weavatrix 0.3.13 → 1.0.0

package/src/analysis/endpoints-java.js

@@ -1,260 +0,0 @@
-// Spring MVC/WebFlux endpoint extraction. This stays source-only and deliberately resolves only
-// literal annotation paths: inventing values for constants would make an architecture inventory look
-// more complete than the evidence permits.
-import { maskJavaNonCode } from "./java-source.js";
-import { lineNumberAt } from "../util.js";
-
-const SPRING_MAPPING = /@(?:org\.springframework\.web\.bind\.annotation\.)?(RequestMapping|GetMapping|PostMapping|PutMapping|PatchMapping|DeleteMapping)\b/g;
-const SPRING_CONDITION = /@(?:org\.springframework\.boot\.autoconfigure\.condition\.)?(ConditionalOnExpression|ConditionalOnProperty)\b/g;
-const REQUEST_METHOD = /\bRequestMethod\s*\.\s*(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS|TRACE)\b/g;
-
-const lineAt = lineNumberAt;
-
-function skipTrivia(text, start) {
-  let i = start;
-  while (i < text.length) {
-    if (/\s/.test(text[i])) { i++; continue; }
-    if (text.startsWith("//", i)) {
-      const nl = text.indexOf("\n", i + 2);
-      i = nl < 0 ? text.length : nl + 1;
-      continue;
-    }
-    if (text.startsWith("/*", i)) {
-      const end = text.indexOf("*/", i + 2);
-      i = end < 0 ? text.length : end + 2;
-      continue;
-    }
-    break;
-  }
-  return i;
-}
-
-function balancedEnd(text, start, open = "(", close = ")") {
-  if (text[start] !== open) return start;
-  let depth = 0;
-  let quote = "";
-  let escaped = false;
-  for (let i = start; i < text.length; i++) {
-    const ch = text[i];
-    if (quote) {
-      if (escaped) escaped = false;
-      else if (ch === "\\") escaped = true;
-      else if (ch === quote) quote = "";
-      continue;
-    }
-    if (ch === '"' || ch === "'") { quote = ch; continue; }
-    if (ch === open) depth++;
-    else if (ch === close && --depth === 0) return i + 1;
-  }
-  return text.length;
-}
-
-function annotationInvocation(text, nameEnd) {
-  const start = skipTrivia(text, nameEnd);
-  if (text[start] !== "(") return { args: "", end: start };
-  const end = balancedEnd(text, start);
-  return { args: text.slice(start + 1, Math.max(start + 1, end - 1)), end };
-}
-
-function skipAnnotations(text, start) {
-  let i = skipTrivia(text, start);
-  while (text[i] === "@") {
-    const name = /^@[A-Za-z_$][\w$]*(?:\s*\.\s*[A-Za-z_$][\w$]*)*/.exec(text.slice(i));
-    if (!name) break;
-    i += name[0].length;
-    i = annotationInvocation(text, i).end;
-    i = skipTrivia(text, i);
-  }
-  return i;
-}
-
-function stringLiterals(value) {
-  const out = [];
-  const re = /"((?:\\.|[^"\\])*)"/g;
-  let match;
-  while ((match = re.exec(String(value || "")))) {
-    out.push(match[1].replace(/\\"/g, '"').replace(/\\\\/g, "\\"));
-  }
-  return out;
-}
-
-function initializer(args, equalsAt) {
-  let i = skipTrivia(args, equalsAt + 1);
-  if (args[i] === "{") {
-    const end = balancedEnd(args, i, "{", "}");
-    return args.slice(i, end);
-  }
-  if (args[i] === '"') {
-    let escaped = false;
-    for (let end = i + 1; end < args.length; end++) {
-      if (escaped) escaped = false;
-      else if (args[end] === "\\") escaped = true;
-      else if (args[end] === '"') return args.slice(i, end + 1);
-    }
-  }
-  const comma = args.indexOf(",", i);
-  return args.slice(i, comma < 0 ? args.length : comma);
-}
-
-function mappingPaths(args) {
-  const source = String(args || "");
-  const named = /\b(?:path|value)\s*=/g.exec(source);
-  if (named) return stringLiterals(initializer(source, source.indexOf("=", named.index)));
-  const leading = source.trimStart();
-  if (!leading) return [""];
-  if (leading[0] === '"' || leading[0] === "{") return stringLiterals(leading);
-  // `method=`, `produces=` and friends do not specify a path, so they map the class/method root.
-  if (/^(?:method|produces|consumes|headers|params|name)\s*=/.test(leading)) return [""];
-  return []; // unresolved positional constant: do not invent a root route
-}
-
-function mappingMethods(name, args) {
-  if (name !== "RequestMapping") return [name.replace(/Mapping$/, "").toUpperCase()];
-  const methods = [];
-  let match;
-  REQUEST_METHOD.lastIndex = 0;
-  while ((match = REQUEST_METHOD.exec(args))) if (!methods.includes(match[1])) methods.push(match[1]);
-  return methods.length ? methods : ["ANY"];
-}
-
-function namedInitializer(args, name) {
-  const source = String(args || "");
-  const match = new RegExp(`\\b${name}\\s*=`).exec(source);
-  return match ? initializer(source, source.indexOf("=", match.index)) : "";
-}
-
-function namedStrings(args, name) {
-  return stringLiterals(namedInitializer(args, name));
-}
-
-function namedBoolean(args, name, fallback) {
-  const value = namedInitializer(args, name).trim();
-  if (/^true\b/i.test(value)) return true;
-  if (/^false\b/i.test(value)) return false;
-  return fallback;
-}
-
-function positionalStrings(args) {
-  const source = String(args || "");
-  const start = source.trimStart()[0];
-  return start === '"' || start === "{" ? stringLiterals(initializer(source, -1)) : [];
-}
-
-function expressionDefaultActive(expression) {
-  const value = String(expression || "").trim();
-  if (/^(?:true|false)$/i.test(value)) return value.toLowerCase() === "true";
-  const match = /^\$\{[^{}:]+:(true|false)\}$/i.exec(value);
-  return match ? match[1].toLowerCase() === "true" : null;
-}
-
-function conditionMetadata(annotation, args) {
-  if (annotation === "ConditionalOnExpression") {
-    const expression = namedStrings(args, "value")[0] || stringLiterals(args)[0] || "";
-    return {
-      type: annotation,
-      expression,
-      defaultActive: expressionDefaultActive(expression),
-    };
-  }
-  const namedProperties = [...namedStrings(args, "name"), ...namedStrings(args, "value")];
-  const properties = [...new Set(namedProperties.length ? namedProperties : positionalStrings(args))];
-  const matchIfMissing = namedBoolean(args, "matchIfMissing", false);
-  return {
-    type: annotation,
-    prefix: namedStrings(args, "prefix")[0] || "",
-    properties,
-    havingValue: namedStrings(args, "havingValue")[0] || "",
-    matchIfMissing,
-    defaultActive: matchIfMissing,
-  };
-}
-
-function joinPaths(prefix, path) {
-  const left = String(prefix || "").trim().replace(/^\/+|\/+$/g, "");
-  const right = String(path || "").trim().replace(/^\/+|\/+$/g, "");
-  return `/${[left, right].filter(Boolean).join("/")}`.replace(/\/{2,}/g, "/");
-}
-
-function declarationAfter(text, start) {
-  const declarationStart = skipAnnotations(text, start);
-  const bounded = text.slice(declarationStart, declarationStart + 2_500);
-  const terminators = [bounded.indexOf("{"), bounded.indexOf(";")].filter((i) => i >= 0);
-  const end = terminators.length ? Math.min(...terminators) : bounded.length;
-  const head = bounded.slice(0, end);
-  const classMatch = /\b(class|interface|record|enum)\s+([A-Za-z_$][\w$]*)/.exec(head);
-  if (classMatch) {
-    const open = bounded.indexOf("{");
-    const bodyOpen = open < 0 ? -1 : declarationStart + open;
-    return { kind: "class", name: classMatch[2], start: declarationStart, bodyOpen, bodyClose: bodyOpen < 0 ? text.length : balancedEnd(text, bodyOpen, "{", "}") };
-  }
-  const methodMatch = /\b([A-Za-z_$][\w$]*)\s*\(/.exec(head);
-  return methodMatch ? { kind: "method", name: methodMatch[1], start: declarationStart } : { kind: "unknown", name: "", start: declarationStart };
-}
-
-export function extractSpringEndpoints(text, file) {
-  if (!/\.java$/i.test(file)) return [];
-  const code = maskJavaNonCode(text);
-  if (!/@(?:[\w$]+\.)*(?:Request|Get|Post|Put|Patch|Delete)Mapping\b/.test(code)) return [];
-  const mappings = [];
-  let match;
-  SPRING_MAPPING.lastIndex = 0;
-  while ((match = SPRING_MAPPING.exec(code))) {
-    const invocation = annotationInvocation(text, SPRING_MAPPING.lastIndex);
-    const declaration = declarationAfter(code, invocation.end);
-    mappings.push({
-      annotation: match[1],
-      args: invocation.args,
-      index: match.index,
-      line: lineAt(text, match.index),
-      declaration,
-    });
-    SPRING_MAPPING.lastIndex = Math.max(SPRING_MAPPING.lastIndex, invocation.end);
-  }
-  const conditions = [];
-  SPRING_CONDITION.lastIndex = 0;
-  while ((match = SPRING_CONDITION.exec(code))) {
-    const invocation = annotationInvocation(text, SPRING_CONDITION.lastIndex);
-    const declaration = declarationAfter(code, invocation.end);
-    conditions.push({
-      index: match.index,
-      line: lineAt(text, match.index),
-      declaration,
-      ...conditionMetadata(match[1], invocation.args),
-    });
-    SPRING_CONDITION.lastIndex = Math.max(SPRING_CONDITION.lastIndex, invocation.end);
-  }
-
-  const classMappings = mappings
-    .filter((item) => item.declaration.kind === "class")
-    .map((item) => ({ ...item, paths: mappingPaths(item.args) }));
-  const out = [];
-  for (const item of mappings) {
-    if (item.declaration.kind !== "method") continue;
-    const owner = classMappings
-      .filter((candidate) => candidate.declaration.bodyOpen >= 0
-        && item.index > candidate.declaration.bodyOpen
-        && item.index < candidate.declaration.bodyClose)
-      .sort((a, b) => b.declaration.bodyOpen - a.declaration.bodyOpen)[0];
-    if (owner && !owner.paths.length) continue; // unresolved class prefix makes the full route unknowable
-    const prefixes = owner?.paths?.length ? owner.paths : [""];
-    const paths = mappingPaths(item.args);
-    if (!paths.length) continue; // literal path was requested but could not be resolved
-    const activationConditions = conditions.filter((condition) => condition.declaration.start === item.declaration.start
-      || (owner && condition.declaration.start === owner.declaration.start));
-    const activation = activationConditions.length
-      ? {
-          conditional: true,
-          defaultActive: activationConditions.some((condition) => condition.defaultActive === false)
-            ? false
-            : activationConditions.every((condition) => condition.defaultActive === true) ? true : null,
-          conditions: activationConditions.map(({ declaration: _declaration, index: _index, ...condition }) => condition),
-        }
-      : {};
-    for (const method of mappingMethods(item.annotation, item.args)) {
-      for (const prefix of prefixes) for (const path of paths) {
-        out.push({ method, path: joinPaths(prefix, path), handler: item.declaration.name, file, line: item.line, ...activation });
-      }
-    }
-  }
-  return out;
-}

package/src/analysis/endpoints-rust.js

@@ -1,124 +0,0 @@
-const RUST_ROUTE_METHOD = "get|post|put|patch|delete|head|options|trace|connect|any";
-
-// Find a call's closing parenthesis without mistaking parens inside strings for syntax. This is deliberately
-// small (not a Rust parser), but keeps route-handler expressions bounded instead of using a cross-statement
-// regex that could turn an unrelated function call into a route.
-function closingParen(text, openAt) {
-  let depth = 0, quote = "", escaped = false, blockComment = 0;
-  for (let i = openAt; i < text.length; i++) {
-    const ch = text[i];
-    if (quote) {
-      if (escaped) escaped = false;
-      else if (ch === "\\") escaped = true;
-      else if (ch === quote) quote = "";
-      continue;
-    }
-    if (blockComment) {
-      if (ch === "/" && text[i + 1] === "*") { blockComment++; i++; }
-      else if (ch === "*" && text[i + 1] === "/") { blockComment--; i++; }
-      continue;
-    }
-    if (ch === "/" && text[i + 1] === "/") {
-      const newline = text.indexOf("\n", i + 2);
-      if (newline < 0) return -1;
-      i = newline;
-      continue;
-    }
-    if (ch === "/" && text[i + 1] === "*") { blockComment = 1; i++; continue; }
-    if (ch === '"') { quote = ch; continue; }
-    if (ch === "'") {
-      // Skip a Rust character literal, but do not mistake a lifetime (`'a`) for an unterminated string.
-      const char = /^'(?:\\.|[^\\'\r\n])'/.exec(text.slice(i));
-      if (char) { i += char[0].length - 1; continue; }
-    }
-    if (ch === "(") depth++;
-    else if (ch === ")" && --depth === 0) return i;
-  }
-  return -1;
-}
-
-// Parse axum's MethodRouter expression, including direct method chains:
-//   get(list).post(create) / axum::routing::get(show).delete(remove)
-// Calls inside a handler closure are not scanned and therefore cannot become fake endpoint methods.
-function axumRoutes(expr) {
-  const found = [];
-  let rest = String(expr || ""), offset = 0;
-  const firstRe = new RegExp(`^\\s*(?:(?:axum\\s*::\\s*)?routing\\s*::\\s*)?(${RUST_ROUTE_METHOD})\\s*\\(`, "i");
-  let match = firstRe.exec(rest);
-  if (!match) return found;
-
-  while (match) {
-    const openAt = offset + match.index + match[0].lastIndexOf("(");
-    const closeAt = closingParen(expr, openAt);
-    if (closeAt < 0) break;
-    found.push({ method: match[1], handler: expr.slice(openAt + 1, closeAt), index: openAt });
-    offset = closeAt + 1;
-    rest = expr.slice(offset);
-    match = new RegExp(`^\\s*\\.\\s*(${RUST_ROUTE_METHOD})\\s*\\(`, "i").exec(rest);
-  }
-  return found;
-}
-
-// Actix's builder form is structurally distinct from axum and from HTTP clients:
-//   web::get().to(handler) / actix_web::web::post().to(handler)
-function actixRoutes(expr) {
-  const found = [];
-  const re = new RegExp(`(?:actix_web\\s*::\\s*)?web\\s*::\\s*(${RUST_ROUTE_METHOD})\\s*\\(\\s*\\)\\s*\\.\\s*to\\s*\\(`, "gi");
-  let match;
-  while ((match = re.exec(expr))) {
-    const openAt = re.lastIndex - 1;
-    const closeAt = closingParen(expr, openAt);
-    if (closeAt < 0) continue;
-    found.push({ method: match[1], handler: expr.slice(openAt + 1, closeAt), index: match.index });
-    re.lastIndex = closeAt + 1;
-  }
-  return found;
-}
-
-export function extractRustEndpoints(text, add) {
-  let match;
-
-  // Axum and actix both expose a path-first `.route(path, ...)` builder. Requiring either an axum
-  // MethodRouter or actix's web::<method>().to(...) avoids treating arbitrary Rust APIs named `route` as HTTP.
-  const routeRe = /\.\s*route\s*\(\s*"(\/(?:\\.|[^"\\])*)"\s*,/g;
-  while ((match = routeRe.exec(text))) {
-    const openAt = text.indexOf("(", match.index);
-    const closeAt = closingParen(text, openAt);
-    if (closeAt < 0) continue;
-    const exprStart = routeRe.lastIndex;
-    const expr = text.slice(exprStart, closeAt);
-    const routes = [...axumRoutes(expr), ...actixRoutes(expr)];
-    for (const route of routes) add(route.method, match[1], route.handler, exprStart + route.index);
-    routeRe.lastIndex = closeAt + 1;
-  }
-
-  // actix `web::resource(path)` associates several method routes with one path.
-  const resourceRe = /(?:actix_web\s*::\s*)?web\s*::\s*resource\s*\(\s*"(\/(?:\\.|[^"\\])*)"\s*\)/g;
-  while ((match = resourceRe.exec(text))) {
-    const tail = text.slice(resourceRe.lastIndex);
-    const nextResource = tail.search(/(?:actix_web\s*::\s*)?web\s*::\s*resource\s*\(/);
-    const semicolon = text.indexOf(";", resourceRe.lastIndex);
-    let end = Math.min(text.length, resourceRe.lastIndex + 4000);
-    if (nextResource >= 0) end = Math.min(end, resourceRe.lastIndex + nextResource);
-    if (semicolon >= 0) end = Math.min(end, semicolon);
-    const chain = text.slice(resourceRe.lastIndex, end);
-    for (const route of actixRoutes(chain)) add(route.method, match[1], route.handler, resourceRe.lastIndex + route.index);
-  }
-
-  // Actix attribute macros. The route macro can declare more than one method for the same handler.
-  const macroRe = new RegExp(`#\\s*\\[\\s*(?:(?:actix_web|actix)\\s*::\\s*)?(${RUST_ROUTE_METHOD})\\s*\\(\\s*"(\\/(?:\\\\.|[^"\\\\])*)"(?:\\s*,[^\\]]*)?\\s*\\)\\s*\\]`, "gi");
-  while ((match = macroRe.exec(text))) {
-    const after = text.slice(macroRe.lastIndex, macroRe.lastIndex + 600);
-    const fn = /\b(?:pub(?:\s*\([^)]*\))?\s+)?(?:async\s+)?fn\s+([A-Za-z_][\w]*)/.exec(after);
-    add(match[1], match[2], fn ? fn[1] : "", match.index);
-  }
-
-  const multiMacroRe = /#\s*\[\s*(?:(?:actix_web|actix)\s*::\s*)?route\s*\(\s*"(\/(?:\\.|[^"\\])*)"([\s\S]*?)\)\s*\]/gi;
-  while ((match = multiMacroRe.exec(text))) {
-    const after = text.slice(multiMacroRe.lastIndex, multiMacroRe.lastIndex + 600);
-    const fn = /\b(?:pub(?:\s*\([^)]*\))?\s+)?(?:async\s+)?fn\s+([A-Za-z_][\w]*)/.exec(after);
-    const methodRe = /\bmethod\s*=\s*"(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS|TRACE|CONNECT)"/gi;
-    let method;
-    while ((method = methodRe.exec(match[2]))) add(method[1], match[1], fn ? fn[1] : "", match.index);
-  }
-}

package/src/analysis/endpoints.js

@@ -1,3 +0,0 @@
-// Stable public facade for server endpoint discovery.
-export { nextRoutePath, extractEndpointsFromText } from "./endpoints/extract.js";
-export { analyzeEndpointInventory, detectEndpoints } from "./endpoints/inventory.js";

package/src/analysis/findings.js

@@ -1,70 +0,0 @@
-// Unified Finding factory + rollups for the internal dependency/security engine (DEPS_SECURITY_PLAN.md §2.3).
-// Every analyzer (unused / structure / vulnerability / malware) and the external-tool adapter emit THIS shape,
-// so the renderer and the AI summarizer consume one contract regardless of engine.
-import { createHash } from "node:crypto";
-
-const SEVERITY_ORDER = ["critical", "high", "medium", "low", "info"];
-
-export function dependencyVerification(manifest, imports, decision, mapping) {
-  return {
-    evidenceModel: "MANIFEST_PLUS_INDEXED_SOURCE",
-    decision,
-    manifestDeclaration: { status: "FOUND", file: manifest },
-    indexedSourceImports: imports.length
-      ? { status: "FOUND", count: imports.length, files: [...new Set(imports.map((item) => item.file))].slice(0, 10) }
-      : { status: "ZERO_FOUND", completeness: "COMPLETE_FOR_GRAPH_SCOPE", count: 0, files: [] },
-    mapping,
-  };
-}
-
-// Stable id: survives re-runs so the UI can persist expand/dismiss state per finding.
-export function makeFinding(f) {
-  const cycleIdentity = Array.isArray(f.cycleMembers)
-    ? [...new Set(f.cycleMembers.map(String))].sort().join("\0")
-    : "";
-  const id = createHash("sha1")
-    .update([
-      f.category, f.rule, f.file || "", f.manifest || "", f.scope || "",
-      f.package || "", f.symbol || "", cycleIdentity, f.title || "",
-    ].join("|"))
-    .digest("hex")
-    .slice(0, 16);
-  return {
-    id,
-    severity: "info",
-    confidence: "medium",
-    title: "",
-    detail: "",
-    reason: "",
-    file: "",
-    line: 0,
-    symbol: "",
-    package: "",
-    version: "",
-    graphNodeId: f.graphNodeId || f.file || "",
-    evidence: [],
-    source: "internal",
-    fixHint: "",
-    ...f,
-  };
-}
-
-export function summarizeFindings(findings) {
-  const bySeverity = { critical: 0, high: 0, medium: 0, low: 0, info: 0 };
-  const byCategory = { unused: 0, structure: 0, vulnerability: 0, malware: 0 };
-  for (const f of findings || []) {
-    if (f.severity in bySeverity) bySeverity[f.severity]++;
-    if (f.category in byCategory) byCategory[f.category]++;
-  }
-  return { bySeverity, byCategory };
-}
-
-export function sortFindings(findings) {
-  const sev = new Map(SEVERITY_ORDER.map((s, i) => [s, i]));
-  return [...(findings || [])].sort(
-    (a, b) =>
-      (sev.get(a.severity) ?? 9) - (sev.get(b.severity) ?? 9) ||
-      String(a.category).localeCompare(String(b.category)) ||
-      String(a.file || a.package || "").localeCompare(String(b.file || b.package || ""))
-  );
-}

package/src/analysis/git-history/analytics.js

@@ -1,177 +0,0 @@
-import {isTestPath} from '../../graph/graph-filter.js'
-import {isStructuralRelation} from '../../graph/relations.js'
-import {
-    boundedHistoryInteger,
-    GIT_HISTORY_DEFAULTS as DEFAULTS,
-    GIT_HISTORY_HARD_CAPS as HARD_CAPS,
-    GIT_HISTORY_V,
-    graphEndpoint,
-    roundHistoryNumber as round,
-    safeHistoryPath,
-} from './options.js'
-
-function graphFilesAndAdjacency(graph = {}) {
-    const byId = new Map(), files = new Set()
-    for (const node of graph.nodes || []) {
-        const file = safeHistoryPath(node?.source_file)
-        if (!file) continue
-        byId.set(String(node.id), file)
-        files.add(file)
-    }
-    const adjacency = new Map([...files].map((file) => [file, new Set()]))
-    for (const link of graph.links || []) {
-        if (isStructuralRelation(link?.relation) || link?.barrelProxy === true) continue
-        const left = byId.get(String(graphEndpoint(link?.source)))
-        const right = byId.get(String(graphEndpoint(link?.target)))
-        if (!left || !right || left === right) continue
-        adjacency.get(left)?.add(right)
-        adjacency.get(right)?.add(left)
-    }
-    return {files, adjacency}
-}
-
-function graphDistanceAtMostTwo(left, right, adjacency) {
-    if (left === right) return 0
-    const neighbors = adjacency.get(left)
-    if (!neighbors) return null
-    if (neighbors.has(right)) return 1
-    for (const middle of neighbors) if (adjacency.get(middle)?.has(right)) return 2
-    return null
-}
-
-function percentile(value, positiveValues) {
-    if (!(value > 0) || !positiveValues.length) return 0
-    let atOrBelow = 0
-    for (const candidate of positiveValues) if (candidate <= value) atOrBelow++
-    return round(atOrBelow / positiveValues.length)
-}
-
-const pairSort = (left, right) => right.count - left.count
-    || right.confidence - left.confidence
-    || right.lift - left.lift
-    || left.left.localeCompare(right.left)
-    || left.right.localeCompare(right.right)
-
-const publicPair = (pair, graphDistance) => ({
-    left: pair.left,
-    right: pair.right,
-    count: pair.count,
-    jaccard: pair.jaccard,
-    lift: pair.lift,
-    confidence: pair.confidence,
-    leftConfidence: pair.leftConfidence,
-    rightConfidence: pair.rightConfidence,
-    graphDistance,
-})
-
-function fileActivity(commits, graph) {
-    const activity = new Map(), fileCommits = new Map()
-    let additions = 0, deletions = 0, binaryChanges = 0
-    for (const commit of commits) {
-        const seen = new Set()
-        for (const stat of commit.files) {
-            if (seen.has(stat.file)) continue
-            seen.add(stat.file)
-            const entry = activity.get(stat.file) || {file: stat.file, commits: 0, additions: 0, deletions: 0, binaryChanges: 0}
-            entry.commits++
-            entry.additions += stat.additions
-            entry.deletions += stat.deletions
-            entry.binaryChanges += stat.binary ? 1 : 0
-            activity.set(stat.file, entry)
-            fileCommits.set(stat.file, (fileCommits.get(stat.file) || 0) + 1)
-            additions += stat.additions
-            deletions += stat.deletions
-            if (stat.binary) binaryChanges++
-        }
-    }
-    const {files: graphFiles, adjacency} = graphFilesAndAdjacency(graph)
-    const raw = [...activity.values()].map((entry) => ({...entry, churn: entry.additions + entry.deletions}))
-    const churnValues = raw.map((entry) => entry.churn).filter((value) => value > 0)
-    const connectivityValues = [...graphFiles].map((file) => adjacency.get(file)?.size || 0).filter((value) => value > 0)
-    const fileChurn = raw.map((entry) => {
-        const connectivity = adjacency.get(entry.file)?.size || 0
-        const churnPercentile = percentile(entry.churn, churnValues)
-        const connectivityPercentile = percentile(connectivity, connectivityValues)
-        return {...entry, connectivity, churnPercentile, connectivityPercentile, hotspotScore: round(Math.sqrt(churnPercentile * connectivityPercentile))}
-    }).sort((a, b) => b.churn - a.churn || b.commits - a.commits || a.file.localeCompare(b.file))
-    const hotspots = fileChurn.filter((entry) => entry.connectivity > 0)
-        .sort((a, b) => b.hotspotScore - a.hotspotScore || b.churn - a.churn || b.connectivity - a.connectivity || a.file.localeCompare(b.file))
-    return {fileCommits, graphFiles, adjacency, fileChurn, hotspots, additions, deletions, binaryChanges}
-}
-
-function coChangePairs(commits, fileCommits, limits) {
-    const counts = new Map()
-    let truncated = false
-    for (const commit of commits) {
-        const files = [...new Set(commit.files.map((entry) => entry.file))].sort()
-        for (let left = 0; left < files.length; left++) for (let right = left + 1; right < files.length; right++) {
-            const key = `${files[left]}\0${files[right]}`
-            if (!counts.has(key) && counts.size >= limits.maxPairCandidates) { truncated = true; continue }
-            counts.set(key, (counts.get(key) || 0) + 1)
-        }
-    }
-    const pairs = []
-    for (const [key, count] of counts) {
-        if (count < limits.minPairCount || !commits.length) continue
-        const split = key.indexOf('\0'), left = key.slice(0, split), right = key.slice(split + 1)
-        const leftCount = fileCommits.get(left) || 0, rightCount = fileCommits.get(right) || 0
-        const leftConfidence = count / leftCount, rightConfidence = count / rightCount
-        pairs.push({
-            left, right, count,
-            jaccard: round(count / (leftCount + rightCount - count)),
-            lift: round((count * commits.length) / (leftCount * rightCount)),
-            confidence: round(Math.max(leftConfidence, rightConfidence)),
-            leftConfidence: round(leftConfidence),
-            rightConfidence: round(rightConfidence),
-        })
-    }
-    return {pairs: pairs.sort(pairSort), totalCandidates: counts.size, truncated}
-}
-
-export function buildGitHistoryAnalytics({commits = [], graph = {}, window, limits = {}, status = 'complete'} = {}) {
-    const maxPairs = boundedHistoryInteger(limits.maxPairs, DEFAULTS.maxPairs, 1, HARD_CAPS.maxPairs)
-    const minPairCount = boundedHistoryInteger(limits.minPairCount, DEFAULTS.minPairCount, 1, 100)
-    const maxPairCandidates = boundedHistoryInteger(limits.maxPairCandidates, DEFAULTS.maxPairCandidates, 100, HARD_CAPS.maxPairCandidates)
-    const eligible = commits.filter((commit) => !commit.oversized && commit.files.length > 0)
-    const skipped = commits.filter((commit) => commit.oversized)
-    const activity = fileActivity(eligible, graph)
-    const cochange = coChangePairs(eligible, activity.fileCommits, {minPairCount, maxPairCandidates})
-    const observed = cochange.pairs.slice(0, maxPairs).map((pair) => publicPair(pair, graphDistanceAtMostTwo(pair.left, pair.right, activity.adjacency)))
-    const expectedTestSource = cochange.pairs.filter((pair) => isTestPath(pair.left) !== isTestPath(pair.right)).slice(0, maxPairs).map((pair) => {
-        const test = isTestPath(pair.left) ? pair.left : pair.right
-        const source = test === pair.left ? pair.right : pair.left
-        return {
-            source, test, count: pair.count, jaccard: pair.jaccard, lift: pair.lift, confidence: pair.confidence,
-            sourceConfidence: source === pair.left ? pair.leftConfidence : pair.rightConfidence,
-            testConfidence: test === pair.left ? pair.leftConfidence : pair.rightConfidence,
-            graphDistance: graphDistanceAtMostTwo(source, test, activity.adjacency),
-        }
-    })
-    const hidden = cochange.pairs.filter((pair) => !isTestPath(pair.left) && !isTestPath(pair.right)
-        && activity.graphFiles.has(pair.left) && activity.graphFiles.has(pair.right)
-        && graphDistanceAtMostTwo(pair.left, pair.right, activity.adjacency) === null)
-        .slice(0, maxPairs).map((pair) => publicPair(pair, null))
-    const reasons = [
-        skipped.length ? `${skipped.length} oversized change-set(s) excluded` : null,
-        cochange.truncated ? 'co-change candidate cap reached' : null,
-        status === 'partial' ? 'git output or commit window was truncated' : null,
-    ].filter(Boolean)
-    return {
-        gitHistoryV: GIT_HISTORY_V,
-        status: reasons.length ? 'partial' : status,
-        window: window || null,
-        limits: {maxCommits: limits.maxCommits ?? null, maxFilesPerCommit: limits.maxFilesPerCommit ?? null, maxPairs, minPairCount, maxPairCandidates},
-        completeness: {complete: reasons.length === 0, reasons},
-        totals: {
-            commitsRead: commits.length, commitsAnalyzed: eligible.length, oversizedCommitsSkipped: skipped.length,
-            files: activity.fileChurn.length, additions: activity.additions, deletions: activity.deletions,
-            churn: activity.additions + activity.deletions, binaryChanges: activity.binaryChanges,
-            ignoredFiles: commits.reduce((sum, commit) => sum + (commit.ignoredFiles || 0), 0),
-            invalidPaths: commits.reduce((sum, commit) => sum + (commit.invalidPaths || 0), 0),
-            graphFiles: activity.graphFiles.size,
-        },
-        fileChurn: activity.fileChurn,
-        hotspots: activity.hotspots,
-        coupling: {eligibleCommits: eligible.length, totalCandidates: cochange.totalCandidates, candidatesTruncated: cochange.truncated, observed, expectedTestSource, hidden},
-    }
-}