    analyze(ctx) {
+        const cfg = resolveBlockConfig(ctx.thresholds);
+        const findings = [];
+        for (const { blocks } of perFileGroups(ctx.facts['code-block'], cfg.excludePatterns ?? []).values()) {
+            findings.push(...detectExactDuplicates(blocks, cfg));
+        }
+        return findings;
+    },
+};
+const dryStructuralSimilarity = {
+    id: 'dry/structural-similarity',
+    analyzer: 'dry',
+    needs: { formats: ['typescript', 'tsx', 'javascript'], facts: ['code-block'] },
+    severity: 'high',
+    message: STRUCT_META.message,
+    docs: STRUCT_META.docs,
+    thresholds: STRUCT_META.thresholds,
+    samples: STRUCT_META.samples,
+    analyze(ctx) {
+        const cfg = resolveBlockConfig(ctx.thresholds);
+        const findings = [];
+        for (const { blocks } of perFileGroups(ctx.facts['code-block'], cfg.excludePatterns ?? []).values()) {
+            findings.push(...detectStructuralDuplicates(blocks, cfg));
+        }
+        return findings;
+    },
+};
+const drySimilarExpression = {
+    id: 'dry/similar-expression',
+    analyzer: 'dry',
+    needs: { formats: ['typescript', 'tsx', 'javascript'], facts: ['code-block'] },
+    severity: 'high',
+    message: EXPR_META.message,
+    docs: EXPR_META.docs,
+    thresholds: EXPR_META.thresholds,
+    samples: EXPR_META.samples,
+    analyze(ctx) {
+        const cfg = resolveBlockConfig(ctx.thresholds);
+        const findings = [];
+        for (const { fragments } of perFileGroups(ctx.facts['code-block'], cfg.excludePatterns ?? []).values()) {
+            findings.push(...detectExpressionSimilarities(fragments, cfg));
+        }
+        return findings;
+    },
+};
+const divergingClone = {
+    id: 'dry/diverging-clone',
+    analyzer: 'dry',
+    needs: { formats: ['typescript', 'tsx', 'javascript'], facts: ['clone-pair-history'] },
+    severity: 'severe',
+    message: DIVERGING_META.message,
+    docs: DIVERGING_META.docs,
+    thresholds: DIVERGING_META.thresholds,
+    samples: DIVERGING_META.samples,
+    analyze(ctx) {
+        // The divergence knobs resolve the same way the legacy Phase 2 did: the
+        // dry namespace's `divergence` object, or the hardcoded fallback. The
+        // top-level `divergence` config is threaded into `dry.divergence` by the
+        // caller (§11.1), so `ctx.thresholds['divergence']` is the effective value.
+        const divergence = ctx.thresholds['divergence'] ?? DIVERGENCE_DEFAULTS;
+        return detectDivergingClone(ctx.facts['clone-pair-history'], divergence);
+    },
+};
+/** The DRY rules, in registry order. */
+export const dryRules = [
+    duplicateImport,
+    duplicateStringLiteral,
+    dryDuplicate,
+    dryStructuralSimilarity,
+    drySimilarExpression,
+    divergingClone,
+];
+//# sourceMappingURL=dry.js.map