weavatrix 0.1.2 → 0.1.4

package/src/analysis/endpoints-rust.js

@@ -0,0 +1,124 @@
+const RUST_ROUTE_METHOD = "get|post|put|patch|delete|head|options|trace|connect|any";
+
+// Find a call's closing parenthesis without mistaking parens inside strings for syntax. This is deliberately
+// small (not a Rust parser), but keeps route-handler expressions bounded instead of using a cross-statement
+// regex that could turn an unrelated function call into a route.
+function closingParen(text, openAt) {
+  let depth = 0, quote = "", escaped = false, blockComment = 0;
+  for (let i = openAt; i < text.length; i++) {
+    const ch = text[i];
+    if (quote) {
+      if (escaped) escaped = false;
+      else if (ch === "\\") escaped = true;
+      else if (ch === quote) quote = "";
+      continue;
+    }
+    if (blockComment) {
+      if (ch === "/" && text[i + 1] === "*") { blockComment++; i++; }
+      else if (ch === "*" && text[i + 1] === "/") { blockComment--; i++; }
+      continue;
+    }
+    if (ch === "/" && text[i + 1] === "/") {
+      const newline = text.indexOf("\n", i + 2);
+      if (newline < 0) return -1;
+      i = newline;
+      continue;
+    }
+    if (ch === "/" && text[i + 1] === "*") { blockComment = 1; i++; continue; }
+    if (ch === '"') { quote = ch; continue; }
+    if (ch === "'") {
+      // Skip a Rust character literal, but do not mistake a lifetime (`'a`) for an unterminated string.
+      const char = /^'(?:\\.|[^\\'\r\n])'/.exec(text.slice(i));
+      if (char) { i += char[0].length - 1; continue; }
+    }
+    if (ch === "(") depth++;
+    else if (ch === ")" && --depth === 0) return i;
+  }
+  return -1;
+}
+
+// Parse axum's MethodRouter expression, including direct method chains:
+//   get(list).post(create) / axum::routing::get(show).delete(remove)
+// Calls inside a handler closure are not scanned and therefore cannot become fake endpoint methods.
+function axumRoutes(expr) {
+  const found = [];
+  let rest = String(expr || ""), offset = 0;
+  const firstRe = new RegExp(`^\\s*(?:(?:axum\\s*::\\s*)?routing\\s*::\\s*)?(${RUST_ROUTE_METHOD})\\s*\\(`, "i");
+  let match = firstRe.exec(rest);
+  if (!match) return found;
+
+  while (match) {
+    const openAt = offset + match.index + match[0].lastIndexOf("(");
+    const closeAt = closingParen(expr, openAt);
+    if (closeAt < 0) break;
+    found.push({ method: match[1], handler: expr.slice(openAt + 1, closeAt), index: openAt });
+    offset = closeAt + 1;
+    rest = expr.slice(offset);
+    match = new RegExp(`^\\s*\\.\\s*(${RUST_ROUTE_METHOD})\\s*\\(`, "i").exec(rest);
+  }
+  return found;
+}
+
+// Actix's builder form is structurally distinct from axum and from HTTP clients:
+//   web::get().to(handler) / actix_web::web::post().to(handler)
+function actixRoutes(expr) {
+  const found = [];
+  const re = new RegExp(`(?:actix_web\\s*::\\s*)?web\\s*::\\s*(${RUST_ROUTE_METHOD})\\s*\\(\\s*\\)\\s*\\.\\s*to\\s*\\(`, "gi");
+  let match;
+  while ((match = re.exec(expr))) {
+    const openAt = re.lastIndex - 1;
+    const closeAt = closingParen(expr, openAt);
+    if (closeAt < 0) continue;
+    found.push({ method: match[1], handler: expr.slice(openAt + 1, closeAt), index: match.index });
+    re.lastIndex = closeAt + 1;
+  }
+  return found;
+}
+
+export function extractRustEndpoints(text, add) {
+  let match;
+
+  // Axum and actix both expose a path-first `.route(path, ...)` builder. Requiring either an axum
+  // MethodRouter or actix's web::<method>().to(...) avoids treating arbitrary Rust APIs named `route` as HTTP.
+  const routeRe = /\.\s*route\s*\(\s*"(\/(?:\\.|[^"\\])*)"\s*,/g;
+  while ((match = routeRe.exec(text))) {
+    const openAt = text.indexOf("(", match.index);
+    const closeAt = closingParen(text, openAt);
+    if (closeAt < 0) continue;
+    const exprStart = routeRe.lastIndex;
+    const expr = text.slice(exprStart, closeAt);
+    const routes = [...axumRoutes(expr), ...actixRoutes(expr)];
+    for (const route of routes) add(route.method, match[1], route.handler, exprStart + route.index);
+    routeRe.lastIndex = closeAt + 1;
+  }
+
+  // actix `web::resource(path)` associates several method routes with one path.
+  const resourceRe = /(?:actix_web\s*::\s*)?web\s*::\s*resource\s*\(\s*"(\/(?:\\.|[^"\\])*)"\s*\)/g;
+  while ((match = resourceRe.exec(text))) {
+    const tail = text.slice(resourceRe.lastIndex);
+    const nextResource = tail.search(/(?:actix_web\s*::\s*)?web\s*::\s*resource\s*\(/);
+    const semicolon = text.indexOf(";", resourceRe.lastIndex);
+    let end = Math.min(text.length, resourceRe.lastIndex + 4000);
+    if (nextResource >= 0) end = Math.min(end, resourceRe.lastIndex + nextResource);
+    if (semicolon >= 0) end = Math.min(end, semicolon);
+    const chain = text.slice(resourceRe.lastIndex, end);
+    for (const route of actixRoutes(chain)) add(route.method, match[1], route.handler, resourceRe.lastIndex + route.index);
+  }
+
+  // Actix attribute macros. The route macro can declare more than one method for the same handler.
+  const macroRe = new RegExp(`#\\s*\\[\\s*(?:(?:actix_web|actix)\\s*::\\s*)?(${RUST_ROUTE_METHOD})\\s*\\(\\s*"(\\/(?:\\\\.|[^"\\\\])*)"(?:\\s*,[^\\]]*)?\\s*\\)\\s*\\]`, "gi");
+  while ((match = macroRe.exec(text))) {
+    const after = text.slice(macroRe.lastIndex, macroRe.lastIndex + 600);
+    const fn = /\b(?:pub(?:\s*\([^)]*\))?\s+)?(?:async\s+)?fn\s+([A-Za-z_][\w]*)/.exec(after);
+    add(match[1], match[2], fn ? fn[1] : "", match.index);
+  }
+
+  const multiMacroRe = /#\s*\[\s*(?:(?:actix_web|actix)\s*::\s*)?route\s*\(\s*"(\/(?:\\.|[^"\\])*)"([\s\S]*?)\)\s*\]/gi;
+  while ((match = multiMacroRe.exec(text))) {
+    const after = text.slice(multiMacroRe.lastIndex, multiMacroRe.lastIndex + 600);
+    const fn = /\b(?:pub(?:\s*\([^)]*\))?\s+)?(?:async\s+)?fn\s+([A-Za-z_][\w]*)/.exec(after);
+    const methodRe = /\bmethod\s*=\s*"(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS|TRACE|CONNECT)"/gi;
+    let method;
+    while ((method = methodRe.exec(match[2]))) add(method[1], match[1], fn ? fn[1] : "", match.index);
+  }
+}

package/src/analysis/endpoints.js

@@ -1,16 +1,18 @@
 // endpoints.js — detect the repo's OWN HTTP API surface (routes it EXPOSES), so the Health tab can
 // surface endpoints the way infra towers surface the services a repo TALKS TO. Each endpoint carries a
 // best-effort handler NAME so the UI can join it to that method's health (O(n) complexity, criticality,
-// coverage). Covers the common shapes across JS/TS, Python and Go:
+// coverage). Covers the common shapes across JS/TS, Python, Go and Rust:
 //   • object routes (Bun.serve / custom):  "/path": { GET: handler, POST: fn }   |   "/path": handler
 //   • method-call routes (Express/Fastify/Koa/Hono/gin/echo):  app.get("/path", handler)
 //   • decorators (FastAPI/Flask/NestJS):   @app.get("/path")  /  @Get("/path")
 //   • Go net/http:                          mux.HandleFunc("/path", handler)
+//   • Rust axum/actix-web:                  .route("/path", get(handler)) / #[get("/path")]
 import { safeRead } from "../util.js";
 import { createRepoBoundary } from "../repo-path.js";
+import { extractRustEndpoints } from "./endpoints-rust.js";
 
 const MAX_FILES = 3000;
-const HTTP_METHODS = new Set(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS", "ALL", "ANY"]);
+const HTTP_METHODS = new Set(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS", "TRACE", "CONNECT", "ALL", "ANY"]);
 // UNAMBIGUOUS HTTP CLIENTS (make requests) vs servers (define routes) — reject `axios.get("/x")`-style client
 // calls in frontend code. Ambiguous names (api/client/service — could be a server router) are NOT listed;
 // they're filtered by the handler requirement instead (a client call has no handler / a config object arg).
@@ -31,7 +33,9 @@ function lineAt(text, index) {
 function handlerName(expr) {
   const s = String(expr || "").trim();
   if (!s) return "";
-  if (/=>/.test(s) || /^\s*(async\s+)?function\b/.test(s)) return "";
+  if (/=>/.test(s) || /^\s*(async\s+)?function\b/.test(s) || /^\s*(?:async\s+)?(?:move\s+)?\|[^|]*\|/.test(s)) return "";
+  const turbofish = /(?:^|::)([A-Za-z_][\w]*)\s*::<[\s\S]*>\s*$/.exec(s);
+  if (turbofish) return turbofish[1];
   const ids = s.match(/[A-Za-z_$][\w$]*/g);
   if (!ids) return "";
   const SKIP = new Set(["async", "function", "await", "req", "res", "ctx", "request", "response", "next", "return"]);
@@ -44,12 +48,31 @@ function handlerName(expr) {
 // endpoints (handler "operation", {id} params). These keys never appear in a real route/handler table.
 const OPENAPI_BLOCK = /\boperationId\b|\bresponses\s*:|\brequestBody\b|\bschemaRef\b|\boperation\s*\(|\bsummary\s*:/;
 
-const looksLikePath = (p) => typeof p === "string" && /^\/[\w\-./:{}*$]*$/.test(p) && !p.includes("://");
+const looksLikePath = (p) => typeof p === "string" && /^\/[\w\-./:{}*$?]*$/.test(p) && !p.includes("://");
 const cleanPath = (p) => String(p || "").replace(/\/+$/, "") || "/";
 
+export function nextRoutePath(file) {
+  const parts = String(file || "").replace(/\\/g, "/").split("/").filter(Boolean);
+  if (!/^route\.[cm]?[jt]s$/i.test(parts.at(-1) || "")) return "";
+  const appAt = parts.lastIndexOf("app");
+  if (appAt < 0) return "";
+  const route = [];
+  for (let segment of parts.slice(appAt + 1, -1)) {
+    if (!segment || /^\([^)]*\)$/.test(segment) || segment.startsWith("@")) continue; // route groups / parallel slots
+    segment = segment.replace(/^\((?:\.{1,3})\)/, "");                    // intercepting-route marker
+    let m;
+    if ((m = /^\[\[\.\.\.([^\]]+)\]\]$/.exec(segment))) segment = `*${m[1]}?`;
+    else if ((m = /^\[\.\.\.([^\]]+)\]$/.exec(segment))) segment = `*${m[1]}`;
+    else if ((m = /^\[([^\]]+)\]$/.exec(segment))) segment = `:${m[1]}`;
+    if (segment) route.push(segment);
+  }
+  return `/${route.join("/")}`;
+}
+
 export function extractEndpointsFromText(text, file) {
   const out = [];
   const py = /\.py$/i.test(file);
+  const rust = /\.rs$/i.test(file);
   const add = (method, path, expr, idx) => {
     const p = cleanPath(path);
     if (!looksLikePath(p)) return;
@@ -58,6 +81,33 @@ export function extractEndpointsFromText(text, file) {
     out.push({ method: m, path: p, handler: handlerName(expr), file, line: lineAt(text, idx) });
   };
 
+  // Next.js App Router: the filesystem provides the path and exported HTTP-method functions provide the
+  // verbs. No literal route string exists in route.ts, so generic Express/FastAPI regexes cannot see it.
+  const nextPath = nextRoutePath(file);
+  if (nextPath) {
+    const seen = new Set();
+    const direct = /\bexport\s+(?:(?:async|declare)\s+)*(?:function\s+|(?:const|let|var)\s+)(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS)\b/g;
+    let nm;
+    while ((nm = direct.exec(text))) {
+      const method = nm[1].toUpperCase();
+      if (!seen.has(method)) { seen.add(method); add(method, nextPath, method, nm.index); }
+    }
+    const lists = /\bexport\s*\{([^}]+)\}/g;
+    let lm;
+    while ((lm = lists.exec(text))) {
+      for (const item of lm[1].split(",")) {
+        const mm = /^\s*([A-Za-z_$][\w$]*)(?:\s+as\s+(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS))?\s*$/.exec(item);
+        if (!mm) continue;
+        if (!mm[2] && !HTTP_METHODS.has(mm[1])) continue;
+        const method = String(mm[2] || mm[1]).toUpperCase();
+        if (!HTTP_METHODS.has(method)) continue;
+        if (!seen.has(method)) { seen.add(method); add(method, nextPath, mm[1], lm.index); }
+      }
+    }
+  }
+
+  if (rust) extractRustEndpoints(text, add);
+
   // ---- object routes: "/path": { GET: fn, POST: fn2 }  or  "/path": handler --------------------
   // find each  "…": {  or  "…": expr,  where the key looks like a path
   const objKeyRe = /(["'`])(\/[^"'`]*)\1\s*:\s*(\{)?/g;
@@ -128,11 +178,11 @@ export function detectEndpoints(repoPath, codeFiles) {
   const boundary = createRepoBoundary(repoPath);
   for (const f of files) {
     const rel = f.path || f;
-    if (!/\.(js|ts|tsx|jsx|cjs|mjs|py|go)$/i.test(rel)) continue;
+    if (!/\.(js|ts|tsx|jsx|cjs|mjs|py|go|rs)$/i.test(rel)) continue;
     const resolved = boundary.resolve(rel);
     if (!resolved.ok) continue;
     const text = safeRead(resolved.path);
-    if (!text || !/["'`]\/|\.(get|post|put|patch|delete)\s*\(|HandleFunc|@\w*\.?(get|post|put|patch|delete)/i.test(text)) continue;
+    if (!text || (!nextRoutePath(rel) && !/["'`]\/|\.(get|post|put|patch|delete)\s*\(|HandleFunc|@\w*\.?(get|post|put|patch|delete)/i.test(text))) continue;
     for (const e of extractEndpointsFromText(text, rel.replace(/\\/g, "/"))) {
       const key = `${e.method} ${normParamKey(e.path)}`;
       const prev = byKey.get(key);

package/src/analysis/graph-analysis.aggregate.js

@@ -6,6 +6,8 @@ import { join } from "node:path";
 import { normalizeRepoParts, readCoverageForRepo, pctFromCounts } from "./coverage-reports.js";
 import { bareSymbolName, countLocalRefsOutsideOwnRange, computeSymbolExternalRefs } from "./graph-analysis.refs.js";
 import { createRepoBoundary } from "../repo-path.js";
+import { edgeList, folderModuleOf } from "./graph-analysis.edges.js";
+export { folderModuleOf } from "./graph-analysis.edges.js";
 
 // Aggregate a built graph.json into the file- and module-level view the UI needs:
 //   - graph-builder nodes are FILES *and* their symbols (functions/methods), linked file→symbol by the
@@ -13,7 +15,6 @@ import { createRepoBoundary } from "../repo-path.js";
 //   - Each file is assigned to ONE module via its file-node's community (symbols may cluster apart,
 //     but the file itself belongs where its file-node sits) → exact, non-overlapping file counts.
 //   - Real edges (everything except "contains") roll up to file→file and module→module relations.
-// Module names match summarizeCommunities (dominant first-two-path-parts), so they line up with cards.
 export function analyzeGraph(graphJsonPath, repoRoot) {
   let graph;
   try {
@@ -40,15 +41,11 @@ export function aggregateGraph(graph, repoRoot) {
   // MODULE = the file's own top FOLDER (its "territory"), up to 2 path levels — NOT a dependency
   // cluster. e.g. src/widget/foo.js → "src/widget"; benchmarks/cleanup.py → "benchmarks" (so all
   // benchmarks files are one module); a top-level file like index.js → "(root)".
-  const folderOf = (file) => {
-    const dirs = String(file || "").split(/[\\/]/).filter(Boolean).slice(0, -1);
-    return dirs.length ? dirs.slice(0, 2).join("/") : "(root)";
-  };
   // In a merged (cross-repo) graph every node carries a `repo`; qualify file & module identity by it
   // so same-named folders/files in different repos never merge. Single-repo graphs have no `repo`,
   // so identity stays the bare path (unchanged behavior).
   const fileIdOf = (node) => (node.repo ? `${node.repo}::${node.source_file}` : node.source_file);
-  const moduleOfNode = (node) => (node.repo ? `${node.repo}/` : "") + folderOf(node.source_file);
+  const moduleOfNode = (node) => (node.repo ? `${node.repo}/` : "") + folderModuleOf(node.source_file);
 
   // file → module (folder) + symbols + display path, all keyed by repo-qualified file id
   const fileModule = new Map();
@@ -100,38 +97,38 @@ export function aggregateGraph(graph, repoRoot) {
   for (const node of nodes) if (node.source_file) id2file.set(node.id, fileIdOf(node));
   const fileEdges = new Map(); // key → { count, rels:{relation→n} } so we can emit the DOMINANT relation (call/import/inherit)
   const moduleEdges = new Map();
+  const typeOnlyFileEdges = new Map();
+  const typeOnlyModuleEdges = new Map();
+  const compileOnlyFileEdges = new Map();
+  const compileOnlyModuleEdges = new Map();
+  const compileTimeFileEdges = new Map();
+  const compileTimeModuleEdges = new Map();
+  const addFileEdge = (map, key, link) => {
+    let edge = map.get(key);
+    if (!edge) map.set(key, (edge = { count: 0, rels: {} }));
+    edge.count++;
+    if (link.relation) edge.rels[link.relation] = (edge.rels[link.relation] || 0) + 1;
+  };
   for (const link of links) {
     if (link.relation === "contains") continue;
     const fromFile = id2file.get(endpoint(link.source));
     const toFile = id2file.get(endpoint(link.target));
     if (fromFile && toFile && fromFile !== toFile) {
       const key = `${fromFile} ${toFile}`;
-      let fe = fileEdges.get(key);
-      if (!fe) fileEdges.set(key, (fe = { count: 0, rels: {} }));
-      fe.count++;
-      if (link.relation) fe.rels[link.relation] = (fe.rels[link.relation] || 0) + 1;
+      const compileTime = link.typeOnly === true || link.compileOnly === true;
+      const targetFileEdges = link.typeOnly === true ? typeOnlyFileEdges : link.compileOnly === true ? compileOnlyFileEdges : fileEdges;
+      addFileEdge(targetFileEdges, key, link);
+      if (compileTime) addFileEdge(compileTimeFileEdges, key, link);
       const fromMod = fileModule.get(fromFile);
       const toMod = fileModule.get(toFile);
       if (fromMod && toMod && fromMod !== toMod) {
         const mkey = `${fromMod} ${toMod}`;
-        moduleEdges.set(mkey, (moduleEdges.get(mkey) || 0) + 1);
+        const targetModuleEdges = link.typeOnly === true ? typeOnlyModuleEdges : link.compileOnly === true ? compileOnlyModuleEdges : moduleEdges;
+        targetModuleEdges.set(mkey, (targetModuleEdges.get(mkey) || 0) + 1);
+        if (compileTime) compileTimeModuleEdges.set(mkey, (compileTimeModuleEdges.get(mkey) || 0) + 1);
       }
     }
   }
-  const split = (key) => {
-    const i = key.indexOf(" ");
-    return [key.slice(0, i), key.slice(i + 1)];
-  };
-  const edgeList = (map) =>
-    [...map.entries()]
-      .map(([key, v]) => {
-        const [from, to] = split(key);
-        if (typeof v === "number") return { from, to, count: v }; // moduleEdges (no relation breakdown)
-        const dom = Object.entries(v.rels).sort((a, b) => b[1] - a[1])[0];
-        return { from, to, count: v.count, relation: dom ? dom[0] : null };
-      })
-      .sort((a, b) => b.count - a.count);
-
   // symbol-level (function/method) call graph: edges between symbol nodes (calls/method), each symbol
   // tagged with its file's module so the Symbols view can still cluster into module regions.
   const symEdges = new Map();
@@ -263,7 +260,13 @@ export function aggregateGraph(graph, repoRoot) {
       }))
       .sort((a, b) => b.fileCount - a.fileCount),
     moduleEdges: edgeList(moduleEdges),
+    typeOnlyModuleEdges: edgeList(typeOnlyModuleEdges),
+    compileOnlyModuleEdges: edgeList(compileOnlyModuleEdges),
+    compileTimeModuleEdges: edgeList(compileTimeModuleEdges),
     fileEdges: edgeList(fileEdges),
+    typeOnlyFileEdges: edgeList(typeOnlyFileEdges),
+    compileOnlyFileEdges: edgeList(compileOnlyFileEdges),
+    compileTimeFileEdges: edgeList(compileTimeFileEdges),
     symbols,
     symbolEdges,
     symbolRefs: [...new Set([...symbolLocalRefs.keys(), ...symbolExternalRefs.keys()])].map((id) => {
@@ -276,7 +279,13 @@ export function aggregateGraph(graph, repoRoot) {
       files: fileModule.size,
       nodes: nodes.filter((n) => n.file_type === "code").length,
       fileEdges: fileEdges.size,
+      typeOnlyFileEdges: typeOnlyFileEdges.size,
+      compileOnlyFileEdges: compileOnlyFileEdges.size,
+      compileTimeFileEdges: compileTimeFileEdges.size,
       moduleEdges: moduleEdges.size,
+      typeOnlyModuleEdges: typeOnlyModuleEdges.size,
+      compileOnlyModuleEdges: compileOnlyModuleEdges.size,
+      compileTimeModuleEdges: compileTimeModuleEdges.size,
       symbols: symbols.length,
       symbolEdges: symbolEdges.length
     }

package/src/analysis/graph-analysis.edges.js

@@ -0,0 +1,21 @@
+// Stable folder territories used by module_map. Nested package source roots keep the first directory below
+// `src`; otherwise a monorepo's entire crate/app would collapse into one module with no visible dependencies.
+export function folderModuleOf(file) {
+  const dirs = String(file || "").split(/[\\/]/).filter(Boolean).slice(0, -1);
+  if (!dirs.length) return "(root)";
+  const sourceRoot = dirs.lastIndexOf("src");
+  if (sourceRoot >= 0 && dirs.length > sourceRoot + 1) return dirs.slice(0, sourceRoot + 2).join("/");
+  return dirs.slice(0, 2).join("/");
+}
+
+export function edgeList(map) {
+  return [...map.entries()]
+    .map(([key, value]) => {
+      const splitAt = key.indexOf(" ");
+      const from = key.slice(0, splitAt), to = key.slice(splitAt + 1);
+      if (typeof value === "number") return { from, to, count: value };
+      const dominant = Object.entries(value.rels).sort((a, b) => b[1] - a[1])[0];
+      return { from, to, count: value.count, relation: dominant ? dominant[0] : null };
+    })
+    .sort((a, b) => b.count - a.count);
+}

package/src/analysis/graph-analysis.js

@@ -4,4 +4,4 @@
 // Facade: implementation lives in graph-analysis.summaries.js and graph-analysis.aggregate.js
 // (with internal helpers in graph-analysis.refs.js).
 export { summarizeCommunities, summarizeHotspots } from "./graph-analysis.summaries.js";
-export { analyzeGraph, aggregateGraph } from "./graph-analysis.aggregate.js";
+export { analyzeGraph, aggregateGraph, folderModuleOf } from "./graph-analysis.aggregate.js";

package/src/analysis/graph-analysis.summaries.js

@@ -1,6 +1,8 @@
 // Reading a built graph.json and summarizing it for the UI cards: named communities and degree
 // hotspots. Both read the graph file from disk and return [] on any failure.
 import { readFileSync } from "node:fs";
+import { communityTerritoryOf } from "../graph/community.js";
+import { isStructuralRelation } from "../graph/relations.js";
 
 // graph-builder labels communities "Community N" without an LLM. Derive a real name from each
 // community's dominant folder + sample files so the UI shows modules, not bare numbers.
@@ -16,7 +18,7 @@ export function summarizeCommunities(graphJsonPath, max = 40) {
       const entry = byCommunity.get(community);
       entry.size += 1;
       const parts = String(node.source_file || "").split(/[\\/]/).filter(Boolean);
-      const dir = parts.length > 1 ? parts.slice(0, 2).join("/") : "(root)";
+      const dir = communityTerritoryOf(node.source_file);
       entry.dirs.set(dir, (entry.dirs.get(dir) || 0) + 1);
       if (entry.files.length < 4) entry.files.push(parts[parts.length - 1] || node.source_file || "");
     }
@@ -41,6 +43,7 @@ export function summarizeHotspots(graphJsonPath, max = 15) {
     const inDeg = new Map();
     const outDeg = new Map();
     for (const link of graph.links || []) {
+      if (isStructuralRelation(link.relation)) continue;
       const s = endpoint(link.source);
       const t = endpoint(link.target);
       outDeg.set(s, (outDeg.get(s) || 0) + 1);

package/src/analysis/internal-audit.collect.js

@@ -1,9 +1,11 @@
 // internal-audit.collect.js — filesystem collection helpers for the internal audit: source/config
 // text gathering, workspace package names, and the Python manifest reader. Split from internal-audit.js.
 import { readFileSync, readdirSync } from "node:fs";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
+import { spawnSync } from "node:child_process";
 import { parseRequirementsNames, parsePyprojectDeps, parsePipfileDeps } from "./manifests.js";
 import { createRepoBoundary } from "../repo-path.js";
+import { childProcessEnv } from "../child-env.js";
 
 export const readText = (p) => { try { return readFileSync(p, "utf8"); } catch { return null; } };
 export const readJson = (p) => { try { return JSON.parse(readFileSync(p, "utf8")); } catch { return null; } };
@@ -18,10 +20,76 @@ export const readRepoJson = (boundary, relativePath) => {
 const SOURCE_EXT_RE = /\.(?:[cm]?[jt]sx?|py|go|vue|svelte)$/i;
 const SOURCE_SKIP_DIRS = new Set([
   ".git", ".hg", ".svn", "node_modules", "vendor", "dist", "build", "coverage", ".next", "out",
-  "weavatrix-graphs", "weavatrix-graphs", "__pycache__", ".venv", "venv", "env", ".tox", "site-packages",
+  "release", "weavatrix-graphs", "__pycache__", ".venv", "venv", "env", ".tox", "site-packages",
   ".mypy_cache", ".pytest_cache",
 ]);
 
+// One file universe for every filesystem-backed audit. In Git repos this exactly matches tracked files
+// plus untracked/non-ignored work, so release bundles and other .gitignore outputs cannot re-enter through
+// text/config/manifest fallback collectors after the graph builder correctly omitted them.
+export function listRepoFiles(repoRoot) {
+  try {
+    const r = spawnSync("git", ["-C", repoRoot, "ls-files", "--cached", "--others", "--exclude-standard", "-z"], {
+      encoding: "utf8", windowsHide: true, timeout: 15_000, maxBuffer: 32 * 1024 * 1024,
+      env: childProcessEnv(),
+    });
+    if (r.status === 0) return String(r.stdout || "").split("\0").filter(Boolean).map((f) => f.replace(/\\/g, "/"));
+  } catch { /* non-Git repo or git unavailable: use the bounded walker below */ }
+
+  const files = [];
+  const walk = (abs, parts = []) => {
+    let entries = [];
+    try { entries = readdirSync(abs, { withFileTypes: true }); } catch { return; }
+    for (const entry of entries) {
+      if (entry.isDirectory()) {
+        if (!SOURCE_SKIP_DIRS.has(entry.name)) walk(join(abs, entry.name), [...parts, entry.name]);
+      } else if (entry.isFile()) files.push([...parts, entry.name].join("/"));
+    }
+  };
+  walk(repoRoot);
+  return files;
+}
+
+const NON_RUNTIME_DIR_RE = /^(?:templates?|examples?|samples?|fixtures?|snippets?|__fixtures__)$/i;
+const NON_RUNTIME_README_RE = /(?:\b(?:reusable|copyable|reference)\b[\s\S]{0,160}\b(?:templates?|snippets?|examples?|samples?)\b|\b(?:these|contents?)\s+are\s+templates?\b)/i;
+const normConfiguredRoot = (value) => {
+  const root = String(value || "").trim().replace(/\\/g, "/").replace(/^\.\//, "").replace(/^\/+|\/+$/g, "");
+  if (!root || root === "." || root.split("/").some((part) => part === "..")) return "";
+  return root;
+};
+
+// Runtime health findings should not treat copy-paste catalogs as deployed applications. Conventional
+// template/example directories are safe to infer; a top-level custom catalog is inferred only when its
+// own README explicitly describes reusable templates/snippets. Projects can declare additional roots in
+// `.weavatrix-deps.json` through `nonRuntimeRoots` / `templateRoots`.
+export function collectNonRuntimeRoots(repoRoot, rules = {}) {
+  const files = listRepoFiles(repoRoot);
+  const roots = new Set();
+  const configured = [
+    rules.nonRuntimeRoots, rules.templateRoots,
+    rules.dependencies?.nonRuntimeRoots, rules.dependencies?.templateRoots,
+  ].flatMap((value) => Array.isArray(value) ? value : typeof value === "string" ? [value] : []);
+  for (const value of configured) {
+    const root = normConfiguredRoot(value);
+    if (root) roots.add(root);
+  }
+
+  for (const file of files) {
+    const parts = file.replace(/\\/g, "/").split("/");
+    for (let i = 0; i < parts.length - 1; i++) {
+      if (NON_RUNTIME_DIR_RE.test(parts[i])) roots.add(parts.slice(0, i + 1).join("/"));
+    }
+  }
+
+  const boundary = createRepoBoundary(repoRoot);
+  for (const file of files) {
+    if (!/^[^/]+\/README\.md$/i.test(file)) continue; // custom inference is deliberately top-level only
+    const text = readRepoText(boundary, file);
+    if (text != null && NON_RUNTIME_README_RE.test(text)) roots.add(normRoot(dirname(file)));
+  }
+  return [...roots].filter(Boolean).sort((a, b) => a.localeCompare(b));
+}
+
 export function collectSourceTexts(repoRoot, graph) {
   const sources = new Map();
   const boundary = createRepoBoundary(repoRoot);
@@ -36,19 +104,7 @@ export function collectSourceTexts(repoRoot, graph) {
 
   for (const n of graph.nodes || []) add(n.source_file);
 
-  const walk = (abs, parts = []) => {
-    let entries = [];
-    try { entries = readdirSync(abs, { withFileTypes: true }); } catch { return; }
-    for (const entry of entries) {
-      if (entry.isDirectory()) {
-        if (!SOURCE_SKIP_DIRS.has(entry.name)) walk(join(abs, entry.name), [...parts, entry.name]);
-        continue;
-      }
-      if (!entry.isFile() || !SOURCE_EXT_RE.test(entry.name)) continue;
-      add([...parts, entry.name].join("/"));
-    }
-  };
-  walk(repoRoot);
+  for (const file of listRepoFiles(repoRoot)) if (SOURCE_EXT_RE.test(file)) add(file);
   return sources;
 }
 
@@ -62,7 +118,8 @@ const CONFIG_FILES = [
   "jest.config.js", "jest.config.ts", "jest.config.cjs", "jest.config.mjs",
   "vite.config.js", "vite.config.ts", "vite.config.mjs", "vitest.config.js", "vitest.config.ts",
   "webpack.config.js", "rollup.config.js", "esbuild.config.js",
-  "postcss.config.js", "postcss.config.cjs", "tailwind.config.js", "tailwind.config.ts",
+  "postcss.config.js", "postcss.config.cjs", "postcss.config.mjs", "postcss.config.ts",
+  "tailwind.config.js", "tailwind.config.cjs", "tailwind.config.mjs", "tailwind.config.ts",
   ".prettierrc", ".prettierrc.json", "prettier.config.js",
   "playwright.config.js", "playwright.config.ts", "cypress.config.js", "cypress.config.ts",
   "next.config.js", "next.config.mjs", "nuxt.config.ts", "svelte.config.js", "astro.config.mjs",
@@ -76,17 +133,96 @@ const CONFIG_FILES = [
 export function collectConfigTexts(repoRoot) {
   const map = new Map();
   const boundary = createRepoBoundary(repoRoot);
-  for (const f of CONFIG_FILES) { const t = readRepoText(boundary, f); if (t != null) map.set(f, t); }
+  const names = new Set(CONFIG_FILES.map((f) => f.toLowerCase()));
+  for (const f of listRepoFiles(repoRoot)) {
+    const base = f.slice(f.lastIndexOf("/") + 1).toLowerCase();
+    if (!names.has(base) && !/^\.github\/workflows\/.*\.ya?ml$/i.test(f)) continue;
+    const t = readRepoText(boundary, f);
+    if (t != null) map.set(f, t);
+  }
+  return map;
+}
+
+function readJsonc(text) {
+  if (text == null) return null;
   try {
-    const workflows = boundary.resolve(".github/workflows");
-    if (!workflows.ok) throw new Error("workflows directory is outside the repository");
-    for (const wf of readdirSync(workflows.path)) {
-      if (!/\.ya?ml$/i.test(wf)) continue;
-      const t = readRepoText(boundary, `.github/workflows/${wf}`);
-      if (t != null) map.set(`.github/workflows/${wf}`, t);
+    const input = String(text).replace(/^\uFEFF/, "");
+    let clean = "", inString = false, escaped = false;
+    for (let i = 0; i < input.length; i++) {
+      const ch = input[i], next = input[i + 1];
+      if (inString) {
+        clean += ch;
+        if (escaped) escaped = false;
+        else if (ch === "\\") escaped = true;
+        else if (ch === '"') inString = false;
+        continue;
+      }
+      if (ch === '"') { inString = true; clean += ch; continue; }
+      if (ch === "/" && next === "/") {
+        while (i < input.length && input[i] !== "\n") i++;
+        clean += "\n";
+        continue;
+      }
+      if (ch === "/" && next === "*") {
+        i += 2;
+        while (i < input.length && !(input[i] === "*" && input[i + 1] === "/")) i++;
+        i++;
+        continue;
+      }
+      clean += ch;
     }
-  } catch { /* no workflows */ }
-  return map;
+    clean = clean.replace(/,\s*([}\]])/g, "$1");
+    return JSON.parse(clean);
+  } catch { return null; }
+}
+
+const normRoot = (root) => {
+  const value = String(root || "").replace(/\\/g, "/").replace(/^\.\//, "").replace(/^\/+|\/+$/g, "");
+  return value === "." ? "" : value;
+};
+const inScope = (file, root) => !root || file === root || file.startsWith(`${root}/`);
+
+function aliasesForScope(repoRoot, root, files, boundary, scopeRoots) {
+  const ownerOf = (file) => scopeRoots.find((candidate) => inScope(file, candidate)) ?? "";
+  const configs = files
+    .filter((f) => ownerOf(f) === root && /(^|\/)(?:tsconfig|jsconfig)(?:\.[^/]+)?\.json$/i.test(f))
+    .filter((f) => normRoot(dirname(f)) === root)
+    .sort((a, b) => Number(!/(^|\/)(?:tsconfig|jsconfig)\.json$/i.test(a)) - Number(!/(^|\/)(?:tsconfig|jsconfig)\.json$/i.test(b)) || a.localeCompare(b));
+  const aliases = new Map();
+  for (const config of configs) {
+    const cfg = readJsonc(readRepoText(boundary, config));
+    const paths = cfg?.compilerOptions?.paths || {};
+    for (const key of Object.keys(paths)) if (!aliases.has(key)) aliases.set(key, {
+      key,
+      prefix: String(key).replace(/\*.*$/, ""),
+      suffix: String(key).includes("*") ? String(key).slice(String(key).indexOf("*") + 1) : "",
+      config,
+    });
+  }
+  return [...aliases.values()];
+}
+
+// Every package.json defines a dependency scope. The nearest ancestor manifest owns an import, matching
+// npm workspace/package semantics. Aliases are collected from that scope's tsconfig/jsconfig so `@/*`
+// remains local rather than becoming a phantom npm package.
+export function collectPackageScopes(repoRoot, rootPkg = null) {
+  const boundary = createRepoBoundary(repoRoot);
+  const files = listRepoFiles(repoRoot);
+  const manifests = files.filter((f) => /(^|\/)package\.json$/i.test(f));
+  if (!manifests.includes("package.json") && rootPkg) manifests.unshift("package.json");
+  const uniqueManifests = [...new Set(manifests)];
+  const scopeRoots = uniqueManifests
+    .map((manifest) => manifest === "package.json" ? "" : normRoot(dirname(manifest)))
+    .sort((a, b) => b.length - a.length);
+  const scopes = [];
+  for (const manifest of uniqueManifests) {
+    const root = manifest === "package.json" ? "" : normRoot(dirname(manifest));
+    const pkg = manifest === "package.json" && rootPkg ? rootPkg : readRepoJson(boundary, manifest);
+    if (!pkg || typeof pkg !== "object") continue;
+    scopes.push({ root, manifest, pkg, aliases: aliasesForScope(repoRoot, root, files, boundary, scopeRoots) });
+  }
+  if (!scopes.some((s) => !s.root)) scopes.push({ root: "", manifest: "package.json", pkg: rootPkg || {}, aliases: aliasesForScope(repoRoot, "", files, boundary, [...scopeRoots, ""]) });
+  return scopes.sort((a, b) => b.root.length - a.root.length);
 }
 
 // Monorepo-local package names: "packages/*"-style workspace globs → each child's package.json name.
@@ -111,6 +247,7 @@ export function workspacePkgNames(repoRoot, pkg) {
       if (p && p.name) names.add(p.name);
     }
   }
+  for (const scope of collectPackageScopes(repoRoot, pkg)) if (scope.pkg?.name) names.add(scope.pkg.name);
   return names;
 }