weavatrix 0.3.14 → 1.0.0

package/docs/releases/v0.3.4.md

@@ -1,40 +0,0 @@
-# Weavatrix 0.3.4
-
-0.3.4 is a focused self-audit precision release. It removes false Health and
-dead-code noise found while dogfooding Core against its own current source,
-without widening the 34-tool offline boundary.
-
-## Bounded dynamic-import evidence
-
-JS/TS graph construction now recognizes the statically named local module in
-URL-based imports such as
-``import(new URL(`./tools-health.mjs${cacheBust}`, import.meta.url).href)``.
-The resolved local candidate participates in reachability, while the edge keeps
-its `dynamic` marker. Variable-first templates, remote URLs, non-`import.meta.url`
-bases and other runtime-only expressions remain unresolved rather than being
-guessed.
-
-## Health and dead-code precision
-
-- The dependency summary uses the same production-first path scope as the
-  findings shown below it. Findings isolated to fixtures/tests are reported as a
-  separate suppressed count instead of leaking into the production headline.
-- Comment-only lexical mentions no longer prove symbol liveness. String-based
-  registries and reflective dispatch stay conservative because they may be real
-  runtime entry points.
-- Dogfood removed unnecessary internal exports, obsolete declarations and
-  uncalled LSP wrapper methods. Supported Online extension exports and
-  TypeScript host callbacks remain intact.
-
-Current-source dogfood reports zero Health findings in both full and no-tests
-graphs. The remaining low-confidence dead-code queue contains only the five
-supported Online extension exports and two TypeScript host callbacks. Classified
-benchmark dependency findings remain available through `include_classified`.
-
-The release remains gated by the full Node suite, release metadata validation,
-portable MCPB/npm runtime smoke, dependency audit and self-dogfood.
-
-The strict source-free real-repository benchmark was refreshed from clean,
-revision-bound checkouts and passes all six language repositories (TypeScript,
-JavaScript, Python, Go, Java and Rust) with complete provenance, expected-signal
-and relation-regression gates.

package/docs/releases/v0.3.5.md

@@ -1,50 +0,0 @@
-# Weavatrix 0.3.5
-
-0.3.5 removes the hidden 64-symbol ceiling from deliberately high-budget
-TypeScript/JavaScript semantic prewarms while keeping the ordinary offline
-startup profile unchanged.
-
-## Explicit full semantic prewarm
-
-- The default remains a 32-symbol ranked prewarm with the previous 64-symbol,
-  16,384-reference/link and 60-second hard ceilings.
-- Setting `WEAVATRIX_PRECISION_MAX_SYMBOLS` above 64 now explicitly opts into
-  the expanded policy instead of being silently clamped back to 64.
-- `WEAVATRIX_PRECISION_PREWARM=full` selects all eligible targets, bounded by a
-  10,000-symbol hard ceiling. It is intended for CI, release evidence and
-  manually requested deep repository audits, not implicit startup work.
-- Expanded runs scale their default reference/link budget to 16 per requested
-  symbol and their deadline to one second per requested symbol. Hard limits
-  remain 131,072 references/links and 30 minutes.
-- Verified source remains bounded to 4 MiB per file, 1,024 simultaneously open
-  documents and 128 MiB total. Crossing a ceiling remains `PARTIAL`; it never
-  becomes a false complete result or an unbounded allocation.
-
-The point-query cache used by `get_dependents` and `inspect_symbol`, and the
-bounded changed-symbol batch used by `change_impact`, remain separate from this
-broad overlay. Existing default and on-demand behavior is unchanged.
-
-The regression suite proves both sides of the contract: an ordinary build still
-selects 32 of 80 candidates and reports `PARTIAL`, while an explicit 1,000-symbol
-budget and `full` mode each query all 80 targets and report `COMPLETE` with a
-cooperative provider.
-
-## Dead-code verdict consistency
-
-- `run_audit` now labels an unreferenced public export as low-confidence
-  `unused-export-surface` evidence and sets `deadCodeCandidate:false`.
-- The audit explains that an unused module surface is not proof of a dead
-  implementation; downstream packages and runtime registries may be invisible.
-- This matches `find_dead_code`, which keeps the same uncertain public surface
-  out of its default medium-confidence review queue while reporting the
-  suppressed low-confidence count.
-
-## Consistent unused-export confidence
-
-`run_audit` now labels an unused export as low-confidence export-surface
-evidence, not a medium-confidence dead implementation. The finding explicitly
-distinguishes removing an unnecessary export keyword from deleting the symbol,
-which still requires the separate exact/reference-aware `find_dead_code`
-workflow. This aligns Health with the default dead-code queue, where public and
-framework-sensitive candidates are intentionally suppressed until
-`min_confidence=low` is requested.

package/docs/releases/v0.3.6.md

@@ -1,44 +0,0 @@
-# Weavatrix 0.3.6
-
-0.3.6 corrects Rust dependency evidence so that language builtins, relative-path
-modules and self-crate references are no longer reported as missing Cargo
-dependencies. Symbol, module and call extraction are unchanged.
-
-## Rust missing-dependency precision
-
-Rust crate detection previously read every leading path segment as a potential
-external crate. Four classes of local or built-in path were therefore reported
-as missing Cargo dependencies:
-
-- **Primitive types.** `f64::from(..)`, `u8::MAX`, `str::len` and the rest of the
-  numeric, `bool`, `char` and `str` primitives are language builtins and are now
-  excluded from crate detection.
-- **`use`-bound aliases.** A name imported into scope by `use foo::bar` (module
-  alias or item) no longer re-registers as a crate when it later appears as
-  `bar::baz`. The crate's own root name — for example `use anyhow::{self}` — is
-  deliberately preserved as a dependency.
-- **Declared child modules.** A `mod child;` (or inline `mod child { .. }`)
-  declaration shadows any same-named crate, so `child::item` paths resolve
-  locally instead of surfacing as a missing crate.
-- **Self-crate references.** A crate that refers to its own package name — the
-  routine `use <crate>::..` in `examples/`, `tests/`, `benches/` and the `[[bin]]`
-  that pairs with a `[lib]` — is treated as a resolved self-reference rather than
-  a missing dependency.
-
-Relative anchors (`crate::`, `self::`, `super::`) and `extern crate` continue to
-resolve exactly as before, and genuinely undeclared external crates are still
-reported.
-
-## Verification
-
-New regression tests pin both layers: the Rust extractor keeps a real crate as
-the only external import when a file mixes an `f64` primitive path, a
-`super::` module and in-scope aliases, and the Cargo evidence layer keeps a
-self-crate reference out of the missing-dependency set while still reporting an
-undeclared crate.
-
-## HTTP contract detector hygiene
-
-The HTTP client-call detector builds its `fetch` token at runtime and uses an
-`isFetch` flag, so the analyzer's own source carries no literal call-shape of the
-Web API it scans for. Detection behavior is unchanged.

package/docs/releases/v0.3.7.md

@@ -1,37 +0,0 @@
-# Weavatrix 0.3.7
-
-0.3.7 fixes three defects surfaced by cross-repository validation: a
-reverse-shell detection gap, an unbounded ripgrep-path probe that could hang the
-server, and a `search_code` path that excluded `node_modules` only through the
-gitignore stack.
-
-## Reverse-shell pre-filter now covers the confirming regex
-
-The malware content sweep uses each rule's `pattern` as the ripgrep pre-filter
-and only then applies the stricter `re` to confirm. The reverse-shell `pattern`
-had drifted narrower than its `re`: it required `SOCK_STREAM` followed by
-`/bin/sh` or `exec`, so socket-backed shells using `connect`, `subprocess`,
-`pty.spawn` or `os.dup2` — and default `socket.socket()` calls with no
-`SOCK_STREAM` literal — were dropped before they could be confirmed. The
-pre-filter is now a superset of the confirming regex, and a new invariant test
-asserts that every payload the confirming regex flags is also surfaced by the
-pre-filter.
-
-A separate, deeper case is deliberately left for a follow-up: multi-line reverse
-shells, where ripgrep's per-line matching cannot span a `socket` call and the
-shell invocation on different lines.
-
-## Bounded ripgrep-path probe
-
-The `where`/`which rg` fallback in the MCP ripgrep resolver ran `spawnSync`
-without a timeout on the main thread, so a slow or unreachable PATH entry (for
-example a disconnected network drive) could hang the server. The probe now runs
-with a three-second timeout and `windowsHide`.
-
-## search_code excludes node_modules explicitly
-
-The `search_code` ripgrep invocation passed `--hidden` with only a `.git`
-exclusion, leaving `node_modules` out of results solely through ripgrep's
-implicit gitignore stack — which fails for repositories that commit their
-dependency tree or lack a gitignore. An explicit `!node_modules` glob is now
-applied; a caller-supplied glob is still appended afterward and wins.

package/docs/releases/v0.3.8.md

@@ -1,21 +0,0 @@
-# Weavatrix 0.3.8
-
-0.3.8 is a documentation and internal-structure release. Tool behavior and
-output are unchanged.
-
-## Slimmer README
-
-The README is refocused on the current release — install, configuration, tools,
-benchmarks and the security model — and the accumulated per-version changelog is
-removed in favor of the existing per-version notes under
-[docs/releases/](../releases/). This also slims the README rendered on the npm
-package page.
-
-## Internal module split
-
-`src/analysis/dead-code-review.js` is split along the repository's existing
-facade convention: the per-candidate record builders (`symbolCandidate`,
-`fileCandidate`) move to `src/analysis/dead-code-review/candidates.js`, while the
-orchestrator and the public `computeDeadCodeReview` export stay in place.
-Importers and returned records are unchanged, and both files are now within the
-300-line owner-module budget.

package/docs/releases/v0.3.9.md

@@ -1,36 +0,0 @@
-# Weavatrix 0.3.9
-
-0.3.9 consolidates every subprocess launch behind a small number of audited
-chokepoints. Tool behavior and output are unchanged — verified byte-identical
-against 0.3.8 on real repositories.
-
-## Single-chokepoint subprocess execution
-
-Git and other subprocess launches were scattered across roughly fifteen modules,
-each with its own near-identical spawn wrapper. They now route through two
-focused modules:
-
-- **git** — every git command runs through `src/git-exec.js`: `runGit` for
-  synchronous run-and-collect calls and `boundedGitCommand` for the streaming
-  history collector.
-- **everything else** — ripgrep resolution and search, `tar` archive extraction,
-  and `where`/`which` binary probing run through `src/process.js`: the existing
-  async `runCommand` plus a new synchronous `runCommandSync`.
-
-Every launch now applies the same credential-stripped child environment,
-`windowsHide`, bounded timeout, and `-C <repoRoot>`/`cwd` containment in one
-place. The number of modules importing `node:child_process` drops from fifteen
-to four — the two runners plus the long-lived language-server client — removing
-duplicated wrappers and making the whole process surface auditable from a single
-point.
-
-This is a pure refactor: graph construction, change impact, Health, history and
-search produce identical results. A byte-level comparison of the entire graph
-(every node, edge and external import, hashed with SHA-256) against the published
-0.3.8 matched exactly on the analytics, controller-rest-api and Weavatrix
-repositories.
-
-## Minor
-
-Removed two redundant module imports (`node:perf_hooks`, `node:process`) that
-re-imported values already available as Node globals.

package/scripts/run-agent-task-benchmark.mjs

@@ -1,118 +0,0 @@
-import {readFileSync} from 'node:fs'
-import {pathToFileURL} from 'node:url'
-import {retrieveTaskContext} from '../src/analysis/task-retrieval.js'
-
-function graphFixture() {
-  const nodes = [
-    {id: 'src/auth/session.js#validateSession@10', label: 'validateSession()', source_file: 'src/auth/session.js', symbol_kind: 'function'},
-    {id: 'src/http/router.js#registerRoutes@20', label: 'registerRoutes()', source_file: 'src/http/router.js', symbol_kind: 'function'},
-    {id: 'src/cache/store.js#readCache@5', label: 'readCache()', source_file: 'src/cache/store.js', symbol_kind: 'function'},
-    {id: 'src/auth/session.test.js#sessionTest@3', label: 'sessionTest()', source_file: 'src/auth/session.test.js', symbol_kind: 'function'},
-  ]
-  return {nodes, byId: new Map(nodes.map((node) => [node.id, node])), out: new Map(), inn: new Map()}
-}
-
-const CASES = [
-  {task: 'validate authentication session', expected: 'src/auth/session.js#validateSession@10'},
-  {task: 'register HTTP API routes', expected: 'src/http/router.js#registerRoutes@20'},
-  {task: 'read values from cache store', expected: 'src/cache/store.js#readCache@5'},
-]
-
-function competitorTemplate(name) {
-  return {name, status: 'MISSING', reason: 'supply same-task blind evaluator output with --independent-results <json>'}
-}
-
-function readCompetitors(path) {
-  if (!path) return {}
-  const parsed = JSON.parse(readFileSync(path, 'utf8'))
-  return parsed?.competitors && typeof parsed.competitors === 'object' ? parsed.competitors : {}
-}
-
-const SYSTEMS = ['weavatrix', 'codebase-memory', 'serena']
-const median = (values) => {
-  const sorted = values.slice().sort((left, right) => left - right)
-  const middle = Math.floor(sorted.length / 2)
-  return sorted.length % 2 ? sorted[middle] : (sorted[middle - 1] + sorted[middle]) / 2
-}
-
-function independentComparison(path) {
-  if (!path) return {status: 'MISSING', reason: 'supply blind evaluator output with --independent-results <json>'}
-  try {
-    const input = JSON.parse(readFileSync(path, 'utf8'))
-    if (input?.schemaVersion !== 'weavatrix.agent-change-results.v1') throw new Error('unsupported schemaVersion')
-    const taskSets = []
-    const metrics = {}
-    for (const name of SYSTEMS) {
-      const runs = input.systems?.[name]?.runs
-      if (!Array.isArray(runs) || !runs.length) throw new Error(`${name} has no runs`)
-      const ids = runs.map((run) => String(run.taskId || '')).sort()
-      if (ids.some((id) => !id) || new Set(ids).size !== ids.length) throw new Error(`${name} task IDs are missing or duplicated`)
-      for (const run of runs) {
-        if (typeof run.success !== 'boolean' || !Number.isFinite(run.falsePositives) || !Number.isFinite(run.tokens) || !Number.isFinite(run.durationMs)) {
-          throw new Error(`${name}/${run.taskId || '?'} has incomplete metrics`)
-        }
-      }
-      taskSets.push(ids.join('\0'))
-      metrics[name] = {
-        tasks: runs.length, changeSuccessRate: runs.filter((run) => run.success).length / runs.length,
-        falsePositiveRate: runs.reduce((sum, run) => sum + Math.max(0, run.falsePositives), 0) / runs.length,
-        medianTokens: median(runs.map((run) => run.tokens)), medianDurationMs: median(runs.map((run) => run.durationMs)),
-      }
-    }
-    if (new Set(taskSets).size !== 1) throw new Error('systems were not evaluated on the same task IDs')
-    return {status: 'COMPLETE', evaluator: String(input.evaluator || 'unspecified'), metrics}
-  } catch (error) {
-    return {status: 'INVALID', reason: error instanceof Error ? error.message : String(error)}
-  }
-}
-
-export function runAgentTaskBenchmark({competitorResults, independentResults} = {}) {
-  const graph = graphFixture()
-  const started = performance.now()
-  const cases = CASES.map((item) => {
-    const semanticSeeds = graph.nodes.filter((node) => item.task.toLowerCase().split(/\W+/).some((word) => word.length > 3 && String(node.id).toLowerCase().includes(word)))
-    const result = retrieveTaskContext(graph, {task: item.task, semanticSeeds, maxSymbols: 2})
-    const selected = result.selected.map((entry) => entry.id)
-    return {task: item.task, expected: item.expected, selected, success: selected[0] === item.expected, falsePositives: selected.filter((id) => id !== item.expected).length}
-  })
-  const durationMs = performance.now() - started
-  const output = JSON.stringify(cases)
-  const imported = readCompetitors(competitorResults)
-  const independent = independentComparison(independentResults)
-  const competitors = independent.status === 'COMPLETE' ? {
-    'codebase-memory': {name: 'codebase-memory', status: 'COMPLETE', metrics: independent.metrics['codebase-memory']},
-    serena: {name: 'serena', status: 'COMPLETE', metrics: independent.metrics.serena},
-  } : {
-    'codebase-memory': imported['codebase-memory'] || competitorTemplate('codebase-memory'),
-    serena: imported.serena || competitorTemplate('serena'),
-  }
-  return {
-    schemaVersion: 'weavatrix.agent-task-benchmark.v1',
-    scope: 'deterministic task-to-symbol routing microbenchmark; not an end-to-end autonomous change benchmark',
-    weavatrix: {
-      status: cases.every((item) => item.success) ? 'PASS' : 'FAIL', cases,
-      metrics: {
-        taskSuccessRate: cases.filter((item) => item.success).length / cases.length,
-        falsePositiveRate: cases.reduce((sum, item) => sum + item.falsePositives, 0) / Math.max(1, cases.reduce((sum, item) => sum + item.selected.length, 0)),
-        estimatedOutputTokens: Math.ceil(Buffer.byteLength(output) / 4), durationMs: Number(durationMs.toFixed(3)),
-      },
-    },
-    competitors, independentComparison: independent,
-    comparisonStatus: independent.status === 'COMPLETE' ? 'COMPLETE' : 'INCOMPLETE',
-  }
-}
-
-function argument(name) {
-  const index = process.argv.indexOf(name)
-  return index >= 0 ? process.argv[index + 1] : null
-}
-
-if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
-  const report = runAgentTaskBenchmark({
-    competitorResults: argument('--competitor-results'),
-    independentResults: argument('--independent-results'),
-  })
-  process.stdout.write(`${JSON.stringify(report, null, 2)}\n`)
-  if ((process.argv.includes('--require-independent') || process.argv.includes('--require-competitors')) && report.comparisonStatus !== 'COMPLETE') process.exitCode = 1
-  if (report.weavatrix.status !== 'PASS') process.exitCode = 1
-}

package/src/analysis/allowed-test-runner.js

@@ -1,70 +0,0 @@
-import {existsSync, readFileSync} from 'node:fs'
-import {join} from 'node:path'
-import {createRepoBoundary} from '../repo-path.js'
-import {runCommand} from '../process.js'
-
-const SAFE_SCRIPT = /^(?:test(?::|$)|(?:check|verify)(?::|$)|[^:]+:(?:test|check|verify)(?::|$))/i
-const UNSAFE_SHELL_ARG = /[\0\r\n&|<>^%!`\"]/
-const tail = (value, limit = 8000) => String(value || '').slice(-limit)
-
-function manifestAt(repoRoot) {
-  const resolved = createRepoBoundary(repoRoot).resolve('package.json')
-  if (!resolved.ok) return null
-  try { return JSON.parse(readFileSync(resolved.path, 'utf8')) } catch { return null }
-}
-
-function packageManager(repoRoot) {
-  if (existsSync(join(repoRoot, 'pnpm-lock.yaml'))) return 'pnpm'
-  if (existsSync(join(repoRoot, 'yarn.lock'))) return 'yarn'
-  return 'npm'
-}
-
-function normalizeTestRequests(requests = []) {
-  const tests = []
-  for (const request of (Array.isArray(requests) ? requests : []).slice(0, 5)) {
-    const script = String(request?.script || '')
-    const args = Array.isArray(request?.args) ? request.args.slice(0, 40).map(String) : []
-    if (!SAFE_SCRIPT.test(script)) return {ok: false, reason: `script ${script || '(missing)'} is outside the test/check/verify allowlist`, tests}
-    if (args.some((arg) => arg.length > 300 || UNSAFE_SHELL_ARG.test(arg))) return {ok: false, reason: `script ${script} has an invalid or shell-sensitive argument`, tests}
-    tests.push({script, args})
-  }
-  return {ok: true, tests}
-}
-
-export function validateTestRequests(repoRoot, requests = []) {
-  const normalized = normalizeTestRequests(requests)
-  if (!normalized.ok || !normalized.tests.length) return normalized
-  const manifest = manifestAt(repoRoot)
-  if (!manifest) return {ok: false, reason: 'package.json is missing or unreadable', tests: []}
-  for (const test of normalized.tests) {
-    if (!Object.hasOwn(manifest.scripts || {}, test.script)) return {ok: false, reason: `package.json has no script named ${test.script}`, tests: []}
-  }
-  const tests = normalized.tests
-  return {ok: true, tests, packageManager: packageManager(repoRoot)}
-}
-
-export async function runAllowedTests(repoRoot, requests = [], {enabled = false, timeoutMs = 60_000} = {}) {
-  const normalized = normalizeTestRequests(requests)
-  if (!normalized.ok) return {state: 'BLOCKED', reason: normalized.reason, results: []}
-  if (!normalized.tests.length) return {state: 'NOT_REQUESTED', reason: 'no package scripts were requested', plan: [], results: []}
-  if (!enabled || process.env.WEAVATRIX_ALLOW_TEST_RUNS !== '1') return {
-    state: 'DISABLED', reason: 'set WEAVATRIX_ALLOW_TEST_RUNS=1 and pass run_tests:true to execute allowlisted package scripts',
-    plan: normalized.tests, results: [],
-  }
-  const checked = validateTestRequests(repoRoot, normalized.tests)
-  if (!checked.ok) return {state: 'BLOCKED', reason: checked.reason, results: []}
-  const results = []
-  const timeout = Math.max(1000, Math.min(300_000, Number(timeoutMs) || 60_000))
-  for (const test of checked.tests) {
-    const start = Date.now()
-    const separator = checked.packageManager === 'yarn' ? [] : ['--']
-    try {
-      const run = await runCommand(checked.packageManager, ['run', test.script, ...separator, ...test.args], {cwd: repoRoot, timeoutMs: timeout})
-      results.push({script: test.script, status: run.exitCode === 0 ? 'PASS' : 'FAIL', exitCode: run.exitCode, durationMs: Date.now() - start, stdoutTail: tail(run.stdout), stderrTail: tail(run.stderr)})
-    } catch (error) {
-      const message = error instanceof Error ? error.message : String(error)
-      results.push({script: test.script, status: /timed out/i.test(message) ? 'TIMEOUT' : 'FAIL', exitCode: null, durationMs: Date.now() - start, stdoutTail: '', stderrTail: tail(message)})
-    }
-  }
-  return {state: results.every((result) => result.status === 'PASS') ? 'PASS' : 'FAIL', packageManager: checked.packageManager, results}
-}

package/src/analysis/architecture/contract-graph.js

@@ -1,119 +0,0 @@
-import {architectureHash} from './contract-schema.js'
-
-export const isSymbolNode = (id) => String(id).includes('#')
-const endpointId = (value) => value && typeof value === 'object' ? String(value.id) : String(value ?? '')
-
-export function fileOfNode(id, byId) {
-    const node = byId.get(String(id))
-    if (node?.source_file) return String(node.source_file).replace(/\\/g, '/')
-    return String(id).split('#')[0].replace(/\\/g, '/')
-}
-
-export function componentForFile(file, components) {
-    const normalized = String(file || '').replace(/\\/g, '/')
-    let best = null
-    for (const component of components) for (const prefix of component.paths) {
-        if (normalized !== prefix && !normalized.startsWith(`${prefix}/`)) continue
-        if (!best || prefix.length > best.prefix.length) best = {id: component.id, prefix}
-    }
-    return best?.id || '(unmapped)'
-}
-
-export function relationKind(link) {
-    if (link.typeOnly === true) return 'type-only'
-    if (link.compileOnly === true) return 'compile-only'
-    return 'runtime'
-}
-
-export function runtimeFileGraph(graph) {
-    const byId = new Map((graph.nodes || []).map((node) => [String(node.id), node]))
-    const files = new Set((graph.nodes || []).filter((node) => !isSymbolNode(node.id)).map((node) => String(node.id)))
-    const adjacency = new Map([...files].map((file) => [file, new Set()]))
-    for (const link of graph.links || []) {
-        if (relationKind(link) !== 'runtime' || !['imports', 're_exports'].includes(link.relation) || link.barrelProxy === true) continue
-        const source = fileOfNode(endpointId(link.source), byId)
-        const target = fileOfNode(endpointId(link.target), byId)
-        if (source && target && source !== target && files.has(source) && files.has(target)) adjacency.get(source)?.add(target)
-    }
-    return adjacency
-}
-
-export function stronglyConnected(adjacency) {
-    let index = 0
-    const indexes = new Map(), low = new Map(), stack = [], onStack = new Set(), out = []
-    const visit = (node) => {
-        indexes.set(node, index); low.set(node, index); index++; stack.push(node); onStack.add(node)
-        for (const target of adjacency.get(node) || []) {
-            if (!indexes.has(target)) { visit(target); low.set(node, Math.min(low.get(node), low.get(target))) }
-            else if (onStack.has(target)) low.set(node, Math.min(low.get(node), indexes.get(target)))
-        }
-        if (low.get(node) !== indexes.get(node)) return
-        const component = []
-        while (stack.length) {
-            const value = stack.pop()
-            onStack.delete(value)
-            component.push(value)
-            if (value === node) break
-        }
-        if (component.length > 1 || adjacency.get(node)?.has(node)) out.push(component.sort())
-    }
-    for (const node of [...adjacency.keys()].sort()) if (!indexes.has(node)) visit(node)
-    return out.sort((a, b) => b.length - a.length || a[0].localeCompare(b[0]))
-}
-
-export function architectureViolation(ruleId, kind, evidence, current, target) {
-    const normalizedEvidence = String(evidence).replace(/:\d+(?=\b|$)/g, '')
-    const fingerprint = architectureHash({ruleId, kind, evidence: normalizedEvidence}).slice(0, 32)
-    return {fingerprint, ruleId, kind, evidence, ...(current != null ? {current} : {}), ...(target != null ? {target} : {})}
-}
-
-export const matchComponentSelector = (selector, value) => selector.includes('*') || selector.includes(value)
-
-export function collectComponentEdges(graph, contract) {
-    const nodes = Array.isArray(graph?.nodes) ? graph.nodes : []
-    const links = Array.isArray(graph?.links) ? graph.links : []
-    const byId = new Map(nodes.map((node) => [String(node.id), node]))
-    const componentEdges = new Map()
-    for (const link of links) {
-        if (!['imports', 're_exports', 'calls', 'references'].includes(link.relation) || link.barrelProxy === true) continue
-        const fromFile = fileOfNode(endpointId(link.source), byId)
-        const toFile = fileOfNode(endpointId(link.target), byId)
-        if (!fromFile || !toFile || fromFile === toFile) continue
-        const from = componentForFile(fromFile, contract.components)
-        const to = componentForFile(toFile, contract.components)
-        if (from === to) continue
-        const kind = relationKind(link)
-        const key = `${from}\0${to}\0${kind}`
-        const record = componentEdges.get(key) || {from, to, kind, count: 0, samples: []}
-        record.count++
-        if (record.samples.length < 5) record.samples.push(`${fromFile} -> ${toFile}`)
-        componentEdges.set(key, record)
-    }
-    return {nodes, links, byId, componentEdges}
-}
-
-export function collectComponentFitness(nodes, links, byId, contract) {
-    const stats = new Map(contract.components.map((component) => [component.id, {
-        files: new Set(), internalPairs: new Set(), boundaryPairs: new Set(),
-    }]))
-    for (const node of nodes.filter((item) => !isSymbolNode(item.id))) {
-        const file = String(node.source_file || node.id).replace(/\\/g, '/')
-        stats.get(componentForFile(file, contract.components))?.files.add(file)
-    }
-    const runtimePairs = new Set()
-    for (const link of links) {
-        if (relationKind(link) !== 'runtime' || !['imports', 're_exports', 'calls', 'references'].includes(link.relation) || link.barrelProxy === true) continue
-        const source = fileOfNode(endpointId(link.source), byId), target = fileOfNode(endpointId(link.target), byId)
-        if (!source || !target || source === target) continue
-        const pair = `${source}\0${target}`
-        if (runtimePairs.has(pair)) continue
-        runtimePairs.add(pair)
-        const from = componentForFile(source, contract.components), to = componentForFile(target, contract.components)
-        if (from === to) stats.get(from)?.internalPairs.add(pair)
-        else {
-            stats.get(from)?.boundaryPairs.add(pair)
-            stats.get(to)?.boundaryPairs.add(pair)
-        }
-    }
-    return stats
-}

package/src/analysis/architecture/contract-schema.js

@@ -1,110 +0,0 @@
-import {createHash} from 'node:crypto'
-
-export const ARCHITECTURE_CONTRACT_V = 1
-
-const RELATION_KIND = new Set(['runtime', 'type-only', 'compile-only', 'any'])
-const ACTION = new Set(['allow', 'forbid'])
-const ENFORCEMENT = new Set(['ratchet', 'strict', 'advisory'])
-
-export const safeArchitectureId = (value, fallback = '') => {
-    const text = String(value ?? '').trim()
-    return /^[a-z0-9][a-z0-9._:-]{0,127}$/i.test(text) ? text : fallback
-}
-
-export const architecturePathPrefix = (value) => {
-    const text = String(value ?? '').replace(/\\/g, '/').replace(/^\.\//, '').replace(/^\/+|\/+$/g, '')
-    return text && !text.split('/').some((part) => !part || part === '.' || part === '..') ? text : null
-}
-
-export const finiteArchitectureBudget = (value, fallback = null) => {
-    const number = Number(value)
-    return Number.isFinite(number) && number >= 0 ? number : fallback
-}
-
-const stringList = (value, sanitize, cap = 100) => [...new Set((Array.isArray(value) ? value : [])
-    .slice(0, cap).map(sanitize).filter(Boolean))]
-
-const stable = (value) => Array.isArray(value)
-    ? `[${value.map(stable).join(',')}]`
-    : value && typeof value === 'object'
-        ? `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${stable(value[key])}`).join(',')}}`
-        : JSON.stringify(value)
-
-export const architectureHash = (value) => createHash('sha256').update(stable(value)).digest('hex')
-
-function sanitizeComponent(value, index) {
-    const id = safeArchitectureId(value?.id, `component-${index + 1}`)
-    const paths = stringList(value?.paths ?? [value?.path], architecturePathPrefix, 64)
-    if (!paths.length) return null
-    return {id, name: String(value?.name || id).slice(0, 128), paths}
-}
-
-function sanitizeRule(value, index) {
-    const from = stringList(value?.from, (item) => item === '*' ? '*' : safeArchitectureId(item), 64)
-    const to = stringList(value?.to, (item) => item === '*' ? '*' : safeArchitectureId(item), 64)
-    if (!from.length || !to.length) return null
-    return {
-        id: safeArchitectureId(value?.id, `dependency-${index + 1}`),
-        action: ACTION.has(value?.action) ? value.action : 'forbid',
-        kinds: stringList(value?.kinds ?? ['runtime'], (kind) => RELATION_KIND.has(kind) ? kind : '', 4),
-        from,
-        to,
-        ...(value?.reason ? {reason: String(value.reason).slice(0, 300)} : {}),
-    }
-}
-
-function sanitizeException(value) {
-    const fingerprint = /^[a-f0-9]{16,64}$/i.test(String(value?.fingerprint || '')) ? String(value.fingerprint) : null
-    if (!fingerprint) return null
-    const expires = /^\d{4}-\d{2}-\d{2}$/.test(String(value?.expires || '')) ? String(value.expires) : null
-    return {fingerprint, reason: String(value?.reason || '').slice(0, 300), ...(expires ? {expires} : {})}
-}
-
-function normalizeBudgets(raw = {}) {
-    const budgets = {
-        runtimeCycles: finiteArchitectureBudget(raw.runtimeCycles),
-        maxFunctionLoc: finiteArchitectureBudget(raw.maxFunctionLoc),
-        maxFileLoc: finiteArchitectureBudget(raw.maxFileLoc),
-        maxCyclomatic: finiteArchitectureBudget(raw.maxCyclomatic),
-        maxParams: finiteArchitectureBudget(raw.maxParams),
-        maxRuntimeDependenciesPerComponent: finiteArchitectureBudget(raw.maxRuntimeDependenciesPerComponent),
-        maxModuleFiles: finiteArchitectureBudget(raw.maxModuleFiles),
-        minModuleCohesion: finiteArchitectureBudget(raw.minModuleCohesion),
-        maxModuleBoundaryRatio: finiteArchitectureBudget(raw.maxModuleBoundaryRatio),
-    }
-    for (const key of Object.keys(budgets)) if (budgets[key] == null) delete budgets[key]
-    return budgets
-}
-
-export function normalizeArchitectureContract(input) {
-    if (!input || typeof input !== 'object' || Array.isArray(input)) throw new Error('architecture contract must be an object')
-    const components = (Array.isArray(input.components) ? input.components : [])
-        .slice(0, 200).map(sanitizeComponent).filter(Boolean)
-    const componentIds = new Set(components.map((item) => item.id))
-    const dependencyRules = (Array.isArray(input.dependencyRules) ? input.dependencyRules : [])
-        .slice(0, 500).map(sanitizeRule).filter(Boolean)
-        .filter((rule) => [...rule.from, ...rule.to].every((id) => id === '*' || componentIds.has(id)))
-    const baseline = input.ratchet?.baseline && typeof input.ratchet.baseline === 'object'
-        ? {
-            fingerprints: stringList(input.ratchet.baseline.fingerprints, (item) => /^[a-f0-9]{16,64}$/i.test(String(item)) ? String(item) : '', 5_000),
-            metrics: Object.fromEntries(Object.entries(input.ratchet.baseline.metrics || {}).slice(0, 500)
-                .map(([key, value]) => [safeArchitectureId(key), finiteArchitectureBudget(value)]).filter(([key, value]) => key && value != null)),
-        }
-        : {fingerprints: [], metrics: {}}
-    const contract = {
-        architectureContractV: ARCHITECTURE_CONTRACT_V,
-        name: String(input.name || 'Target architecture').slice(0, 128),
-        style: safeArchitectureId(input.style, 'custom'),
-        enforcement: ENFORCEMENT.has(input.enforcement) ? input.enforcement : 'ratchet',
-        components,
-        dependencyRules,
-        budgets: normalizeBudgets(input.budgets),
-        technologies: {
-            required: stringList(input.technologies?.required, (item) => safeArchitectureId(item), 100),
-            forbidden: stringList(input.technologies?.forbidden, (item) => safeArchitectureId(item), 100),
-        },
-        exceptions: (Array.isArray(input.exceptions) ? input.exceptions : []).slice(0, 500).map(sanitizeException).filter(Boolean),
-        ratchet: {baseline},
-    }
-    return {...contract, contractHash: architectureHash(contract)}
-}