weavatrix 0.3.14 → 1.0.0

package/src/graph/builder/lang-sql.js

@@ -1,263 +0,0 @@
-// SQL extractor. No SQL grammar ships in the pinned tree-sitter-wasms, so this module is textOnly:
-// a dependency-free statement scanner built for the graph's needs (symbols + references), NOT a SQL
-// parser. Symbols: CREATE TABLE/VIEW (+ columns as member symbols, ALTER TABLE ADD COLUMN included),
-// FUNCTION/PROCEDURE, INDEX, TRIGGER. References: FROM/JOIN/INSERT INTO/UPDATE…SET/DELETE FROM/
-// TRUNCATE/REFERENCES/EXECUTE FUNCTION/CALL inside .sql files, plus the same verbs found in string
-// literals of every other indexed language (scanEmbeddedSql) — that is what ties the code graph to
-// the database schema: a query in app code becomes a `references` edge onto the table it touches.
-// Known blind spots (kept honest downstream, see dead-check.js): ORM-generated SQL is invisible,
-// `SELECT *` consumes columns namelessly (tables get sql_star), DROP statements are not replayed.
-// String literals and comments are blanked before structural scanning so a quoted "SELECT" can
-// never fabricate a reference; dollar-quoted function bodies stay scannable on purpose.
-
-const NAME = String.raw`((?:[\`"\[]?[A-Za-z_][\w$]*[\`"\]]?\.)*[\`"\[]?[A-Za-z_][\w$]*[\`"\]]?)`;
-const cleanName = (raw) => String(raw || "").replace(/[`"\[\]]/g, "").split(".").pop();
-const CONSTRAINT_START = /^(?:CONSTRAINT|PRIMARY|FOREIGN|UNIQUE|CHECK|EXCLUDE|KEY|INDEX|LIKE|PERIOD)\b/i;
-
-// strings ('…' with '' doubling) and comments (-- …, /* … */) become spaces of equal length,
-// so offsets/line numbers survive and quoted text can't match structural patterns.
-function sanitizeSql(text) {
-  const out = text.split("");
-  let i = 0;
-  const blank = (from, to) => { for (let k = from; k < to; k++) if (out[k] !== "\n") out[k] = " "; };
-  while (i < text.length) {
-    const ch = text[i], next = text[i + 1];
-    if (ch === "-" && next === "-") { let j = i; while (j < text.length && text[j] !== "\n") j++; blank(i, j); i = j; continue; }
-    if (ch === "/" && next === "*") { let j = text.indexOf("*/", i + 2); j = j < 0 ? text.length : j + 2; blank(i, j); i = j; continue; }
-    if (ch === "'") {
-      let j = i + 1;
-      while (j < text.length) { if (text[j] === "'") { if (text[j + 1] === "'") { j += 2; continue; } break; } j++; }
-      blank(i + 1, Math.min(j, text.length)); i = j + 1; continue;
-    }
-    i++;
-  }
-  return out.join("");
-}
-
-const lineIndex = (text) => {
-  const starts = [0];
-  for (let i = 0; i < text.length; i++) if (text[i] === "\n") starts.push(i + 1);
-  return (offset) => {
-    let lo = 0, hi = starts.length - 1;
-    while (lo < hi) { const mid = (lo + hi + 1) >> 1; if (starts[mid] <= offset) lo = mid; else hi = mid - 1; }
-    return lo + 1;
-  };
-};
-
-// split a CREATE TABLE body on top-level commas, keeping each part's offset
-function splitColumns(body, base) {
-  const parts = [];
-  let depth = 0, start = 0;
-  for (let i = 0; i < body.length; i++) {
-    const ch = body[i];
-    if (ch === "(") depth++;
-    else if (ch === ")") depth--;
-    else if (ch === "," && depth === 0) { parts.push({ text: body.slice(start, i), offset: base + start }); start = i + 1; }
-  }
-  parts.push({ text: body.slice(start), offset: base + start });
-  return parts;
-}
-
-const REF_PATTERNS = [
-  new RegExp(String.raw`\bFROM\s+${NAME}`, "gi"),
-  new RegExp(String.raw`\bJOIN\s+${NAME}`, "gi"),
-  new RegExp(String.raw`\bINSERT\s+INTO\s+${NAME}`, "gi"),
-  new RegExp(String.raw`\bMERGE\s+INTO\s+${NAME}`, "gi"),
-  new RegExp(String.raw`\bUPDATE\s+(?:ONLY\s+)?${NAME}\s+SET\b`, "gi"),
-  new RegExp(String.raw`\bTRUNCATE\s+(?:TABLE\s+)?${NAME}`, "gi"),
-  new RegExp(String.raw`\bREFERENCES\s+${NAME}`, "gi"),
-  new RegExp(String.raw`\bEXECUTE\s+(?:FUNCTION|PROCEDURE)\s+${NAME}`, "gi"),
-];
-const STAR_RE = /\bSELECT\s+(?:[A-Za-z_]\w*\.)?\*/i;
-
-export default {
-  family: "sql",
-  grammars: [],
-  exts: { ".sql": "sql" },
-  isWeb: false,
-  textOnly: true,
-  calls: null,
-  heritage: [],
-
-  pass1(ctx) {
-    const { fileRel, code, addSym, links, sqlRefs } = ctx;
-    const text = sanitizeSql(String(code || ""));
-    const lineOf = lineIndex(text);
-    const fakeNode = (startOffset, endOffset) => ({
-      startPosition: { row: lineOf(startOffset) - 1, column: 0 },
-      endPosition: { row: lineOf(Math.max(startOffset, endOffset - 1)) - 1, column: 0 },
-    });
-
-    // statements with offsets (';' inside dollar-quoted bodies splits early — refs/lines still land right)
-    const statements = [];
-    let cursor = 0;
-    while (cursor <= text.length) {
-      let end = text.indexOf(";", cursor);
-      if (end < 0) end = text.length;
-      if (text.slice(cursor, end).trim()) statements.push({ text: text.slice(cursor, end), offset: cursor });
-      cursor = end + 1;
-    }
-
-    const addRef = (table, offset, star) => {
-      const name = cleanName(table);
-      if (/^[A-Za-z_][\w$]*$/.test(name)) sqlRefs.push({ file: fileRel, line: lineOf(offset), table: name, star: !!star });
-    };
-
-    for (const stmt of statements) {
-      const at = (m) => stmt.offset + m.index;
-      const definedHere = new Set();
-      const defineSym = (raw, m, callable, extra) => {
-        const name = cleanName(raw);
-        definedHere.add(name);
-        return addSym(name, lineOf(at(m)), callable, {
-          sourceNode: fakeNode(at(m), stmt.offset + stmt.text.length),
-          exported: true, moduleDeclaration: true, ...extra,
-        });
-      };
-
-      let m;
-      if ((m = stmt.text.match(new RegExp(String.raw`\bCREATE\s+(?:GLOBAL\s+|LOCAL\s+)?(?:TEMP(?:ORARY)?\s+|UNLOGGED\s+)?TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?${NAME}\s*\(`, "i")))) {
-        const tableName = cleanName(m[1]);
-        const open = stmt.offset + m.index + m[0].length - 1;
-        let depth = 0, close = open;
-        for (let i = open; i < text.length; i++) { if (text[i] === "(") depth++; else if (text[i] === ")" && --depth === 0) { close = i; break; } }
-        const fieldTypes = {};
-        const columns = [];
-        for (const part of splitColumns(text.slice(open + 1, close), open + 1)) {
-          const trimmed = part.text.trim();
-          if (!trimmed || CONSTRAINT_START.test(trimmed)) continue;
-          const col = trimmed.match(new RegExp(String.raw`^${NAME}\s+([A-Za-z_]\w*(?:\([^)]*\))?)`));
-          if (!col) continue;
-          const colName = cleanName(col[1]);
-          if (!/^[A-Za-z_][\w$]*$/.test(colName)) continue;
-          fieldTypes[colName] = col[2];
-          columns.push({ name: colName, offset: part.offset + part.text.indexOf(col[1]) });
-        }
-        const tableId = defineSym(m[1], m, false, { symbolKind: "table", fieldTypes });
-        for (const column of columns) {
-          const columnId = addSym(column.name, lineOf(column.offset), false, {
-            sourceNode: fakeNode(column.offset, column.offset + 1),
-            symbolKind: "column", memberOf: tableName,
-          });
-          if (tableId && columnId) links.push({ source: tableId, target: columnId, relation: "contains", confidence: "EXTRACTED" });
-        }
-      } else if ((m = stmt.text.match(new RegExp(String.raw`\bCREATE\s+(?:OR\s+REPLACE\s+)?(?:MATERIALIZED\s+)?VIEW\s+(?:IF\s+NOT\s+EXISTS\s+)?${NAME}`, "i")))) {
-        defineSym(m[1], m, false, { symbolKind: "view" });
-      } else if ((m = stmt.text.match(new RegExp(String.raw`\bCREATE\s+(?:OR\s+REPLACE\s+)?(?:FUNCTION|PROCEDURE)\s+${NAME}`, "i")))) {
-        defineSym(m[1], m, true, { symbolKind: "function" });
-      } else if ((m = stmt.text.match(new RegExp(String.raw`\bCREATE\s+(?:UNIQUE\s+)?INDEX\s+(?:CONCURRENTLY\s+)?(?:IF\s+NOT\s+EXISTS\s+)?${NAME}\s+ON\s+(?:ONLY\s+)?${NAME}`, "i")))) {
-        defineSym(m[1], m, false, { symbolKind: "index" });
-        addRef(m[2], at(m), false);
-      } else if ((m = stmt.text.match(new RegExp(String.raw`\bCREATE\s+(?:OR\s+REPLACE\s+)?(?:CONSTRAINT\s+)?TRIGGER\s+${NAME}[\s\S]*?\bON\s+${NAME}`, "i")))) {
-        defineSym(m[1], m, false, { symbolKind: "trigger" });
-        addRef(m[2], at(m), false);
-      } else if ((m = stmt.text.match(new RegExp(String.raw`\bALTER\s+TABLE\s+(?:IF\s+EXISTS\s+)?(?:ONLY\s+)?${NAME}`, "i")))) {
-        const tableName = cleanName(m[1]);
-        addRef(m[1], at(m), false);
-        const addColumn = new RegExp(String.raw`\bADD\s+(?:COLUMN\s+)?(?:IF\s+NOT\s+EXISTS\s+)?(?!CONSTRAINT\b|PRIMARY\b|FOREIGN\b|UNIQUE\b|CHECK\b|EXCLUDE\b)${NAME}\s+[A-Za-z_]`, "gi");
-        for (const colMatch of stmt.text.matchAll(addColumn)) {
-          const colName = cleanName(colMatch[1]);
-          if (!/^[A-Za-z_][\w$]*$/.test(colName)) continue;
-          addSym(colName, lineOf(stmt.offset + colMatch.index), false, {
-            sourceNode: fakeNode(stmt.offset + colMatch.index, stmt.offset + colMatch.index + 1),
-            symbolKind: "column", memberOf: tableName,
-          });
-        }
-      }
-
-      const star = STAR_RE.test(stmt.text);
-      for (const pattern of REF_PATTERNS) {
-        pattern.lastIndex = 0;
-        for (const refMatch of stmt.text.matchAll(pattern)) {
-          const name = cleanName(refMatch[1]);
-          if (!definedHere.has(name)) addRef(refMatch[1], stmt.offset + refMatch.index, star);
-        }
-      }
-    }
-  },
-};
-
-// SQL verbs inside string literals of any host language — the cross-link between app code and schema.
-// Runs on RAW text (strings are exactly where the queries live); comments can over-match, which only
-// errs toward "referenced" and carries INFERRED confidence.
-const EMBEDDED = [
-  { re: new RegExp(String.raw`\bSELECT\b[^;]{0,2000}?\bFROM\s+${NAME}`, "gi"), star: true },
-  { re: new RegExp(String.raw`\bINSERT\s+INTO\s+${NAME}`, "gi") },
-  { re: new RegExp(String.raw`\bUPDATE\s+${NAME}\s+SET\b`, "gi") },
-  { re: new RegExp(String.raw`\bDELETE\s+FROM\s+${NAME}`, "gi") },
-  { re: new RegExp(String.raw`\bJOIN\s+${NAME}\b`, "gi") },
-  { re: new RegExp(String.raw`\bCALL\s+${NAME}\s*\(`, "gi") },
-];
-const EMBEDDED_PREFILTER = /\b(?:select|insert|update|delete|join|call)\b/i;
-
-export function scanEmbeddedSql(code, fileRel, sqlRefs) {
-  const text = String(code || "");
-  if (!EMBEDDED_PREFILTER.test(text)) return;
-  const lineOf = lineIndex(text);
-  for (const { re, star } of EMBEDDED) {
-    re.lastIndex = 0;
-    for (const m of text.matchAll(re)) {
-      const name = cleanName(m[1]);
-      if (!/^[A-Za-z_][\w$]*$/.test(name)) continue;
-      sqlRefs.push({ file: fileRel, line: lineOf(m.index), table: name, star: !!(star && STAR_RE.test(m[0])) });
-    }
-  }
-}
-
-// Dead-code policy for SQL schema objects, consumed by analysis/dead-check.js. Static liveness can
-// only be judged where the repo demonstrably uses literal SQL the scanner can read: without a single
-// embedded-SQL edge from host code, DB consumers (ORMs, external services) are invisible and every
-// verdict would be a guess. Indexes and triggers are DB-engine surface — never judged. Columns of a
-// `SELECT *`-consumed table are consumed namelessly — never judged by name.
-export function createSqlDeadVerdict({ nodes, links, ep, bareName }) {
-  const usageFromCode = links.some((l) => l.usage === "sql" && !String(ep(l.source)).split("#")[0].endsWith(".sql"));
-  const starTables = new Set(nodes.filter((n) => n.sql_star).map((n) => bareName(n.label)));
-  const classify = (n) => {
-    if (!String(n.source_file || "").endsWith(".sql")) return null;
-    const kind = String(n.symbol_kind || "");
-    if (kind === "index" || kind === "trigger" || !usageFromCode) return "veto";
-    if (kind === "column" && starTables.has(String(n.member_of || ""))) return "veto";
-    return "flag";
-  };
-  return {
-    veto: (n) => classify(n) === "veto",
-    reason: (n) => (classify(n) === "flag" ? "no SQL statement in the indexed sources references it" : null),
-  };
-}
-
-// After both passes: resolve collected refs against every table/view/function DEFINED in .sql files.
-// Unknown names drop silently — only schema objects the repo actually declares can gain edges.
-export function resolveSqlReferences({ sqlRefs, links, nodeById, perFileSymbols }) {
-  if (!sqlRefs?.length) return;
-  const index = new Map();
-  for (const [file, syms] of perFileSymbols) {
-    if (!file.endsWith(".sql")) continue;
-    for (const sym of syms) {
-      if (!["table", "view", "function"].includes(sym.symbolKind)) continue;
-      (index.get(sym.name) || index.set(sym.name, []).get(sym.name)).push(sym.id);
-    }
-  }
-  if (!index.size) return;
-  const enclosing = (file, line) => {
-    let best = null;
-    for (const symbol of perFileSymbols.get(file) || []) {
-      if (line < symbol.start || line > symbol.end) continue;
-      if (!best || symbol.start > best.start || (symbol.start === best.start && symbol.end < best.end)) best = symbol;
-    }
-    return best;
-  };
-  const seen = new Set();
-  for (const ref of sqlRefs) {
-    const targets = index.get(ref.table);
-    if (!targets) continue;
-    const source = enclosing(ref.file, ref.line)?.id || ref.file;
-    for (const target of targets) {
-      if (ref.star) { const node = nodeById.get(target); if (node) node.sql_star = true; }
-      if (target === source) continue;
-      const key = source + ">" + target;
-      if (seen.has(key)) continue;
-      seen.add(key);
-      links.push({ source, target, relation: "references", confidence: "INFERRED", usage: "sql", line: ref.line });
-    }
-  }
-}

package/src/graph/builder/pass2-resolution.js

@@ -1,81 +0,0 @@
-export function createPass2Resolution({symIdsByFileName, nodeById, importedLocals, symByFileName}) {
-    const dirSymbols = new Map(), dirMethods = new Map(), dirMethodsByName = new Map(), dirTypes = new Map()
-    // Rust associated functions / methods indexed by their owning type, per directory: `Type::method`
-    // resolves to the exact impl member instead of any same-named function in the directory.
-    const rustMethods = new Map() // dir -> Map(typeName -> Map(methodName -> id))
-    // .sol shares dir scope because Solidity's project namespace is flat: `import "./Base.sol"` names no
-    // symbols yet pulls every declaration into scope, so same-dir name resolution is the honest static proxy.
-    const sharesDirScope = (file) => file.endsWith('.go') || file.endsWith('.cs') || file.endsWith('.rs') || file.endsWith('.sol')
-    for (const [file, names] of symIdsByFileName) {
-        if (!sharesDirScope(file)) continue
-        const dir = file.includes('/') ? file.slice(0, file.lastIndexOf('/')) : ''
-        let symbols = dirSymbols.get(dir)
-        if (!symbols) dirSymbols.set(dir, (symbols = new Map()))
-        for (const [name, ids] of names) for (const id of ids) {
-            const node = nodeById.get(id)
-            if (file.endsWith('.go') && node?.member_of && node?.symbol_kind === 'method') {
-                let receivers = dirMethods.get(dir)
-                if (!receivers) dirMethods.set(dir, (receivers = new Map()))
-                let methods = receivers.get(node.member_of)
-                if (!methods) receivers.set(node.member_of, (methods = new Map()))
-                const exact = methods.get(name) || []
-                exact.push(id); methods.set(name, exact)
-                let byName = dirMethodsByName.get(dir)
-                if (!byName) dirMethodsByName.set(dir, (byName = new Map()))
-                const candidates = byName.get(name) || []
-                candidates.push(id); byName.set(name, candidates)
-                continue
-            }
-            if (!symbols.has(name)) symbols.set(name, id)
-            if (file.endsWith('.rs') && node?.member_of) {
-                let byType = rustMethods.get(dir)
-                if (!byType) rustMethods.set(dir, (byType = new Map()))
-                let methods = byType.get(node.member_of)
-                if (!methods) byType.set(node.member_of, (methods = new Map()))
-                if (!methods.has(name)) methods.set(name, id)
-            }
-            if (file.endsWith('.go') && node?.symbol_space === 'type') {
-                let types = dirTypes.get(dir)
-                if (!types) dirTypes.set(dir, (types = new Map()))
-                if (!types.has(name)) types.set(name, id)
-            }
-        }
-    }
-    const symbolSpace = (node) => {
-        const explicit = String(node?.symbol_space || '')
-        if (['value', 'type', 'both'].includes(explicit)) return explicit
-        const kind = String(node?.symbol_kind || '').toLowerCase()
-        if (['interface', 'type'].includes(kind)) return 'type'
-        return ['class', 'enum'].includes(kind) ? 'both' : 'value'
-    }
-    const resolveNamedSymbol = (file, name, space = 'value') => {
-        const ids = symIdsByFileName.get(file)?.get(name) || []
-        const exact = ids.find((id) => symbolSpace(nodeById.get(id)) === space)
-        return exact || ids.find((id) => ['both', space].includes(symbolSpace(nodeById.get(id)))) || null
-    }
-    const resolveCall = (name, file) => {
-        const local = resolveNamedSymbol(file, name, 'value')
-        if (local) return local
-        if (sharesDirScope(file)) {
-            const dir = file.includes('/') ? file.slice(0, file.lastIndexOf('/')) : ''
-            const symbols = dirSymbols.get(dir)
-            if (symbols?.has(name)) return symbols.get(name)
-        }
-        const imported = importedLocals.get(file)?.get(name)
-        if (!imported?.targetFile) return null
-        return resolveNamedSymbol(imported.originFile || imported.targetFile, imported.originName || imported.imported, 'value')
-    }
-    const resolveRustMethod = (dir, typeName, methodName) => rustMethods.get(dir)?.get(typeName)?.get(methodName) || null
-    const javaTypeKinds = new Set(['class', 'interface', 'enum', 'record', 'annotation'])
-    const resolveJavaType = (name, file) => {
-        const imported = importedLocals.get(file)?.get(name)
-        if (imported?.targetFile) {
-            const symbols = symByFileName.get(imported.targetFile)
-            const target = symbols?.get(imported.imported) || symbols?.get(name)
-            if (target && javaTypeKinds.has(nodeById.get(target)?.symbol_kind)) return target
-        }
-        const target = symByFileName.get(file)?.get(name)
-        return target && javaTypeKinds.has(nodeById.get(target)?.symbol_kind) ? target : null
-    }
-    return {dirSymbols, dirMethods, dirMethodsByName, dirTypes, resolveNamedSymbol, resolveCall, resolveJavaType, resolveRustMethod}
-}

package/src/graph/builder/spec-pkg.js

@@ -1,87 +0,0 @@
-// specToPkg(spec) — map an import specifier to its npm package name, a Node builtin, or null for
-// relative/absolute/URL specifiers. The core primitive for dependency analysis (unused/missing deps):
-// "axios/lib/core" → axios, "@scope/name/sub" → @scope/name, "node:fs/promises" + "fs/promises" → fs
-// (builtin), "./x" → null. See DEPS_SECURITY_PLAN.md (P0).
-
-// Builtins importable WITHOUT the node: prefix. Prefix-only builtins (node:test, node:sea, node:sqlite)
-// are deliberately NOT here — bare "test" is a legitimate npm package name; node:-prefixed specifiers
-// are always classified builtin regardless of this set.
-export const NODE_BUILTINS = new Set([
-  "assert", "async_hooks", "buffer", "child_process", "cluster", "console", "constants", "crypto",
-  "dgram", "diagnostics_channel", "dns", "domain", "events", "fs", "http", "http2", "https", "inspector",
-  "module", "net", "os", "path", "perf_hooks", "process", "punycode", "querystring", "readline", "repl",
-  "stream", "string_decoder", "sys", "timers", "tls", "trace_events", "tty", "url", "util", "v8", "vm",
-  "wasi", "worker_threads", "zlib",
-]);
-
-export function specToPkg(spec) {
-  const s = String(spec || "").trim();
-  if (!s || s.startsWith(".") || s.startsWith("/") || /^[A-Za-z]:[\\/]/.test(s)) return null; // relative/absolute/local
-  if (s.startsWith("#")) return null; // package.json "imports" subpath (self-internal), not a dependency
-  if (/^(https?|data|file):/.test(s)) return null; // URL-style imports aren't manifest deps
-  if (s.startsWith("node:")) return { pkg: s.slice(5).split("/")[0], builtin: true };
-  if (s === "bun" || s.startsWith("bun:")) return { pkg: s, builtin: true }; // Bun runtime modules (bun:test, bun:sqlite) — never npm deps
-  if (s.startsWith("npm:")) return specToPkg(s.slice(4)); // Deno/import-map npm: specifiers alias real npm packages
-  if (/^[a-z][\w+.-]*:/.test(s)) return null; // other scheme-style specifiers (jsr:, deno:, virtual:, …) aren't manifest deps
-  const parts = s.split("/");
-  const pkg = s.startsWith("@") ? (parts.length >= 2 ? `${parts[0]}/${parts[1]}` : s) : parts[0];
-  if (NODE_BUILTINS.has(pkg)) return { pkg, builtin: true };
-  return { pkg, builtin: false };
-}
-
-// ---- Go: import path → module (declared in go.mod) or stdlib. Stdlib packages have a dotless first
-// segment (fmt, net/http, encoding/json — and cgo's "C"); everything else is a module path. Prefer the
-// longest go.mod require prefix (exact module identity); fall back to a host-convention guess so
-// MISSING modules still get a sane name (github.com/owner/repo, gopkg.in/pkg.v3, k8s.io/client-go).
-const GO_DEEP_HOSTS = new Set(["github.com", "gitlab.com", "bitbucket.org", "golang.org", "go.googlesource.com"]);
-export function goSpecToPkg(importPath, { requires = [], ownModule = "" } = {}) {
-  const s = String(importPath || "").trim();
-  if (!s) return null;
-  const segs = s.split("/");
-  if (!segs[0].includes(".")) return { pkg: s, builtin: true }; // stdlib + "C"
-  if (ownModule && (s === ownModule || s.startsWith(ownModule + "/"))) return null; // own module → internal (broken path, not a dep)
-  let best = "";
-  for (const r of requires) { const p = typeof r === "string" ? r : r.path; if ((s === p || s.startsWith(p + "/")) && p.length > best.length) best = p; }
-  if (best) return { pkg: best, builtin: false };
-  let n = GO_DEEP_HOSTS.has(segs[0]) ? 3 : 2;
-  if (segs[0] === "gopkg.in") n = /\.v\d+$/.test(segs[1] || "") ? 2 : 3;
-  return { pkg: segs.slice(0, Math.min(n, segs.length)).join("/"), builtin: false };
-}
-
-// ---- Python: top-level imported module → PyPI distribution (or stdlib). PY_STDLIB ≈ CPython 3.12
-// sys.stdlib_module_names (public names) + legacy stalwarts, so old codebases classify cleanly too.
-export const PY_STDLIB = new Set(("__future__ __main__ _thread abc aifc argparse array ast asyncio atexit audioop base64 bdb binascii bisect builtins bz2 " +
-  "calendar cgi cgitb chunk cmath cmd code codecs codeop collections colorsys compileall concurrent configparser contextlib contextvars copy copyreg cProfile crypt csv ctypes curses " +
-  "dataclasses datetime dbm decimal difflib dis distutils doctest email encodings ensurepip enum errno faulthandler fcntl filecmp fileinput fnmatch fractions ftplib functools " +
-  "gc getopt getpass gettext glob graphlib grp gzip hashlib heapq hmac html http imaplib imghdr imp importlib inspect io ipaddress itertools json keyword " +
-  "linecache locale logging lzma mailbox mailcap marshal math mimetypes mmap modulefinder msilib msvcrt multiprocessing netrc nntplib ntpath numbers " +
-  "operator optparse os ossaudiodev pathlib pdb pickle pickletools pipes pkgutil platform plistlib poplib posixpath pprint profile pstats pty pwd py_compile pyclbr pydoc queue quopri " +
-  "random re readline reprlib resource rlcompleter runpy sched secrets select selectors shelve shlex shutil signal site smtplib sndhdr socket socketserver spwd sqlite3 ssl stat statistics " +
-  "sre_compile sre_constants sre_parse string stringprep struct subprocess sunau symtable sys sysconfig syslog tabnanny tarfile telnetlib tempfile termios textwrap threading time timeit tkinter token tokenize tomllib " +
-  "trace traceback tracemalloc tty turtle types typing unicodedata unittest urllib uu uuid venv warnings wave weakref webbrowser winreg winsound wsgiref xdrlib xml xmlrpc zipapp zipfile zipimport zlib zoneinfo").split(" "));
-
-// import name → PyPI dist where they differ. Generic python-X / X-python / X[2]-binary equivalence is
-// handled by the matcher in dep-check; this map covers the truly irregular names.
-const PY_IMPORT_TO_DIST = {
-  yaml: "PyYAML", cv2: "opencv-python", PIL: "Pillow", sklearn: "scikit-learn", skimage: "scikit-image",
-  bs4: "beautifulsoup4", dateutil: "python-dateutil", dotenv: "python-dotenv", jose: "python-jose",
-  magic: "python-magic", multipart: "python-multipart", docx: "python-docx", pptx: "python-pptx",
-  fitz: "PyMuPDF", OpenSSL: "pyOpenSSL", Crypto: "pycryptodome", nacl: "PyNaCl", jwt: "PyJWT",
-  MySQLdb: "mysqlclient", attr: "attrs", attrs: "attrs", git: "GitPython", github: "PyGithub",
-  kafka: "kafka-python", grpc: "grpcio", serial: "pyserial", usb: "pyusb", zmq: "pyzmq",
-  websocket: "websocket-client", socks: "PySocks", telegram: "python-telegram-bot",
-  speech_recognition: "SpeechRecognition", wx: "wxPython", cairo: "pycairo", gi: "PyGObject",
-  mpl_toolkits: "matplotlib", pkg_resources: "setuptools", Levenshtein: "python-Levenshtein",
-  ldap: "python-ldap", memcache: "python-memcached", slugify: "python-slugify", decouple: "python-decouple",
-  engineio: "python-engineio", socketio: "python-socketio", ruamel: "ruamel.yaml", flask: "Flask",
-  win32api: "pywin32", win32com: "pywin32", win32con: "pywin32", win32gui: "pywin32", pythoncom: "pywin32", pywintypes: "pywin32",
-};
-// namespace roots shared by many dists (google.protobuf/google.cloud.* …) — too ambiguous to name one
-// package; "src" is a repo-layout artifact (stale sys.path import), never a PyPI dist.
-const PY_AMBIGUOUS_TOP = new Set(["google", "src"]);
-export function pySpecToPkg(topModule) {
-  const t = String(topModule || "").trim();
-  if (!t) return null;
-  if (PY_STDLIB.has(t)) return { pkg: t, builtin: true };
-  return { pkg: PY_IMPORT_TO_DIST[t] || t, builtin: false, ambiguous: PY_AMBIGUOUS_TOP.has(t) };
-}

package/src/graph/community.js

@@ -1,27 +0,0 @@
-// Deterministic community territories. Most languages keep the historical top-two-folder bucket. Java
-// Maven/Gradle trees need package depth: otherwise every class under application/src becomes one giant blob.
-export function communityTerritoryOf(file) {
-  const normalized = String(file || "").replace(/\\/g, "/");
-  if (/\.java$/i.test(normalized)) {
-    const marker = /(?:^|\/)src\/(?:main|test)\/java\//.exec(normalized);
-    if (marker) {
-      const end = marker.index + marker[0].length;
-      const prefix = normalized.slice(0, end).replace(/\/$/, "");
-      const packageDirs = normalized.slice(end).split("/").filter(Boolean).slice(0, -1);
-      if (packageDirs.length) return `${prefix}/${packageDirs.slice(0, 5).join("/")}`;
-      return prefix;
-    }
-  }
-  const dirs = normalized.split("/").filter(Boolean).slice(0, -1);
-  return dirs.length ? dirs.slice(0, 2).join("/") : "(root)";
-}
-
-// Community ids are serialized into graph.json and therefore must not depend on which subset of
-// files happened to be reparsed. Assign ids from the complete, sorted territory universe so a
-// scoped incremental merge produces the same ids as a full build.
-export function assignDeterministicCommunities(nodes = []) {
-  const territories = [...new Set(nodes.map((node) => communityTerritoryOf(node?.source_file)))].sort();
-  const ids = new Map(territories.map((territory, index) => [territory, index]));
-  for (const node of nodes) node.community = ids.get(communityTerritoryOf(node?.source_file));
-  return nodes;
-}

package/src/graph/edge-provenance.js

@@ -1,31 +0,0 @@
-// Versioned origin classification for graph edges. `confidence` remains a compatibility field;
-// provenance says how an edge was established and leaves room for a bounded LSP precision overlay.
-export const EDGE_PROVENANCE_V = 1;
-export const EDGE_PROVENANCE_KINDS = Object.freeze([
-  "EXACT_LSP", "EXTRACTED", "RESOLVED", "INFERRED", "CONFLICT",
-]);
-
-const ALLOWED = new Set(EDGE_PROVENANCE_KINDS);
-
-export function edgeProvenance(edge) {
-  const explicit = String(edge?.provenance || "").trim().toUpperCase();
-  if (ALLOWED.has(explicit)) return explicit;
-  if (edge?.semanticOrigin === true) return "RESOLVED";
-  const legacy = String(edge?.confidence || "").trim().toUpperCase();
-  return ALLOWED.has(legacy) ? legacy : "UNKNOWN";
-}
-
-export function stampEdgeProvenance(links) {
-  for (const link of Array.isArray(links) ? links : []) {
-    const provenance = edgeProvenance(link);
-    if (provenance !== "UNKNOWN") link.provenance = provenance;
-  }
-  return links;
-}
-
-export function summarizeEdgeProvenance(links) {
-  const counts = Object.fromEntries([...EDGE_PROVENANCE_KINDS, "UNKNOWN"].map((kind) => [kind, 0]));
-  for (const link of Array.isArray(links) ? links : []) counts[edgeProvenance(link)] += 1;
-  const total = Array.isArray(links) ? links.length : 0;
-  return {version: EDGE_PROVENANCE_V, total, classified: total - counts.UNKNOWN, complete: counts.UNKNOWN === 0, counts};
-}

package/src/graph/file-lock.js

@@ -1,69 +0,0 @@
-// Small cross-process lock + atomic file replacement helpers for derived graph state. Multiple MCP
-// clients commonly run at once (Claude, Codex, desktop); a plain read -> write sequence can lose a
-// registry record or expose a half-written multi-megabyte graph to another reader.
-import {mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync} from 'node:fs'
-import {dirname} from 'node:path'
-import process from 'node:process'
-
-const wait = (ms) => new Promise((resolve) => setTimeout(resolve, ms))
-const waitSync = (ms) => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms)
-
-function clearStaleLock(lockDir, staleMs) {
-    try {
-        if (Date.now() - statSync(lockDir).mtimeMs <= staleMs) return false
-        try {
-            const ownerPid = Number(readFileSync(`${lockDir}/owner`, 'utf8').split(/\s+/)[0])
-            if (Number.isInteger(ownerPid) && ownerPid > 0) {
-                try { process.kill(ownerPid, 0); return false }
-                catch (error) { if (error?.code === 'EPERM') return false }
-            }
-        } catch { /* missing owner: stale age remains the authority */ }
-        rmSync(lockDir, {recursive: true, force: true})
-        return true
-    } catch { return false }
-}
-
-function acquired(lockDir) {
-    mkdirSync(dirname(lockDir), {recursive: true})
-    try {
-        mkdirSync(lockDir)
-        writeFileSync(`${lockDir}/owner`, `${process.pid}\n${new Date().toISOString()}\n`, 'utf8')
-        return true
-    } catch (error) {
-        if (error?.code === 'EEXIST') return false
-        throw error
-    }
-}
-
-export async function withFileLock(lockDir, fn, {timeoutMs = 10_000, staleMs = 60_000, pollMs = 25} = {}) {
-    const started = Date.now()
-    while (!acquired(lockDir)) {
-        clearStaleLock(lockDir, staleMs)
-        if (Date.now() - started >= timeoutMs) throw new Error(`timed out waiting for derived-state lock: ${lockDir}`)
-        await wait(pollMs)
-    }
-    try { return await fn() }
-    finally { rmSync(lockDir, {recursive: true, force: true}) }
-}
-
-export function withFileLockSync(lockDir, fn, {timeoutMs = 10_000, staleMs = 60_000, pollMs = 20} = {}) {
-    const started = Date.now()
-    while (!acquired(lockDir)) {
-        clearStaleLock(lockDir, staleMs)
-        if (Date.now() - started >= timeoutMs) throw new Error(`timed out waiting for derived-state lock: ${lockDir}`)
-        waitSync(pollMs)
-    }
-    try { return fn() }
-    finally { rmSync(lockDir, {recursive: true, force: true}) }
-}
-
-export function atomicWriteFileSync(path, data, encoding = undefined) {
-    mkdirSync(dirname(path), {recursive: true})
-    const temp = `${path}.${process.pid}.${Date.now()}.${Math.random().toString(16).slice(2)}.tmp`
-    try {
-        writeFileSync(temp, data, encoding)
-        renameSync(temp, path)
-    } finally {
-        try { rmSync(temp, {force: true}) } catch { /* already renamed */ }
-    }
-}