weavatrix 0.3.14 → 1.0.0

package/src/mcp/evidence/bun-lock-graph.mjs

@@ -1,209 +0,0 @@
-import {compareText, safeToken, STATE} from '../evidence-snapshot.common.mjs'
-import {
-    MAX_DEPENDENCY_DECLARATIONS, MAX_PACKAGE_RECORDS, PACKAGE_NAME,
-    dependencyDeclarations, emptyDeclarations, emptyGraph, finalizeGraph,
-    packageId, packageVersion,
-} from './package-graph-common.mjs'
-
-// Bun >= 1.2 writes JSONC: JSON plus comments and trailing commas.
-export function parseJsonc(text) {
-    const source = text.charCodeAt(0) === 0xfeff ? text.slice(1) : text
-    const out = []
-    let i = 0
-    const length = source.length
-    const skipComment = (index) => {
-        if (source[index] !== '/') return index
-        if (source[index + 1] === '/') {
-            let cursor = index + 2
-            while (cursor < length && source[cursor] !== '\n') cursor++
-            return cursor
-        }
-        if (source[index + 1] === '*') {
-            let cursor = index + 2
-            while (cursor < length && !(source[cursor] === '*' && source[cursor + 1] === '/')) cursor++
-            return Math.min(cursor + 2, length)
-        }
-        return index
-    }
-    while (i < length) {
-        const char = source[i]
-        if (char === '"') {
-            const start = i
-            i++
-            while (i < length && source[i] !== '"') i += source[i] === '\\' ? 2 : 1
-            i = Math.min(i + 1, length)
-            out.push(source.slice(start, i))
-            continue
-        }
-        if (char === '/') {
-            const next = skipComment(i)
-            if (next !== i) { i = next; continue }
-        }
-        if (char === ',') {
-            let ahead = i + 1
-            while (ahead < length) {
-                if (/\s/.test(source[ahead])) { ahead++; continue }
-                const next = skipComment(ahead)
-                if (next !== ahead) { ahead = next; continue }
-                break
-            }
-            if (ahead < length && (source[ahead] === '}' || source[ahead] === ']')) { i++; continue }
-        }
-        out.push(char)
-        i++
-    }
-    return JSON.parse(out.join(''))
-}
-
-function bunKeySegments(key) {
-    if (typeof key !== 'string' || key.length === 0 || key.length > 4096 || /[\u0000-\u001f\u007f]/.test(key)) return null
-    const parts = key.split('/')
-    const segments = []
-    for (let index = 0; index < parts.length; index++) {
-        let segment = parts[index]
-        if (segment.startsWith('@')) {
-            if (index + 1 >= parts.length) return null
-            segment = `${segment}/${parts[++index]}`
-        }
-        if (segment.length > 256 || !PACKAGE_NAME.test(segment)) return null
-        segments.push(segment)
-    }
-    return segments
-}
-
-function bunPackageRecord(entry) {
-    if (!Array.isArray(entry) || typeof entry[0] !== 'string' || entry[0].length > 1024) return null
-    const at = entry[0].lastIndexOf('@')
-    if (at <= 0) return null
-    const name = entry[0].slice(0, at)
-    if (name.length > 256 || !PACKAGE_NAME.test(name)) return null
-    const rawVersion = entry[0].slice(at + 1)
-    const meta = entry.slice(1).find((value) => value && typeof value === 'object' && !Array.isArray(value)) || {}
-    return {name, rawVersion, workspace: rawVersion.startsWith('workspace:'), meta}
-}
-
-function bunDeclarationRecord(meta) {
-    if (!meta || typeof meta !== 'object' || Array.isArray(meta)) return {}
-    const peerDependenciesMeta = {}
-    if (Array.isArray(meta.optionalPeers)) {
-        for (const name of meta.optionalPeers) if (typeof name === 'string') peerDependenciesMeta[name] = {optional: true}
-    }
-    return {
-        dependencies: meta.dependencies,
-        devDependencies: meta.devDependencies,
-        optionalDependencies: meta.optionalDependencies,
-        peerDependencies: meta.peerDependencies,
-        peerDependenciesMeta,
-    }
-}
-
-function resolveBunDependency(sourceSegments, name, records) {
-    for (let depth = sourceSegments.length; depth >= 0; depth--) {
-        const key = [...sourceSegments.slice(0, depth), name].join('/')
-        const record = records.get(key)
-        if (record) return {key, record}
-    }
-    return null
-}
-
-function applyBunReachabilityFlags(nodes, edges) {
-    const adjacency = new Map()
-    for (const edge of edges) {
-        if (!adjacency.has(edge.from)) adjacency.set(edge.from, [])
-        adjacency.get(edge.from).push(edge)
-    }
-    const reach = (excluded) => {
-        const seen = new Set(['(root)'])
-        const queue = ['(root)']
-        while (queue.length) {
-            for (const edge of adjacency.get(queue.pop()) || []) {
-                if (excluded.has(edge.kind) || seen.has(edge.to)) continue
-                seen.add(edge.to)
-                queue.push(edge.to)
-            }
-        }
-        return seen
-    }
-    const withoutDev = reach(new Set(['dev']))
-    const withoutOptional = reach(new Set(['optional', 'optional-peer']))
-    const withoutPeer = reach(new Set(['peer', 'optional-peer']))
-    for (const node of nodes) {
-        node.dev = !withoutDev.has(node.id)
-        node.optional = !withoutOptional.has(node.id)
-        node.peer = !withoutPeer.has(node.id)
-    }
-}
-
-export function parseBunLock(lock, lockfile) {
-    const lockfileVersion = Number(lock?.lockfileVersion)
-    const extras = {lockfile, lockfileVersion: Number.isFinite(lockfileVersion) ? Math.trunc(lockfileVersion) : 0}
-    if (!lock?.packages || typeof lock.packages !== 'object' || Array.isArray(lock.packages)) {
-        return emptyGraph(STATE.PARTIAL, 'BUN_LOCK_PACKAGES_REQUIRED', extras)
-    }
-    const allKeys = Object.keys(lock.packages).sort(compareText)
-    const selectedKeys = allKeys.slice(0, MAX_PACKAGE_RECORDS)
-    const reasons = []
-    if (selectedKeys.length < allKeys.length) reasons.push('LOCKFILE_PACKAGE_RECORD_LIMIT_REACHED')
-    const records = new Map()
-    let invalidRecords = 0
-    for (const key of selectedKeys) {
-        const segments = bunKeySegments(key)
-        const record = segments ? bunPackageRecord(lock.packages[key]) : null
-        if (!record) { invalidRecords++; continue }
-        records.set(key, {...record, segments})
-    }
-    if (invalidRecords > 0) reasons.push('INVALID_LOCKFILE_PACKAGE_RECORDS')
-    const externalNodes = new Map()
-    let invalidPackageVersions = 0
-    for (const [key, record] of records) {
-        if (record.workspace) continue
-        const version = packageVersion(record.rawVersion)
-        if (!version) { invalidPackageVersions++; continue }
-        externalNodes.set(key, {
-            id: packageId(record.name, version, key), name: record.name, version,
-            direct: false, dev: false, optional: false, peer: false,
-        })
-    }
-    if (invalidPackageVersions > 0) reasons.push('INVALID_LOCKFILE_PACKAGE_VERSIONS')
-    const workspaces = lock?.workspaces && typeof lock.workspaces === 'object' && !Array.isArray(lock.workspaces)
-        ? lock.workspaces : null
-    if (!workspaces) reasons.push('BUN_LOCK_WORKSPACES_MISSING')
-    const sources = []
-    for (const path of Object.keys(workspaces || {}).sort(compareText)) {
-        const meta = workspaces[path]
-        if (!meta || typeof meta !== 'object' || Array.isArray(meta)) continue
-        const workspaceName = path === '' ? null : safeToken(meta.name)
-        const segments = workspaceName && records.has(workspaceName) ? [workspaceName] : []
-        sources.push({sourceId: '(root)', segments, declarationRecord: bunDeclarationRecord(meta)})
-    }
-    for (const [key, record] of [...records].sort(([a], [b]) => compareText(a, b))) {
-        const node = externalNodes.get(key)
-        if (node) sources.push({sourceId: node.id, segments: record.segments, declarationRecord: bunDeclarationRecord(record.meta)})
-    }
-    const edgeMap = new Map()
-    const declarations = emptyDeclarations()
-    let declarationLimitReached = false
-    outer: for (const source of sources) {
-        for (const declaration of dependencyDeclarations(source.declarationRecord)) {
-            if (declarations.total >= MAX_DEPENDENCY_DECLARATIONS) { declarationLimitReached = true; break outer }
-            declarations.total++
-            const resolved = resolveBunDependency(source.segments, declaration.name, records)
-            if (resolved?.record.workspace) { declarations.local++; continue }
-            const node = resolved ? externalNodes.get(resolved.key) : null
-            if (!node) {
-                if (declaration.kind === 'optional' || declaration.kind === 'optional-peer') declarations.optionalMissing++
-                else declarations.unresolved++
-                continue
-            }
-            declarations.resolved++
-            if (source.sourceId === '(root)') node.direct = true
-            if (source.sourceId === node.id) continue
-            const edge = {from: source.sourceId, to: node.id, kind: declaration.kind}
-            edgeMap.set(`${edge.from}\0${edge.to}\0${edge.kind}`, edge)
-        }
-    }
-    if (declarationLimitReached) reasons.push('LOCKFILE_DEPENDENCY_DECLARATION_LIMIT_REACHED')
-    if (declarations.unresolved > 0) reasons.push('UNRESOLVED_LOCKFILE_DEPENDENCIES')
-    applyBunReachabilityFlags(externalNodes.values(), edgeMap.values())
-    return finalizeGraph({externalNodes, edgeMap, declarations, reasons, lockfile, lockfileVersion: extras.lockfileVersion})
-}

package/src/mcp/evidence/duplicate-member-order.mjs

@@ -1,8 +0,0 @@
-const compareText = (left, right) => String(left).localeCompare(String(right), 'en')
-
-// Snapshot construction and source-free payload validation must use the same stable
-// member order or equivalent evidence can hash differently across the boundary.
-export function compareDuplicateMember(left, right) {
-    return compareText(left.file, right.file) || left.startLine - right.startLine ||
-        left.endLine - right.endLine || compareText(left.graphNodeId || '', right.graphNodeId || '')
-}

package/src/mcp/evidence/package-graph-common.mjs

@@ -1,115 +0,0 @@
-import {createHash} from 'node:crypto'
-import {CAPS, STATE, compareText, safeToken} from '../evidence-snapshot.common.mjs'
-
-export const MAX_LOCKFILE_BYTES = 64 * 1024 * 1024
-export const MAX_PACKAGE_RECORDS = 50_000
-export const MAX_DEPENDENCY_DECLARATIONS = 200_000
-export const PACKAGE_NAME = /^(?:@[a-z0-9._-]+\/)?[a-z0-9][a-z0-9._-]*$/i
-const PACKAGE_VERSION = /^[A-Za-z0-9][A-Za-z0-9._+~-]*$/
-
-export const packageVersion = (value) => {
-    const version = safeToken(value, 128)
-    return version && PACKAGE_VERSION.test(version) ? version : null
-}
-
-export const emptyDeclarations = () => ({total: 0, resolved: 0, unresolved: 0, local: 0, optionalMissing: 0})
-
-export function emptyGraph(state, reason, extras = {}) {
-    const emptyCount = () => ({total: 0, returned: 0, truncated: false})
-    return {
-        state,
-        ecosystem: 'npm',
-        root: '(root)',
-        ...extras,
-        completeness: {
-            nodes: emptyCount(),
-            edges: emptyCount(),
-            declarations: emptyDeclarations(),
-            reasons: reason ? [reason] : [],
-        },
-        nodes: [],
-        edges: [],
-    }
-}
-
-export function normalizeLockPath(value) {
-    if (typeof value !== 'string' || value.length > 4096 || /[\u0000-\u001f\u007f]/.test(value)) return null
-    const raw = value.replace(/\\/g, '/')
-    if (/^(?:[a-z][a-z0-9+.-]*:|\/)/i.test(raw)) return null
-    const normalized = raw.replace(/\/$/, '')
-    if (normalized === '') return ''
-    const parts = normalized.split('/')
-    return parts.every((part) => part && part !== '.' && part !== '..') ? normalized : null
-}
-
-export function packageNameFromPath(packagePath) {
-    const match = packagePath.match(/(?:^|\/)node_modules\/((?:@[^/]+\/)?[^/]+)$/)
-    const name = match?.[1]
-    return name && name.length <= 256 && PACKAGE_NAME.test(name) ? name : null
-}
-
-export function packageId(name, version, packagePath) {
-    const location = createHash('sha256').update(packagePath).digest('hex').slice(0, 12)
-    return `npm:${name}@${version}:${location}`
-}
-
-export function parentInstallPath(packagePath) {
-    const marker = packagePath.lastIndexOf('/node_modules/')
-    return marker >= 0 ? packagePath.slice(0, marker) : ''
-}
-
-export function dependencyDeclarations(record) {
-    const declarations = new Map()
-    const add = (values, kind, replace = false) => {
-        if (!values || typeof values !== 'object' || Array.isArray(values)) return
-        for (const name of Object.keys(values)) {
-            if (name.length > 256 || !PACKAGE_NAME.test(name)) continue
-            if (replace || !declarations.has(name)) declarations.set(name, kind)
-        }
-    }
-    add(record?.dependencies, 'runtime')
-    add(record?.devDependencies, 'dev')
-    add(record?.optionalDependencies, 'optional', true)
-    if (record?.peerDependencies && typeof record.peerDependencies === 'object' && !Array.isArray(record.peerDependencies)) {
-        for (const name of Object.keys(record.peerDependencies)) {
-            if (name.length > 256 || !PACKAGE_NAME.test(name) || declarations.has(name)) continue
-            const optional = record?.peerDependenciesMeta?.[name]?.optional === true
-            declarations.set(name, optional ? 'optional-peer' : 'peer')
-        }
-    }
-    return [...declarations].map(([name, kind]) => ({name, kind}))
-        .sort((a, b) => compareText(a.name, b.name) || compareText(a.kind, b.kind))
-}
-
-export function finalizeGraph({externalNodes, edgeMap, declarations, reasons, lockfile, lockfileVersion}) {
-    const allNodes = [...externalNodes.values()].sort((a, b) =>
-        Number(b.direct) - Number(a.direct) || compareText(a.name, b.name) ||
-        compareText(a.version, b.version) || compareText(a.id, b.id))
-    const nodes = allNodes.slice(0, CAPS.packageGraphNodes)
-    const nodeIds = new Set(nodes.map((node) => node.id))
-    const allEdges = [...edgeMap.values()].sort((a, b) =>
-        compareText(a.from, b.from) || compareText(a.to, b.to) || compareText(a.kind, b.kind))
-    const eligibleEdges = allEdges.filter((edge) =>
-        (edge.from === '(root)' || nodeIds.has(edge.from)) && nodeIds.has(edge.to))
-    const edges = eligibleEdges.slice(0, CAPS.packageGraphEdges)
-    const nodesTruncated = nodes.length < allNodes.length
-    const edgesTruncated = edges.length < allEdges.length
-    if (nodesTruncated) reasons.push('PACKAGE_NODE_LIMIT_REACHED')
-    if (edgesTruncated) reasons.push('PACKAGE_EDGE_LIMIT_REACHED')
-
-    return {
-        state: reasons.length ? STATE.PARTIAL : STATE.COMPLETE,
-        ecosystem: 'npm',
-        lockfile,
-        lockfileVersion,
-        root: '(root)',
-        completeness: {
-            nodes: {total: allNodes.length, returned: nodes.length, truncated: nodesTruncated},
-            edges: {total: allEdges.length, returned: edges.length, truncated: edgesTruncated},
-            declarations,
-            reasons: [...new Set(reasons)].sort(compareText),
-        },
-        nodes,
-        edges,
-    }
-}

package/src/mcp/evidence/package-lock-graph.mjs

@@ -1,92 +0,0 @@
-import {compareText, STATE} from '../evidence-snapshot.common.mjs'
-import {
-    MAX_DEPENDENCY_DECLARATIONS, MAX_PACKAGE_RECORDS, dependencyDeclarations,
-    emptyDeclarations, emptyGraph, finalizeGraph, normalizeLockPath, packageId,
-    packageNameFromPath, packageVersion, parentInstallPath,
-} from './package-graph-common.mjs'
-
-function resolveDependency(sourcePath, name, records, externalNodes) {
-    let cursor = sourcePath
-    const seen = new Set()
-    while (!seen.has(cursor)) {
-        seen.add(cursor)
-        const candidate = cursor ? `${cursor}/node_modules/${name}` : `node_modules/${name}`
-        const record = records.get(candidate)
-        if (record) {
-            if (record.link === true) return {kind: 'local'}
-            const node = externalNodes.get(candidate)
-            return node ? {kind: 'external', node} : {kind: 'unresolved'}
-        }
-        if (!cursor) break
-        cursor = parentInstallPath(cursor)
-    }
-    return {kind: 'unresolved'}
-}
-
-export function parsePackageLock(lock, lockfile) {
-    const lockfileVersion = Number(lock?.lockfileVersion || 0)
-    const extras = {lockfile, lockfileVersion: Number.isFinite(lockfileVersion) ? Math.trunc(lockfileVersion) : 0}
-    if (![2, 3].includes(lockfileVersion) || !lock?.packages || typeof lock.packages !== 'object' || Array.isArray(lock.packages)) {
-        return emptyGraph(STATE.PARTIAL, 'PACKAGE_LOCK_V2_V3_REQUIRED', extras)
-    }
-    const allKeys = Object.keys(lock.packages).sort(compareText)
-    const selectedKeys = allKeys.slice(0, MAX_PACKAGE_RECORDS)
-    const reasons = []
-    if (selectedKeys.length < allKeys.length) reasons.push('LOCKFILE_PACKAGE_RECORD_LIMIT_REACHED')
-    const records = new Map()
-    let invalidRecords = 0
-    for (const rawPath of selectedKeys) {
-        const packagePath = normalizeLockPath(rawPath)
-        const record = lock.packages[rawPath]
-        if (packagePath == null || !record || typeof record !== 'object' || Array.isArray(record) ||
-            ((packagePath.startsWith('node_modules/') || packagePath.includes('/node_modules/')) && !packageNameFromPath(packagePath)) || records.has(packagePath)) {
-            invalidRecords++
-            continue
-        }
-        records.set(packagePath, record)
-    }
-    if (invalidRecords > 0) reasons.push('INVALID_LOCKFILE_PACKAGE_RECORDS')
-    const externalNodes = new Map()
-    let invalidPackageVersions = 0
-    for (const [packagePath, record] of records) {
-        const name = packageNameFromPath(packagePath)
-        const version = packageVersion(record.version)
-        if (!name || record.link === true) continue
-        if (!version) { invalidPackageVersions++; continue }
-        externalNodes.set(packagePath, {
-            id: packageId(name, version, packagePath), name, version, direct: false,
-            dev: record.dev === true || record.devOptional === true,
-            optional: record.optional === true || record.devOptional === true,
-            peer: record.peer === true,
-        })
-    }
-    if (invalidPackageVersions > 0) reasons.push('INVALID_LOCKFILE_PACKAGE_VERSIONS')
-    const edgeMap = new Map()
-    const declarations = emptyDeclarations()
-    let declarationLimitReached = false
-    const sources = [...records].filter(([packagePath]) => packageNameFromPath(packagePath) == null || externalNodes.has(packagePath))
-        .sort(([a], [b]) => compareText(a, b))
-    outer: for (const [sourcePath, record] of sources) {
-        const sourceNode = externalNodes.get(sourcePath)
-        const sourceId = sourceNode?.id || '(root)'
-        for (const declaration of dependencyDeclarations(record)) {
-            if (declarations.total >= MAX_DEPENDENCY_DECLARATIONS) { declarationLimitReached = true; break outer }
-            declarations.total++
-            const resolved = resolveDependency(sourcePath, declaration.name, records, externalNodes)
-            if (resolved.kind === 'local') { declarations.local++; continue }
-            if (resolved.kind !== 'external') {
-                if (declaration.kind === 'optional' || declaration.kind === 'optional-peer') declarations.optionalMissing++
-                else declarations.unresolved++
-                continue
-            }
-            declarations.resolved++
-            if (sourceId === '(root)') resolved.node.direct = true
-            if (sourceId === resolved.node.id) continue
-            const edge = {from: sourceId, to: resolved.node.id, kind: declaration.kind}
-            edgeMap.set(`${edge.from}\0${edge.to}\0${edge.kind}`, edge)
-        }
-    }
-    if (declarationLimitReached) reasons.push('LOCKFILE_DEPENDENCY_DECLARATION_LIMIT_REACHED')
-    if (declarations.unresolved > 0) reasons.push('UNRESOLVED_LOCKFILE_DEPENDENCIES')
-    return finalizeGraph({externalNodes, edgeMap, declarations, reasons, lockfile, lockfileVersion})
-}

package/src/mcp/evidence-snapshot.architecture.mjs

@@ -1,80 +0,0 @@
-import {
-    CAPS, STATE, VERDICT, bounded, compareText, moduleId, nonNegativeInteger,
-} from './evidence-snapshot.common.mjs'
-
-function sanitizeModule(value) {
-    const id = moduleId(value?.name)
-    if (!id) return null
-    return {
-        id,
-        fileCount: nonNegativeInteger(value.fileCount),
-        nodeCount: nonNegativeInteger(value.nodeCount),
-        symbolCount: nonNegativeInteger(value.symbolCount),
-    }
-}
-
-function sanitizeModuleDependency(value) {
-    const from = moduleId(value?.from)
-    const to = moduleId(value?.to)
-    if (!from || !to || from === to) return null
-    return {from, to, count: nonNegativeInteger(value.count)}
-}
-
-function sortedModuleDependencies(values) {
-    return (Array.isArray(values) ? values : [])
-        .map(sanitizeModuleDependency)
-        .filter(Boolean)
-        .sort((a, b) => compareText(a.from, b.from) || compareText(a.to, b.to) || a.count - b.count)
-}
-
-export function buildArchitectureSection(graph, aggregate, audit, structure) {
-    if (!aggregate) {
-        return {
-            state: STATE.ERROR,
-            verdict: VERDICT.UNKNOWN,
-            completeness: {reasons: ['GRAPH_AGGREGATION_ERROR']},
-            modules: [],
-            dependencies: {runtime: [], typeOnly: [], compileOnly: []},
-            cycles: [],
-            boundaryViolations: [],
-        }
-    }
-
-    const modules = bounded(
-        (aggregate.modules || []).map(sanitizeModule).filter(Boolean).sort((a, b) => compareText(a.id, b.id)),
-        CAPS.modules,
-    )
-    const runtime = bounded(sortedModuleDependencies(aggregate.moduleEdges), CAPS.moduleDependencies)
-    const typeOnly = bounded(sortedModuleDependencies(aggregate.typeOnlyModuleEdges), CAPS.moduleDependencies)
-    const compileOnly = bounded(sortedModuleDependencies(aggregate.compileOnlyModuleEdges), CAPS.moduleDependencies)
-    const cycles = structure?.cycles || bounded([], CAPS.architectureFindings)
-    const boundaries = structure?.boundaries || bounded([], CAPS.architectureFindings)
-
-    const edgeTypesComplete = Number.isInteger(graph?.edgeTypesV) && graph.edgeTypesV >= 2
-    const auditComplete = audit?.ok === true
-    const structureComplete = structure?.state === STATE.COMPLETE
-    const state = edgeTypesComplete && auditComplete && structureComplete ? STATE.COMPLETE : STATE.PARTIAL
-    const fails = cycles.items.some((cycle) => cycle.kind === 'runtime') || boundaries.items.length > 0
-    return {
-        state,
-        verdict: fails ? VERDICT.FAIL : state === STATE.COMPLETE ? VERDICT.PASS : VERDICT.UNKNOWN,
-        completeness: {
-            modules: modules.completeness,
-            runtimeDependencies: runtime.completeness,
-            typeOnlyDependencies: typeOnly.completeness,
-            compileOnlyDependencies: compileOnly.completeness,
-            cycles: cycles.completeness,
-            boundaryViolations: boundaries.completeness,
-            reasons: [
-                ...(!edgeTypesComplete ? ['EDGE_TYPES_V2_REQUIRED'] : []),
-                ...(!auditComplete ? ['AUDIT_UNAVAILABLE'] : []),
-                ...(!structureComplete ? ['STRUCTURE_EVIDENCE_UNAVAILABLE'] : []),
-            ],
-        },
-        modules: modules.items,
-        dependencies: {runtime: runtime.items, typeOnly: typeOnly.items, compileOnly: compileOnly.items},
-        cycles: cycles.items,
-        boundaryViolations: boundaries.items,
-        boundaryRulesState: structure?.rulesState || STATE.ERROR,
-    }
-}

package/src/mcp/evidence-snapshot.common.mjs

@@ -1,158 +0,0 @@
-import {createHash} from 'node:crypto'
-
-export const STATE = Object.freeze({
-    COMPLETE: 'COMPLETE',
-    PARTIAL: 'PARTIAL',
-    NOT_CHECKED: 'NOT_CHECKED',
-    NOT_APPLICABLE: 'NOT_APPLICABLE',
-    ERROR: 'ERROR',
-})
-
-export const VERDICT = Object.freeze({PASS: 'PASS', FAIL: 'FAIL', UNKNOWN: 'UNKNOWN'})
-
-export const CAPS = Object.freeze({
-    modules: 500,
-    moduleDependencies: 2_000,
-    architectureFindings: 150,
-    findings: 500,
-    hotspots: 250,
-    stackBadges: 100,
-    packages: 5_000,
-    directUsage: 1_000,
-    usageFiles: 20,
-    packageGraphNodes: 5_000,
-    packageGraphEdges: 20_000,
-    duplicateGroups: 100,
-    duplicateMembers: 12,
-    divergenceCandidates: 100,
-})
-
-export const COMPLEXITY_THRESHOLDS = Object.freeze({
-    loc: Object.freeze({warning: 120, high: 300}),
-    cyclomatic: Object.freeze({warning: 15, high: 30}),
-    params: Object.freeze({warning: 6, high: 10}),
-})
-
-const CONTROL_CHARS = /[\u0000-\u001f\u007f]/
-const ABSOLUTE_PATH_FRAGMENT = /(?:^|[\/\s"'`(=])[a-z]:[\\/]|(?:^|[\s"'`(=])(?:\\\\[^\\/\s]+(?:[\\/]|$)|file:(?:\/\/)?[\\/]|\/(?!\/)[^\s])/i
-const SAFE_TOKEN = /^[A-Za-z0-9@][A-Za-z0-9._:+/@-]*$/
-const SAFE_RULE = /^[a-z0-9][a-z0-9._-]*$/
-const SAFE_FINDING_ID = /^[a-f0-9]{8,64}$/i
-const SAFE_SEVERITY = new Set(['critical', 'high', 'medium', 'low', 'info'])
-const SAFE_CONFIDENCE = new Set(['high', 'medium', 'low'])
-const SAFE_CATEGORY = new Set(['unused', 'structure', 'vulnerability', 'malware'])
-const SAFE_CHECK_STATE = new Set(Object.values(STATE))
-
-export function metadataString(value, max = 512) {
-    return typeof value === 'string' && value.length > 0 && value.length <= max && !CONTROL_CHARS.test(value)
-        ? value
-        : undefined
-}
-
-export function privacySafeText(value, max = 512) {
-    const text = metadataString(value, max)
-    return text && !ABSOLUTE_PATH_FRAGMENT.test(text) ? text : undefined
-}
-
-export function safeToken(value, max = 256) {
-    const text = metadataString(value, max)
-    return text && SAFE_TOKEN.test(text) ? text : undefined
-}
-
-export function repoRelativePath(value, max = 4096) {
-    const raw = metadataString(value, max)
-    if (!raw) return undefined
-    const path = raw.replace(/\\/g, '/')
-    if (/^(?:[a-z][a-z0-9+.-]*:|\/)/i.test(path)) return undefined
-    const segments = path.split('/')
-    if (!segments.length || segments.some((segment) => !segment || segment === '.' || segment === '..')) return undefined
-    return path
-}
-
-export function graphId(value) {
-    const id = metadataString(value, 4096)
-    if (!id) return undefined
-    const hash = id.indexOf('#')
-    const file = hash < 0 ? id : id.slice(0, hash)
-    return repoRelativePath(file) ? id.replace(/\\/g, '/') : undefined
-}
-
-export function moduleId(value) {
-    if (value === '(root)') return '(root)'
-    return repoRelativePath(value)
-}
-
-export function nonNegativeInteger(value) {
-    return optionalNonNegativeInteger(value) ?? 0
-}
-
-export function optionalNonNegativeInteger(value) {
-    return typeof value === 'number' && Number.isFinite(value) && value >= 0
-        ? Math.trunc(value)
-        : undefined
-}
-
-export function addIf(out, key, value) {
-    if (value !== undefined) out[key] = value
-}
-
-export function compareText(a, b) {
-    return String(a).localeCompare(String(b), 'en')
-}
-
-export function bounded(sortedItems, cap) {
-    const items = sortedItems.slice(0, cap)
-    return {
-        items,
-        completeness: {
-            total: sortedItems.length,
-            returned: items.length,
-            truncated: sortedItems.length > items.length,
-        },
-    }
-}
-
-function stableStringify(value) {
-    if (Array.isArray(value)) return `[${value.map(stableStringify).join(',')}]`
-    if (value && typeof value === 'object') {
-        return `{${Object.keys(value).sort(compareText).map((key) => `${JSON.stringify(key)}:${stableStringify(value[key])}`).join(',')}}`
-    }
-    return JSON.stringify(value)
-}
-
-export function hashSnapshot(snapshot) {
-    return createHash('sha256').update(stableStringify(snapshot)).digest('hex')
-}
-
-export function normalizeCheckState(value) {
-    if (value === 'OK') return STATE.COMPLETE
-    return SAFE_CHECK_STATE.has(value) ? value : STATE.ERROR
-}
-
-export function sanitizeFinding(value) {
-    if (!value || typeof value !== 'object' || Array.isArray(value)) return null
-    const id = metadataString(value.id, 64)
-    const category = metadataString(value.category, 32)
-    const rule = metadataString(value.rule, 64)
-    const severity = metadataString(value.severity, 16)
-    if (!id || !SAFE_FINDING_ID.test(id) || !category || !SAFE_CATEGORY.has(category) ||
-        !rule || !SAFE_RULE.test(rule) || !severity || !SAFE_SEVERITY.has(severity)) return null
-
-    const out = {id, category, rule, severity}
-    const confidence = metadataString(value.confidence, 16)
-    if (confidence && SAFE_CONFIDENCE.has(confidence)) out.confidence = confidence
-    addIf(out, 'file', repoRelativePath(value.file))
-    const line = optionalNonNegativeInteger(value.line)
-    if (line !== undefined) out.line = line
-    addIf(out, 'symbol', privacySafeText(value.symbol, 256))
-    addIf(out, 'package', safeToken(value.package))
-    addIf(out, 'version', safeToken(value.version, 128))
-    addIf(out, 'graphNodeId', graphId(value.graphNodeId))
-    return out
-}
-
-export function numericRecord(value, keys) {
-    const out = {}
-    for (const key of keys) out[key] = nonNegativeInteger(value?.[key])
-    return out
-}