weavatrix 0.3.13 → 1.0.0

package/src/analysis/data-flow-evidence.js

@@ -1,114 +0,0 @@
-import {readFileSync} from 'node:fs'
-import {extname} from 'node:path'
-import ts from 'typescript'
-import {createRepoBoundary} from '../repo-path.js'
-
-const lineOfNode = (node) => Number(String(node?.source_location || '').match(/^L(\d+)/i)?.[1] || String(node?.id || '').match(/@(\d+)$/)?.[1] || 0)
-const fileOfNode = (node) => String(node?.source_file || String(node?.id || '').split('#')[0]).replace(/\\/g, '/')
-const cleanName = (value) => String(value || '').replace(/\(\)$/, '').split('.').pop()
-const callName = (node) => node.expression?.name?.text || node.expression?.text || node.expression?.escapedText || ''
-
-function scriptKind(file) {
-  const ext = extname(file).toLowerCase()
-  if (ext === '.tsx') return ts.ScriptKind.TSX
-  if (ext === '.jsx') return ts.ScriptKind.JSX
-  if (ext === '.ts' || ext === '.mts' || ext === '.cts') return ts.ScriptKind.TS
-  return ts.ScriptKind.JS
-}
-
-function parse(cache, boundary, file) {
-  if (cache.has(file)) return cache.get(file)
-  if (!/\.[cm]?[jt]sx?$/i.test(file)) return null
-  const resolved = boundary.resolve(file)
-  if (!resolved.ok) return null
-  try {
-    const source = ts.createSourceFile(file, readFileSync(resolved.path, 'utf8'), ts.ScriptTarget.Latest, true, scriptKind(file))
-    cache.set(file, source)
-    return source
-  } catch { return null }
-}
-
-function parametersFor(source, target) {
-  const expected = cleanName(target?.label)
-  const expectedLine = lineOfNode(target)
-  const choices = []
-  const visit = (node) => {
-    if (Array.isArray(node.parameters) && node.name) {
-      const name = cleanName(node.name.text || node.name.getText?.(source))
-      if (!expected || name === expected) {
-        const line = source.getLineAndCharacterOfPosition(node.getStart(source)).line + 1
-        choices.push({line, parameters: node.parameters.map((item) => item.name.getText(source).slice(0, 80))})
-      }
-    }
-    ts.forEachChild(node, visit)
-  }
-  visit(source)
-  choices.sort((a, b) => Math.abs(a.line - expectedLine) - Math.abs(b.line - expectedLine))
-  return choices[0]?.parameters || []
-}
-
-function callsAt(source, line, expectedName) {
-  const found = []
-  const visit = (node) => {
-    if (ts.isCallExpression(node)) {
-      const at = source.getLineAndCharacterOfPosition(node.getStart(source)).line + 1
-      if ((!line || at === line) && (!expectedName || cleanName(callName(node)) === expectedName)) found.push({node, line: at})
-    }
-    ts.forEachChild(node, visit)
-  }
-  visit(source)
-  return found
-}
-
-// Bounded interprocedural evidence: maps arguments at graph callsites to the callee's declared
-// parameters. This is not a control-flow graph, value propagation, or taint-analysis claim.
-export function extractCallArgumentEvidence({graph, repoRoot, seedIds = [], depth = 2, maxEdges = 40} = {}) {
-  const boundary = createRepoBoundary(repoRoot)
-  const cache = new Map()
-  const queue = (seedIds || []).map((id) => ({id: String(id), hop: 0}))
-  const visited = new Set()
-  const seenCalls = new Set()
-  const edges = []
-  let unsupported = 0
-  while (queue.length && edges.length < maxEdges) {
-    const current = queue.shift()
-    if (visited.has(current.id) || current.hop >= depth) continue
-    visited.add(current.id)
-    const calls = [
-      ...(graph.out.get(current.id) || []).filter((edge) => edge.relation === 'calls')
-        .map((edge) => ({fromId: current.id, toId: String(edge.id), line: Number(edge.line) || 0, nextId: String(edge.id)})),
-      ...(graph.inn.get(current.id) || []).filter((edge) => edge.relation === 'calls')
-        .map((edge) => ({fromId: String(edge.id), toId: current.id, line: Number(edge.line) || 0, nextId: String(edge.id)})),
-    ]
-    for (const callEdge of calls) {
-      const callKey = `${callEdge.fromId}\0${callEdge.toId}\0${callEdge.line}`
-      if (seenCalls.has(callKey)) continue
-      seenCalls.add(callKey)
-      const from = graph.byId.get(callEdge.fromId)
-      const to = graph.byId.get(callEdge.toId)
-      const callerSource = parse(cache, boundary, fileOfNode(from))
-      const targetSource = parse(cache, boundary, fileOfNode(to))
-      if (!from || !to || !callerSource || !targetSource) { unsupported++; continue }
-      const params = parametersFor(targetSource, to)
-      const callsites = callsAt(callerSource, callEdge.line, cleanName(to.label))
-      if (!callsites.length) { unsupported++; continue }
-      for (const call of callsites.slice(0, 3)) {
-        edges.push({
-          from: callEdge.fromId, to: callEdge.toId, hop: current.hop + 1,
-          file: fileOfNode(from), line: call.line,
-          arguments: call.node.arguments.slice(0, 12).map((argument, index) => ({
-            index, expression: argument.getText(callerSource).slice(0, 160), parameter: params[index] || null,
-          })),
-          state: 'EXTRACTED',
-        })
-        if (edges.length >= maxEdges) break
-      }
-      if (current.hop + 1 < depth) queue.push({id: callEdge.nextId, hop: current.hop + 1})
-    }
-  }
-  return {
-    model: 'bounded call-argument-to-parameter evidence (not CFG or taint analysis)',
-    status: edges.length ? (unsupported ? 'PARTIAL' : 'COMPLETE') : 'UNAVAILABLE',
-    edges, unsupportedEdges: unsupported, capped: edges.length >= maxEdges,
-  }
-}

package/src/analysis/dead-check.js

@@ -1,300 +0,0 @@
-// Portable, language-agnostic DEAD-code checker. A symbol is DEAD when it has NO inbound graph edge (nothing
-// calls/imports/references/inherits it) AND its bare name appears NOWHERE in the repo outside its own file.
-// A file is DEAD when nothing imports it, it isn't an entry point, and all its symbols are dead.
-//
-// Pure core `computeDead(graph, sources)` (sources = Map<fileRel, text>) works on any graph-builder-schema graph
-// and is fully testable with no filesystem. It only needs {nodes, links} + source text. See [[graph-builder-internalization]].
-import { posix } from "node:path";
-import { isStructuralRelation } from "../graph/relations.js";
-import { createSqlDeadVerdict } from "../graph/builder/lang-sql.js";
-import { createPathClassifier, hasPathClass } from "../path-classification.js";
-
-const IDENT_RE = /[A-Za-z_$][\w$]*/g;
-const bareName = (label) => String(label || "").replace(/\s*\(.*$/, "").replace(/[()]/g, "").trim();
-// Ignore comment-only lexical mentions, which are documentation rather than callers. Keep strings on
-// purpose: registries/reflection often address a live symbol by name, and static liveness must stay
-// conservative there. This only strips comments that start a logical line, avoiding a language parser
-// guess around inline comment markers, regex literals, or URLs.
-const lexicalEvidenceText = (value) => {
-  let inBlockComment = false;
-  return String(value || "").split(/\r?\n/).map((line) => {
-    let rest = line;
-    while (true) {
-      if (inBlockComment) {
-        const end = rest.indexOf("*/");
-        if (end < 0) return "";
-        inBlockComment = false;
-        rest = rest.slice(end + 2);
-      }
-      const trimmed = rest.trimStart();
-      if (trimmed.startsWith("//") || trimmed.startsWith("#")) return "";
-      if (!trimmed.startsWith("/*")) return rest;
-      inBlockComment = true;
-      rest = trimmed.slice(2);
-    }
-  }).join("\n");
-};
-// entry surfaces are never dead even with no inbound edge (framework/CLI/HTTP enter them externally).
-// Exported for internal-audit.js (reachability entry set) — keep the two in lockstep.
-export const ENTRY_FILE = /(^|[\\/])(index|main|app|server|cli|cmd|bootstrap|entry|run|__main__|manage|wsgi|asgi|setup|conftest)\.[a-z0-9]+$|(^|[\\/])(bin|cmd)[\\/]|(^|[\\/])main\.go$/i;
-const defaultPathClassifier = createPathClassifier(null);
-const isTestFile = (file) => hasPathClass(defaultPathClassifier.explain(file), "test", "e2e");
-
-// Framework-owned entry modules are invoked by convention rather than a source import. Keep this narrow:
-// these are Next.js App/Pages Router surfaces and framework metadata files, not every file under `app/`.
-const NEXT_ENTRY_FILE = /(^|\/)(?:src\/)?app\/(?:.*\/)?(?:page|layout|template|loading|error|global-error|not-found|default|route|robots|sitemap|manifest|opengraph-image|twitter-image|icon|apple-icon)\.[cm]?[jt]sx?$|(^|\/)(?:src\/)?pages\/(?!.*\/(?:components?|lib|utils?)\/).+\.[cm]?[jt]sx?$|(^|\/)(?:middleware|instrumentation)\.[cm]?[jt]s$/i;
-const RUST_ENTRY_FILE = /(^|\/)(?:build\.rs|src\/(?:lib|main)\.rs)$/i;
-export const isFrameworkEntryFile = (file) => {
-  const normalized = String(file || "").replace(/\\/g, "/");
-  return NEXT_ENTRY_FILE.test(normalized) || RUST_ENTRY_FILE.test(normalized);
-};
-
-const lineOfNode = (n) => {
-  const m = /@(\d+)$/.exec(String(n.id || "")) || /L(\d+)/.exec(String(n.source_location || ""));
-  return m ? Number(m[1]) : 0;
-};
-
-// Older graphs marked every method of an exported class as exported. Verify that an `exported` node is
-// actually a module-surface declaration before reporting it. New graphs expose symbol_kind/member_of and
-// already keep members unexported, but the source check preserves correctness for cached v0.1.2 graphs.
-function hasModuleExport(source, node, name) {
-  if (node.member_of || node.symbol_kind === "method") return false;
-  const lines = String(source || "").split(/\r?\n/);
-  const line = lines[Math.max(0, lineOfNode(node) - 1)] || "";
-  const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  const direct = new RegExp(`\\bexport\\s+(?:default\\s+)?(?:(?:declare|abstract|async)\\s+)*(?:function|class|const|let|var|enum|interface|type|namespace)\\s+${escaped}\\b`);
-  if (direct.test(line) || direct.test(String(source || ""))) return true;
-  const exportDefault = new RegExp(`\\bexport\\s+default\\s+${escaped}\\b`);
-  if (exportDefault.test(String(source || ""))) return true;
-  // `export { local }`, `export { local as publicName }` and CommonJS explicit exports.
-  const exportList = new RegExp(`\\bexport\\s*\\{[^}]*\\b${escaped}\\b[^}]*\\}`, "s");
-  const commonJs = new RegExp(`(?:module\\.exports\\s*=\\s*\\{[^}]*\\b${escaped}\\b|(?:module\\.exports|exports)\\.${escaped}\\s*=)`, "s");
-  return exportList.test(String(source || "")) || commonJs.test(String(source || ""));
-}
-
-function namespaceConsumedFiles(sources, graph) {
-  const files = new Set(sources.keys());
-  const consumed = new Set();
-  const extensions = ["", ".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs", ".mts", ".cts"];
-  const resolve = (from, spec) => {
-    if (!spec.startsWith(".")) return "";
-    const base = posix.normalize(posix.join(posix.dirname(from.replace(/\\/g, "/")), spec));
-    for (const ext of extensions) {
-      const p = `${base}${ext}`;
-      if (files.has(p)) return p;
-    }
-    for (const ext of extensions.slice(1)) {
-      const p = `${base}/index${ext}`;
-      if (files.has(p)) return p;
-    }
-    return "";
-  };
-  for (const [file, textValue] of sources) {
-    const text = String(textValue || "");
-    const patterns = [
-      /\bimport\s+\*\s+as\s+[A-Za-z_$][\w$]*\s+from\s*(["'])([^"']+)\1/g,
-      /\bexport\s+\*\s+from\s*(["'])([^"']+)\1/g,
-      /\b(?:const|let|var)\s+[A-Za-z_$][\w$]*\s*=\s*require\(\s*(["'])([^"']+)\1\s*\)/g,
-    ];
-    for (const re of patterns) {
-      let m;
-      while ((m = re.exec(text))) {
-        const target = resolve(file, m[2]);
-        if (target) consumed.add(target);
-      }
-    }
-  }
-  // New graphs retain the exact specifier on file import edges, which also resolves namespace imports
-  // expressed through tsconfig aliases (the relative-path fallback above intentionally cannot guess those).
-  for (const link of graph.links || []) {
-    if (link.relation !== "imports" && link.relation !== "re_exports") continue;
-    const from = String(link.source?.id || link.source || ""), target = String(link.target?.id || link.target || "");
-    if (!link.specifier || from.includes("#") || target.includes("#") || !sources.has(from)) continue;
-    const spec = String(link.specifier).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-    const text = String(sources.get(from) || "");
-    if (new RegExp(`(?:import\\s+\\*\\s+as\\s+[A-Za-z_$][\\w$]*\\s+from|export\\s+\\*\\s+from)\\s*["']${spec}["']`).test(text)) consumed.add(target);
-  }
-  return consumed;
-}
-
-export function computeDead(graph, sources, { entrySet = new Set() } = {}) {
-  const nodes = graph.nodes || [], links = graph.links || [];
-  const ep = (v) => (v && typeof v === "object" ? v.id : v);
-  const inbound = new Set();
-  const inboundSources = new Map();
-  const nodesById = new Map(nodes.map((node) => [String(node.id), node]));
-  for (const l of links) if (!isStructuralRelation(l.relation)) {
-    const target = String(ep(l.target));
-    const source = String(ep(l.source));
-    inbound.add(target);
-    const values = inboundSources.get(target) || [];
-    values.push(source);
-    inboundSources.set(target, values);
-  }
-
-  // whole-repo identifier frequency: a symbol whose name appears MORE than once total (its definition + at least
-  // one use, same-file OR cross-file) is referenced. Errs toward "alive" (common-named symbols never flagged).
-  const globalFreq = new Map();
-  for (const [, text] of sources) for (const m of lexicalEvidenceText(text).matchAll(IDENT_RE)) { const n = m[0]; globalFreq.set(n, (globalFreq.get(n) || 0) + 1); }
-
-  const symById = new Map();
-  const symsByFile = new Map();
-  for (const n of nodes) {
-    if (!String(n.id).includes("#")) continue;
-    symById.set(n.id, n);
-    (symsByFile.get(n.source_file) || symsByFile.set(n.source_file, []).get(n.source_file)).push(n);
-  }
-
-  const symbolNames = new Set([...symById.values()].map((node) => bareName(node.label)).filter(Boolean));
-  const occurrenceFiles = new Map();
-  const occurrenceCounts = new Map();
-  for (const [file, text] of sources) for (const match of lexicalEvidenceText(text).matchAll(IDENT_RE)) {
-    const name = match[0];
-    if (!symbolNames.has(name)) continue;
-    const files = occurrenceFiles.get(name) || new Set();
-    files.add(file);
-    occurrenceFiles.set(name, files);
-    const counts = occurrenceCounts.get(name) || new Map();
-    counts.set(file, (counts.get(file) || 0) + 1);
-    occurrenceCounts.set(name, counts);
-  }
-
-  const declarationCounts = new Map();
-  for (const node of symById.values()) {
-    const name = bareName(node.label);
-    if (!name) continue;
-    const key = `${node.source_file}\0${name}`;
-    declarationCounts.set(key, (declarationCounts.get(key) || 0) + 1);
-  }
-  const exactReferenceIds = new Set(graph.precisionReferenceSymbols || []);
-  const exactProductionReferenceIds = new Set(graph.precisionProductionReferenceSymbols || []);
-  const exactTestReferenceIds = new Set(graph.precisionTestReferenceSymbols || []);
-
-  // decorated defs (@app.route/@app.event/@pytest.fixture…) are entered by the framework: trust the
-  // builder's flag when present, else walk the source line(s) above the definition (graph-builder graphs).
-  const lineCache = new Map();
-  const linesOf = (f) => { let l = lineCache.get(f); if (!l) { l = String(sources.get(f) || "").split(/\r?\n/); lineCache.set(f, l); } return l; };
-  const symLine = (n) => { const m = /@(\d+)$/.exec(String(n.id)) || /L(\d+)/.exec(String(n.source_location || "")); return m ? Number(m[1]) : 0; };
-  const isDecorated = (n) => {
-    if (n.decorated) return true;
-    const ln = symLine(n);
-    if (!ln) return false;
-    const lines = linesOf(n.source_file);
-    for (let i = ln - 2; i >= 0 && i >= ln - 6; i--) {
-      const t = (lines[i] || "").trim();
-      if (t.startsWith("@")) return true;
-      if (t === "" || t.startsWith("#")) continue;
-      break;
-    }
-    return false;
-  };
-
-  const isReferenced = (n) => {
-    if (inbound.has(n.id)) return true;                          // a real graph edge targets it
-    if (exactReferenceIds.has(String(n.id))) return true;        // revision-bound point-query evidence found a caller
-    const name = bareName(n.label);
-    if (!name || !/^[A-Za-z_$]/.test(name)) return true;         // selectors/odd labels → don't flag
-    if (/^__\w+__$/.test(name)) return true;                     // dunders are invoked implicitly (with/str/==/iter…), never spelled
-    if ((globalFreq.get(name) || 0) > 1) return true;            // name appears beyond its single definition
-    return isDecorated(n);                                       // framework-registered via decorator
-  };
-
-  const sqlVerdict = createSqlDeadVerdict({ nodes, links, ep, bareName });   // gated SQL verdicts — ORM blindness stays silent
-  const deadSymbols = [];
-  for (const n of symById.values()) {
-    if (isReferenced(n) || sqlVerdict.veto(n)) continue;
-    deadSymbols.push({ id: n.id, file: n.source_file, label: n.label, test: isTestFile(n.source_file) || n.test_surface === true, reason: sqlVerdict.reason(n) || "no inbound edge and name unreferenced outside its file" });
-  }
-  const deadSet = new Set(deadSymbols.map((s) => s.id));
-
-  // A production declaration consumed only by tests is live to the raw graph but dead to production.
-  // Keep it in a separate review class: this is useful evidence, never an automatic delete verdict.
-  const testOnlySymbols = [];
-  const consumerFileOf = (id) => nodesById.get(id)?.source_file || (id.includes("#") ? id.split("#")[0] : id);
-  const isTestConsumer = (id) => nodesById.get(id)?.test_surface === true || isTestFile(consumerFileOf(id));
-  for (const n of symById.values()) {
-    if (deadSet.has(n.id) || isTestFile(n.source_file) || n.test_surface === true || isDecorated(n)) continue;
-    const sourcesForSymbol = inboundSources.get(String(n.id)) || [];
-    const hasTestInbound = sourcesForSymbol.some(isTestConsumer);
-    const hasProductionInbound = sourcesForSymbol.some((id) => consumerFileOf(id) && !isTestConsumer(id));
-    const name = bareName(n.label);
-    const occurrenceSet = occurrenceFiles.get(name) || new Set();
-    const externalOccurrences = [...occurrenceSet].filter((file) => file !== n.source_file);
-    const localOccurrences = occurrenceCounts.get(name)?.get(n.source_file) || 0;
-    const localDeclarations = declarationCounts.get(`${n.source_file}\0${name}`) || 0;
-    const hasLocalProductionUse = localOccurrences > localDeclarations;
-    const lexicalTestOnly = externalOccurrences.length > 0 && externalOccurrences.every((file) => isTestFile(file));
-    const hasExactProductionInbound = exactProductionReferenceIds.has(String(n.id));
-    const hasExactTestInbound = exactTestReferenceIds.has(String(n.id));
-    if (hasProductionInbound || hasExactProductionInbound || hasLocalProductionUse
-      || (!hasTestInbound && !hasExactTestInbound && !lexicalTestOnly)) continue;
-    testOnlySymbols.push({
-      id: n.id,
-      file: n.source_file,
-      label: n.label,
-      test: false,
-      reason: "referenced only from test/e2e code; no production consumer was found",
-      testConsumerFiles: [...new Set(sourcesForSymbol.filter(isTestConsumer).map(consumerFileOf).filter(Boolean))].sort(),
-      evidence: hasTestInbound ? "graph" : hasExactTestInbound ? "exact-semantic" : "lexical",
-      publicApi: n.exported === true || ["public", "protected"].includes(String(n.visibility || "").toLowerCase()),
-    });
-  }
-
-  const deadFiles = [];
-  for (const n of nodes) {
-    if (String(n.id).includes("#")) continue;                   // file nodes only
-    if (inbound.has(n.id) || ENTRY_FILE.test(n.source_file) || isFrameworkEntryFile(n.source_file) || entrySet.has(n.source_file)) continue;
-    const syms = symsByFile.get(n.source_file) || [];
-    if (syms.length && syms.every((s) => deadSet.has(s.id))) deadFiles.push({ file: n.source_file, reason: "not imported; all symbols unreferenced" });
-  }
-
-  return {
-    deadSymbols,
-    testOnlySymbols,
-    deadFiles,
-    referencedIds: [...symById.values()].filter(isReferenced).map((n) => n.id),
-    stats: { symbols: symById.size, deadSymbols: deadSymbols.length, testOnlySymbols: testOnlySymbols.length, files: nodes.filter((n) => !String(n.id).includes("#")).length, deadFiles: deadFiles.length },
-  };
-}
-
-// Export-scoped unused check (knip's "unused exports"): an EXPORTED symbol (P0's exported:true flag)
-// with no inbound non-contains edge whose bare name occurs in NO file other than its own. Same-file-only
-// usage means the symbol is alive but the export is not — still worth surfacing. Pure like computeDead.
-// dynamicTargets = files reached via dynamic import() — their exports are consumed at runtime, skip them.
-export function computeUnusedExports(graph, sources, { dynamicTargets = new Set(), entrySet = new Set() } = {}) {
-  const nodes = graph.nodes || [], links = graph.links || [];
-  const ep = (v) => (v && typeof v === "object" ? v.id : v);
-  const inbound = new Set();
-  for (const l of links) if (!isStructuralRelation(l.relation)) inbound.add(ep(l.target));
-
-  const namespaceConsumed = namespaceConsumedFiles(sources, graph);
-  const candidates = [];
-  const wanted = new Set();
-  for (const n of nodes) {
-    if (!n.exported || !String(n.id).includes("#") || inbound.has(n.id)) continue;
-    if (ENTRY_FILE.test(n.source_file) || isFrameworkEntryFile(n.source_file) || entrySet.has(n.source_file) || dynamicTargets.has(n.source_file) || namespaceConsumed.has(n.source_file)) continue;
-    const nm = bareName(n.label);
-    if (!nm || !/^[A-Za-z_$]/.test(nm)) continue;
-    if (!hasModuleExport(sources.get(n.source_file), n, nm)) continue;
-    candidates.push({ n, nm });
-    wanted.add(nm);
-  }
-  if (!candidates.length) return [];
-
-  const occursIn = new Map(); // name -> Set(files whose text contains it)
-  for (const [file, text] of sources) {
-    for (const m of String(text || "").matchAll(IDENT_RE)) {
-      const w = m[0];
-      if (!wanted.has(w)) continue;
-      (occursIn.get(w) || occursIn.set(w, new Set()).get(w)).add(file);
-    }
-  }
-
-  const out = [];
-  for (const { n, nm } of candidates) {
-    const occ = occursIn.get(nm);
-    if (occ && [...occ].some((f) => f !== n.source_file)) continue; // referenced beyond its own file → alive
-    out.push({ id: n.id, file: n.source_file, label: n.label, test: isTestFile(n.source_file), reason: "exported but never imported or referenced outside its own file" });
-  }
-  return out;
-}

package/src/analysis/dead-code-review/candidates.js

@@ -1,194 +0,0 @@
-// Per-candidate review records for the dead-code review queue, split out of dead-code-review.js so the
-// orchestrator stays within the file budget. The confidence, caveat, evidence and verification model is
-// unchanged; symbolCandidate and fileCandidate are pure over the context built by computeDeadCodeReview.
-import { isFrameworkEntryFile } from "../dead-check.js";
-import {
-  hasDynamicCode, REFLECTION_CODE_RE as REFLECTION_RE, normalizedReviewPath as normalizedPath,
-} from "./policy.js";
-
-const lineOf = (node) => {
-  const match = /@(\d+)$/.exec(String(node?.id || "")) || /L(\d+)/.exec(String(node?.source_location || ""));
-  return match ? Number(match[1]) : 0;
-};
-const bareLabel = (value) => String(value || "").replace(/\s*\(.*$/, "").replace(/[()]/g, "").trim();
-
-function kindOf(node) {
-  const symbolKind = String(node?.symbol_kind || "").toLowerCase();
-  if (symbolKind === "method" || symbolKind === "constructor") return "method";
-  if (["function", "function_definition", "func", "fn"].includes(symbolKind)) return "function";
-  // Old graphs may not retain symbol_kind. Only use call syntax as a compatibility fallback;
-  // member_of alone also describes fields and must never promote them to methods.
-  if (!symbolKind && /\([^)]*\)\s*$/.test(String(node?.label || ""))) return node?.member_of ? "method" : "function";
-  return "symbol";
-}
-
-function isPublicSurface(node) {
-  const visibility = String(node?.visibility || "").toLowerCase();
-  return node?.exported === true || visibility === "public" || visibility === "protected";
-}
-
-export function symbolCandidate(item, node, context) {
-  const file = normalizedPath(item.file);
-  const source = String(context.sources.get(file) || "");
-  const pathInfo = context.classify(file, source);
-  const publicSurface = isPublicSurface(node);
-  const testOnly = item.testOnly === true;
-  const externalEntry = context.entrySet.has(file) || isFrameworkEntryFile(file);
-  const framework = context.frameworkByFile.get(file) || null;
-  const dynamicFile = context.dynamicTargets.has(file) || hasDynamicCode(source, file);
-  const reflectionFile = REFLECTION_RE.test(source);
-  const kind = kindOf(node);
-  const exactNoReference = context.exactNoReferenceIds.has(String(item.id));
-  const internallyScoped = String(node?.visibility || "").toLowerCase() === "private"
-    || (!publicSurface && ["method", "function"].includes(kind));
-  // Static absence alone is never high-confidence dead code. High is reserved for a successfully
-  // queried semantic declaration whose language server also returned no in-workspace references.
-  let confidence = internallyScoped && exactNoReference ? "high" : "medium";
-  const caveats = [];
-
-  if (internallyScoped && !exactNoReference) {
-    caveats.push("No complete exact semantic no-reference result is available for this declaration; static absence remains medium confidence.");
-  }
-
-  if (publicSurface) {
-    confidence = "low";
-    caveats.push("Public/exported APIs can be consumed by downstream packages, interfaces, reflection, dependency injection, templates, or configuration outside this repository.");
-  }
-  if (externalEntry || framework) {
-    confidence = "low";
-    caveats.push(framework?.reason || "This file is an externally entered or framework-owned surface; static inbound edges are not complete usage evidence.");
-  }
-  if (node?.decorated) {
-    confidence = "low";
-    caveats.push("Decorators/annotations can register this symbol without a direct caller.");
-  }
-  if (dynamicFile) {
-    confidence = "low";
-    caveats.push("The declaring file uses or is reached through dynamic loading, so the static graph can miss callers.");
-  }
-  if (reflectionFile || (publicSurface && context.repoSignals.reflection)) {
-    confidence = "low";
-    caveats.push("Reflection is present and may invoke names without a resolvable static edge.");
-  }
-
-  const evidenceTier = confidence === "high" && exactNoReference
-    ? "STRONG_STATIC_EVIDENCE"
-    : confidence === "low" ? "HIGH_UNCERTAINTY" : "BOUNDED_STATIC_EVIDENCE";
-  const remainingChecks = [
-    ...(!exactNoReference ? ["Run an exact language-server reference query for this declaration."] : []),
-    ...(publicSurface ? ["Check downstream/external consumers of the public API."] : []),
-    ...(externalEntry || framework ? ["Inspect framework registration and externally entered call paths."] : []),
-    ...(dynamicFile ? ["Resolve dynamic import/require targets and name-based dispatch."] : []),
-    ...(reflectionFile || (publicSurface && context.repoSignals.reflection) ? ["Inspect reflection/annotation/configuration consumers."] : []),
-    "Run targeted tests after any removal.",
-  ];
-
-  return {
-    id: String(item.id),
-    kind,
-    classification: testOnly ? `test-only-${kind}` : publicSurface ? `public-${kind}` : kind === "method" ? "internal-method" : kind === "function" ? "internal-function" : "unreferenced-symbol",
-    file,
-    line: lineOf(node),
-    symbol: bareLabel(node?.label || item.label),
-    owner: node?.member_of || null,
-    symbolKind: node?.symbol_kind || null,
-    visibility: node?.visibility || (node?.exported ? "exported" : "internal"),
-    confidence,
-    evidenceTier,
-    actionability: evidenceTier === "STRONG_STATIC_EVIDENCE" ? "PRIORITY_MANUAL_REVIEW" : "MANUAL_REVIEW",
-    reason: item.reason,
-    evidence: [
-      ...(testOnly ? [{kind: item.evidence || "graph", fact: `Only test/e2e consumers were found${item.testConsumerFiles?.length ? `: ${item.testConsumerFiles.join(", ")}` : "."}`}]
-        : [{ kind: "graph", fact: "No inbound non-structural graph edge targets this symbol." }, { kind: "source-index", fact: "Its identifier has no second indexed occurrence that establishes a caller." }]),
-      ...(exactNoReference ? [{kind: "exact-lsp", fact: "The active language server returned no in-workspace references for this exact declaration."}] : []),
-    ],
-    caveats,
-    publicApi: publicSurface,
-    externallyEnteredFile: externalEntry,
-    pathClasses: pathInfo.classes || [],
-    matchedPathRule: pathInfo.matchedRule || null,
-    verification: {
-      graphInboundRuntimeEdge: "NOT_FOUND",
-      indexedSecondOccurrence: testOnly ? "TEST_ONLY" : "NOT_FOUND",
-      exactLanguageServerReferences: exactNoReference ? "ZERO_CONFIRMED" : "NOT_CHECKED_OR_INCOMPLETE",
-      recognizedEntryPoint: externalEntry ? "FOUND" : "NOT_FOUND",
-      dynamicLoadingRisk: dynamicFile ? "PRESENT" : "NOT_OBSERVED_IN_DECLARING_FILE",
-      reflectionRisk: reflectionFile || (publicSurface && context.repoSignals.reflection) ? "PRESENT" : "NOT_OBSERVED",
-      publicApi: publicSurface ? "YES" : "NO",
-      decision: "MANUAL_REVIEW_REQUIRED",
-    },
-    remainingChecks,
-    autoDelete: false,
-    reviewAction: testOnly
-      ? "Confirm that no production/config/framework consumer exists; decide whether the declaration is intentional test support or removable with its tests. Never auto-delete."
-      : "Confirm with read_source, get_dependents, exact search, framework/config inspection and tests; never auto-delete.",
-  };
-}
-
-export function fileCandidate(item, symbols, context) {
-  const file = normalizedPath(item.file);
-  const source = String(context.sources.get(file) || "");
-  const pathInfo = context.classify(file, source);
-  const publicSymbols = symbols.filter((symbol) => symbol.publicApi);
-  const dynamicFile = context.dynamicTargets.has(file) || hasDynamicCode(source, file);
-  const reflectionFile = REFLECTION_RE.test(source);
-  // Whole-file liveness always remains at most medium: external launchers/manifests can exist outside
-  // the indexed import graph even when every internal symbol signal is otherwise strong.
-  let confidence = "medium";
-  const caveats = ["Files can be launched by scripts, plugins, manifests, framework conventions, generated consumers, or external tooling without an import edge."];
-  if (publicSymbols.length) {
-    confidence = "low";
-    caveats.push(`${publicSymbols.length} indexed public/exported symbol(s) may be consumed outside this repository.`);
-  }
-  if (dynamicFile) {
-    confidence = "low";
-    caveats.push("Dynamic loading is present in or targets this file.");
-  }
-  if (reflectionFile) {
-    confidence = "low";
-    caveats.push("Reflection is present in this file.");
-  }
-  const remainingChecks = [
-    "Inspect package scripts, manifests, framework/plugin discovery and deployment configuration.",
-    "Check external launchers and consumers outside the indexed repository.",
-    ...(dynamicFile ? ["Resolve dynamic import/require targets."] : []),
-    ...(reflectionFile ? ["Inspect reflection/name-based consumers."] : []),
-    "Run targeted tests after any removal.",
-  ];
-  return {
-    id: `file:${file}`,
-    kind: "file",
-    classification: "unreferenced-file",
-    file,
-    line: 1,
-    symbol: null,
-    owner: null,
-    symbolKind: null,
-    visibility: null,
-    confidence,
-    evidenceTier: confidence === "low" ? "HIGH_UNCERTAINTY" : "BOUNDED_STATIC_EVIDENCE",
-    actionability: "MANUAL_REVIEW",
-    reason: item.reason,
-    evidence: [
-      { kind: "graph", fact: "No indexed module imports this file." },
-      { kind: "symbol-liveness", fact: "Every indexed symbol in the file is statically unreferenced." },
-    ],
-    caveats,
-    publicApi: publicSymbols.length > 0,
-    externallyEnteredFile: false,
-    pathClasses: pathInfo.classes || [],
-    matchedPathRule: pathInfo.matchedRule || null,
-    verification: {
-      graphInboundModuleEdge: "NOT_FOUND",
-      indexedSymbolsReferenced: "NONE",
-      recognizedEntryPoint: "NOT_FOUND",
-      dynamicLoadingRisk: dynamicFile ? "PRESENT" : "NOT_OBSERVED",
-      reflectionRisk: reflectionFile ? "PRESENT" : "NOT_OBSERVED",
-      externalConsumerCheck: "NOT_POSSIBLE_FROM_REPOSITORY_GRAPH",
-      decision: "MANUAL_REVIEW_REQUIRED",
-    },
-    remainingChecks,
-    autoDelete: false,
-    reviewAction: "Verify package scripts, manifests, framework discovery, dynamic loading and external consumers; never auto-delete.",
-  };
-}

package/src/analysis/dead-code-review/policy.js

@@ -1,23 +0,0 @@
-import {hasPathClass} from '../../path-classification.js'
-
-export const DEAD_CODE_CONFIDENCE_RANK = Object.freeze({high: 0, medium: 1, low: 2})
-const DYNAMIC_CODE_RE = /(?:\brequire\s*\(\s*(?!["'])|\bcreateRequire\s*\(|\b__import__\s*\(|\bimportlib\.|(?:^|[^\w.$])(?:eval|exec)\s*\()/m
-const JS_DYNAMIC_IMPORT_RE = /\bimport\s*\(/
-const JS_LIKE_PATH_RE = /\.(?:[cm]?js|jsx|[cm]?ts|tsx)$/i
-export const REFLECTION_CODE_RE = /(?:\b(?:Class\.forName|get(?:Declared)?Method|getattr|setattr|hasattr|Method\.Invoke|GetMethod|GetProcAddress|dlsym)\s*\(|\b(?:globals|locals)\s*\(\s*\)\s*\[|\breflect\.[A-Za-z_$][\w$]*\s*\()/i
-export const normalizedReviewPath = (value) => String(value || '').replace(/\\/g, '/').replace(/^\.\//, '')
-
-export function hasDynamicCode(source, file = '') {
-    const text = String(source || '')
-    return DYNAMIC_CODE_RE.test(text) || (JS_LIKE_PATH_RE.test(String(file)) && JS_DYNAMIC_IMPORT_RE.test(text))
-}
-
-const NON_PRODUCT_CLASSES = Object.freeze(['generated', 'mock', 'story', 'docs', 'benchmark', 'temp'])
-
-export function deadCodePathAllowed(info, {includeTests, includeClassified}) {
-    if (!includeTests && hasPathClass(info, 'test', 'e2e')) return {ok: false, bucket: 'tests'}
-    if (!includeClassified && (info?.excluded || hasPathClass(info, ...NON_PRODUCT_CLASSES))) {
-        return {ok: false, bucket: 'classified'}
-    }
-    return {ok: true}
-}