weavatrix 0.3.14 → 1.0.0

package/src/analysis/coverage-reports.js

@@ -1,246 +0,0 @@
-// graph-builder-coverage.js — coverage-report readers for the graph analysis. Parses Istanbul (summary/final),
-// lcov, Python coverage.json, and Go coverage.out into per-file line-hit maps, resolving report paths onto the
-// graph's known files. Split out of graph-builder-analysis.js (pure except for reading the repo's coverage files).
-import { existsSync, readFileSync } from "node:fs";
-import { join, relative, resolve } from "node:path";
-import { createRepoBoundary } from "../repo-path.js";
-import { readTarpaulinCoverage } from "./coverage-reports-tarpaulin.js";
-
-export function normRepoPath(value) {
-  return String(value || "").replace(/\\/g, "/").replace(/^\.\//, "");
-}
-
-export function dirOfRepoPath(value) {
-  const p = normRepoPath(value);
-  const i = p.lastIndexOf("/");
-  return i >= 0 ? p.slice(0, i) : "";
-}
-
-export function normalizeRepoParts(value) {
-  const out = [];
-  for (const part of normRepoPath(value).split("/")) {
-    if (!part || part === ".") continue;
-    if (part === "..") out.pop();
-    else out.push(part);
-  }
-  return out.join("/");
-}
-
-function pct01(value) {
-  const n = Number(value);
-  if (!Number.isFinite(n)) return null;
-  return Math.max(0, Math.min(1, n > 1 ? n / 100 : n));
-}
-
-export function pctFromCounts(covered, total) {
-  const c = Number(covered);
-  const t = Number(total);
-  if (!Number.isFinite(c) || !Number.isFinite(t) || t <= 0) return null;
-  return Math.max(0, Math.min(1, c / t));
-}
-
-function resolveCoverageFile(rawPath, knownFiles, repoRoot) {
-  const known = (knownFiles || []).map(normalizeRepoParts).filter(Boolean);
-  const knownSet = new Set(known);
-  const candidates = [];
-  const add = (value) => {
-    const p = normalizeRepoParts(value);
-    if (p && !candidates.includes(p)) candidates.push(p);
-  };
-  const raw = String(rawPath || "").replace(/^file:\/\//i, "").replace(/[?#].*$/, "");
-  const normalizedRaw = normRepoPath(raw);
-  add(normalizedRaw);
-  add(normalizedRaw.replace(/^\.\//, ""));
-  if (repoRoot) {
-    try {
-      const rel = normRepoPath(relative(repoRoot, raw));
-      if (rel && !rel.startsWith("..")) add(rel);
-    } catch {
-      /* best effort */
-    }
-    const rootPrefix = `${normRepoPath(resolve(repoRoot)).toLowerCase()}/`;
-    const lowerRaw = normalizedRaw.toLowerCase();
-    if (lowerRaw.startsWith(rootPrefix)) add(normalizedRaw.slice(rootPrefix.length));
-  }
-  for (const candidate of candidates) if (knownSet.has(candidate)) return candidate;
-  const lower = normalizedRaw.toLowerCase();
-  const suffixHit = known
-    .slice()
-    .sort((a, b) => b.length - a.length)
-    .find((file) => lower.endsWith(`/${file.toLowerCase()}`) || lower === file.toLowerCase());
-  return suffixHit || candidates[0] || "";
-}
-
-function mergeCoverageEntry(map, rawPath, entry, knownFiles, repoRoot) {
-  const file = resolveCoverageFile(rawPath, knownFiles, repoRoot);
-  if (!file) return;
-  const current = map.get(file) || {};
-  map.set(file, {
-    pct: entry.pct != null ? entry.pct : current.pct ?? null,
-    total: entry.total != null ? entry.total : current.total ?? null,
-    covered: entry.covered != null ? entry.covered : current.covered ?? null,
-    lines: entry.lines || current.lines || null,
-    source: current.source && entry.source ? `${current.source}, ${entry.source}` : entry.source || current.source || ""
-  });
-}
-
-function addLineHit(lines, line, hit) {
-  const value = Number(line);
-  if (!Number.isFinite(value) || value <= 0) return;
-  const n = Math.round(value);
-  if (n < 1) return;
-  const current = lines.get(n);
-  lines.set(n, Math.max(Number(current) || 0, Number(hit) || 0));
-}
-
-function parseIstanbulSummary(map, filePath, knownFiles, repoRoot) {
-  const json = JSON.parse(readFileSync(filePath, "utf8"));
-  for (const [raw, value] of Object.entries(json || {})) {
-    if (raw === "total" || !value || typeof value !== "object") continue;
-    const lines = value.lines || value.statements || {};
-    mergeCoverageEntry(map, raw, {
-      pct: pct01(lines.pct),
-      total: Number.isFinite(Number(lines.total)) ? Number(lines.total) : null,
-      covered: Number.isFinite(Number(lines.covered)) ? Number(lines.covered) : null,
-      source: "coverage-summary.json"
-    }, knownFiles, repoRoot);
-  }
-}
-
-function parseIstanbulFinal(map, filePath, knownFiles, repoRoot) {
-  const json = JSON.parse(readFileSync(filePath, "utf8"));
-  for (const [raw, record] of Object.entries(json || {})) {
-    if (!record || typeof record !== "object") continue;
-    const statementMap = record.statementMap || {};
-    const hits = record.s || {};
-    const lines = new Map();
-    for (const [id, loc] of Object.entries(statementMap)) {
-      const hit = Number(hits[id]) || 0;
-      const start = Math.max(1, Math.round(Number(loc?.start?.line) || 0));
-      const end = Math.max(start, Math.round(Number(loc?.end?.line) || start));
-      for (let line = start; line <= end; line++) addLineHit(lines, line, hit);
-    }
-    const total = lines.size;
-    const covered = [...lines.values()].filter((hit) => Number(hit) > 0).length;
-    mergeCoverageEntry(map, record.path || raw, {
-      pct: pctFromCounts(covered, total),
-      total,
-      covered,
-      lines,
-      source: "coverage-final.json"
-    }, knownFiles, repoRoot);
-  }
-}
-
-function parseLcov(map, filePath, knownFiles, repoRoot) {
-  const flush = (record) => {
-    if (!record || !record.file) return;
-    const total = record.total ?? record.lines.size;
-    const covered = record.covered ?? [...record.lines.values()].filter((hit) => Number(hit) > 0).length;
-    mergeCoverageEntry(map, record.file, {
-      pct: pctFromCounts(covered, total),
-      total,
-      covered,
-      lines: record.lines,
-      source: "lcov.info"
-    }, knownFiles, repoRoot);
-  };
-  let current = null;
-  for (const rawLine of readFileSync(filePath, "utf8").split(/\r?\n/)) {
-    const line = rawLine.trim();
-    if (line.startsWith("SF:")) {
-      flush(current);
-      current = { file: line.slice(3), lines: new Map(), total: null, covered: null };
-    } else if (current && line.startsWith("DA:")) {
-      const [lineNo, count] = line.slice(3).split(",");
-      addLineHit(current.lines, lineNo, count);
-    } else if (current && line.startsWith("LF:")) {
-      current.total = Number(line.slice(3)) || current.total;
-    } else if (current && line.startsWith("LH:")) {
-      current.covered = Number(line.slice(3)) || current.covered;
-    } else if (line === "end_of_record") {
-      flush(current);
-      current = null;
-    }
-  }
-  flush(current);
-}
-
-function parseCoveragePyJson(map, filePath, knownFiles, repoRoot) {
-  const json = JSON.parse(readFileSync(filePath, "utf8"));
-  for (const [raw, file] of Object.entries(json?.files || {})) {
-    const lines = new Map();
-    for (const line of file.executed_lines || []) addLineHit(lines, line, 1);
-    for (const line of file.missing_lines || []) if (!lines.has(Number(line))) addLineHit(lines, line, 0);
-    const summary = file.summary || {};
-    const total = Number(summary.num_statements) || lines.size;
-    const covered = Number(summary.covered_lines) || [...lines.values()].filter((hit) => Number(hit) > 0).length;
-    mergeCoverageEntry(map, raw, {
-      pct: pct01(summary.percent_covered ?? summary.percent_covered_display) ?? pctFromCounts(covered, total),
-      total,
-      covered,
-      lines,
-      source: "coverage.json"
-    }, knownFiles, repoRoot);
-  }
-}
-
-function parseGoCoverage(map, filePath, knownFiles, repoRoot) {
-  const byFile = new Map();
-  for (const rawLine of readFileSync(filePath, "utf8").split(/\r?\n/)) {
-    const line = rawLine.trim();
-    if (!line || line.startsWith("mode:")) continue;
-    const m = line.match(/^(.+):(\d+)\.\d+,(\d+)\.\d+\s+\d+\s+(\d+)$/);
-    if (!m) continue;
-    const record = byFile.get(m[1]) || { lines: new Map() };
-    const start = Math.max(1, Number(m[2]) || 1);
-    const end = Math.max(start, Number(m[3]) || start);
-    for (let n = start; n <= end; n++) addLineHit(record.lines, n, Number(m[4]) || 0);
-    byFile.set(m[1], record);
-  }
-  for (const [raw, record] of byFile) {
-    const total = record.lines.size;
-    const covered = [...record.lines.values()].filter((hit) => Number(hit) > 0).length;
-    mergeCoverageEntry(map, raw, {
-      pct: pctFromCounts(covered, total),
-      total,
-      covered,
-      lines: record.lines,
-      source: "coverage.out"
-    }, knownFiles, repoRoot);
-  }
-}
-
-function parseTarpaulinJson(map, filePath, knownFiles, repoRoot) {
-  for (const record of readTarpaulinCoverage(filePath)) {
-    mergeCoverageEntry(map, record.path, record.entry, knownFiles, repoRoot);
-  }
-}
-
-export function readCoverageForRepo(repoRoot, knownFiles) {
-  const out = new Map();
-  if (!repoRoot) return out;
-  const boundary = createRepoBoundary(repoRoot);
-  const candidates = [
-    ["coverage/coverage-summary.json", parseIstanbulSummary],
-    ["coverage/coverage-final.json", parseIstanbulFinal],
-    ["coverage/lcov.info", parseLcov],
-    ["lcov.info", parseLcov],
-    ["coverage/coverage.json", parseCoveragePyJson],
-    ["coverage.json", parseCoveragePyJson],
-    ["tarpaulin-report.json", parseTarpaulinJson],
-    ["coverage/tarpaulin-report.json", parseTarpaulinJson],
-    ["coverage.out", parseGoCoverage],
-    ["cover.out", parseGoCoverage]
-  ];
-  for (const [candidate, parser] of candidates) {
-    const resolved = boundary.resolve(candidate);
-    if (!resolved.ok || !existsSync(resolved.path)) continue;
-    try {
-      parser(out, resolved.path, knownFiles, repoRoot);
-    } catch {
-      /* malformed/foreign coverage report: ignore */
-    }
-  }
-  return out;
-}

package/src/analysis/cycle-route.js

@@ -1,14 +0,0 @@
-const MAX_REPRESENTATIVE_CYCLE_FILES = 64;
-
-// Keep the complete closed route for normal cycles. Very large SCCs still get a closed, deterministic
-// head/tail route without letting one finding consume the whole audit response.
-export function formatRepresentativeCycle(cycle, maxFiles = MAX_REPRESENTATIVE_CYCLE_FILES) {
-  const raw = Array.isArray(cycle) ? cycle.map(String).filter(Boolean) : [];
-  if (!raw.length) return "";
-  const closed = raw.length > 1 && raw[0] === raw[raw.length - 1] ? raw : [...raw, raw[0]];
-  const cap = Math.max(4, Number(maxFiles) || MAX_REPRESENTATIVE_CYCLE_FILES);
-  if (closed.length <= cap + 1) return closed.join(" → ");
-  const side = Math.max(2, Math.floor(cap / 2));
-  const omitted = closed.length - side * 2;
-  return `${closed.slice(0, side).join(" → ")} → … ${omitted} file(s) omitted … → ${closed.slice(-side).join(" → ")}`;
-}

package/src/analysis/data-flow-evidence.js

@@ -1,114 +0,0 @@
-import {readFileSync} from 'node:fs'
-import {extname} from 'node:path'
-import ts from 'typescript'
-import {createRepoBoundary} from '../repo-path.js'
-
-const lineOfNode = (node) => Number(String(node?.source_location || '').match(/^L(\d+)/i)?.[1] || String(node?.id || '').match(/@(\d+)$/)?.[1] || 0)
-const fileOfNode = (node) => String(node?.source_file || String(node?.id || '').split('#')[0]).replace(/\\/g, '/')
-const cleanName = (value) => String(value || '').replace(/\(\)$/, '').split('.').pop()
-const callName = (node) => node.expression?.name?.text || node.expression?.text || node.expression?.escapedText || ''
-
-function scriptKind(file) {
-  const ext = extname(file).toLowerCase()
-  if (ext === '.tsx') return ts.ScriptKind.TSX
-  if (ext === '.jsx') return ts.ScriptKind.JSX
-  if (ext === '.ts' || ext === '.mts' || ext === '.cts') return ts.ScriptKind.TS
-  return ts.ScriptKind.JS
-}
-
-function parse(cache, boundary, file) {
-  if (cache.has(file)) return cache.get(file)
-  if (!/\.[cm]?[jt]sx?$/i.test(file)) return null
-  const resolved = boundary.resolve(file)
-  if (!resolved.ok) return null
-  try {
-    const source = ts.createSourceFile(file, readFileSync(resolved.path, 'utf8'), ts.ScriptTarget.Latest, true, scriptKind(file))
-    cache.set(file, source)
-    return source
-  } catch { return null }
-}
-
-function parametersFor(source, target) {
-  const expected = cleanName(target?.label)
-  const expectedLine = lineOfNode(target)
-  const choices = []
-  const visit = (node) => {
-    if (Array.isArray(node.parameters) && node.name) {
-      const name = cleanName(node.name.text || node.name.getText?.(source))
-      if (!expected || name === expected) {
-        const line = source.getLineAndCharacterOfPosition(node.getStart(source)).line + 1
-        choices.push({line, parameters: node.parameters.map((item) => item.name.getText(source).slice(0, 80))})
-      }
-    }
-    ts.forEachChild(node, visit)
-  }
-  visit(source)
-  choices.sort((a, b) => Math.abs(a.line - expectedLine) - Math.abs(b.line - expectedLine))
-  return choices[0]?.parameters || []
-}
-
-function callsAt(source, line, expectedName) {
-  const found = []
-  const visit = (node) => {
-    if (ts.isCallExpression(node)) {
-      const at = source.getLineAndCharacterOfPosition(node.getStart(source)).line + 1
-      if ((!line || at === line) && (!expectedName || cleanName(callName(node)) === expectedName)) found.push({node, line: at})
-    }
-    ts.forEachChild(node, visit)
-  }
-  visit(source)
-  return found
-}
-
-// Bounded interprocedural evidence: maps arguments at graph callsites to the callee's declared
-// parameters. This is not a control-flow graph, value propagation, or taint-analysis claim.
-export function extractCallArgumentEvidence({graph, repoRoot, seedIds = [], depth = 2, maxEdges = 40} = {}) {
-  const boundary = createRepoBoundary(repoRoot)
-  const cache = new Map()
-  const queue = (seedIds || []).map((id) => ({id: String(id), hop: 0}))
-  const visited = new Set()
-  const seenCalls = new Set()
-  const edges = []
-  let unsupported = 0
-  while (queue.length && edges.length < maxEdges) {
-    const current = queue.shift()
-    if (visited.has(current.id) || current.hop >= depth) continue
-    visited.add(current.id)
-    const calls = [
-      ...(graph.out.get(current.id) || []).filter((edge) => edge.relation === 'calls')
-        .map((edge) => ({fromId: current.id, toId: String(edge.id), line: Number(edge.line) || 0, nextId: String(edge.id)})),
-      ...(graph.inn.get(current.id) || []).filter((edge) => edge.relation === 'calls')
-        .map((edge) => ({fromId: String(edge.id), toId: current.id, line: Number(edge.line) || 0, nextId: String(edge.id)})),
-    ]
-    for (const callEdge of calls) {
-      const callKey = `${callEdge.fromId}\0${callEdge.toId}\0${callEdge.line}`
-      if (seenCalls.has(callKey)) continue
-      seenCalls.add(callKey)
-      const from = graph.byId.get(callEdge.fromId)
-      const to = graph.byId.get(callEdge.toId)
-      const callerSource = parse(cache, boundary, fileOfNode(from))
-      const targetSource = parse(cache, boundary, fileOfNode(to))
-      if (!from || !to || !callerSource || !targetSource) { unsupported++; continue }
-      const params = parametersFor(targetSource, to)
-      const callsites = callsAt(callerSource, callEdge.line, cleanName(to.label))
-      if (!callsites.length) { unsupported++; continue }
-      for (const call of callsites.slice(0, 3)) {
-        edges.push({
-          from: callEdge.fromId, to: callEdge.toId, hop: current.hop + 1,
-          file: fileOfNode(from), line: call.line,
-          arguments: call.node.arguments.slice(0, 12).map((argument, index) => ({
-            index, expression: argument.getText(callerSource).slice(0, 160), parameter: params[index] || null,
-          })),
-          state: 'EXTRACTED',
-        })
-        if (edges.length >= maxEdges) break
-      }
-      if (current.hop + 1 < depth) queue.push({id: callEdge.nextId, hop: current.hop + 1})
-    }
-  }
-  return {
-    model: 'bounded call-argument-to-parameter evidence (not CFG or taint analysis)',
-    status: edges.length ? (unsupported ? 'PARTIAL' : 'COMPLETE') : 'UNAVAILABLE',
-    edges, unsupportedEdges: unsupported, capped: edges.length >= maxEdges,
-  }
-}

package/src/analysis/dead-check.js

@@ -1,300 +0,0 @@
-// Portable, language-agnostic DEAD-code checker. A symbol is DEAD when it has NO inbound graph edge (nothing
-// calls/imports/references/inherits it) AND its bare name appears NOWHERE in the repo outside its own file.
-// A file is DEAD when nothing imports it, it isn't an entry point, and all its symbols are dead.
-//
-// Pure core `computeDead(graph, sources)` (sources = Map<fileRel, text>) works on any graph-builder-schema graph
-// and is fully testable with no filesystem. It only needs {nodes, links} + source text. See [[graph-builder-internalization]].
-import { posix } from "node:path";
-import { isStructuralRelation } from "../graph/relations.js";
-import { createSqlDeadVerdict } from "../graph/builder/lang-sql.js";
-import { createPathClassifier, hasPathClass } from "../path-classification.js";
-
-const IDENT_RE = /[A-Za-z_$][\w$]*/g;
-const bareName = (label) => String(label || "").replace(/\s*\(.*$/, "").replace(/[()]/g, "").trim();
-// Ignore comment-only lexical mentions, which are documentation rather than callers. Keep strings on
-// purpose: registries/reflection often address a live symbol by name, and static liveness must stay
-// conservative there. This only strips comments that start a logical line, avoiding a language parser
-// guess around inline comment markers, regex literals, or URLs.
-const lexicalEvidenceText = (value) => {
-  let inBlockComment = false;
-  return String(value || "").split(/\r?\n/).map((line) => {
-    let rest = line;
-    while (true) {
-      if (inBlockComment) {
-        const end = rest.indexOf("*/");
-        if (end < 0) return "";
-        inBlockComment = false;
-        rest = rest.slice(end + 2);
-      }
-      const trimmed = rest.trimStart();
-      if (trimmed.startsWith("//") || trimmed.startsWith("#")) return "";
-      if (!trimmed.startsWith("/*")) return rest;
-      inBlockComment = true;
-      rest = trimmed.slice(2);
-    }
-  }).join("\n");
-};
-// entry surfaces are never dead even with no inbound edge (framework/CLI/HTTP enter them externally).
-// Exported for internal-audit.js (reachability entry set) — keep the two in lockstep.
-export const ENTRY_FILE = /(^|[\\/])(index|main|app|server|cli|cmd|bootstrap|entry|run|__main__|manage|wsgi|asgi|setup|conftest)\.[a-z0-9]+$|(^|[\\/])(bin|cmd)[\\/]|(^|[\\/])main\.go$/i;
-const defaultPathClassifier = createPathClassifier(null);
-const isTestFile = (file) => hasPathClass(defaultPathClassifier.explain(file), "test", "e2e");
-
-// Framework-owned entry modules are invoked by convention rather than a source import. Keep this narrow:
-// these are Next.js App/Pages Router surfaces and framework metadata files, not every file under `app/`.
-const NEXT_ENTRY_FILE = /(^|\/)(?:src\/)?app\/(?:.*\/)?(?:page|layout|template|loading|error|global-error|not-found|default|route|robots|sitemap|manifest|opengraph-image|twitter-image|icon|apple-icon)\.[cm]?[jt]sx?$|(^|\/)(?:src\/)?pages\/(?!.*\/(?:components?|lib|utils?)\/).+\.[cm]?[jt]sx?$|(^|\/)(?:middleware|instrumentation)\.[cm]?[jt]s$/i;
-const RUST_ENTRY_FILE = /(^|\/)(?:build\.rs|src\/(?:lib|main)\.rs)$/i;
-export const isFrameworkEntryFile = (file) => {
-  const normalized = String(file || "").replace(/\\/g, "/");
-  return NEXT_ENTRY_FILE.test(normalized) || RUST_ENTRY_FILE.test(normalized);
-};
-
-const lineOfNode = (n) => {
-  const m = /@(\d+)$/.exec(String(n.id || "")) || /L(\d+)/.exec(String(n.source_location || ""));
-  return m ? Number(m[1]) : 0;
-};
-
-// Older graphs marked every method of an exported class as exported. Verify that an `exported` node is
-// actually a module-surface declaration before reporting it. New graphs expose symbol_kind/member_of and
-// already keep members unexported, but the source check preserves correctness for cached v0.1.2 graphs.
-function hasModuleExport(source, node, name) {
-  if (node.member_of || node.symbol_kind === "method") return false;
-  const lines = String(source || "").split(/\r?\n/);
-  const line = lines[Math.max(0, lineOfNode(node) - 1)] || "";
-  const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  const direct = new RegExp(`\\bexport\\s+(?:default\\s+)?(?:(?:declare|abstract|async)\\s+)*(?:function|class|const|let|var|enum|interface|type|namespace)\\s+${escaped}\\b`);
-  if (direct.test(line) || direct.test(String(source || ""))) return true;
-  const exportDefault = new RegExp(`\\bexport\\s+default\\s+${escaped}\\b`);
-  if (exportDefault.test(String(source || ""))) return true;
-  // `export { local }`, `export { local as publicName }` and CommonJS explicit exports.
-  const exportList = new RegExp(`\\bexport\\s*\\{[^}]*\\b${escaped}\\b[^}]*\\}`, "s");
-  const commonJs = new RegExp(`(?:module\\.exports\\s*=\\s*\\{[^}]*\\b${escaped}\\b|(?:module\\.exports|exports)\\.${escaped}\\s*=)`, "s");
-  return exportList.test(String(source || "")) || commonJs.test(String(source || ""));
-}
-
-function namespaceConsumedFiles(sources, graph) {
-  const files = new Set(sources.keys());
-  const consumed = new Set();
-  const extensions = ["", ".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs", ".mts", ".cts"];
-  const resolve = (from, spec) => {
-    if (!spec.startsWith(".")) return "";
-    const base = posix.normalize(posix.join(posix.dirname(from.replace(/\\/g, "/")), spec));
-    for (const ext of extensions) {
-      const p = `${base}${ext}`;
-      if (files.has(p)) return p;
-    }
-    for (const ext of extensions.slice(1)) {
-      const p = `${base}/index${ext}`;
-      if (files.has(p)) return p;
-    }
-    return "";
-  };
-  for (const [file, textValue] of sources) {
-    const text = String(textValue || "");
-    const patterns = [
-      /\bimport\s+\*\s+as\s+[A-Za-z_$][\w$]*\s+from\s*(["'])([^"']+)\1/g,
-      /\bexport\s+\*\s+from\s*(["'])([^"']+)\1/g,
-      /\b(?:const|let|var)\s+[A-Za-z_$][\w$]*\s*=\s*require\(\s*(["'])([^"']+)\1\s*\)/g,
-    ];
-    for (const re of patterns) {
-      let m;
-      while ((m = re.exec(text))) {
-        const target = resolve(file, m[2]);
-        if (target) consumed.add(target);
-      }
-    }
-  }
-  // New graphs retain the exact specifier on file import edges, which also resolves namespace imports
-  // expressed through tsconfig aliases (the relative-path fallback above intentionally cannot guess those).
-  for (const link of graph.links || []) {
-    if (link.relation !== "imports" && link.relation !== "re_exports") continue;
-    const from = String(link.source?.id || link.source || ""), target = String(link.target?.id || link.target || "");
-    if (!link.specifier || from.includes("#") || target.includes("#") || !sources.has(from)) continue;
-    const spec = String(link.specifier).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-    const text = String(sources.get(from) || "");
-    if (new RegExp(`(?:import\\s+\\*\\s+as\\s+[A-Za-z_$][\\w$]*\\s+from|export\\s+\\*\\s+from)\\s*["']${spec}["']`).test(text)) consumed.add(target);
-  }
-  return consumed;
-}
-
-export function computeDead(graph, sources, { entrySet = new Set() } = {}) {
-  const nodes = graph.nodes || [], links = graph.links || [];
-  const ep = (v) => (v && typeof v === "object" ? v.id : v);
-  const inbound = new Set();
-  const inboundSources = new Map();
-  const nodesById = new Map(nodes.map((node) => [String(node.id), node]));
-  for (const l of links) if (!isStructuralRelation(l.relation)) {
-    const target = String(ep(l.target));
-    const source = String(ep(l.source));
-    inbound.add(target);
-    const values = inboundSources.get(target) || [];
-    values.push(source);
-    inboundSources.set(target, values);
-  }
-
-  // whole-repo identifier frequency: a symbol whose name appears MORE than once total (its definition + at least
-  // one use, same-file OR cross-file) is referenced. Errs toward "alive" (common-named symbols never flagged).
-  const globalFreq = new Map();
-  for (const [, text] of sources) for (const m of lexicalEvidenceText(text).matchAll(IDENT_RE)) { const n = m[0]; globalFreq.set(n, (globalFreq.get(n) || 0) + 1); }
-
-  const symById = new Map();
-  const symsByFile = new Map();
-  for (const n of nodes) {
-    if (!String(n.id).includes("#")) continue;
-    symById.set(n.id, n);
-    (symsByFile.get(n.source_file) || symsByFile.set(n.source_file, []).get(n.source_file)).push(n);
-  }
-
-  const symbolNames = new Set([...symById.values()].map((node) => bareName(node.label)).filter(Boolean));
-  const occurrenceFiles = new Map();
-  const occurrenceCounts = new Map();
-  for (const [file, text] of sources) for (const match of lexicalEvidenceText(text).matchAll(IDENT_RE)) {
-    const name = match[0];
-    if (!symbolNames.has(name)) continue;
-    const files = occurrenceFiles.get(name) || new Set();
-    files.add(file);
-    occurrenceFiles.set(name, files);
-    const counts = occurrenceCounts.get(name) || new Map();
-    counts.set(file, (counts.get(file) || 0) + 1);
-    occurrenceCounts.set(name, counts);
-  }
-
-  const declarationCounts = new Map();
-  for (const node of symById.values()) {
-    const name = bareName(node.label);
-    if (!name) continue;
-    const key = `${node.source_file}\0${name}`;
-    declarationCounts.set(key, (declarationCounts.get(key) || 0) + 1);
-  }
-  const exactReferenceIds = new Set(graph.precisionReferenceSymbols || []);
-  const exactProductionReferenceIds = new Set(graph.precisionProductionReferenceSymbols || []);
-  const exactTestReferenceIds = new Set(graph.precisionTestReferenceSymbols || []);
-
-  // decorated defs (@app.route/@app.event/@pytest.fixture…) are entered by the framework: trust the
-  // builder's flag when present, else walk the source line(s) above the definition (graph-builder graphs).
-  const lineCache = new Map();
-  const linesOf = (f) => { let l = lineCache.get(f); if (!l) { l = String(sources.get(f) || "").split(/\r?\n/); lineCache.set(f, l); } return l; };
-  const symLine = (n) => { const m = /@(\d+)$/.exec(String(n.id)) || /L(\d+)/.exec(String(n.source_location || "")); return m ? Number(m[1]) : 0; };
-  const isDecorated = (n) => {
-    if (n.decorated) return true;
-    const ln = symLine(n);
-    if (!ln) return false;
-    const lines = linesOf(n.source_file);
-    for (let i = ln - 2; i >= 0 && i >= ln - 6; i--) {
-      const t = (lines[i] || "").trim();
-      if (t.startsWith("@")) return true;
-      if (t === "" || t.startsWith("#")) continue;
-      break;
-    }
-    return false;
-  };
-
-  const isReferenced = (n) => {
-    if (inbound.has(n.id)) return true;                          // a real graph edge targets it
-    if (exactReferenceIds.has(String(n.id))) return true;        // revision-bound point-query evidence found a caller
-    const name = bareName(n.label);
-    if (!name || !/^[A-Za-z_$]/.test(name)) return true;         // selectors/odd labels → don't flag
-    if (/^__\w+__$/.test(name)) return true;                     // dunders are invoked implicitly (with/str/==/iter…), never spelled
-    if ((globalFreq.get(name) || 0) > 1) return true;            // name appears beyond its single definition
-    return isDecorated(n);                                       // framework-registered via decorator
-  };
-
-  const sqlVerdict = createSqlDeadVerdict({ nodes, links, ep, bareName });   // gated SQL verdicts — ORM blindness stays silent
-  const deadSymbols = [];
-  for (const n of symById.values()) {
-    if (isReferenced(n) || sqlVerdict.veto(n)) continue;
-    deadSymbols.push({ id: n.id, file: n.source_file, label: n.label, test: isTestFile(n.source_file) || n.test_surface === true, reason: sqlVerdict.reason(n) || "no inbound edge and name unreferenced outside its file" });
-  }
-  const deadSet = new Set(deadSymbols.map((s) => s.id));
-
-  // A production declaration consumed only by tests is live to the raw graph but dead to production.
-  // Keep it in a separate review class: this is useful evidence, never an automatic delete verdict.
-  const testOnlySymbols = [];
-  const consumerFileOf = (id) => nodesById.get(id)?.source_file || (id.includes("#") ? id.split("#")[0] : id);
-  const isTestConsumer = (id) => nodesById.get(id)?.test_surface === true || isTestFile(consumerFileOf(id));
-  for (const n of symById.values()) {
-    if (deadSet.has(n.id) || isTestFile(n.source_file) || n.test_surface === true || isDecorated(n)) continue;
-    const sourcesForSymbol = inboundSources.get(String(n.id)) || [];
-    const hasTestInbound = sourcesForSymbol.some(isTestConsumer);
-    const hasProductionInbound = sourcesForSymbol.some((id) => consumerFileOf(id) && !isTestConsumer(id));
-    const name = bareName(n.label);
-    const occurrenceSet = occurrenceFiles.get(name) || new Set();
-    const externalOccurrences = [...occurrenceSet].filter((file) => file !== n.source_file);
-    const localOccurrences = occurrenceCounts.get(name)?.get(n.source_file) || 0;
-    const localDeclarations = declarationCounts.get(`${n.source_file}\0${name}`) || 0;
-    const hasLocalProductionUse = localOccurrences > localDeclarations;
-    const lexicalTestOnly = externalOccurrences.length > 0 && externalOccurrences.every((file) => isTestFile(file));
-    const hasExactProductionInbound = exactProductionReferenceIds.has(String(n.id));
-    const hasExactTestInbound = exactTestReferenceIds.has(String(n.id));
-    if (hasProductionInbound || hasExactProductionInbound || hasLocalProductionUse
-      || (!hasTestInbound && !hasExactTestInbound && !lexicalTestOnly)) continue;
-    testOnlySymbols.push({
-      id: n.id,
-      file: n.source_file,
-      label: n.label,
-      test: false,
-      reason: "referenced only from test/e2e code; no production consumer was found",
-      testConsumerFiles: [...new Set(sourcesForSymbol.filter(isTestConsumer).map(consumerFileOf).filter(Boolean))].sort(),
-      evidence: hasTestInbound ? "graph" : hasExactTestInbound ? "exact-semantic" : "lexical",
-      publicApi: n.exported === true || ["public", "protected"].includes(String(n.visibility || "").toLowerCase()),
-    });
-  }
-
-  const deadFiles = [];
-  for (const n of nodes) {
-    if (String(n.id).includes("#")) continue;                   // file nodes only
-    if (inbound.has(n.id) || ENTRY_FILE.test(n.source_file) || isFrameworkEntryFile(n.source_file) || entrySet.has(n.source_file)) continue;
-    const syms = symsByFile.get(n.source_file) || [];
-    if (syms.length && syms.every((s) => deadSet.has(s.id))) deadFiles.push({ file: n.source_file, reason: "not imported; all symbols unreferenced" });
-  }
-
-  return {
-    deadSymbols,
-    testOnlySymbols,
-    deadFiles,
-    referencedIds: [...symById.values()].filter(isReferenced).map((n) => n.id),
-    stats: { symbols: symById.size, deadSymbols: deadSymbols.length, testOnlySymbols: testOnlySymbols.length, files: nodes.filter((n) => !String(n.id).includes("#")).length, deadFiles: deadFiles.length },
-  };
-}
-
-// Export-scoped unused check (knip's "unused exports"): an EXPORTED symbol (P0's exported:true flag)
-// with no inbound non-contains edge whose bare name occurs in NO file other than its own. Same-file-only
-// usage means the symbol is alive but the export is not — still worth surfacing. Pure like computeDead.
-// dynamicTargets = files reached via dynamic import() — their exports are consumed at runtime, skip them.
-export function computeUnusedExports(graph, sources, { dynamicTargets = new Set(), entrySet = new Set() } = {}) {
-  const nodes = graph.nodes || [], links = graph.links || [];
-  const ep = (v) => (v && typeof v === "object" ? v.id : v);
-  const inbound = new Set();
-  for (const l of links) if (!isStructuralRelation(l.relation)) inbound.add(ep(l.target));
-
-  const namespaceConsumed = namespaceConsumedFiles(sources, graph);
-  const candidates = [];
-  const wanted = new Set();
-  for (const n of nodes) {
-    if (!n.exported || !String(n.id).includes("#") || inbound.has(n.id)) continue;
-    if (ENTRY_FILE.test(n.source_file) || isFrameworkEntryFile(n.source_file) || entrySet.has(n.source_file) || dynamicTargets.has(n.source_file) || namespaceConsumed.has(n.source_file)) continue;
-    const nm = bareName(n.label);
-    if (!nm || !/^[A-Za-z_$]/.test(nm)) continue;
-    if (!hasModuleExport(sources.get(n.source_file), n, nm)) continue;
-    candidates.push({ n, nm });
-    wanted.add(nm);
-  }
-  if (!candidates.length) return [];
-
-  const occursIn = new Map(); // name -> Set(files whose text contains it)
-  for (const [file, text] of sources) {
-    for (const m of String(text || "").matchAll(IDENT_RE)) {
-      const w = m[0];
-      if (!wanted.has(w)) continue;
-      (occursIn.get(w) || occursIn.set(w, new Set()).get(w)).add(file);
-    }
-  }
-
-  const out = [];
-  for (const { n, nm } of candidates) {
-    const occ = occursIn.get(nm);
-    if (occ && [...occ].some((f) => f !== n.source_file)) continue; // referenced beyond its own file → alive
-    out.push({ id: n.id, file: n.source_file, label: n.label, test: isTestFile(n.source_file), reason: "exported but never imported or referenced outside its own file" });
-  }
-  return out;
-}