weavatrix 0.3.13 → 1.0.0

package/src/analysis/internal-audit/supply-chain.js

@@ -1,149 +0,0 @@
-import { collectInstalled } from "../../security/installed.js";
-import { advisoryQueryFingerprint, loadStore, queryStore } from "../../security/advisory-store.js";
-import { matchAdvisories } from "../../security/match.js";
-import { scanMalware } from "../../security/malware-heuristics.js";
-import { classifyTyposquat } from "../../security/typosquat.js";
-import { loadRustAdvisoryReport } from "../../security/rust-advisory-report.js";
-import { makeFinding } from "../findings.js";
-import { packageReachability } from "../package-reachability.js";
-
-const LOWER_SEVERITY = { critical: "high", high: "medium", medium: "low", low: "info", info: "info" };
-
-const removalHint = (pkg) => {
-  if (pkg?.ecosystem === "npm") return `npm uninstall ${pkg.name} and audit what it touched`;
-  if (pkg?.ecosystem === "PyPI") return `remove ${pkg.name} from the Python environment/manifest and audit what it touched`;
-  if (pkg?.ecosystem === "Go") return `remove ${pkg.name} from the Go module graph, run go mod tidy, and audit what it touched`;
-  if (pkg?.ecosystem === "crates.io") return `cargo remove ${pkg.name}, rebuild every feature/target, and audit what it touched`;
-  if (pkg?.ecosystem === "Maven") return `remove or upgrade ${pkg.name} in Maven/Gradle, refresh the resolved graph, and audit what it touched`;
-  return `remove ${pkg?.name || "the package"} with its ecosystem's package manager and audit what it touched`;
-};
-
-export async function runSupplyChainChecks(repoPath, {
-  externalImports = [],
-  packageScopes = [],
-  isNonProductPath = () => false,
-  advisoryStorePath,
-  skipMalwareScan = false,
-  malwareExclusions = {},
-  rgPath = "",
-} = {}) {
-  const findings = [];
-  let advisoryDbDate = null;
-  let installedCount = 0;
-  let inst = { installed: [], drift: [] };
-  const checks = {
-    osv: { status: "NOT_CHECKED", detail: "Advisory cache was never refreshed for this repository. The MIT core remains offline; use the separate Weavatrix Online connector only if you choose to query OSV with pinned package names and versions." },
-    malware: { status: skipMalwareScan ? "NOT_CHECKED" : "PENDING", detail: skipMalwareScan ? "Installed-package malware scan is opt-in and was not requested." : "" },
-    rustsec: { status: "NOT_CHECKED", detail: "No saved cargo audit --json report was inspected." },
-  };
-
-  try {
-    inst = collectInstalled(repoPath);
-    installedCount = inst.installed.length;
-    const store = advisoryStorePath ? loadStore(advisoryStorePath) : loadStore();
-    const repoStamp = store.meta?.repos?.[repoPath] || null;
-    advisoryDbDate = typeof repoStamp === "string" ? repoStamp : repoStamp?.fetched_at || null;
-    if (advisoryDbDate) {
-      let status = typeof repoStamp === "object" && ["OK", "PARTIAL", "ERROR"].includes(repoStamp.status) ? repoStamp.status : "PARTIAL";
-      const fingerprintMatches = typeof repoStamp === "object" && repoStamp.query_fingerprint === advisoryQueryFingerprint(inst.installed);
-      if (!fingerprintMatches && status === "OK") status = "PARTIAL";
-      const coverage = typeof repoStamp === "object" && Number.isFinite(repoStamp.queried)
-        ? ` (${repoStamp.queried_ok ?? repoStamp.queried}/${repoStamp.queried} package versions queried successfully)`
-        : "";
-      const drift = fingerprintMatches ? "" : " Dependency versions changed, or this is a legacy stamp without a package fingerprint; refresh through the separate Weavatrix Online connector for complete advisory coverage.";
-      checks.osv = {
-        status,
-        detail: `${status === "PARTIAL" ? "Partially matched" : "Matched"} installed packages against the cached OSV snapshot from ${advisoryDbDate}${coverage}.${drift}`,
-        checkedAt: advisoryDbDate,
-      };
-      for (const hit of matchAdvisories(inst.installed, (ecosystem, name) => queryStore(store, ecosystem, name))) {
-        const malicious = hit.adv.kind === "malicious";
-        const reachability = packageReachability(externalImports, hit.pkg.name, { isNonProductPath });
-        const observedInProduct = reachability.state === "DIRECT_RUNTIME_IMPORT";
-        const reachabilityDetail = observedInProduct
-          ? ` Graph reachability: directly imported by product code in ${reachability.directRuntimeImports} callsite(s) across ${reachability.files.length} file(s).`
-          : ` Graph reachability: ${reachability.state}; ${reachability.note}`;
-        findings.push(makeFinding({
-          category: malicious ? "malware" : "vulnerability",
-          rule: malicious ? "malicious-package" : "known-vuln",
-          severity: malicious || observedInProduct ? (malicious ? "critical" : hit.adv.severity) : LOWER_SEVERITY[hit.adv.severity] || hit.adv.severity,
-          confidence: malicious || observedInProduct ? hit.confidence : "low",
-          title: `${malicious ? "Known-malicious package" : `Known vulnerability (${hit.adv.id})`}: ${hit.pkg.name}@${hit.pkg.version}`,
-          detail: `${hit.adv.summary || hit.adv.id}${hit.adv.fixedIn.length ? ` Fixed in: ${hit.adv.fixedIn.join(", ")}.` : malicious ? " Remove this package immediately and rotate any secrets it could reach." : ""} (matched by ${hit.matchedBy}${hit.adv.aliases.length ? `; aliases ${hit.adv.aliases.join(", ")}` : ""}).${reachabilityDetail}`,
-          package: hit.pkg.name,
-          version: hit.pkg.version,
-          reachability,
-          evidence: [
-            { file: hit.adv.id, line: 0, snippet: `installed via ${hit.pkg.source}${hit.pkg.dev ? " (dev)" : ""}` },
-            ...reachability.evidence.slice(0, 5).map((item) => ({ file: item.file, line: item.line, snippet: `${item.typeOnly ? "type-only " : ""}${item.kind}` })),
-          ],
-          source: "osv",
-          fixHint: malicious
-            ? removalHint(hit.pkg)
-            : hit.adv.fixedIn.length
-              ? `upgrade ${hit.pkg.name} to ${hit.adv.fixedIn.at(-1)}+ with its ecosystem's package manager`
-              : "no fixed version published; consider replacing the package",
-        }));
-      }
-    }
-    const directDependencyNames = new Set(packageScopes.flatMap((scope) => Object.keys({ ...(scope.pkg?.dependencies || {}), ...(scope.pkg?.devDependencies || {}) })));
-    for (const name of directDependencyNames) {
-      const candidate = classifyTyposquat(name);
-      if (!candidate) continue;
-      findings.push(makeFinding({
-        category: "malware",
-        rule: "typosquat",
-        severity: "medium",
-        confidence: "low",
-        title: `Possible typosquat: ${name} (looks like "${candidate.nearest}")`,
-        detail: `Direct dependency "${name}" is edit-distance ${candidate.distance} from the popular package "${candidate.nearest}". Confirm you meant "${name}" and not "${candidate.nearest}" — name-confusion is a common supply-chain lure.`,
-        package: name,
-        source: "internal",
-        fixHint: `verify "${name}" is the intended package (not a typo of "${candidate.nearest}")`,
-      }));
-    }
-    for (const item of inst.drift.slice(0, 20)) {
-      findings.push(makeFinding({
-        category: "malware",
-        rule: "lockfile-drift",
-        severity: "low",
-        confidence: "medium",
-        title: `Lockfile drift: ${item.name} (locked ${item.locked}, installed ${item.installed})`,
-        detail: "The version on disk differs from the lockfile — a stale install, a manual edit, or (worst case) tampering. Reinstall from the lockfile to realign.",
-        package: item.name,
-        version: item.installed,
-        source: "internal",
-        fixHint: "npm ci (clean install from the lockfile)",
-      }));
-    }
-    const rustsec = loadRustAdvisoryReport(repoPath);
-    checks.rustsec = { status: rustsec.status, detail: rustsec.detail, checkedAt: rustsec.checkedAt || null };
-    for (const issue of rustsec.findings) {
-      findings.push(makeFinding({
-        category: "vulnerability", rule: issue.kind === "vulnerability" ? "known-vuln" : "rust-advisory-warning",
-        severity: issue.kind === "vulnerability" ? "high" : "medium", confidence: "high",
-        title: `${issue.id}: ${issue.package}${issue.version ? `@${issue.version}` : ""}`,
-        detail: `${issue.title}${issue.patched.length ? ` Patched: ${issue.patched.join(", ")}.` : ""}`,
-        package: issue.package, version: issue.version, source: "rustsec",
-        evidence: issue.url ? [{ file: issue.url, line: 0, snippet: `imported from ${rustsec.file}` }] : [{ file: rustsec.file, line: 0, snippet: issue.id }],
-        fixHint: issue.patched.length ? `upgrade ${issue.package} to a patched RustSec range (${issue.patched.join(", ")})` : `review or replace ${issue.package}; no patched range was reported`,
-      }));
-    }
-  } catch (error) {
-    checks.osv = { status: "ERROR", detail: `Offline advisory matching failed: ${error instanceof Error ? error.message : String(error)}` };
-  }
-
-  let malwareScan = null;
-  if (!skipMalwareScan) {
-    try {
-      const importedPkgs = new Set(externalImports.filter((entry) => entry.pkg && !entry.builtin).map((entry) => entry.pkg));
-      const scan = await scanMalware(repoPath, { installed: inst.installed, importedPkgs, malwareExclusions, rgPath });
-      findings.push(...scan.findings);
-      malwareScan = { scanMode: scan.scanMode, packagesScanned: scan.packagesScanned, findings: scan.findings.length, excludedSignals: scan.excludedSignals || 0 };
-      checks.malware = { status: "OK", detail: `Scanned ${scan.packagesScanned} installed package(s) using ${scan.scanMode}.` };
-    } catch (error) {
-      checks.malware = { status: "ERROR", detail: `Installed-package malware scan failed: ${error instanceof Error ? error.message : String(error)}` };
-    }
-  }
-  return { findings, checks, installedCount, advisoryDbDate, malwareScan };
-}

package/src/analysis/internal-audit.collect.js

@@ -1,213 +0,0 @@
-// internal-audit.collect.js — filesystem collection helpers for the internal audit: source/config
-// text gathering, workspace package names, and the Python manifest reader. Split from internal-audit.js.
-import { readdirSync } from "node:fs";
-import { dirname, join } from "node:path";
-import { createRepoBoundary } from "../repo-path.js";
-import {listRepoFiles, readJson, readRepoJson, readRepoText, readText} from './internal-audit/repo-files.js'
-
-export {listRepoFiles, readJson, readRepoJson, readRepoText, readText} from './internal-audit/repo-files.js'
-export {collectPyManifest} from './internal-audit/python-manifests.js'
-const SOURCE_EXT_RE = /\.(?:[cm]?[jt]sx?|py|go|java|rs|cs|vue|svelte)$/i;
-
-const NON_RUNTIME_DIR_RE = /^(?:templates?|examples?|samples?|fixtures?|snippets?|__fixtures__)$/i;
-const NON_RUNTIME_README_RE = /(?:\b(?:reusable|copyable|reference)\b[\s\S]{0,160}\b(?:templates?|snippets?|examples?|samples?)\b|\b(?:these|contents?)\s+are\s+templates?\b)/i;
-const normConfiguredRoot = (value) => {
-  const root = String(value || "").trim().replace(/\\/g, "/").replace(/^\.\//, "").replace(/^\/+|\/+$/g, "");
-  if (!root || root === "." || root.split("/").some((part) => part === "..")) return "";
-  return root;
-};
-
-// Runtime health findings should not treat copy-paste catalogs as deployed applications. Conventional
-// template/example directories are safe to infer; a top-level custom catalog is inferred only when its
-// own README explicitly describes reusable templates/snippets. Projects can declare additional roots in
-// `.weavatrix-deps.json` through `nonRuntimeRoots` / `templateRoots`.
-export function collectNonRuntimeRoots(repoRoot, rules = {}) {
-  const files = listRepoFiles(repoRoot);
-  const roots = new Set();
-  const configured = [
-    rules.nonRuntimeRoots, rules.templateRoots,
-    rules.dependencies?.nonRuntimeRoots, rules.dependencies?.templateRoots,
-  ].flatMap((value) => Array.isArray(value) ? value : typeof value === "string" ? [value] : []);
-  for (const value of configured) {
-    const root = normConfiguredRoot(value);
-    if (root) roots.add(root);
-  }
-
-  for (const file of files) {
-    const parts = file.replace(/\\/g, "/").split("/");
-    for (let i = 0; i < parts.length - 1; i++) {
-      if (NON_RUNTIME_DIR_RE.test(parts[i])) roots.add(parts.slice(0, i + 1).join("/"));
-    }
-  }
-
-  const boundary = createRepoBoundary(repoRoot);
-  for (const file of files) {
-    if (!/^[^/]+\/README\.md$/i.test(file)) continue; // custom inference is deliberately top-level only
-    const text = readRepoText(boundary, file);
-    if (text != null && NON_RUNTIME_README_RE.test(text)) roots.add(normRoot(dirname(file)));
-  }
-  return [...roots].filter(Boolean).sort((a, b) => a.localeCompare(b));
-}
-
-export function collectSourceTexts(repoRoot, graph) {
-  const sources = new Map();
-  const boundary = createRepoBoundary(repoRoot);
-  const add = (rel) => {
-    const file = String(rel || "").replace(/\\/g, "/");
-    if (!file || sources.has(file)) return;
-    const resolved = boundary.resolve(file);
-    if (!resolved.ok) return;
-    const text = readText(resolved.path);
-    if (text != null) sources.set(file, text);
-  };
-
-  for (const n of graph.nodes || []) add(n.source_file);
-
-  for (const file of listRepoFiles(repoRoot)) if (SOURCE_EXT_RE.test(file)) add(file);
-  return sources;
-}
-
-// Root config files whose TEXT keeps a dependency "mentioned" (dep-check downgrades/skips those).
-// package.json is deliberately ABSENT — every declared dep appears there, it would blank all findings;
-// its scripts are passed to dep-check separately via pkg.
-const CONFIG_FILES = [
-  "tsconfig.json", "jsconfig.json",
-  ".eslintrc", ".eslintrc.json", ".eslintrc.js", ".eslintrc.cjs", "eslint.config.js", "eslint.config.mjs",
-  ".babelrc", "babel.config.js", "babel.config.cjs",
-  "jest.config.js", "jest.config.ts", "jest.config.cjs", "jest.config.mjs",
-  "vite.config.js", "vite.config.ts", "vite.config.mjs", "vitest.config.js", "vitest.config.ts",
-  "webpack.config.js", "rollup.config.js", "esbuild.config.js",
-  "postcss.config.js", "postcss.config.cjs", "postcss.config.mjs", "postcss.config.ts",
-  "tailwind.config.js", "tailwind.config.cjs", "tailwind.config.mjs", "tailwind.config.ts",
-  ".prettierrc", ".prettierrc.json", "prettier.config.js",
-  "playwright.config.js", "playwright.config.ts", "cypress.config.js", "cypress.config.ts",
-  "next.config.js", "next.config.mjs", "nuxt.config.ts", "svelte.config.js", "astro.config.mjs",
-  "angular.json", "nest-cli.json", ".mocharc.json", ".mocharc.yml",
-  "commitlint.config.js", ".lintstagedrc", ".lintstagedrc.json", "knip.json", ".releaserc",
-  "electron-builder.yml", "electron-builder.json", "serverless.yml", "Dockerfile", "docker-compose.yml",
-  // python tool configs (pyproject.toml is deliberately absent — it DECLARES deps, scanning it would blank findings)
-  "tox.ini", "pytest.ini", "setup.cfg", ".pre-commit-config.yaml", "Makefile", "Procfile",
-];
-
-export function collectConfigTexts(repoRoot) {
-  const map = new Map();
-  const boundary = createRepoBoundary(repoRoot);
-  const names = new Set(CONFIG_FILES.map((f) => f.toLowerCase()));
-  for (const f of listRepoFiles(repoRoot)) {
-    const base = f.slice(f.lastIndexOf("/") + 1).toLowerCase();
-    if (!names.has(base) && !/^\.github\/workflows\/.*\.ya?ml$/i.test(f)) continue;
-    const t = readRepoText(boundary, f);
-    if (t != null) map.set(f, t);
-  }
-  return map;
-}
-
-function readJsonc(text) {
-  if (text == null) return null;
-  try {
-    const input = String(text).replace(/^\uFEFF/, "");
-    let clean = "", inString = false, escaped = false;
-    for (let i = 0; i < input.length; i++) {
-      const ch = input[i], next = input[i + 1];
-      if (inString) {
-        clean += ch;
-        if (escaped) escaped = false;
-        else if (ch === "\\") escaped = true;
-        else if (ch === '"') inString = false;
-        continue;
-      }
-      if (ch === '"') { inString = true; clean += ch; continue; }
-      if (ch === "/" && next === "/") {
-        while (i < input.length && input[i] !== "\n") i++;
-        clean += "\n";
-        continue;
-      }
-      if (ch === "/" && next === "*") {
-        i += 2;
-        while (i < input.length && !(input[i] === "*" && input[i + 1] === "/")) i++;
-        i++;
-        continue;
-      }
-      clean += ch;
-    }
-    clean = clean.replace(/,\s*([}\]])/g, "$1");
-    return JSON.parse(clean);
-  } catch { return null; }
-}
-
-const normRoot = (root) => {
-  const value = String(root || "").replace(/\\/g, "/").replace(/^\.\//, "").replace(/^\/+|\/+$/g, "");
-  return value === "." ? "" : value;
-};
-const inScope = (file, root) => !root || file === root || file.startsWith(`${root}/`);
-
-function aliasesForScope(repoRoot, root, files, boundary, scopeRoots) {
-  const ownerOf = (file) => scopeRoots.find((candidate) => inScope(file, candidate)) ?? "";
-  const configs = files
-    .filter((f) => ownerOf(f) === root && /(^|\/)(?:tsconfig|jsconfig)(?:\.[^/]+)?\.json$/i.test(f))
-    .filter((f) => normRoot(dirname(f)) === root)
-    .sort((a, b) => Number(!/(^|\/)(?:tsconfig|jsconfig)\.json$/i.test(a)) - Number(!/(^|\/)(?:tsconfig|jsconfig)\.json$/i.test(b)) || a.localeCompare(b));
-  const aliases = new Map();
-  for (const config of configs) {
-    const cfg = readJsonc(readRepoText(boundary, config));
-    const paths = cfg?.compilerOptions?.paths || {};
-    for (const key of Object.keys(paths)) if (!aliases.has(key)) aliases.set(key, {
-      key,
-      prefix: String(key).replace(/\*.*$/, ""),
-      suffix: String(key).includes("*") ? String(key).slice(String(key).indexOf("*") + 1) : "",
-      config,
-    });
-  }
-  return [...aliases.values()];
-}
-
-// Every package.json defines a dependency scope. The nearest ancestor manifest owns an import, matching
-// npm workspace/package semantics. Aliases are collected from that scope's tsconfig/jsconfig so `@/*`
-// remains local rather than becoming a phantom npm package.
-export function collectPackageScopes(repoRoot, rootPkg = null) {
-  const boundary = createRepoBoundary(repoRoot);
-  const files = listRepoFiles(repoRoot);
-  const manifests = files.filter((f) => /(^|\/)package\.json$/i.test(f));
-  if (!manifests.includes("package.json") && rootPkg) manifests.unshift("package.json");
-  const uniqueManifests = [...new Set(manifests)];
-  const scopeRoots = uniqueManifests
-    .map((manifest) => manifest === "package.json" ? "" : normRoot(dirname(manifest)))
-    .sort((a, b) => b.length - a.length);
-  const scopes = [];
-  for (const manifest of uniqueManifests) {
-    const root = manifest === "package.json" ? "" : normRoot(dirname(manifest));
-    const pkg = manifest === "package.json" && rootPkg ? rootPkg : readRepoJson(boundary, manifest);
-    if (!pkg || typeof pkg !== "object") continue;
-    scopes.push({ root, manifest, pkg, aliases: aliasesForScope(repoRoot, root, files, boundary, scopeRoots) });
-  }
-  if (!scopes.some((s) => !s.root)) scopes.push({ root: "", manifest: "package.json", pkg: rootPkg || {}, aliases: aliasesForScope(repoRoot, "", files, boundary, [...scopeRoots, ""]) });
-  return scopes.sort((a, b) => b.root.length - a.root.length);
-}
-
-// Monorepo-local package names: "packages/*"-style workspace globs → each child's package.json name.
-// Those are importable without being declared — never "missing" deps.
-export function workspacePkgNames(repoRoot, pkg) {
-  const names = new Set();
-  const boundary = createRepoBoundary(repoRoot);
-  const globs = Array.isArray(pkg.workspaces) ? pkg.workspaces : (pkg.workspaces && pkg.workspaces.packages) || [];
-  for (const g of globs) {
-    const base = String(g).replace(/\/?\*+.*$/, "");
-    let dirs = [];
-    if (/\*/.test(String(g))) {
-      try {
-        const resolvedBase = boundary.resolve(base || ".");
-        if (!resolvedBase.ok) continue;
-        dirs = readdirSync(resolvedBase.path).map((d) => join(base, d));
-      } catch { continue; }
-    }
-    else dirs = [String(g)];
-    for (const d of dirs) {
-      const p = readRepoJson(boundary, join(d, "package.json"));
-      if (p && p.name) names.add(p.name);
-    }
-  }
-  for (const scope of collectPackageScopes(repoRoot, pkg)) if (scope.pkg?.name) names.add(scope.pkg.name);
-  return names;
-}
-
-export const TEST_FILE_RE = /(^|[/])(test|tests|__tests__|spec|e2e|__mocks__)([/]|$)|[._-](test|spec)\.[a-z0-9]+$/i;

package/src/analysis/internal-audit.js

@@ -1,9 +0,0 @@
-// internal-audit.js — façade over the internal analyzers: loads a repo's graph.json + package.json,
-// runs dead-check (files) + computeUnusedExports + dep-check, and emits the unified findings envelope
-// (DEPS_SECURITY_PLAN.md §2.2-2.3). ALL filesystem access lives here; the analyzers stay pure.
-// P2 will add dep-rules (cycles/orphans/boundary); the security/ analyzers join in P4-P5.
-// Split: fs collection helpers live in internal-audit.collect.js, reachability in
-// internal-audit.reach.js, and the audit runner in internal-audit.run.js — this file
-// re-exports the public surface so external import paths keep working unchanged.
-export { collectSourceTexts } from "./internal-audit.collect.js";
-export { runInternalAudit } from "./internal-audit.run.js";

package/src/analysis/internal-audit.reach.js

@@ -1,173 +0,0 @@
-// internal-audit.reach.js — entry-point discovery + file-level reachability BFS for the internal
-// audit. Split from internal-audit.js.
-import { posix } from "node:path";
-import { ENTRY_FILE, isFrameworkEntryFile } from "./dead-check.js";
-import { TEST_FILE_RE } from "./internal-audit.collect.js";
-import { maskJavaNonCode } from "./java-source.js";
-
-const isFileNode = (n) => !String(n.id).includes("#");
-
-const springAnnotation = (name) => new RegExp(`@(?:[A-Za-z_$][\\w$]*\\s*\\.\\s*)*${name}\\b`);
-const SPRING_CONVENTIONS = [
-  ["SpringBootApplication", "high", "Spring Boot application entry point is launched externally and starts component scanning"],
-  ["RestControllerAdvice", "high", "Spring registers @RestControllerAdvice through application-context scanning"],
-  ["ControllerAdvice", "high", "Spring registers @ControllerAdvice through application-context scanning"],
-  ["RestController", "high", "Spring registers @RestController through component scanning and routes requests to it"],
-  ["Controller", "high", "Spring registers @Controller through component scanning"],
-  ["Configuration", "high", "Spring discovers @Configuration and invokes its bean definitions externally"],
-  ["Service", "high", "Spring registers @Service through component scanning"],
-  ["Repository", "high", "Spring registers @Repository through component scanning or repository proxy creation"],
-  ["Component", "high", "Spring registers @Component through component scanning"],
-  ["ConfigurationProperties", "high", "Spring binds @ConfigurationProperties outside the static import graph"],
-  ["KafkaListener", "high", "Spring Kafka invokes @KafkaListener methods from the message container"],
-  ["Scheduled", "high", "Spring invokes @Scheduled methods from its task scheduler"],
-  ["EventListener", "high", "Spring invokes @EventListener methods from the application event bus"],
-];
-
-// Framework-managed Java files are externally entered by the Spring container, not by an ordinary
-// source import. Return bounded, explainable evidence so suppressing an orphan is never a silent guess.
-export function springConventionEntries(sources, fileSet = null) {
-  const out = [];
-  for (const [rawFile, rawText] of sources || []) {
-    const file = String(rawFile || "").replace(/\\/g, "/");
-    if (!/\.java$/i.test(file) || (fileSet && !fileSet.has(file))) continue;
-    const text = maskJavaNonCode(rawText);
-    let evidence = null;
-    for (const [marker, confidence, reason] of SPRING_CONVENTIONS) {
-      if (springAnnotation(marker).test(text)) {
-        evidence = { file, framework: "spring", marker: `@${marker}`, confidence, reason };
-        break;
-      }
-    }
-    if (!evidence && /\binterface\s+[A-Za-z_$][\w$]*(?:\s*<[^>{}]+>)?\s+extends\s+[^;{]*(?:JpaRepository|MongoRepository|ReactiveCrudRepository|CrudRepository|PagingAndSortingRepository|Repository)\s*</s.test(text)) {
-      evidence = {
-        file,
-        framework: "spring-data",
-        marker: "repository interface",
-        confidence: "high",
-        reason: "Spring Data creates the repository implementation and proxy from the interface at runtime",
-      };
-    }
-    if (evidence) out.push(evidence);
-  }
-  return out.sort((a, b) => a.file.localeCompare(b.file));
-}
-
-// Entry set for reachability: conventional entry names + package.json main/module/browser/bin/exports +
-// html pages (they root classic-script apps) + test files (the runner enters them) + root config files +
-// dynamic-import targets. Anything reachable from here is "used"; the rest corroborates unused-file.
-export function entryFiles(graph, pkgOrScopes, dynamicTargets = new Set(), { declaredEntries = [], sources = new Map(), conventionEvidence = [] } = {}) {
-  const entries = new Set();
-  const scopes = Array.isArray(pkgOrScopes)
-    ? pkgOrScopes
-    : [{ root: "", manifest: "package.json", pkg: pkgOrScopes || {} }];
-  const fileSet = new Set((graph.nodes || []).filter(isFileNode).map((n) => String(n.source_file || n.id).replace(/\\/g, "/")));
-  const pe = new Set();
-  const resolveEntry = (root, raw) => {
-    let p = String(raw || "").trim().replace(/^['"]|['"]$/g, "").replace(/^file:/, "").replace(/\\/g, "/");
-    if (!p || p.startsWith("-") || /^https?:/.test(p)) return "";
-    p = p.replace(/^\.\//, "");
-    const joined = posix.normalize(root ? posix.join(root, p) : p).replace(/^\.\//, "");
-    if (fileSet.has(joined)) return joined;
-    for (const ext of [".js", ".mjs", ".cjs", ".ts", ".tsx", ".jsx", ".py"]) if (fileSet.has(joined + ext)) return joined + ext;
-    return joined;
-  };
-  for (const scope of scopes) {
-    const pkg = scope.pkg || {};
-    const root = String(scope.root || "").replace(/\\/g, "/").replace(/^\/+|\/+$/g, "");
-    const pkgEntries = [];
-    for (const k of ["main", "module", "browser"]) if (typeof pkg[k] === "string") pkgEntries.push(pkg[k]);
-    if (pkg.bin) pkgEntries.push(...(typeof pkg.bin === "string" ? [pkg.bin] : Object.values(pkg.bin)));
-    (function walkExports(e) {
-      if (typeof e === "string") pkgEntries.push(e);
-      else if (e && typeof e === "object") Object.values(e).forEach(walkExports);
-    })(pkg.exports);
-    // Script commands are external entry surfaces. Extract only path-shaped source tokens; package names,
-    // flags and shell operators are intentionally ignored.
-    for (const script of Object.values(pkg.scripts || {})) {
-      const re = /(?:^|[\s'"=])((?:\.?\.?\/)?[\w@./-]+\.(?:[cm]?[jt]sx?|py|go))(?=$|[\s'";,)&|])/gi;
-      let m;
-      while ((m = re.exec(String(script)))) pkgEntries.push(m[1]);
-      const runner = /\b(?:node|bun|deno|tsx|ts-node|python\d*|electron)\s+(?!-)([\w@./\\-]+)/gi;
-      while ((m = runner.exec(String(script)))) if (/[./\\]/.test(m[1])) pkgEntries.push(m[1]);
-    }
-    for (const p of pkgEntries) pe.add(resolveEntry(root, p));
-  }
-  for (const n of graph.nodes || []) {
-    if (!isFileNode(n)) continue;
-    const f = n.source_file;
-    if (ENTRY_FILE.test(f) || isFrameworkEntryFile(f) || /\.d\.[cm]?ts$/i.test(f) || TEST_FILE_RE.test(f) || /\.html?$/i.test(f) || pe.has(f) || /(^|\/)[^/]*\.config\.[a-z]+$/i.test(f)) entries.add(f);
-  }
-  // Classic/static HTML pages load scripts, styles and other assets without a
-  // JavaScript import edge. Treat an exact local src/href target as an entry
-  // surface so a deployed asset is not mislabeled orphan/dead.
-  for (const [rawFile, rawText] of sources || []) {
-    const htmlFile = String(rawFile || "").replace(/\\/g, "/");
-    if (!/\.html?$/i.test(htmlFile)) continue;
-    const htmlDir = posix.dirname(htmlFile);
-    const attr = /\b(?:src|href)\s*=\s*["']([^"']+)["']/gi;
-    let match;
-    while ((match = attr.exec(String(rawText || "")))) {
-      const rawTarget = String(match[1] || "").trim().split(/[?#]/, 1)[0];
-      if (!rawTarget || /^(?:[a-z][a-z0-9+.-]*:|\/\/|#)/i.test(rawTarget)) continue;
-      const relative = rawTarget.replace(/^\/+/, "");
-      const candidates = rawTarget.startsWith("/")
-        ? [posix.normalize(posix.join(htmlDir, relative)), posix.normalize(relative)]
-        : [posix.normalize(posix.join(htmlDir, relative))];
-      const target = candidates.find((candidate) => fileSet.has(candidate));
-      if (target) entries.add(target);
-    }
-  }
-  // Drizzle Kit loads schema modules from configuration strings rather than a
-  // runtime import. Resolve the bounded `schema:` value so the schema and its
-  // exported tables are not reported as orphan/test-only production code.
-  for (const [rawFile, rawText] of sources || []) {
-    const configFile = String(rawFile || "").replace(/\\/g, "/");
-    if (!/(^|\/)drizzle(?:\.[^/]*)?\.config\.[cm]?[jt]s$/i.test(configFile)) continue;
-    const value = /\bschema\s*:\s*(\[[\s\S]{0,1000}?\]|["'][^"']+["'])/i.exec(String(rawText || ""))?.[1] || "";
-    const quoted = /["']([^"']+)["']/g;
-    let match;
-    while ((match = quoted.exec(value))) {
-      const candidate = posix.normalize(posix.join(posix.dirname(configFile), match[1].replace(/^\.\//, "")));
-      if (fileSet.has(candidate)) entries.add(candidate);
-    }
-  }
-  for (const evidence of springConventionEntries(sources, fileSet)) {
-    entries.add(evidence.file);
-    conventionEvidence.push(evidence);
-  }
-  for (const raw of Array.isArray(declaredEntries) ? declaredEntries : [declaredEntries]) {
-    const resolved = resolveEntry("", raw);
-    if (resolved && fileSet.has(resolved)) entries.add(resolved);
-  }
-  // Bundled helper programs are often launched by filename (`resolveResource("worker.py")`) rather than
-  // imported. A quoted basename reference from another source file is enough to establish that a code file
-  // under resources/ is a runtime entry, without treating arbitrary prose/config files as roots.
-  for (const file of fileSet) {
-    if (!/(^|\/)resources\/.*\.(?:py|[cm]?[jt]s)$/i.test(file)) continue;
-    const base = posix.basename(file).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-    const quoted = new RegExp(`["'\x60]${base}["'\x60]`);
-    if ([...sources].some(([other, text]) => other !== file && quoted.test(String(text || "")))) entries.add(file);
-  }
-  for (const t of dynamicTargets) entries.add(t);
-  return entries;
-}
-
-// File-level BFS over every non-contains link (symbol endpoints collapse to their file via the id prefix).
-export function computeReachability(graph, entries) {
-  const fileOf = (v) => { const s = String(v && typeof v === "object" ? v.id : v); const h = s.indexOf("#"); return h < 0 ? s : s.slice(0, h); };
-  const adj = new Map();
-  for (const l of graph.links || []) {
-    if (l.relation === "contains") continue;
-    const a = fileOf(l.source), b = fileOf(l.target);
-    if (!a || !b || a === b) continue;
-    (adj.get(a) || adj.set(a, new Set()).get(a)).add(b);
-  }
-  const reached = new Set(entries);
-  const queue = [...entries];
-  while (queue.length) {
-    const cur = queue.pop();
-    for (const nxt of adj.get(cur) || []) if (!reached.has(nxt)) { reached.add(nxt); queue.push(nxt); }
-  }
-  return reached;
-}