weavatrix 0.3.14 → 1.0.0

package/src/mcp/sync/evidence-duplicates.mjs

@@ -1,97 +0,0 @@
-import {
-    CAPS, DUPLICATE_THRESHOLDS, bool, compare, count, graphId, int, list,
-    path, reasons, state, text, verdict,
-} from './evidence-common.mjs'
-import {compareDuplicateMember} from '../evidence/duplicate-member-order.mjs'
-
-function duplicateEvidenceId(value) {
-    const id = text(value, 64)
-    return id && /^[a-f0-9]{24,64}$/i.test(id) ? id : undefined
-}
-
-function duplicateMember(value) {
-    if (!value || typeof value !== 'object' || Array.isArray(value)) return null
-    const file = path(value.file)
-    const startLine = int(value.startLine), endLine = int(value.endLine), tokens = int(value.tokens)
-    if (!file || startLine < 1 || endLine < startLine || tokens < DUPLICATE_THRESHOLDS.clones.minTokens) return null
-    const out = {file, startLine, endLine, tokens}
-    const nodeId = graphId(value.graphNodeId)
-    if (nodeId?.startsWith(`${file}#`)) out.graphNodeId = nodeId
-    return out
-}
-
-function duplicateMembers(values, cap = CAPS.duplicateMembers) {
-    const raw = Array.isArray(values) ? values : []
-    const unique = new Map()
-    for (const value of raw) {
-        const item = duplicateMember(value)
-        if (!item) continue
-        unique.set(`${item.file}\0${item.startLine}\0${item.endLine}\0${item.graphNodeId || ''}`, item)
-    }
-    const all = [...unique.values()].sort(compareDuplicateMember)
-    return {items: all.slice(0, cap), total: all.length, invalid: raw.length - all.length, truncated: all.length > cap}
-}
-
-function cloneGroup(value) {
-    const id = duplicateEvidenceId(value?.id)
-    const members = duplicateMembers(value?.members)
-    const rawStrongestSimilarity = Number(value?.strongestSimilarity)
-    const rawWeakestLinkedSimilarity = Number(value?.weakestLinkedSimilarity)
-    const strongestSimilarity = Math.trunc(rawStrongestSimilarity)
-    const weakestLinkedSimilarity = Math.trunc(rawWeakestLinkedSimilarity)
-    if (!id || members.items.length < 2 || strongestSimilarity < DUPLICATE_THRESHOLDS.clones.minSimilarityPercent ||
-        !Number.isFinite(rawStrongestSimilarity) || rawStrongestSimilarity > 100 ||
-        !Number.isFinite(rawWeakestLinkedSimilarity) || weakestLinkedSimilarity < DUPLICATE_THRESHOLDS.clones.minSimilarityPercent ||
-        rawWeakestLinkedSimilarity > 100 || weakestLinkedSimilarity > strongestSimilarity) return null
-    const memberCount = Math.max(int(value?.memberCount), members.total)
-    const returnedTokens = members.items.reduce((sum, member) => sum + member.tokens, 0)
-    return {
-        id, memberCount, totalTokens: Math.max(int(value?.totalTokens), returnedTokens),
-        strongestSimilarity, weakestLinkedSimilarity,
-        membersTruncated: bool(value?.membersTruncated) || members.truncated || members.invalid > 0 || memberCount > members.items.length,
-        members: members.items,
-    }
-}
-
-function divergenceCandidate(value) {
-    const id = duplicateEvidenceId(value?.id)
-    const symbol = text(value?.symbol, 256)
-    const rawSimilarity = Number(value?.similarity)
-    const similarity = Math.trunc(rawSimilarity)
-    const members = duplicateMembers(value?.members, 2)
-    if (!id || !symbol || !/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(symbol) || members.total !== 2 || members.invalid > 0 ||
-        !Number.isFinite(rawSimilarity) || rawSimilarity < 0 || rawSimilarity > DUPLICATE_THRESHOLDS.divergence.maxSimilarityPercent ||
-        members.items[0].file === members.items[1].file) return null
-    return {id, symbol, similarity, totalTokens: Math.max(int(value?.totalTokens), members.items[0].tokens + members.items[1].tokens), members: members.items}
-}
-
-export function sanitizeDuplicates(value) {
-    const rawGroups = Array.isArray(value?.cloneGroups) ? value.cloneGroups : []
-    const rawDivergence = Array.isArray(value?.divergenceCandidates) ? value.divergenceCandidates : []
-    const cloneGroups = list(rawGroups, CAPS.duplicateGroups, cloneGroup,
-        (a, b) => b.totalTokens - a.totalTokens || b.memberCount - a.memberCount || compare(a.id, b.id))
-    const divergence = list(rawDivergence, CAPS.divergenceCandidates, divergenceCandidate,
-        (a, b) => b.totalTokens - a.totalTokens || a.similarity - b.similarity || compare(a.symbol, b.symbol) || compare(a.id, b.id))
-    const invalid = rawGroups.length - cloneGroups.total + rawDivergence.length - divergence.total
-    const membersTruncated = cloneGroups.items.some((group) => group.membersTruncated)
-    const groupCompleteness = count(value?.completeness?.cloneGroups, rawGroups.length, cloneGroups.items.length)
-    const divergenceCompleteness = count(value?.completeness?.divergenceCandidates, rawDivergence.length, divergence.items.length)
-    const truncated = cloneGroups.truncated || divergence.truncated || groupCompleteness.truncated || divergenceCompleteness.truncated || membersTruncated || invalid > 0
-    const outReasons = reasons([
-        ...(Array.isArray(value?.completeness?.reasons) ? value.completeness.reasons : []),
-        ...(invalid > 0 ? ['INVALID_DUPLICATE_EVIDENCE_DROPPED'] : []),
-        ...(membersTruncated ? ['CLONE_MEMBERS_TRUNCATED'] : []),
-        ...(cloneGroups.truncated ? ['CLONE_GROUPS_TRUNCATED'] : []),
-        ...(divergence.truncated ? ['DIVERGENCE_CANDIDATES_TRUNCATED'] : []),
-    ])
-    const rawFragments = value?.completeness?.fragments
-    const eligible = int(rawFragments?.eligible), filtered = int(rawFragments?.filtered)
-    const total = Math.max(int(rawFragments?.total), eligible + filtered)
-    const outState = state(value?.state)
-    return {
-        state: truncated && outState === 'COMPLETE' ? 'PARTIAL' : outState,
-        verdict: verdict(value?.verdict), thresholds: DUPLICATE_THRESHOLDS,
-        completeness: {fragments: {total, eligible: Math.min(eligible, total), filtered: Math.max(filtered, total - eligible)}, cloneGroups: groupCompleteness, divergenceCandidates: divergenceCompleteness, reasons: outReasons},
-        cloneGroups: cloneGroups.items, divergenceCandidates: divergence.items,
-    }
-}

package/src/mcp/sync/evidence-health.mjs

@@ -1,56 +0,0 @@
-import {
-    CAPS, CATEGORIES, CONFIDENCE, SEVERITIES, checks, compare, count, graphId,
-    int, list, numericRecord, packageName, path, privacySafeText, reasons, set,
-    state, text, token, verdict,
-} from './evidence-common.mjs'
-
-function finding(value) {
-    if (!value || typeof value !== 'object') return null
-    const id = text(value.id, 64), category = token(value.category, 32), rule = token(value.rule, 64), severity = token(value.severity, 16)
-    if (!id || !/^[a-f0-9]{8,64}$/i.test(id) || !CATEGORIES.has(category) || !rule || !SEVERITIES.has(severity)) return null
-    const out = {id, category, rule, severity}
-    if (CONFIDENCE.has(value.confidence)) out.confidence = value.confidence
-    set(out, 'file', path(value.file)); set(out, 'line', Number.isFinite(value.line) && value.line >= 0 ? Math.trunc(value.line) : undefined)
-    set(out, 'symbol', privacySafeText(value.symbol)); set(out, 'package', packageName(value.package)); set(out, 'version', token(value.version, 128)); set(out, 'graphNodeId', graphId(value.graphNodeId))
-    return out
-}
-
-function hotspot(value) {
-    const id = graphId(value?.id), file = path(value?.file), severity = token(value?.severity, 16)
-    if (!id || !file || !['medium', 'high'].includes(severity)) return null
-    const out = {id, file, severity, breaches: [...new Set((value.breaches || []).map((item) => token(item, 48)).filter(Boolean))].sort(compare).slice(0, 12)}
-    set(out, 'symbol', privacySafeText(value.symbol))
-    for (const key of ['startLine', 'endLine', 'loc', 'cyclomatic', 'params']) if (Number.isFinite(value[key]) && value[key] >= 0) out[key] = Math.trunc(value[key])
-    return out
-}
-
-export function sanitizeHealth(value) {
-    const findings = list(value?.findings, CAPS.findings, finding, (a, b) => compare(a.severity, b.severity) || compare(a.id, b.id))
-    const hotspots = list(value?.complexity?.hotspots, CAPS.hotspots, hotspot, (a, b) => compare(a.severity, b.severity) || compare(a.id, b.id))
-    const truncated = findings.truncated || hotspots.truncated
-    const outState = state(value?.state)
-    return {
-        state: truncated && outState === 'COMPLETE' ? 'PARTIAL' : outState, verdict: verdict(value?.verdict),
-        completeness: {findings: count(value?.completeness?.findings, findings.total, findings.items.length), hotspots: count(value?.completeness?.hotspots, hotspots.total, hotspots.items.length), reasons: reasons(value?.completeness?.reasons)},
-        summary: {
-            bySeverity: numericRecord(value?.summary?.bySeverity, ['critical', 'high', 'medium', 'low', 'info']),
-            byCategory: numericRecord(value?.summary?.byCategory, ['unused', 'structure', 'vulnerability', 'malware']),
-            dead: numericRecord(value?.summary?.dead, ['deadSymbols', 'deadFiles', 'unusedExports']),
-            structure: numericRecord(value?.summary?.structure, ['runtimeImportEdges', 'typeOnlyImportEdges', 'compileOnlyImportEdges', 'runtimeCycles', 'compileTimeCouplings', 'largestCycle', 'largestCompileTimeCoupling', 'orphans', 'boundaryViolations']),
-        },
-        checks: checks(value?.checks), findings: findings.items,
-        complexity: {thresholds: {loc: {warning: int(value?.complexity?.thresholds?.loc?.warning), high: int(value?.complexity?.thresholds?.loc?.high)}, cyclomatic: {warning: int(value?.complexity?.thresholds?.cyclomatic?.warning), high: int(value?.complexity?.thresholds?.cyclomatic?.high)}, params: {warning: int(value?.complexity?.thresholds?.params?.warning), high: int(value?.complexity?.thresholds?.params?.high)}}, analyzed: int(value?.complexity?.analyzed), hotspots: hotspots.items},
-    }
-}
-
-function badge(value) {
-    const category = token(value?.category, 32), id = token(value?.id, 128)
-    if (!['languages', 'runtimes', 'tests', 'infra', 'deploy'].includes(category) || !id) return null
-    const out = {category, id}; set(out, 'kind', token(value.kind, 64)); set(out, 'version', token(value.version, 64)); return out
-}
-
-export function sanitizeTechnologies(value) {
-    const badges = list(value?.badges, CAPS.badges, badge, (a, b) => compare(a.category, b.category) || compare(a.id, b.id))
-    const outState = state(value?.state)
-    return {state: badges.truncated && outState === 'COMPLETE' ? 'PARTIAL' : outState, verdict: verdict(value?.verdict), completeness: {badges: count(value?.completeness?.badges, badges.total, badges.items.length), reasons: reasons(value?.completeness?.reasons)}, badges: badges.items}
-}

package/src/mcp/sync/evidence-packages.mjs

@@ -1,95 +0,0 @@
-import {
-    CAPS, PACKAGE_DEPENDENCY_KINDS, bool, checks, compare, count, int, list,
-    numericRecord, packageName, packageVersion, path, reasons, set, state, text,
-    token, verdict,
-} from './evidence-common.mjs'
-
-const PACKAGE_SOURCES = new Set(['package-lock', 'yarn-lock', 'requirements', 'venv', 'poetry-lock', 'uv-lock', 'pipfile-lock', 'go-sum', 'go-mod', 'node_modules'])
-
-function packageSource(value) {
-    const source = text(value, 512)
-    if (PACKAGE_SOURCES.has(source)) return source
-    const relative = path(source, 512)
-    return relative && /(^|\/)(?:package-lock\.json|npm-shrinkwrap\.json|yarn\.lock|pnpm-lock\.ya?ml|requirements[\w.-]*\.(?:txt|in)|poetry\.lock|uv\.lock|Pipfile\.lock|go\.(?:mod|sum))$/i.test(relative) ? relative : undefined
-}
-
-function packageFact(value) {
-    const name = packageName(value?.name), version = token(value?.version, 128), ecosystem = token(value?.ecosystem, 64), source = packageSource(value?.source)
-    return name && version && ecosystem && source ? {name, version, ecosystem, dev: bool(value.dev), source} : null
-}
-
-function usage(value) {
-    const name = packageName(value?.name), ecosystem = token(value?.ecosystem, 64)
-    if (!name || !ecosystem) return null
-    const files = [...new Set((value.files || []).map((item) => path(item)).filter(Boolean))].sort(compare)
-    return {name, ecosystem, importCount: int(value.importCount), fileCount: int(value.fileCount), files: files.slice(0, CAPS.files), filesTruncated: bool(value.filesTruncated) || files.length > CAPS.files, kinds: [...new Set((value.kinds || []).map((item) => token(item, 64)).filter(Boolean))].sort(compare).slice(0, 32)}
-}
-
-function packageGraphNode(value) {
-    const name = packageName(value?.name), version = packageVersion(value?.version), id = text(value?.id, 512)
-    if (!name || !version || !id) return null
-    const prefix = `npm:${name}@${version}:`
-    if (!id.startsWith(prefix) || !/^[a-f0-9]{12}$/i.test(id.slice(prefix.length))) return null
-    return {id, name, version, direct: bool(value.direct), dev: bool(value.dev), optional: bool(value.optional), peer: bool(value.peer)}
-}
-
-function sanitizePackageDependencyGraph(value) {
-    if (!value || typeof value !== 'object' || Array.isArray(value)) {
-        return {
-            state: 'NOT_CHECKED', ecosystem: 'npm', root: '(root)',
-            completeness: {nodes: count(null, 0, 0), edges: count(null, 0, 0), declarations: numericRecord(null, ['total', 'resolved', 'unresolved', 'local', 'optionalMissing']), reasons: ['DEPENDENCY_GRAPH_NOT_PROVIDED']},
-            nodes: [], edges: [],
-        }
-    }
-    const nodes = list(value.nodes, CAPS.packageGraphNodes, packageGraphNode,
-        (a, b) => Number(b.direct) - Number(a.direct) || compare(a.name, b.name) || compare(a.version, b.version) || compare(a.id, b.id))
-    const nodeIds = new Set(nodes.items.map((node) => node.id))
-    const edge = (candidate) => {
-        const from = candidate?.from === '(root)' ? '(root)' : text(candidate?.from, 512)
-        const to = text(candidate?.to, 512), kind = token(candidate?.kind, 32)
-        if (!from || !to || !PACKAGE_DEPENDENCY_KINDS.has(kind) || from === to ||
-            (from !== '(root)' && !nodeIds.has(from)) || !nodeIds.has(to)) return null
-        return {from, to, kind}
-    }
-    const edges = list(value.edges, CAPS.packageGraphEdges, edge,
-        (a, b) => compare(a.from, b.from) || compare(a.to, b.to) || compare(a.kind, b.kind))
-    const lockfile = path(value.lockfile, 512)
-    const safeLockfile = lockfile && /(^|\/)(?:package-lock\.json|npm-shrinkwrap\.json)$/i.test(lockfile) ? lockfile : undefined
-    const graphState = state(value.state)
-    const truncated = nodes.truncated || edges.truncated
-    const out = {
-        state: truncated && graphState === 'COMPLETE' ? 'PARTIAL' : graphState,
-        ecosystem: 'npm', root: '(root)',
-        completeness: {
-            nodes: count(value?.completeness?.nodes, nodes.total, nodes.items.length),
-            edges: count(value?.completeness?.edges, edges.total, edges.items.length),
-            declarations: numericRecord(value?.completeness?.declarations, ['total', 'resolved', 'unresolved', 'local', 'optionalMissing']),
-            reasons: reasons(value?.completeness?.reasons),
-        },
-        nodes: nodes.items, edges: edges.items,
-    }
-    set(out, 'lockfile', safeLockfile)
-    const lockfileVersion = int(value.lockfileVersion)
-    if (lockfileVersion > 0) out.lockfileVersion = lockfileVersion
-    return out
-}
-
-export function sanitizePackages(value) {
-    const inventory = list(value?.inventory, CAPS.packages, packageFact, (a, b) => compare(a.ecosystem, b.ecosystem) || compare(a.name, b.name) || compare(a.version, b.version))
-    const directUsage = list(value?.directUsage, CAPS.usage, usage, (a, b) => compare(a.ecosystem, b.ecosystem) || compare(a.name, b.name))
-    const dependencyGraph = sanitizePackageDependencyGraph(value?.dependencyGraph)
-    const outState = state(value?.state)
-    const truncated = inventory.truncated || directUsage.truncated || (dependencyGraph.state === 'PARTIAL' && value?.dependencyGraph?.state === 'COMPLETE')
-    return {
-        state: truncated && outState === 'COMPLETE' ? 'PARTIAL' : outState,
-        verdict: verdict(value?.verdict),
-        completeness: {
-            inventory: count(value?.completeness?.inventory, inventory.total, inventory.items.length),
-            directUsage: count(value?.completeness?.directUsage, directUsage.total, directUsage.items.length),
-            dependencyGraphNodes: count(value?.completeness?.dependencyGraphNodes, dependencyGraph.completeness.nodes.total, dependencyGraph.nodes.length),
-            dependencyGraphEdges: count(value?.completeness?.dependencyGraphEdges, dependencyGraph.completeness.edges.total, dependencyGraph.edges.length),
-            reasons: reasons(value?.completeness?.reasons),
-        },
-        checks: checks(value?.checks), inventory: inventory.items, directUsage: directUsage.items, dependencyGraph,
-    }
-}

package/src/mcp/sync/payload-common.mjs

@@ -1,97 +0,0 @@
-const CONTROL_CHARS = /[\u0000-\u001f\u007f]/;
-const ABSOLUTE_PATH_FRAGMENT = /(?:^|[\/\s"'`(=])[a-z]:[\\/]|(?:^|[\s"'`(=])(?:\\\\[^\\/\s]+(?:[\\/]|$)|file:(?:\/\/)?[\\/]|\/(?!\/)[^\s])/i;
-
-export const MAX_SYNC_BODY_BYTES = 8 * 1024 * 1024;
-export const MAX_SYNC_NODES = 25_000;
-export const MAX_SYNC_LINKS = 100_000;
-export const MAX_SYNC_EXTERNAL_IMPORTS = 50_000;
-
-export function metadataString(value, max = 4096) {
-    return typeof value === 'string' && value.length > 0 && value.length <= max && !CONTROL_CHARS.test(value)
-        ? value : undefined;
-}
-
-export function repoRelativePathString(value, max = 4096) {
-    const path = metadataString(value, max);
-    if (!path || /^(?:[a-z][a-z0-9+.-]*:|[\\/])/i.test(path)) return undefined;
-    const segments = path.split(/[\\/]/);
-    if (segments.some((segment) => segment === '.' || segment === '..')) return undefined;
-    return path;
-}
-
-export function graphIdString(value) {
-    const id = metadataString(value);
-    if (!id) return undefined;
-    const hash = id.indexOf('#');
-    const file = hash < 0 ? id : id.slice(0, hash);
-    return repoRelativePathString(file) ? id : undefined;
-}
-
-export function privacySafeText(value, max = 4096) {
-    const text = metadataString(value, max);
-    return text && !ABSOLUTE_PATH_FRAGMENT.test(text) ? text : undefined;
-}
-
-export function repoPathV3(value, max = 4096) {
-    const path = repoRelativePathString(value, max);
-    return path ? path.replace(/\\/g, '/') : undefined;
-}
-
-export function graphIdV3(value) {
-    const id = metadataString(value);
-    if (!id) return undefined;
-    const hash = id.indexOf('#');
-    const file = hash < 0 ? id : id.slice(0, hash);
-    const safeFile = repoPathV3(file);
-    if (!safeFile) return undefined;
-    if (hash < 0) return safeFile;
-    const suffix = id.slice(hash);
-    if (suffix.length > 512 || !/^#[^\\/\s\u0000-\u001f\u007f]{1,511}$/u.test(suffix)) return undefined;
-    return `${safeFile}${suffix}`;
-}
-
-export function safeToken(value, max = 256) {
-    const token = metadataString(value, max);
-    return token && /^[\p{L}\p{N}_.:@+\-#$<>()\[\],]+$/u.test(token) ? token : undefined;
-}
-
-export function packageName(value) {
-    const name = metadataString(value, 256);
-    return name && /^(?:@[a-z0-9._-]+\/)?[a-z0-9][a-z0-9._-]*$/i.test(name) ? name : undefined;
-}
-
-export function externalSpecifier(value) {
-    const spec = metadataString(value, 512);
-    if (!spec || ABSOLUTE_PATH_FRAGMENT.test(spec) || /^(?:[a-z]:[\\/]|[\\/]|\.\.?[\\/])/i.test(spec)) return undefined;
-    return /^[a-z0-9@][a-z0-9@._:/+\-]*$/i.test(spec) ? spec : undefined;
-}
-
-export function finiteNumber(value) {
-    return typeof value === 'number' && Number.isFinite(value) ? value : undefined;
-}
-
-export function setIf(out, key, value) {
-    if (value !== undefined) out[key] = value;
-}
-
-const COMPLEXITY_NUMBERS = [
-    'startLine', 'endLine', 'loc', 'params', 'objectFields', 'branches', 'cyclomatic',
-    'loops', 'maxLoopDepth', 'returns', 'awaits', 'callCount', 'externalCalls',
-    'asyncBoundaries', 'allocations', 'objectLiterals', 'spreadCopies', 'sorts',
-    'linearOps', 'allocationsInLoops', 'copiesInLoops', 'linearOpsInLoops',
-    'sortsInLoops', 'recursionInLoops', 'timeRank', 'timeScore', 'memoryRank', 'memoryScore',
-];
-
-export function sanitizeComplexity(value) {
-    if (!value || typeof value !== 'object' || Array.isArray(value)) return undefined;
-    const out = {};
-    for (const key of COMPLEXITY_NUMBERS) setIf(out, key, finiteNumber(value[key]));
-    if (typeof value.recursion === 'boolean') out.recursion = value.recursion;
-    for (const key of ['family', 'scope', 'complexityScope', 'confidence']) setIf(out, key, metadataString(value[key], 32));
-    return Object.keys(out).length ? out : undefined;
-}
-
-export function assertArrayLimit(raw, key, limit) {
-    const count = Array.isArray(raw[key]) ? raw[key].length : 0;
-    if (count > limit) throw new Error(`${key} has ${count} entries; maximum is ${limit}`);
-}

package/src/mcp/sync/payload-v2.mjs

@@ -1,54 +0,0 @@
-import {
-    finiteNumber, graphIdString, metadataString, repoRelativePathString,
-    sanitizeComplexity, setIf,
-} from './payload-common.mjs';
-
-export function sanitizeNode(value) {
-    if (!value || typeof value !== 'object' || Array.isArray(value)) return null;
-    const id = graphIdString(value.id);
-    if (!id) return null;
-    const out = {id};
-    setIf(out, 'label', metadataString(value.label, 1024));
-    setIf(out, 'file_type', metadataString(value.file_type, 32));
-    setIf(out, 'source_file', repoRelativePathString(value.source_file));
-    const sourceLocation = metadataString(value.source_location, 32);
-    const sourceEnd = metadataString(value.source_end, 32);
-    if (sourceLocation && /^L\d+$/.test(sourceLocation)) out.source_location = sourceLocation;
-    if (sourceEnd && /^L\d+$/.test(sourceEnd)) out.source_end = sourceEnd;
-    const community = finiteNumber(value.community);
-    if (community !== undefined && Number.isInteger(community) && community >= 0) out.community = community;
-    if (typeof value.exported === 'boolean') out.exported = value.exported;
-    if (typeof value.decorated === 'boolean') out.decorated = value.decorated;
-    if (value.test_surface === true) out.test_surface = true;
-    setIf(out, 'complexity', sanitizeComplexity(value.complexity));
-    return out;
-}
-
-export function sanitizeLink(value) {
-    if (!value || typeof value !== 'object' || Array.isArray(value)) return null;
-    const source = graphIdString(value.source);
-    const target = graphIdString(value.target);
-    if (!source || !target) return null;
-    const out = {source, target};
-    setIf(out, 'relation', metadataString(value.relation, 32));
-    setIf(out, 'confidence', metadataString(value.confidence, 32));
-    if (value.typeOnly === true) out.typeOnly = true;
-    if (value.compileOnly === true) out.compileOnly = true;
-    const line = finiteNumber(value.line);
-    if (line !== undefined && Number.isInteger(line) && line >= 0) out.line = line;
-    setIf(out, 'specifier', metadataString(value.specifier));
-    return out;
-}
-
-export function sanitizeExternalImport(value) {
-    if (!value || typeof value !== 'object' || Array.isArray(value)) return null;
-    const file = repoRelativePathString(value.file);
-    if (!file) return null;
-    const out = {file};
-    for (const key of ['spec', 'target']) setIf(out, key, metadataString(value[key]));
-    for (const key of ['pkg', 'kind', 'ecosystem']) setIf(out, key, metadataString(value[key], 256));
-    const line = finiteNumber(value.line);
-    if (line !== undefined && Number.isInteger(line) && line >= 0) out.line = line;
-    for (const key of ['builtin', 'dynamic', 'unresolved']) if (typeof value[key] === 'boolean') out[key] = value[key];
-    return out;
-}

package/src/mcp/sync/payload-v3.mjs

@@ -1,79 +0,0 @@
-import {edgeProvenance} from '../../graph/edge-provenance.js';
-import {
-    externalSpecifier, graphIdV3, packageName, privacySafeText, repoPathV3,
-    safeToken, setIf,
-} from './payload-common.mjs';
-import {sanitizeExternalImport, sanitizeLink, sanitizeNode} from './payload-v2.mjs';
-
-export function sanitizeNodeV3(value) {
-    const out = sanitizeNode(value);
-    if (!out) return null;
-    const id = graphIdV3(value.id);
-    if (!id) return null;
-    const sourceFile = value.source_file == null ? undefined : repoPathV3(value.source_file);
-    if (value.source_file != null && !sourceFile) return null;
-    const hash = id.indexOf('#');
-    const idFile = hash < 0 ? id : id.slice(0, hash);
-    if (sourceFile && idFile !== sourceFile) return null;
-    out.id = id;
-    const label = privacySafeText(value.label, 1024);
-    if (label) out.label = label;
-    else delete out.label;
-    const fileType = safeToken(value.file_type, 32);
-    if (fileType) out.file_type = fileType;
-    else delete out.file_type;
-    if (sourceFile) out.source_file = sourceFile;
-    else delete out.source_file;
-    for (const key of ['symbol_kind', 'symbol_space', 'member_of', 'visibility']) setIf(out, key, safeToken(value[key], 128));
-    if (out.complexity) for (const key of ['family', 'scope', 'complexityScope', 'confidence']) {
-        const safe = safeToken(value.complexity?.[key], 32);
-        if (safe) out.complexity[key] = safe;
-        else delete out.complexity[key];
-    }
-    return out;
-}
-
-export function sanitizeLinkV3(value) {
-    const out = sanitizeLink(value);
-    if (!out) return null;
-    const source = graphIdV3(value.source);
-    const target = graphIdV3(value.target);
-    if (!source || !target) return null;
-    out.source = source;
-    out.target = target;
-    for (const key of ['relation', 'confidence']) {
-        const safe = safeToken(value[key], 32);
-        if (safe) out[key] = safe;
-        else delete out[key];
-    }
-    const provenance = edgeProvenance(value);
-    if (provenance !== 'UNKNOWN') out.provenance = provenance;
-    const specifier = privacySafeText(value.specifier, 1024);
-    if (specifier) out.specifier = specifier;
-    else delete out.specifier;
-    return out;
-}
-
-export function sanitizeExternalImportV3(value) {
-    const out = sanitizeExternalImport(value);
-    if (!out) return null;
-    const file = repoPathV3(value.file);
-    if (!file) return null;
-    out.file = file;
-    setIf(out, 'spec', externalSpecifier(value.spec));
-    if (!externalSpecifier(value.spec)) delete out.spec;
-    setIf(out, 'pkg', packageName(value.pkg));
-    if (!packageName(value.pkg)) delete out.pkg;
-    for (const key of ['kind', 'ecosystem']) {
-        const safe = safeToken(value[key], 64);
-        if (safe) out[key] = safe;
-        else delete out[key];
-    }
-    if (value.target != null) {
-        const target = repoPathV3(value.target);
-        if (target) out.target = target;
-        else delete out.target;
-    }
-    if (value.typeOnly === true) out.typeOnly = true;
-    return out;
-}

package/src/mcp/sync-evidence.mjs

@@ -1,23 +0,0 @@
-// Defense-in-depth wire sanitizer for evidence snapshots. Each section owns its
-// allowlist; this facade only assembles and hashes the versioned wire envelope.
-import {createHash} from 'node:crypto'
-import {sanitizeArchitecture} from './sync/evidence-architecture.mjs'
-import {stableStringify} from './sync/evidence-common.mjs'
-import {sanitizeDuplicates} from './sync/evidence-duplicates.mjs'
-import {sanitizeHealth, sanitizeTechnologies} from './sync/evidence-health.mjs'
-import {sanitizePackages} from './sync/evidence-packages.mjs'
-
-export function sanitizeEvidenceSnapshot(value) {
-    if (!value || typeof value !== 'object' || Array.isArray(value) || value.evidenceSnapshotV !== 1) throw new Error('invalid evidence snapshot')
-    const sections = {
-        architecture: sanitizeArchitecture(value.sections?.architecture),
-        duplicates: sanitizeDuplicates(value.sections?.duplicates),
-        health: sanitizeHealth(value.sections?.health),
-        technologies: sanitizeTechnologies(value.sections?.technologies),
-        packages: sanitizePackages(value.sections?.packages),
-    }
-    const states = Object.values(sections).map((section) => section.state)
-    const snapshotState = states.every((item) => item === 'ERROR') ? 'ERROR' : states.every((item) => item === 'COMPLETE' || item === 'NOT_APPLICABLE') ? 'COMPLETE' : 'PARTIAL'
-    const snapshot = {evidenceSnapshotV: 1, state: snapshotState, sections}
-    return {...snapshot, snapshotHash: createHash('sha256').update(stableStringify(snapshot)).digest('hex')}
-}

package/src/mcp/sync-payload.mjs

@@ -1,70 +0,0 @@
-// Versioned, explicit source-free extension schema. Never forward graph.json wholesale.
-import {sanitizeEvidenceSnapshot} from './sync-evidence.mjs';
-import {
-    MAX_SYNC_EXTERNAL_IMPORTS, MAX_SYNC_LINKS, MAX_SYNC_NODES, assertArrayLimit,
-} from './sync/payload-common.mjs';
-import {sanitizeExternalImport, sanitizeLink, sanitizeNode} from './sync/payload-v2.mjs';
-import {sanitizeExternalImportV3, sanitizeLinkV3, sanitizeNodeV3} from './sync/payload-v3.mjs';
-
-export {
-    MAX_SYNC_BODY_BYTES, MAX_SYNC_EXTERNAL_IMPORTS, MAX_SYNC_LINKS, MAX_SYNC_NODES,
-} from './sync/payload-common.mjs';
-
-export function createSyncPayload(raw) {
-    if (!raw || typeof raw !== 'object' || Array.isArray(raw) || raw.repoBoundaryV !== 1) {
-        throw new Error('graph predates repository-boundary hardening');
-    }
-    if (!Number.isInteger(raw.edgeTypesV) || raw.edgeTypesV < 2) {
-        throw new Error('graph predates compile-only edge metadata');
-    }
-    const nodes = Array.isArray(raw.nodes) ? raw.nodes.map(sanitizeNode).filter(Boolean) : [];
-    const links = Array.isArray(raw.links) ? raw.links.map(sanitizeLink).filter(Boolean) : [];
-    const externalImports = Array.isArray(raw.externalImports)
-        ? raw.externalImports.map(sanitizeExternalImport).filter(Boolean) : [];
-    return {
-        syncPayloadV: 2,
-        repoBoundaryV: 1,
-        edgeTypesV: 2,
-        extImportsV: Number.isInteger(raw.extImportsV) ? raw.extImportsV : 0,
-        complexityV: Number.isInteger(raw.complexityV) ? raw.complexityV : 0,
-        nodes,
-        links,
-        externalImports,
-    };
-}
-
-export function createSyncPayloadV3(raw, evidence) {
-    const base = createSyncPayload(raw);
-    if (!Number.isInteger(raw.edgeProvenanceV) || raw.edgeProvenanceV < 1) {
-        throw new Error('graph predates edge provenance metadata');
-    }
-    assertArrayLimit(raw, 'nodes', MAX_SYNC_NODES);
-    assertArrayLimit(raw, 'links', MAX_SYNC_LINKS);
-    assertArrayLimit(raw, 'externalImports', MAX_SYNC_EXTERNAL_IMPORTS);
-    const nodes = (raw.nodes || []).map(sanitizeNodeV3).filter(Boolean);
-    const nodeIds = new Set();
-    for (const node of nodes) {
-        if (nodeIds.has(node.id)) throw new Error(`duplicate node id in graph: ${node.id}`);
-        nodeIds.add(node.id);
-    }
-    const links = (raw.links || []).map(sanitizeLinkV3).filter(Boolean);
-    for (const link of links) {
-        if (!nodeIds.has(link.source) || !nodeIds.has(link.target)) {
-            throw new Error(`dangling link in graph: ${link.source} -> ${link.target}`);
-        }
-    }
-    const externalImports = (raw.externalImports || []).map(sanitizeExternalImportV3).filter(Boolean);
-    return {
-        syncPayloadV: 3,
-        repoBoundaryV: base.repoBoundaryV,
-        edgeTypesV: base.edgeTypesV,
-        edgeProvenanceV: Number.isInteger(raw.edgeProvenanceV) ? raw.edgeProvenanceV : 0,
-        extImportsV: base.extImportsV,
-        complexityV: base.complexityV,
-        evidenceV: 1,
-        nodes,
-        links,
-        externalImports,
-        evidence: sanitizeEvidenceSnapshot(evidence),
-    };
-}

package/src/mcp/tool-result.mjs

@@ -1,54 +0,0 @@
-// Text mode stays genuinely compact for agents and older clients: it returns TextContent only.
-// JSON mode adds the stable machine-readable structuredContent envelope and mirrors that envelope
-// into TextContent for workflow runners that cannot consume structured results directly.
-
-const TOOL_RESULT_SCHEMA = 'weavatrix.tool.v1'
-
-export function toolResult(text, result, extra = {}) {
-    return {
-        __weavatrixToolResult: true,
-        text: String(text ?? ''),
-        result: result && typeof result === 'object' ? result : {},
-        warnings: Array.isArray(extra.warnings) ? extra.warnings : [],
-        page: extra.page && typeof extra.page === 'object' ? extra.page : undefined,
-        completeness: extra.completeness && typeof extra.completeness === 'object' ? extra.completeness : undefined,
-    }
-}
-
-function repoName(repoRoot) {
-    const parts = String(repoRoot || '').replace(/[\\/]+$/, '').split(/[\\/]/)
-    const name = parts.pop() || 'unknown'
-    return name.normalize('NFKC').replace(/[^a-z0-9._-]+/gi, '-').replace(/^-+|-+$/g, '').slice(0, 128) || 'unknown'
-}
-
-export function normalizeToolResult({toolName, value, args, ctx, refresh, warnings = [], freshness = 'unknown'}) {
-    const rich = value && typeof value === 'object' && value.__weavatrixToolResult === true
-    const text = rich ? value.text : String(value ?? '')
-    const resultWarnings = [...(rich ? value.warnings : []), ...warnings]
-    if (refresh?.notice) resultWarnings.unshift({code: 'GRAPH_AUTO_REFRESHED', message: refresh.notice})
-    if (refresh?.error) resultWarnings.unshift({code: 'GRAPH_AUTO_REFRESH_FAILED', message: refresh.error})
-    const structured = {
-        schemaVersion: TOOL_RESULT_SCHEMA,
-        tool: String(toolName || ''),
-        repo: {name: repoName(ctx?.repoRoot)},
-        graph: {
-            revision: refresh?.revision || null,
-            freshness: refresh?.error ? 'stale' : (refresh?.kind ? 'fresh' : freshness),
-            update: refresh?.kind || 'none',
-            changedFiles: Number(refresh?.changedFiles) || 0,
-        },
-        result: rich ? value.result : {text},
-        evidence: [],
-        warnings: resultWarnings,
-        page: rich ? (value.page || {}) : {},
-        ...(rich && value.completeness ? {completeness: value.completeness} : {}),
-    }
-    const json = args?.output_format === 'json'
-    return {
-        text: json ? JSON.stringify(structured, null, 2) : `Repository: ${structured.repo.name}\n${text}`,
-        // MCP output schemas apply to every invocation of a tool. The catalog intentionally does not
-        // advertise one because text mode must not attach a second, potentially very large payload.
-        // JSON callers still receive the stable structured result as an optional MCP extension.
-        structured: json ? structured : undefined,
-    }
-}

package/src/mcp/tools-actions.mjs

@@ -1,11 +0,0 @@
-// Propagate catalog.mjs's cache-busting query to owner modules so development hot reload remains
-// behaviorally identical to the former single-file implementation.
-const version = new URL(import.meta.url).search
-const load = (path) => import(new URL(`${path}${version}`, import.meta.url).href)
-const [lifecycle] = await Promise.all([
-  load('./actions/graph-lifecycle.mjs'),
-])
-
-export const tOpenRepo = lifecycle.tOpenRepo
-export const tListKnownRepos = lifecycle.tListKnownRepos
-export const tRebuildGraph = lifecycle.tRebuildGraph