weavatrix 0.2.12 → 0.2.14

package/src/mcp/catalog.mjs

@@ -26,14 +26,28 @@ const PROFILE_CAPS = Object.freeze({
 
 // The files whose mtime the stdio shell watches for hot reload — keep in sync with the imports in
 // loadHotApi below (catalog.mjs itself is last: a change here re-derives the whole table).
-export const HOT_FILES = ['tools-graph.mjs', 'tools-impact.mjs', 'tools-health.mjs', 'tools-source.mjs', 'tools-context.mjs', 'tools-endpoints.mjs', 'tools-actions.mjs', 'tools-architecture.mjs', 'tools-history.mjs', 'tools-company.mjs', 'tools-verified-change.mjs', 'catalog.mjs']
+const HOT_FACADES = [
+    'tools-graph.mjs', 'tools-impact.mjs', 'tools-health.mjs', 'tools-source.mjs',
+    'tools-context.mjs', 'tools-endpoints.mjs', 'tools-actions.mjs',
+    'tools-architecture.mjs', 'tools-history.mjs', 'tools-company.mjs',
+    'tools-verified-change.mjs',
+]
+const HOT_OWNERS = [
+    'graph/tools-core.mjs', 'graph/tools-query.mjs', 'tools-graph-hubs.mjs',
+    'health/duplicates.mjs', 'health/dead-code.mjs', 'health/audit-format.mjs',
+    'health/audit.mjs', 'health/structure.mjs', 'health/endpoints.mjs',
+    'actions/graph-lifecycle.mjs', 'actions/advisories.mjs',
+    'actions/hosted-architecture.mjs', 'actions/graph-sync.mjs',
+    'architecture-starter.mjs', 'architecture-bootstrap.mjs',
+]
+export const HOT_FILES = [...HOT_FACADES, ...HOT_OWNERS, 'catalog.mjs']
 
 function buildTools({tg, ti, th, ts, tb, te, ta, tar, thi, tc, tv, caps}) {
     const tools = [
         {cap: 'graph', name: 'graph_stats', description: 'Return summary statistics: node count, edge count, communities, versioned edge-provenance/legacy-confidence breakdowns, and graph build time vs repo HEAD (staleness).', inputSchema: {type: 'object', properties: {}}, run: (g, a, ctx) => tg.tGraphStats(g, ctx)},
         {cap: 'graph', name: 'get_node', description: 'Get full details for a specific node by label or ID.', inputSchema: {type: 'object', properties: {label: {type: 'string', description: 'Node label or ID to look up'}}, required: ['label']}, run: (g, a, ctx) => tg.tGetNode(g, a, ctx)},
         {cap: 'graph', name: 'get_neighbors', description: 'Get all direct neighbors of a node with edge details (1 hop, call sites deduped). For transitive impact use get_dependents; for the impact of your current branch changes use change_impact.', inputSchema: {type: 'object', properties: {label: {type: 'string'}, relation_filter: {type: 'string', description: 'Optional: filter by relation type'}}, required: ['label']}, run: (g, a, ctx) => tg.tGetNeighbors(g, a, ctx)},
-        {cap: 'graph', name: 'query_graph', description: 'Explore a focused production-first graph around a concept (BFS/DFS). Exact seed files stay pinned; a code-shaped identifier uses only exact same-name declarations. Classified paths and unreferenced constant/field leaves are suppressed unless the question or explicit flags request them. Reports policy and suppression instead of silently flooding the result.', inputSchema: {type: 'object', properties: {question: {type: 'string', description: 'Natural language question or keyword search'}, mode: {type: 'string', enum: ['bfs', 'dfs'], default: 'bfs'}, depth: {type: 'integer', default: 3}, context_filter: {type: 'array', items: {type: 'string'}}, seed_files: {type: 'array', items: {type: 'string'}, maxItems: 12, description: 'Optional exact repo-relative file paths. When resolved, these are the only seeds unless augment_seeds is true'}, augment_seeds: {type: 'boolean', default: false, description: 'With seed_files, also add fuzzy question-derived seeds; false keeps traversal strictly pinned'}, include_classified: {type: 'boolean', default: false, description: 'Allow traversal through tests/e2e/generated/mocks/stories/docs/benchmarks/temp and explicitly excluded paths. An explicit class term in the question enables only that class.'}, include_low_signal: {type: 'boolean', default: false, description: 'Include unreferenced constant/field leaf symbols that do not match a query term'}, token_budget: {type: 'integer', description: 'Higher budget shows more nodes/edges', default: 2000}}, required: ['question']}, run: (g, a, ctx) => tg.tQueryGraph(g, a, ctx)},
+        {cap: 'graph', name: 'query_graph', description: 'Explore a focused production-first graph around a concept or exact symbols (BFS/DFS). Exact seed files/symbols stay pinned; relation_filter and flow_direction support bounded event/data-flow views without a separate tool. Classified paths and unreferenced constant/field leaves stay suppressed unless explicitly requested.', inputSchema: {type: 'object', properties: {question: {type: 'string', description: 'Optional natural-language question or keyword search when exact seeds are not sufficient'}, mode: {type: 'string', enum: ['bfs', 'dfs'], default: 'bfs'}, depth: {type: 'integer', default: 3}, context_filter: {type: 'array', items: {type: 'string'}}, seed_files: {type: 'array', items: {type: 'string'}, maxItems: 12, description: 'Exact repo-relative file paths. Resolved exact seeds remain pinned unless augment_seeds is true'}, seed_symbols: {type: 'array', items: {type: 'string'}, maxItems: 12, description: 'Exact node IDs or unambiguous symbol labels; enables focused flows without fuzzy query seeds'}, relation_filter: {oneOf: [{type: 'array', items: {type: 'string'}}, {type: 'string'}], description: 'Optional relation allow-list, e.g. calls,references,imports'}, flow_direction: {type: 'string', enum: ['forward', 'backward', 'both'], default: 'both', description: 'Traverse outgoing, incoming, or both directions'}, augment_seeds: {type: 'boolean', default: false, description: 'With exact seeds, also add fuzzy question-derived seeds; false keeps traversal strictly pinned'}, include_classified: {type: 'boolean', default: false, description: 'Allow traversal through tests/e2e/generated/mocks/stories/docs/benchmarks/temp and explicitly excluded paths. An explicit class term in the question enables only that class.'}, include_low_signal: {type: 'boolean', default: false, description: 'Include unreferenced constant/field leaf symbols that do not match a query term'}, token_budget: {type: 'integer', description: 'Higher budget shows more nodes/edges', default: 2000}}, anyOf: [{required: ['question']}, {required: ['seed_files']}, {required: ['seed_symbols']}]}, run: (g, a, ctx) => tg.tQueryGraph(g, a, ctx)},
         {cap: 'graph', name: 'god_nodes', description: 'Rank production-code connectivity hubs by unique call/import/reference neighbors, with class/method ownership reported separately from runtime connectivity. Repeated call sites do not inflate the rank; classified tests, generated/build output and other non-product paths are excluded by default.', inputSchema: {type: 'object', properties: {top_n: {type: 'integer', default: 10}, include_classified: {type: 'boolean', default: false, description: 'Include tests/e2e/generated/build output/mocks/stories/docs/benchmarks/temp and paths explicitly excluded by repository classification'}}}, run: (g, a, ctx) => tg.tGodNodes(g, a, ctx)},
         {cap: 'graph', name: 'shortest_path', description: 'Find the shortest path between two concepts in the knowledge graph.', inputSchema: {type: 'object', properties: {source: {type: 'string'}, target: {type: 'string'}, max_hops: {type: 'integer', default: 8}}, required: ['source', 'target']}, run: (g, a) => tg.tShortestPath(g, a)},
         {cap: 'graph', name: 'get_dependents', description: 'Transitive blast-radius of ONE node: everything that calls/imports/inherits it, directly or through intermediaries (reverse edges, ranked by proximity then connectivity). Symbol queries stay symbol-precise by default; set include_container_importers only for a conservative module-wide radius. Use before refactoring; get_neighbors shows only 1 hop, change_impact covers your whole current diff at once.', inputSchema: {type: 'object', properties: {label: {type: 'string', description: 'Node label or ID'}, depth: {type: 'integer', description: 'Max reverse hops, default 3', default: 3}, max_nodes: {type: 'integer', description: 'Max dependents to list, default 40', default: 40}, include_container_importers: {type: 'boolean', description: 'Also seed importers of the symbol containing file (broader, conservative; default false)', default: false}}, required: ['label']}, run: (g, a) => ti.tGetDependents(g, a)},
@@ -105,19 +119,19 @@ function buildTools({tg, ti, th, ts, tb, te, ta, tar, thi, tc, tv, caps}) {
         {cap: 'search', name: 'search_code', description: 'Full-text or regex search across the repo source (ripgrep-backed, Node fallback). The graph only stores structure — use this to find literal text/patterns, then get_node/get_neighbors for structure.', inputSchema: {type: 'object', properties: {query: {type: 'string', description: 'text or regex to search for'}, is_regex: {type: 'boolean', default: false}, glob: {type: 'string', description: 'optional path glob, e.g. "*.js" or "src/**"'}, max_results: {type: 'integer', default: 40}}, required: ['query']}, run: (g, a, ctx) => searchCode({repoRoot: ctx.repoRoot, resolveRg}, a)},
           {cap: 'source', name: 'read_source', description: "Read the actual source of a node (by label/ID) or a repo-relative file path — the symbol's lines with context. The graph stores only locations, not source text. For a path read, pass start_line to anchor the window anywhere in the file (otherwise it shows the head).", inputSchema: {type: 'object', properties: {label: {type: 'string', description: 'node label or ID'}, path: {type: 'string', description: 'or a repo-relative file path'}, start_line: {type: 'integer', description: 'anchor line: window = start_line-before .. start_line+after'}, before: {type: 'integer', default: 3}, after: {type: 'integer', default: 40}}}, run: (g, a, ctx) => readSource({repoRoot: ctx.repoRoot, resolveNode, isSymbol}, g, a)},
           {cap: 'source', refreshGraph: true, name: 'inspect_symbol', description: 'Inspect one exact symbol with an on-demand TypeScript/JavaScript LSP reference query, grouped occurrence containers, graph blast radius, complexity facts and bounded local source context. Ambiguous labels fail closed; point queries never replace the broad precision overlay.', inputSchema: {type: 'object', properties: {label: {type: 'string', description: 'Exact node ID or unambiguous symbol label'}, precision: {type: 'string', enum: ['auto', 'graph', 'lsp'], default: 'auto'}, max_references: {type: 'integer', minimum: 1, maximum: 5000, default: 1000}, max_containers: {type: 'integer', minimum: 1, maximum: 50, default: 15}, context_lines: {type: 'integer', minimum: 0, maximum: 40, default: 8}, timeout_ms: {type: 'integer', minimum: 1000, maximum: 60000, default: 30000}}, required: ['label']}, run: (g, a, ctx) => ts.tInspectSymbol(g, a, ctx)},
-          {cap: 'source', refreshGraph: true, name: 'context_bundle', description: 'Return one compact, bounded source bundle for an exact symbol: definition, aggregated inbound/outbound containers, exact re-export sites, on-demand TS/JS reference evidence and a few focused source excerpts. Use before an edit when query_graph would be too broad.', inputSchema: {type: 'object', properties: {label: {type: 'string', description: 'Exact node ID or unambiguous symbol label'}, precision: {type: 'string', enum: ['auto', 'graph', 'lsp'], default: 'auto'}, max_references: {type: 'integer', minimum: 1, maximum: 5000, default: 1000}, max_related: {type: 'integer', minimum: 1, maximum: 30, default: 10}, max_reexports: {type: 'integer', minimum: 1, maximum: 100, default: 20}, max_source_files: {type: 'integer', minimum: 1, maximum: 8, default: 4}, context_lines: {type: 'integer', minimum: 0, maximum: 12, default: 4}, timeout_ms: {type: 'integer', minimum: 1000, maximum: 60000, default: 30000}}, required: ['label']}, run: (g, a, ctx) => tb.tContextBundle(g, a, ctx, ts.tInspectSymbol)},
+          {cap: 'source', refreshGraph: true, name: 'context_bundle', description: 'Return one compact, bounded source bundle for an exact symbol: definition, production-first inbound/outbound containers, exact re-export sites, on-demand TS/JS reference evidence and diverse excerpts around call sites. Use before an edit when query_graph would be too broad.', inputSchema: {type: 'object', properties: {label: {type: 'string', description: 'Exact node ID or unambiguous symbol label'}, precision: {type: 'string', enum: ['auto', 'graph', 'lsp'], default: 'auto'}, max_references: {type: 'integer', minimum: 1, maximum: 5000, default: 1000}, max_related: {type: 'integer', minimum: 1, maximum: 30, default: 10}, max_reexports: {type: 'integer', minimum: 1, maximum: 100, default: 20}, max_source_files: {type: 'integer', minimum: 1, maximum: 8, default: 4}, context_lines: {type: 'integer', minimum: 0, maximum: 12, default: 4}, include_classified: {type: 'boolean', default: false, description: 'Include test/e2e/generated/mock/story/docs/benchmark/temp callers after production callers'}, timeout_ms: {type: 'integer', minimum: 1000, maximum: 60000, default: 30000}}, required: ['label']}, run: (g, a, ctx) => tb.tContextBundle(g, a, ctx, ts.tInspectSymbol)},
         {cap: 'health', name: 'find_duplicates', description: "Content-based clone detection over production code (MOSS winnowing over method bodies). Supports high-confidence small clones down to 12 tokens when min_tokens is lowered. Tests, classified non-product paths, and all-router framework boilerplate clone groups are excluded by default; opt them in explicitly.", inputSchema: {type: 'object', properties: {min_similarity: {type: 'integer', description: '50-100, default 80 (ignored in semantic mode)'}, min_tokens: {type: 'integer', minimum: 12, maximum: 400, description: 'min fragment size, 12-400; default 50'}, mode: {type: 'string', enum: ['renamed', 'strict', 'semantic'], default: 'renamed'}, include_tests: {type: 'boolean', default: false}, include_classified: {type: 'boolean', default: false, description: 'Include generated/mock/story/docs/benchmark/temp and paths explicitly classified as excluded; tests still require include_tests'}, include_boilerplate: {type: 'boolean', default: false, description: 'Include clone groups made entirely of conventional *.router.js/ts router symbols'}, include_strings: {type: 'boolean', description: 'Also clone-check large multi-line string literals', default: false}, top_n: {type: 'integer', default: 15}}}, run: (g, a, ctx) => th.tFindDuplicates(g, a, ctx)},
         {cap: 'health', name: 'find_dead_code', description: 'Conservative review queue for statically unreferenced files, functions, methods and symbols. Returns confidence, reason, bounded evidence and explicit framework/dynamic/reflection/public-API caveats; never an auto-delete verdict. Tests, generated code, mocks, stories, docs, benchmarks and temporary roots are excluded by default.', inputSchema: {type: 'object', properties: {path: {type: 'string', maxLength: 1024, description: 'Optional repo-relative path prefix'}, kinds: {type: 'array', items: {type: 'string', enum: ['file', 'function', 'method', 'symbol']}, maxItems: 4, uniqueItems: true, description: 'Optional candidate kinds; defaults to all'}, min_confidence: {type: 'string', enum: ['high', 'medium', 'low'], default: 'medium', description: 'Minimum confidence to include. low explicitly includes public/framework/dynamic review candidates'}, include_tests: {type: 'boolean', default: false}, include_classified: {type: 'boolean', default: false, description: 'Include generated/mock/story/docs/benchmark/temp and paths explicitly classified as excluded; tests still require include_tests'}, top_n: {type: 'integer', minimum: 1, maximum: 100, default: 30}}}, run: (g, a, ctx) => th.tFindDeadCode(g, a, ctx)},
-        {cap: 'health', name: 'run_audit', description: 'Core production-first repository Health review: structure, dependency declarations, unused surfaces and explicitly bounded supply-chain evidence. Findings whose evidence is entirely test/e2e/generated/mock/story/docs/benchmark/temp or explicitly excluded are suppressed by default; opt them in with include_classified. category=dependencies is a dedicated dependency-health projection across missing, unused and duplicate declarations while preserving each finding\'s native category. With base_ref, builds and audits an immutable Git checkout and compares stable deterministic finding IDs; debt defaults to genuinely new findings. Supply-chain checks remain explicitly uncomparable across the source-only baseline. changed_files without base_ref is only changed-scope, never a new-debt claim.', inputSchema: {type: 'object', properties: {category: {type: 'string', enum: ['dependencies', 'unused', 'structure', 'vulnerability', 'malware'], description: 'Only findings of this category; dependencies selects dependency manifest/import findings across native categories'}, min_severity: {type: 'string', enum: ['critical', 'high', 'medium', 'low', 'info'], description: 'Minimum severity to include'}, max_findings: {type: 'integer', description: 'Max findings to list, default 30'}, include_classified: {type: 'boolean', default: false, description: 'Include findings whose evidence is entirely tests/e2e/generated/mocks/stories/docs/benchmarks/temp or explicitly excluded'}, include_malware_scan: {type: 'boolean', description: 'Also grep installed packages for malware heuristics (slow)', default: false}, base_ref: {type: 'string', maxLength: 200, description: 'Optional immutable Git baseline (for example HEAD~1 or origin/main). Enables honest new/existing/fixed debt comparison'}, changed_files: {type: 'array', items: {type: 'string'}, minItems: 1, maxItems: 500, description: 'Optional explicit repo-relative scope. Without base_ref this is changed-scope only; when omitted with base_ref, files are derived from the Git diff'}, debt: {type: 'string', enum: ['new', 'existing', 'all'], default: 'new', description: 'Baseline comparison view. Defaults to genuinely new deterministic findings when base_ref is present'}}}, run: (g, a, ctx) => th.tRunAudit(g, a, ctx)},
+        {cap: 'health', name: 'run_audit', description: 'Core production-first repository Health review with an explicit capability/completeness matrix for structure, dependencies, bounded runtime-correctness/concurrency patterns, advisories, malware and coverage. Unsupported Maven/Gradle import verification is NOT_SUPPORTED/PARTIAL, never a clean zero. Findings whose evidence is entirely test/e2e/generated/mock/story/docs/benchmark/temp or explicitly excluded are suppressed by default; opt them in with include_classified. category=dependencies is a dedicated dependency-health projection across missing, unused and duplicate declarations while preserving each finding\'s native category. With base_ref, builds and audits an immutable Git checkout and compares stable deterministic finding IDs; debt defaults to genuinely new findings. Supply-chain checks remain explicitly uncomparable across the source-only baseline. changed_files without base_ref is only changed-scope, never a new-debt claim.', inputSchema: {type: 'object', properties: {category: {type: 'string', enum: ['dependencies', 'unused', 'structure', 'vulnerability', 'malware'], description: 'Only findings of this category; dependencies selects dependency manifest/import findings across native categories'}, min_severity: {type: 'string', enum: ['critical', 'high', 'medium', 'low', 'info'], description: 'Minimum severity to include'}, max_findings: {type: 'integer', description: 'Max findings to list, default 30'}, include_classified: {type: 'boolean', default: false, description: 'Include findings whose evidence is entirely tests/e2e/generated/mocks/stories/docs/benchmarks/temp or explicitly excluded'}, include_malware_scan: {type: 'boolean', description: 'Also grep installed packages for malware heuristics (slow)', default: false}, base_ref: {type: 'string', maxLength: 200, description: 'Optional immutable Git baseline (for example HEAD~1 or origin/main). Enables honest new/existing/fixed debt comparison'}, changed_files: {type: 'array', items: {type: 'string'}, minItems: 1, maxItems: 500, description: 'Optional explicit repo-relative scope. Without base_ref this is changed-scope only; when omitted with base_ref, files are derived from the Git diff'}, debt: {type: 'string', enum: ['new', 'existing', 'all'], default: 'new', description: 'Baseline comparison view. Defaults to genuinely new deterministic findings when base_ref is present'}}}, run: (g, a, ctx) => th.tRunAudit(g, a, ctx)},
         {cap: 'health', name: 'coverage_map', description: 'Map a real existing coverage report onto the graph. If no report exists, return clearly labelled static test reachability (a test imports/reaches a source file) with actualCoverage=NOT_AVAILABLE; reachability is never presented as measured coverage.', inputSchema: {type: 'object', properties: {top_n: {type: 'integer', description: 'Max risk hotspots to list, default 15'}, path: {type: 'string', description: 'Optional repo-relative path prefix filter, e.g. src/query'}}}, run: (g, a, ctx) => th.tCoverageMap(g, a, ctx)},
         {cap: 'health', name: 'hot_path_review', description: 'Rank a focused production-symbol hot-path queue from parser-derived local complexity, inside-loop allocations/copies/scans/sorts/recursion, graph fan-in/fan-out, and measured coverage or clearly labelled static test reachability. The default score gate is 85 with a narrow strong-local fallback; set min_score=0 for the full diagnostic queue. This is not profiler data or interprocedural Big-O.', inputSchema: {type: 'object', properties: {path: {type: 'string', maxLength: 1024, description: 'Optional repository-relative path prefix'}, top_n: {type: 'integer', minimum: 1, maximum: 100, default: 20}, min_score: {type: 'integer', minimum: 0, maximum: 100, default: 85, description: 'Focused default is 85; lower explicitly to broaden, or use 0 for every threshold-matching diagnostic candidate'}, cyclomatic_threshold: {type: 'integer', minimum: 2, maximum: 1000, default: 8}, call_threshold: {type: 'integer', minimum: 1, maximum: 10000, default: 12}, loop_depth_threshold: {type: 'integer', minimum: 1, maximum: 10, default: 2}, time_rank_threshold: {type: 'integer', minimum: 0, maximum: 5, default: 2}, include_tests: {type: 'boolean', default: false}, include_classified: {type: 'boolean', default: false, description: 'Include generated/mock/story/docs/benchmark/temp and explicitly excluded paths; tests still require include_tests'}}}, run: (g, a, ctx) => th.tHotPathReview(g, a, ctx)},
         {cap: 'graph', name: 'list_communities', description: 'List graph communities named by their dominant folder (largest first) with sample files — a readable module overview; feed the list position into get_community.', inputSchema: {type: 'object', properties: {top_n: {type: 'integer', description: 'Max communities to list, default 20'}}}, run: (g, a, ctx) => th.tListCommunities(g, a, ctx)},
         {cap: 'graph', name: 'module_map', description: 'First orientation view for understanding an unfamiliar application with little context: a production-first folder architecture map with file/symbol counts and strongest module dependencies, separating runtime, TypeScript type-only and language compile-only coupling.', inputSchema: {type: 'object', properties: {top_n: {type: 'integer', description: 'Max modules to list, default 25'}, include_non_product: {type: 'boolean', default: false, description: 'Include tests, fixtures, benchmarks, generated output, docs and other classified non-product files; false by default'}}}, run: (g, a, ctx) => th.tModuleMap(g, a, ctx)},
-        {cap: 'source', refreshGraph: true, name: 'list_endpoints', description: 'Inventory of HTTP endpoints defined in the repo (Express/Fastify/Nest/Flask/FastAPI/Go mux/Rust axum and actix-web/Spring MVC and WebFlux): declared and reachable composed paths, static mount provenance, confidence, handler, and file:line.', inputSchema: {type: 'object', properties: {method: {type: 'string', enum: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS', 'TRACE', 'CONNECT', 'ALL', 'ANY']}, path: {type: 'string', maxLength: 2048, description: 'Optional exact composed path or segment-aligned suffix'}, max_results: {type: 'integer', description: 'Max endpoints to list, default 100'}}}, run: (g, a, ctx) => th.tListEndpoints(g, a, ctx)},
+        {cap: 'source', refreshGraph: true, name: 'list_endpoints', description: 'Inventory of HTTP endpoints defined in the repo (Express/Fastify/Nest/Flask/FastAPI/Go mux/Rust axum and actix-web/Spring MVC and WebFlux): declared and reachable composed paths, static mount provenance, confidence, handler, file:line, and Spring conditional/default-active state.', inputSchema: {type: 'object', properties: {method: {type: 'string', enum: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS', 'TRACE', 'CONNECT', 'ALL', 'ANY']}, path: {type: 'string', maxLength: 2048, description: 'Optional exact composed path or segment-aligned suffix'}, max_results: {type: 'integer', description: 'Max endpoints to list, default 100'}}}, run: (g, a, ctx) => th.tListEndpoints(g, a, ctx)},
         {cap: 'source', refreshGraph: true, name: 'trace_endpoint', description: 'Resolve one exact reachable HTTP endpoint, prove its router mount chain, bind its handler symbol, and return a bounded production-only multi-hop call graph with call-site excerpts. This is a focused projection of the repository graph, not text-search inference.', inputSchema: {type: 'object', properties: {path: {type: 'string', minLength: 1, maxLength: 2048, description: 'Exact composed path; a suffix is accepted only when unambiguous'}, method: {type: 'string', enum: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS', 'TRACE', 'CONNECT', 'ALL', 'ANY']}, max_depth: {type: 'integer', minimum: 1, maximum: 4, default: 3}, max_nodes: {type: 'integer', minimum: 2, maximum: 40, default: 20}, max_excerpts: {type: 'integer', minimum: 0, maximum: 12, default: 6}, context_lines: {type: 'integer', minimum: 0, maximum: 6, default: 2}, include_classified: {type: 'boolean', default: false, description: 'Include test/e2e/generated/mock/story/docs/benchmark/temp and explicitly excluded targets'}}, required: ['path']}, run: (g, a, ctx) => te.tTraceEndpoint(g, a, ctx)},
         {cap: 'build', name: 'rebuild_graph', description: "Rebuild the active full-repository graph and report a structural delta. Omitted mode/precision preserve the active graph; a first build uses full and the startup precision setting (lsp unless WEAVATRIX_PRECISION=off). The local TypeScript/JavaScript LSP overlay validates bounded ambiguous edges; precision:off is an explicit fallback. With scope, build an isolated diagnostic graph without replacing or diffing the full graph.", inputSchema: {type: 'object', properties: {mode: {type: 'string', enum: ['full', 'no-tests', 'tests-only'], description: 'Build mode; omit to preserve the active mode (or use full for a first build)'}, precision: {type: 'string', enum: ['lsp', 'off'], description: 'Semantic precision; omit to preserve the active mode (or use the startup setting for a first build)'}, scope: {type: 'string', description: 'Optional isolated diagnostic path prefix; never replaces the active full graph'}}}, run: (g, a, ctx) => ta.tRebuildGraph(g, a, ctx)},
         {cap: 'graph', name: 'graph_diff', description: 'Structural graph diff: compare the current graph with an immutable Git-ref baseline (base_ref such as HEAD~1 or main), or with graph.prev.json from the last rebuild when base_ref is omitted. Reports architecture drift, cycle changes and symbols that lost their last caller.', inputSchema: {type: 'object', properties: {base_ref: {type: 'string', maxLength: 256, description: 'Optional immutable Git baseline to build in isolation, e.g. HEAD~1, main or origin/main; never checks out or mutates the working tree'}, path: {type: 'string', description: 'Optional node-id/path prefix to scope the diff, e.g. src/query'}}}, run: (g, a, ctx) => ti.tGraphDiff(g, a, ctx)},
-        {cap: 'graph', name: 'get_architecture_contract', description: 'Start the intended-architecture workflow: return the executable owner-approved target, quality budgets and ratchet mode that an agent must follow before editing. When absent, returns a starter proposal rather than silently inventing policy.', inputSchema: {type: 'object', properties: {}}, run: (g, a, ctx) => tar.tGetArchitectureContract(g, a, ctx)},
+        {cap: 'graph', name: 'get_architecture_contract', description: 'Read the owner-approved architecture target or safely bootstrap one. With action=preview, returns an adaptive candidate, observed-but-not-enforced dependency directions, verification, exact file content/hash and a short-lived confirmation token. action=approve creates the local contract only after explicit token confirmation and never overwrites an active target.', inputSchema: {type: 'object', properties: {action: {type: 'string', enum: ['preview', 'approve'], description: 'Omit to read; preview is dry-run only; approve requires the preview token'}, candidate_contract: {type: 'object', description: 'Optional reviewed candidate to normalize and verify during preview'}, baseline_mode: {type: 'string', enum: ['none', 'accept-current'], default: 'none', description: 'Whether preview should materialize current violations as an explicit ratchet baseline'}, confirm_token: {type: 'string', description: 'One-time token returned by preview; required for approve'}}}, run: (g, a, ctx) => tar.tGetArchitectureContract(g, a, ctx)},
         {cap: 'graph', name: 'prepare_change', description: 'Select active target-architecture rules for an intended set of changed files. Run before a non-trivial edit.', inputSchema: {type: 'object', properties: {intent: {type: 'string'}, files: {type: 'array', items: {type: 'string'}, maxItems: 200}}, required: ['files']}, run: (g, a, ctx) => tar.tPrepareChange(g, a, ctx)},
         {cap: 'health', name: 'verify_architecture', description: 'Verify the fresh graph against the active target contract and ratchet; separates new, existing, fixed and excepted debt.', inputSchema: {type: 'object', properties: {}}, run: (g, a, ctx) => tar.tVerifyArchitecture(g, a, ctx)},
         {cap: 'health', name: 'explain_architecture_violation', description: 'Explain one active architecture violation and the governing rule.', inputSchema: {type: 'object', properties: {fingerprint: {type: 'string'}}, required: ['fingerprint']}, run: (g, a, ctx) => tar.tExplainArchitectureViolation(g, a, ctx)},
@@ -169,6 +183,7 @@ export async function loadHotApi(version, capsArg) {
         import(new URL(`./tools-verified-change.mjs${v}`, import.meta.url).href),
     ])
     const raw = capsArg == null ? 'offline' : String(capsArg).trim()
+    const profile = Object.hasOwn(PROFILE_CAPS, raw) ? raw : 'custom'
     const selected = PROFILE_CAPS[raw] || raw.split(',').map((s) => s.trim()).filter(Boolean)
         .flatMap((cap) => cap === 'online' ? ['advisories', 'hosted'] : [cap])
     const caps = new Set(selected)
@@ -178,6 +193,7 @@ export async function loadHotApi(version, capsArg) {
         tools,
         byName: new Map(tools.map((t) => [t.name, t])),
         caps,
+        profile,
         stalenessLine,
         resetStalenessCache,
     }

package/src/mcp/evidence/bun-lock-graph.mjs

@@ -0,0 +1,209 @@
+import {compareText, safeToken, STATE} from '../evidence-snapshot.common.mjs'
+import {
+    MAX_DEPENDENCY_DECLARATIONS, MAX_PACKAGE_RECORDS, PACKAGE_NAME,
+    dependencyDeclarations, emptyDeclarations, emptyGraph, finalizeGraph,
+    packageId, packageVersion,
+} from './package-graph-common.mjs'
+
+// Bun >= 1.2 writes JSONC: JSON plus comments and trailing commas.
+export function parseJsonc(text) {
+    const source = text.charCodeAt(0) === 0xfeff ? text.slice(1) : text
+    const out = []
+    let i = 0
+    const length = source.length
+    const skipComment = (index) => {
+        if (source[index] !== '/') return index
+        if (source[index + 1] === '/') {
+            let cursor = index + 2
+            while (cursor < length && source[cursor] !== '\n') cursor++
+            return cursor
+        }
+        if (source[index + 1] === '*') {
+            let cursor = index + 2
+            while (cursor < length && !(source[cursor] === '*' && source[cursor + 1] === '/')) cursor++
+            return Math.min(cursor + 2, length)
+        }
+        return index
+    }
+    while (i < length) {
+        const char = source[i]
+        if (char === '"') {
+            const start = i
+            i++
+            while (i < length && source[i] !== '"') i += source[i] === '\\' ? 2 : 1
+            i = Math.min(i + 1, length)
+            out.push(source.slice(start, i))
+            continue
+        }
+        if (char === '/') {
+            const next = skipComment(i)
+            if (next !== i) { i = next; continue }
+        }
+        if (char === ',') {
+            let ahead = i + 1
+            while (ahead < length) {
+                if (/\s/.test(source[ahead])) { ahead++; continue }
+                const next = skipComment(ahead)
+                if (next !== ahead) { ahead = next; continue }
+                break
+            }
+            if (ahead < length && (source[ahead] === '}' || source[ahead] === ']')) { i++; continue }
+        }
+        out.push(char)
+        i++
+    }
+    return JSON.parse(out.join(''))
+}
+
+function bunKeySegments(key) {
+    if (typeof key !== 'string' || key.length === 0 || key.length > 4096 || /[\u0000-\u001f\u007f]/.test(key)) return null
+    const parts = key.split('/')
+    const segments = []
+    for (let index = 0; index < parts.length; index++) {
+        let segment = parts[index]
+        if (segment.startsWith('@')) {
+            if (index + 1 >= parts.length) return null
+            segment = `${segment}/${parts[++index]}`
+        }
+        if (segment.length > 256 || !PACKAGE_NAME.test(segment)) return null
+        segments.push(segment)
+    }
+    return segments
+}
+
+function bunPackageRecord(entry) {
+    if (!Array.isArray(entry) || typeof entry[0] !== 'string' || entry[0].length > 1024) return null
+    const at = entry[0].lastIndexOf('@')
+    if (at <= 0) return null
+    const name = entry[0].slice(0, at)
+    if (name.length > 256 || !PACKAGE_NAME.test(name)) return null
+    const rawVersion = entry[0].slice(at + 1)
+    const meta = entry.slice(1).find((value) => value && typeof value === 'object' && !Array.isArray(value)) || {}
+    return {name, rawVersion, workspace: rawVersion.startsWith('workspace:'), meta}
+}
+
+function bunDeclarationRecord(meta) {
+    if (!meta || typeof meta !== 'object' || Array.isArray(meta)) return {}
+    const peerDependenciesMeta = {}
+    if (Array.isArray(meta.optionalPeers)) {
+        for (const name of meta.optionalPeers) if (typeof name === 'string') peerDependenciesMeta[name] = {optional: true}
+    }
+    return {
+        dependencies: meta.dependencies,
+        devDependencies: meta.devDependencies,
+        optionalDependencies: meta.optionalDependencies,
+        peerDependencies: meta.peerDependencies,
+        peerDependenciesMeta,
+    }
+}
+
+function resolveBunDependency(sourceSegments, name, records) {
+    for (let depth = sourceSegments.length; depth >= 0; depth--) {
+        const key = [...sourceSegments.slice(0, depth), name].join('/')
+        const record = records.get(key)
+        if (record) return {key, record}
+    }
+    return null
+}
+
+function applyBunReachabilityFlags(nodes, edges) {
+    const adjacency = new Map()
+    for (const edge of edges) {
+        if (!adjacency.has(edge.from)) adjacency.set(edge.from, [])
+        adjacency.get(edge.from).push(edge)
+    }
+    const reach = (excluded) => {
+        const seen = new Set(['(root)'])
+        const queue = ['(root)']
+        while (queue.length) {
+            for (const edge of adjacency.get(queue.pop()) || []) {
+                if (excluded.has(edge.kind) || seen.has(edge.to)) continue
+                seen.add(edge.to)
+                queue.push(edge.to)
+            }
+        }
+        return seen
+    }
+    const withoutDev = reach(new Set(['dev']))
+    const withoutOptional = reach(new Set(['optional', 'optional-peer']))
+    const withoutPeer = reach(new Set(['peer', 'optional-peer']))
+    for (const node of nodes) {
+        node.dev = !withoutDev.has(node.id)
+        node.optional = !withoutOptional.has(node.id)
+        node.peer = !withoutPeer.has(node.id)
+    }
+}
+
+export function parseBunLock(lock, lockfile) {
+    const lockfileVersion = Number(lock?.lockfileVersion)
+    const extras = {lockfile, lockfileVersion: Number.isFinite(lockfileVersion) ? Math.trunc(lockfileVersion) : 0}
+    if (!lock?.packages || typeof lock.packages !== 'object' || Array.isArray(lock.packages)) {
+        return emptyGraph(STATE.PARTIAL, 'BUN_LOCK_PACKAGES_REQUIRED', extras)
+    }
+    const allKeys = Object.keys(lock.packages).sort(compareText)
+    const selectedKeys = allKeys.slice(0, MAX_PACKAGE_RECORDS)
+    const reasons = []
+    if (selectedKeys.length < allKeys.length) reasons.push('LOCKFILE_PACKAGE_RECORD_LIMIT_REACHED')
+    const records = new Map()
+    let invalidRecords = 0
+    for (const key of selectedKeys) {
+        const segments = bunKeySegments(key)
+        const record = segments ? bunPackageRecord(lock.packages[key]) : null
+        if (!record) { invalidRecords++; continue }
+        records.set(key, {...record, segments})
+    }
+    if (invalidRecords > 0) reasons.push('INVALID_LOCKFILE_PACKAGE_RECORDS')
+    const externalNodes = new Map()
+    let invalidPackageVersions = 0
+    for (const [key, record] of records) {
+        if (record.workspace) continue
+        const version = packageVersion(record.rawVersion)
+        if (!version) { invalidPackageVersions++; continue }
+        externalNodes.set(key, {
+            id: packageId(record.name, version, key), name: record.name, version,
+            direct: false, dev: false, optional: false, peer: false,
+        })
+    }
+    if (invalidPackageVersions > 0) reasons.push('INVALID_LOCKFILE_PACKAGE_VERSIONS')
+    const workspaces = lock?.workspaces && typeof lock.workspaces === 'object' && !Array.isArray(lock.workspaces)
+        ? lock.workspaces : null
+    if (!workspaces) reasons.push('BUN_LOCK_WORKSPACES_MISSING')
+    const sources = []
+    for (const path of Object.keys(workspaces || {}).sort(compareText)) {
+        const meta = workspaces[path]
+        if (!meta || typeof meta !== 'object' || Array.isArray(meta)) continue
+        const workspaceName = path === '' ? null : safeToken(meta.name)
+        const segments = workspaceName && records.has(workspaceName) ? [workspaceName] : []
+        sources.push({sourceId: '(root)', segments, declarationRecord: bunDeclarationRecord(meta)})
+    }
+    for (const [key, record] of [...records].sort(([a], [b]) => compareText(a, b))) {
+        const node = externalNodes.get(key)
+        if (node) sources.push({sourceId: node.id, segments: record.segments, declarationRecord: bunDeclarationRecord(record.meta)})
+    }
+    const edgeMap = new Map()
+    const declarations = emptyDeclarations()
+    let declarationLimitReached = false
+    outer: for (const source of sources) {
+        for (const declaration of dependencyDeclarations(source.declarationRecord)) {
+            if (declarations.total >= MAX_DEPENDENCY_DECLARATIONS) { declarationLimitReached = true; break outer }
+            declarations.total++
+            const resolved = resolveBunDependency(source.segments, declaration.name, records)
+            if (resolved?.record.workspace) { declarations.local++; continue }
+            const node = resolved ? externalNodes.get(resolved.key) : null
+            if (!node) {
+                if (declaration.kind === 'optional' || declaration.kind === 'optional-peer') declarations.optionalMissing++
+                else declarations.unresolved++
+                continue
+            }
+            declarations.resolved++
+            if (source.sourceId === '(root)') node.direct = true
+            if (source.sourceId === node.id) continue
+            const edge = {from: source.sourceId, to: node.id, kind: declaration.kind}
+            edgeMap.set(`${edge.from}\0${edge.to}\0${edge.kind}`, edge)
+        }
+    }
+    if (declarationLimitReached) reasons.push('LOCKFILE_DEPENDENCY_DECLARATION_LIMIT_REACHED')
+    if (declarations.unresolved > 0) reasons.push('UNRESOLVED_LOCKFILE_DEPENDENCIES')
+    applyBunReachabilityFlags(externalNodes.values(), edgeMap.values())
+    return finalizeGraph({externalNodes, edgeMap, declarations, reasons, lockfile, lockfileVersion: extras.lockfileVersion})
+}

package/src/mcp/evidence/package-graph-common.mjs

@@ -0,0 +1,115 @@
+import {createHash} from 'node:crypto'
+import {CAPS, STATE, compareText, safeToken} from '../evidence-snapshot.common.mjs'
+
+export const MAX_LOCKFILE_BYTES = 64 * 1024 * 1024
+export const MAX_PACKAGE_RECORDS = 50_000
+export const MAX_DEPENDENCY_DECLARATIONS = 200_000
+export const PACKAGE_NAME = /^(?:@[a-z0-9._-]+\/)?[a-z0-9][a-z0-9._-]*$/i
+const PACKAGE_VERSION = /^[A-Za-z0-9][A-Za-z0-9._+~-]*$/
+
+export const packageVersion = (value) => {
+    const version = safeToken(value, 128)
+    return version && PACKAGE_VERSION.test(version) ? version : null
+}
+
+export const emptyDeclarations = () => ({total: 0, resolved: 0, unresolved: 0, local: 0, optionalMissing: 0})
+
+export function emptyGraph(state, reason, extras = {}) {
+    const emptyCount = () => ({total: 0, returned: 0, truncated: false})
+    return {
+        state,
+        ecosystem: 'npm',
+        root: '(root)',
+        ...extras,
+        completeness: {
+            nodes: emptyCount(),
+            edges: emptyCount(),
+            declarations: emptyDeclarations(),
+            reasons: reason ? [reason] : [],
+        },
+        nodes: [],
+        edges: [],
+    }
+}
+
+export function normalizeLockPath(value) {
+    if (typeof value !== 'string' || value.length > 4096 || /[\u0000-\u001f\u007f]/.test(value)) return null
+    const raw = value.replace(/\\/g, '/')
+    if (/^(?:[a-z][a-z0-9+.-]*:|\/)/i.test(raw)) return null
+    const normalized = raw.replace(/\/$/, '')
+    if (normalized === '') return ''
+    const parts = normalized.split('/')
+    return parts.every((part) => part && part !== '.' && part !== '..') ? normalized : null
+}
+
+export function packageNameFromPath(packagePath) {
+    const match = packagePath.match(/(?:^|\/)node_modules\/((?:@[^/]+\/)?[^/]+)$/)
+    const name = match?.[1]
+    return name && name.length <= 256 && PACKAGE_NAME.test(name) ? name : null
+}
+
+export function packageId(name, version, packagePath) {
+    const location = createHash('sha256').update(packagePath).digest('hex').slice(0, 12)
+    return `npm:${name}@${version}:${location}`
+}
+
+export function parentInstallPath(packagePath) {
+    const marker = packagePath.lastIndexOf('/node_modules/')
+    return marker >= 0 ? packagePath.slice(0, marker) : ''
+}
+
+export function dependencyDeclarations(record) {
+    const declarations = new Map()
+    const add = (values, kind, replace = false) => {
+        if (!values || typeof values !== 'object' || Array.isArray(values)) return
+        for (const name of Object.keys(values)) {
+            if (name.length > 256 || !PACKAGE_NAME.test(name)) continue
+            if (replace || !declarations.has(name)) declarations.set(name, kind)
+        }
+    }
+    add(record?.dependencies, 'runtime')
+    add(record?.devDependencies, 'dev')
+    add(record?.optionalDependencies, 'optional', true)
+    if (record?.peerDependencies && typeof record.peerDependencies === 'object' && !Array.isArray(record.peerDependencies)) {
+        for (const name of Object.keys(record.peerDependencies)) {
+            if (name.length > 256 || !PACKAGE_NAME.test(name) || declarations.has(name)) continue
+            const optional = record?.peerDependenciesMeta?.[name]?.optional === true
+            declarations.set(name, optional ? 'optional-peer' : 'peer')
+        }
+    }
+    return [...declarations].map(([name, kind]) => ({name, kind}))
+        .sort((a, b) => compareText(a.name, b.name) || compareText(a.kind, b.kind))
+}
+
+export function finalizeGraph({externalNodes, edgeMap, declarations, reasons, lockfile, lockfileVersion}) {
+    const allNodes = [...externalNodes.values()].sort((a, b) =>
+        Number(b.direct) - Number(a.direct) || compareText(a.name, b.name) ||
+        compareText(a.version, b.version) || compareText(a.id, b.id))
+    const nodes = allNodes.slice(0, CAPS.packageGraphNodes)
+    const nodeIds = new Set(nodes.map((node) => node.id))
+    const allEdges = [...edgeMap.values()].sort((a, b) =>
+        compareText(a.from, b.from) || compareText(a.to, b.to) || compareText(a.kind, b.kind))
+    const eligibleEdges = allEdges.filter((edge) =>
+        (edge.from === '(root)' || nodeIds.has(edge.from)) && nodeIds.has(edge.to))
+    const edges = eligibleEdges.slice(0, CAPS.packageGraphEdges)
+    const nodesTruncated = nodes.length < allNodes.length
+    const edgesTruncated = edges.length < allEdges.length
+    if (nodesTruncated) reasons.push('PACKAGE_NODE_LIMIT_REACHED')
+    if (edgesTruncated) reasons.push('PACKAGE_EDGE_LIMIT_REACHED')
+
+    return {
+        state: reasons.length ? STATE.PARTIAL : STATE.COMPLETE,
+        ecosystem: 'npm',
+        lockfile,
+        lockfileVersion,
+        root: '(root)',
+        completeness: {
+            nodes: {total: allNodes.length, returned: nodes.length, truncated: nodesTruncated},
+            edges: {total: allEdges.length, returned: edges.length, truncated: edgesTruncated},
+            declarations,
+            reasons: [...new Set(reasons)].sort(compareText),
+        },
+        nodes,
+        edges,
+    }
+}

package/src/mcp/evidence/package-lock-graph.mjs

@@ -0,0 +1,92 @@
+import {compareText, STATE} from '../evidence-snapshot.common.mjs'
+import {
+    MAX_DEPENDENCY_DECLARATIONS, MAX_PACKAGE_RECORDS, dependencyDeclarations,
+    emptyDeclarations, emptyGraph, finalizeGraph, normalizeLockPath, packageId,
+    packageNameFromPath, packageVersion, parentInstallPath,
+} from './package-graph-common.mjs'
+
+function resolveDependency(sourcePath, name, records, externalNodes) {
+    let cursor = sourcePath
+    const seen = new Set()
+    while (!seen.has(cursor)) {
+        seen.add(cursor)
+        const candidate = cursor ? `${cursor}/node_modules/${name}` : `node_modules/${name}`
+        const record = records.get(candidate)
+        if (record) {
+            if (record.link === true) return {kind: 'local'}
+            const node = externalNodes.get(candidate)
+            return node ? {kind: 'external', node} : {kind: 'unresolved'}
+        }
+        if (!cursor) break
+        cursor = parentInstallPath(cursor)
+    }
+    return {kind: 'unresolved'}
+}
+
+export function parsePackageLock(lock, lockfile) {
+    const lockfileVersion = Number(lock?.lockfileVersion || 0)
+    const extras = {lockfile, lockfileVersion: Number.isFinite(lockfileVersion) ? Math.trunc(lockfileVersion) : 0}
+    if (![2, 3].includes(lockfileVersion) || !lock?.packages || typeof lock.packages !== 'object' || Array.isArray(lock.packages)) {
+        return emptyGraph(STATE.PARTIAL, 'PACKAGE_LOCK_V2_V3_REQUIRED', extras)
+    }
+    const allKeys = Object.keys(lock.packages).sort(compareText)
+    const selectedKeys = allKeys.slice(0, MAX_PACKAGE_RECORDS)
+    const reasons = []
+    if (selectedKeys.length < allKeys.length) reasons.push('LOCKFILE_PACKAGE_RECORD_LIMIT_REACHED')
+    const records = new Map()
+    let invalidRecords = 0
+    for (const rawPath of selectedKeys) {
+        const packagePath = normalizeLockPath(rawPath)
+        const record = lock.packages[rawPath]
+        if (packagePath == null || !record || typeof record !== 'object' || Array.isArray(record) ||
+            ((packagePath.startsWith('node_modules/') || packagePath.includes('/node_modules/')) && !packageNameFromPath(packagePath)) || records.has(packagePath)) {
+            invalidRecords++
+            continue
+        }
+        records.set(packagePath, record)
+    }
+    if (invalidRecords > 0) reasons.push('INVALID_LOCKFILE_PACKAGE_RECORDS')
+    const externalNodes = new Map()
+    let invalidPackageVersions = 0
+    for (const [packagePath, record] of records) {
+        const name = packageNameFromPath(packagePath)
+        const version = packageVersion(record.version)
+        if (!name || record.link === true) continue
+        if (!version) { invalidPackageVersions++; continue }
+        externalNodes.set(packagePath, {
+            id: packageId(name, version, packagePath), name, version, direct: false,
+            dev: record.dev === true || record.devOptional === true,
+            optional: record.optional === true || record.devOptional === true,
+            peer: record.peer === true,
+        })
+    }
+    if (invalidPackageVersions > 0) reasons.push('INVALID_LOCKFILE_PACKAGE_VERSIONS')
+    const edgeMap = new Map()
+    const declarations = emptyDeclarations()
+    let declarationLimitReached = false
+    const sources = [...records].filter(([packagePath]) => packageNameFromPath(packagePath) == null || externalNodes.has(packagePath))
+        .sort(([a], [b]) => compareText(a, b))
+    outer: for (const [sourcePath, record] of sources) {
+        const sourceNode = externalNodes.get(sourcePath)
+        const sourceId = sourceNode?.id || '(root)'
+        for (const declaration of dependencyDeclarations(record)) {
+            if (declarations.total >= MAX_DEPENDENCY_DECLARATIONS) { declarationLimitReached = true; break outer }
+            declarations.total++
+            const resolved = resolveDependency(sourcePath, declaration.name, records, externalNodes)
+            if (resolved.kind === 'local') { declarations.local++; continue }
+            if (resolved.kind !== 'external') {
+                if (declaration.kind === 'optional' || declaration.kind === 'optional-peer') declarations.optionalMissing++
+                else declarations.unresolved++
+                continue
+            }
+            declarations.resolved++
+            if (sourceId === '(root)') resolved.node.direct = true
+            if (sourceId === resolved.node.id) continue
+            const edge = {from: sourceId, to: resolved.node.id, kind: declaration.kind}
+            edgeMap.set(`${edge.from}\0${edge.to}\0${edge.kind}`, edge)
+        }
+    }
+    if (declarationLimitReached) reasons.push('LOCKFILE_DEPENDENCY_DECLARATION_LIMIT_REACHED')
+    if (declarations.unresolved > 0) reasons.push('UNRESOLVED_LOCKFILE_DEPENDENCIES')
+    return finalizeGraph({externalNodes, edgeMap, declarations, reasons, lockfile, lockfileVersion})
+}