sigmap 7.31.0 → 8.1.0

package/gen-project-map.js

@@ -127,9 +127,13 @@ function formatOutput(sections) {
   ];
 
   const parts = [
-    { key: 'imports',   header: '### Import graph',      content: sections.imports },
-    { key: 'classes',   header: '### Class hierarchy',   content: sections.classes },
-    { key: 'routes',    header: '### Route table',       content: sections.routes  },
+    { key: 'imports',    header: '### Import graph',         content: sections.imports },
+    { key: 'classes',    header: '### Class hierarchy',      content: sections.classes },
+    { key: 'routes',     header: '### Route table',          content: sections.routes  },
+    { key: 'env',        header: '### Environment variables', content: sections.env },
+    { key: 'buildci',    header: '### Build & CI',           content: sections.buildci },
+    { key: 'manifests',  header: '### Config & manifests',   content: sections.manifests },
+    { key: 'migrations', header: '### Database migrations',  content: sections.migrations },
   ];
 
   for (const { header, content } of parts) {
@@ -165,9 +169,13 @@ function main() {
   }
 
   const sections = {
-    imports: runAnalyzer('import-graph',     files, cwd),
-    classes: runAnalyzer('class-hierarchy',  files, cwd),
-    routes:  runAnalyzer('route-table',      files, cwd),
+    imports:    runAnalyzer('import-graph',    files, cwd),
+    classes:    runAnalyzer('class-hierarchy', files, cwd),
+    routes:     runAnalyzer('route-table',     files, cwd),
+    env:        runAnalyzer('env-schema',      files, cwd),
+    buildci:    runAnalyzer('build-ci',        files, cwd),
+    manifests:  runAnalyzer('config-manifest', files, cwd),
+    migrations: runAnalyzer('migrations',      files, cwd),
   };
 
   const output = formatOutput(sections);

package/llms-full.txt

@@ -11,13 +11,13 @@ ranking keeps the relevant context in scope (cutting tokens ~97% as a side
 effect), with no LLM calls, embeddings, or vector database. Works with Claude,
 Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 
-# Version: 7.31.0 | Benchmark: sigmap-v7.31-main (2026-07-02)
+# Version: 8.1.0 | Benchmark: sigmap-v8.1-main (2026-07-04)
 # Source: auto-generated from package.json, version.json, benchmarks/latest.json, src/mcp/tools.js, src/config/defaults.js
 # Regenerate: npm run generate:llms   |   Validate: npm run validate:llms
 
 ---
 
-## Core metrics (benchmark: sigmap-v7.31-main, 2026-07-02)
+## Core metrics (benchmark: sigmap-v8.1-main, 2026-07-04)
 
 | Metric | Without SigMap | With SigMap |
 |--------|----------------|-------------|

package/llms.txt

@@ -11,7 +11,7 @@ ranking keeps the relevant context in scope (cutting tokens ~97% as a side
 effect), with no LLM calls, embeddings, or vector database. Works with Claude,
 Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 
-# Version: 7.31.0 | Benchmark: sigmap-v7.31-main (2026-07-02)
+# Version: 8.1.0 | Benchmark: sigmap-v8.1-main (2026-07-04)
 # Source: auto-generated from package.json, version.json, benchmarks/latest.json, src/mcp/tools.js, src/config/defaults.js
 # Regenerate: npm run generate:llms   |   Validate: npm run validate:llms
 
@@ -23,7 +23,7 @@ Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 - No blast-radius awareness before editing a hub file — `--impact` shows every file a change touches.
 - Pasted stack traces, CI logs, and JSON bloat the prompt — `squeeze` minimizes them and enriches the top frame from the symbol index.
 
-## Core metrics (benchmark: sigmap-v7.31-main, 2026-07-02)
+## Core metrics (benchmark: sigmap-v8.1-main, 2026-07-04)
 
 - hit@5 retrieval: 86.7% vs 13.6% random baseline (6.4× lift)
 - Token reduction: 97.0% average across benchmark repos

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap",
-  "version": "7.31.0",
+  "version": "8.1.0",
   "description": "97% token reduction for AI coding. Extracts function & class signatures with TF-IDF ranking to feed only the right files to Claude, Cursor, Copilot, Aider, Windsurf, local LLMs & MCP. Zero dependencies, runs offline via npx.",
   "main": "packages/core/index.js",
   "exports": {
@@ -27,6 +27,7 @@
     "benchmark:matrix": "node scripts/run-benchmark-matrix.mjs --save --skip-clone",
     "benchmark:verify": "node scripts/run-verify-benchmark.mjs",
     "benchmark:squeeze": "node scripts/run-squeeze-benchmark.mjs --save",
+    "benchmark:test-discovery": "node scripts/run-test-discovery-benchmark.mjs --save",
     "validate:squeeze": "node scripts/run-squeeze-benchmark.mjs --gate",
     "health": "node gen-context.js --health",
     "map": "node gen-project-map.js",

package/packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap-cli",
-  "version": "7.31.0",
+  "version": "8.1.0",
   "description": "SigMap CLI wrapper — thin adapter for programmatic CLI invocation",
   "main": "index.js",
   "keywords": [

package/packages/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap-core",
-  "version": "7.31.0",
+  "version": "8.1.0",
   "description": "SigMap core library — zero-dependency code signature extraction, retrieval, and security scanning",
   "main": "index.js",
   "keywords": [

package/src/evidence/pack.js

@@ -33,7 +33,14 @@ const DEFAULT_TOP = 12;
 const GENERATED_RE = /(^|\/)(dist|build|out|vendor|node_modules)\/|\.(generated|min|bundle)\.|\.(pb|_pb)\.|\.pb\.go$|_pb2\.py$/;
 const TEST_RE = /(^|\/)(tests?|__tests__|spec|specs)\/|\.(test|spec)\.[a-z]+$|(^|\/)test_[^/]+\.py$|_test\.(go|py|rb)$/;
 const CONFIG_RE = /\.(json|ya?ml|toml|ini|conf|config|properties|env)$|(^|\/)(\.?[a-z]+rc)$|\.config\.[a-z]+$/i;
-const SECURITY_RE = /(^|\/|[._-])(auth|authn|authz|login|password|passwd|secret|credential|token|session|crypto|cipher|payment|billing|checkout|oauth|jwt|permission|acl|rbac)([._-]|\/|$)/i;
+// DB migrations: framework dirs (Rails/Alembic/Prisma), Flyway `V1__x.sql`,
+// timestamped migration files, and `*_migration.*` naming.
+const MIGRATION_RE = /(^|\/)(migrations?|alembic\/versions|prisma\/migrations)(\/|$)|(^|\/)db\/migrate\/|(^|\/)V\d+(_\d+)*__[^/]+\.(sql|java)$|(^|\/)\d{8,}[_-][^/]+\.(sql|rb|py|js|ts)$|[._-]migration[s]?[._-]/i;
+const PAYMENT_RE = /(^|\/|[._-])(payment|payments|billing|checkout|invoice|invoicing|subscription|stripe|paypal|braintree|charge|refund|payout)([._-]|\/|$)/i;
+const AUTH_RE = /(^|\/|[._-])(auth|authn|authz|login|logout|signin|signup|password|passwd|session|oauth|jwt|permission|permissions|acl|rbac|credential|credentials)([._-]|\/|$)/i;
+const SECURITY_RE = /(^|\/|[._-])(secret|secrets|crypto|cipher|encrypt|decrypt|token|signing|keystore|vault)([._-]|\/|$)/i;
+// Public API surface: `api/` dirs, `public-api`, and module barrel entrypoints.
+const PUBLIC_API_RE = /(^|\/)api(\/|$)|(^|\/)public[-_]?api(\/|$)|(^|\/)index\.(js|ts|mjs|cjs)$/i;
 
 /**
  * Split a signature's `  :start-end` line anchor from its symbol text.
@@ -51,17 +58,25 @@ function parseAnchor(sig) {
 }
 
 /**
- * Classify a file into a coarse risk label. Path-based heuristic (v1) — the
- * richer label set (C3) lands in v8.5.
+ * Classify a file into a risk label (C3, v8.5). Path-based, deterministic.
+ * Precedence is strict, most-specific-risk first: a migration touching payments
+ * is labeled `migration` (a schema change is the dominant risk), payment/auth
+ * outrank the generic `security` bucket, and `config`/`public-api` resolve
+ * before the `source` fallback. `test`/`generated` semantics are preserved so
+ * existing consumers (findRelatedTests, verifier) keep working.
  * @param {string} relPath
- * @returns {'generated'|'test'|'config'|'security'|'source'}
+ * @returns {'generated'|'test'|'migration'|'payment'|'auth'|'security'|'config'|'public-api'|'source'}
  */
 function riskLabelFor(relPath) {
   const p = relPath.replace(/\\/g, '/');
   if (GENERATED_RE.test(p)) return 'generated';
   if (TEST_RE.test(p)) return 'test';
+  if (MIGRATION_RE.test(p)) return 'migration';
+  if (PAYMENT_RE.test(p)) return 'payment';
+  if (AUTH_RE.test(p)) return 'auth';
   if (SECURITY_RE.test(p)) return 'security';
   if (CONFIG_RE.test(p)) return 'config';
+  if (PUBLIC_API_RE.test(p)) return 'public-api';
   return 'source';
 }
 
@@ -72,9 +87,28 @@ function stemOf(relPath) {
 }
 
 /**
- * Best-effort impl→test discovery (v1). Matches test files whose stem equals
- * the implementation file's stem, by common convention. Deterministic. The
- * accuracy-measured discovery (C2) lands in v8.5.
+ * Infer the implementation stem a test file targets, by stripping the
+ * conventional test affixes across languages (measured in the C2 benchmark):
+ *   foo.test.js / foo.spec.ts    → foo   (JS/TS)
+ *   test_foo.py                  → foo   (Python / pytest)
+ *   foo_test.go / foo_test.py    → foo   (Go, unittest)
+ *   FooTest.java / BarSpec.scala → Foo   (JVM, PascalCase)
+ * @param {string} relPath
+ * @returns {string}
+ */
+function testTargetStem(relPath) {
+  let s = stemOf(relPath);               // strips ext + trailing .test/.spec
+  s = s.replace(/^test[_-]/i, '');       // Python: test_foo
+  s = s.replace(/[_-]test$/i, '');       // Go / unittest: foo_test
+  s = s.replace(/(Tests?|Specs?)$/, ''); // JVM PascalCase: FooTest, BarSpec
+  return s;
+}
+
+/**
+ * Impl→test discovery (C2, v8.5). Matches test files back to their
+ * implementation by normalizing conventional test affixes, so JS/TS, Python,
+ * Go, and JVM naming conventions all resolve. Deterministic; accuracy is
+ * measured by `scripts/run-test-discovery-benchmark.mjs`.
  * @param {string} relPath
  * @param {string[]} allFiles  - universe of indexed files (relative paths)
  * @returns {string[]}
@@ -87,7 +121,7 @@ function findRelatedTests(relPath, allFiles) {
   for (const f of allFiles) {
     if (f === relPath) continue;
     if (riskLabelFor(f) !== 'test') continue;
-    if (stemOf(f).toLowerCase() === stem) out.push(f);
+    if (testTargetStem(f).toLowerCase() === stem) out.push(f);
   }
   return out.sort();
 }

package/src/map/build-ci.js

@@ -0,0 +1,91 @@
+'use strict';
+
+/**
+ * Build & CI extractor (v8.5 C1).
+ *
+ * Surfaces how the project is built and validated: npm/pnpm/yarn scripts
+ * (package.json), GitHub Actions workflows (.github/workflows/*.yml), and
+ * Makefile targets. Pure, zero-dependency, deterministic.
+ *
+ * @param {string[]} files — absolute file paths (unused; roots are read directly)
+ * @param {string}   cwd   — project root
+ * @returns {string} formatted markdown table (empty string if none found)
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+const MAX_ROWS = 120;
+
+function readJson(p) {
+  try { return JSON.parse(fs.readFileSync(p, 'utf8')); } catch (_) { return null; }
+}
+
+function npmScripts(cwd, rows) {
+  const pkg = readJson(path.join(cwd, 'package.json'));
+  if (!pkg || !pkg.scripts || typeof pkg.scripts !== 'object') return;
+  for (const name of Object.keys(pkg.scripts).sort()) {
+    rows.push({ kind: 'script', name, detail: 'npm run ' + name });
+  }
+}
+
+function ciWorkflows(cwd, rows) {
+  const dir = path.join(cwd, '.github', 'workflows');
+  let entries;
+  try { entries = fs.readdirSync(dir); } catch (_) { return; }
+  for (const file of entries.sort()) {
+    if (!/\.ya?ml$/i.test(file)) continue;
+    let content;
+    try { content = fs.readFileSync(path.join(dir, file), 'utf8'); } catch (_) { continue; }
+    const nameMatch = content.match(/^name:\s*(.+)$/m);
+    const name = nameMatch ? nameMatch[1].trim().replace(/^['"]|['"]$/g, '') : file;
+    // Trigger events from an `on:` mapping or inline form.
+    const onMatch = content.match(/^on:\s*(.*)$/m);
+    let triggers = '';
+    if (onMatch) {
+      if (onMatch[1].trim()) {
+        triggers = onMatch[1].replace(/[[\]{}'"]/g, '').trim();
+      } else {
+        const block = content.slice(onMatch.index);
+        const events = [...block.matchAll(/^\s{2,}([a-z_]+):/gm)].map((m) => m[1]);
+        triggers = [...new Set(events)].slice(0, 6).join(', ');
+      }
+    }
+    rows.push({ kind: 'ci', name, detail: `${file}${triggers ? ' — ' + triggers : ''}` });
+  }
+}
+
+function makeTargets(cwd, rows) {
+  let content;
+  try { content = fs.readFileSync(path.join(cwd, 'Makefile'), 'utf8'); } catch (_) { return; }
+  const targets = [];
+  for (const line of content.split('\n')) {
+    const m = line.match(/^([a-zA-Z0-9_][a-zA-Z0-9_.-]*)\s*:(?!=)/);
+    if (m && m[1] !== '.PHONY') targets.push(m[1]);
+  }
+  for (const t of [...new Set(targets)].sort()) {
+    rows.push({ kind: 'make', name: t, detail: 'make ' + t });
+  }
+}
+
+function analyze(files, cwd) {
+  const rows = [];
+  npmScripts(cwd, rows);
+  ciWorkflows(cwd, rows);
+  makeTargets(cwd, rows);
+  if (rows.length === 0) return '';
+
+  const lines = [
+    '| Kind | Name | Detail |',
+    '|------|------|--------|',
+  ];
+  for (const r of rows.slice(0, MAX_ROWS)) {
+    lines.push(`| ${r.kind} | ${r.name} | ${r.detail} |`);
+  }
+  if (rows.length > MAX_ROWS) {
+    lines.push(`| … | | +${rows.length - MAX_ROWS} more |`);
+  }
+  return lines.join('\n');
+}
+
+module.exports = { analyze };

package/src/map/config-manifest.js

@@ -0,0 +1,101 @@
+'use strict';
+
+/**
+ * Config & package-manifest extractor (v8.5 C1).
+ *
+ * Surfaces the project's package manifests (name / version / dependency counts)
+ * across ecosystems and the notable root config files present. Pure,
+ * zero-dependency, deterministic.
+ *
+ * @param {string[]} files — absolute file paths (unused; roots are read directly)
+ * @param {string}   cwd   — project root
+ * @returns {string} formatted markdown table (empty string if none found)
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+const CONFIG_FILES = [
+  'tsconfig.json', 'jsconfig.json', '.eslintrc', '.eslintrc.json', '.eslintrc.js',
+  '.prettierrc', 'babel.config.js', 'jest.config.js', 'vitest.config.ts',
+  'webpack.config.js', 'vite.config.ts', 'rollup.config.js', 'tailwind.config.js',
+  'docker-compose.yml', 'docker-compose.yaml', 'Dockerfile', '.editorconfig',
+];
+
+function readText(p) { try { return fs.readFileSync(p, 'utf8'); } catch (_) { return null; } }
+function readJson(p) { try { return JSON.parse(fs.readFileSync(p, 'utf8')); } catch (_) { return null; } }
+function count(obj) { return obj && typeof obj === 'object' ? Object.keys(obj).length : 0; }
+
+function manifests(cwd, rows) {
+  const pkg = readJson(path.join(cwd, 'package.json'));
+  if (pkg) {
+    const deps = count(pkg.dependencies);
+    const dev = count(pkg.devDependencies);
+    const id = [pkg.name, pkg.version].filter(Boolean).join('@') || 'package.json';
+    rows.push({ manifest: 'package.json (npm)', detail: `${id} · ${deps} deps, ${dev} devDeps` });
+  }
+
+  const pyproject = readText(path.join(cwd, 'pyproject.toml'));
+  if (pyproject) {
+    const name = (pyproject.match(/^\s*name\s*=\s*["']([^"']+)["']/m) || [])[1];
+    const ver = (pyproject.match(/^\s*version\s*=\s*["']([^"']+)["']/m) || [])[1];
+    rows.push({ manifest: 'pyproject.toml (python)', detail: [name, ver].filter(Boolean).join('@') || 'present' });
+  } else if (readText(path.join(cwd, 'setup.py'))) {
+    rows.push({ manifest: 'setup.py (python)', detail: 'present' });
+  }
+  if (readText(path.join(cwd, 'requirements.txt'))) {
+    rows.push({ manifest: 'requirements.txt (python)', detail: 'present' });
+  }
+
+  const cargo = readText(path.join(cwd, 'Cargo.toml'));
+  if (cargo) {
+    const name = (cargo.match(/^\s*name\s*=\s*["']([^"']+)["']/m) || [])[1];
+    const ver = (cargo.match(/^\s*version\s*=\s*["']([^"']+)["']/m) || [])[1];
+    rows.push({ manifest: 'Cargo.toml (rust)', detail: [name, ver].filter(Boolean).join('@') || 'present' });
+  }
+
+  const gomod = readText(path.join(cwd, 'go.mod'));
+  if (gomod) {
+    const mod = (gomod.match(/^module\s+(\S+)/m) || [])[1];
+    const go = (gomod.match(/^go\s+(\S+)/m) || [])[1];
+    rows.push({ manifest: 'go.mod (go)', detail: [mod, go && 'go ' + go].filter(Boolean).join(' · ') || 'present' });
+  }
+
+  if (readText(path.join(cwd, 'pom.xml'))) rows.push({ manifest: 'pom.xml (maven)', detail: 'present' });
+  if (readText(path.join(cwd, 'build.gradle')) || readText(path.join(cwd, 'build.gradle.kts'))) {
+    rows.push({ manifest: 'build.gradle (gradle)', detail: 'present' });
+  }
+  if (readText(path.join(cwd, 'Gemfile'))) rows.push({ manifest: 'Gemfile (ruby)', detail: 'present' });
+  const composer = readJson(path.join(cwd, 'composer.json'));
+  if (composer) {
+    rows.push({ manifest: 'composer.json (php)', detail: `${composer.name || 'present'} · ${count(composer.require)} deps` });
+  }
+}
+
+function configFiles(cwd) {
+  const present = [];
+  for (const f of CONFIG_FILES) {
+    if (fs.existsSync(path.join(cwd, f))) present.push(f);
+  }
+  return present;
+}
+
+function analyze(files, cwd) {
+  const rows = [];
+  manifests(cwd, rows);
+  const configs = configFiles(cwd);
+  if (rows.length === 0 && configs.length === 0) return '';
+
+  const lines = [];
+  if (rows.length) {
+    lines.push('| Manifest | Detail |', '|----------|--------|');
+    for (const r of rows) lines.push(`| ${r.manifest} | ${r.detail} |`);
+  }
+  if (configs.length) {
+    if (lines.length) lines.push('');
+    lines.push(`**Config files:** ${configs.map((c) => '`' + c + '`').join(', ')}`);
+  }
+  return lines.join('\n');
+}
+
+module.exports = { analyze };

package/src/map/env-schema.js

@@ -0,0 +1,90 @@
+'use strict';
+
+/**
+ * Environment-variable schema extractor (v8.5 C1).
+ *
+ * Surfaces the environment the project actually reads — from source across
+ * JS/TS, Python, Ruby, and Go, plus keys declared in a committed `.env.example`
+ * / `.env.sample` / `.env.template`. Pure, zero-dependency, deterministic.
+ *
+ * @param {string[]} files — absolute file paths to analyze (srcDirs-scoped)
+ * @param {string}   cwd   — project root
+ * @returns {string} formatted markdown table (empty string if none found)
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+const SCAN_EXTS = new Set(['.js', '.jsx', '.ts', '.tsx', '.mjs', '.cjs', '.py', '.rb', '.go']);
+const EXAMPLE_FILES = ['.env.example', '.env.sample', '.env.template', '.env.dist'];
+
+// process.env.X / process.env['X'] / import.meta.env.X / Deno.env.get('X')
+const JS_RE = /(?:process\.env|import\.meta\.env)(?:\.([A-Z_][A-Z0-9_]*)|\[\s*['"]([A-Z_][A-Z0-9_]*)['"]\s*\])|Deno\.env\.get\(\s*['"]([A-Z_][A-Z0-9_]*)['"]/g;
+// os.environ['X'] / os.environ.get('X') / os.getenv('X') / getenv('X')
+const PY_RE = /(?:os\.)?(?:environ(?:\.get)?\[?\s*['"]([A-Z_][A-Z0-9_]*)['"]|getenv\(\s*['"]([A-Z_][A-Z0-9_]*)['"])/g;
+const RB_RE = /ENV\[\s*['"]([A-Z_][A-Z0-9_]*)['"]\s*\]/g;
+const GO_RE = /os\.(?:Getenv|LookupEnv)\(\s*["`']([A-Z_][A-Z0-9_]*)["`']/g;
+
+const MAX_ROWS = 200;
+
+function collectMatches(re, content, into) {
+  let m;
+  re.lastIndex = 0;
+  while ((m = re.exec(content)) !== null) {
+    const name = m[1] || m[2] || m[3];
+    if (name) into.add(name);
+  }
+}
+
+function readExampleKeys(cwd) {
+  const keys = new Set();
+  for (const name of EXAMPLE_FILES) {
+    let content;
+    try { content = fs.readFileSync(path.join(cwd, name), 'utf8'); } catch (_) { continue; }
+    for (const line of content.split('\n')) {
+      const t = line.trim();
+      if (!t || t.startsWith('#')) continue;
+      const eq = t.match(/^(?:export\s+)?([A-Z_][A-Z0-9_]*)\s*=/);
+      if (eq) keys.add(eq[1]);
+    }
+  }
+  return keys;
+}
+
+function analyze(files, cwd) {
+  const fromCode = new Set();
+
+  for (const filePath of files) {
+    const ext = path.extname(filePath).toLowerCase();
+    if (!SCAN_EXTS.has(ext)) continue;
+    let content;
+    try { content = fs.readFileSync(filePath, 'utf8'); } catch (_) { continue; }
+
+    if (ext === '.py') collectMatches(PY_RE, content, fromCode);
+    else if (ext === '.rb') collectMatches(RB_RE, content, fromCode);
+    else if (ext === '.go') collectMatches(GO_RE, content, fromCode);
+    else collectMatches(JS_RE, content, fromCode);
+  }
+
+  const fromExample = readExampleKeys(cwd);
+  const all = new Set([...fromCode, ...fromExample]);
+  if (all.size === 0) return '';
+
+  const names = [...all].sort();
+  const lines = [
+    '| Variable | Source |',
+    '|----------|--------|',
+  ];
+  for (const name of names.slice(0, MAX_ROWS)) {
+    const src = [];
+    if (fromCode.has(name)) src.push('code');
+    if (fromExample.has(name)) src.push('.env.example');
+    lines.push(`| ${name} | ${src.join(', ')} |`);
+  }
+  if (names.length > MAX_ROWS) {
+    lines.push(`| … | +${names.length - MAX_ROWS} more |`);
+  }
+  return lines.join('\n');
+}
+
+module.exports = { analyze };

package/src/map/migrations.js

@@ -0,0 +1,84 @@
+'use strict';
+
+/**
+ * Database-migration extractor (v8.5 C1).
+ *
+ * Detects schema-migration files across the common frameworks — Rails
+ * (db/migrate), Django/Alembic, Prisma, Flyway (`V1__name.sql`), knex/Sequelize,
+ * and timestamped SQL — and surfaces them with a parsed version + name. Pure,
+ * zero-dependency, deterministic.
+ *
+ * @param {string[]} files — absolute file paths (unused; the tree is walked)
+ * @param {string}   cwd   — project root
+ * @returns {string} formatted markdown table (empty string if none found)
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+const MAX_DEPTH = 6;
+const MAX_ROWS = 200;
+const SKIP_DIR = new Set(['.git', 'node_modules', 'vendor', 'dist', 'build', 'target', '.venv', 'venv', '__pycache__']);
+const MIG_EXT = new Set(['.sql', '.rb', '.py', '.js', '.ts']);
+
+// A directory whose path marks its children as migrations.
+const MIG_DIR_RE = /(^|\/)(db\/migrate|migrations?|alembic\/versions|prisma\/migrations)$/i;
+// A filename that is itself a migration regardless of directory.
+const FLYWAY_RE = /^V\d+(?:[._]\d+)*__(.+)\.(sql|java)$/;
+const TIMESTAMP_RE = /^(\d{8,})[_-](.+)\.(sql|rb|py|js|ts)$/;
+const NAMED_RE = /[._-]migrations?[._-]/i;
+
+function walk(dir, cwd, depth, out) {
+  if (depth > MAX_DEPTH) return;
+  let entries;
+  try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch (_) { return; }
+  entries.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
+
+  const relDir = path.relative(cwd, dir).replace(/\\/g, '/');
+  const dirIsMigration = MIG_DIR_RE.test(relDir);
+
+  for (const e of entries) {
+    if (e.isDirectory()) {
+      if (SKIP_DIR.has(e.name)) continue;
+      walk(path.join(dir, e.name), cwd, depth + 1, out);
+      continue;
+    }
+    const ext = path.extname(e.name).toLowerCase();
+    if (!MIG_EXT.has(ext)) continue;
+
+    const rel = path.relative(cwd, path.join(dir, e.name)).replace(/\\/g, '/');
+    let version = null;
+    let name = null;
+
+    let m;
+    if ((m = e.name.match(FLYWAY_RE))) { version = e.name.split('__')[0]; name = m[1].replace(/_/g, ' '); }
+    else if ((m = e.name.match(TIMESTAMP_RE))) { version = m[1]; name = m[2].replace(/[_-]/g, ' '); }
+    else if (dirIsMigration) { version = '—'; name = e.name.replace(ext, ''); }
+    else if (NAMED_RE.test(e.name)) { version = '—'; name = e.name.replace(ext, ''); }
+    else continue;
+
+    out.push({ version, name, file: rel });
+  }
+}
+
+function analyze(files, cwd) {
+  const found = [];
+  walk(cwd, cwd, 0, found);
+  if (found.length === 0) return '';
+
+  found.sort((a, b) => (a.file < b.file ? -1 : a.file > b.file ? 1 : 0));
+
+  const lines = [
+    '| Version | Migration | File |',
+    '|---------|-----------|------|',
+  ];
+  for (const r of found.slice(0, MAX_ROWS)) {
+    lines.push(`| ${r.version} | ${r.name} | ${r.file} |`);
+  }
+  if (found.length > MAX_ROWS) {
+    lines.push(`| … | +${found.length - MAX_ROWS} more | |`);
+  }
+  return lines.join('\n');
+}
+
+module.exports = { analyze };

package/src/mcp/handlers.js

@@ -21,6 +21,10 @@ const MAP_SECTIONS = {
   imports: '### Import graph',
   classes: '### Class hierarchy',
   routes: '### Route table',
+  env: '### Environment variables',
+  buildci: '### Build & CI',
+  manifests: '### Config & manifests',
+  migrations: '### Database migrations',
 };
 
 /**
@@ -106,7 +110,7 @@ function getMap(args, cwd) {
 
   const header = MAP_SECTIONS[args.type];
   if (!header) {
-    return `Unknown map type: "${args.type}". Use: imports, classes, routes`;
+    return `Unknown map type: "${args.type}". Use: ${Object.keys(MAP_SECTIONS).join(', ')}`;
   }
 
   const mapPath = path.join(cwd, 'PROJECT_MAP.md');

package/src/mcp/server.js

@@ -18,7 +18,7 @@ const { readContext, searchSignatures, getMap, createCheckpoint, getRouting, exp
 
 const SERVER_INFO = {
   name: 'sigmap',
-  version: '7.31.0',
+  version: '8.1.0',
   description: 'SigMap MCP server — code signatures on demand',
 };
 

package/src/verify/hallucination-guard.js

@@ -21,6 +21,7 @@ const fs = require('fs');
 const path = require('path');
 const parsers = require('./parsers');
 const { closestMatch, buildSymbolCandidates, formatSuggestion } = require('./closest-match');
+const { buildLibraryIndex } = require('./lib-index');
 
 // A path that looks like a test file (JS/TS spec/test, Python test_/_test, or
 // a tests/__tests__ directory). Used to flag fake-test-file separately.
@@ -189,6 +190,28 @@ function verify(answerText, cwd, opts = {}) {
   }
   if (!fileBasenames) fileBasenames = new Set();
 
+  // Installed-library grounding (G5/D5, the moat): union the exported symbols of
+  // the libraries actually installed in node_modules, so genuine library calls
+  // stop false-flagging as fake-symbol and the summary can pin the versions the
+  // answer was verified against. Auto-runs only when the caller did not override
+  // the symbol set (keeps hermetic callers unchanged); disable with libIndex:false.
+  let libraries = opts.libraries || [];
+  {
+    let libSyms = opts.libSymbols;
+    if (!libSyms && opts.libIndex !== false && !opts.symbolSet) {
+      try {
+        const li = buildLibraryIndex(cwd, { version: opts.version });
+        libSyms = li.symbols;
+        if (!opts.libraries) libraries = li.libraries;
+      } catch (_) { libSyms = null; }
+    }
+    if (libSyms && libSyms.size) {
+      const merged = new Set(symbolSet);
+      for (const s of libSyms) merged.add(s);
+      symbolSet = merged;
+    }
+  }
+
   let deps = opts.deps;
   let hasPkg = opts.hasPkg;
   if (!deps) {
@@ -312,6 +335,8 @@ function verify(answerText, cwd, opts = {}) {
     clean: issues.length === 0,
     symbolsIndexed: symbolSet.size,
     withSuggestion: issues.filter((i) => i.suggestion).length,
+    librariesIndexed: libraries.length,
+    libraries: libraries.map((l) => ({ name: l.name, version: l.version, symbols: l.symbols, typed: l.typed })),
   };
 
   return { issues, summary };