weavatrix 0.3.13 → 1.0.0

package/src/analysis/dead-code-review.js

@@ -1,119 +0,0 @@
-// Conservative, source-free review queue for statically unreferenced code. This deliberately builds
-// on computeDead instead of inventing a second liveness model. Candidates are evidence for review,
-// never deletion instructions: framework entry, dynamic loading, reflection and public API surfaces
-// lower confidence and remain explicit in the returned record. Per-candidate record shapes live in
-// dead-code-review/candidates.js; this module owns collection, filtering and the summary envelope.
-import { computeDead } from "./dead-check.js";
-import { createPathClassifier } from "../path-classification.js";
-import {
-  DEAD_CODE_CONFIDENCE_RANK as CONFIDENCE_RANK, hasDynamicCode,
-  REFLECTION_CODE_RE as REFLECTION_RE, deadCodePathAllowed as pathAllowed,
-  normalizedReviewPath as normalizedPath,
-} from './dead-code-review/policy.js'
-import { symbolCandidate, fileCandidate } from './dead-code-review/candidates.js'
-
-// Pure review model. Filesystem collection/entry inference stays in the MCP adapter so tests can pass
-// exact source maps and convention evidence without touching the working tree.
-export function computeDeadCodeReview(graph, sources, options = {}) {
-  const entrySet = options.entrySet instanceof Set ? options.entrySet : new Set(options.entrySet || []);
-  const dynamicTargets = options.dynamicTargets instanceof Set ? options.dynamicTargets : new Set(options.dynamicTargets || []);
-  const frameworkByFile = new Map((options.frameworkEvidence || []).map((entry) => [normalizedPath(entry.file), entry]));
-  const classifier = options.pathClassifier || createPathClassifier(null);
-  const classificationCache = new Map();
-  const classify = (file, source) => {
-    if (!classificationCache.has(file)) classificationCache.set(file, classifier.explain(file, { content: source }));
-    return classificationCache.get(file);
-  };
-  const repoSignals = {
-    dynamicLoading: (graph.externalImports || []).some((entry) => entry?.dynamic) || [...sources].some(([file, text]) => hasDynamicCode(text, file)),
-    reflection: [...sources.values()].some((text) => REFLECTION_RE.test(String(text || ""))),
-  };
-  const includeTests = options.includeTests === true;
-  const includeClassified = options.includeClassified === true;
-  const minConfidence = Object.hasOwn(CONFIDENCE_RANK, options.minConfidence) ? options.minConfidence : "medium";
-  const pathPrefix = normalizedPath(options.path || "").replace(/\/+$/, "");
-  const requestedKinds = new Set(Array.isArray(options.kinds) && options.kinds.length ? options.kinds : ["file", "function", "method", "symbol"]);
-  const exactNoReferenceIds = new Set(graph.precisionNoReferenceSymbols || options.exactNoReferenceIds || []);
-  const context = { sources, entrySet, dynamicTargets, frameworkByFile, classify, repoSignals, exactNoReferenceIds };
-  const dead = computeDead(graph, sources, { entrySet });
-  const nodesById = new Map((graph.nodes || []).map((node) => [String(node.id), node]));
-  const rawSymbols = [...dead.deadSymbols, ...(dead.testOnlySymbols || []).map((item) => ({...item, testOnly: true}))]
-    .map((item) => ({ item, node: nodesById.get(String(item.id)) }))
-    .filter((entry) => entry.node)
-    .map(({ item, node }) => symbolCandidate(item, node, context));
-  const symbolsByFile = new Map();
-  for (const candidate of rawSymbols) {
-    if (!symbolsByFile.has(candidate.file)) symbolsByFile.set(candidate.file, []);
-    symbolsByFile.get(candidate.file).push(candidate);
-  }
-  const rawFiles = dead.deadFiles.map((item) => fileCandidate(item, symbolsByFile.get(normalizedPath(item.file)) || [], context));
-  const raw = [...rawSymbols, ...rawFiles];
-  const suppressed = { tests: 0, classified: 0, confidence: 0, path: 0, kind: 0 };
-  const candidates = [];
-  for (const candidate of raw) {
-    // Node-level test surfaces (Rust #[cfg(test)] symbols in production files) follow the same
-    // include_tests policy as path-classified test files.
-    if (!includeTests && nodesById.get(String(candidate.id))?.test_surface === true) { suppressed.tests += 1; continue; }
-    const info = classify(candidate.file, sources.get(candidate.file));
-    const allowed = pathAllowed(info, { includeTests, includeClassified });
-    if (!allowed.ok) { suppressed[allowed.bucket] += 1; continue; }
-    if (pathPrefix && candidate.file !== pathPrefix && !candidate.file.startsWith(`${pathPrefix}/`)) { suppressed.path += 1; continue; }
-    if (!requestedKinds.has(candidate.kind)) { suppressed.kind += 1; continue; }
-    if (CONFIDENCE_RANK[candidate.confidence] > CONFIDENCE_RANK[minConfidence]) { suppressed.confidence += 1; continue; }
-    candidates.push(candidate);
-  }
-  candidates.sort((left, right) =>
-    CONFIDENCE_RANK[left.confidence] - CONFIDENCE_RANK[right.confidence]
-    || left.file.localeCompare(right.file)
-    || left.line - right.line
-    || left.id.localeCompare(right.id));
-
-  const warnings = [{
-    code: "STATIC_LIVENESS_IS_NOT_RUNTIME_PROOF",
-    message: "No static reference is not proof of dead runtime code. Review every candidate; never bulk-delete or auto-delete.",
-  }];
-  if (repoSignals.dynamicLoading) warnings.push({
-    code: "DYNAMIC_LOADING_PRESENT",
-    message: "Dynamic loading exists in the repository; static callers may be incomplete.",
-  });
-  if (repoSignals.reflection) warnings.push({
-    code: "REFLECTION_PRESENT",
-    message: "Reflection-like APIs exist in the repository; public or name-addressed symbols may be invoked without graph edges.",
-  });
-  if (suppressed.confidence) warnings.push({
-    code: "LOW_CONFIDENCE_SUPPRESSED",
-    message: `${suppressed.confidence} low-confidence candidate(s), including public/framework-sensitive code, were suppressed; set min_confidence=low to review them explicitly.`,
-  });
-
-  return {
-    candidates,
-    warnings,
-    suppressed,
-    repoSignals,
-    totals: {
-      indexedSymbols: dead.stats.symbols,
-      indexedFiles: dead.stats.files,
-      rawDeadSymbols: rawSymbols.length,
-      rawTestOnlySymbols: (dead.testOnlySymbols || []).length,
-      rawDeadFiles: rawFiles.length,
-      reviewCandidates: candidates.length,
-      byConfidence: {
-        high: candidates.filter((candidate) => candidate.confidence === "high").length,
-        medium: candidates.filter((candidate) => candidate.confidence === "medium").length,
-        low: candidates.filter((candidate) => candidate.confidence === "low").length,
-      },
-      byEvidenceTier: {
-        strongStatic: candidates.filter((candidate) => candidate.evidenceTier === "STRONG_STATIC_EVIDENCE").length,
-        boundedStatic: candidates.filter((candidate) => candidate.evidenceTier === "BOUNDED_STATIC_EVIDENCE").length,
-        highUncertainty: candidates.filter((candidate) => candidate.evidenceTier === "HIGH_UNCERTAINTY").length,
-      },
-    },
-    policy: {
-      verdict: "REVIEW_REQUIRED",
-      autoDelete: false,
-      minConfidence,
-      includeTests,
-      includeClassified,
-    },
-  };
-}

package/src/analysis/dep-check-ecosystems.js

@@ -1,205 +0,0 @@
-import { makeFinding } from "./findings.js";
-
-const TEST_PATH_RE = /(^|[/\\])(test|tests|__tests__|spec|e2e|__mocks__)([/\\]|$)|[._-](test|spec)\.[a-z0-9]+$|_test\.go$|(^|[/\\])test(?:_[^/\\]*)?\.py$/i;
-const escRe = (s) => String(s).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-const mentioned = (blob, name) => new RegExp(`(^|[^\\w@.-])${escRe(name)}($|[^\\w.-])`).test(blob);
-
-// ---- Go: set math over ecosystem:"Go" externalImports vs go.mod requires ----
-// goMod = parseGoMod() output. Only DIRECT requires can be "unused" (indirect ones belong to `go mod
-// tidy`); replace targets and the own module never count. Missing = imported module with no require
-// prefix — rare in Go (builds fail), so it usually flags vendored/replaced setups: keep it medium.
-export function computeGoDepFindings({ externalImports = [], goMod = null, nonRuntimeRoots = [] } = {}) {
-  const findings = [];
-  if (!goMod || !goMod.module) return { findings, declared: new Set() };
-  const requires = goMod.requires || [];
-  const declared = new Set(requires.map((r) => r.path));
-  const replaced = new Set((goMod.replaces || []).map((r) => r.from));
-  const moduleOf = (spec) => { let best = ""; for (const p of declared) if ((spec === p || spec.startsWith(p + "/")) && p.length > best.length) best = p; return best; };
-
-  const usedModules = new Set();
-  const missing = new Map(); // pkg → { files:Set, lines:Map }
-  const inNonRuntimeRoot = (file) => (nonRuntimeRoots || []).some((root) => {
-    const f = String(file || "").replace(/\\/g, "/"), r = String(root || "").replace(/\\/g, "/").replace(/^\.\//, "").replace(/^\/+|\/+$/g, "");
-    return !!r && (f === r || f.startsWith(`${r}/`));
-  });
-  for (const e of externalImports) {
-    if (e.ecosystem !== "Go" || e.builtin || e.unresolved || !e.pkg) continue;
-    const mod = moduleOf(e.spec || e.pkg) || (declared.has(e.pkg) ? e.pkg : "");
-    if (mod) { usedModules.add(mod); continue; }
-    let m = missing.get(e.pkg);
-    if (!m) missing.set(e.pkg, (m = { files: new Set(), lines: new Map() }));
-    m.files.add(e.file);
-    if (!m.lines.has(e.file)) m.lines.set(e.file, e.line || 0);
-  }
-
-  for (const r of requires) {
-    if (r.indirect || usedModules.has(r.path)) continue;
-    findings.push(makeFinding({
-      category: "unused",
-      rule: "unused-dep",
-      severity: "low",
-      confidence: "medium",
-      title: `Unused Go module: ${r.path}`,
-      reason: "A direct go.mod requirement has no matching recorded Go import; build-tagged usage remains possible.",
-      detail: `"${r.path}" is required (direct) in go.mod but no .go file imports it or any of its packages. Build-tag-guarded files can hide usage — confirm with \`go mod tidy\` before removing.`,
-      package: r.path,
-      version: r.version,
-      source: "internal",
-      fixHint: "go mod tidy (drops requires nothing imports)",
-    }));
-  }
-  for (const [pkg, use] of missing) {
-    if (replaced.has(pkg)) continue;
-    const files = [...use.files];
-    if (files.every(inNonRuntimeRoot)) continue;
-    findings.push(makeFinding({
-      category: "unused",
-      rule: "missing-dep",
-      severity: "medium",
-      confidence: "medium",
-      title: `Missing Go module: ${pkg}`,
-      reason: "A recorded Go import has no matching direct go.mod requirement or replace entry.",
-      detail: `"${pkg}" is imported by ${files.length} file(s) but go.mod has no matching require — a replace/workspace/vendor setup, or the module was never added.`,
-      package: pkg,
-      file: files[0],
-      line: use.lines.get(files[0]) || 0,
-      evidence: files.slice(0, 5).map((f) => ({ file: f, line: use.lines.get(f) || 0, snippet: "" })),
-      source: "internal",
-      fixHint: `go get ${pkg}`,
-    }));
-  }
-  return { findings, declared };
-}
-
-// ---- Python: ecosystem:"PyPI" externalImports vs requirements/pyproject/Pipfile ----
-// Import→dist naming is heuristic (yaml→PyYAML, python-X/X-python variants), so matching is GENEROUS for
-// suppression and every unused finding stays low-confidence. CLI-only tools (pytest, black, gunicorn …)
-// and stub/plugin conventions (types-*, *-stubs, pytest-*, flake8-*) are never flagged unused.
-const PY_TOOL_DISTS = new Set(("pytest tox nox black ruff flake8 pylint mypy pyright isort bandit coverage pre-commit pip setuptools wheel build twine poetry poetry-core " +
-  "pip-tools uv virtualenv pipenv gunicorn uwsgi supervisor ipython jupyter jupyterlab notebook ipykernel codecov autopep8 yapf commitizen detect-secrets safety pip-audit hatchling flit flit-core pdm").split(" "));
-const pyNorm = (n) => String(n || "").toLowerCase().replace(/[-_.]+/g, "-");
-
-function computePyDepFindingsFlat({
-  externalImports = [], pyManifest = null, configTexts = new Map(),
-  managedDependencies = [], ignoredDependencies = [], nonRuntimeRoots = [],
-} = {}) {
-  const findings = [];
-  const deps = (pyManifest && pyManifest.deps) || [];
-  const present = !!(pyManifest && pyManifest.present);
-  const declared = new Set(deps.map((d) => pyNorm(d.name)));
-  const managed = new Set((managedDependencies || []).map(pyNorm));
-  const ignored = new Set((ignoredDependencies || []).map(pyNorm));
-  const inNonRuntimeRoot = (file) => (nonRuntimeRoots || []).some((root) => {
-    const f = String(file || "").replace(/\\/g, "/"), r = String(root || "").replace(/\\/g, "/").replace(/^\.\//, "").replace(/^\/+|\/+$/g, "");
-    return !!r && (f === r || f.startsWith(`${r}/`));
-  });
-  for (const name of managed) declared.add(name);
-
-  const used = new Map(); // top import → { dist, files:Set, lines:Map }
-  for (const e of externalImports) {
-    if (e.ecosystem !== "PyPI" || e.builtin || e.unresolved || !e.pkg) continue;
-    const top = String(e.spec || e.pkg).split(".")[0];
-    let u = used.get(top);
-    if (!u) used.set(top, (u = { dist: e.pkg, files: new Set(), lines: new Map() }));
-    u.files.add(e.file);
-    if (!u.lines.has(e.file)) u.lines.set(e.file, e.line || 0);
-  }
-  // generous match: does declared dist D cover import top t (dist guess g)?
-  const covers = (D, t, g) => {
-    const d = pyNorm(D), nt = pyNorm(t), ng = pyNorm(g);
-    return d === nt || d === ng || d === `python-${nt}` || d === `${nt}-python` || d === `${nt}-binary` || d.replace(/\d+$/, "") === nt.replace(/\d+$/, "");
-  };
-
-  const configBlob = [...configTexts.values()].join("\n");
-  if (present) {
-    for (const d of deps) {
-      const n = pyNorm(d.name);
-      if (managed.has(n) || ignored.has(n)) continue;
-      if (d.buildSystem || PY_TOOL_DISTS.has(n) || /^types-|-stubs$|^pytest-|^flake8-|^sphinx/.test(n)) continue;
-      let hit = false;
-      for (const [top, u] of used) if (covers(d.name, top, u.dist)) { hit = true; break; }
-      if (hit || mentioned(configBlob, d.name)) continue;
-      findings.push(makeFinding({
-        category: "unused",
-        rule: "unused-dep",
-        severity: d.dev ? "info" : "low",
-        confidence: "low",
-        title: `Unused Python dependency: ${d.name}`,
-        reason: "No recorded Python import maps to this declared distribution; import-to-distribution mapping and plugin loading are heuristic.",
-        detail: `"${d.name}" is declared but no .py file imports a module that maps to it. Import-name↔package-name mapping is heuristic and plugins/CLI tools load dynamically — review before removing.`,
-        package: d.name,
-        source: "internal",
-        fixHint: `remove "${d.name}" from the manifest after confirming nothing imports or shells out to it`,
-      }));
-    }
-  }
-  for (const [top, u] of used) {
-    if (ignored.has(pyNorm(top)) || ignored.has(pyNorm(u.dist)) || managed.has(pyNorm(top)) || managed.has(pyNorm(u.dist))) continue;
-    let hit = false;
-    for (const D of declared) if (covers(D, top, u.dist)) { hit = true; break; }
-    if (hit) continue;
-    const files = [...u.files];
-    if (files.every(inNonRuntimeRoot)) continue;
-    const testOnly = files.every((f) => TEST_PATH_RE.test(f));
-    findings.push(makeFinding({
-      category: "unused",
-      rule: "missing-dep",
-      severity: present ? (testOnly ? "low" : "medium") : "low",
-      confidence: present ? "medium" : "low",
-      title: `Missing Python dependency: ${u.dist}`,
-      reason: present
-        ? `A recorded Python import maps to "${u.dist}", but no declared distribution covers it.`
-        : `A recorded Python import maps to "${u.dist}", but no Python dependency manifest is present; a managed runtime may provide it.`,
-      detail: `"${top}" is imported by ${files.length} file(s) but ${present ? "no declared dependency provides it" : "the repo has no Python dependency manifest (requirements.txt / pyproject / Pipfile); a bundled or managed runtime may provide it"}${u.dist !== top ? ` (PyPI package is likely "${u.dist}")` : ""}.${present ? "" : " If this is intentional, declare it under python.managedDependencies in .weavatrix-deps.json."}`,
-      package: u.dist,
-      file: files[0],
-      line: u.lines.get(files[0]) || 0,
-      evidence: files.slice(0, 5).map((f) => ({ file: f, line: u.lines.get(f) || 0, snippet: "" })),
-      source: "internal",
-      fixHint: present ? `pip install ${u.dist}  (and add it to requirements.txt / pyproject)` : `add ${u.dist} to a Python manifest, or declare it as a managed runtime dependency`,
-    }));
-  }
-  return { findings, declared, managed };
-}
-
-const normPyScope = (root) => String(root || "").replace(/\\/g, "/").replace(/^\.\//, "").replace(/^\/+|\/+$/g, "");
-const pyScopeOwns = (root, file) => !root || file === root || String(file || "").replace(/\\/g, "/").startsWith(`${root}/`);
-
-export function computePyDepFindings(options = {}) {
-  const scopes = Array.isArray(options.pyManifest?.scopes) ? options.pyManifest.scopes : [];
-  if (!scopes.length) return computePyDepFindingsFlat(options);
-  const normalized = scopes.map((scope) => ({ ...scope, root: normPyScope(scope.root) }))
-    .sort((left, right) => right.root.length - left.root.length);
-  if (!normalized.some((scope) => !scope.root)) normalized.push({ root: "", present: false, deps: [], manifests: [] });
-  const importsByScope = new Map(normalized.map((scope) => [scope, []]));
-  const configByScope = new Map(normalized.map((scope) => [scope, new Map()]));
-  for (const entry of options.externalImports || []) {
-    const owner = normalized.find((scope) => pyScopeOwns(scope.root, entry.file)) || normalized.at(-1);
-    importsByScope.get(owner).push(entry);
-  }
-  for (const [file, text] of options.configTexts || new Map()) {
-    const owner = normalized.find((scope) => pyScopeOwns(scope.root, file)) || normalized.at(-1);
-    configByScope.get(owner).set(file, text);
-  }
-  const findings = [];
-  const declared = new Set();
-  const managed = new Set();
-  for (const scope of normalized) {
-    const result = computePyDepFindingsFlat({
-      ...options,
-      externalImports: importsByScope.get(scope),
-      configTexts: configByScope.get(scope),
-      pyManifest: {present: scope.present, deps: scope.deps || []},
-    });
-    findings.push(...result.findings.map((finding) => ({
-      ...finding,
-      ...(scope.manifests?.length ? {manifest: scope.manifests[0]} : {}),
-      verification: finding.rule === "missing-dep"
-        ? { evidenceModel: "MANIFEST_PLUS_INDEXED_SOURCE", decision: "ACTION_REQUIRED", manifestDeclaration: { status: scope.present ? "NOT_FOUND" : "NOT_PRESENT", files: scope.manifests || [] }, indexedSourceImports: { status: "FOUND", count: finding.evidence?.length || 1, files: (finding.evidence || []).map((item) => item.file) }, mapping: "PEP 503 plus bounded import-to-distribution aliases" }
-        : { evidenceModel: "MANIFEST_PLUS_INDEXED_SOURCE", decision: "REVIEW_REQUIRED", manifestDeclaration: { status: "FOUND", files: scope.manifests || [] }, indexedSourceImports: { status: "ZERO_FOUND", completeness: "COMPLETE_FOR_GRAPH_SCOPE", count: 0, files: [] }, mapping: "PEP 503 plus bounded import-to-distribution aliases" },
-    })));
-    for (const name of result.declared) declared.add(`${scope.root || "."}:${name}`);
-    for (const name of result.managed) managed.add(name);
-  }
-  return { findings, declared, managed };
-}

package/src/analysis/dep-check.js

@@ -1,290 +0,0 @@
-// Pure dependency checker (replaces depcheck + knip's dependency output) — set math over the graph's
-// externalImports vs package.json. NO filesystem here: the fs wrapper is internal-audit.js, so this is
-// fully unit-testable (same pattern as dead-check.js computeDead). See DEPS_SECURITY_PLAN.md (P1).
-//
-// Philosophy: bias to FALSE-NEGATIVES. A dep we can't prove unused stays unflagged (or drops to low
-// confidence) — knip's ~100 framework plugins know config conventions we don't, so we compensate with
-// script/config-text mention scanning + a config-ecosystem prefix rule, and we NEVER say "safe to
-// auto-remove", only "review".
-import { makeFinding } from "./findings.js";
-import {FRAMEWORK_RUNTIME_PEERS, IMPLICIT_STYLE_COMPILERS} from './dependency/conventions.js'
-import {createScopedDepFindings} from './dependency/scoped-dependencies.js'
-import {createPackageSourceMatcher} from './dependency/source-references.js'
-
-// Packages referenced by config CONVENTION, not imports (eslint extends "airbnb" → eslint-config-airbnb).
-// Flagged only at low confidence when nothing mentions them anywhere.
-const CONFIG_ECOSYSTEM_RE = /^(eslint-(config|plugin)-|@typescript-eslint\/|@eslint\/|prettier-plugin-|postcss-|autoprefixer$|tailwindcss$|babel-(plugin|preset)-|@babel\/(plugin|preset)-|stylelint-|@commitlint\/|commitlint-|remark-|rehype-|@semantic-release\/|karma-|grunt-|gulp-)/;
-
-// CLI name → package name, for script commands whose binary doesn't equal the package
-// (`tsc` comes from typescript, `depcruise` from dependency-cruiser, …).
-const BIN_PKG = {
-  tsc: "typescript", depcruise: "dependency-cruiser", "vue-cli-service": "@vue/cli-service",
-  ng: "@angular/cli", nest: "@nestjs/cli", sb: "storybook",
-  "electron-rebuild": "@electron/rebuild", playwright: "@playwright/test",
-};
-
-const isStylesheetSpecifier = (spec) => /\.(?:css|scss|sass|less|styl(?:us)?)(?:[?#].*)?$/i.test(String(spec || ""));
-const escRe = (s) => String(s).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-// word-ish mention: the name not embedded inside a longer identifier/path segment
-const mentioned = (blob, name) => new RegExp(`(^|[^\\w@.-])${escRe(name)}($|[^\\w.-])`).test(blob);
-
-// computeDepFindings({ externalImports, pkg, workspacePkgNames, configTexts }) → { findings, usedPackages }
-//   externalImports — graph.json's array (P0): {file, spec, pkg, builtin, kind, line, dynamic?, unresolved?}
-//   pkg             — parsed package.json ({} for non-JS repos → no dep findings)
-//   workspacePkgNames — Set of monorepo-local package names (never "missing")
-//   configTexts     — Map<fileName, text> of root config files + CI workflows (mention scanning)
-//   sourceTexts     — Map<fileName, text> for narrow dynamic/package-path literal evidence
-export function computeDepFindings({
-  externalImports = [], pkg = {}, workspacePkgNames = new Set(), configTexts = new Map(),
-  sourceTexts = new Map(), aliases = [], scope = "", manifest = "package.json", nonRuntimeRoots = [], sourceFiles = [],
-} = {}) {
-  const findings = [];
-  const meta = { scope: scope || ".", manifest };
-  const isAliasSpec = (spec) => aliases.some((a) => {
-    const s = String(spec || "");
-    const key = typeof a === "string" ? a : String(a?.key || "");
-    const prefix = typeof a === "string" ? a.replace(/\*.*$/, "") : String(a?.prefix || "");
-    const suffix = key.includes("*") ? key.slice(key.indexOf("*") + 1) : String(a?.suffix || "");
-    return key.includes("*")
-      ? !!prefix && s.startsWith(prefix) && (!suffix || s.endsWith(suffix))
-      : !!key && s === key;
-  });
-  const sections = {
-    dependencies: pkg.dependencies || {},
-    devDependencies: pkg.devDependencies || {},
-    peerDependencies: pkg.peerDependencies || {},
-    optionalDependencies: pkg.optionalDependencies || {},
-  };
-  const allDeclared = new Set(Object.values(sections).flatMap((s) => Object.keys(s)));
-  const selfName = String(pkg.name || "");
-  const normRoots = (nonRuntimeRoots || []).map((root) => String(root || "").replace(/\\/g, "/").replace(/^\.\//, "").replace(/^\/+|\/+$/g, "")).filter(Boolean);
-  const isNonRuntimeFile = (file) => {
-    const normalized = String(file || "").replace(/\\/g, "/").replace(/^\.\//, "");
-    return normRoots.some((root) => normalized === root || normalized.startsWith(`${root}/`));
-  };
-  const npmNameParts = (name) => {
-    const value = String(name || "");
-    const slash = value.startsWith("@") ? value.indexOf("/") : -1;
-    return slash > 0 ? { scope: value.slice(0, slash), base: value.slice(slash + 1) } : { scope: "", base: value };
-  };
-  const selfParts = npmNameParts(selfName);
-  const configuredNapi = npmNameParts(pkg.napi?.name || selfName);
-  const napiBinding = {
-    scope: configuredNapi.scope || (configuredNapi.base === selfParts.base ? selfParts.scope : ""),
-    base: configuredNapi.base,
-  };
-  const NAPI_PLATFORM_SUFFIX = /^(?:android-(?:arm64|arm-eabi)|win32-(?:x64|ia32|arm64)-msvc|darwin-(?:universal|x64|arm64)|freebsd-(?:x64|arm64)|linux-(?:x64|arm64|arm|riscv64|s390x|ppc64|loong64)-(?:gnu|musl|gnueabihf|musleabihf)|aix-ppc64|sunos-x64|wasm32-wasi(?:-preview1-threads)?)$/;
-  const isGeneratedNapiPackage = (name, files) => {
-    if (!pkg.napi || !napiBinding.base || !files.every((file) => /(^|\/)index\.[cm]?js$/i.test(String(file || "").replace(/\\/g, "/")))) return false;
-    const candidate = npmNameParts(name);
-    if (candidate.scope !== napiBinding.scope || !candidate.base.startsWith(`${napiBinding.base}-`)) return false;
-    return NAPI_PLATFORM_SUFFIX.test(candidate.base.slice(napiBinding.base.length + 1));
-  };
-  const isGeneratedNapiBinary = (entry) => !!pkg.napi
-    && /(^|\/)index\.[cm]?js$/i.test(String(entry.file || "").replace(/\\/g, "/"))
-    && /^\.\/[^/]+\.node$/i.test(String(entry.spec || ""));
-  // Some frameworks consume required peers internally, so application source legitimately never imports
-  // them. Keep this deliberately narrow: react-dom is a required Next.js runtime peer in the same package
-  // scope, not a general React exemption and not a repo-wide whitelist.
-  const frameworkRuntime = new Set();
-  for (const [provider, peers] of FRAMEWORK_RUNTIME_PEERS) {
-    if (allDeclared.has(provider)) for (const peer of peers) frameworkRuntime.add(peer);
-  }
-  const implicitCompilerUsage = new Set();
-  for (const [name, sourcePattern] of IMPLICIT_STYLE_COMPILERS) {
-    if (allDeclared.has(name) && sourceFiles.some((file) => sourcePattern.test(String(file || "")))) {
-      implicitCompilerUsage.add(name);
-    }
-  }
-
-  // ---- usage index from the graph's recorded imports ----
-  const usedPackages = new Map(); // pkgName -> { files:Set, lines:Map(file→first line), kinds/specs:Set, typeOnly:boolean }
-  let builtinUsed = false;
-  for (const e of externalImports) {
-    if (e.ecosystem && e.ecosystem !== "npm") continue; // go/python imports have their own checkers
-    if (isAliasSpec(e.spec)) continue;
-    if (e.unresolved) continue;
-    if (e.builtin) { builtinUsed = true; continue; }
-    if (!e.pkg) continue;
-    let u = usedPackages.get(e.pkg);
-    if (!u) usedPackages.set(e.pkg, (u = { files: new Set(), lines: new Map(), kinds: new Set(), specs: new Set(), typeOnly: true }));
-    u.files.add(e.file);
-    if (!u.lines.has(e.file)) u.lines.set(e.file, e.line || 0);
-    u.kinds.add(e.kind);
-    u.specs.add(e.spec || e.pkg);
-    if (!e.typeOnly) u.typeOnly = false;
-  }
-
-  const scriptBlob = Object.values(pkg.scripts || {}).join("\n");
-  const configBlob = scriptBlob + "\n" + [...configTexts.values()].join("\n");
-  const scriptTokens = new Set(scriptBlob.split(/[^\w@/.:-]+/).filter(Boolean));
-  const binReferenced = (name) => {
-    if (scriptTokens.has(name)) return true;
-    for (const [bin, p] of Object.entries(BIN_PKG)) if (p === name && scriptTokens.has(bin)) return true;
-    return false;
-  };
-  const typesBase = (name) => (name.startsWith("@types/") ? name.slice(7).replace(/^(.+?)__(.+)$/, "@$1/$2") : null); // @types/babel__core → @babel/core
-  const sourceReferenced = createPackageSourceMatcher(sourceTexts);
-
-  // ---- unused dependencies (per section; prod vs dev differ in severity/confidence) ----
-  for (const [section, deps] of Object.entries(sections)) {
-    if (section === "peerDependencies") continue; // peers are consumer-facing contracts, not usage
-    for (const name of Object.keys(deps)) {
-      if (name === selfName || usedPackages.has(name) || frameworkRuntime.has(name) || implicitCompilerUsage.has(name) || sourceReferenced(name)) continue;
-      const tb = typesBase(name);
-      if (tb) { // @types/x is used iff x is used (or it types the Node builtins)
-        if (tb === "node" ? builtinUsed : usedPackages.has(tb) || frameworkRuntime.has(tb) || mentioned(configBlob, tb)) continue;
-      }
-      if (binReferenced(name) || mentioned(configBlob, name)) continue; // scripts/config keep it alive
-      const ecosystem = CONFIG_ECOSYSTEM_RE.test(name);
-      const dev = section !== "dependencies";
-      if (ecosystem && dev) continue; // config-convention devDeps: too FP-prone to flag at all
-      findings.push(makeFinding({
-        category: "unused",
-        rule: "unused-dep",
-        severity: dev ? "info" : "low",
-        confidence: dev || ecosystem ? "low" : "medium",
-        title: `Unused ${section === "dependencies" ? "dependency" : section.replace(/ies$/, "y")}: ${name}`,
-        reason: "No indexed package import, package-script command, recognized config mention, framework peer contract, or implicit style-compiler input uses this declaration.",
-        detail: `"${name}" is declared in ${section}, but no usage was found in the indexed source scope, package scripts, or ${configTexts.size} known config file(s). Dynamic/plugin/config-convention usage is not proven absent — review before removing.`,
-        file: manifest,
-        package: name,
-        evidence: [{ file: manifest, line: 0, snippet: `declared in ${section}` }],
-        source: "internal",
-        actionability: "MANIFEST_REVIEW_REQUIRED",
-        autoRemove: false,
-        verification: {
-          evidenceModel: "MANIFEST_PLUS_INDEXED_SOURCE",
-          manifestDeclaration: { status: "FOUND", file: manifest, section, version: String(deps[name] || "") },
-          indexedSourceImports: { status: "ZERO_FOUND", completeness: "COMPLETE_FOR_GRAPH_SCOPE", count: 0 },
-          packageScripts: { status: "CHECKED", matched: false },
-          knownConfigs: { status: "CHECKED", filesScanned: configTexts.size, matched: false },
-          frameworkPeerContract: "NOT_FOUND",
-          implicitCompilerInput: "NOT_FOUND",
-          dynamicOrPluginUsage: "NOT_PROVEN_ABSENT",
-          decision: "REVIEW_REQUIRED",
-        },
-        fixHint: `Review manifest/config/plugin usage; if confirmed unused, remove ${name} with the package manager and run targeted tests`,
-        ...meta,
-      }));
-    }
-  }
-
-  // ---- missing (phantom) dependencies: imported but declared nowhere ----
-  for (const [name, use] of usedPackages) {
-    if (allDeclared.has(name) || name === selfName || workspacePkgNames.has(name)) continue;
-    const files = [...use.files];
-    if (files.every(isNonRuntimeFile) || isGeneratedNapiPackage(name, files)) continue;
-    const testOnly = files.every((f) => /(^|[/\\])(test|tests|__tests__|spec|e2e|__mocks__)([/\\]|$)|[._-](test|spec)\.[a-z]+$/i.test(f));
-    const stylesheetOnly = [...use.specs].length > 0 && [...use.specs].every(isStylesheetSpecifier);
-    const usageReason = stylesheetOnly
-      ? `Direct stylesheet import(s) resolve through "${name}"; CSS-only imports are build/runtime inputs even without JavaScript bindings.`
-      : use.typeOnly
-        ? `Direct type-only import(s) resolve through "${name}"; the compiler still requires a declared package.`
-        : `Direct source import(s) resolve through "${name}", but the nearest package manifest does not declare it.`;
-    findings.push(makeFinding({
-      category: "unused",
-      rule: "missing-dep",
-      severity: testOnly ? "low" : "medium",
-      confidence: "high",
-      title: `Missing dependency: ${name}`,
-      reason: usageReason,
-      detail: `"${name}" is imported by ${files.length} file(s) in scope ${meta.scope} but not declared in ${manifest} — it only works via a transitive install (phantom dependency) and can break on any lockfile change.`,
-      package: name,
-      file: files[0],
-      line: use.lines.get(files[0]) || 0,
-      evidence: files.slice(0, 5).map((f) => ({ file: f, line: use.lines.get(f) || 0, snippet: "" })),
-      source: "internal",
-      actionability: "STRONG_MANIFEST_MISMATCH",
-      autoInstall: false,
-      verification: {
-        evidenceModel: "MANIFEST_PLUS_INDEXED_SOURCE",
-        manifestDeclaration: { status: "NOT_FOUND", file: manifest, checkedSections: Object.keys(sections) },
-        indexedSourceImports: {
-          status: "FOUND",
-          completeness: "COMPLETE_FOR_GRAPH_SCOPE",
-          count: files.length,
-          files: files.slice(0, 20),
-          truncated: files.length > 20,
-          typeOnly: use.typeOnly,
-          stylesheetOnly,
-          testOnly,
-        },
-        packageScope: meta.scope,
-        transitiveResolutionRisk: "PRESENT",
-        decision: "DECLARE_AFTER_SCOPE_REVIEW",
-      },
-      fixHint: `npm install ${testOnly ? "--save-dev " : ""}${name}`,
-      ...meta,
-    }));
-  }
-
-  // ---- duplicate declarations (same package in several sections) ----
-  const seenIn = new Map();
-  for (const [section, deps] of Object.entries(sections)) for (const name of Object.keys(deps)) (seenIn.get(name) || seenIn.set(name, []).get(name)).push(section);
-  for (const [name, ss] of seenIn) {
-    if (ss.length < 2) continue;
-    if (ss.includes("peerDependencies") && ss.includes("devDependencies") && ss.length === 2) continue; // standard lib-author pattern
-    findings.push(makeFinding({
-      category: "unused",
-      rule: "duplicate-dep",
-      severity: "info",
-      confidence: "high",
-      title: `Duplicate declaration: ${name}`,
-      reason: `The same package is declared in multiple manifest sections: ${ss.join(" + ")}.`,
-      detail: `"${name}" is declared in ${ss.join(" + ")} — npm resolves one of them; keep a single section.`,
-      package: name,
-      source: "internal",
-      actionability: "MANIFEST_REVIEW_REQUIRED",
-      autoRemove: false,
-      verification: {
-        evidenceModel: "MANIFEST_ONLY",
-        manifestDeclaration: { status: "DUPLICATE", file: manifest, sections: ss },
-        decision: "REVIEW_REQUIRED",
-      },
-      ...meta,
-    }));
-  }
-
-  // ---- unresolved local imports (broken relative/alias paths) ----
-  const unresolvedSeen = new Set();
-  let unresolvedCount = 0;
-  for (const e of externalImports) {
-    if (!e.unresolved) continue;
-    if (isNonRuntimeFile(e.file) || isGeneratedNapiBinary(e)) continue;
-    unresolvedCount++;
-    const key = e.file + "|" + e.spec;
-    if (unresolvedSeen.has(key) || unresolvedSeen.size >= 100) continue; // cap the findings, keep the count honest
-    unresolvedSeen.add(key);
-    findings.push(makeFinding({
-      category: "structure",
-      rule: "unresolved-import",
-      severity: "low",
-      confidence: "medium",
-      title: `Unresolved import: ${e.spec}`,
-      detail: `${e.file}:${e.line} imports "${e.spec}", which resolves to no file in the repo (broken path, missing alias target, or a file type the graph doesn't index).`,
-      file: e.file,
-      line: e.line || 0,
-      source: "internal",
-      ...meta,
-    }));
-  }
-  if (unresolvedCount > unresolvedSeen.size) {
-    findings.push(makeFinding({
-      category: "structure",
-      rule: "unresolved-import",
-      severity: "info",
-      confidence: "high",
-      title: `…and ${unresolvedCount - unresolvedSeen.size} more unresolved imports`,
-      detail: "Finding list capped at 100 unique unresolved imports; the count above is the true total.",
-      source: "internal",
-      ...meta,
-    }));
-  }
-
-  return { findings, usedPackages, declared: allDeclared };
-}
-
-export const computeScopedDepFindings = createScopedDepFindings(computeDepFindings)
-
-export { computeGoDepFindings, computePyDepFindings } from "./dep-check-ecosystems.js";

package/src/analysis/dep-rules.js

@@ -1,10 +0,0 @@
-// Stable facade for structural dependency analysis.
-export {
-    buildFileImportGraph,
-    checkBoundaries,
-    findOrphans,
-    findSccs,
-    globToRe,
-    representativeCycle,
-} from './structure/dependency-graph.js'
-export {computeStructureFindings, isRustModuleTreeComponent} from './structure/findings.js'

package/src/analysis/dependency/conventions.js

@@ -1,16 +0,0 @@
-// Exact package contracts consumed by frameworks/build tools without a source
-// import. Keep them package-scope local; these are not repo-wide allowlists.
-export const FRAMEWORK_RUNTIME_PEERS = new Map([
-    ['next', ['react-dom']],
-    ['vinext', ['@vitejs/plugin-react', '@vitejs/plugin-rsc', 'react-server-dom-webpack', 'vite']],
-    ['electron-vite', ['vite']],
-    ['@cloudflare/vite-plugin', ['vite', 'wrangler']],
-])
-
-// Style preprocessors are compiler inputs proven by source extensions.
-export const IMPLICIT_STYLE_COMPILERS = new Map([
-    ['sass', /\.(?:scss|sass)$/i],
-    ['sass-embedded', /\.(?:scss|sass)$/i],
-    ['less', /\.less$/i],
-    ['stylus', /\.styl(?:us)?$/i],
-])