weavatrix 0.2.13 → 0.2.15

package/src/mcp/architecture-starter.mjs

@@ -0,0 +1,234 @@
+// Adaptive, source-free architecture starter. It proposes component territories and separately
+// reports observed dependency directions; observations never become enforceable policy implicitly.
+import {normalizeArchitectureContract} from '../analysis/architecture-contract.js'
+import {createPathClassifier, hasPathClass} from '../path-classification.js'
+
+export const PROVISIONAL_BUDGETS = Object.freeze({
+    runtimeCycles: 0,
+    maxFileLoc: 300,
+    maxFunctionLoc: 120,
+    maxCyclomatic: 15,
+    maxModuleFiles: 80,
+    minModuleCohesion: .5,
+    maxModuleBoundaryRatio: .65,
+})
+
+export const STARTER_BUDGETS = Object.freeze({
+    runtimeCycles: PROVISIONAL_BUDGETS.runtimeCycles,
+    maxFileLoc: PROVISIONAL_BUDGETS.maxFileLoc,
+})
+
+const BUDGET_PROPOSALS = Object.freeze(Object.entries(PROVISIONAL_BUDGETS)
+    .filter(([key]) => !(key in STARTER_BUDGETS))
+    .map(([key, value]) => ({
+        key, value, state: 'CANDIDATE_NOT_ENFORCED',
+        reason: 'Generic review threshold; adopt only after inspecting repository-specific evidence.',
+    })))
+
+const SOURCE_ROOTS = new Set(['src', 'app', 'lib', 'packages', 'services'])
+const CODE_EXTENSIONS = new Set([
+    '.cjs', '.cs', '.css', '.go', '.htm', '.html', '.java', '.js', '.jsx', '.less', '.mjs', '.py', '.pyi',
+    '.rs', '.scss', '.ts', '.tsx',
+])
+const CLASSIFIED = ['test', 'e2e', 'generated', 'mock', 'story', 'docs', 'benchmark', 'temp']
+const EDGE_RELATIONS = new Set(['imports', 're_exports', 'calls', 'references'])
+
+const slash = (value) => String(value || '').replace(/\\/g, '/').replace(/^\.\//, '')
+const extension = (file) => {
+    const name = slash(file).split('/').at(-1) || ''
+    const dot = name.lastIndexOf('.')
+    return dot >= 0 ? name.slice(dot).toLowerCase() : ''
+}
+const safeId = (value, fallback) => String(value || '').toLowerCase()
+    .replace(/[^a-z0-9._:-]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 100) || fallback
+
+function productFiles(graph, repoRoot) {
+    const classifier = createPathClassifier(repoRoot)
+    return [...new Set((graph?.nodes || [])
+        .filter((node) => !String(node.id).includes('#'))
+        .map((node) => slash(node.source_file || node.id))
+        .filter((file) => file && CODE_EXTENSIONS.has(extension(file))))]
+        .filter((file) => {
+            const explanation = classifier.explain(file)
+            return !explanation.excluded && !hasPathClass(explanation, ...CLASSIFIED)
+        })
+        .sort((a, b) => a.localeCompare(b))
+}
+
+function commonDirectoryPrefix(entries) {
+    if (!entries.length) return []
+    const first = entries[0].directories
+    let length = first.length
+    for (const entry of entries.slice(1)) {
+        let index = 0
+        while (index < length && index < entry.directories.length && first[index] === entry.directories[index]) index++
+        length = index
+    }
+    // Keep at least one package segment available as an actual component territory.
+    const shortest = Math.min(...entries.map((entry) => entry.directories.length))
+    return first.slice(0, Math.min(length, Math.max(0, shortest - 1)))
+}
+
+function javaTerritories(files) {
+    const byRoot = new Map()
+    for (const file of files) {
+        const match = /^(.*?)(?:\/)?src\/main\/java\/(.+\.java)$/i.exec(file)
+        if (!match) continue
+        const root = `${match[1] ? `${match[1]}/` : ''}src/main/java`
+        const tail = match[2].split('/')
+        const entry = {file, root, directories: tail.slice(0, -1)}
+        const entries = byRoot.get(root) || []
+        entries.push(entry)
+        byRoot.set(root, entries)
+    }
+    const paths = new Map()
+    for (const [root, entries] of byRoot) {
+        const common = commonDirectoryPrefix(entries)
+        for (const entry of entries) {
+            const next = entry.directories[common.length]
+            const path = next ? `${root}/${[...common, next].join('/')}` : entry.file
+            paths.set(entry.file, {key: path, name: path, path})
+        }
+    }
+    let refined = true
+    while (refined) {
+        refined = false
+        const groups = new Map()
+        for (const [file, territory] of paths) {
+            const entries = groups.get(territory.key) || []
+            entries.push({file, territory})
+            groups.set(territory.key, entries)
+        }
+        for (const entries of groups.values()) {
+            if (entries.length <= PROVISIONAL_BUDGETS.maxModuleFiles) continue
+            const base = entries[0].territory.path
+            if (!entries.every((entry) => entry.territory.path === base)) continue
+            const nested = entries.map((entry) => ({...entry, rest: entry.file.slice(base.length + 1).split('/')}))
+            const childDirectories = new Set(nested.filter((entry) => entry.rest.length > 1).map((entry) => entry.rest[0]))
+            if (childDirectories.size < 2) continue
+            for (const entry of nested) {
+                if (entry.rest.length > 1) {
+                    const path = `${base}/${entry.rest[0]}`
+                    paths.set(entry.file, {key: path, name: path, path})
+                } else {
+                    paths.set(entry.file, {key: `${base}::root`, name: `${base} (root files)`, path: entry.file})
+                }
+            }
+            refined = true
+        }
+    }
+    return paths
+}
+
+function nestedSourceTerritory(file) {
+    const match = /^(.*?)\/src\/(.+)$/.exec(file)
+    if (!match || !match[1]) return null
+    const tail = match[2].split('/')
+    // Java's src/main/java package tree is handled with a package-aware common prefix above.
+    if (tail[0] === 'main' && tail[1] === 'java') return null
+    return tail.length > 1 ? `${match[1]}/src/${tail[0]}` : file
+}
+
+function genericTerritory(file) {
+    const parts = file.split('/').filter(Boolean)
+    if (parts.length === 1) return {key: 'root-code', name: 'root code', path: file}
+    if (SOURCE_ROOTS.has(parts[0]) && parts.length === 2) {
+        return {key: `${parts[0]}-root`, name: `${parts[0]} (root files)`, path: file}
+    }
+    const path = parts.slice(0, SOURCE_ROOTS.has(parts[0]) ? 2 : 1).join('/')
+    return {key: path, name: path, path}
+}
+
+function componentsFor(graph, repoRoot) {
+    const files = productFiles(graph, repoRoot)
+    const java = javaTerritories(files)
+    const groups = new Map()
+    for (const file of files) {
+        const adaptive = java.get(file) || nestedSourceTerritory(file)
+        const territory = adaptive
+            ? typeof adaptive === 'string' ? {key: adaptive, name: adaptive, path: adaptive} : adaptive
+            : genericTerritory(file)
+        const group = groups.get(territory.key) || {name: territory.name, paths: new Set(), files: 0}
+        group.paths.add(territory.path)
+        group.files++
+        groups.set(territory.key, group)
+    }
+    return [...groups]
+        .sort((a, b) => b[1].files - a[1].files || a[0].localeCompare(b[0]))
+        .slice(0, 200)
+        .map(([key, group], index) => ({
+            id: safeId(key, `component-${index + 1}`),
+            name: group.name,
+            paths: [...group.paths].sort((a, b) => a.localeCompare(b)),
+        }))
+}
+
+function componentFor(file, components) {
+    const normalized = slash(file)
+    let best = null
+    for (const component of components) for (const prefix of component.paths) {
+        if (normalized !== prefix && !normalized.startsWith(`${prefix}/`)) continue
+        if (!best || prefix.length > best.prefix.length) best = {id: component.id, prefix}
+    }
+    return best?.id || null
+}
+
+const endpoint = (value) => value && typeof value === 'object' ? String(value.id) : String(value || '')
+function fileOf(id, byId) {
+    const node = byId.get(id)
+    return slash(node?.source_file || id.split('#')[0])
+}
+function edgeKind(link) {
+    return link.typeOnly === true ? 'type-only' : link.compileOnly === true ? 'compile-only' : 'runtime'
+}
+
+function observedDirections(graph, components) {
+    const byId = new Map((graph?.nodes || []).map((node) => [String(node.id), node]))
+    const pairs = new Set(), directions = new Map()
+    for (const link of graph?.links || []) {
+        if (!EDGE_RELATIONS.has(link.relation) || link.barrelProxy === true) continue
+        const fromFile = fileOf(endpoint(link.source), byId), toFile = fileOf(endpoint(link.target), byId)
+        const from = componentFor(fromFile, components), to = componentFor(toFile, components)
+        if (!from || !to || from === to) continue
+        const kind = edgeKind(link), pair = `${fromFile}\0${toFile}\0${kind}`
+        if (pairs.has(pair)) continue
+        pairs.add(pair)
+        const key = `${from}\0${to}\0${kind}`
+        const item = directions.get(key) || {from, to, kind, count: 0, samples: []}
+        item.count++
+        if (item.samples.length < 3) item.samples.push(`${fromFile} -> ${toFile}`)
+        directions.set(key, item)
+    }
+    return [...directions.values()]
+        .sort((a, b) => b.count - a.count || a.from.localeCompare(b.from) || a.to.localeCompare(b.to))
+        .slice(0, 100)
+        .map((item, index) => ({
+            ...item,
+            state: 'OBSERVED_NOT_ENFORCED',
+            suggestedRule: {
+                id: safeId(`observed-${item.from}-to-${item.to}-${item.kind}`, `observed-${index + 1}`),
+                action: 'allow', kinds: [item.kind], from: [item.from], to: [item.to],
+                reason: `Observed in ${item.count} unique file dependency pair(s); review before adopting as policy.`,
+            },
+        }))
+}
+
+export function proposeObservedDependencyDirections(graph, components) {
+    return observedDirections(graph, components)
+}
+
+export function createArchitectureStarter(graph, repoRoot) {
+    const components = componentsFor(graph, repoRoot)
+    const contract = normalizeArchitectureContract({
+        name: 'Proposed no-regressions baseline', style: 'custom', enforcement: 'ratchet', components,
+        dependencyRules: [], budgets: STARTER_BUDGETS,
+        technologies: {required: [], forbidden: []}, exceptions: [],
+        ratchet: {baseline: {fingerprints: [], metrics: {}}},
+    })
+    return {
+        contract,
+        observedDependencyProposals: proposeObservedDependencyDirections(graph, contract.components),
+        budgetProposals: BUDGET_PROPOSALS,
+        methodology: 'adaptive product territories; only universal runtime-cycle/file-size guards are active; observed directions and generic quality thresholds are review-only',
+    }
+}

package/src/mcp/catalog.mjs

@@ -26,14 +26,28 @@ const PROFILE_CAPS = Object.freeze({
 
 // The files whose mtime the stdio shell watches for hot reload — keep in sync with the imports in
 // loadHotApi below (catalog.mjs itself is last: a change here re-derives the whole table).
-export const HOT_FILES = ['tools-graph.mjs', 'tools-impact.mjs', 'tools-health.mjs', 'tools-source.mjs', 'tools-context.mjs', 'tools-endpoints.mjs', 'tools-actions.mjs', 'tools-architecture.mjs', 'tools-history.mjs', 'tools-company.mjs', 'tools-verified-change.mjs', 'catalog.mjs']
+const HOT_FACADES = [
+    'tools-graph.mjs', 'tools-impact.mjs', 'tools-health.mjs', 'tools-source.mjs',
+    'tools-context.mjs', 'tools-endpoints.mjs', 'tools-actions.mjs',
+    'tools-architecture.mjs', 'tools-history.mjs', 'tools-company.mjs',
+    'tools-verified-change.mjs',
+]
+const HOT_OWNERS = [
+    'graph/tools-core.mjs', 'graph/tools-query.mjs', 'tools-graph-hubs.mjs',
+    'health/duplicates.mjs', 'health/dead-code.mjs', 'health/audit-format.mjs',
+    'health/audit.mjs', 'health/structure.mjs', 'health/endpoints.mjs',
+    'actions/graph-lifecycle.mjs', 'actions/advisories.mjs',
+    'actions/hosted-architecture.mjs', 'actions/graph-sync.mjs',
+    'architecture-starter.mjs', 'architecture-bootstrap.mjs',
+]
+export const HOT_FILES = [...HOT_FACADES, ...HOT_OWNERS, 'catalog.mjs']
 
 function buildTools({tg, ti, th, ts, tb, te, ta, tar, thi, tc, tv, caps}) {
     const tools = [
         {cap: 'graph', name: 'graph_stats', description: 'Return summary statistics: node count, edge count, communities, versioned edge-provenance/legacy-confidence breakdowns, and graph build time vs repo HEAD (staleness).', inputSchema: {type: 'object', properties: {}}, run: (g, a, ctx) => tg.tGraphStats(g, ctx)},
         {cap: 'graph', name: 'get_node', description: 'Get full details for a specific node by label or ID.', inputSchema: {type: 'object', properties: {label: {type: 'string', description: 'Node label or ID to look up'}}, required: ['label']}, run: (g, a, ctx) => tg.tGetNode(g, a, ctx)},
         {cap: 'graph', name: 'get_neighbors', description: 'Get all direct neighbors of a node with edge details (1 hop, call sites deduped). For transitive impact use get_dependents; for the impact of your current branch changes use change_impact.', inputSchema: {type: 'object', properties: {label: {type: 'string'}, relation_filter: {type: 'string', description: 'Optional: filter by relation type'}}, required: ['label']}, run: (g, a, ctx) => tg.tGetNeighbors(g, a, ctx)},
-        {cap: 'graph', name: 'query_graph', description: 'Explore a focused production-first graph around a concept (BFS/DFS). Exact seed files stay pinned; a code-shaped identifier uses only exact same-name declarations. Classified paths and unreferenced constant/field leaves are suppressed unless the question or explicit flags request them. Reports policy and suppression instead of silently flooding the result.', inputSchema: {type: 'object', properties: {question: {type: 'string', description: 'Natural language question or keyword search'}, mode: {type: 'string', enum: ['bfs', 'dfs'], default: 'bfs'}, depth: {type: 'integer', default: 3}, context_filter: {type: 'array', items: {type: 'string'}}, seed_files: {type: 'array', items: {type: 'string'}, maxItems: 12, description: 'Optional exact repo-relative file paths. When resolved, these are the only seeds unless augment_seeds is true'}, augment_seeds: {type: 'boolean', default: false, description: 'With seed_files, also add fuzzy question-derived seeds; false keeps traversal strictly pinned'}, include_classified: {type: 'boolean', default: false, description: 'Allow traversal through tests/e2e/generated/mocks/stories/docs/benchmarks/temp and explicitly excluded paths. An explicit class term in the question enables only that class.'}, include_low_signal: {type: 'boolean', default: false, description: 'Include unreferenced constant/field leaf symbols that do not match a query term'}, token_budget: {type: 'integer', description: 'Higher budget shows more nodes/edges', default: 2000}}, required: ['question']}, run: (g, a, ctx) => tg.tQueryGraph(g, a, ctx)},
+        {cap: 'graph', name: 'query_graph', description: 'Explore a focused production-first graph around a concept or exact symbols (BFS/DFS). Exact seed files/symbols stay pinned; relation_filter and flow_direction support bounded event/data-flow views without a separate tool. Classified paths and unreferenced constant/field leaves stay suppressed unless explicitly requested.', inputSchema: {type: 'object', properties: {question: {type: 'string', description: 'Optional natural-language question or keyword search when exact seeds are not sufficient'}, mode: {type: 'string', enum: ['bfs', 'dfs'], default: 'bfs'}, depth: {type: 'integer', default: 3}, context_filter: {type: 'array', items: {type: 'string'}}, seed_files: {type: 'array', items: {type: 'string'}, maxItems: 12, description: 'Exact repo-relative file paths. Resolved exact seeds remain pinned unless augment_seeds is true'}, seed_symbols: {type: 'array', items: {type: 'string'}, maxItems: 12, description: 'Exact node IDs or unambiguous symbol labels; enables focused flows without fuzzy query seeds'}, relation_filter: {oneOf: [{type: 'array', items: {type: 'string'}}, {type: 'string'}], description: 'Optional relation allow-list, e.g. calls,references,imports'}, flow_direction: {type: 'string', enum: ['forward', 'backward', 'both'], default: 'both', description: 'Traverse outgoing, incoming, or both directions'}, augment_seeds: {type: 'boolean', default: false, description: 'With exact seeds, also add fuzzy question-derived seeds; false keeps traversal strictly pinned'}, include_classified: {type: 'boolean', default: false, description: 'Allow traversal through tests/e2e/generated/mocks/stories/docs/benchmarks/temp and explicitly excluded paths. An explicit class term in the question enables only that class.'}, include_low_signal: {type: 'boolean', default: false, description: 'Include unreferenced constant/field leaf symbols that do not match a query term'}, token_budget: {type: 'integer', description: 'Higher budget shows more nodes/edges', default: 2000}}, anyOf: [{required: ['question']}, {required: ['seed_files']}, {required: ['seed_symbols']}]}, run: (g, a, ctx) => tg.tQueryGraph(g, a, ctx)},
         {cap: 'graph', name: 'god_nodes', description: 'Rank production-code connectivity hubs by unique call/import/reference neighbors, with class/method ownership reported separately from runtime connectivity. Repeated call sites do not inflate the rank; classified tests, generated/build output and other non-product paths are excluded by default.', inputSchema: {type: 'object', properties: {top_n: {type: 'integer', default: 10}, include_classified: {type: 'boolean', default: false, description: 'Include tests/e2e/generated/build output/mocks/stories/docs/benchmarks/temp and paths explicitly excluded by repository classification'}}}, run: (g, a, ctx) => tg.tGodNodes(g, a, ctx)},
         {cap: 'graph', name: 'shortest_path', description: 'Find the shortest path between two concepts in the knowledge graph.', inputSchema: {type: 'object', properties: {source: {type: 'string'}, target: {type: 'string'}, max_hops: {type: 'integer', default: 8}}, required: ['source', 'target']}, run: (g, a) => tg.tShortestPath(g, a)},
         {cap: 'graph', name: 'get_dependents', description: 'Transitive blast-radius of ONE node: everything that calls/imports/inherits it, directly or through intermediaries (reverse edges, ranked by proximity then connectivity). Symbol queries stay symbol-precise by default; set include_container_importers only for a conservative module-wide radius. Use before refactoring; get_neighbors shows only 1 hop, change_impact covers your whole current diff at once.', inputSchema: {type: 'object', properties: {label: {type: 'string', description: 'Node label or ID'}, depth: {type: 'integer', description: 'Max reverse hops, default 3', default: 3}, max_nodes: {type: 'integer', description: 'Max dependents to list, default 40', default: 40}, include_container_importers: {type: 'boolean', description: 'Also seed importers of the symbol containing file (broader, conservative; default false)', default: false}}, required: ['label']}, run: (g, a) => ti.tGetDependents(g, a)},
@@ -105,19 +119,19 @@ function buildTools({tg, ti, th, ts, tb, te, ta, tar, thi, tc, tv, caps}) {
         {cap: 'search', name: 'search_code', description: 'Full-text or regex search across the repo source (ripgrep-backed, Node fallback). The graph only stores structure — use this to find literal text/patterns, then get_node/get_neighbors for structure.', inputSchema: {type: 'object', properties: {query: {type: 'string', description: 'text or regex to search for'}, is_regex: {type: 'boolean', default: false}, glob: {type: 'string', description: 'optional path glob, e.g. "*.js" or "src/**"'}, max_results: {type: 'integer', default: 40}}, required: ['query']}, run: (g, a, ctx) => searchCode({repoRoot: ctx.repoRoot, resolveRg}, a)},
           {cap: 'source', name: 'read_source', description: "Read the actual source of a node (by label/ID) or a repo-relative file path — the symbol's lines with context. The graph stores only locations, not source text. For a path read, pass start_line to anchor the window anywhere in the file (otherwise it shows the head).", inputSchema: {type: 'object', properties: {label: {type: 'string', description: 'node label or ID'}, path: {type: 'string', description: 'or a repo-relative file path'}, start_line: {type: 'integer', description: 'anchor line: window = start_line-before .. start_line+after'}, before: {type: 'integer', default: 3}, after: {type: 'integer', default: 40}}}, run: (g, a, ctx) => readSource({repoRoot: ctx.repoRoot, resolveNode, isSymbol}, g, a)},
           {cap: 'source', refreshGraph: true, name: 'inspect_symbol', description: 'Inspect one exact symbol with an on-demand TypeScript/JavaScript LSP reference query, grouped occurrence containers, graph blast radius, complexity facts and bounded local source context. Ambiguous labels fail closed; point queries never replace the broad precision overlay.', inputSchema: {type: 'object', properties: {label: {type: 'string', description: 'Exact node ID or unambiguous symbol label'}, precision: {type: 'string', enum: ['auto', 'graph', 'lsp'], default: 'auto'}, max_references: {type: 'integer', minimum: 1, maximum: 5000, default: 1000}, max_containers: {type: 'integer', minimum: 1, maximum: 50, default: 15}, context_lines: {type: 'integer', minimum: 0, maximum: 40, default: 8}, timeout_ms: {type: 'integer', minimum: 1000, maximum: 60000, default: 30000}}, required: ['label']}, run: (g, a, ctx) => ts.tInspectSymbol(g, a, ctx)},
-          {cap: 'source', refreshGraph: true, name: 'context_bundle', description: 'Return one compact, bounded source bundle for an exact symbol: definition, aggregated inbound/outbound containers, exact re-export sites, on-demand TS/JS reference evidence and a few focused source excerpts. Use before an edit when query_graph would be too broad.', inputSchema: {type: 'object', properties: {label: {type: 'string', description: 'Exact node ID or unambiguous symbol label'}, precision: {type: 'string', enum: ['auto', 'graph', 'lsp'], default: 'auto'}, max_references: {type: 'integer', minimum: 1, maximum: 5000, default: 1000}, max_related: {type: 'integer', minimum: 1, maximum: 30, default: 10}, max_reexports: {type: 'integer', minimum: 1, maximum: 100, default: 20}, max_source_files: {type: 'integer', minimum: 1, maximum: 8, default: 4}, context_lines: {type: 'integer', minimum: 0, maximum: 12, default: 4}, timeout_ms: {type: 'integer', minimum: 1000, maximum: 60000, default: 30000}}, required: ['label']}, run: (g, a, ctx) => tb.tContextBundle(g, a, ctx, ts.tInspectSymbol)},
+          {cap: 'source', refreshGraph: true, name: 'context_bundle', description: 'Return one compact, bounded source bundle for an exact symbol: definition, production-first inbound/outbound containers, exact re-export sites, on-demand TS/JS reference evidence and diverse excerpts around call sites. Use before an edit when query_graph would be too broad.', inputSchema: {type: 'object', properties: {label: {type: 'string', description: 'Exact node ID or unambiguous symbol label'}, precision: {type: 'string', enum: ['auto', 'graph', 'lsp'], default: 'auto'}, max_references: {type: 'integer', minimum: 1, maximum: 5000, default: 1000}, max_related: {type: 'integer', minimum: 1, maximum: 30, default: 10}, max_reexports: {type: 'integer', minimum: 1, maximum: 100, default: 20}, max_source_files: {type: 'integer', minimum: 1, maximum: 8, default: 4}, context_lines: {type: 'integer', minimum: 0, maximum: 12, default: 4}, include_classified: {type: 'boolean', default: false, description: 'Include test/e2e/generated/mock/story/docs/benchmark/temp callers after production callers'}, timeout_ms: {type: 'integer', minimum: 1000, maximum: 60000, default: 30000}}, required: ['label']}, run: (g, a, ctx) => tb.tContextBundle(g, a, ctx, ts.tInspectSymbol)},
         {cap: 'health', name: 'find_duplicates', description: "Content-based clone detection over production code (MOSS winnowing over method bodies). Supports high-confidence small clones down to 12 tokens when min_tokens is lowered. Tests, classified non-product paths, and all-router framework boilerplate clone groups are excluded by default; opt them in explicitly.", inputSchema: {type: 'object', properties: {min_similarity: {type: 'integer', description: '50-100, default 80 (ignored in semantic mode)'}, min_tokens: {type: 'integer', minimum: 12, maximum: 400, description: 'min fragment size, 12-400; default 50'}, mode: {type: 'string', enum: ['renamed', 'strict', 'semantic'], default: 'renamed'}, include_tests: {type: 'boolean', default: false}, include_classified: {type: 'boolean', default: false, description: 'Include generated/mock/story/docs/benchmark/temp and paths explicitly classified as excluded; tests still require include_tests'}, include_boilerplate: {type: 'boolean', default: false, description: 'Include clone groups made entirely of conventional *.router.js/ts router symbols'}, include_strings: {type: 'boolean', description: 'Also clone-check large multi-line string literals', default: false}, top_n: {type: 'integer', default: 15}}}, run: (g, a, ctx) => th.tFindDuplicates(g, a, ctx)},
         {cap: 'health', name: 'find_dead_code', description: 'Conservative review queue for statically unreferenced files, functions, methods and symbols. Returns confidence, reason, bounded evidence and explicit framework/dynamic/reflection/public-API caveats; never an auto-delete verdict. Tests, generated code, mocks, stories, docs, benchmarks and temporary roots are excluded by default.', inputSchema: {type: 'object', properties: {path: {type: 'string', maxLength: 1024, description: 'Optional repo-relative path prefix'}, kinds: {type: 'array', items: {type: 'string', enum: ['file', 'function', 'method', 'symbol']}, maxItems: 4, uniqueItems: true, description: 'Optional candidate kinds; defaults to all'}, min_confidence: {type: 'string', enum: ['high', 'medium', 'low'], default: 'medium', description: 'Minimum confidence to include. low explicitly includes public/framework/dynamic review candidates'}, include_tests: {type: 'boolean', default: false}, include_classified: {type: 'boolean', default: false, description: 'Include generated/mock/story/docs/benchmark/temp and paths explicitly classified as excluded; tests still require include_tests'}, top_n: {type: 'integer', minimum: 1, maximum: 100, default: 30}}}, run: (g, a, ctx) => th.tFindDeadCode(g, a, ctx)},
-        {cap: 'health', name: 'run_audit', description: 'Core production-first repository Health review: structure, dependency declarations, unused surfaces and explicitly bounded supply-chain evidence. Findings whose evidence is entirely test/e2e/generated/mock/story/docs/benchmark/temp or explicitly excluded are suppressed by default; opt them in with include_classified. category=dependencies is a dedicated dependency-health projection across missing, unused and duplicate declarations while preserving each finding\'s native category. With base_ref, builds and audits an immutable Git checkout and compares stable deterministic finding IDs; debt defaults to genuinely new findings. Supply-chain checks remain explicitly uncomparable across the source-only baseline. changed_files without base_ref is only changed-scope, never a new-debt claim.', inputSchema: {type: 'object', properties: {category: {type: 'string', enum: ['dependencies', 'unused', 'structure', 'vulnerability', 'malware'], description: 'Only findings of this category; dependencies selects dependency manifest/import findings across native categories'}, min_severity: {type: 'string', enum: ['critical', 'high', 'medium', 'low', 'info'], description: 'Minimum severity to include'}, max_findings: {type: 'integer', description: 'Max findings to list, default 30'}, include_classified: {type: 'boolean', default: false, description: 'Include findings whose evidence is entirely tests/e2e/generated/mocks/stories/docs/benchmarks/temp or explicitly excluded'}, include_malware_scan: {type: 'boolean', description: 'Also grep installed packages for malware heuristics (slow)', default: false}, base_ref: {type: 'string', maxLength: 200, description: 'Optional immutable Git baseline (for example HEAD~1 or origin/main). Enables honest new/existing/fixed debt comparison'}, changed_files: {type: 'array', items: {type: 'string'}, minItems: 1, maxItems: 500, description: 'Optional explicit repo-relative scope. Without base_ref this is changed-scope only; when omitted with base_ref, files are derived from the Git diff'}, debt: {type: 'string', enum: ['new', 'existing', 'all'], default: 'new', description: 'Baseline comparison view. Defaults to genuinely new deterministic findings when base_ref is present'}}}, run: (g, a, ctx) => th.tRunAudit(g, a, ctx)},
+        {cap: 'health', name: 'run_audit', description: 'Core production-first repository Health review with an explicit capability/completeness matrix for structure, dependencies, bounded runtime-correctness/concurrency patterns, advisories, malware and coverage. Unsupported Maven/Gradle import verification is NOT_SUPPORTED/PARTIAL, never a clean zero. Findings whose evidence is entirely test/e2e/generated/mock/story/docs/benchmark/temp or explicitly excluded are suppressed by default; opt them in with include_classified. category=dependencies is a dedicated dependency-health projection across missing, unused and duplicate declarations while preserving each finding\'s native category. With base_ref, builds and audits an immutable Git checkout and compares stable deterministic finding IDs; debt defaults to genuinely new findings. Supply-chain checks remain explicitly uncomparable across the source-only baseline. changed_files without base_ref is only changed-scope, never a new-debt claim.', inputSchema: {type: 'object', properties: {category: {type: 'string', enum: ['dependencies', 'unused', 'structure', 'vulnerability', 'malware'], description: 'Only findings of this category; dependencies selects dependency manifest/import findings across native categories'}, min_severity: {type: 'string', enum: ['critical', 'high', 'medium', 'low', 'info'], description: 'Minimum severity to include'}, max_findings: {type: 'integer', description: 'Max findings to list, default 30'}, include_classified: {type: 'boolean', default: false, description: 'Include findings whose evidence is entirely tests/e2e/generated/mocks/stories/docs/benchmarks/temp or explicitly excluded'}, include_malware_scan: {type: 'boolean', description: 'Also grep installed packages for malware heuristics (slow)', default: false}, base_ref: {type: 'string', maxLength: 200, description: 'Optional immutable Git baseline (for example HEAD~1 or origin/main). Enables honest new/existing/fixed debt comparison'}, changed_files: {type: 'array', items: {type: 'string'}, minItems: 1, maxItems: 500, description: 'Optional explicit repo-relative scope. Without base_ref this is changed-scope only; when omitted with base_ref, files are derived from the Git diff'}, debt: {type: 'string', enum: ['new', 'existing', 'all'], default: 'new', description: 'Baseline comparison view. Defaults to genuinely new deterministic findings when base_ref is present'}}}, run: (g, a, ctx) => th.tRunAudit(g, a, ctx)},
         {cap: 'health', name: 'coverage_map', description: 'Map a real existing coverage report onto the graph. If no report exists, return clearly labelled static test reachability (a test imports/reaches a source file) with actualCoverage=NOT_AVAILABLE; reachability is never presented as measured coverage.', inputSchema: {type: 'object', properties: {top_n: {type: 'integer', description: 'Max risk hotspots to list, default 15'}, path: {type: 'string', description: 'Optional repo-relative path prefix filter, e.g. src/query'}}}, run: (g, a, ctx) => th.tCoverageMap(g, a, ctx)},
         {cap: 'health', name: 'hot_path_review', description: 'Rank a focused production-symbol hot-path queue from parser-derived local complexity, inside-loop allocations/copies/scans/sorts/recursion, graph fan-in/fan-out, and measured coverage or clearly labelled static test reachability. The default score gate is 85 with a narrow strong-local fallback; set min_score=0 for the full diagnostic queue. This is not profiler data or interprocedural Big-O.', inputSchema: {type: 'object', properties: {path: {type: 'string', maxLength: 1024, description: 'Optional repository-relative path prefix'}, top_n: {type: 'integer', minimum: 1, maximum: 100, default: 20}, min_score: {type: 'integer', minimum: 0, maximum: 100, default: 85, description: 'Focused default is 85; lower explicitly to broaden, or use 0 for every threshold-matching diagnostic candidate'}, cyclomatic_threshold: {type: 'integer', minimum: 2, maximum: 1000, default: 8}, call_threshold: {type: 'integer', minimum: 1, maximum: 10000, default: 12}, loop_depth_threshold: {type: 'integer', minimum: 1, maximum: 10, default: 2}, time_rank_threshold: {type: 'integer', minimum: 0, maximum: 5, default: 2}, include_tests: {type: 'boolean', default: false}, include_classified: {type: 'boolean', default: false, description: 'Include generated/mock/story/docs/benchmark/temp and explicitly excluded paths; tests still require include_tests'}}}, run: (g, a, ctx) => th.tHotPathReview(g, a, ctx)},
         {cap: 'graph', name: 'list_communities', description: 'List graph communities named by their dominant folder (largest first) with sample files — a readable module overview; feed the list position into get_community.', inputSchema: {type: 'object', properties: {top_n: {type: 'integer', description: 'Max communities to list, default 20'}}}, run: (g, a, ctx) => th.tListCommunities(g, a, ctx)},
         {cap: 'graph', name: 'module_map', description: 'First orientation view for understanding an unfamiliar application with little context: a production-first folder architecture map with file/symbol counts and strongest module dependencies, separating runtime, TypeScript type-only and language compile-only coupling.', inputSchema: {type: 'object', properties: {top_n: {type: 'integer', description: 'Max modules to list, default 25'}, include_non_product: {type: 'boolean', default: false, description: 'Include tests, fixtures, benchmarks, generated output, docs and other classified non-product files; false by default'}}}, run: (g, a, ctx) => th.tModuleMap(g, a, ctx)},
-        {cap: 'source', refreshGraph: true, name: 'list_endpoints', description: 'Inventory of HTTP endpoints defined in the repo (Express/Fastify/Nest/Flask/FastAPI/Go mux/Rust axum and actix-web/Spring MVC and WebFlux): declared and reachable composed paths, static mount provenance, confidence, handler, and file:line.', inputSchema: {type: 'object', properties: {method: {type: 'string', enum: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS', 'TRACE', 'CONNECT', 'ALL', 'ANY']}, path: {type: 'string', maxLength: 2048, description: 'Optional exact composed path or segment-aligned suffix'}, max_results: {type: 'integer', description: 'Max endpoints to list, default 100'}}}, run: (g, a, ctx) => th.tListEndpoints(g, a, ctx)},
+        {cap: 'source', refreshGraph: true, name: 'list_endpoints', description: 'Inventory of HTTP endpoints defined in the repo (Express/Fastify/Nest/Flask/FastAPI/Go mux/Rust axum and actix-web/Spring MVC and WebFlux): declared and reachable composed paths, static mount provenance, confidence, handler, file:line, and Spring conditional/default-active state.', inputSchema: {type: 'object', properties: {method: {type: 'string', enum: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS', 'TRACE', 'CONNECT', 'ALL', 'ANY']}, path: {type: 'string', maxLength: 2048, description: 'Optional exact composed path or segment-aligned suffix'}, max_results: {type: 'integer', description: 'Max endpoints to list, default 100'}}}, run: (g, a, ctx) => th.tListEndpoints(g, a, ctx)},
         {cap: 'source', refreshGraph: true, name: 'trace_endpoint', description: 'Resolve one exact reachable HTTP endpoint, prove its router mount chain, bind its handler symbol, and return a bounded production-only multi-hop call graph with call-site excerpts. This is a focused projection of the repository graph, not text-search inference.', inputSchema: {type: 'object', properties: {path: {type: 'string', minLength: 1, maxLength: 2048, description: 'Exact composed path; a suffix is accepted only when unambiguous'}, method: {type: 'string', enum: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS', 'TRACE', 'CONNECT', 'ALL', 'ANY']}, max_depth: {type: 'integer', minimum: 1, maximum: 4, default: 3}, max_nodes: {type: 'integer', minimum: 2, maximum: 40, default: 20}, max_excerpts: {type: 'integer', minimum: 0, maximum: 12, default: 6}, context_lines: {type: 'integer', minimum: 0, maximum: 6, default: 2}, include_classified: {type: 'boolean', default: false, description: 'Include test/e2e/generated/mock/story/docs/benchmark/temp and explicitly excluded targets'}}, required: ['path']}, run: (g, a, ctx) => te.tTraceEndpoint(g, a, ctx)},
         {cap: 'build', name: 'rebuild_graph', description: "Rebuild the active full-repository graph and report a structural delta. Omitted mode/precision preserve the active graph; a first build uses full and the startup precision setting (lsp unless WEAVATRIX_PRECISION=off). The local TypeScript/JavaScript LSP overlay validates bounded ambiguous edges; precision:off is an explicit fallback. With scope, build an isolated diagnostic graph without replacing or diffing the full graph.", inputSchema: {type: 'object', properties: {mode: {type: 'string', enum: ['full', 'no-tests', 'tests-only'], description: 'Build mode; omit to preserve the active mode (or use full for a first build)'}, precision: {type: 'string', enum: ['lsp', 'off'], description: 'Semantic precision; omit to preserve the active mode (or use the startup setting for a first build)'}, scope: {type: 'string', description: 'Optional isolated diagnostic path prefix; never replaces the active full graph'}}}, run: (g, a, ctx) => ta.tRebuildGraph(g, a, ctx)},
         {cap: 'graph', name: 'graph_diff', description: 'Structural graph diff: compare the current graph with an immutable Git-ref baseline (base_ref such as HEAD~1 or main), or with graph.prev.json from the last rebuild when base_ref is omitted. Reports architecture drift, cycle changes and symbols that lost their last caller.', inputSchema: {type: 'object', properties: {base_ref: {type: 'string', maxLength: 256, description: 'Optional immutable Git baseline to build in isolation, e.g. HEAD~1, main or origin/main; never checks out or mutates the working tree'}, path: {type: 'string', description: 'Optional node-id/path prefix to scope the diff, e.g. src/query'}}}, run: (g, a, ctx) => ti.tGraphDiff(g, a, ctx)},
-        {cap: 'graph', name: 'get_architecture_contract', description: 'Start the intended-architecture workflow: return the executable owner-approved target, quality budgets and ratchet mode that an agent must follow before editing. When absent, returns a starter proposal rather than silently inventing policy.', inputSchema: {type: 'object', properties: {}}, run: (g, a, ctx) => tar.tGetArchitectureContract(g, a, ctx)},
+        {cap: 'graph', name: 'get_architecture_contract', description: 'Read the owner-approved architecture target or safely bootstrap one. With action=preview, returns an adaptive candidate, observed-but-not-enforced dependency directions, verification, exact file content/hash and a short-lived confirmation token. action=approve creates the local contract only after explicit token confirmation and never overwrites an active target.', inputSchema: {type: 'object', properties: {action: {type: 'string', enum: ['preview', 'approve'], description: 'Omit to read; preview is dry-run only; approve requires the preview token'}, candidate_contract: {type: 'object', description: 'Optional reviewed candidate to normalize and verify during preview'}, baseline_mode: {type: 'string', enum: ['none', 'accept-current'], default: 'none', description: 'Whether preview should materialize current violations as an explicit ratchet baseline'}, confirm_token: {type: 'string', description: 'One-time token returned by preview; required for approve'}}}, run: (g, a, ctx) => tar.tGetArchitectureContract(g, a, ctx)},
         {cap: 'graph', name: 'prepare_change', description: 'Select active target-architecture rules for an intended set of changed files. Run before a non-trivial edit.', inputSchema: {type: 'object', properties: {intent: {type: 'string'}, files: {type: 'array', items: {type: 'string'}, maxItems: 200}}, required: ['files']}, run: (g, a, ctx) => tar.tPrepareChange(g, a, ctx)},
         {cap: 'health', name: 'verify_architecture', description: 'Verify the fresh graph against the active target contract and ratchet; separates new, existing, fixed and excepted debt.', inputSchema: {type: 'object', properties: {}}, run: (g, a, ctx) => tar.tVerifyArchitecture(g, a, ctx)},
         {cap: 'health', name: 'explain_architecture_violation', description: 'Explain one active architecture violation and the governing rule.', inputSchema: {type: 'object', properties: {fingerprint: {type: 'string'}}, required: ['fingerprint']}, run: (g, a, ctx) => tar.tExplainArchitectureViolation(g, a, ctx)},

package/src/mcp/evidence/bun-lock-graph.mjs

@@ -0,0 +1,209 @@
+import {compareText, safeToken, STATE} from '../evidence-snapshot.common.mjs'
+import {
+    MAX_DEPENDENCY_DECLARATIONS, MAX_PACKAGE_RECORDS, PACKAGE_NAME,
+    dependencyDeclarations, emptyDeclarations, emptyGraph, finalizeGraph,
+    packageId, packageVersion,
+} from './package-graph-common.mjs'
+
+// Bun >= 1.2 writes JSONC: JSON plus comments and trailing commas.
+export function parseJsonc(text) {
+    const source = text.charCodeAt(0) === 0xfeff ? text.slice(1) : text
+    const out = []
+    let i = 0
+    const length = source.length
+    const skipComment = (index) => {
+        if (source[index] !== '/') return index
+        if (source[index + 1] === '/') {
+            let cursor = index + 2
+            while (cursor < length && source[cursor] !== '\n') cursor++
+            return cursor
+        }
+        if (source[index + 1] === '*') {
+            let cursor = index + 2
+            while (cursor < length && !(source[cursor] === '*' && source[cursor + 1] === '/')) cursor++
+            return Math.min(cursor + 2, length)
+        }
+        return index
+    }
+    while (i < length) {
+        const char = source[i]
+        if (char === '"') {
+            const start = i
+            i++
+            while (i < length && source[i] !== '"') i += source[i] === '\\' ? 2 : 1
+            i = Math.min(i + 1, length)
+            out.push(source.slice(start, i))
+            continue
+        }
+        if (char === '/') {
+            const next = skipComment(i)
+            if (next !== i) { i = next; continue }
+        }
+        if (char === ',') {
+            let ahead = i + 1
+            while (ahead < length) {
+                if (/\s/.test(source[ahead])) { ahead++; continue }
+                const next = skipComment(ahead)
+                if (next !== ahead) { ahead = next; continue }
+                break
+            }
+            if (ahead < length && (source[ahead] === '}' || source[ahead] === ']')) { i++; continue }
+        }
+        out.push(char)
+        i++
+    }
+    return JSON.parse(out.join(''))
+}
+
+function bunKeySegments(key) {
+    if (typeof key !== 'string' || key.length === 0 || key.length > 4096 || /[\u0000-\u001f\u007f]/.test(key)) return null
+    const parts = key.split('/')
+    const segments = []
+    for (let index = 0; index < parts.length; index++) {
+        let segment = parts[index]
+        if (segment.startsWith('@')) {
+            if (index + 1 >= parts.length) return null
+            segment = `${segment}/${parts[++index]}`
+        }
+        if (segment.length > 256 || !PACKAGE_NAME.test(segment)) return null
+        segments.push(segment)
+    }
+    return segments
+}
+
+function bunPackageRecord(entry) {
+    if (!Array.isArray(entry) || typeof entry[0] !== 'string' || entry[0].length > 1024) return null
+    const at = entry[0].lastIndexOf('@')
+    if (at <= 0) return null
+    const name = entry[0].slice(0, at)
+    if (name.length > 256 || !PACKAGE_NAME.test(name)) return null
+    const rawVersion = entry[0].slice(at + 1)
+    const meta = entry.slice(1).find((value) => value && typeof value === 'object' && !Array.isArray(value)) || {}
+    return {name, rawVersion, workspace: rawVersion.startsWith('workspace:'), meta}
+}
+
+function bunDeclarationRecord(meta) {
+    if (!meta || typeof meta !== 'object' || Array.isArray(meta)) return {}
+    const peerDependenciesMeta = {}
+    if (Array.isArray(meta.optionalPeers)) {
+        for (const name of meta.optionalPeers) if (typeof name === 'string') peerDependenciesMeta[name] = {optional: true}
+    }
+    return {
+        dependencies: meta.dependencies,
+        devDependencies: meta.devDependencies,
+        optionalDependencies: meta.optionalDependencies,
+        peerDependencies: meta.peerDependencies,
+        peerDependenciesMeta,
+    }
+}
+
+function resolveBunDependency(sourceSegments, name, records) {
+    for (let depth = sourceSegments.length; depth >= 0; depth--) {
+        const key = [...sourceSegments.slice(0, depth), name].join('/')
+        const record = records.get(key)
+        if (record) return {key, record}
+    }
+    return null
+}
+
+function applyBunReachabilityFlags(nodes, edges) {
+    const adjacency = new Map()
+    for (const edge of edges) {
+        if (!adjacency.has(edge.from)) adjacency.set(edge.from, [])
+        adjacency.get(edge.from).push(edge)
+    }
+    const reach = (excluded) => {
+        const seen = new Set(['(root)'])
+        const queue = ['(root)']
+        while (queue.length) {
+            for (const edge of adjacency.get(queue.pop()) || []) {
+                if (excluded.has(edge.kind) || seen.has(edge.to)) continue
+                seen.add(edge.to)
+                queue.push(edge.to)
+            }
+        }
+        return seen
+    }
+    const withoutDev = reach(new Set(['dev']))
+    const withoutOptional = reach(new Set(['optional', 'optional-peer']))
+    const withoutPeer = reach(new Set(['peer', 'optional-peer']))
+    for (const node of nodes) {
+        node.dev = !withoutDev.has(node.id)
+        node.optional = !withoutOptional.has(node.id)
+        node.peer = !withoutPeer.has(node.id)
+    }
+}
+
+export function parseBunLock(lock, lockfile) {
+    const lockfileVersion = Number(lock?.lockfileVersion)
+    const extras = {lockfile, lockfileVersion: Number.isFinite(lockfileVersion) ? Math.trunc(lockfileVersion) : 0}
+    if (!lock?.packages || typeof lock.packages !== 'object' || Array.isArray(lock.packages)) {
+        return emptyGraph(STATE.PARTIAL, 'BUN_LOCK_PACKAGES_REQUIRED', extras)
+    }
+    const allKeys = Object.keys(lock.packages).sort(compareText)
+    const selectedKeys = allKeys.slice(0, MAX_PACKAGE_RECORDS)
+    const reasons = []
+    if (selectedKeys.length < allKeys.length) reasons.push('LOCKFILE_PACKAGE_RECORD_LIMIT_REACHED')
+    const records = new Map()
+    let invalidRecords = 0
+    for (const key of selectedKeys) {
+        const segments = bunKeySegments(key)
+        const record = segments ? bunPackageRecord(lock.packages[key]) : null
+        if (!record) { invalidRecords++; continue }
+        records.set(key, {...record, segments})
+    }
+    if (invalidRecords > 0) reasons.push('INVALID_LOCKFILE_PACKAGE_RECORDS')
+    const externalNodes = new Map()
+    let invalidPackageVersions = 0
+    for (const [key, record] of records) {
+        if (record.workspace) continue
+        const version = packageVersion(record.rawVersion)
+        if (!version) { invalidPackageVersions++; continue }
+        externalNodes.set(key, {
+            id: packageId(record.name, version, key), name: record.name, version,
+            direct: false, dev: false, optional: false, peer: false,
+        })
+    }
+    if (invalidPackageVersions > 0) reasons.push('INVALID_LOCKFILE_PACKAGE_VERSIONS')
+    const workspaces = lock?.workspaces && typeof lock.workspaces === 'object' && !Array.isArray(lock.workspaces)
+        ? lock.workspaces : null
+    if (!workspaces) reasons.push('BUN_LOCK_WORKSPACES_MISSING')
+    const sources = []
+    for (const path of Object.keys(workspaces || {}).sort(compareText)) {
+        const meta = workspaces[path]
+        if (!meta || typeof meta !== 'object' || Array.isArray(meta)) continue
+        const workspaceName = path === '' ? null : safeToken(meta.name)
+        const segments = workspaceName && records.has(workspaceName) ? [workspaceName] : []
+        sources.push({sourceId: '(root)', segments, declarationRecord: bunDeclarationRecord(meta)})
+    }
+    for (const [key, record] of [...records].sort(([a], [b]) => compareText(a, b))) {
+        const node = externalNodes.get(key)
+        if (node) sources.push({sourceId: node.id, segments: record.segments, declarationRecord: bunDeclarationRecord(record.meta)})
+    }
+    const edgeMap = new Map()
+    const declarations = emptyDeclarations()
+    let declarationLimitReached = false
+    outer: for (const source of sources) {
+        for (const declaration of dependencyDeclarations(source.declarationRecord)) {
+            if (declarations.total >= MAX_DEPENDENCY_DECLARATIONS) { declarationLimitReached = true; break outer }
+            declarations.total++
+            const resolved = resolveBunDependency(source.segments, declaration.name, records)
+            if (resolved?.record.workspace) { declarations.local++; continue }
+            const node = resolved ? externalNodes.get(resolved.key) : null
+            if (!node) {
+                if (declaration.kind === 'optional' || declaration.kind === 'optional-peer') declarations.optionalMissing++
+                else declarations.unresolved++
+                continue
+            }
+            declarations.resolved++
+            if (source.sourceId === '(root)') node.direct = true
+            if (source.sourceId === node.id) continue
+            const edge = {from: source.sourceId, to: node.id, kind: declaration.kind}
+            edgeMap.set(`${edge.from}\0${edge.to}\0${edge.kind}`, edge)
+        }
+    }
+    if (declarationLimitReached) reasons.push('LOCKFILE_DEPENDENCY_DECLARATION_LIMIT_REACHED')
+    if (declarations.unresolved > 0) reasons.push('UNRESOLVED_LOCKFILE_DEPENDENCIES')
+    applyBunReachabilityFlags(externalNodes.values(), edgeMap.values())
+    return finalizeGraph({externalNodes, edgeMap, declarations, reasons, lockfile, lockfileVersion: extras.lockfileVersion})
+}

package/src/mcp/evidence/duplicate-member-order.mjs

@@ -0,0 +1,8 @@
+const compareText = (left, right) => String(left).localeCompare(String(right), 'en')
+
+// Snapshot construction and hosted-payload validation must use the same stable
+// member order or equivalent evidence can hash differently across the boundary.
+export function compareDuplicateMember(left, right) {
+    return compareText(left.file, right.file) || left.startLine - right.startLine ||
+        left.endLine - right.endLine || compareText(left.graphNodeId || '', right.graphNodeId || '')
+}