weavatrix 0.2.1 → 0.2.3

package/README.md

@@ -95,7 +95,7 @@ No graph yet? Ask the agent to call `rebuild_graph`; it builds the missing graph
 With the default `offline` profile (or an explicit capability set containing `retarget`),
 `open_repo` can change the active repository
 and builds a missing graph automatically. A normal
-`open_repo` call also upgrades graphs created before `0.1.4` to edge metadata v2; `build:false`
+`open_repo` also upgrades graphs that predate current typed-edge/provenance metadata; `build:false`
 probes without building and refuses a legacy graph. Retargeting is offline but intentionally changes
 the filesystem boundary for subsequent tools; select `pinned` when that boundary must not move.
 
@@ -111,6 +111,11 @@ An agent skill with recipes ships in [skill/SKILL.md](skill/SKILL.md) — instal
 compile-only edges (Rust module/use, Java imports) are reported separately where that distinction
 changes the result.
 
+Every current edge also carries versioned provenance: `EXTRACTED`, `RESOLVED`, or `INFERRED` today,
+with `EXACT_LSP` and `CONFLICT` reserved for the optional precision overlay. `graph_stats` reports
+the complete breakdown; provenance describes how the relationship was established, while the older
+`confidence` field remains for compatibility.
+
 **search / source** — `search_code` (ripgrep-backed, pure-Node fallback), `read_source` (a
 symbol's actual code in one hop), `list_endpoints` (HTTP route inventory:
 Express/Fastify/Nest/Flask/FastAPI/Go mux/Rust axum and actix-web …)
@@ -168,6 +173,33 @@ disclosed instead of silently guessed; and the server **hot-reloads its watched
 modules and catalog** when those files change — other MCP helpers and analysis engines require a
 reconnect.
 
+### 0.2.3 real-wrapper patch
+
+- Auto-discovery recognizes wrappers that pass a fixed HTTP client method and argument array to a
+  shared transport helper, such as `api(axios.get, [url, options])`.
+- Ambiguous handler names can resolve to the unique matching symbol in a module directly imported
+  by the route file, allowing proven external frontend calls to suppress only that exact backend
+  dead-code candidate.
+- Missing, ambiguous, low-confidence and capped evidence remains review-only; the patch does not
+  turn absence of a client match into a dead-code verdict.
+
+Full patch notes: [docs/releases/v0.2.3.md](docs/releases/v0.2.3.md).
+
+### 0.2.2 regression and cross-repository evidence
+
+- Permanent TS/JS/Python/Go/Java/Rust regression fixtures now gate graph correctness, output size,
+  latency, freshness, reconnect behavior and repository-target stability.
+- Every current graph edge carries versioned `EXTRACTED`, `RESOLVED`, or `INFERRED` provenance;
+  `EXACT_LSP` and `CONFLICT` are reserved for the optional precision overlay.
+- `trace_api_contract` recognizes configured and conservatively auto-discovered HTTP wrappers,
+  resolves bounded dynamic URL prefixes and can mark an unambiguous backend handler
+  `NOT_DEAD_EXTERNAL_USE` when another registered repository supplies medium/high-confidence use.
+- Real-repository verification records explicit `MISSING`, `UNBASELINED`, and `STALE` gaps instead
+  of converting absent Java/Rust or source-checkout evidence into a green result.
+- No mandatory runtime dependency was added.
+
+Full release notes: [docs/releases/v0.2.2.md](docs/releases/v0.2.2.md).
+
 ### 0.2.1 bounded-output patch
 
 - `git_history top_n=N` is a hard per-collection MCP cap, including churn, hotspots and every
@@ -234,6 +266,34 @@ Java graphs:
   agent review queue. Public/exported methods, framework entries, decorators, dynamic loading and
   reflection lower confidence; the result always says `REVIEW_REQUIRED` and `autoDelete:false`.
 
+### HTTP clients and wrappers
+
+`trace_api_contract` recognizes built-in object clients such as `axios.get(...)`, explicit bare or
+object/member wrappers, and simple auto-discovered functions that forward a URL parameter directly
+to a known HTTP client. Auto-discovered wrappers are restricted to their bounded reverse-import
+scope; ambiguous same-name definitions are skipped and reported as incomplete evidence.
+
+Persistent per-client-repository configuration lives in `.weavatrix.json`:
+
+```json
+{
+  "httpContracts": {
+    "clientNames": ["internalHttp"],
+    "wrappers": [
+      { "call": "get", "method": "GET", "urlArgument": 0 },
+      { "object": "transport", "member": "send", "method": "POST", "urlArgument": 1 }
+    ],
+    "autoDiscoverWrappers": true
+  }
+}
+```
+
+The MCP call exposes the same ad-hoc controls as `client_names`, `client_wrappers` and
+`auto_discover_wrappers`. A medium/high-confidence client match marks the backend endpoint/handler
+`NOT_DEAD_EXTERNAL_USE`; a low-confidence match is `POSSIBLE_EXTERNAL_USE`; no match is `UNKNOWN`.
+Only an unambiguously resolved handler node can suppress a method-level dead-code candidate. The tool
+never turns missing static evidence into a `DEAD` verdict.
+
 `run_audit` makes incomplete security coverage explicit. OSV state is `OK` only after every
 supported pinned package/version for this repository was queried successfully. `PARTIAL` means
 some queries failed, the response was incomplete, the dependency fingerprint changed, or the cache
@@ -290,7 +350,8 @@ Weavatrix itself initiates outbound HTTP only from three tools; all are absent f
   hosted list. The endpoint is **yours**, configured through `WEAVATRIX_SYNC_URL` and the optional
   `WEAVATRIX_SYNC_TOKEN`; the feature is off by default. Pass `payload_version: 2` only for an
   intentional graph-only compatibility sync—there is no silent downgrade that discards evidence.
-  Graphs built before `0.1.4` must be rebuilt once before syncing; V3 also refuses a stale graph so
+  Graphs that predate current typed-edge/provenance metadata must be rebuilt once before V3 sync;
+  V3 also refuses a stale graph so
   source-derived evidence cannot be mixed with old topology.
 
 Evidence sections carry independent `state` (`COMPLETE`, `PARTIAL`, `NOT_CHECKED`,
@@ -344,21 +405,48 @@ Graphs are derived data and never live inside your repo: the global per-user reg
 
 ```sh
 npm install
-npm test          # node --test
+npm test                 # unit/integration tests plus the quick golden benchmark
+npm run benchmark        # full TS/JS/Python/Go/Java/Rust + MCP lifecycle gate
+npm run benchmark:real   # locally available real repos vs source-free 0.2.1 baselines
 ```
 
-Design rule: **no source file exceeds 300 lines.** Larger concerns split into dotted-suffix modules
-behind a slim facade (`foo.js` re-exports `foo.parse.js`, `foo.report.js`, …); the MCP layer lives
+The benchmark checks representative graph correctness, complete edge provenance, cross-repository
+HTTP tracing, output bytes, latency, freshness, reconnect and active-target stability. Its budgets, semantics and intentionally
+limited claims are documented in [docs/benchmarking.md](docs/benchmarking.md).
+
+Refactoring target: keep focused implementation modules near 300 lines and split larger concerns
+into dotted-suffix modules behind a slim facade (`foo.js` re-exports `foo.parse.js`,
+`foo.report.js`, …). A few older orchestration modules remain above that target; new work should
+reduce them instead of growing new monoliths. The MCP layer lives
 in `src/mcp/` (graph context, tool entry modules, focused helpers, and the catalog/hot-reload
 loader) behind the thin stdio entry `src/mcp-server.mjs`.
 
 ## Roadmap
 
-- **Hosted graph view** on [weavatrix.com](https://weavatrix.com) — sync with one tool call, share
-  the interactive map with your team
-- **Graph-anchored memory** — agent notes pinned to nodes/modules, staleness-tracked as the code
-  under them changes
-- **CI blast radius** — `change_impact` as a PR comment
+- **Public 0.2.2 regression foundation** now has the permanent six-language golden corpus,
+  cross-repository wrapper/liveness fixture, framework/convention fixture, full MCP lifecycle gate
+  and a portable real-repository runner. Five source-free 0.2.1 real-repository baselines are
+  recorded; edge provenance is gated end-to-end. The unavailable Rust source checkout is the only
+  explicit local gap preventing the strict six-repository release command from passing here.
+- **Wrapper-aware API contracts** shipped in 0.2.2: persistent/ad-hoc configuration,
+  conservative discovery, cross-repository handler liveness and explicit unknown states. The next
+  hosted increment joins privacy-safe contract identities across separately synced services.
+- **Hosted architecture workbench** is live at
+  [app.weavatrix.com](https://app.weavatrix.com): explicit source-free sync,
+  immutable history, Flow/DSM/Map, target architecture and bounded review
+  evidence. Hosted use remains optional and owner-authenticated.
+- **Semantic precision bridge** — optional local language-server validation for
+  ambiguous impact, reference and dead-code evidence; the current parser graph
+  remains the offline fallback.
+- **Git-native architecture history** — bounded tag/ref timelines and branch
+  reports built outside the worktree; graph artifacts stay out of Git.
+- **Cross-repository company evidence** — endpoints, events and internal
+  packages joined to affected consumers and ownership without uploading source.
+- **CI blast radius** — bounded `change_impact` and architecture-ratchet evidence
+  as a PR check/comment.
+
+The public alignment note for the fixed cross-product release sequence is in
+[docs/product-roadmap.md](docs/product-roadmap.md).
 
 ## License
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "weavatrix",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "type": "module",
   "description": "Weavatrix — code graph & blast-radius MCP server for AI coding agents: change impact, transitive dependents, health audit, duplicate detection, and coverage mapping over any local repository.",
   "author": "Sergii Ziborov <sergii.ziborov@gmail.com>",
@@ -30,6 +30,10 @@
   ],
   "scripts": {
     "test": "node --test",
+    "benchmark": "node scripts/run-benchmark.mjs",
+    "benchmark:quick": "node scripts/run-benchmark.mjs --quick",
+    "benchmark:real": "node scripts/run-real-benchmark.mjs",
+    "benchmark:real:release": "node scripts/run-real-benchmark.mjs --require-all",
     "build:mcpb": "node scripts/build-mcpb.mjs",
     "verify:release": "node scripts/verify-release.mjs"
   },

package/skill/SKILL.md

@@ -47,6 +47,11 @@ named profiles for new registrations.
   `change_impact` and `graph_diff` label the distinction; `god_nodes` ranks unique connectivity and
   reports repeated references separately. Do not schedule a runtime-cycle refactor from
   compile-time-only edges.
+- **Edge provenance**: distinguish how an edge was established from legacy confidence. Current
+  graphs use `EXTRACTED`, `RESOLVED`, and `INFERRED`; `EXACT_LSP` is reserved for a bounded local
+  precision overlay and `CONFLICT` means evidence disagrees. Treat `INFERRED` and `CONFLICT` as
+  review signals rather than compiler-exact facts; an `UNKNOWN` count in `graph_stats` requires a
+  rebuild before precision-sensitive work.
 - **Repository universe**: in Git repositories, graph and duplicate scans include tracked plus
   non-ignored untracked files. If an old graph still contains packaged/generated output, rebuild it
   before interpreting the result. Repository-root `.weavatrixignore` applies the same tracked-file
@@ -117,8 +122,21 @@ named profiles for new registrations.
 - **Cross-repository API impact**: ensure both repositories are in `list_known_repos`, then call
   `trace_api_contract backend=<uuid-or-label> clients=[<uuid-or-label>]`; narrow with `method`, `path`,
   or backend `changed_files`. `path` may be a segment-aligned fragment (`/query` can select
-  `/edgeAnalytics/query/...`), and bounded constant prefixes in template URLs are resolved. Treat
-  remaining unresolved/dynamic URLs as incomplete evidence, not a clean result.
+  `/edgeAnalytics/query/...`), and bounded constant prefixes in template URLs are resolved. The tool
+  recognizes configured and conservatively auto-discovered HTTP wrappers; use per-repository
+  `.weavatrix.json` `httpContracts` configuration for durable custom client names/wrappers, or
+  `client_names` / `client_wrappers` for one trace. `NOT_DEAD_EXTERNAL_USE` requires medium/high
+  confidence; only an unambiguously resolved handler node can suppress a dead-method candidate.
+  `POSSIBLE_EXTERNAL_USE`, `UNKNOWN`, and remaining unresolved/dynamic URLs are incomplete evidence,
+  never proof that a method is dead.
+- **Release regression gate**: for a Weavatrix source checkout, use `npm test` for the quick
+  six-language golden corpus and `npm run benchmark` before release for the real MCP
+  `full -> incremental -> none -> reconnect/none` lifecycle, bounded output and active-target checks.
+  Use `npm run benchmark:real` for available manifest repositories and
+  `npm run benchmark:real:release` only when all six source checkouts are present; `MISSING`,
+  `UNBASELINED` and `STALE` are explicit incomplete states, not green results.
+  A green Java/Rust fixture proves only its declared representative signals, not compiler-exact
+  coverage of arbitrary repositories.
 - **Target architecture before editing**: `get_architecture_contract` → `prepare_change` with the
   intended files → edit and rebuild → `verify_architecture`. A missing contract returns a starter
   proposal from `get_architecture_contract output_format:"json"`, not an automatically approved
@@ -170,7 +188,7 @@ runtime/type-only/compile-only module dependencies. Package evidence contains a
 graph with direct/transitive runtime, dev, optional and peer edges plus explicit resolution counts.
 Duplicate evidence contains stable, source-free clone/divergence candidates; it never sends method
 bodies or snippets. Use `payload_version: 2` only when the user explicitly wants graph-only
-compatibility—Weavatrix never silently downgrades. A graph built before `0.1.4`, or one stale against
+compatibility—Weavatrix never silently downgrades. A graph predating current provenance metadata, or one stale against
 the working tree, must be rebuilt first. Sync remains unavailable until the user selects `hosted`
 (or the exact `hosted` capability) and configures `WEAVATRIX_SYNC_URL`.
 

package/src/analysis/http-contract-wrappers.js

@@ -0,0 +1,241 @@
+// Bounded HTTP-wrapper configuration and conservative auto-discovery. A wrapper is accepted only
+// when its URL position and HTTP method are statically known; no source is evaluated.
+import { statSync } from "node:fs";
+import { createRepoBoundary } from "../repo-path.js";
+import { safeRead } from "../util.js";
+
+export const DEFAULT_HTTP_CLIENT_NAMES = Object.freeze([
+  "axios", "http", "https", "$http", "httpClient", "apiClient", "restClient",
+]);
+
+const HTTP_METHODS = new Set(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"]);
+const MAX_CONFIG_BYTES = 64 * 1024;
+const MAX_WRAPPERS = 100;
+const MAX_CLIENT_NAMES = 40;
+const MAX_DISCOVERY_BODY = 2_000;
+const identifier = (value) => {
+  const text = String(value || "").trim();
+  return /^[A-Za-z_$][\w$]{0,127}$/.test(text) ? text : null;
+};
+const method = (value) => {
+  const text = String(value || "").trim().toUpperCase();
+  return HTTP_METHODS.has(text) ? text : null;
+};
+const argumentIndex = (value) => {
+  const number = Number(value ?? 0);
+  return Number.isInteger(number) && number >= 0 && number <= 5 ? number : null;
+};
+
+export function normalizeHttpClientNames(values) {
+  return [...new Set((Array.isArray(values) ? values : [])
+    .slice(0, MAX_CLIENT_NAMES)
+    .map(identifier)
+    .filter(Boolean))];
+}
+
+export function normalizeHttpWrapperDescriptors(values, source = "input") {
+  const wrappers = [];
+  for (const raw of (Array.isArray(values) ? values : []).slice(0, MAX_WRAPPERS)) {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) continue;
+    const urlArgument = argumentIndex(raw.urlArgument ?? raw.url_argument);
+    const fixedMethod = method(raw.method);
+    if (urlArgument == null || !fixedMethod) continue;
+    const call = identifier(raw.call);
+    const object = identifier(raw.object);
+    const member = identifier(raw.member);
+    if (call && !object && !member) {
+      wrappers.push({ kind: "function", call, method: fixedMethod, urlArgument, source });
+    } else if (!call && object && member) {
+      wrappers.push({ kind: "member", object, member, method: fixedMethod, urlArgument, source });
+    }
+  }
+  const seen = new Set();
+  return wrappers.filter((wrapper) => {
+    const key = `${wrapper.kind}\0${wrapper.call || wrapper.object}\0${wrapper.member || ""}\0${wrapper.method}\0${wrapper.urlArgument}`;
+    if (seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  });
+}
+
+export function loadHttpContractConfig(repoRoot) {
+  const empty = { clientNames: [], wrappers: [], autoDiscoverWrappers: true, loaded: false, warnings: [] };
+  const resolved = createRepoBoundary(repoRoot).resolve(".weavatrix.json");
+  if (!resolved.ok) return empty;
+  try {
+    if (statSync(resolved.path).size > MAX_CONFIG_BYTES) return { ...empty, error: "config-too-large" };
+    const raw = JSON.parse(safeRead(resolved.path));
+    const config = raw?.httpContracts;
+    if (config == null) return { ...empty, loaded: true };
+    if (!config || typeof config !== "object" || Array.isArray(config)) return { ...empty, error: "invalid-http-contract-config" };
+    const rawNames = Array.isArray(config.clientNames) ? config.clientNames : [];
+    const rawWrappers = Array.isArray(config.wrappers) ? config.wrappers : [];
+    const clientNames = normalizeHttpClientNames(rawNames);
+    const wrappers = normalizeHttpWrapperDescriptors(rawWrappers, "config");
+    const warnings = [];
+    if (config.clientNames != null && !Array.isArray(config.clientNames)) warnings.push("httpContracts.clientNames must be an array");
+    if (rawNames.length > MAX_CLIENT_NAMES) warnings.push("httpContracts.clientNames cap reached");
+    if (clientNames.length < Math.min(rawNames.length, MAX_CLIENT_NAMES)) warnings.push("invalid httpContracts.clientNames entries skipped");
+    if (config.wrappers != null && !Array.isArray(config.wrappers)) warnings.push("httpContracts.wrappers must be an array");
+    if (rawWrappers.length > MAX_WRAPPERS) warnings.push("httpContracts.wrappers cap reached");
+    if (wrappers.length < Math.min(rawWrappers.length, MAX_WRAPPERS)) warnings.push("invalid or duplicate httpContracts.wrappers entries skipped");
+    if (config.autoDiscoverWrappers != null && typeof config.autoDiscoverWrappers !== "boolean") warnings.push("httpContracts.autoDiscoverWrappers must be boolean");
+    return {
+      clientNames,
+      wrappers,
+      autoDiscoverWrappers: config.autoDiscoverWrappers !== false,
+      loaded: true,
+      warnings,
+    };
+  } catch {
+    return { ...empty, error: "invalid-config" };
+  }
+}
+
+// Masks comments and strings while retaining indices and newlines. Wrapper discovery needs only
+// declarations and a direct `client.verb(urlParam)` delegation, never literal contents.
+function codeMask(text) {
+  const chars = String(text || "").split("");
+  let index = 0;
+  while (index < chars.length) {
+    const char = chars[index], next = chars[index + 1];
+    if (char === "/" && next === "/") {
+      chars[index++] = " "; chars[index++] = " ";
+      while (index < chars.length && chars[index] !== "\n") chars[index++] = " ";
+    } else if (char === "/" && next === "*") {
+      chars[index++] = " "; chars[index++] = " ";
+      while (index < chars.length) {
+        if (chars[index] === "*" && chars[index + 1] === "/") { chars[index++] = " "; chars[index++] = " "; break; }
+        if (chars[index] !== "\n") chars[index] = " ";
+        index += 1;
+      }
+    } else if (char === "'" || char === '"' || char === "`") {
+      const quote = char;
+      chars[index++] = " ";
+      while (index < chars.length) {
+        if (chars[index] === "\\") {
+          chars[index++] = " ";
+          if (index < chars.length && chars[index] !== "\n") chars[index] = " ";
+          index += 1;
+          continue;
+        }
+        const closes = chars[index] === quote;
+        if (chars[index] !== "\n") chars[index] = " ";
+        index += 1;
+        if (closes) break;
+      }
+    } else index += 1;
+  }
+  return chars.join("");
+}
+
+function matchingBrace(mask, open) {
+  let depth = 0;
+  for (let index = open; index < Math.min(mask.length, open + MAX_DISCOVERY_BODY); index += 1) {
+    if (mask[index] === "{") depth += 1;
+    else if (mask[index] === "}" && --depth === 0) return index + 1;
+  }
+  return Math.min(mask.length, open + MAX_DISCOVERY_BODY);
+}
+
+function parameterNames(raw) {
+  const parts = [];
+  let start = 0, round = 0, square = 0, curly = 0, angle = 0;
+  const text = String(raw || "");
+  for (let index = 0; index <= text.length; index += 1) {
+    const char = text[index];
+    if (char === "(") round += 1;
+    else if (char === ")") round -= 1;
+    else if (char === "[") square += 1;
+    else if (char === "]") square -= 1;
+    else if (char === "{") curly += 1;
+    else if (char === "}") curly -= 1;
+    else if (char === "<") angle += 1;
+    else if (char === ">") angle = Math.max(0, angle - 1);
+    if ((char === "," && round === 0 && square === 0 && curly === 0 && angle === 0) || index === text.length) {
+      parts.push(text.slice(start, index));
+      start = index + 1;
+    }
+  }
+  const names = [];
+  for (const part of parts.slice(0, 6)) {
+    const match = /^\s*([A-Za-z_$][\w$]*)(?=\s*(?:[?:=]|$))/.exec(part);
+    if (!match) return [];
+    names.push(match[1]);
+  }
+  return names;
+}
+
+function escaped(value) {
+  return String(value).replace(/[|\\{}()[\]^$+*?.-]/g, "\\$&");
+}
+
+function delegatedWrapper(mask, definition, clientNames) {
+  const body = mask.slice(definition.bodyStart, definition.bodyEnd);
+  const clients = clientNames.map(escaped).join("|");
+  if (!clients) return null;
+  const delegate = new RegExp(`\\b(?:${clients})\\s*(?:\\?\\.|\\.)\\s*(get|post|put|patch|delete|head|options)\\s*(?:<[^>\\n]{1,200}>)?\\s*\\(\\s*([A-Za-z_$][\\w$]*)\\s*(?=[,)])`, "gi");
+  const matches = [];
+  let found;
+  while ((found = delegate.exec(body)) && matches.length < 3) {
+    const urlArgument = definition.parameters.indexOf(found[2]);
+    if (urlArgument >= 0) matches.push({ method: found[1].toUpperCase(), urlArgument });
+  }
+  // Common typed clients keep response/error handling in one helper and pass the concrete
+  // axios/http method plus its argument array: api(axios.get, [url, options]). The HTTP method and
+  // first transport argument are still statically fixed, so this is as deterministic as a direct
+  // axios.get(url) delegation without evaluating the helper.
+  const methodReference = new RegExp(`\\b[A-Za-z_$][\\w$]*\\s*\\(\\s*(?:${clients})\\s*(?:\\?\\.|\\.)\\s*(get|post|put|patch|delete|head|options)\\s*,\\s*\\[\\s*([A-Za-z_$][\\w$]*)\\s*(?=[,\\]])`, "gi");
+  while ((found = methodReference.exec(body)) && matches.length < 3) {
+    const urlArgument = definition.parameters.indexOf(found[2]);
+    if (urlArgument >= 0) matches.push({ method: found[1].toUpperCase(), urlArgument });
+  }
+  const unique = [...new Map(matches.map((item) => [`${item.method}\0${item.urlArgument}`, item])).values()];
+  return unique.length === 1 ? unique[0] : null;
+}
+
+export function discoverHttpWrappers(sources, clientNames = []) {
+  const allowedClients = [...new Set([...DEFAULT_HTTP_CLIENT_NAMES, ...normalizeHttpClientNames(clientNames)])];
+  const candidates = [];
+  let truncated = false;
+  for (const source of Array.isArray(sources) ? sources : []) {
+    if (candidates.length >= MAX_WRAPPERS) { truncated = true; break; }
+    const mask = codeMask(source.text);
+    const definitions = [];
+    const functions = /\b(?:export\s+)?(?:default\s+)?(?:async\s+)?function\s+([A-Za-z_$][\w$]*)\s*\(([^)]{0,300})\)\s*(?::[^\n{]{1,200})?\s*\{/g;
+    let match;
+    while ((match = functions.exec(mask)) && definitions.length < MAX_WRAPPERS) {
+      const open = functions.lastIndex - 1;
+      definitions.push({ call: match[1], parameters: parameterNames(match[2]), bodyStart: open + 1, bodyEnd: matchingBrace(mask, open) - 1 });
+    }
+    const arrows = /\b(?:export\s+)?(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(?:async\s+)?(?:<[^>\n]{1,200}>\s*)?(?:\(([^)]{0,300})\)\s*(?::[^\n=]{1,200})?|([A-Za-z_$][\w$]*))\s*=>\s*/g;
+    while ((match = arrows.exec(mask)) && definitions.length < MAX_WRAPPERS) {
+      const parameters = parameterNames(match[2] ?? match[3]);
+      const open = mask.indexOf("{", arrows.lastIndex);
+      const block = open >= 0 && /^\s*\{/.test(mask.slice(arrows.lastIndex, open + 1));
+      const bodyStart = block ? open + 1 : arrows.lastIndex;
+      const bodyEnd = block ? matchingBrace(mask, open) - 1 : Math.min(mask.length, bodyStart + MAX_DISCOVERY_BODY, mask.indexOf(";", bodyStart) >= 0 ? mask.indexOf(";", bodyStart) : mask.length);
+      definitions.push({ call: match[1], parameters, bodyStart, bodyEnd });
+    }
+    for (const definition of definitions) {
+      if (!definition.parameters.length) continue;
+      const delegated = delegatedWrapper(mask, definition, allowedClients);
+      if (delegated && candidates.length < MAX_WRAPPERS) candidates.push({ kind: "function", call: definition.call, ...delegated, source: "auto", definitionFile: source.file });
+      else if (delegated) truncated = true;
+    }
+  }
+
+  const byCall = new Map();
+  for (const candidate of candidates) {
+    const entries = byCall.get(candidate.call) || [];
+    entries.push(candidate);
+    byCall.set(candidate.call, entries);
+  }
+  const wrappers = [], ambiguous = [];
+  for (const [call, entries] of [...byCall.entries()].sort(([left], [right]) => left.localeCompare(right))) {
+    const unique = [...new Map(entries.map((entry) => [`${entry.method}\0${entry.urlArgument}\0${entry.definitionFile}`, entry])).values()];
+    if (unique.length === 1) wrappers.push(unique[0]);
+    else ambiguous.push({ call, definitions: unique.length });
+  }
+  return { wrappers, ambiguous, truncated };
+}

package/src/analysis/http-contracts.js

@@ -8,11 +8,17 @@ import { createPathClassifier, hasPathClass } from "../path-classification.js";
 import { isWeavatrixIgnored, loadWeavatrixIgnore } from "../path-ignore.js";
 import { createRepoBoundary } from "../repo-path.js";
 import { safeRead } from "../util.js";
+import {
+  DEFAULT_HTTP_CLIENT_NAMES,
+  discoverHttpWrappers,
+  loadHttpContractConfig,
+  normalizeHttpClientNames,
+  normalizeHttpWrapperDescriptors,
+} from "./http-contract-wrappers.js";
 
-export const HTTP_CONTRACTS_V = 1;
+export const HTTP_CONTRACTS_V = 2;
 
 const METHODS = new Set(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"]);
-const DEFAULT_CLIENT_NAMES = Object.freeze(["axios", "http", "https", "$http", "httpClient", "apiClient", "restClient"]);
 const DEFAULTS = Object.freeze({
   maxBackendFiles: 3_000,
   maxClientFiles: 3_000,
@@ -235,8 +241,37 @@ function extractStaticStringConstants(text) {
   return constants;
 }
 
-function parseUrlArgument(text, openParen, constants) {
-  let start = openParen + 1;
+function argumentStart(text, openParen, target) {
+  let current = 0, round = 0, square = 0, curly = 0;
+  for (let index = openParen + 1; index < text.length; index += 1) {
+    const char = text[index];
+    if (current === target && !/\s|,/.test(char)) return index;
+    if (char === "'" || char === '"' || char === "`") {
+      const quote = char;
+      index += 1;
+      while (index < text.length) {
+        if (text[index] === "\\") index += 2;
+        else if (text[index] === quote) break;
+        else index += 1;
+      }
+      continue;
+    }
+    if (char === "(" ) round += 1;
+    else if (char === "[" ) square += 1;
+    else if (char === "{" ) curly += 1;
+    else if (char === ")") {
+      if (round === 0 && square === 0 && curly === 0) return null;
+      round -= 1;
+    } else if (char === "]") square -= 1;
+    else if (char === "}") curly -= 1;
+    else if (char === "," && round === 0 && square === 0 && curly === 0) current += 1;
+  }
+  return null;
+}
+
+function parseUrlArgument(text, openParen, constants, argument = 0) {
+  let start = argumentStart(text, openParen, argument);
+  if (start == null) return { path: null, endIndex: openParen, kind: "dynamic", dynamic: true, unknownPrefix: false, partialDynamic: true, reason: `URL argument ${argument} is missing` };
   while (/\s/.test(text[start] || "")) start += 1;
   const quote = text[start];
   if (quote === "'" || quote === '"') {
@@ -272,22 +307,30 @@ function fetchMethod(text, argumentEnd) {
 }
 
 function normalizedClientNames(values) {
-  return new Set([...DEFAULT_CLIENT_NAMES, ...(Array.isArray(values) ? values : [])]
+  return new Set([...DEFAULT_HTTP_CLIENT_NAMES, ...normalizeHttpClientNames(values)]
     .map((value) => String(value || "").trim().toLowerCase())
     .filter((value) => /^[a-z_$][\w$]*$/i.test(value)));
 }
 
+const escapeRegex = (value) => String(value).replace(/[|\\{}()[\]^$+*?.-]/g, "\\$&");
+
 export function extractHttpClientCallsFromText(text, file, options = {}) {
   const source = String(text || "");
   const mask = maskNonCode(source);
   const constants = extractStaticStringConstants(source);
   const allowed = normalizedClientNames(options.clientNames);
+  const wrappers = normalizeHttpWrapperDescriptors(options.wrappers, "input")
+    .concat((Array.isArray(options.normalizedWrappers) ? options.normalizedWrappers : []));
   const maxCalls = boundedInteger(options.maxCalls, DEFAULTS.maxCallsPerClient, 1, HARD.maxCallsPerClient);
   const calls = [];
+  const seen = new Set();
   let truncated = false;
-  const add = (clientName, method, openParen, fetch = false) => {
+  const add = (clientName, method, openParen, fetch = false, urlArgument = 0, detector = "builtin", wrapper = null) => {
+    const key = `${openParen}\0${method}\0${urlArgument}`;
+    if (seen.has(key)) return;
+    seen.add(key);
     if (calls.length >= maxCalls) { truncated = true; return; }
-    const parsed = parseUrlArgument(source, openParen, constants);
+    const parsed = parseUrlArgument(source, openParen, constants, urlArgument);
     const fetchInfo = fetch ? fetchMethod(source, parsed.endIndex) : { method: method.toUpperCase(), uncertain: false };
     calls.push({
       file: normalizeFile(file),
@@ -300,10 +343,12 @@ export function extractHttpClientCallsFromText(text, file, options = {}) {
       unknownPrefix: Boolean(parsed.unknownPrefix),
       partialDynamic: Boolean(parsed.partialDynamic || fetchInfo.uncertain),
       reason: fetchInfo.uncertain ? "HTTP method is dynamic" : parsed.reason,
+      detector,
+      wrapper,
     });
   };
 
-  const member = /(^|[^\w$])([A-Za-z_$][\w$]*)\s*(?:\?\.|\.)\s*(get|post|put|patch|delete|head|options)\s*\(/gim;
+  const member = /(^|[^\w$])([A-Za-z_$][\w$]*)\s*(?:\?\.|\.)\s*(get|post|put|patch|delete|head|options)\s*(?:<[^>\n]{1,200}>)?\s*\(/gim;
   let match;
   while ((match = member.exec(mask))) {
     if (!allowed.has(match[2].toLowerCase())) continue;
@@ -311,6 +356,24 @@ export function extractHttpClientCallsFromText(text, file, options = {}) {
   }
   const fetchCall = /(^|[^\w$])fetch\s*\(/gim;
   while ((match = fetchCall.exec(mask))) add("fetch", "GET", fetchCall.lastIndex - 1, true);
+  for (const wrapper of wrappers) {
+    if (wrapper.allowedFiles instanceof Set && !wrapper.allowedFiles.has(normalizeFile(file))) continue;
+    if (wrapper.kind === "function") {
+      const bare = new RegExp(`(^|[^\\w$.?])${escapeRegex(wrapper.call)}\\s*(?:<[^>\\n]{1,200}>)?\\s*\\(`, "gim");
+      while ((match = bare.exec(mask))) {
+        const nameAt = bare.lastIndex - match[0].length + match[1].length;
+        if (/\bfunction\s*$/i.test(mask.slice(Math.max(0, nameAt - 30), nameAt))) continue;
+        add(wrapper.call, wrapper.method, bare.lastIndex - 1, false, wrapper.urlArgument, `${wrapper.source}-wrapper`, {
+          kind: wrapper.kind, call: wrapper.call, definitionFile: wrapper.definitionFile || null,
+        });
+      }
+    } else if (wrapper.kind === "member") {
+      const memberCall = new RegExp(`(^|[^\\w$])${escapeRegex(wrapper.object)}\\s*(?:\\?\\.|\\.)\\s*${escapeRegex(wrapper.member)}\\s*(?:<[^>\\n]{1,200}>)?\\s*\\(`, "gim");
+      while ((match = memberCall.exec(mask))) add(`${wrapper.object}.${wrapper.member}`, wrapper.method, memberCall.lastIndex - 1, false, wrapper.urlArgument, `${wrapper.source}-wrapper`, {
+        kind: wrapper.kind, object: wrapper.object, member: wrapper.member, definitionFile: wrapper.definitionFile || null,
+      });
+    }
+  }
   calls.sort((left, right) => left.file.localeCompare(right.file) || left.line - right.line || left.method.localeCompare(right.method) || String(left.path).localeCompare(String(right.path)));
   return { calls, truncated };
 }
@@ -321,7 +384,7 @@ function filesFromGraph(graph) {
 
 export function detectHttpClientCalls(repoRoot, codeFiles, options = {}) {
   const boundary = createRepoBoundary(repoRoot);
-  if (!boundary.root) return { calls: [], truncated: false, filesScanned: 0 };
+  if (!boundary.root) return { calls: [], truncated: false, filesScanned: 0, discovery: { enabled: false, configured: 0, discovered: 0, ambiguous: [] }, reasons: [] };
   const maxFiles = boundedInteger(options.maxFiles, DEFAULTS.maxClientFiles, 1, HARD.maxClientFiles);
   const maxCalls = boundedInteger(options.maxCalls, DEFAULTS.maxCallsPerClient, 1, HARD.maxCallsPerClient);
   const ignoreRules = loadWeavatrixIgnore(boundary.root);
@@ -329,6 +392,7 @@ export function detectHttpClientCalls(repoRoot, codeFiles, options = {}) {
   const candidates = [...new Set((codeFiles || []).map((entry) => normalizeFile(entry?.path || entry)).filter(Boolean))].sort();
   let truncated = candidates.length > maxFiles;
   let filesScanned = 0;
+  const sources = [];
   const calls = [];
   for (const file of candidates.slice(0, maxFiles)) {
     if (!/\.(?:[cm]?[jt]sx?|vue|svelte)$/i.test(file) || isWeavatrixIgnored(file, ignoreRules)) continue;
@@ -339,14 +403,53 @@ export function detectHttpClientCalls(repoRoot, codeFiles, options = {}) {
     const text = safeRead(resolved.path);
     if (!text) continue;
     filesScanned += 1;
+    sources.push({ file, text });
+  }
+  const config = loadHttpContractConfig(boundary.root);
+  const clientNames = [...new Set([
+    ...normalizeHttpClientNames(options.clientNames),
+    ...config.clientNames,
+  ])];
+  const configured = [
+    ...normalizeHttpWrapperDescriptors(options.wrappers, "input"),
+    ...config.wrappers,
+  ];
+  const discoveryEnabled = options.autoDiscoverWrappers !== false && config.autoDiscoverWrappers !== false;
+  const discovered = discoveryEnabled ? discoverHttpWrappers(sources, clientNames) : { wrappers: [], ambiguous: [], truncated: false };
+  const scopedDiscovered = discovered.wrappers.map((wrapper) => ({
+    ...wrapper,
+    allowedFiles: wrapperScopeFiles(wrapper.definitionFile, options.graph),
+  }));
+  for (const { file, text } of sources) {
     const remaining = maxCalls - calls.length;
     if (remaining <= 0) { truncated = true; break; }
-    const extracted = extractHttpClientCallsFromText(text, file, { clientNames: options.clientNames, maxCalls: remaining });
+    const extracted = extractHttpClientCallsFromText(text, file, {
+      clientNames,
+      normalizedWrappers: [...configured, ...scopedDiscovered],
+      maxCalls: remaining,
+    });
     calls.push(...extracted.calls);
     if (extracted.truncated) truncated = true;
   }
   calls.sort((left, right) => left.file.localeCompare(right.file) || left.line - right.line || left.method.localeCompare(right.method) || String(left.path).localeCompare(String(right.path)));
-  return { calls, truncated, filesScanned };
+  const reasons = [];
+  if (config.error) reasons.push(`HTTP contract config ${config.error}`);
+  reasons.push(...(config.warnings || []));
+  if (discovered.truncated) reasons.push("auto-discovered wrapper cap reached");
+  if (discovered.ambiguous.length) reasons.push(`${discovered.ambiguous.length} ambiguous auto-discovered wrapper name(s) skipped`);
+  return {
+    calls,
+    truncated,
+    filesScanned,
+    discovery: {
+      enabled: discoveryEnabled,
+      configured: configured.length,
+      discovered: scopedDiscovered.length,
+      ambiguous: discovered.ambiguous,
+      truncated: discovered.truncated,
+    },
+    reasons,
+  };
 }
 
 function pathSegments(path) {
@@ -434,6 +537,24 @@ function reverseImports(graph = {}) {
   return reverse;
 }
 
+function wrapperScopeFiles(sourceFile, graph) {
+  const source = normalizeFile(sourceFile);
+  if (!source || !Array.isArray(graph?.nodes)) return null;
+  const reverse = reverseImports(graph);
+  const allowed = new Set([source]);
+  const queue = [{ file: source, depth: 0 }];
+  while (queue.length && allowed.size < 2_000) {
+    const current = queue.shift();
+    if (current.depth >= 4) continue;
+    for (const importer of [...(reverse.get(current.file) || [])].sort()) {
+      if (allowed.has(importer)) continue;
+      allowed.add(importer);
+      queue.push({ file: importer, depth: current.depth + 1 });
+    }
+  }
+  return allowed;
+}
+
 function isScreen(file) {
   const path = normalizeFile(file);
   const base = path.split("/").at(-1) || "";
@@ -511,6 +632,55 @@ function endpointFilter(endpoint, backendId, options) {
   return true;
 }
 
+function bareGraphLabel(value) {
+  return String(value || "").replace(/\s*\(.*$/, "").replace(/[()]/g, "").trim();
+}
+
+function handlerNodeEvidence(endpoint, graph) {
+  const handler = /^[A-Za-z_$][\w$]{0,127}$/.test(String(endpoint?.handler || "")) ? String(endpoint.handler) : null;
+  if (!handler) return { handler: null, handlerNodeId: null, handlerResolution: "inline-or-unresolved" };
+  const nodes = graph?.nodes || [];
+  const matches = nodes.filter((node) =>
+    normalizeFile(node?.source_file) && bareGraphLabel(node?.label) === handler && String(node?.id || "") !== normalizeFile(node?.source_file));
+  const endpointFile = normalizeFile(endpoint.file);
+  const sameFile = matches.filter((node) => normalizeFile(node?.source_file) === endpointFile);
+  const byId = new Map(nodes.map((node) => [endpointId(node?.id), node]));
+  const linkFile = (value) => {
+    const id = endpointId(value);
+    return normalizeFile(byId.get(id)?.source_file || String(id || "").split("#")[0]);
+  };
+  const directlyImportedFiles = new Set((graph?.links || [])
+    .filter((link) => ["imports", "re_exports"].includes(link?.relation) && linkFile(link?.source) === endpointFile)
+    .map((link) => linkFile(link?.target))
+    .filter(Boolean));
+  const imported = matches.filter((node) => directlyImportedFiles.has(normalizeFile(node?.source_file)));
+  const resolved = sameFile.length === 1 ? sameFile[0] : imported.length === 1 ? imported[0] : matches.length === 1 ? matches[0] : null;
+  return {
+    handler,
+    handlerNodeId: resolved ? String(resolved.id) : null,
+    handlerResolution: resolved ? "resolved" : matches.length > 1 ? "ambiguous" : "unresolved",
+  };
+}
+
+function externalUseLiveness(callsites, handlerEvidence) {
+  const proven = callsites.filter((call) => call.match?.confidence === "high" || call.match?.confidence === "medium");
+  const possible = callsites.filter((call) => call.match?.confidence === "low");
+  const status = proven.length ? "NOT_DEAD_EXTERNAL_USE" : possible.length ? "POSSIBLE_EXTERNAL_USE" : "UNKNOWN";
+  const evidence = proven.length ? proven : possible;
+  return {
+    status,
+    subject: handlerEvidence.handlerNodeId ? "handler-node" : handlerEvidence.handler ? "endpoint-handler" : "endpoint",
+    canSuppressDeadCandidate: proven.length > 0 && Boolean(handlerEvidence.handlerNodeId),
+    staticEvidence: evidence.length,
+    consumerRepositories: [...new Set(evidence.map((call) => call.clientRepo))].sort(),
+    reason: proven.length
+      ? "At least one selected external repository has a medium/high-confidence static HTTP contract match."
+      : possible.length
+        ? "Only low-confidence external HTTP contract matches were found; review before suppressing a dead-code candidate."
+        : "No selected external repository proved a static caller; absence of evidence is not a dead-code verdict.",
+  };
+}
+
 // `backends` and `clients` are arrays of {id, repoRoot, codeFiles?, graph?}. Backends may optionally
 // supply a precomputed `endpoints` array; otherwise the shared multi-language endpoint detector is used.
 export function analyzeHttpContracts(input = {}) {
@@ -535,7 +705,7 @@ export function analyzeHttpContracts(input = {}) {
     if (filtered.length > endpointBudget) completeness.push(`${id}: endpoint cap reached`);
     const accepted = filtered.slice(0, endpointBudget);
     endpointBudget -= accepted.length;
-    backends.push({ id, endpoints: accepted });
+    backends.push({ id, endpoints: accepted, graph: descriptor.graph });
   }
 
   const clients = [];
@@ -546,10 +716,20 @@ export function analyzeHttpContracts(input = {}) {
       maxFiles: limits.maxClientFiles,
       maxCalls: limits.maxCallsPerClient,
       clientNames: descriptor.clientNames || input.clientNames,
+      wrappers: descriptor.wrappers || input.wrappers,
+      autoDiscoverWrappers: descriptor.autoDiscoverWrappers ?? input.autoDiscoverWrappers,
+      graph: descriptor.graph,
       includeTests: descriptor.includeTests ?? input.includeTests,
     });
     if (detected.truncated) completeness.push(`${id}: client scan cap reached`);
-    clients.push({ id, calls: detected.calls, reverse: reverseImports(descriptor.graph), filesScanned: detected.filesScanned });
+    for (const reason of detected.reasons || []) completeness.push(`${id}: ${reason}`);
+    clients.push({
+      id,
+      calls: detected.calls,
+      reverse: reverseImports(descriptor.graph),
+      filesScanned: detected.filesScanned,
+      wrapperDiscovery: detected.discovery,
+    });
   }
 
   const results = [];
@@ -581,20 +761,24 @@ export function analyzeHttpContracts(input = {}) {
             method: call.method,
             path: call.path,
             dynamic: call.dynamic,
+            detector: call.detector,
+            wrapper: call.wrapper,
             match,
           });
         }
       }
       callsites.sort((left, right) => right.match.score - left.match.score || left.clientRepo.localeCompare(right.clientRepo) || left.file.localeCompare(right.file) || left.line - right.line);
+      const handlerEvidence = handlerNodeEvidence(endpoint, backend.graph);
       results.push({
         backend: backend.id,
         method: endpoint.method,
         path: endpoint.path,
         normalizedPath: normalizeHttpContractPath(endpoint.path),
-        handler: /^[A-Za-z_$][\w$]{0,127}$/.test(String(endpoint.handler || "")) ? String(endpoint.handler) : null,
+        ...handlerEvidence,
         file: normalizeFile(endpoint.file) || null,
         line: Number(endpoint.line) || null,
         callsites,
+        liveness: externalUseLiveness(callsites, handlerEvidence),
         affected: affectedForEndpoint(callsites, clients, limits),
       });
     }
@@ -626,7 +810,12 @@ export function analyzeHttpContracts(input = {}) {
       matches,
       methodMismatches,
       uncertainCalls: uncertainAll.length,
+      notDeadExternalUse: results.filter((endpoint) => endpoint.liveness.status === "NOT_DEAD_EXTERNAL_USE").length,
+      notDeadExternalHandlers: results.filter((endpoint) => endpoint.liveness.canSuppressDeadCandidate).length,
+      possibleExternalUse: results.filter((endpoint) => endpoint.liveness.status === "POSSIBLE_EXTERNAL_USE").length,
+      unknownLiveness: results.filter((endpoint) => endpoint.liveness.status === "UNKNOWN").length,
     },
+    wrapperDiscovery: clients.map((client) => ({ clientRepo: client.id, ...client.wrapperDiscovery })),
     endpoints: results,
     uncertain: uncertainAll.slice(0, limits.maxUncertain),
   };

package/src/graph/edge-provenance.js

@@ -0,0 +1,31 @@
+// Versioned origin classification for graph edges. `confidence` remains a compatibility field;
+// provenance says how an edge was established and leaves room for a bounded LSP precision overlay.
+export const EDGE_PROVENANCE_V = 1;
+export const EDGE_PROVENANCE_KINDS = Object.freeze([
+  "EXACT_LSP", "EXTRACTED", "RESOLVED", "INFERRED", "CONFLICT",
+]);
+
+const ALLOWED = new Set(EDGE_PROVENANCE_KINDS);
+
+export function edgeProvenance(edge) {
+  const explicit = String(edge?.provenance || "").trim().toUpperCase();
+  if (ALLOWED.has(explicit)) return explicit;
+  if (edge?.semanticOrigin === true) return "RESOLVED";
+  const legacy = String(edge?.confidence || "").trim().toUpperCase();
+  return ALLOWED.has(legacy) ? legacy : "UNKNOWN";
+}
+
+export function stampEdgeProvenance(links) {
+  for (const link of Array.isArray(links) ? links : []) {
+    const provenance = edgeProvenance(link);
+    if (provenance !== "UNKNOWN") link.provenance = provenance;
+  }
+  return links;
+}
+
+export function summarizeEdgeProvenance(links) {
+  const counts = Object.fromEntries([...EDGE_PROVENANCE_KINDS, "UNKNOWN"].map((kind) => [kind, 0]));
+  for (const link of Array.isArray(links) ? links : []) counts[edgeProvenance(link)] += 1;
+  const total = Array.isArray(links) ? links.length : 0;
+  return {version: EDGE_PROVENANCE_V, total, classified: total - counts.UNKNOWN, complete: counts.UNKNOWN === 0, counts};
+}

package/src/graph/freshness-probe.js

@@ -9,7 +9,7 @@ import {childProcessEnv} from '../child-env.js'
 import {createRepoBoundary} from '../repo-path.js'
 
 export const REPOSITORY_FRESHNESS_PROBE_V = 1
-export const GRAPH_BUILDER_SCHEMA_V = 1
+export const GRAPH_BUILDER_SCHEMA_V = 2
 export const GRAPH_BUILDER_VERSION = (() => {
     try { return String(createRequire(import.meta.url)('../../package.json').version) }
     catch { return '0.0.0' }
@@ -21,6 +21,7 @@ export const GRAPH_BUILDER_VERSION = (() => {
 const CURRENT_GRAPH_SCHEMA = Object.freeze({
     extImportsV: 2,
     edgeTypesV: 2,
+    edgeProvenanceV: 1,
     complexityV: 1,
     repoBoundaryV: 1,
     barrelResolutionV: 1,

package/src/graph/incremental-refresh.js

@@ -162,7 +162,7 @@ function mergeScopedGraph(base, scoped, affected, snapshot) {
     controlHashes: snapshot.controlHashes,
     graphRevision: snapshot.revision,
   };
-  for (const key of ["extImportsV", "edgeTypesV", "complexityV", "repoBoundaryV", "barrelResolutionV", "extractorSchemaV"]) {
+  for (const key of ["extImportsV", "edgeTypesV", "edgeProvenanceV", "complexityV", "repoBoundaryV", "barrelResolutionV", "extractorSchemaV"]) {
     merged[key] = Math.max(Number(base[key]) || 0, Number(scoped[key]) || 0);
   }
   return merged;
@@ -183,7 +183,7 @@ export async function refreshGraphIncrementally(repoDir, existingGraph, {
 
   if (!existingGraph || !existingGraph.fileHashes || !existingGraph.fileExportSignatures
     || !existingGraph.controlHashes || !existingGraph.jsExportRecords || Number(existingGraph.barrelResolutionV) < 1
-    || Number(existingGraph.extractorSchemaV) < 1) {
+    || Number(existingGraph.extractorSchemaV) < 1 || Number(existingGraph.edgeProvenanceV) < 1) {
     return full("incremental-baseline-unavailable");
   }
   if (!sameRecord(existingGraph.controlHashes, snapshot.controlHashes)) return full("ignore-or-control-config-changed");

package/src/graph/internal-builder.build.js

@@ -12,6 +12,7 @@ import { addJavaReferences } from "./internal-builder.java.js";
 import { assignDeterministicCommunities } from "./community.js";
 import { resolveJsBarrels } from "./internal-builder.barrels.js";
 import { snapshotRepository } from "./incremental-refresh.js";
+import { EDGE_PROVENANCE_V, stampEdgeProvenance } from "./edge-provenance.js";
 
 // Parse a repo directory into a graph-builder-compatible { nodes, links } graph.
 export async function buildInternalGraph(repoDir, opts = {}) {
@@ -128,6 +129,7 @@ export async function buildInternalGraph(repoDir, opts = {}) {
         target: tgt,
         relation: meta.relation || "imports",
         confidence: "EXTRACTED",
+        provenance: meta.provenance || "RESOLVED",
         ...(typeof meta.typeOnly === "boolean" ? { typeOnly: meta.typeOnly } : {}),
         ...(meta.compileOnly === true ? { compileOnly: true } : {}),
         ...(meta.line ? { line: meta.line } : {}),
@@ -317,6 +319,7 @@ export async function buildInternalGraph(repoDir, opts = {}) {
   // community = folder bucket (top 2 path parts) — deterministic, mirrors the folder-based module grouping the
   // app already uses (graph-builder-analysis.js). Populates Modules/community cards without a heavy clustering pass.
   assignDeterministicCommunities(nodes);
+  stampEdgeProvenance(links);
 
   // extImportsV: bump when the externalImports schema/coverage changes (v2 = go/python ecosystems) —
   // deps-engine rebuilds in memory when a saved graph is older than this.
@@ -328,6 +331,7 @@ export async function buildInternalGraph(repoDir, opts = {}) {
     externalImports,
     extImportsV: 2,
     edgeTypesV: 2,
+    edgeProvenanceV: EDGE_PROVENANCE_V,
     complexityV: 1,
     repoBoundaryV: 1,
     barrelResolutionV: 1,

package/src/graph/internal-builder.resolvers.js

@@ -248,6 +248,21 @@ export function buildResolvers(repoDir, fileSet) {
   };
 
   const JS_EXTS = ["", ".js", ".ts", ".jsx", ".tsx", ".mjs", ".cjs", ".json", "/index.js", "/index.ts", "/index.jsx", "/index.tsx"];
+  const resolveJsBase = (base) => {
+    for (const extension of JS_EXTS) {
+      const candidate = (base + extension).replace(/\/+/g, "/");
+      if (fileSet.has(candidate)) return candidate;
+    }
+    // TypeScript NodeNext source commonly imports the emitted extension (`./http.js`) while the
+    // repository contains `http.ts`/`http.tsx`. Exact runtime files win above; a source counterpart
+    // is accepted only when unique so same-basename ambiguity is never guessed.
+    const sourceCandidates = [];
+    if (/\.js$/i.test(base)) sourceCandidates.push(base.replace(/\.js$/i, ".ts"), base.replace(/\.js$/i, ".tsx"));
+    else if (/\.jsx$/i.test(base)) sourceCandidates.push(base.replace(/\.jsx$/i, ".tsx"));
+    const existing = [...new Set(sourceCandidates.map((candidate) => candidate.replace(/\/+/g, "/")))]
+      .filter((candidate) => fileSet.has(candidate));
+    return existing.length === 1 ? existing[0] : null;
+  };
   const resolveJsImport = (fromRel, spec) => {
     if (!spec) return null;
     let base;
@@ -258,13 +273,13 @@ export function buildResolvers(repoDir, fileSet) {
         // baseUrl-rooted internal import ("components/Button" with baseUrl:"src") — try before calling it an npm package
         for (const ctx of contextsForFile(fromRel)) for (const b of ctx.baseUrls) {
           const root = (b ? b + "/" : "") + spec;
-          for (const e of JS_EXTS) { const cand = (root + e).replace(/\/+/g, "/"); if (fileSet.has(cand)) return cand; }
+          const resolved = resolveJsBase(root);
+          if (resolved) return resolved;
         }
         return null;   // genuinely bare → npm package (stays unresolved here)
       }
     }
-    for (const e of JS_EXTS) { const cand = (base + e).replace(/\/+/g, "/"); if (fileSet.has(cand)) return cand; }
-    return null;
+    return resolveJsBase(base);
   };
 
   const resolvePyPath = (baseDir, parts) => {

package/src/mcp/catalog.mjs

@@ -30,7 +30,7 @@ export const HOT_FILES = ['tools-graph.mjs', 'tools-impact.mjs', 'tools-health.m
 
 function buildTools({tg, ti, th, ta, tar, thi, tc}) {
     const tools = [
-        {cap: 'graph', name: 'graph_stats', description: 'Return summary statistics: node count, edge count, communities, confidence breakdown, and graph build time vs repo HEAD (staleness).', inputSchema: {type: 'object', properties: {}}, run: (g, a, ctx) => tg.tGraphStats(g, ctx)},
+        {cap: 'graph', name: 'graph_stats', description: 'Return summary statistics: node count, edge count, communities, versioned edge-provenance/legacy-confidence breakdowns, and graph build time vs repo HEAD (staleness).', inputSchema: {type: 'object', properties: {}}, run: (g, a, ctx) => tg.tGraphStats(g, ctx)},
         {cap: 'graph', name: 'get_node', description: 'Get full details for a specific node by label or ID.', inputSchema: {type: 'object', properties: {label: {type: 'string', description: 'Node label or ID to look up'}}, required: ['label']}, run: (g, a, ctx) => tg.tGetNode(g, a, ctx)},
         {cap: 'graph', name: 'get_neighbors', description: 'Get all direct neighbors of a node with edge details (1 hop, call sites deduped). For transitive impact use get_dependents; for the impact of your current branch changes use change_impact.', inputSchema: {type: 'object', properties: {label: {type: 'string'}, relation_filter: {type: 'string', description: 'Optional: filter by relation type'}}, required: ['label']}, run: (g, a, ctx) => tg.tGetNeighbors(g, a, ctx)},
         {cap: 'graph', name: 'query_graph', description: 'Explore the graph around a concept (BFS/DFS). Returns a focused, ranked subgraph — the closest, most-connected nodes near the matched seeds, with edges among them — not the full flood; states how many nodes were reached vs shown.', inputSchema: {type: 'object', properties: {question: {type: 'string', description: 'Natural language question or keyword search'}, mode: {type: 'string', enum: ['bfs', 'dfs'], default: 'bfs'}, depth: {type: 'integer', default: 3}, context_filter: {type: 'array', items: {type: 'string'}}, seed_files: {type: 'array', items: {type: 'string'}, maxItems: 12, description: 'Optional exact repo-relative file paths. When resolved, these are the only seeds unless augment_seeds is true'}, augment_seeds: {type: 'boolean', default: false, description: 'With seed_files, also add fuzzy question-derived seeds; false keeps traversal strictly pinned'}, token_budget: {type: 'integer', description: 'Higher budget shows more nodes/edges', default: 2000}}, required: ['question']}, run: (g, a) => tg.tQueryGraph(g, a)},
@@ -39,7 +39,49 @@ function buildTools({tg, ti, th, ta, tar, thi, tc}) {
         {cap: 'graph', name: 'get_dependents', description: 'Transitive blast-radius of ONE node: everything that calls/imports/inherits it, directly or through intermediaries (reverse edges, ranked by proximity then connectivity). For a symbol, also follows importers of its containing file. Use before refactoring; get_neighbors shows only 1 hop, change_impact covers your whole current diff at once.', inputSchema: {type: 'object', properties: {label: {type: 'string', description: 'Node label or ID'}, depth: {type: 'integer', description: 'Max reverse hops, default 3', default: 3}, max_nodes: {type: 'integer', description: 'Max dependents to list, default 40', default: 40}}, required: ['label']}, run: (g, a) => ti.tGetDependents(g, a)},
         {cap: 'graph', name: 'change_impact', description: 'Verdict-first, symbol-aware blast radius. Parses a zero-context git diff, distinguishes additive exports from signature/body/removal risk, and reverse-traverses only exact changed seeds so a new API does not inherit every legacy importer of its file. Measured coverage is used when present; otherwise static test reachability is labelled actualCoverage=NOT_AVAILABLE. Pass `diff` for a not-checked-out PR; `files` without a diff remains a conservative fallback.', inputSchema: {type: 'object', properties: {base: {type: 'string', description: 'Base ref, e.g. origin/main or HEAD~1 (default: first existing of origin/HEAD, origin/main, origin/master, main, master)'}, diff: {type: 'string', maxLength: 2097152, description: 'Optional unified diff (prefer --unified=0) for a PR/change that is not checked out; enables symbol-level classification'}, files: {type: 'array', items: {type: 'string'}, maxItems: 500, description: 'Optional repo-relative changed-file hints. Without diff evidence these are classified conservatively rather than guessed additive'}, depth: {type: 'integer', description: 'Max reverse hops, default 2'}, max_nodes: {type: 'integer', description: 'Max impacted nodes to list, default 40'}}}, run: (g, a, ctx) => ti.tChangeImpact(g, a, ctx)},
         {cap: 'graph', name: 'git_history', description: 'Behavioral architecture evidence from bounded local git history: churn × connectivity hotspots, hidden co-change coupling, and expected test/source coupling. Reads numstat only — never commit messages, authors, or source bodies.', inputSchema: {type: 'object', properties: {months: {type: 'integer', enum: [3, 6, 12], default: 6}, max_commits: {type: 'integer', minimum: 1, maximum: 5000, default: 1000}, min_pair_count: {type: 'integer', minimum: 2, maximum: 100, default: 3}, max_pairs: {type: 'integer', minimum: 1, maximum: 500, default: 100}, top_n: {type: 'integer', minimum: 1, maximum: 50, default: 10}}}, run: (g, a, ctx) => thi.tGitHistory(g, a, ctx)},
-        {cap: 'crossrepo', name: 'trace_api_contract', description: 'Cross-repository HTTP contract and blast-radius evidence. Select a registered backend and one or more registered clients by stable repository UUID or unambiguous label; joins backend endpoints to static client calls and follows client importers to affected screens. Repository paths stay local and cannot be supplied through this tool. This capability is intentionally absent from the pinned profile.', inputSchema: {type: 'object', properties: {backend: {type: 'string', description: 'Backend repository UUID or exact unambiguous registry label'}, clients: {type: 'array', items: {type: 'string'}, minItems: 1, maxItems: 20, description: 'Client repository UUIDs or exact unambiguous registry labels'}, method: {type: 'string', enum: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS']}, path: {type: 'string', maxLength: 2048, description: 'Optional full route or segment-aligned route fragment; /query matches /edgeAnalytics/query/... and {id}, :id and concrete parameter values are normalized'}, changed_files: {type: 'array', items: {type: 'string'}, maxItems: 500, description: 'Optional backend repo-relative changed files; only endpoints declared in those files are traced'}, include_tests: {type: 'boolean', default: false}, max_impact_depth: {type: 'integer', minimum: 0, maximum: 5, default: 2}, max_endpoints: {type: 'integer', minimum: 1, maximum: 500, default: 250}, max_matches: {type: 'integer', minimum: 1, maximum: 5000, default: 1000}, max_affected_files: {type: 'integer', minimum: 1, maximum: 500, default: 100}, top_n: {type: 'integer', minimum: 1, maximum: 50, default: 10}}, required: ['backend', 'clients']}, run: (g, a, ctx) => tc.tTraceApiContract(g, a, ctx)},
+        {
+            cap: 'crossrepo',
+            name: 'trace_api_contract',
+            description: 'Cross-repository HTTP contract, handler-liveness and blast-radius evidence. Select a registered backend and one or more registered clients; joins backend endpoints to built-in, configured, or conservatively auto-discovered HTTP wrappers. Medium/high-confidence external matches mark a handler NOT_DEAD_EXTERNAL_USE; no match remains UNKNOWN. Repository paths stay local and cannot be supplied through this tool.',
+            inputSchema: {
+                type: 'object',
+                properties: {
+                    backend: {type: 'string', description: 'Backend repository UUID or exact unambiguous registry label'},
+                    clients: {type: 'array', items: {type: 'string'}, minItems: 1, maxItems: 20, description: 'Client repository UUIDs or exact unambiguous registry labels'},
+                    method: {type: 'string', enum: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS']},
+                    path: {type: 'string', maxLength: 2048, description: 'Optional full route or segment-aligned route fragment; /query matches /edgeAnalytics/query/... and {id}, :id and concrete parameter values are normalized'},
+                    changed_files: {type: 'array', items: {type: 'string'}, maxItems: 500, description: 'Optional backend repo-relative changed files; only endpoints declared in those files are traced'},
+                    client_names: {type: 'array', items: {type: 'string', pattern: '^[A-Za-z_$][\\w$]{0,127}$'}, maxItems: 40, uniqueItems: true, description: 'Extra object-style clients whose .get/.post/... methods perform HTTP requests; persistent per-repo configuration belongs in .weavatrix.json httpContracts.clientNames'},
+                    client_wrappers: {
+                        type: 'array', maxItems: 100,
+                        description: 'Fixed-method wrapper calls. Use call+method for get(url), or object+member+method for transport.send(url). url_argument is zero-based.',
+                        items: {
+                            type: 'object', additionalProperties: false,
+                            properties: {
+                                call: {type: 'string', pattern: '^[A-Za-z_$][\\w$]{0,127}$'},
+                                object: {type: 'string', pattern: '^[A-Za-z_$][\\w$]{0,127}$'},
+                                member: {type: 'string', pattern: '^[A-Za-z_$][\\w$]{0,127}$'},
+                                method: {type: 'string', enum: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS']},
+                                url_argument: {type: 'integer', minimum: 0, maximum: 5, default: 0},
+                            },
+                            anyOf: [
+                                {required: ['call', 'method'], not: {anyOf: [{required: ['object']}, {required: ['member']}]}},
+                                {required: ['object', 'member', 'method'], not: {required: ['call']}},
+                            ],
+                        },
+                    },
+                    auto_discover_wrappers: {type: 'boolean', default: true, description: 'Discover only simple unambiguous functions that forward a URL parameter directly to a known object-style HTTP client'},
+                    include_tests: {type: 'boolean', default: false},
+                    max_impact_depth: {type: 'integer', minimum: 0, maximum: 5, default: 2},
+                    max_endpoints: {type: 'integer', minimum: 1, maximum: 500, default: 250},
+                    max_matches: {type: 'integer', minimum: 1, maximum: 5000, default: 1000},
+                    max_affected_files: {type: 'integer', minimum: 1, maximum: 500, default: 100},
+                    top_n: {type: 'integer', minimum: 1, maximum: 50, default: 10},
+                },
+                required: ['backend', 'clients'],
+            },
+            run: (g, a, ctx) => tc.tTraceApiContract(g, a, ctx),
+        },
         {cap: 'graph', name: 'get_community', description: 'Get all nodes in a community by community ID (0-indexed by size).', inputSchema: {type: 'object', properties: {community_id: {type: 'integer', description: 'Community ID (0-indexed by size)'}}, required: ['community_id']}, run: (g, a) => tg.tGetCommunity(g, a)},
         {cap: 'search', name: 'search_code', description: 'Full-text or regex search across the repo source (ripgrep-backed, Node fallback). The graph only stores structure — use this to find literal text/patterns, then get_node/get_neighbors for structure.', inputSchema: {type: 'object', properties: {query: {type: 'string', description: 'text or regex to search for'}, is_regex: {type: 'boolean', default: false}, glob: {type: 'string', description: 'optional path glob, e.g. "*.js" or "src/**"'}, max_results: {type: 'integer', default: 40}}, required: ['query']}, run: (g, a, ctx) => searchCode({repoRoot: ctx.repoRoot, resolveRg}, a)},
         {cap: 'source', name: 'read_source', description: "Read the actual source of a node (by label/ID) or a repo-relative file path — the symbol's lines with context. The graph stores only locations, not source text. For a path read, pass start_line to anchor the window anywhere in the file (otherwise it shows the head).", inputSchema: {type: 'object', properties: {label: {type: 'string', description: 'node label or ID'}, path: {type: 'string', description: 'or a repo-relative file path'}, start_line: {type: 'integer', description: 'anchor line: window = start_line-before .. start_line+after'}, before: {type: 'integer', default: 3}, after: {type: 'integer', default: 40}}}, run: (g, a, ctx) => readSource({repoRoot: ctx.repoRoot, resolveNode, isSymbol}, g, a)},

package/src/mcp/graph-context.mjs

@@ -8,6 +8,7 @@ import {spawnSync} from 'node:child_process'
 import {childProcessEnv} from '../child-env.js'
 import {resolveRepoPath} from '../repo-path.js'
 import {isStructuralRelation} from '../graph/relations.js'
+import {edgeProvenance} from '../graph/edge-provenance.js'
 
 // ---- graph load + indexes -----------------------------------------------------------------------
 export function loadGraph(path) {
@@ -36,6 +37,7 @@ export function loadGraph(path) {
         const metadata = {
             relation: e.relation,
             confidence: e.confidence,
+            provenance: edgeProvenance(e),
             ...(e.typeOnly === true ? {typeOnly: true} : {}),
             ...(e.compileOnly === true ? {compileOnly: true} : {}),
             ...(Number.isInteger(e.line) ? {line: e.line} : {}),
@@ -51,6 +53,7 @@ export function loadGraph(path) {
         nodes, links, byId, byLabel, out, inn,
         repoBoundaryV: Number(raw.repoBoundaryV) || 0,
         edgeTypesV: Number(raw.edgeTypesV) || 0,
+        edgeProvenanceV: Number(raw.edgeProvenanceV) || 0,
         barrelResolutionV: Number(raw.barrelResolutionV) || 0,
         extractorSchemaV: Number(raw.extractorSchemaV) || 0,
         extImportsV: Number(raw.extImportsV) || 0,

package/src/mcp/sync-payload.mjs

@@ -1,6 +1,7 @@
 // Versioned, explicit wire schema for sync_graph. Never forward graph.json wholesale: it is a local
 // cache file and may contain future fields or attacker-injected data that are not safe to upload.
 import {sanitizeEvidenceSnapshot} from './sync-evidence.mjs';
+import {edgeProvenance} from '../graph/edge-provenance.js';
 
 const CONTROL_CHARS = /[\u0000-\u001f\u007f]/;
 const ABSOLUTE_PATH_FRAGMENT = /(?:^|[\/\s"'`(=])[a-z]:[\\/]|(?:^|[\s"'`(=])(?:\\\\[^\\/\s]+(?:[\\/]|$)|file:(?:\/\/)?[\\/]|\/(?!\/)[^\s])/i;
@@ -202,6 +203,8 @@ function sanitizeLinkV3(value) {
         if (safe) out[key] = safe;
         else delete out[key];
     }
+    const provenance = edgeProvenance(value);
+    if (provenance !== 'UNKNOWN') out.provenance = provenance;
     const specifier = privacySafeText(value.specifier, 1024);
     if (specifier) out.specifier = specifier;
     else delete out.specifier;
@@ -265,6 +268,9 @@ export function createSyncPayloadV3(raw, evidence) {
     // Reuse the v2 schema gates, but construct v3 arrays independently so the stricter path/identity
     // rules cannot change graph-only compatibility for existing endpoints.
     const base = createSyncPayload(raw);
+    if (!Number.isInteger(raw.edgeProvenanceV) || raw.edgeProvenanceV < 1) {
+        throw new Error('graph predates edge provenance metadata');
+    }
     assertArrayLimit(raw, 'nodes', MAX_SYNC_NODES);
     assertArrayLimit(raw, 'links', MAX_SYNC_LINKS);
     assertArrayLimit(raw, 'externalImports', MAX_SYNC_EXTERNAL_IMPORTS);
@@ -285,6 +291,7 @@ export function createSyncPayloadV3(raw, evidence) {
         syncPayloadV: 3,
         repoBoundaryV: base.repoBoundaryV,
         edgeTypesV: base.edgeTypesV,
+        edgeProvenanceV: Number.isInteger(raw.edgeProvenanceV) ? raw.edgeProvenanceV : 0,
         extImportsV: base.extImportsV,
         complexityV: base.complexityV,
         evidenceV: 1,

package/src/mcp/tools-actions.mjs

@@ -41,6 +41,7 @@ export async function tRebuildGraph(g, args, ctx) {
     const before = g?.nodes ? {
         nodes: g.nodes, links: g.links,
         edgeTypesV: g.edgeTypesV || 0,
+        edgeProvenanceV: g.edgeProvenanceV || 0,
         barrelResolutionV: g.barrelResolutionV || 0,
         extractorSchemaV: g.extractorSchemaV || 0,
     } : null
@@ -73,6 +74,7 @@ export async function tOpenRepo(g, args, ctx) {
         try {
             const saved = JSON.parse(readFileSync(graphPath, 'utf8'))
             upgrade = !Number.isInteger(saved.edgeTypesV) || saved.edgeTypesV < 2
+                || !Number.isInteger(saved.edgeProvenanceV) || saved.edgeProvenanceV < 1
         } catch {
             upgrade = true
         }
@@ -80,7 +82,7 @@ export async function tOpenRepo(g, args, ctx) {
     if (!existsSync(graphPath) || upgrade) {
         if (args.build === false) {
             return upgrade
-                ? `The existing graph for ${repoPath} predates compile-only edge metadata (edge schema v2). Re-call without build:false to upgrade it before switching.`
+                ? `The existing graph for ${repoPath} predates current typed-edge/provenance metadata. Re-call without build:false to upgrade it before switching.`
                 : `No graph yet for ${repoPath} (expected at ${graphPath}). Re-call without build:false to build one — large repos can take minutes.`
         }
         const mode = ['no-tests', 'tests-only', 'full'].includes(args.mode) ? args.mode : 'full'
@@ -99,7 +101,7 @@ export async function tOpenRepo(g, args, ctx) {
         return `Failed to load ${graphPath} — still targeting the previous repo (${prev.repoRoot || 'none'}).`
     }
     registerRepository({repoPath, graphDir: graphOutDirForRepo(repoPath), graphHome: graphHomeDir()})
-    const buildNote = built ? (upgrade ? ' (graph upgraded to edge metadata v2)' : ' (graph built fresh)') : ''
+    const buildNote = built ? (upgrade ? ' (graph upgraded to current edge metadata)' : ' (graph built fresh)') : ''
     return `Opened ${repoPath}${buildNote}: ${loaded.nodes.length} nodes / ${loaded.links.length} edges. All tools now target this repo.`
 }
 

package/src/mcp/tools-company.mjs

@@ -9,6 +9,7 @@ import {liveRepositoryRecords} from '../graph/repo-registry.js'
 import {loadGraph} from './graph-context.mjs'
 import {toolResult} from './tool-result.mjs'
 
+const CROSS_REPO_HTTP_CONTRACT_V = 2
 const selectorText = (value) => String(value ?? '').trim()
 
 function selectRecord(records, selector) {
@@ -120,6 +121,10 @@ function verdictFor(analysis) {
         affectedScreens: affectedScreens.size,
         methodMismatches: analysis.totals.methodMismatches,
         uncertainCalls: analysis.totals.uncertainCalls,
+        notDeadExternalUse: analysis.totals.notDeadExternalUse,
+        notDeadExternalHandlers: analysis.totals.notDeadExternalHandlers,
+        possibleExternalUse: analysis.totals.possibleExternalUse,
+        unknownLiveness: analysis.totals.unknownLiveness,
     }
 }
 
@@ -188,7 +193,7 @@ export async function tTraceApiContract(_g, args = {}, ctx = {}) {
         return toolResult(
             `VERDICT PARTIAL — selected repository graphs could not all be refreshed and loaded.\nCompleteness: partial — ${reasons.join('; ')}.`,
             {
-                crossRepoHttpContractV: 1,
+                crossRepoHttpContractV: CROSS_REPO_HTTP_CONTRACT_V,
                 status: 'PARTIAL',
                 repositories: {
                     backend: publicRecord(backend, backendAlias),
@@ -209,6 +214,9 @@ export async function tTraceApiContract(_g, args = {}, ctx = {}) {
             path: args.path,
             changedFiles: args.changed_files,
             includeTests: args.include_tests === true,
+            clientNames: args.client_names,
+            wrappers: args.client_wrappers,
+            autoDiscoverWrappers: args.auto_discover_wrappers !== false,
             maxImpactDepth: args.max_impact_depth,
             maxEndpoints: args.max_endpoints,
             maxMatches: args.max_matches,
@@ -236,7 +244,7 @@ export async function tTraceApiContract(_g, args = {}, ctx = {}) {
                 const screens = endpoint.affected.screens.slice(0, 3)
                     .map((screen) => `    screen ${screen.client}:${screen.file} (distance ${screen.distance})`)
                 return [
-                    `  ${endpoint.method} ${endpoint.path}${location} → ${endpoint.callsites.length} callsite(s), ${endpoint.affected.screens.length} screen(s), ${endpoint.affected.files.length} affected file(s)`,
+                    `  ${endpoint.method} ${endpoint.path}${location} [${endpoint.liveness.status}${endpoint.handler ? `; handler ${endpoint.handler}` : ''}] → ${endpoint.callsites.length} callsite(s), ${endpoint.affected.screens.length} screen(s), ${endpoint.affected.files.length} affected file(s)`,
                     ...callsites,
                     ...screens,
                 ]
@@ -246,7 +254,7 @@ export async function tTraceApiContract(_g, args = {}, ctx = {}) {
                 : `Completeness: partial — ${completeness.reasons.join('; ')}.`,
         ]
         const result = {
-            crossRepoHttpContractV: 1,
+            crossRepoHttpContractV: CROSS_REPO_HTTP_CONTRACT_V,
             verdict,
             repositories: {
                 backend: publicRecord(backend, backendAlias),

package/src/mcp/tools-graph.mjs

@@ -6,6 +6,7 @@ import {
     resolveNodeInfo, resolveNode, ambiguityNote, findSeeds, resolveSeedFiles, undirectedNeighbors,
     graphStaleness, fileStalenessNote,
 } from './graph-context.mjs'
+import {summarizeEdgeProvenance} from '../graph/edge-provenance.js'
 
 const compileKind = (edge) => edge?.typeOnly === true ? 'type-only' : edge?.compileOnly === true ? 'compile-only' : null
 
@@ -34,15 +35,17 @@ export function tGraphStats(g, ctx) {
             .map(([k, v]) => `${k}: ${v}`)
             .join(', ')
     const freshness = ctx ? graphStaleness(ctx) : null
+    const provenance = summarizeEdgeProvenance(g.links)
     return [
         `Graph summary`,
         ctx?.repoRoot ? `- Repo: ${ctx.repoRoot}` : null,
         `- Nodes: ${g.nodes.length} (${files} files, ${symbols} symbols)`,
         `- Edges: ${g.links.length}`,
         g.edgeTypesV ? `- Typed-edge metadata: v${g.edgeTypesV} (${typeOnlyEdges} type-only, ${compileOnlyEdges} compile-only edges)` : `- Typed-edge metadata: unavailable (rebuild_graph required)`,
+        g.edgeProvenanceV ? `- Edge provenance: v${g.edgeProvenanceV} (${fmt(provenance.counts)}; ${provenance.complete ? 'complete' : `${provenance.counts.UNKNOWN} unclassified`})` : `- Edge provenance: unavailable (rebuild_graph required)`,
         g.barrelResolutionV ? `- Barrel resolution: v${g.barrelResolutionV} (semantic tools look through JS/TS re-export facades)` : `- Barrel resolution: unavailable (rebuild_graph required for JS/TS barrel transparency)`,
         `- Relations: ${fmt(relCount)}`,
-        Object.keys(confCount).length ? `- Confidence: ${fmt(confCount)}` : null,
+        Object.keys(confCount).length ? `- Legacy confidence: ${fmt(confCount)}` : null,
         `- Communities: ${comm.size} (top by size: ${topComm.map(([c, n]) => `#${c}=${n}`).join(', ')})`,
         freshness?.builtAt ? `- Built: ${freshness.builtAt.toISOString()}${freshness.headAt ? ` (repo HEAD committed ${freshness.headAt.toISOString()})` : ''}` : null,
     ]

package/src/mcp/tools-impact.mjs

@@ -112,6 +112,7 @@ export async function tGraphDiff(g, args, ctx) {
         nodes: (graph.nodes || []).filter((n) => String(n.id).startsWith(filter)),
         links: (graph.links || []).filter((l) => String(edgeEndpoint(l.source)).startsWith(filter) || String(edgeEndpoint(l.target)).startsWith(filter)),
         edgeTypesV: graph.edgeTypesV || 0,
+        edgeProvenanceV: graph.edgeProvenanceV || 0,
         barrelResolutionV: graph.barrelResolutionV || 0,
         extractorSchemaV: graph.extractorSchemaV || 0,
     } : graph