weavatrix 0.1.3 → 0.2.0

package/src/mcp/evidence-snapshot.duplicates.mjs

@@ -0,0 +1,217 @@
+import {createHash} from 'node:crypto'
+import {computeDuplicates} from '../analysis/duplicates.js'
+import {
+    CAPS, STATE, VERDICT, bounded, compareText, graphId, repoRelativePath,
+} from './evidence-snapshot.common.mjs'
+
+const CLONE_MIN_SIMILARITY = 80
+const DIVERGENCE_MAX_SIMILARITY = 45
+const MIN_TOKENS = 50
+const FILTERED_CLASSES = new Set(['test', 'e2e', 'generated', 'mock', 'story', 'docs', 'benchmark', 'temp'])
+const SAFE_SYMBOL = /^[A-Za-z_$][A-Za-z0-9_$]*$/
+
+export const DUPLICATE_EVIDENCE_THRESHOLDS = Object.freeze({
+    clones: Object.freeze({mode: 'renamed', minSimilarityPercent: CLONE_MIN_SIMILARITY, minTokens: MIN_TOKENS}),
+    divergence: Object.freeze({
+        sameName: true,
+        maxSimilarityPercent: DIVERGENCE_MAX_SIMILARITY,
+        minTokens: MIN_TOKENS,
+        maxImplementationsPerName: 12,
+    }),
+})
+
+const hash = (value) => createHash('sha256').update(value).digest('hex').slice(0, 24)
+const positiveInteger = (value) => Number.isFinite(value) && value >= 1 ? Math.trunc(value) : undefined
+
+function safeGraphNodeId(value, file) {
+    const id = graphId(value)
+    if (!id) return undefined
+    const hashIndex = id.indexOf('#')
+    if (hashIndex < 1 || id.slice(0, hashIndex) !== file) return undefined
+    const suffix = id.slice(hashIndex)
+    return /^#[^\s\\/\u0000-\u001f\u007f]{1,511}$/u.test(suffix) ? id : undefined
+}
+
+function member(fragment) {
+    if (!fragment || typeof fragment !== 'object' || fragment.kind === 'string' || fragment.excluded === true) return null
+    const classes = Array.isArray(fragment.classes) ? fragment.classes : []
+    if (fragment.test === true || classes.some((value) => FILTERED_CLASSES.has(value))) return null
+    const file = repoRelativePath(fragment.file)
+    const startLine = positiveInteger(fragment.start)
+    const endLine = positiveInteger(fragment.end)
+    const tokens = positiveInteger(fragment.n)
+    if (!file || !startLine || !endLine || endLine < startLine || !tokens || tokens < MIN_TOKENS) return null
+    const out = {file, startLine, endLine, tokens}
+    const nodeId = safeGraphNodeId(fragment.id, file)
+    if (nodeId) out.graphNodeId = nodeId
+    return out
+}
+
+function memberIdentity(value) {
+    return `${value.file}\0${value.startLine}\0${value.endLine}\0${value.graphNodeId || ''}`
+}
+
+function compareMember(a, b) {
+    return compareText(a.file, b.file) || a.startLine - b.startLine || a.endLine - b.endLine ||
+        compareText(a.graphNodeId || '', b.graphNodeId || '')
+}
+
+function eligibleMembers(fragments) {
+    const out = new Map()
+    for (let index = 0; index < fragments.length; index++) {
+        const value = member(fragments[index])
+        if (value) out.set(index, value)
+    }
+    return out
+}
+
+function cloneGroups(data, membersByIndex) {
+    const parent = new Map([...membersByIndex.keys()].map((index) => [index, index]))
+    const find = (index) => {
+        let root = index
+        while (parent.get(root) !== root) root = parent.get(root)
+        while (parent.get(index) !== index) {
+            const next = parent.get(index)
+            parent.set(index, root)
+            index = next
+        }
+        return root
+    }
+    const union = (left, right) => {
+        const a = find(left), b = find(right)
+        if (a !== b) parent.set(a > b ? a : b, a > b ? b : a)
+    }
+    const links = []
+    for (const pair of Array.isArray(data?.modes?.renamed) ? data.modes.renamed : []) {
+        if (!Array.isArray(pair) || pair.length < 3) continue
+        const left = Number(pair[0]), right = Number(pair[1]), similarity = Number(pair[2])
+        if (!Number.isInteger(left) || !Number.isInteger(right) || left === right ||
+            !membersByIndex.has(left) || !membersByIndex.has(right) ||
+            !Number.isFinite(similarity) || similarity < CLONE_MIN_SIMILARITY || similarity > 100) continue
+        union(left, right)
+        links.push({left, right, similarity: Math.trunc(similarity)})
+    }
+
+    const components = new Map()
+    for (const index of membersByIndex.keys()) {
+        const root = find(index)
+        if (!components.has(root)) components.set(root, [])
+        components.get(root).push(index)
+    }
+
+    const groups = []
+    for (const indices of components.values()) {
+        if (indices.length < 2) continue
+        const unique = new Map()
+        for (const index of indices) {
+            const value = membersByIndex.get(index)
+            unique.set(memberIdentity(value), value)
+        }
+        const members = [...unique.values()].sort(compareMember)
+        if (members.length < 2) continue
+        const indexSet = new Set(indices)
+        const similarities = links
+            .filter((link) => indexSet.has(link.left) && indexSet.has(link.right))
+            .map((link) => link.similarity)
+        if (!similarities.length) continue
+        const identity = members.map(memberIdentity).join('\0')
+        groups.push({
+            id: hash(`clone\0${identity}`),
+            memberCount: members.length,
+            totalTokens: members.reduce((sum, value) => sum + value.tokens, 0),
+            strongestSimilarity: Math.max(...similarities),
+            weakestLinkedSimilarity: Math.min(...similarities),
+            membersTruncated: members.length > CAPS.duplicateMembers,
+            members: members.slice(0, CAPS.duplicateMembers),
+        })
+    }
+    return groups.sort((a, b) => b.totalTokens - a.totalTokens || b.memberCount - a.memberCount ||
+        b.strongestSimilarity - a.strongestSimilarity || compareText(a.id, b.id))
+}
+
+function divergenceCandidates(data, membersByIndex) {
+    const candidates = []
+    for (const twin of Array.isArray(data?.nameTwins) ? data.nameTwins : []) {
+        const symbol = typeof twin?.label === 'string' && SAFE_SYMBOL.test(twin.label) ? twin.label : undefined
+        if (!symbol) continue
+        const pairs = []
+        for (const pair of Array.isArray(twin.pairs) ? twin.pairs : []) {
+            const left = Number(pair?.a), right = Number(pair?.b), similarity = Number(pair?.similarity)
+            const leftMember = membersByIndex.get(left), rightMember = membersByIndex.get(right)
+            if (!Number.isInteger(left) || !Number.isInteger(right) || left === right || !leftMember || !rightMember ||
+                leftMember.file === rightMember.file || !Number.isFinite(similarity) ||
+                similarity < 0 || similarity > DIVERGENCE_MAX_SIMILARITY) continue
+            const members = [leftMember, rightMember].sort(compareMember)
+            pairs.push({
+                similarity: Math.trunc(similarity),
+                totalTokens: members[0].tokens + members[1].tokens,
+                members,
+                identity: members.map(memberIdentity).join('\0'),
+            })
+        }
+        pairs.sort((a, b) => a.similarity - b.similarity || b.totalTokens - a.totalTokens || compareText(a.identity, b.identity))
+        const selected = pairs[0]
+        if (!selected) continue
+        candidates.push({
+            id: hash(`divergence\0${symbol.toLowerCase()}\0${selected.identity}`),
+            symbol,
+            similarity: selected.similarity,
+            totalTokens: selected.totalTokens,
+            members: selected.members,
+        })
+    }
+    return candidates.sort((a, b) => b.totalTokens - a.totalTokens || a.similarity - b.similarity ||
+        compareText(a.symbol, b.symbol) || compareText(a.id, b.id))
+}
+
+function errorSection(reason = 'DUPLICATE_ANALYSIS_ERROR') {
+    return {
+        state: STATE.ERROR,
+        verdict: VERDICT.UNKNOWN,
+        thresholds: DUPLICATE_EVIDENCE_THRESHOLDS,
+        completeness: {
+            fragments: {total: 0, eligible: 0, filtered: 0},
+            cloneGroups: {total: 0, returned: 0, truncated: false},
+            divergenceCandidates: {total: 0, returned: 0, truncated: false},
+            reasons: [reason],
+        },
+        cloneGroups: [],
+        divergenceCandidates: [],
+    }
+}
+
+export function buildDuplicatesSection(repoRoot, graph) {
+    try {
+        const data = computeDuplicates(repoRoot, graph, {nameTwins: true, includeStrings: false})
+        if (!data?.ok || !Array.isArray(data.frags)) return errorSection()
+        const membersByIndex = eligibleMembers(data.frags)
+        const groups = bounded(cloneGroups(data, membersByIndex), CAPS.duplicateGroups)
+        const divergence = bounded(divergenceCandidates(data, membersByIndex), CAPS.divergenceCandidates)
+        const reasons = []
+        if (!Number.isFinite(data.graphSymbols) || data.graphSymbols < 1) reasons.push('NO_GRAPH_SYMBOLS')
+        if (data.completeness?.assetFiles?.truncated) reasons.push('ASSET_SCAN_TRUNCATED')
+        if (data.completeness?.nameTwinsTruncated) reasons.push('NAME_TWIN_SCAN_TRUNCATED')
+        if (groups.items.some((group) => group.membersTruncated)) reasons.push('CLONE_MEMBERS_TRUNCATED')
+        if (groups.completeness.truncated) reasons.push('CLONE_GROUPS_TRUNCATED')
+        if (divergence.completeness.truncated) reasons.push('DIVERGENCE_CANDIDATES_TRUNCATED')
+        return {
+            state: reasons.length ? STATE.PARTIAL : STATE.COMPLETE,
+            verdict: VERDICT.UNKNOWN,
+            thresholds: DUPLICATE_EVIDENCE_THRESHOLDS,
+            completeness: {
+                fragments: {
+                    total: data.frags.length,
+                    eligible: membersByIndex.size,
+                    filtered: data.frags.length - membersByIndex.size,
+                },
+                cloneGroups: groups.completeness,
+                divergenceCandidates: divergence.completeness,
+                reasons,
+            },
+            cloneGroups: groups.items,
+            divergenceCandidates: divergence.items,
+        }
+    } catch {
+        return errorSection()
+    }
+}

package/src/mcp/evidence-snapshot.health.mjs

@@ -0,0 +1,95 @@
+import {
+    CAPS, COMPLEXITY_THRESHOLDS, STATE, VERDICT, addIf, bounded, compareText, graphId,
+    normalizeCheckState, numericRecord, optionalNonNegativeInteger, privacySafeText, repoRelativePath,
+    sanitizeFinding,
+} from './evidence-snapshot.common.mjs'
+
+function buildHotspots(graph) {
+    let analyzed = 0
+    const facts = []
+    for (const node of Array.isArray(graph?.nodes) ? graph.nodes : []) {
+        if (!node || typeof node !== 'object' || !node.complexity || typeof node.complexity !== 'object') continue
+        const id = graphId(node.id)
+        const file = repoRelativePath(node.source_file)
+        if (!id || !file) continue
+        analyzed++
+        const loc = optionalNonNegativeInteger(node.complexity.loc)
+        const cyclomatic = optionalNonNegativeInteger(node.complexity.cyclomatic)
+        const params = optionalNonNegativeInteger(node.complexity.params)
+        const breaches = []
+        let severity = 'medium'
+        if (loc !== undefined && loc >= COMPLEXITY_THRESHOLDS.loc.high) { breaches.push('LOC_HIGH'); severity = 'high' }
+        else if (loc !== undefined && loc >= COMPLEXITY_THRESHOLDS.loc.warning) breaches.push('LOC_WARNING')
+        if (cyclomatic !== undefined && cyclomatic >= COMPLEXITY_THRESHOLDS.cyclomatic.high) { breaches.push('CYCLOMATIC_HIGH'); severity = 'high' }
+        else if (cyclomatic !== undefined && cyclomatic >= COMPLEXITY_THRESHOLDS.cyclomatic.warning) breaches.push('CYCLOMATIC_WARNING')
+        if (params !== undefined && params >= COMPLEXITY_THRESHOLDS.params.high) { breaches.push('PARAMS_HIGH'); severity = 'high' }
+        else if (params !== undefined && params >= COMPLEXITY_THRESHOLDS.params.warning) breaches.push('PARAMS_WARNING')
+        if (!breaches.length) continue
+        const fact = {id, file, severity, breaches: breaches.sort(compareText)}
+        addIf(fact, 'symbol', privacySafeText(node.label, 256))
+        addIf(fact, 'startLine', optionalNonNegativeInteger(node.complexity.startLine))
+        addIf(fact, 'endLine', optionalNonNegativeInteger(node.complexity.endLine))
+        addIf(fact, 'loc', loc)
+        addIf(fact, 'cyclomatic', cyclomatic)
+        addIf(fact, 'params', params)
+        facts.push(fact)
+    }
+    facts.sort((a, b) => (a.severity === b.severity ? 0 : a.severity === 'high' ? -1 : 1) ||
+        (b.loc || 0) - (a.loc || 0) || (b.cyclomatic || 0) - (a.cyclomatic || 0) ||
+        (b.params || 0) - (a.params || 0) || compareText(a.id, b.id))
+    return {analyzed, ...bounded(facts, CAPS.hotspots)}
+}
+
+export function buildHealthSection(graph, audit) {
+    if (!audit?.ok) {
+        return {
+            state: STATE.ERROR,
+            verdict: VERDICT.UNKNOWN,
+            completeness: {reasons: ['AUDIT_ERROR']},
+            summary: {bySeverity: {}, byCategory: {}},
+            checks: {osv: STATE.ERROR, malware: STATE.ERROR},
+            findings: [],
+            complexity: {thresholds: COMPLEXITY_THRESHOLDS, analyzed: 0, hotspots: []},
+        }
+    }
+    const findings = bounded((audit.findings || []).map(sanitizeFinding).filter(Boolean)
+        .sort((a, b) => compareText(a.severity, b.severity) || compareText(a.category, b.category) ||
+            compareText(a.rule, b.rule) || compareText(a.file || a.package || '', b.file || b.package || '') || compareText(a.id, b.id)),
+    CAPS.findings)
+    const hotspots = buildHotspots(graph)
+    const checks = {
+        osv: normalizeCheckState(audit.checks?.osv?.status),
+        malware: normalizeCheckState(audit.checks?.malware?.status),
+    }
+    const state = Object.values(checks).every((value) => value === STATE.COMPLETE || value === STATE.NOT_APPLICABLE)
+        ? STATE.COMPLETE
+        : STATE.PARTIAL
+    return {
+        state,
+        verdict: findings.completeness.total > 0 || hotspots.completeness.total > 0
+            ? VERDICT.FAIL
+            : state === STATE.COMPLETE ? VERDICT.PASS : VERDICT.UNKNOWN,
+        completeness: {
+            findings: findings.completeness,
+            hotspots: hotspots.completeness,
+            complexity: {analyzed: hotspots.analyzed},
+            reasons: state === STATE.PARTIAL ? ['OPTIONAL_CHECKS_INCOMPLETE'] : [],
+        },
+        summary: {
+            bySeverity: numericRecord(audit.summary?.bySeverity, ['critical', 'high', 'medium', 'low', 'info']),
+            byCategory: numericRecord(audit.summary?.byCategory, ['unused', 'structure', 'vulnerability', 'malware']),
+            dead: numericRecord(audit.deadReport, ['deadSymbols', 'deadFiles', 'unusedExports']),
+            structure: numericRecord(audit.structureReport, [
+                'runtimeImportEdges', 'typeOnlyImportEdges', 'compileOnlyImportEdges', 'runtimeCycles',
+                'compileTimeCouplings', 'largestCycle', 'largestCompileTimeCoupling', 'orphans', 'boundaryViolations',
+            ]),
+        },
+        checks,
+        findings: findings.items,
+        complexity: {
+            thresholds: COMPLEXITY_THRESHOLDS,
+            analyzed: hotspots.analyzed,
+            hotspots: hotspots.items,
+        },
+    }
+}

package/src/mcp/evidence-snapshot.inventory.mjs

@@ -0,0 +1,148 @@
+import {
+    CAPS, STATE, VERDICT, addIf, bounded, compareText, metadataString, normalizeCheckState,
+    repoRelativePath, safeToken,
+} from './evidence-snapshot.common.mjs'
+import {buildPackageDependencyGraph} from './evidence-snapshot.package-graph.mjs'
+
+const FIXED_PACKAGE_SOURCES = new Set([
+    'package-lock', 'yarn-lock', 'requirements', 'venv', 'poetry-lock', 'uv-lock',
+    'pipfile-lock', 'go-sum', 'go-mod', 'node_modules',
+])
+const PACKAGE_SOURCE_FILE = /(^|\/)(?:package-lock\.json|npm-shrinkwrap\.json|yarn\.lock|pnpm-lock\.ya?ml|requirements[\w.-]*\.(?:txt|in)|poetry\.lock|uv\.lock|Pipfile\.lock|go\.(?:mod|sum))$/i
+
+function sanitizeBadge(category, value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) return null
+    const id = safeToken(value.id, 128)
+    if (!id) return null
+    const out = {category, id}
+    addIf(out, 'name', metadataString(value.name || value.label, 128))
+    addIf(out, 'kind', safeToken(value.kind, 64))
+    addIf(out, 'title', metadataString(value.title, 128))
+    addIf(out, 'version', safeToken(value.version, 64))
+    return out
+}
+
+export function buildTechnologiesSection(stack, stackError) {
+    if (stackError) {
+        return {
+            state: STATE.ERROR,
+            verdict: VERDICT.UNKNOWN,
+            completeness: {badges: {total: 0, returned: 0, truncated: false}, reasons: ['STACK_DETECTION_ERROR']},
+            badges: [],
+        }
+    }
+    const categories = ['languages', 'runtimes', 'tests', 'infra', 'deploy']
+    const facts = categories.flatMap((category) => (Array.isArray(stack?.[category]) ? stack[category] : [])
+        .map((badge) => sanitizeBadge(category, badge)).filter(Boolean))
+        .sort((a, b) => compareText(a.category, b.category) || compareText(a.id, b.id))
+    const badges = bounded(facts, CAPS.stackBadges)
+    return {
+        state: STATE.PARTIAL,
+        verdict: VERDICT.UNKNOWN,
+        completeness: {
+            badges: badges.completeness,
+            reasons: ['MANIFEST_AND_FILE_HEURISTICS_ONLY', 'INFRA_IMPORT_DETECTION_DISABLED'],
+        },
+        badges: badges.items,
+    }
+}
+
+function packageSource(value) {
+    const raw = metadataString(value, 512)
+    if (!raw) return undefined
+    const normalized = raw.replace(/\\/g, '/')
+    if (FIXED_PACKAGE_SOURCES.has(normalized)) return normalized
+    const relative = repoRelativePath(normalized, 512)
+    return relative && PACKAGE_SOURCE_FILE.test(relative) ? relative : undefined
+}
+
+function sanitizePackage(value) {
+    const name = safeToken(value?.name)
+    const version = safeToken(value?.version, 128)
+    const ecosystem = safeToken(value?.ecosystem, 64)
+    const source = packageSource(value?.source)
+    if (!name || !version || !ecosystem || !source) return null
+    return {name, version, ecosystem, dev: value.dev === true, source}
+}
+
+function buildDirectUsage(externalImports) {
+    const usage = new Map()
+    for (const entry of Array.isArray(externalImports) ? externalImports : []) {
+        if (!entry || typeof entry !== 'object' || entry.builtin === true || entry.unresolved === true) continue
+        const name = safeToken(entry.pkg)
+        const ecosystem = safeToken(entry.ecosystem || 'npm', 64)
+        const file = repoRelativePath(entry.file)
+        if (!name || !ecosystem || !file) continue
+        const key = `${ecosystem}\0${name}`
+        let fact = usage.get(key)
+        if (!fact) usage.set(key, (fact = {name, ecosystem, importCount: 0, files: new Set(), kinds: new Set()}))
+        fact.importCount++
+        fact.files.add(file)
+        const kind = safeToken(entry.kind, 64)
+        if (kind) fact.kinds.add(kind)
+    }
+    return [...usage.values()].map((fact) => {
+        const files = [...fact.files].sort(compareText)
+        return {
+            name: fact.name,
+            ecosystem: fact.ecosystem,
+            importCount: fact.importCount,
+            fileCount: files.length,
+            files: files.slice(0, CAPS.usageFiles),
+            filesTruncated: files.length > CAPS.usageFiles,
+            kinds: [...fact.kinds].sort(compareText),
+        }
+    }).sort((a, b) => compareText(a.ecosystem, b.ecosystem) || compareText(a.name, b.name))
+}
+
+export function buildPackagesSection(installedResult, installedError, graph, audit, repoRoot) {
+    const dependencyGraph = buildPackageDependencyGraph(repoRoot)
+    const dependencyGraphCounts = {
+        dependencyGraphNodes: dependencyGraph.completeness.nodes,
+        dependencyGraphEdges: dependencyGraph.completeness.edges,
+    }
+    if (installedError) {
+        return {
+            state: STATE.ERROR,
+            verdict: VERDICT.UNKNOWN,
+            completeness: {...dependencyGraphCounts, reasons: ['PACKAGE_INVENTORY_ERROR']},
+            checks: {osv: normalizeCheckState(audit?.checks?.osv?.status), malware: normalizeCheckState(audit?.checks?.malware?.status)},
+            inventory: [],
+            directUsage: [],
+            dependencyGraph,
+        }
+    }
+    const inventory = bounded((installedResult?.installed || []).map(sanitizePackage).filter(Boolean)
+        .sort((a, b) => compareText(a.ecosystem, b.ecosystem) || compareText(a.name, b.name) ||
+            compareText(a.version, b.version) || compareText(a.source, b.source) || Number(a.dev) - Number(b.dev)),
+    CAPS.packages)
+    const usage = bounded(buildDirectUsage(graph?.externalImports), CAPS.directUsage)
+    const packageRules = new Set(['unused-dep', 'missing-dep', 'duplicate-dep', 'lockfile-drift', 'known-vuln', 'malicious-package', 'typosquat'])
+    const packageFailure = (audit?.findings || []).some((finding) => packageRules.has(finding?.rule))
+    const checks = {
+        osv: normalizeCheckState(audit?.checks?.osv?.status),
+        malware: normalizeCheckState(audit?.checks?.malware?.status),
+    }
+    const reasons = []
+    if (inventory.completeness.truncated) reasons.push('PACKAGE_INVENTORY_TRUNCATED')
+    if (usage.completeness.truncated) reasons.push('DIRECT_USAGE_TRUNCATED')
+    if (Object.values(checks).some((value) => ![STATE.COMPLETE, STATE.NOT_APPLICABLE].includes(value))) {
+        reasons.push('OPTIONAL_CHECKS_INCOMPLETE')
+    }
+    if ([STATE.PARTIAL, STATE.ERROR].includes(dependencyGraph.state)) reasons.push('PACKAGE_DEPENDENCY_GRAPH_PARTIAL')
+    const state = reasons.length ? STATE.PARTIAL : STATE.COMPLETE
+    return {
+        state,
+        verdict: packageFailure ? VERDICT.FAIL : state === STATE.COMPLETE ? VERDICT.PASS : VERDICT.UNKNOWN,
+        completeness: {
+            inventory: inventory.completeness,
+            directUsage: usage.completeness,
+            ...dependencyGraphCounts,
+            reasons,
+        },
+        checks,
+        inventory: inventory.items,
+        directUsage: usage.items,
+        dependencyGraph,
+    }
+}

package/src/mcp/evidence-snapshot.mjs

@@ -0,0 +1,50 @@
+// Bounded, deterministic and source-free evidence derived locally from a repository and its graph.
+// The sync wire layer applies a second allowlist because cached graph/evidence data is untrusted.
+import {aggregateGraph} from '../analysis/graph-analysis.js'
+import {runInternalAudit} from '../analysis/internal-audit.js'
+import {detectRepoStack} from '../scan/discover.js'
+import {collectInstalled} from '../security/installed.js'
+import {STATE, hashSnapshot} from './evidence-snapshot.common.mjs'
+import {buildArchitectureSection} from './evidence-snapshot.architecture.mjs'
+import {buildDuplicatesSection} from './evidence-snapshot.duplicates.mjs'
+import {buildHealthSection} from './evidence-snapshot.health.mjs'
+import {buildPackagesSection, buildTechnologiesSection} from './evidence-snapshot.inventory.mjs'
+import {buildStructureEvidence} from './evidence-snapshot.structure.mjs'
+
+export async function createEvidenceSnapshot({repoRoot, graph}) {
+    const inputGraph = graph && typeof graph === 'object' && !Array.isArray(graph)
+        ? graph
+        : {nodes: [], links: [], externalImports: []}
+
+    let aggregate = null
+    try { aggregate = aggregateGraph(inputGraph) } catch { aggregate = null }
+
+    let audit = null
+    try { audit = await runInternalAudit(repoRoot, {graph: inputGraph, skipMalwareScan: true}) } catch { audit = null }
+
+    let stack = null
+    let stackError = false
+    try { stack = detectRepoStack(repoRoot) } catch { stackError = true }
+
+    let installedResult = null
+    let installedError = false
+    try { installedResult = collectInstalled(repoRoot) } catch { installedError = true }
+
+    const structure = buildStructureEvidence(inputGraph, repoRoot)
+
+    const sections = {
+        architecture: buildArchitectureSection(inputGraph, aggregate, audit, structure),
+        duplicates: buildDuplicatesSection(repoRoot, inputGraph),
+        health: buildHealthSection(inputGraph, audit),
+        technologies: buildTechnologiesSection(stack, stackError),
+        packages: buildPackagesSection(installedResult, installedError, inputGraph, audit, repoRoot),
+    }
+    const sectionStates = Object.values(sections).map((section) => section.state)
+    const state = sectionStates.every((value) => value === STATE.ERROR)
+        ? STATE.ERROR
+        : sectionStates.every((value) => value === STATE.COMPLETE || value === STATE.NOT_APPLICABLE)
+            ? STATE.COMPLETE
+            : STATE.PARTIAL
+    const snapshot = {evidenceSnapshotV: 1, state, sections}
+    return {...snapshot, snapshotHash: hashSnapshot(snapshot)}
+}