sigmap 7.30.0 → 8.0.0

package/gen-project-map.js

@@ -127,9 +127,13 @@ function formatOutput(sections) {
   ];
 
   const parts = [
-    { key: 'imports',   header: '### Import graph',      content: sections.imports },
-    { key: 'classes',   header: '### Class hierarchy',   content: sections.classes },
-    { key: 'routes',    header: '### Route table',       content: sections.routes  },
+    { key: 'imports',    header: '### Import graph',         content: sections.imports },
+    { key: 'classes',    header: '### Class hierarchy',      content: sections.classes },
+    { key: 'routes',     header: '### Route table',          content: sections.routes  },
+    { key: 'env',        header: '### Environment variables', content: sections.env },
+    { key: 'buildci',    header: '### Build & CI',           content: sections.buildci },
+    { key: 'manifests',  header: '### Config & manifests',   content: sections.manifests },
+    { key: 'migrations', header: '### Database migrations',  content: sections.migrations },
   ];
 
   for (const { header, content } of parts) {
@@ -165,9 +169,13 @@ function main() {
   }
 
   const sections = {
-    imports: runAnalyzer('import-graph',     files, cwd),
-    classes: runAnalyzer('class-hierarchy',  files, cwd),
-    routes:  runAnalyzer('route-table',      files, cwd),
+    imports:    runAnalyzer('import-graph',    files, cwd),
+    classes:    runAnalyzer('class-hierarchy', files, cwd),
+    routes:     runAnalyzer('route-table',     files, cwd),
+    env:        runAnalyzer('env-schema',      files, cwd),
+    buildci:    runAnalyzer('build-ci',        files, cwd),
+    manifests:  runAnalyzer('config-manifest', files, cwd),
+    migrations: runAnalyzer('migrations',      files, cwd),
   };
 
   const output = formatOutput(sections);

package/llms-full.txt

@@ -11,20 +11,20 @@ ranking keeps the relevant context in scope (cutting tokens ~97% as a side
 effect), with no LLM calls, embeddings, or vector database. Works with Claude,
 Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 
-# Version: 7.30.0 | Benchmark: sigmap-v7.30-main (2026-06-23)
+# Version: 8.0.0 | Benchmark: sigmap-v8.0-main (2026-07-04)
 # Source: auto-generated from package.json, version.json, benchmarks/latest.json, src/mcp/tools.js, src/config/defaults.js
 # Regenerate: npm run generate:llms   |   Validate: npm run validate:llms
 
 ---
 
-## Core metrics (benchmark: sigmap-v7.30-main, 2026-06-23)
+## Core metrics (benchmark: sigmap-v8.0-main, 2026-07-04)
 
 | Metric | Without SigMap | With SigMap |
 |--------|----------------|-------------|
-| Retrieval hit@5 | 13.6% (random) | 75.6% (5.6× lift) |
+| Retrieval hit@5 | 13.6% (random) | 86.7% (6.4× lift) |
 | Token reduction | — | 97.0% average |
-| Task success proxy | 10% | 52.2% |
-| Prompts per task | 2.84 | 1.72 (39.4% fewer) |
+| Task success proxy | 10% | 67.8% |
+| Prompts per task | 2.84 | 1.46 (48.8% fewer) |
 | Supported languages | — | 33 |
 | MCP tools | — | 17 |
 | npm runtime dependencies | — | 0 |

package/llms.txt

@@ -11,7 +11,7 @@ ranking keeps the relevant context in scope (cutting tokens ~97% as a side
 effect), with no LLM calls, embeddings, or vector database. Works with Claude,
 Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 
-# Version: 7.30.0 | Benchmark: sigmap-v7.30-main (2026-06-23)
+# Version: 8.0.0 | Benchmark: sigmap-v8.0-main (2026-07-04)
 # Source: auto-generated from package.json, version.json, benchmarks/latest.json, src/mcp/tools.js, src/config/defaults.js
 # Regenerate: npm run generate:llms   |   Validate: npm run validate:llms
 
@@ -23,12 +23,12 @@ Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 - No blast-radius awareness before editing a hub file — `--impact` shows every file a change touches.
 - Pasted stack traces, CI logs, and JSON bloat the prompt — `squeeze` minimizes them and enriches the top frame from the symbol index.
 
-## Core metrics (benchmark: sigmap-v7.30-main, 2026-06-23)
+## Core metrics (benchmark: sigmap-v8.0-main, 2026-07-04)
 
-- hit@5 retrieval: 75.6% vs 13.6% random baseline (5.6× lift)
+- hit@5 retrieval: 86.7% vs 13.6% random baseline (6.4× lift)
 - Token reduction: 97.0% average across benchmark repos
-- Task success: 52.2% vs 10% without SigMap
-- Prompts per task: 1.72 vs 2.84 baseline (39.4% fewer)
+- Task success: 67.8% vs 10% without SigMap
+- Prompts per task: 1.46 vs 2.84 baseline (48.8% fewer)
 - Languages: 33 supported · MCP tools: 17
 - Dependencies: zero npm runtime dependencies · fully offline
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap",
-  "version": "7.30.0",
+  "version": "8.0.0",
   "description": "97% token reduction for AI coding. Extracts function & class signatures with TF-IDF ranking to feed only the right files to Claude, Cursor, Copilot, Aider, Windsurf, local LLMs & MCP. Zero dependencies, runs offline via npx.",
   "main": "packages/core/index.js",
   "exports": {
@@ -27,6 +27,7 @@
     "benchmark:matrix": "node scripts/run-benchmark-matrix.mjs --save --skip-clone",
     "benchmark:verify": "node scripts/run-verify-benchmark.mjs",
     "benchmark:squeeze": "node scripts/run-squeeze-benchmark.mjs --save",
+    "benchmark:test-discovery": "node scripts/run-test-discovery-benchmark.mjs --save",
     "validate:squeeze": "node scripts/run-squeeze-benchmark.mjs --gate",
     "health": "node gen-context.js --health",
     "map": "node gen-project-map.js",

package/packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap-cli",
-  "version": "7.30.0",
+  "version": "8.0.0",
   "description": "SigMap CLI wrapper — thin adapter for programmatic CLI invocation",
   "main": "index.js",
   "keywords": [

package/packages/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap-core",
-  "version": "7.30.0",
+  "version": "8.0.0",
   "description": "SigMap core library — zero-dependency code signature extraction, retrieval, and security scanning",
   "main": "index.js",
   "keywords": [

package/src/eval/runner.js

@@ -20,6 +20,7 @@
 const fs = require('fs');
 const path = require('path');
 const { aggregate } = require('./scorer');
+const { bm25rank } = require('../retrieval/bm25');
 
 // ---------------------------------------------------------------------------
 // Context file reader
@@ -81,79 +82,26 @@ function buildSigIndex(cwd) {
 }
 
 // ---------------------------------------------------------------------------
-// Simple keyword-based ranking (pre-retrieval layer; v2.3 adds proper ranker)
+// Identifier-aware BM25 ranking (v7.31; see src/retrieval/bm25.js and #395)
 // ---------------------------------------------------------------------------
 
-/**
- * Tokenize a query or signature into lower-case word tokens.
- * Splits on whitespace, punctuation, camelCase, and snake_case.
- * @param {string} text
- * @returns {string[]}
- */
-function tokenize(text) {
-  if (!text) return [];
-  return text
-    // split camelCase
-    .replace(/([a-z])([A-Z])/g, '$1 $2')
-    // split snake/kebab
-    .replace(/[_\-]/g, ' ')
-    // drop non-word chars
-    .replace(/[^\w\s]/g, ' ')
-    .toLowerCase()
-    .split(/\s+/)
-    .filter((t) => t.length > 1);
-}
-
-const STOP_WORDS = new Set([
-  'the', 'a', 'an', 'in', 'of', 'to', 'for', 'and', 'or', 'is', 'are',
-  'that', 'this', 'it', 'with', 'from', 'by', 'be', 'as', 'on', 'at',
-]);
-
-/**
- * Score a single file's signatures against a query.
- * Returns a non-negative number; higher = more relevant.
- * @param {string[]} sigs  - array of signature strings for this file
- * @param {string[]} queryTokens
- * @returns {number}
- */
-function scoreFile(sigs, queryTokens) {
-  if (!sigs || sigs.length === 0) return 0;
-
-  const sigText = sigs.join(' ');
-  const sigTokens = new Set(tokenize(sigText));
-
-  let score = 0;
-  for (const qt of queryTokens) {
-    if (STOP_WORDS.has(qt)) continue;
-    if (sigTokens.has(qt)) score += 1;
-    // Partial match (prefix)
-    for (const st of sigTokens) {
-      if (st !== qt && st.startsWith(qt) && qt.length >= 4) score += 0.3;
-    }
-  }
-
-  return score;
-}
+const { tokenize } = require('../retrieval/bm25');
 
 /**
- * Rank all files in the index against a query. Returns file paths sorted
- * by relevance score descending. Ties are broken by file path alphabetically.
+ * Rank all files in the index against a query with the identifier-aware BM25
+ * re-ranker. Returns file entries sorted by relevance score descending; ties
+ * are broken by file path alphabetically (deterministic).
  * @param {string} query
  * @param {Map<string, string[]>} index
  * @param {number} topK
  * @returns {{ file: string, score: number, sigs: string[] }[]}
  */
 function rank(query, index, topK = 10) {
-  const queryTokens = tokenize(query);
-  const scored = [];
-
+  const candidates = [];
   for (const [file, sigs] of index.entries()) {
-    const score = scoreFile(sigs, queryTokens);
-    scored.push({ file, score, sigs });
+    candidates.push({ file, sigs });
   }
-
-  scored.sort((a, b) => b.score - a.score || a.file.localeCompare(b.file));
-  return scored.slice(0, topK);
+  return bm25rank(query, candidates).slice(0, topK);
 }
 
 // ---------------------------------------------------------------------------

package/src/evidence/pack.js

@@ -33,7 +33,14 @@ const DEFAULT_TOP = 12;
 const GENERATED_RE = /(^|\/)(dist|build|out|vendor|node_modules)\/|\.(generated|min|bundle)\.|\.(pb|_pb)\.|\.pb\.go$|_pb2\.py$/;
 const TEST_RE = /(^|\/)(tests?|__tests__|spec|specs)\/|\.(test|spec)\.[a-z]+$|(^|\/)test_[^/]+\.py$|_test\.(go|py|rb)$/;
 const CONFIG_RE = /\.(json|ya?ml|toml|ini|conf|config|properties|env)$|(^|\/)(\.?[a-z]+rc)$|\.config\.[a-z]+$/i;
-const SECURITY_RE = /(^|\/|[._-])(auth|authn|authz|login|password|passwd|secret|credential|token|session|crypto|cipher|payment|billing|checkout|oauth|jwt|permission|acl|rbac)([._-]|\/|$)/i;
+// DB migrations: framework dirs (Rails/Alembic/Prisma), Flyway `V1__x.sql`,
+// timestamped migration files, and `*_migration.*` naming.
+const MIGRATION_RE = /(^|\/)(migrations?|alembic\/versions|prisma\/migrations)(\/|$)|(^|\/)db\/migrate\/|(^|\/)V\d+(_\d+)*__[^/]+\.(sql|java)$|(^|\/)\d{8,}[_-][^/]+\.(sql|rb|py|js|ts)$|[._-]migration[s]?[._-]/i;
+const PAYMENT_RE = /(^|\/|[._-])(payment|payments|billing|checkout|invoice|invoicing|subscription|stripe|paypal|braintree|charge|refund|payout)([._-]|\/|$)/i;
+const AUTH_RE = /(^|\/|[._-])(auth|authn|authz|login|logout|signin|signup|password|passwd|session|oauth|jwt|permission|permissions|acl|rbac|credential|credentials)([._-]|\/|$)/i;
+const SECURITY_RE = /(^|\/|[._-])(secret|secrets|crypto|cipher|encrypt|decrypt|token|signing|keystore|vault)([._-]|\/|$)/i;
+// Public API surface: `api/` dirs, `public-api`, and module barrel entrypoints.
+const PUBLIC_API_RE = /(^|\/)api(\/|$)|(^|\/)public[-_]?api(\/|$)|(^|\/)index\.(js|ts|mjs|cjs)$/i;
 
 /**
  * Split a signature's `  :start-end` line anchor from its symbol text.
@@ -51,17 +58,25 @@ function parseAnchor(sig) {
 }
 
 /**
- * Classify a file into a coarse risk label. Path-based heuristic (v1) — the
- * richer label set (C3) lands in v8.5.
+ * Classify a file into a risk label (C3, v8.5). Path-based, deterministic.
+ * Precedence is strict, most-specific-risk first: a migration touching payments
+ * is labeled `migration` (a schema change is the dominant risk), payment/auth
+ * outrank the generic `security` bucket, and `config`/`public-api` resolve
+ * before the `source` fallback. `test`/`generated` semantics are preserved so
+ * existing consumers (findRelatedTests, verifier) keep working.
  * @param {string} relPath
- * @returns {'generated'|'test'|'config'|'security'|'source'}
+ * @returns {'generated'|'test'|'migration'|'payment'|'auth'|'security'|'config'|'public-api'|'source'}
  */
 function riskLabelFor(relPath) {
   const p = relPath.replace(/\\/g, '/');
   if (GENERATED_RE.test(p)) return 'generated';
   if (TEST_RE.test(p)) return 'test';
+  if (MIGRATION_RE.test(p)) return 'migration';
+  if (PAYMENT_RE.test(p)) return 'payment';
+  if (AUTH_RE.test(p)) return 'auth';
   if (SECURITY_RE.test(p)) return 'security';
   if (CONFIG_RE.test(p)) return 'config';
+  if (PUBLIC_API_RE.test(p)) return 'public-api';
   return 'source';
 }
 
@@ -72,9 +87,28 @@ function stemOf(relPath) {
 }
 
 /**
- * Best-effort impl→test discovery (v1). Matches test files whose stem equals
- * the implementation file's stem, by common convention. Deterministic. The
- * accuracy-measured discovery (C2) lands in v8.5.
+ * Infer the implementation stem a test file targets, by stripping the
+ * conventional test affixes across languages (measured in the C2 benchmark):
+ *   foo.test.js / foo.spec.ts    → foo   (JS/TS)
+ *   test_foo.py                  → foo   (Python / pytest)
+ *   foo_test.go / foo_test.py    → foo   (Go, unittest)
+ *   FooTest.java / BarSpec.scala → Foo   (JVM, PascalCase)
+ * @param {string} relPath
+ * @returns {string}
+ */
+function testTargetStem(relPath) {
+  let s = stemOf(relPath);               // strips ext + trailing .test/.spec
+  s = s.replace(/^test[_-]/i, '');       // Python: test_foo
+  s = s.replace(/[_-]test$/i, '');       // Go / unittest: foo_test
+  s = s.replace(/(Tests?|Specs?)$/, ''); // JVM PascalCase: FooTest, BarSpec
+  return s;
+}
+
+/**
+ * Impl→test discovery (C2, v8.5). Matches test files back to their
+ * implementation by normalizing conventional test affixes, so JS/TS, Python,
+ * Go, and JVM naming conventions all resolve. Deterministic; accuracy is
+ * measured by `scripts/run-test-discovery-benchmark.mjs`.
  * @param {string} relPath
  * @param {string[]} allFiles  - universe of indexed files (relative paths)
  * @returns {string[]}
@@ -87,7 +121,7 @@ function findRelatedTests(relPath, allFiles) {
   for (const f of allFiles) {
     if (f === relPath) continue;
     if (riskLabelFor(f) !== 'test') continue;
-    if (stemOf(f).toLowerCase() === stem) out.push(f);
+    if (testTargetStem(f).toLowerCase() === stem) out.push(f);
   }
   return out.sort();
 }

package/src/map/build-ci.js

@@ -0,0 +1,91 @@
+'use strict';
+
+/**
+ * Build & CI extractor (v8.5 C1).
+ *
+ * Surfaces how the project is built and validated: npm/pnpm/yarn scripts
+ * (package.json), GitHub Actions workflows (.github/workflows/*.yml), and
+ * Makefile targets. Pure, zero-dependency, deterministic.
+ *
+ * @param {string[]} files — absolute file paths (unused; roots are read directly)
+ * @param {string}   cwd   — project root
+ * @returns {string} formatted markdown table (empty string if none found)
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+const MAX_ROWS = 120;
+
+function readJson(p) {
+  try { return JSON.parse(fs.readFileSync(p, 'utf8')); } catch (_) { return null; }
+}
+
+function npmScripts(cwd, rows) {
+  const pkg = readJson(path.join(cwd, 'package.json'));
+  if (!pkg || !pkg.scripts || typeof pkg.scripts !== 'object') return;
+  for (const name of Object.keys(pkg.scripts).sort()) {
+    rows.push({ kind: 'script', name, detail: 'npm run ' + name });
+  }
+}
+
+function ciWorkflows(cwd, rows) {
+  const dir = path.join(cwd, '.github', 'workflows');
+  let entries;
+  try { entries = fs.readdirSync(dir); } catch (_) { return; }
+  for (const file of entries.sort()) {
+    if (!/\.ya?ml$/i.test(file)) continue;
+    let content;
+    try { content = fs.readFileSync(path.join(dir, file), 'utf8'); } catch (_) { continue; }
+    const nameMatch = content.match(/^name:\s*(.+)$/m);
+    const name = nameMatch ? nameMatch[1].trim().replace(/^['"]|['"]$/g, '') : file;
+    // Trigger events from an `on:` mapping or inline form.
+    const onMatch = content.match(/^on:\s*(.*)$/m);
+    let triggers = '';
+    if (onMatch) {
+      if (onMatch[1].trim()) {
+        triggers = onMatch[1].replace(/[[\]{}'"]/g, '').trim();
+      } else {
+        const block = content.slice(onMatch.index);
+        const events = [...block.matchAll(/^\s{2,}([a-z_]+):/gm)].map((m) => m[1]);
+        triggers = [...new Set(events)].slice(0, 6).join(', ');
+      }
+    }
+    rows.push({ kind: 'ci', name, detail: `${file}${triggers ? ' — ' + triggers : ''}` });
+  }
+}
+
+function makeTargets(cwd, rows) {
+  let content;
+  try { content = fs.readFileSync(path.join(cwd, 'Makefile'), 'utf8'); } catch (_) { return; }
+  const targets = [];
+  for (const line of content.split('\n')) {
+    const m = line.match(/^([a-zA-Z0-9_][a-zA-Z0-9_.-]*)\s*:(?!=)/);
+    if (m && m[1] !== '.PHONY') targets.push(m[1]);
+  }
+  for (const t of [...new Set(targets)].sort()) {
+    rows.push({ kind: 'make', name: t, detail: 'make ' + t });
+  }
+}
+
+function analyze(files, cwd) {
+  const rows = [];
+  npmScripts(cwd, rows);
+  ciWorkflows(cwd, rows);
+  makeTargets(cwd, rows);
+  if (rows.length === 0) return '';
+
+  const lines = [
+    '| Kind | Name | Detail |',
+    '|------|------|--------|',
+  ];
+  for (const r of rows.slice(0, MAX_ROWS)) {
+    lines.push(`| ${r.kind} | ${r.name} | ${r.detail} |`);
+  }
+  if (rows.length > MAX_ROWS) {
+    lines.push(`| … | | +${rows.length - MAX_ROWS} more |`);
+  }
+  return lines.join('\n');
+}
+
+module.exports = { analyze };

package/src/map/config-manifest.js

@@ -0,0 +1,101 @@
+'use strict';
+
+/**
+ * Config & package-manifest extractor (v8.5 C1).
+ *
+ * Surfaces the project's package manifests (name / version / dependency counts)
+ * across ecosystems and the notable root config files present. Pure,
+ * zero-dependency, deterministic.
+ *
+ * @param {string[]} files — absolute file paths (unused; roots are read directly)
+ * @param {string}   cwd   — project root
+ * @returns {string} formatted markdown table (empty string if none found)
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+const CONFIG_FILES = [
+  'tsconfig.json', 'jsconfig.json', '.eslintrc', '.eslintrc.json', '.eslintrc.js',
+  '.prettierrc', 'babel.config.js', 'jest.config.js', 'vitest.config.ts',
+  'webpack.config.js', 'vite.config.ts', 'rollup.config.js', 'tailwind.config.js',
+  'docker-compose.yml', 'docker-compose.yaml', 'Dockerfile', '.editorconfig',
+];
+
+function readText(p) { try { return fs.readFileSync(p, 'utf8'); } catch (_) { return null; } }
+function readJson(p) { try { return JSON.parse(fs.readFileSync(p, 'utf8')); } catch (_) { return null; } }
+function count(obj) { return obj && typeof obj === 'object' ? Object.keys(obj).length : 0; }
+
+function manifests(cwd, rows) {
+  const pkg = readJson(path.join(cwd, 'package.json'));
+  if (pkg) {
+    const deps = count(pkg.dependencies);
+    const dev = count(pkg.devDependencies);
+    const id = [pkg.name, pkg.version].filter(Boolean).join('@') || 'package.json';
+    rows.push({ manifest: 'package.json (npm)', detail: `${id} · ${deps} deps, ${dev} devDeps` });
+  }
+
+  const pyproject = readText(path.join(cwd, 'pyproject.toml'));
+  if (pyproject) {
+    const name = (pyproject.match(/^\s*name\s*=\s*["']([^"']+)["']/m) || [])[1];
+    const ver = (pyproject.match(/^\s*version\s*=\s*["']([^"']+)["']/m) || [])[1];
+    rows.push({ manifest: 'pyproject.toml (python)', detail: [name, ver].filter(Boolean).join('@') || 'present' });
+  } else if (readText(path.join(cwd, 'setup.py'))) {
+    rows.push({ manifest: 'setup.py (python)', detail: 'present' });
+  }
+  if (readText(path.join(cwd, 'requirements.txt'))) {
+    rows.push({ manifest: 'requirements.txt (python)', detail: 'present' });
+  }
+
+  const cargo = readText(path.join(cwd, 'Cargo.toml'));
+  if (cargo) {
+    const name = (cargo.match(/^\s*name\s*=\s*["']([^"']+)["']/m) || [])[1];
+    const ver = (cargo.match(/^\s*version\s*=\s*["']([^"']+)["']/m) || [])[1];
+    rows.push({ manifest: 'Cargo.toml (rust)', detail: [name, ver].filter(Boolean).join('@') || 'present' });
+  }
+
+  const gomod = readText(path.join(cwd, 'go.mod'));
+  if (gomod) {
+    const mod = (gomod.match(/^module\s+(\S+)/m) || [])[1];
+    const go = (gomod.match(/^go\s+(\S+)/m) || [])[1];
+    rows.push({ manifest: 'go.mod (go)', detail: [mod, go && 'go ' + go].filter(Boolean).join(' · ') || 'present' });
+  }
+
+  if (readText(path.join(cwd, 'pom.xml'))) rows.push({ manifest: 'pom.xml (maven)', detail: 'present' });
+  if (readText(path.join(cwd, 'build.gradle')) || readText(path.join(cwd, 'build.gradle.kts'))) {
+    rows.push({ manifest: 'build.gradle (gradle)', detail: 'present' });
+  }
+  if (readText(path.join(cwd, 'Gemfile'))) rows.push({ manifest: 'Gemfile (ruby)', detail: 'present' });
+  const composer = readJson(path.join(cwd, 'composer.json'));
+  if (composer) {
+    rows.push({ manifest: 'composer.json (php)', detail: `${composer.name || 'present'} · ${count(composer.require)} deps` });
+  }
+}
+
+function configFiles(cwd) {
+  const present = [];
+  for (const f of CONFIG_FILES) {
+    if (fs.existsSync(path.join(cwd, f))) present.push(f);
+  }
+  return present;
+}
+
+function analyze(files, cwd) {
+  const rows = [];
+  manifests(cwd, rows);
+  const configs = configFiles(cwd);
+  if (rows.length === 0 && configs.length === 0) return '';
+
+  const lines = [];
+  if (rows.length) {
+    lines.push('| Manifest | Detail |', '|----------|--------|');
+    for (const r of rows) lines.push(`| ${r.manifest} | ${r.detail} |`);
+  }
+  if (configs.length) {
+    if (lines.length) lines.push('');
+    lines.push(`**Config files:** ${configs.map((c) => '`' + c + '`').join(', ')}`);
+  }
+  return lines.join('\n');
+}
+
+module.exports = { analyze };

package/src/map/env-schema.js

@@ -0,0 +1,90 @@
+'use strict';
+
+/**
+ * Environment-variable schema extractor (v8.5 C1).
+ *
+ * Surfaces the environment the project actually reads — from source across
+ * JS/TS, Python, Ruby, and Go, plus keys declared in a committed `.env.example`
+ * / `.env.sample` / `.env.template`. Pure, zero-dependency, deterministic.
+ *
+ * @param {string[]} files — absolute file paths to analyze (srcDirs-scoped)
+ * @param {string}   cwd   — project root
+ * @returns {string} formatted markdown table (empty string if none found)
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+const SCAN_EXTS = new Set(['.js', '.jsx', '.ts', '.tsx', '.mjs', '.cjs', '.py', '.rb', '.go']);
+const EXAMPLE_FILES = ['.env.example', '.env.sample', '.env.template', '.env.dist'];
+
+// process.env.X / process.env['X'] / import.meta.env.X / Deno.env.get('X')
+const JS_RE = /(?:process\.env|import\.meta\.env)(?:\.([A-Z_][A-Z0-9_]*)|\[\s*['"]([A-Z_][A-Z0-9_]*)['"]\s*\])|Deno\.env\.get\(\s*['"]([A-Z_][A-Z0-9_]*)['"]/g;
+// os.environ['X'] / os.environ.get('X') / os.getenv('X') / getenv('X')
+const PY_RE = /(?:os\.)?(?:environ(?:\.get)?\[?\s*['"]([A-Z_][A-Z0-9_]*)['"]|getenv\(\s*['"]([A-Z_][A-Z0-9_]*)['"])/g;
+const RB_RE = /ENV\[\s*['"]([A-Z_][A-Z0-9_]*)['"]\s*\]/g;
+const GO_RE = /os\.(?:Getenv|LookupEnv)\(\s*["`']([A-Z_][A-Z0-9_]*)["`']/g;
+
+const MAX_ROWS = 200;
+
+function collectMatches(re, content, into) {
+  let m;
+  re.lastIndex = 0;
+  while ((m = re.exec(content)) !== null) {
+    const name = m[1] || m[2] || m[3];
+    if (name) into.add(name);
+  }
+}
+
+function readExampleKeys(cwd) {
+  const keys = new Set();
+  for (const name of EXAMPLE_FILES) {
+    let content;
+    try { content = fs.readFileSync(path.join(cwd, name), 'utf8'); } catch (_) { continue; }
+    for (const line of content.split('\n')) {
+      const t = line.trim();
+      if (!t || t.startsWith('#')) continue;
+      const eq = t.match(/^(?:export\s+)?([A-Z_][A-Z0-9_]*)\s*=/);
+      if (eq) keys.add(eq[1]);
+    }
+  }
+  return keys;
+}
+
+function analyze(files, cwd) {
+  const fromCode = new Set();
+
+  for (const filePath of files) {
+    const ext = path.extname(filePath).toLowerCase();
+    if (!SCAN_EXTS.has(ext)) continue;
+    let content;
+    try { content = fs.readFileSync(filePath, 'utf8'); } catch (_) { continue; }
+
+    if (ext === '.py') collectMatches(PY_RE, content, fromCode);
+    else if (ext === '.rb') collectMatches(RB_RE, content, fromCode);
+    else if (ext === '.go') collectMatches(GO_RE, content, fromCode);
+    else collectMatches(JS_RE, content, fromCode);
+  }
+
+  const fromExample = readExampleKeys(cwd);
+  const all = new Set([...fromCode, ...fromExample]);
+  if (all.size === 0) return '';
+
+  const names = [...all].sort();
+  const lines = [
+    '| Variable | Source |',
+    '|----------|--------|',
+  ];
+  for (const name of names.slice(0, MAX_ROWS)) {
+    const src = [];
+    if (fromCode.has(name)) src.push('code');
+    if (fromExample.has(name)) src.push('.env.example');
+    lines.push(`| ${name} | ${src.join(', ')} |`);
+  }
+  if (names.length > MAX_ROWS) {
+    lines.push(`| … | +${names.length - MAX_ROWS} more |`);
+  }
+  return lines.join('\n');
+}
+
+module.exports = { analyze };