sigmap 8.0.0 → 8.1.0

package/CHANGELOG.md

@@ -10,6 +10,14 @@ Format: [Semantic Versioning](https://semver.org/)
 
 ---
 
+## [8.1.0] — 2026-07-04
+
+Minor release — **v9.0 G5/D5: the local-library signature index (the private-API grounding moat, v1).** SigMap's hallucination guard can now verify AI suggestions against the libraries **actually installed** in `node_modules`, not just declared dependency *names*. This is a capability no competitor offers — Context7 knows only *public* library docs; SigMap grounds against the real installed tree. Local, zero-dependency, deterministic (byte-stable given a fixed installed tree).
+
+### Added
+- **Local-library signature index (#405, PR #406):** new `src/verify/lib-index.js` — `buildLibraryIndex(cwd)` resolves the **direct** dependencies declared in `package.json`, locates each under `node_modules/<dep>`, reads its version (**D8 version pinning**) and TypeScript declaration entry (`types`/`typings`, else `index.d.ts`), and deterministically extracts the exported symbol names. Bounded (per-file + dep caps), cached via `src/cache/sig-cache.js`, and graceful on missing/untyped/malformed packages.
+- **Installed-library grounding in `verify-ai-output`:** `verify()` now unions installed-library symbols into its known-symbol universe, so genuine library calls (e.g. `Router()`, `debounce()`) stop being false-flagged as `fake-symbol`. The result summary gains `librariesIndexed` and `libraries` (`name@version`, D8). Auto-runs from the project's `node_modules`; opt-out via `libIndex:false`. Scope v1 is JS/TS `.d.ts`; Python site-packages and a standalone `verify_suggestion` MCP tool are deferred to a follow-up.
+
 ## [8.0.0] — 2026-07-04
 
 Major release — **v8.5 "Repo-Context Coverage & Test Discovery" (C1 + C2 + C3).** Marks the v8 milestone: the signature map now reaches beyond functions/classes/routes into the repo's operational surface, impl→test discovery is measured rather than best-effort, and every Evidence Pack file carries a risk label from a richer, precedence-ordered set. All zero-dependency, deterministic, and in-boundary with the North-Star constraints. **No breaking API changes** — the `8.0.0` bump aligns the published version with the roadmap's v8 framing; existing `riskLabel`/`relatedTests` consumers keep working.

package/README.md

@@ -98,7 +98,7 @@ Ask → Rank → Context → Validate → Judge → Learn
 
 <!--SM:benchmarkBlock-->
 ```
-Benchmark : sigmap-v8.0-main (21 repositories, including R language)
+Benchmark : sigmap-v8.1-main (21 repositories, including R language)
 Date      : 2026-07-04
 
 Hit@5          : 86.7%   (baseline 13.6%  — 6.4× lift)

package/gen-context.js

@@ -13063,7 +13063,7 @@ __factories["./src/mcp/server"] = function(module, exports) {
 
   const SERVER_INFO = {
     name: 'sigmap',
-    version: '8.0.0',
+    version: '8.1.0',
     description: 'SigMap MCP server — code signatures on demand',
   };
 
@@ -16403,6 +16403,7 @@ __factories["./src/verify/hallucination-guard"] = function(module, exports) {
   const path = require('path');
   const parsers = __require('./src/verify/parsers');
   const { closestMatch, buildSymbolCandidates, formatSuggestion } = __require('./src/verify/closest-match');
+  const { buildLibraryIndex } = __require('./src/verify/lib-index');
 
   // A path that looks like a test file (JS/TS spec/test, Python test_/_test, or
   // a tests/__tests__ directory). Used to flag fake-test-file separately.
@@ -16571,6 +16572,28 @@ __factories["./src/verify/hallucination-guard"] = function(module, exports) {
     }
     if (!fileBasenames) fileBasenames = new Set();
 
+    // Installed-library grounding (G5/D5, the moat): union the exported symbols of
+    // the libraries actually installed in node_modules, so genuine library calls
+    // stop false-flagging as fake-symbol and the summary can pin the versions the
+    // answer was verified against. Auto-runs only when the caller did not override
+    // the symbol set (keeps hermetic callers unchanged); disable with libIndex:false.
+    let libraries = opts.libraries || [];
+    {
+      let libSyms = opts.libSymbols;
+      if (!libSyms && opts.libIndex !== false && !opts.symbolSet) {
+        try {
+          const li = buildLibraryIndex(cwd, { version: opts.version });
+          libSyms = li.symbols;
+          if (!opts.libraries) libraries = li.libraries;
+        } catch (_) { libSyms = null; }
+      }
+      if (libSyms && libSyms.size) {
+        const merged = new Set(symbolSet);
+        for (const s of libSyms) merged.add(s);
+        symbolSet = merged;
+      }
+    }
+
     let deps = opts.deps;
     let hasPkg = opts.hasPkg;
     if (!deps) {
@@ -16694,6 +16717,8 @@ __factories["./src/verify/hallucination-guard"] = function(module, exports) {
       clean: issues.length === 0,
       symbolsIndexed: symbolSet.size,
       withSuggestion: issues.filter((i) => i.suggestion).length,
+      librariesIndexed: libraries.length,
+      libraries: libraries.map((l) => ({ name: l.name, version: l.version, symbols: l.symbols, typed: l.typed })),
     };
 
     return { issues, summary };
@@ -16703,6 +16728,174 @@ __factories["./src/verify/hallucination-guard"] = function(module, exports) {
   
 };
 
+// ── ./src/verify/lib-index ──
+__factories["./src/verify/lib-index"] = function(module, exports) {
+  
+  /**
+   * Local-library signature index (v9.0 G5/D5 — the private-API grounding moat).
+   *
+   * Context7 knows only *public* library docs. SigMap can do something no
+   * competitor can: index the signatures of the libraries **actually installed**
+   * in `node_modules` and verify AI suggestions against repo + private +
+   * installed-lib symbols. This module builds the installed-lib half.
+   *
+   * For each **direct** dependency declared in `package.json`, it locates the
+   * package under `node_modules/<dep>`, reads its version (D8 version pinning),
+   * and extracts the exported symbol names from its TypeScript declaration entry
+   * (`types`/`typings`, else `index.d.ts`). Pure, zero-dependency, deterministic:
+   * byte-stable given a fixed installed tree. Bounded (per-file read cap + dep
+   * cap) and cached via `src/cache/sig-cache.js` so repeat builds are near-free.
+   */
+
+  const fs = require('fs');
+  const path = require('path');
+  const { loadCache, saveCache, getChangedFiles, updateCacheEntries } = __require('./src/cache/sig-cache');
+
+  const MAX_DTS_BYTES = 512 * 1024; // per-file read cap
+  const MAX_DEPS = 1000;            // dep count cap
+  const DEP_KEYS = ['dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies'];
+
+  /**
+   * Extract exported symbol names from a `.d.ts` declaration file. Deterministic,
+   * regex-based (declaration files are already normalized, so this is robust
+   * without a full TS parser and stays zero-dependency).
+   * @param {string} src
+   * @returns {string[]} sorted unique exported names
+   */
+  function extractDtsExports(src) {
+    const names = new Set();
+    if (!src) return [];
+
+    // export [declare] [default] function|const|let|var|class|interface|type|enum|namespace Name
+    const declRe = /\bexport\s+(?:declare\s+)?(?:default\s+)?(?:abstract\s+)?(?:async\s+)?(?:function|const|let|var|class|interface|type|enum|namespace|module)\s+([A-Za-z_$][\w$]*)/g;
+    let m;
+    while ((m = declRe.exec(src)) !== null) names.add(m[1]);
+
+    // export { a, b as c, default as d }
+    const listRe = /\bexport\s*(?:type\s*)?\{([^}]*)\}/g;
+    while ((m = listRe.exec(src)) !== null) {
+      for (const part of m[1].split(',')) {
+        const name = part.trim().split(/\s+as\s+/).pop().trim();
+        if (/^[A-Za-z_$][\w$]*$/.test(name) && name !== 'default') names.add(name);
+      }
+    }
+
+    // export as namespace Name  /  export = Name
+    const nsRe = /\bexport\s+as\s+namespace\s+([A-Za-z_$][\w$]*)/g;
+    while ((m = nsRe.exec(src)) !== null) names.add(m[1]);
+    const assignRe = /\bexport\s*=\s*([A-Za-z_$][\w$]*)/g;
+    while ((m = assignRe.exec(src)) !== null) names.add(m[1]);
+
+    return [...names].sort();
+  }
+
+  /** Read direct dependency names declared in the project's package.json. */
+  function directDeps(cwd) {
+    const names = new Set();
+    try {
+      const pkg = JSON.parse(fs.readFileSync(path.join(cwd, 'package.json'), 'utf8'));
+      for (const k of DEP_KEYS) {
+        if (pkg[k] && typeof pkg[k] === 'object') {
+          for (const n of Object.keys(pkg[k])) names.add(n);
+        }
+      }
+    } catch (_) { /* no/invalid package.json → no deps */ }
+    return [...names].sort();
+  }
+
+  /**
+   * Resolve an installed dependency's version + entry `.d.ts` path.
+   * @returns {{ version: string|null, dtsPath: string|null }|null} null if not installed
+   */
+  function resolveEntry(cwd, dep) {
+    const pkgDir = path.join(cwd, 'node_modules', dep);
+    let pkg;
+    try { pkg = JSON.parse(fs.readFileSync(path.join(pkgDir, 'package.json'), 'utf8')); } catch (_) { return null; }
+    const version = typeof pkg.version === 'string' ? pkg.version : null;
+
+    const candidates = [];
+    const typesField = pkg.types || pkg.typings;
+    if (typeof typesField === 'string') {
+      candidates.push(typesField);
+      candidates.push(path.join(typesField, 'index.d.ts')); // typesField may be a dir
+    }
+    candidates.push('index.d.ts');
+    if (typeof pkg.main === 'string') candidates.push(pkg.main.replace(/\.(js|cjs|mjs)$/, '.d.ts'));
+
+    for (const c of candidates) {
+      const p = path.join(pkgDir, c);
+      try { if (fs.statSync(p).isFile()) return { version, dtsPath: p }; } catch (_) { /* next */ }
+    }
+    return { version, dtsPath: null }; // installed but untyped
+  }
+
+  /**
+   * Build the installed-library signature index for `cwd`.
+   *
+   * @param {string} cwd
+   * @param {object} [opts]
+   * @param {string} [opts.version='0']  sigmap version, for cache busting
+   * @param {boolean} [opts.cache=true]  use the on-disk sig-cache
+   * @returns {{ symbols: Set<string>, libraries: Array<{name,version,symbols,typed}>, count: number }}
+   */
+  function buildLibraryIndex(cwd, opts = {}) {
+    const version = opts.version || '0';
+    const useCache = opts.cache !== false;
+    const deps = directDeps(cwd).slice(0, MAX_DEPS);
+
+    const entries = [];
+    for (const dep of deps) {
+      const r = resolveEntry(cwd, dep);
+      if (r) entries.push({ dep, version: r.version, dtsPath: r.dtsPath });
+    }
+
+    const cache = useCache ? loadCache(cwd, version) : new Map();
+    const dtsFiles = entries.filter((e) => e.dtsPath).map((e) => e.dtsPath);
+    const { unchanged } = getChangedFiles(dtsFiles, cache);
+    const unchangedSet = new Set(unchanged);
+
+    const symbols = new Set();
+    const libraries = [];
+    const fresh = [];
+
+    for (const e of entries) {
+      let names;
+      if (!e.dtsPath) {
+        names = [];
+      } else if (unchangedSet.has(e.dtsPath) && cache.get(e.dtsPath)) {
+        names = cache.get(e.dtsPath).sigs || [];
+      } else {
+        let src = '';
+        try {
+          if (fs.statSync(e.dtsPath).size <= MAX_DTS_BYTES) src = fs.readFileSync(e.dtsPath, 'utf8');
+        } catch (_) { /* unreadable → empty */ }
+        names = extractDtsExports(src);
+        fresh.push({ file: e.dtsPath, sigs: names });
+      }
+      for (const n of names) symbols.add(n);
+      libraries.push({ name: e.dep, version: e.version, symbols: names.length, typed: !!e.dtsPath });
+    }
+
+    if (useCache && fresh.length) {
+      updateCacheEntries(cache, fresh);
+      saveCache(cwd, version, cache);
+    }
+
+    libraries.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
+    return { symbols, libraries, count: symbols.size };
+  }
+
+  /** D8: render `name@version` pins for the typed/installed libraries. */
+  function formatVersionPins(libraries) {
+    return (libraries || [])
+      .filter((l) => l.version)
+      .map((l) => `${l.name}@${l.version}`);
+  }
+
+  module.exports = { buildLibraryIndex, extractDtsExports, directDeps, resolveEntry, formatVersionPins };
+  
+};
+
 // ── ./src/verify/parsers ──
 __factories["./src/verify/parsers"] = function(module, exports) {
   
@@ -17032,7 +17225,7 @@ function __tryGit(args, opts = {}) {
   catch (_) { return ''; }
 }
 
-const VERSION = '8.0.0';
+const VERSION = '8.1.0';
 const MARKER = '\n\n## Auto-generated signatures\n<!-- Updated by gen-context.js -->\n';
 
 function requireSourceOrBundled(key) {

package/llms-full.txt

@@ -11,13 +11,13 @@ ranking keeps the relevant context in scope (cutting tokens ~97% as a side
 effect), with no LLM calls, embeddings, or vector database. Works with Claude,
 Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 
-# Version: 8.0.0 | Benchmark: sigmap-v8.0-main (2026-07-04)
+# Version: 8.1.0 | Benchmark: sigmap-v8.1-main (2026-07-04)
 # Source: auto-generated from package.json, version.json, benchmarks/latest.json, src/mcp/tools.js, src/config/defaults.js
 # Regenerate: npm run generate:llms   |   Validate: npm run validate:llms
 
 ---
 
-## Core metrics (benchmark: sigmap-v8.0-main, 2026-07-04)
+## Core metrics (benchmark: sigmap-v8.1-main, 2026-07-04)
 
 | Metric | Without SigMap | With SigMap |
 |--------|----------------|-------------|

package/llms.txt

@@ -11,7 +11,7 @@ ranking keeps the relevant context in scope (cutting tokens ~97% as a side
 effect), with no LLM calls, embeddings, or vector database. Works with Claude,
 Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 
-# Version: 8.0.0 | Benchmark: sigmap-v8.0-main (2026-07-04)
+# Version: 8.1.0 | Benchmark: sigmap-v8.1-main (2026-07-04)
 # Source: auto-generated from package.json, version.json, benchmarks/latest.json, src/mcp/tools.js, src/config/defaults.js
 # Regenerate: npm run generate:llms   |   Validate: npm run validate:llms
 
@@ -23,7 +23,7 @@ Cursor, GitHub Copilot, Aider, Windsurf, local LLMs, and MCP.
 - No blast-radius awareness before editing a hub file — `--impact` shows every file a change touches.
 - Pasted stack traces, CI logs, and JSON bloat the prompt — `squeeze` minimizes them and enriches the top frame from the symbol index.
 
-## Core metrics (benchmark: sigmap-v8.0-main, 2026-07-04)
+## Core metrics (benchmark: sigmap-v8.1-main, 2026-07-04)
 
 - hit@5 retrieval: 86.7% vs 13.6% random baseline (6.4× lift)
 - Token reduction: 97.0% average across benchmark repos

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap",
-  "version": "8.0.0",
+  "version": "8.1.0",
   "description": "97% token reduction for AI coding. Extracts function & class signatures with TF-IDF ranking to feed only the right files to Claude, Cursor, Copilot, Aider, Windsurf, local LLMs & MCP. Zero dependencies, runs offline via npx.",
   "main": "packages/core/index.js",
   "exports": {

package/packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap-cli",
-  "version": "8.0.0",
+  "version": "8.1.0",
   "description": "SigMap CLI wrapper — thin adapter for programmatic CLI invocation",
   "main": "index.js",
   "keywords": [

package/packages/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigmap-core",
-  "version": "8.0.0",
+  "version": "8.1.0",
   "description": "SigMap core library — zero-dependency code signature extraction, retrieval, and security scanning",
   "main": "index.js",
   "keywords": [

package/src/mcp/server.js

@@ -18,7 +18,7 @@ const { readContext, searchSignatures, getMap, createCheckpoint, getRouting, exp
 
 const SERVER_INFO = {
   name: 'sigmap',
-  version: '8.0.0',
+  version: '8.1.0',
   description: 'SigMap MCP server — code signatures on demand',
 };
 

package/src/verify/hallucination-guard.js

@@ -21,6 +21,7 @@ const fs = require('fs');
 const path = require('path');
 const parsers = require('./parsers');
 const { closestMatch, buildSymbolCandidates, formatSuggestion } = require('./closest-match');
+const { buildLibraryIndex } = require('./lib-index');
 
 // A path that looks like a test file (JS/TS spec/test, Python test_/_test, or
 // a tests/__tests__ directory). Used to flag fake-test-file separately.
@@ -189,6 +190,28 @@ function verify(answerText, cwd, opts = {}) {
   }
   if (!fileBasenames) fileBasenames = new Set();
 
+  // Installed-library grounding (G5/D5, the moat): union the exported symbols of
+  // the libraries actually installed in node_modules, so genuine library calls
+  // stop false-flagging as fake-symbol and the summary can pin the versions the
+  // answer was verified against. Auto-runs only when the caller did not override
+  // the symbol set (keeps hermetic callers unchanged); disable with libIndex:false.
+  let libraries = opts.libraries || [];
+  {
+    let libSyms = opts.libSymbols;
+    if (!libSyms && opts.libIndex !== false && !opts.symbolSet) {
+      try {
+        const li = buildLibraryIndex(cwd, { version: opts.version });
+        libSyms = li.symbols;
+        if (!opts.libraries) libraries = li.libraries;
+      } catch (_) { libSyms = null; }
+    }
+    if (libSyms && libSyms.size) {
+      const merged = new Set(symbolSet);
+      for (const s of libSyms) merged.add(s);
+      symbolSet = merged;
+    }
+  }
+
   let deps = opts.deps;
   let hasPkg = opts.hasPkg;
   if (!deps) {
@@ -312,6 +335,8 @@ function verify(answerText, cwd, opts = {}) {
     clean: issues.length === 0,
     symbolsIndexed: symbolSet.size,
     withSuggestion: issues.filter((i) => i.suggestion).length,
+    librariesIndexed: libraries.length,
+    libraries: libraries.map((l) => ({ name: l.name, version: l.version, symbols: l.symbols, typed: l.typed })),
   };
 
   return { issues, summary };

package/src/verify/lib-index.js

@@ -0,0 +1,164 @@
+'use strict';
+
+/**
+ * Local-library signature index (v9.0 G5/D5 — the private-API grounding moat).
+ *
+ * Context7 knows only *public* library docs. SigMap can do something no
+ * competitor can: index the signatures of the libraries **actually installed**
+ * in `node_modules` and verify AI suggestions against repo + private +
+ * installed-lib symbols. This module builds the installed-lib half.
+ *
+ * For each **direct** dependency declared in `package.json`, it locates the
+ * package under `node_modules/<dep>`, reads its version (D8 version pinning),
+ * and extracts the exported symbol names from its TypeScript declaration entry
+ * (`types`/`typings`, else `index.d.ts`). Pure, zero-dependency, deterministic:
+ * byte-stable given a fixed installed tree. Bounded (per-file read cap + dep
+ * cap) and cached via `src/cache/sig-cache.js` so repeat builds are near-free.
+ */
+
+const fs = require('fs');
+const path = require('path');
+const { loadCache, saveCache, getChangedFiles, updateCacheEntries } = require('../cache/sig-cache');
+
+const MAX_DTS_BYTES = 512 * 1024; // per-file read cap
+const MAX_DEPS = 1000;            // dep count cap
+const DEP_KEYS = ['dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies'];
+
+/**
+ * Extract exported symbol names from a `.d.ts` declaration file. Deterministic,
+ * regex-based (declaration files are already normalized, so this is robust
+ * without a full TS parser and stays zero-dependency).
+ * @param {string} src
+ * @returns {string[]} sorted unique exported names
+ */
+function extractDtsExports(src) {
+  const names = new Set();
+  if (!src) return [];
+
+  // export [declare] [default] function|const|let|var|class|interface|type|enum|namespace Name
+  const declRe = /\bexport\s+(?:declare\s+)?(?:default\s+)?(?:abstract\s+)?(?:async\s+)?(?:function|const|let|var|class|interface|type|enum|namespace|module)\s+([A-Za-z_$][\w$]*)/g;
+  let m;
+  while ((m = declRe.exec(src)) !== null) names.add(m[1]);
+
+  // export { a, b as c, default as d }
+  const listRe = /\bexport\s*(?:type\s*)?\{([^}]*)\}/g;
+  while ((m = listRe.exec(src)) !== null) {
+    for (const part of m[1].split(',')) {
+      const name = part.trim().split(/\s+as\s+/).pop().trim();
+      if (/^[A-Za-z_$][\w$]*$/.test(name) && name !== 'default') names.add(name);
+    }
+  }
+
+  // export as namespace Name  /  export = Name
+  const nsRe = /\bexport\s+as\s+namespace\s+([A-Za-z_$][\w$]*)/g;
+  while ((m = nsRe.exec(src)) !== null) names.add(m[1]);
+  const assignRe = /\bexport\s*=\s*([A-Za-z_$][\w$]*)/g;
+  while ((m = assignRe.exec(src)) !== null) names.add(m[1]);
+
+  return [...names].sort();
+}
+
+/** Read direct dependency names declared in the project's package.json. */
+function directDeps(cwd) {
+  const names = new Set();
+  try {
+    const pkg = JSON.parse(fs.readFileSync(path.join(cwd, 'package.json'), 'utf8'));
+    for (const k of DEP_KEYS) {
+      if (pkg[k] && typeof pkg[k] === 'object') {
+        for (const n of Object.keys(pkg[k])) names.add(n);
+      }
+    }
+  } catch (_) { /* no/invalid package.json → no deps */ }
+  return [...names].sort();
+}
+
+/**
+ * Resolve an installed dependency's version + entry `.d.ts` path.
+ * @returns {{ version: string|null, dtsPath: string|null }|null} null if not installed
+ */
+function resolveEntry(cwd, dep) {
+  const pkgDir = path.join(cwd, 'node_modules', dep);
+  let pkg;
+  try { pkg = JSON.parse(fs.readFileSync(path.join(pkgDir, 'package.json'), 'utf8')); } catch (_) { return null; }
+  const version = typeof pkg.version === 'string' ? pkg.version : null;
+
+  const candidates = [];
+  const typesField = pkg.types || pkg.typings;
+  if (typeof typesField === 'string') {
+    candidates.push(typesField);
+    candidates.push(path.join(typesField, 'index.d.ts')); // typesField may be a dir
+  }
+  candidates.push('index.d.ts');
+  if (typeof pkg.main === 'string') candidates.push(pkg.main.replace(/\.(js|cjs|mjs)$/, '.d.ts'));
+
+  for (const c of candidates) {
+    const p = path.join(pkgDir, c);
+    try { if (fs.statSync(p).isFile()) return { version, dtsPath: p }; } catch (_) { /* next */ }
+  }
+  return { version, dtsPath: null }; // installed but untyped
+}
+
+/**
+ * Build the installed-library signature index for `cwd`.
+ *
+ * @param {string} cwd
+ * @param {object} [opts]
+ * @param {string} [opts.version='0']  sigmap version, for cache busting
+ * @param {boolean} [opts.cache=true]  use the on-disk sig-cache
+ * @returns {{ symbols: Set<string>, libraries: Array<{name,version,symbols,typed}>, count: number }}
+ */
+function buildLibraryIndex(cwd, opts = {}) {
+  const version = opts.version || '0';
+  const useCache = opts.cache !== false;
+  const deps = directDeps(cwd).slice(0, MAX_DEPS);
+
+  const entries = [];
+  for (const dep of deps) {
+    const r = resolveEntry(cwd, dep);
+    if (r) entries.push({ dep, version: r.version, dtsPath: r.dtsPath });
+  }
+
+  const cache = useCache ? loadCache(cwd, version) : new Map();
+  const dtsFiles = entries.filter((e) => e.dtsPath).map((e) => e.dtsPath);
+  const { unchanged } = getChangedFiles(dtsFiles, cache);
+  const unchangedSet = new Set(unchanged);
+
+  const symbols = new Set();
+  const libraries = [];
+  const fresh = [];
+
+  for (const e of entries) {
+    let names;
+    if (!e.dtsPath) {
+      names = [];
+    } else if (unchangedSet.has(e.dtsPath) && cache.get(e.dtsPath)) {
+      names = cache.get(e.dtsPath).sigs || [];
+    } else {
+      let src = '';
+      try {
+        if (fs.statSync(e.dtsPath).size <= MAX_DTS_BYTES) src = fs.readFileSync(e.dtsPath, 'utf8');
+      } catch (_) { /* unreadable → empty */ }
+      names = extractDtsExports(src);
+      fresh.push({ file: e.dtsPath, sigs: names });
+    }
+    for (const n of names) symbols.add(n);
+    libraries.push({ name: e.dep, version: e.version, symbols: names.length, typed: !!e.dtsPath });
+  }
+
+  if (useCache && fresh.length) {
+    updateCacheEntries(cache, fresh);
+    saveCache(cwd, version, cache);
+  }
+
+  libraries.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
+  return { symbols, libraries, count: symbols.size };
+}
+
+/** D8: render `name@version` pins for the typed/installed libraries. */
+function formatVersionPins(libraries) {
+  return (libraries || [])
+    .filter((l) => l.version)
+    .map((l) => `${l.name}@${l.version}`);
+}
+
+module.exports = { buildLibraryIndex, extractDtsExports, directDeps, resolveEntry, formatVersionPins };