weavatrix 0.1.3 → 0.1.4

package/src/analysis/dep-rules.js

@@ -7,7 +7,6 @@
 // built from EXTRACTED import edges → high confidence.
 import { makeFinding } from "./findings.js";
 import { ENTRY_FILE } from "./dead-check.js";
-
 const TEST_FILE_RE = /(^|[/])(test|tests|__tests__|spec|e2e|__mocks__)([/]|$)|[._-](test|spec)\.[a-z0-9]+$/i;
 // config/data/docs: never "orphans" — nothing imports them by design
 const NON_CODE_RE = /\.(json|ya?ml|sh|ps1|md|txt|html?|css|scss|less)$|(^|[/])(dockerfile|containerfile)/i;
@@ -15,18 +14,19 @@ const NON_CODE_RE = /\.(json|ya?ml|sh|ps1|md|txt|html?|css|scss|less)$|(^|[/])(d
 const ep = (v) => String(v && typeof v === "object" ? v.id : v);
 const fileOf = (v) => { const s = ep(v); const h = s.indexOf("#"); return h < 0 ? s : s.slice(0, h); };
 const dirOf = (f) => (f.includes("/") ? f.slice(0, f.lastIndexOf("/")) : "");
-
 // File-level import adjacency. Go same-directory edges are excluded: a Go package IS the directory, the
 // compiler forbids real cross-package cycles, and our suffix-fallback Go resolution could fake them.
-export function buildFileImportGraph(graph, { includeTypeOnly = false } = {}) {
+export function buildFileImportGraph(graph, { includeTypeOnly = false, includeCompileOnly = false } = {}) {
   const fileIds = new Set();
   for (const n of graph.nodes || []) if (!String(n.id).includes("#")) fileIds.add(String(n.id));
   const runtimeAdj = new Map();       // runtime/value imports only
-  const allAdj = new Map();           // runtime + type-only, used to describe architectural coupling
+  const allAdj = new Map();           // runtime + compile-time-only, used to describe architectural coupling
   const edges = [];
   const allEdges = [];
   const typeOnlyEdges = [];
-  const runtimeSeen = new Set(), allSeen = new Set(), typeSeen = new Set();
+  const compileOnlyEdges = [];
+  const compileTimeEdges = [];
+  const runtimeSeen = new Set(), allSeen = new Set(), typeSeen = new Set(), compileSeen = new Set(), compileTimeSeen = new Set();
   const add = (map, a, b) => {
     let set = map.get(a);
     if (!set) map.set(a, (set = new Set()));
@@ -39,22 +39,28 @@ export function buildFileImportGraph(graph, { includeTypeOnly = false } = {}) {
     if (a.endsWith(".go") && b.endsWith(".go") && dirOf(a) === dirOf(b)) continue;
     const key = `${a}\0${b}`;
     if (!allSeen.has(key)) { allSeen.add(key); add(allAdj, a, b); allEdges.push([a, b]); }
-    if (l.typeOnly === true) {
-      if (!typeSeen.has(key)) { typeSeen.add(key); typeOnlyEdges.push([a, b]); }
+    if (l.typeOnly === true || l.compileOnly === true) {
+      if (l.typeOnly === true && !typeSeen.has(key)) { typeSeen.add(key); typeOnlyEdges.push([a, b]); }
+      if (l.compileOnly === true && !compileSeen.has(key)) { compileSeen.add(key); compileOnlyEdges.push([a, b]); }
+      if (!compileTimeSeen.has(key)) { compileTimeSeen.add(key); compileTimeEdges.push([a, b]); }
       continue;
     }
     if (!runtimeSeen.has(key)) { runtimeSeen.add(key); add(runtimeAdj, a, b); edges.push([a, b]); }
   }
   const pureTypeOnlyEdges = typeOnlyEdges.filter(([a, b]) => !runtimeSeen.has(`${a}\0${b}`));
+  const pureCompileOnlyEdges = compileOnlyEdges.filter(([a, b]) => !runtimeSeen.has(`${a}\0${b}`));
+  const pureCompileTimeEdges = compileTimeEdges.filter(([a, b]) => !runtimeSeen.has(`${a}\0${b}`));
   return {
     fileIds,
-    adj: includeTypeOnly ? allAdj : runtimeAdj,
-    edges: includeTypeOnly ? allEdges : edges,
+    adj: includeTypeOnly || includeCompileOnly ? allAdj : runtimeAdj,
+    edges: includeTypeOnly || includeCompileOnly ? allEdges : edges,
     runtimeAdj,
     runtimeEdges: edges,
     allAdj,
     allEdges,
     typeOnlyEdges: pureTypeOnlyEdges,
+    compileOnlyEdges: pureCompileOnlyEdges,
+    compileTimeEdges: pureCompileTimeEdges,
   };
 }
 
@@ -167,12 +173,10 @@ export function checkBoundaries(edges, rules = {}) {
 
 const MAX_CYCLE_FINDINGS = 50;
 const MAX_BOUNDARY_FINDINGS = 100;
-
 // Assemble everything into unified Findings. rules comes from the repo's .weavatrix-deps.json (optional).
 export function computeStructureFindings(graph, { rules = {}, entrySet = new Set(), externalImportFiles = new Set() } = {}) {
-  const { adj, edges, allAdj, allEdges, typeOnlyEdges } = buildFileImportGraph(graph);
+  const { adj, edges, allAdj, allEdges, typeOnlyEdges, compileOnlyEdges, compileTimeEdges } = buildFileImportGraph(graph);
   const findings = [];
-
   const sccs = findSccs(adj).sort((a, b) => b.length - a.length);
   for (const scc of sccs.slice(0, MAX_CYCLE_FINDINGS)) {
     const cycle = representativeCycle(adj, scc);
@@ -191,33 +195,37 @@ export function computeStructureFindings(graph, { rules = {}, entrySet = new Set
     }));
   }
 
-  // A TypeScript `import type` is erased before runtime. It can still reveal architectural coupling, but
-  // it cannot create an initialization-order/runtime cycle. Report SCCs that grow only because of type
-  // edges separately and at info severity so agents do not churn working code to fix a phantom hazard.
+  // TypeScript `import type` and Rust module/use edges are compile-time coupling. They can reveal real
+  // architecture, but cannot create an initialization-order/runtime cycle. Report SCCs that require
+  // either classification separately so agents do not churn working code for a phantom runtime hazard.
   const runtimeKeys = new Set(sccs.map((s) => [...s].sort().join("\0")));
   const allSccs = findSccs(allAdj).sort((a, b) => b.length - a.length);
-  const typeCouplings = allSccs.filter((s) => !runtimeKeys.has([...s].sort().join("\0")));
+  const compileTimeCouplings = allSccs.filter((s) => !runtimeKeys.has([...s].sort().join("\0")));
   const edgeCountIn = (scc, list) => {
     const inside = new Set(scc);
     return list.reduce((n, [a, b]) => n + (inside.has(a) && inside.has(b) ? 1 : 0), 0);
   };
-  for (const scc of typeCouplings.slice(0, MAX_CYCLE_FINDINGS)) {
+  for (const scc of compileTimeCouplings.slice(0, MAX_CYCLE_FINDINGS)) {
     const cycle = representativeCycle(allAdj, scc);
     const runtimeInside = edgeCountIn(scc, edges);
     const typeInside = edgeCountIn(scc, typeOnlyEdges);
+    const compileInside = edgeCountIn(scc, compileOnlyEdges);
     const containsRuntimeCycle = sccs.some((runtime) => runtime.every((f) => scc.includes(f)));
+    const typeSpecific = compileInside === 0;
     findings.push(makeFinding({
       category: "structure",
-      rule: "type-coupling",
+      rule: typeSpecific ? "type-coupling" : "compile-time-coupling",
       severity: "info",
       confidence: "high",
-      title: `${containsRuntimeCycle ? "Type imports expand dependency coupling" : "Type-induced dependency cycle (no runtime cycle)"}: ${scc.length} files`,
-      detail: `${cycle.join(" → ")}. This strongly-connected group needs type-only edges to close; it contains ${runtimeInside} runtime edge(s) and ${typeInside} type-only edge(s)${containsRuntimeCycle ? ", with a smaller runtime cycle reported separately" : ", while its runtime import graph is acyclic"}. Treat this as design coupling, not an initialization-order failure.`,
+      title: `${containsRuntimeCycle
+        ? (typeSpecific ? "Type imports expand dependency coupling" : "Compile-time edges expand dependency coupling")
+        : (typeSpecific ? "Type-induced dependency cycle (no runtime cycle)" : "Compile-time dependency cycle (no runtime cycle)")}: ${scc.length} files`,
+      detail: `${cycle.join(" → ")}. This strongly-connected group needs compile-time-only edges to close; it contains ${runtimeInside} runtime edge(s), ${typeInside} type-only edge(s), and ${compileInside} compile-only edge(s)${containsRuntimeCycle ? ", with a smaller runtime cycle reported separately" : ", while its runtime import graph is acyclic"}. Treat this as design coupling, not an initialization-order failure.`,
       file: cycle[0],
       graphNodeId: cycle[0],
       evidence: cycle.map((f) => ({ file: f, line: 0, snippet: "" })),
       source: "internal",
-      fixHint: "review the shared type ownership only if the coupling impedes changes; no runtime-cycle fix is required",
+      fixHint: "review the compile-time ownership only if the coupling impedes changes; no runtime-cycle fix is required",
     }));
   }
   if (sccs.length > MAX_CYCLE_FINDINGS) {
@@ -275,11 +283,16 @@ export function computeStructureFindings(graph, { rules = {}, entrySet = new Set
       importEdges: allEdges.length,
       runtimeImportEdges: edges.length,
       typeOnlyImportEdges: typeOnlyEdges.length,
+      compileOnlyImportEdges: compileOnlyEdges.length,
+      compileTimeImportEdges: compileTimeEdges.length,
       cycles: sccs.length,
       runtimeCycles: sccs.length,
       largestCycle: sccs[0]?.length || 0,
-      typeCouplings: typeCouplings.length,
-      largestTypeCoupling: typeCouplings[0]?.length || 0,
+      // Backward-compatible aliases remain for edgeTypesV 1 consumers.
+      typeCouplings: compileTimeCouplings.length,
+      largestTypeCoupling: compileTimeCouplings[0]?.length || 0,
+      compileTimeCouplings: compileTimeCouplings.length,
+      largestCompileTimeCoupling: compileTimeCouplings[0]?.length || 0,
       orphans: findings.filter((f) => f.rule === "orphan-file").length,
       boundaryViolations: violations.length,
     },

package/src/analysis/endpoints-rust.js

@@ -0,0 +1,124 @@
+const RUST_ROUTE_METHOD = "get|post|put|patch|delete|head|options|trace|connect|any";
+
+// Find a call's closing parenthesis without mistaking parens inside strings for syntax. This is deliberately
+// small (not a Rust parser), but keeps route-handler expressions bounded instead of using a cross-statement
+// regex that could turn an unrelated function call into a route.
+function closingParen(text, openAt) {
+  let depth = 0, quote = "", escaped = false, blockComment = 0;
+  for (let i = openAt; i < text.length; i++) {
+    const ch = text[i];
+    if (quote) {
+      if (escaped) escaped = false;
+      else if (ch === "\\") escaped = true;
+      else if (ch === quote) quote = "";
+      continue;
+    }
+    if (blockComment) {
+      if (ch === "/" && text[i + 1] === "*") { blockComment++; i++; }
+      else if (ch === "*" && text[i + 1] === "/") { blockComment--; i++; }
+      continue;
+    }
+    if (ch === "/" && text[i + 1] === "/") {
+      const newline = text.indexOf("\n", i + 2);
+      if (newline < 0) return -1;
+      i = newline;
+      continue;
+    }
+    if (ch === "/" && text[i + 1] === "*") { blockComment = 1; i++; continue; }
+    if (ch === '"') { quote = ch; continue; }
+    if (ch === "'") {
+      // Skip a Rust character literal, but do not mistake a lifetime (`'a`) for an unterminated string.
+      const char = /^'(?:\\.|[^\\'\r\n])'/.exec(text.slice(i));
+      if (char) { i += char[0].length - 1; continue; }
+    }
+    if (ch === "(") depth++;
+    else if (ch === ")" && --depth === 0) return i;
+  }
+  return -1;
+}
+
+// Parse axum's MethodRouter expression, including direct method chains:
+//   get(list).post(create) / axum::routing::get(show).delete(remove)
+// Calls inside a handler closure are not scanned and therefore cannot become fake endpoint methods.
+function axumRoutes(expr) {
+  const found = [];
+  let rest = String(expr || ""), offset = 0;
+  const firstRe = new RegExp(`^\\s*(?:(?:axum\\s*::\\s*)?routing\\s*::\\s*)?(${RUST_ROUTE_METHOD})\\s*\\(`, "i");
+  let match = firstRe.exec(rest);
+  if (!match) return found;
+
+  while (match) {
+    const openAt = offset + match.index + match[0].lastIndexOf("(");
+    const closeAt = closingParen(expr, openAt);
+    if (closeAt < 0) break;
+    found.push({ method: match[1], handler: expr.slice(openAt + 1, closeAt), index: openAt });
+    offset = closeAt + 1;
+    rest = expr.slice(offset);
+    match = new RegExp(`^\\s*\\.\\s*(${RUST_ROUTE_METHOD})\\s*\\(`, "i").exec(rest);
+  }
+  return found;
+}
+
+// Actix's builder form is structurally distinct from axum and from HTTP clients:
+//   web::get().to(handler) / actix_web::web::post().to(handler)
+function actixRoutes(expr) {
+  const found = [];
+  const re = new RegExp(`(?:actix_web\\s*::\\s*)?web\\s*::\\s*(${RUST_ROUTE_METHOD})\\s*\\(\\s*\\)\\s*\\.\\s*to\\s*\\(`, "gi");
+  let match;
+  while ((match = re.exec(expr))) {
+    const openAt = re.lastIndex - 1;
+    const closeAt = closingParen(expr, openAt);
+    if (closeAt < 0) continue;
+    found.push({ method: match[1], handler: expr.slice(openAt + 1, closeAt), index: match.index });
+    re.lastIndex = closeAt + 1;
+  }
+  return found;
+}
+
+export function extractRustEndpoints(text, add) {
+  let match;
+
+  // Axum and actix both expose a path-first `.route(path, ...)` builder. Requiring either an axum
+  // MethodRouter or actix's web::<method>().to(...) avoids treating arbitrary Rust APIs named `route` as HTTP.
+  const routeRe = /\.\s*route\s*\(\s*"(\/(?:\\.|[^"\\])*)"\s*,/g;
+  while ((match = routeRe.exec(text))) {
+    const openAt = text.indexOf("(", match.index);
+    const closeAt = closingParen(text, openAt);
+    if (closeAt < 0) continue;
+    const exprStart = routeRe.lastIndex;
+    const expr = text.slice(exprStart, closeAt);
+    const routes = [...axumRoutes(expr), ...actixRoutes(expr)];
+    for (const route of routes) add(route.method, match[1], route.handler, exprStart + route.index);
+    routeRe.lastIndex = closeAt + 1;
+  }
+
+  // actix `web::resource(path)` associates several method routes with one path.
+  const resourceRe = /(?:actix_web\s*::\s*)?web\s*::\s*resource\s*\(\s*"(\/(?:\\.|[^"\\])*)"\s*\)/g;
+  while ((match = resourceRe.exec(text))) {
+    const tail = text.slice(resourceRe.lastIndex);
+    const nextResource = tail.search(/(?:actix_web\s*::\s*)?web\s*::\s*resource\s*\(/);
+    const semicolon = text.indexOf(";", resourceRe.lastIndex);
+    let end = Math.min(text.length, resourceRe.lastIndex + 4000);
+    if (nextResource >= 0) end = Math.min(end, resourceRe.lastIndex + nextResource);
+    if (semicolon >= 0) end = Math.min(end, semicolon);
+    const chain = text.slice(resourceRe.lastIndex, end);
+    for (const route of actixRoutes(chain)) add(route.method, match[1], route.handler, resourceRe.lastIndex + route.index);
+  }
+
+  // Actix attribute macros. The route macro can declare more than one method for the same handler.
+  const macroRe = new RegExp(`#\\s*\\[\\s*(?:(?:actix_web|actix)\\s*::\\s*)?(${RUST_ROUTE_METHOD})\\s*\\(\\s*"(\\/(?:\\\\.|[^"\\\\])*)"(?:\\s*,[^\\]]*)?\\s*\\)\\s*\\]`, "gi");
+  while ((match = macroRe.exec(text))) {
+    const after = text.slice(macroRe.lastIndex, macroRe.lastIndex + 600);
+    const fn = /\b(?:pub(?:\s*\([^)]*\))?\s+)?(?:async\s+)?fn\s+([A-Za-z_][\w]*)/.exec(after);
+    add(match[1], match[2], fn ? fn[1] : "", match.index);
+  }
+
+  const multiMacroRe = /#\s*\[\s*(?:(?:actix_web|actix)\s*::\s*)?route\s*\(\s*"(\/(?:\\.|[^"\\])*)"([\s\S]*?)\)\s*\]/gi;
+  while ((match = multiMacroRe.exec(text))) {
+    const after = text.slice(multiMacroRe.lastIndex, multiMacroRe.lastIndex + 600);
+    const fn = /\b(?:pub(?:\s*\([^)]*\))?\s+)?(?:async\s+)?fn\s+([A-Za-z_][\w]*)/.exec(after);
+    const methodRe = /\bmethod\s*=\s*"(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS|TRACE|CONNECT)"/gi;
+    let method;
+    while ((method = methodRe.exec(match[2]))) add(method[1], match[1], fn ? fn[1] : "", match.index);
+  }
+}

package/src/analysis/endpoints.js

@@ -1,16 +1,18 @@
 // endpoints.js — detect the repo's OWN HTTP API surface (routes it EXPOSES), so the Health tab can
 // surface endpoints the way infra towers surface the services a repo TALKS TO. Each endpoint carries a
 // best-effort handler NAME so the UI can join it to that method's health (O(n) complexity, criticality,
-// coverage). Covers the common shapes across JS/TS, Python and Go:
+// coverage). Covers the common shapes across JS/TS, Python, Go and Rust:
 //   • object routes (Bun.serve / custom):  "/path": { GET: handler, POST: fn }   |   "/path": handler
 //   • method-call routes (Express/Fastify/Koa/Hono/gin/echo):  app.get("/path", handler)
 //   • decorators (FastAPI/Flask/NestJS):   @app.get("/path")  /  @Get("/path")
 //   • Go net/http:                          mux.HandleFunc("/path", handler)
+//   • Rust axum/actix-web:                  .route("/path", get(handler)) / #[get("/path")]
 import { safeRead } from "../util.js";
 import { createRepoBoundary } from "../repo-path.js";
+import { extractRustEndpoints } from "./endpoints-rust.js";
 
 const MAX_FILES = 3000;
-const HTTP_METHODS = new Set(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS", "ALL", "ANY"]);
+const HTTP_METHODS = new Set(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS", "TRACE", "CONNECT", "ALL", "ANY"]);
 // UNAMBIGUOUS HTTP CLIENTS (make requests) vs servers (define routes) — reject `axios.get("/x")`-style client
 // calls in frontend code. Ambiguous names (api/client/service — could be a server router) are NOT listed;
 // they're filtered by the handler requirement instead (a client call has no handler / a config object arg).
@@ -31,7 +33,9 @@ function lineAt(text, index) {
 function handlerName(expr) {
   const s = String(expr || "").trim();
   if (!s) return "";
-  if (/=>/.test(s) || /^\s*(async\s+)?function\b/.test(s)) return "";
+  if (/=>/.test(s) || /^\s*(async\s+)?function\b/.test(s) || /^\s*(?:async\s+)?(?:move\s+)?\|[^|]*\|/.test(s)) return "";
+  const turbofish = /(?:^|::)([A-Za-z_][\w]*)\s*::<[\s\S]*>\s*$/.exec(s);
+  if (turbofish) return turbofish[1];
   const ids = s.match(/[A-Za-z_$][\w$]*/g);
   if (!ids) return "";
   const SKIP = new Set(["async", "function", "await", "req", "res", "ctx", "request", "response", "next", "return"]);
@@ -68,6 +72,7 @@ export function nextRoutePath(file) {
 export function extractEndpointsFromText(text, file) {
   const out = [];
   const py = /\.py$/i.test(file);
+  const rust = /\.rs$/i.test(file);
   const add = (method, path, expr, idx) => {
     const p = cleanPath(path);
     if (!looksLikePath(p)) return;
@@ -101,6 +106,8 @@ export function extractEndpointsFromText(text, file) {
     }
   }
 
+  if (rust) extractRustEndpoints(text, add);
+
   // ---- object routes: "/path": { GET: fn, POST: fn2 }  or  "/path": handler --------------------
   // find each  "…": {  or  "…": expr,  where the key looks like a path
   const objKeyRe = /(["'`])(\/[^"'`]*)\1\s*:\s*(\{)?/g;
@@ -171,7 +178,7 @@ export function detectEndpoints(repoPath, codeFiles) {
   const boundary = createRepoBoundary(repoPath);
   for (const f of files) {
     const rel = f.path || f;
-    if (!/\.(js|ts|tsx|jsx|cjs|mjs|py|go)$/i.test(rel)) continue;
+    if (!/\.(js|ts|tsx|jsx|cjs|mjs|py|go|rs)$/i.test(rel)) continue;
     const resolved = boundary.resolve(rel);
     if (!resolved.ok) continue;
     const text = safeRead(resolved.path);

package/src/analysis/graph-analysis.aggregate.js

@@ -6,6 +6,8 @@ import { join } from "node:path";
 import { normalizeRepoParts, readCoverageForRepo, pctFromCounts } from "./coverage-reports.js";
 import { bareSymbolName, countLocalRefsOutsideOwnRange, computeSymbolExternalRefs } from "./graph-analysis.refs.js";
 import { createRepoBoundary } from "../repo-path.js";
+import { edgeList, folderModuleOf } from "./graph-analysis.edges.js";
+export { folderModuleOf } from "./graph-analysis.edges.js";
 
 // Aggregate a built graph.json into the file- and module-level view the UI needs:
 //   - graph-builder nodes are FILES *and* their symbols (functions/methods), linked file→symbol by the
@@ -13,7 +15,6 @@ import { createRepoBoundary } from "../repo-path.js";
 //   - Each file is assigned to ONE module via its file-node's community (symbols may cluster apart,
 //     but the file itself belongs where its file-node sits) → exact, non-overlapping file counts.
 //   - Real edges (everything except "contains") roll up to file→file and module→module relations.
-// Module names match summarizeCommunities (dominant first-two-path-parts), so they line up with cards.
 export function analyzeGraph(graphJsonPath, repoRoot) {
   let graph;
   try {
@@ -40,15 +41,11 @@ export function aggregateGraph(graph, repoRoot) {
   // MODULE = the file's own top FOLDER (its "territory"), up to 2 path levels — NOT a dependency
   // cluster. e.g. src/widget/foo.js → "src/widget"; benchmarks/cleanup.py → "benchmarks" (so all
   // benchmarks files are one module); a top-level file like index.js → "(root)".
-  const folderOf = (file) => {
-    const dirs = String(file || "").split(/[\\/]/).filter(Boolean).slice(0, -1);
-    return dirs.length ? dirs.slice(0, 2).join("/") : "(root)";
-  };
   // In a merged (cross-repo) graph every node carries a `repo`; qualify file & module identity by it
   // so same-named folders/files in different repos never merge. Single-repo graphs have no `repo`,
   // so identity stays the bare path (unchanged behavior).
   const fileIdOf = (node) => (node.repo ? `${node.repo}::${node.source_file}` : node.source_file);
-  const moduleOfNode = (node) => (node.repo ? `${node.repo}/` : "") + folderOf(node.source_file);
+  const moduleOfNode = (node) => (node.repo ? `${node.repo}/` : "") + folderModuleOf(node.source_file);
 
   // file → module (folder) + symbols + display path, all keyed by repo-qualified file id
   const fileModule = new Map();
@@ -102,40 +99,36 @@ export function aggregateGraph(graph, repoRoot) {
   const moduleEdges = new Map();
   const typeOnlyFileEdges = new Map();
   const typeOnlyModuleEdges = new Map();
+  const compileOnlyFileEdges = new Map();
+  const compileOnlyModuleEdges = new Map();
+  const compileTimeFileEdges = new Map();
+  const compileTimeModuleEdges = new Map();
+  const addFileEdge = (map, key, link) => {
+    let edge = map.get(key);
+    if (!edge) map.set(key, (edge = { count: 0, rels: {} }));
+    edge.count++;
+    if (link.relation) edge.rels[link.relation] = (edge.rels[link.relation] || 0) + 1;
+  };
   for (const link of links) {
     if (link.relation === "contains") continue;
     const fromFile = id2file.get(endpoint(link.source));
     const toFile = id2file.get(endpoint(link.target));
     if (fromFile && toFile && fromFile !== toFile) {
       const key = `${fromFile} ${toFile}`;
-      const targetFileEdges = link.typeOnly === true ? typeOnlyFileEdges : fileEdges;
-      let fe = targetFileEdges.get(key);
-      if (!fe) targetFileEdges.set(key, (fe = { count: 0, rels: {} }));
-      fe.count++;
-      if (link.relation) fe.rels[link.relation] = (fe.rels[link.relation] || 0) + 1;
+      const compileTime = link.typeOnly === true || link.compileOnly === true;
+      const targetFileEdges = link.typeOnly === true ? typeOnlyFileEdges : link.compileOnly === true ? compileOnlyFileEdges : fileEdges;
+      addFileEdge(targetFileEdges, key, link);
+      if (compileTime) addFileEdge(compileTimeFileEdges, key, link);
       const fromMod = fileModule.get(fromFile);
       const toMod = fileModule.get(toFile);
       if (fromMod && toMod && fromMod !== toMod) {
         const mkey = `${fromMod} ${toMod}`;
-        const targetModuleEdges = link.typeOnly === true ? typeOnlyModuleEdges : moduleEdges;
+        const targetModuleEdges = link.typeOnly === true ? typeOnlyModuleEdges : link.compileOnly === true ? compileOnlyModuleEdges : moduleEdges;
         targetModuleEdges.set(mkey, (targetModuleEdges.get(mkey) || 0) + 1);
+        if (compileTime) compileTimeModuleEdges.set(mkey, (compileTimeModuleEdges.get(mkey) || 0) + 1);
       }
     }
   }
-  const split = (key) => {
-    const i = key.indexOf(" ");
-    return [key.slice(0, i), key.slice(i + 1)];
-  };
-  const edgeList = (map) =>
-    [...map.entries()]
-      .map(([key, v]) => {
-        const [from, to] = split(key);
-        if (typeof v === "number") return { from, to, count: v }; // moduleEdges (no relation breakdown)
-        const dom = Object.entries(v.rels).sort((a, b) => b[1] - a[1])[0];
-        return { from, to, count: v.count, relation: dom ? dom[0] : null };
-      })
-      .sort((a, b) => b.count - a.count);
-
   // symbol-level (function/method) call graph: edges between symbol nodes (calls/method), each symbol
   // tagged with its file's module so the Symbols view can still cluster into module regions.
   const symEdges = new Map();
@@ -268,8 +261,12 @@ export function aggregateGraph(graph, repoRoot) {
       .sort((a, b) => b.fileCount - a.fileCount),
     moduleEdges: edgeList(moduleEdges),
     typeOnlyModuleEdges: edgeList(typeOnlyModuleEdges),
+    compileOnlyModuleEdges: edgeList(compileOnlyModuleEdges),
+    compileTimeModuleEdges: edgeList(compileTimeModuleEdges),
     fileEdges: edgeList(fileEdges),
     typeOnlyFileEdges: edgeList(typeOnlyFileEdges),
+    compileOnlyFileEdges: edgeList(compileOnlyFileEdges),
+    compileTimeFileEdges: edgeList(compileTimeFileEdges),
     symbols,
     symbolEdges,
     symbolRefs: [...new Set([...symbolLocalRefs.keys(), ...symbolExternalRefs.keys()])].map((id) => {
@@ -283,8 +280,12 @@ export function aggregateGraph(graph, repoRoot) {
       nodes: nodes.filter((n) => n.file_type === "code").length,
       fileEdges: fileEdges.size,
       typeOnlyFileEdges: typeOnlyFileEdges.size,
+      compileOnlyFileEdges: compileOnlyFileEdges.size,
+      compileTimeFileEdges: compileTimeFileEdges.size,
       moduleEdges: moduleEdges.size,
       typeOnlyModuleEdges: typeOnlyModuleEdges.size,
+      compileOnlyModuleEdges: compileOnlyModuleEdges.size,
+      compileTimeModuleEdges: compileTimeModuleEdges.size,
       symbols: symbols.length,
       symbolEdges: symbolEdges.length
     }

package/src/analysis/graph-analysis.edges.js

@@ -0,0 +1,21 @@
+// Stable folder territories used by module_map. Nested package source roots keep the first directory below
+// `src`; otherwise a monorepo's entire crate/app would collapse into one module with no visible dependencies.
+export function folderModuleOf(file) {
+  const dirs = String(file || "").split(/[\\/]/).filter(Boolean).slice(0, -1);
+  if (!dirs.length) return "(root)";
+  const sourceRoot = dirs.lastIndexOf("src");
+  if (sourceRoot >= 0 && dirs.length > sourceRoot + 1) return dirs.slice(0, sourceRoot + 2).join("/");
+  return dirs.slice(0, 2).join("/");
+}
+
+export function edgeList(map) {
+  return [...map.entries()]
+    .map(([key, value]) => {
+      const splitAt = key.indexOf(" ");
+      const from = key.slice(0, splitAt), to = key.slice(splitAt + 1);
+      if (typeof value === "number") return { from, to, count: value };
+      const dominant = Object.entries(value.rels).sort((a, b) => b[1] - a[1])[0];
+      return { from, to, count: value.count, relation: dominant ? dominant[0] : null };
+    })
+    .sort((a, b) => b.count - a.count);
+}

package/src/analysis/graph-analysis.js

@@ -4,4 +4,4 @@
 // Facade: implementation lives in graph-analysis.summaries.js and graph-analysis.aggregate.js
 // (with internal helpers in graph-analysis.refs.js).
 export { summarizeCommunities, summarizeHotspots } from "./graph-analysis.summaries.js";
-export { analyzeGraph, aggregateGraph } from "./graph-analysis.aggregate.js";
+export { analyzeGraph, aggregateGraph, folderModuleOf } from "./graph-analysis.aggregate.js";

package/src/analysis/graph-analysis.summaries.js

@@ -1,6 +1,8 @@
 // Reading a built graph.json and summarizing it for the UI cards: named communities and degree
 // hotspots. Both read the graph file from disk and return [] on any failure.
 import { readFileSync } from "node:fs";
+import { communityTerritoryOf } from "../graph/community.js";
+import { isStructuralRelation } from "../graph/relations.js";
 
 // graph-builder labels communities "Community N" without an LLM. Derive a real name from each
 // community's dominant folder + sample files so the UI shows modules, not bare numbers.
@@ -16,7 +18,7 @@ export function summarizeCommunities(graphJsonPath, max = 40) {
       const entry = byCommunity.get(community);
       entry.size += 1;
       const parts = String(node.source_file || "").split(/[\\/]/).filter(Boolean);
-      const dir = parts.length > 1 ? parts.slice(0, 2).join("/") : "(root)";
+      const dir = communityTerritoryOf(node.source_file);
       entry.dirs.set(dir, (entry.dirs.get(dir) || 0) + 1);
       if (entry.files.length < 4) entry.files.push(parts[parts.length - 1] || node.source_file || "");
     }
@@ -41,6 +43,7 @@ export function summarizeHotspots(graphJsonPath, max = 15) {
     const inDeg = new Map();
     const outDeg = new Map();
     for (const link of graph.links || []) {
+      if (isStructuralRelation(link.relation)) continue;
       const s = endpoint(link.source);
       const t = endpoint(link.target);
       outDeg.set(s, (outDeg.get(s) || 0) + 1);

package/src/analysis/internal-audit.collect.js

@@ -50,6 +50,46 @@ export function listRepoFiles(repoRoot) {
   return files;
 }
 
+const NON_RUNTIME_DIR_RE = /^(?:templates?|examples?|samples?|fixtures?|snippets?|__fixtures__)$/i;
+const NON_RUNTIME_README_RE = /(?:\b(?:reusable|copyable|reference)\b[\s\S]{0,160}\b(?:templates?|snippets?|examples?|samples?)\b|\b(?:these|contents?)\s+are\s+templates?\b)/i;
+const normConfiguredRoot = (value) => {
+  const root = String(value || "").trim().replace(/\\/g, "/").replace(/^\.\//, "").replace(/^\/+|\/+$/g, "");
+  if (!root || root === "." || root.split("/").some((part) => part === "..")) return "";
+  return root;
+};
+
+// Runtime health findings should not treat copy-paste catalogs as deployed applications. Conventional
+// template/example directories are safe to infer; a top-level custom catalog is inferred only when its
+// own README explicitly describes reusable templates/snippets. Projects can declare additional roots in
+// `.weavatrix-deps.json` through `nonRuntimeRoots` / `templateRoots`.
+export function collectNonRuntimeRoots(repoRoot, rules = {}) {
+  const files = listRepoFiles(repoRoot);
+  const roots = new Set();
+  const configured = [
+    rules.nonRuntimeRoots, rules.templateRoots,
+    rules.dependencies?.nonRuntimeRoots, rules.dependencies?.templateRoots,
+  ].flatMap((value) => Array.isArray(value) ? value : typeof value === "string" ? [value] : []);
+  for (const value of configured) {
+    const root = normConfiguredRoot(value);
+    if (root) roots.add(root);
+  }
+
+  for (const file of files) {
+    const parts = file.replace(/\\/g, "/").split("/");
+    for (let i = 0; i < parts.length - 1; i++) {
+      if (NON_RUNTIME_DIR_RE.test(parts[i])) roots.add(parts.slice(0, i + 1).join("/"));
+    }
+  }
+
+  const boundary = createRepoBoundary(repoRoot);
+  for (const file of files) {
+    if (!/^[^/]+\/README\.md$/i.test(file)) continue; // custom inference is deliberately top-level only
+    const text = readRepoText(boundary, file);
+    if (text != null && NON_RUNTIME_README_RE.test(text)) roots.add(normRoot(dirname(file)));
+  }
+  return [...roots].filter(Boolean).sort((a, b) => a.localeCompare(b));
+}
+
 export function collectSourceTexts(repoRoot, graph) {
   const sources = new Map();
   const boundary = createRepoBoundary(repoRoot);

package/src/analysis/internal-audit.run.js

@@ -16,7 +16,7 @@ import { scanMalware } from "../security/malware-heuristics.js";
 import { classifyTyposquat } from "../security/typosquat.js";
 import {
   readJson, readRepoText, readRepoJson, collectSourceTexts, collectConfigTexts, workspacePkgNames,
-  collectPackageScopes, collectPyManifest, TEST_FILE_RE,
+  collectPackageScopes, collectPyManifest, collectNonRuntimeRoots, TEST_FILE_RE,
 } from "./internal-audit.collect.js";
 import { entryFiles, computeReachability } from "./internal-audit.reach.js";
 import { createRepoBoundary } from "../repo-path.js";
@@ -40,19 +40,23 @@ export async function runInternalAudit(repoPath, { graph, advisoryStorePath, ski
 
   // Graphs can be stale or miss a helper file; text fallbacks must scan the real repo tree too.
   const sources = collectSourceTexts(repoPath, graph);
+  const nonRuntimeRoots = collectNonRuntimeRoots(repoPath, rules);
 
   const entries = entryFiles(graph, packageScopes, dynamicTargets, {
     declaredEntries: rules.entrypoints || rules.entries || [],
     sources,
   });
+  for (const file of sources.keys()) {
+    if (nonRuntimeRoots.some((root) => file === root || file.startsWith(`${root}/`))) entries.add(file);
+  }
   const dead = computeDead(graph, sources, { entrySet: entries });
   const unusedExports = computeUnusedExports(graph, sources, { dynamicTargets, entrySet: entries });
   const reachable = computeReachability(graph, entries);
   const configTexts = collectConfigTexts(repoPath);
-  const dep = computeScopedDepFindings({ externalImports, packageScopes, workspacePkgNames: workspacePkgNames(repoPath, pkg), configTexts });
+  const dep = computeScopedDepFindings({ externalImports, packageScopes, workspacePkgNames: workspacePkgNames(repoPath, pkg), configTexts, nonRuntimeRoots });
   // non-npm ecosystems: Go (go.mod) + Python (requirements/pyproject/Pipfile) — same findings shape
   const goModText = readRepoText(boundary, "go.mod");
-  const goDep = computeGoDepFindings({ externalImports, goMod: goModText != null ? parseGoMod(goModText) : null });
+  const goDep = computeGoDepFindings({ externalImports, goMod: goModText != null ? parseGoMod(goModText) : null, nonRuntimeRoots });
   const asList = (v) => Array.isArray(v) ? v : typeof v === "string" ? [v] : [];
   const pyRules = rules.python || {};
   const depRules = rules.dependencies || {};
@@ -66,7 +70,7 @@ export async function runInternalAudit(repoPath, { graph, advisoryStorePath, ski
   ])];
   const pyDep = computePyDepFindings({
     externalImports, pyManifest: collectPyManifest(repoPath), configTexts,
-    managedDependencies: managedPython, ignoredDependencies: ignoredPython,
+    managedDependencies: managedPython, ignoredDependencies: ignoredPython, nonRuntimeRoots,
   });
 
   // structure: cycles / orphans / boundary rules. Rules come from the repo's optional .weavatrix-deps.json
@@ -229,6 +233,7 @@ export async function runInternalAudit(repoPath, { graph, advisoryStorePath, ski
       malwareStatus: checks.malware.status,
       packageScopes: packageScopes.length,
       managedPythonDependencies: managedPython.length,
+      nonRuntimeRoots,
     },
     summary: summarizeFindings(sorted),
     findings: sorted,