weavatrix 0.2.19 → 0.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (39) hide show
  1. package/README.md +90 -93
  2. package/SECURITY.md +13 -31
  3. package/bin/weavatrix-mcp.mjs +2 -1
  4. package/docs/adr/0001-v0.3-offline-online-split.md +9 -7
  5. package/docs/releases/v0.3.0.md +43 -0
  6. package/package.json +8 -2
  7. package/skill/SKILL.md +34 -59
  8. package/src/analysis/architecture/contract-storage.js +2 -2
  9. package/src/analysis/audit-extensions.js +60 -0
  10. package/src/analysis/duplicate-groups.js +13 -2
  11. package/src/analysis/duplicates.compute.js +7 -2
  12. package/src/analysis/health-capabilities.js +2 -1
  13. package/src/analysis/internal-audit/supply-chain.js +17 -2
  14. package/src/analysis/jvm-artifact-index.js +87 -0
  15. package/src/analysis/jvm-dependency-evidence.js +31 -8
  16. package/src/analysis/transport-contracts.js +78 -11
  17. package/src/analysis/transport-runtime-evidence.js +155 -0
  18. package/src/child-env.js +2 -2
  19. package/src/extension/local-services.mjs +75 -0
  20. package/src/graph/internal-builder.langs.js +2 -0
  21. package/src/graph/repo-registry.js +2 -2
  22. package/src/mcp/catalog.mjs +47 -21
  23. package/src/mcp/evidence/duplicate-member-order.mjs +1 -1
  24. package/src/mcp/evidence-snapshot.health.mjs +2 -2
  25. package/src/mcp/extension-api.mjs +77 -0
  26. package/src/mcp/health/audit-format.mjs +11 -1
  27. package/src/mcp/health/audit.mjs +10 -7
  28. package/src/mcp/health/duplicates.mjs +5 -3
  29. package/src/mcp/sync-payload.mjs +1 -1
  30. package/src/mcp/tools-actions.mjs +1 -8
  31. package/src/mcp/tools-architecture.mjs +2 -2
  32. package/src/mcp/tools-company.mjs +4 -2
  33. package/src/mcp-runtime.mjs +2 -0
  34. package/src/mcp-server.mjs +28 -17
  35. package/src/security/advisory-store.js +133 -181
  36. package/src/security/rust-advisory-report.js +60 -0
  37. package/src/mcp/actions/advisories.mjs +0 -17
  38. package/src/mcp/actions/graph-sync.mjs +0 -195
  39. package/src/mcp/actions/hosted-architecture.mjs +0 -57
@@ -1,57 +0,0 @@
1
- import {writeCachedArchitectureContract} from '../../analysis/architecture-contract.js'
2
- import {graphHomeDir, graphOutDirForRepo} from '../../graph/layout.js'
3
- import {registerRepository, repositoryRecord} from '../../graph/repo-registry.js'
4
- import {toolResult} from '../tool-result.mjs'
5
- const syncVersion = new URL(import.meta.url).search
6
- const {syncDestination} = await import(new URL(`./graph-sync.mjs${syncVersion}`, import.meta.url).href)
7
-
8
- export async function tPullArchitectureContract(g, args, ctx) {
9
- if (!ctx.repoRoot || !ctx.graphPath) return 'No active repository graph — open_repo first.'
10
- const syncUrl = process.env.WEAVATRIX_SYNC_URL
11
- const token = process.env.WEAVATRIX_SYNC_TOKEN
12
- if (!syncUrl || !token) return 'Hosted architecture pull is not configured. Use the hosted profile with WEAVATRIX_SYNC_URL and WEAVATRIX_SYNC_TOKEN, or keep .weavatrix/architecture.json locally.'
13
- let url
14
- try {
15
- const configured = process.env.WEAVATRIX_ARCHITECTURE_URL || new URL('/api/v1/architecture-contract', syncUrl).toString()
16
- url = syncDestination(configured).url
17
- } catch (error) { return `Hosted architecture pull is not configured safely: ${error.message}.` }
18
- const registry = repositoryRecord(ctx.repoRoot, graphHomeDir())
19
- || registerRepository({repoPath: ctx.repoRoot, graphDir: graphOutDirForRepo(ctx.repoRoot), graphHome: graphHomeDir()})
20
- const timeoutMs = Math.min(120000, Math.max(1000, Number(args.timeout_ms) || 30000))
21
- try {
22
- const res = await fetch(url, {
23
- headers: {authorization: `Bearer ${token}`, 'x-weavatrix-repository-id': registry.repositoryId},
24
- signal: AbortSignal.timeout(timeoutMs),
25
- })
26
- const body = await res.json().catch(() => null)
27
- if (!res.ok) {
28
- const serverCode = String(body?.error?.code || body?.state || '').toUpperCase()
29
- const state = res.status === 401 ? 'AUTH_REQUIRED'
30
- : res.status === 403 ? 'FORBIDDEN'
31
- : res.status === 404 && ['REPOSITORY_NOT_FOUND', 'NOT_FOUND'].includes(serverCode) ? 'REPOSITORY_NOT_REGISTERED'
32
- : res.status === 404 ? 'ENDPOINT_NOT_FOUND'
33
- : res.status === 409 ? 'REPOSITORY_NOT_READY'
34
- : 'HTTP_ERROR'
35
- const next = state === 'REPOSITORY_NOT_REGISTERED'
36
- ? 'The Hosted endpoint is reachable, but this UUID has not completed a preview-confirmed repository sync.'
37
- : state === 'ENDPOINT_NOT_FOUND'
38
- ? 'The configured architecture endpoint does not exist; verify WEAVATRIX_ARCHITECTURE_URL or the URL derived from WEAVATRIX_SYNC_URL.'
39
- : res.status === 401 || res.status === 403
40
- ? 'Check the hosted token and repository access; no local cache entry was changed.'
41
- : res.status === 409
42
- ? 'Sync/register this repository first, then create or pull its target contract.'
43
- : 'Check the hosted service status and configured endpoint before retrying.'
44
- return toolResult(`Hosted architecture pull: ${state} (HTTP ${res.status}). ${next} The previous local contract cache remains unchanged.`, {
45
- state, httpStatus: res.status, serverCode: serverCode || null, cacheChanged: false,
46
- })
47
- }
48
- if (body?.state === 'NOT_CONFIGURED' || !body?.contract) return toolResult(
49
- 'Hosted target architecture is NOT_CONFIGURED. Repository sync and authentication succeeded; define and save a target in the Architecture editor first.',
50
- {state: 'NOT_CONFIGURED', repositoryId: registry.repositoryId, cacheChanged: false},
51
- )
52
- const stored = writeCachedArchitectureContract(ctx.graphPath, body.contract)
53
- return `Pulled target architecture ${stored.contract.name} (${stored.contract.style}, ${stored.contract.enforcement}) into the local graph cache. get_architecture_contract and verify_architecture now use it.`
54
- } catch (error) {
55
- return `Hosted architecture pull failed: ${error.message}; the previous local contract, if any, remains active.`
56
- }
57
- }