weavatrix 0.3.14 → 1.1.0

package/src/analysis/endpoints-rust.js

@@ -1,124 +0,0 @@
-const RUST_ROUTE_METHOD = "get|post|put|patch|delete|head|options|trace|connect|any";
-
-// Find a call's closing parenthesis without mistaking parens inside strings for syntax. This is deliberately
-// small (not a Rust parser), but keeps route-handler expressions bounded instead of using a cross-statement
-// regex that could turn an unrelated function call into a route.
-function closingParen(text, openAt) {
-  let depth = 0, quote = "", escaped = false, blockComment = 0;
-  for (let i = openAt; i < text.length; i++) {
-    const ch = text[i];
-    if (quote) {
-      if (escaped) escaped = false;
-      else if (ch === "\\") escaped = true;
-      else if (ch === quote) quote = "";
-      continue;
-    }
-    if (blockComment) {
-      if (ch === "/" && text[i + 1] === "*") { blockComment++; i++; }
-      else if (ch === "*" && text[i + 1] === "/") { blockComment--; i++; }
-      continue;
-    }
-    if (ch === "/" && text[i + 1] === "/") {
-      const newline = text.indexOf("\n", i + 2);
-      if (newline < 0) return -1;
-      i = newline;
-      continue;
-    }
-    if (ch === "/" && text[i + 1] === "*") { blockComment = 1; i++; continue; }
-    if (ch === '"') { quote = ch; continue; }
-    if (ch === "'") {
-      // Skip a Rust character literal, but do not mistake a lifetime (`'a`) for an unterminated string.
-      const char = /^'(?:\\.|[^\\'\r\n])'/.exec(text.slice(i));
-      if (char) { i += char[0].length - 1; continue; }
-    }
-    if (ch === "(") depth++;
-    else if (ch === ")" && --depth === 0) return i;
-  }
-  return -1;
-}
-
-// Parse axum's MethodRouter expression, including direct method chains:
-//   get(list).post(create) / axum::routing::get(show).delete(remove)
-// Calls inside a handler closure are not scanned and therefore cannot become fake endpoint methods.
-function axumRoutes(expr) {
-  const found = [];
-  let rest = String(expr || ""), offset = 0;
-  const firstRe = new RegExp(`^\\s*(?:(?:axum\\s*::\\s*)?routing\\s*::\\s*)?(${RUST_ROUTE_METHOD})\\s*\\(`, "i");
-  let match = firstRe.exec(rest);
-  if (!match) return found;
-
-  while (match) {
-    const openAt = offset + match.index + match[0].lastIndexOf("(");
-    const closeAt = closingParen(expr, openAt);
-    if (closeAt < 0) break;
-    found.push({ method: match[1], handler: expr.slice(openAt + 1, closeAt), index: openAt });
-    offset = closeAt + 1;
-    rest = expr.slice(offset);
-    match = new RegExp(`^\\s*\\.\\s*(${RUST_ROUTE_METHOD})\\s*\\(`, "i").exec(rest);
-  }
-  return found;
-}
-
-// Actix's builder form is structurally distinct from axum and from HTTP clients:
-//   web::get().to(handler) / actix_web::web::post().to(handler)
-function actixRoutes(expr) {
-  const found = [];
-  const re = new RegExp(`(?:actix_web\\s*::\\s*)?web\\s*::\\s*(${RUST_ROUTE_METHOD})\\s*\\(\\s*\\)\\s*\\.\\s*to\\s*\\(`, "gi");
-  let match;
-  while ((match = re.exec(expr))) {
-    const openAt = re.lastIndex - 1;
-    const closeAt = closingParen(expr, openAt);
-    if (closeAt < 0) continue;
-    found.push({ method: match[1], handler: expr.slice(openAt + 1, closeAt), index: match.index });
-    re.lastIndex = closeAt + 1;
-  }
-  return found;
-}
-
-export function extractRustEndpoints(text, add) {
-  let match;
-
-  // Axum and actix both expose a path-first `.route(path, ...)` builder. Requiring either an axum
-  // MethodRouter or actix's web::<method>().to(...) avoids treating arbitrary Rust APIs named `route` as HTTP.
-  const routeRe = /\.\s*route\s*\(\s*"(\/(?:\\.|[^"\\])*)"\s*,/g;
-  while ((match = routeRe.exec(text))) {
-    const openAt = text.indexOf("(", match.index);
-    const closeAt = closingParen(text, openAt);
-    if (closeAt < 0) continue;
-    const exprStart = routeRe.lastIndex;
-    const expr = text.slice(exprStart, closeAt);
-    const routes = [...axumRoutes(expr), ...actixRoutes(expr)];
-    for (const route of routes) add(route.method, match[1], route.handler, exprStart + route.index);
-    routeRe.lastIndex = closeAt + 1;
-  }
-
-  // actix `web::resource(path)` associates several method routes with one path.
-  const resourceRe = /(?:actix_web\s*::\s*)?web\s*::\s*resource\s*\(\s*"(\/(?:\\.|[^"\\])*)"\s*\)/g;
-  while ((match = resourceRe.exec(text))) {
-    const tail = text.slice(resourceRe.lastIndex);
-    const nextResource = tail.search(/(?:actix_web\s*::\s*)?web\s*::\s*resource\s*\(/);
-    const semicolon = text.indexOf(";", resourceRe.lastIndex);
-    let end = Math.min(text.length, resourceRe.lastIndex + 4000);
-    if (nextResource >= 0) end = Math.min(end, resourceRe.lastIndex + nextResource);
-    if (semicolon >= 0) end = Math.min(end, semicolon);
-    const chain = text.slice(resourceRe.lastIndex, end);
-    for (const route of actixRoutes(chain)) add(route.method, match[1], route.handler, resourceRe.lastIndex + route.index);
-  }
-
-  // Actix attribute macros. The route macro can declare more than one method for the same handler.
-  const macroRe = new RegExp(`#\\s*\\[\\s*(?:(?:actix_web|actix)\\s*::\\s*)?(${RUST_ROUTE_METHOD})\\s*\\(\\s*"(\\/(?:\\\\.|[^"\\\\])*)"(?:\\s*,[^\\]]*)?\\s*\\)\\s*\\]`, "gi");
-  while ((match = macroRe.exec(text))) {
-    const after = text.slice(macroRe.lastIndex, macroRe.lastIndex + 600);
-    const fn = /\b(?:pub(?:\s*\([^)]*\))?\s+)?(?:async\s+)?fn\s+([A-Za-z_][\w]*)/.exec(after);
-    add(match[1], match[2], fn ? fn[1] : "", match.index);
-  }
-
-  const multiMacroRe = /#\s*\[\s*(?:(?:actix_web|actix)\s*::\s*)?route\s*\(\s*"(\/(?:\\.|[^"\\])*)"([\s\S]*?)\)\s*\]/gi;
-  while ((match = multiMacroRe.exec(text))) {
-    const after = text.slice(multiMacroRe.lastIndex, multiMacroRe.lastIndex + 600);
-    const fn = /\b(?:pub(?:\s*\([^)]*\))?\s+)?(?:async\s+)?fn\s+([A-Za-z_][\w]*)/.exec(after);
-    const methodRe = /\bmethod\s*=\s*"(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS|TRACE|CONNECT)"/gi;
-    let method;
-    while ((method = methodRe.exec(match[2]))) add(method[1], match[1], fn ? fn[1] : "", match.index);
-  }
-}

package/src/analysis/endpoints.js

@@ -1,3 +0,0 @@
-// Stable public facade for server endpoint discovery.
-export { nextRoutePath, extractEndpointsFromText } from "./endpoints/extract.js";
-export { analyzeEndpointInventory, detectEndpoints } from "./endpoints/inventory.js";

package/src/analysis/findings.js

@@ -1,70 +0,0 @@
-// Unified Finding factory + rollups for the internal dependency/security engine (DEPS_SECURITY_PLAN.md §2.3).
-// Every analyzer (unused / structure / vulnerability / malware) and the external-tool adapter emit THIS shape,
-// so the renderer and the AI summarizer consume one contract regardless of engine.
-import { createHash } from "node:crypto";
-
-const SEVERITY_ORDER = ["critical", "high", "medium", "low", "info"];
-
-export function dependencyVerification(manifest, imports, decision, mapping) {
-  return {
-    evidenceModel: "MANIFEST_PLUS_INDEXED_SOURCE",
-    decision,
-    manifestDeclaration: { status: "FOUND", file: manifest },
-    indexedSourceImports: imports.length
-      ? { status: "FOUND", count: imports.length, files: [...new Set(imports.map((item) => item.file))].slice(0, 10) }
-      : { status: "ZERO_FOUND", completeness: "COMPLETE_FOR_GRAPH_SCOPE", count: 0, files: [] },
-    mapping,
-  };
-}
-
-// Stable id: survives re-runs so the UI can persist expand/dismiss state per finding.
-export function makeFinding(f) {
-  const cycleIdentity = Array.isArray(f.cycleMembers)
-    ? [...new Set(f.cycleMembers.map(String))].sort().join("\0")
-    : "";
-  const id = createHash("sha1")
-    .update([
-      f.category, f.rule, f.file || "", f.manifest || "", f.scope || "",
-      f.package || "", f.symbol || "", cycleIdentity, f.title || "",
-    ].join("|"))
-    .digest("hex")
-    .slice(0, 16);
-  return {
-    id,
-    severity: "info",
-    confidence: "medium",
-    title: "",
-    detail: "",
-    reason: "",
-    file: "",
-    line: 0,
-    symbol: "",
-    package: "",
-    version: "",
-    graphNodeId: f.graphNodeId || f.file || "",
-    evidence: [],
-    source: "internal",
-    fixHint: "",
-    ...f,
-  };
-}
-
-export function summarizeFindings(findings) {
-  const bySeverity = { critical: 0, high: 0, medium: 0, low: 0, info: 0 };
-  const byCategory = { unused: 0, structure: 0, vulnerability: 0, malware: 0 };
-  for (const f of findings || []) {
-    if (f.severity in bySeverity) bySeverity[f.severity]++;
-    if (f.category in byCategory) byCategory[f.category]++;
-  }
-  return { bySeverity, byCategory };
-}
-
-export function sortFindings(findings) {
-  const sev = new Map(SEVERITY_ORDER.map((s, i) => [s, i]));
-  return [...(findings || [])].sort(
-    (a, b) =>
-      (sev.get(a.severity) ?? 9) - (sev.get(b.severity) ?? 9) ||
-      String(a.category).localeCompare(String(b.category)) ||
-      String(a.file || a.package || "").localeCompare(String(b.file || b.package || ""))
-  );
-}

package/src/analysis/git-history/analytics.js

@@ -1,177 +0,0 @@
-import {isTestPath} from '../../graph/graph-filter.js'
-import {isStructuralRelation} from '../../graph/relations.js'
-import {
-    boundedHistoryInteger,
-    GIT_HISTORY_DEFAULTS as DEFAULTS,
-    GIT_HISTORY_HARD_CAPS as HARD_CAPS,
-    GIT_HISTORY_V,
-    graphEndpoint,
-    roundHistoryNumber as round,
-    safeHistoryPath,
-} from './options.js'
-
-function graphFilesAndAdjacency(graph = {}) {
-    const byId = new Map(), files = new Set()
-    for (const node of graph.nodes || []) {
-        const file = safeHistoryPath(node?.source_file)
-        if (!file) continue
-        byId.set(String(node.id), file)
-        files.add(file)
-    }
-    const adjacency = new Map([...files].map((file) => [file, new Set()]))
-    for (const link of graph.links || []) {
-        if (isStructuralRelation(link?.relation) || link?.barrelProxy === true) continue
-        const left = byId.get(String(graphEndpoint(link?.source)))
-        const right = byId.get(String(graphEndpoint(link?.target)))
-        if (!left || !right || left === right) continue
-        adjacency.get(left)?.add(right)
-        adjacency.get(right)?.add(left)
-    }
-    return {files, adjacency}
-}
-
-function graphDistanceAtMostTwo(left, right, adjacency) {
-    if (left === right) return 0
-    const neighbors = adjacency.get(left)
-    if (!neighbors) return null
-    if (neighbors.has(right)) return 1
-    for (const middle of neighbors) if (adjacency.get(middle)?.has(right)) return 2
-    return null
-}
-
-function percentile(value, positiveValues) {
-    if (!(value > 0) || !positiveValues.length) return 0
-    let atOrBelow = 0
-    for (const candidate of positiveValues) if (candidate <= value) atOrBelow++
-    return round(atOrBelow / positiveValues.length)
-}
-
-const pairSort = (left, right) => right.count - left.count
-    || right.confidence - left.confidence
-    || right.lift - left.lift
-    || left.left.localeCompare(right.left)
-    || left.right.localeCompare(right.right)
-
-const publicPair = (pair, graphDistance) => ({
-    left: pair.left,
-    right: pair.right,
-    count: pair.count,
-    jaccard: pair.jaccard,
-    lift: pair.lift,
-    confidence: pair.confidence,
-    leftConfidence: pair.leftConfidence,
-    rightConfidence: pair.rightConfidence,
-    graphDistance,
-})
-
-function fileActivity(commits, graph) {
-    const activity = new Map(), fileCommits = new Map()
-    let additions = 0, deletions = 0, binaryChanges = 0
-    for (const commit of commits) {
-        const seen = new Set()
-        for (const stat of commit.files) {
-            if (seen.has(stat.file)) continue
-            seen.add(stat.file)
-            const entry = activity.get(stat.file) || {file: stat.file, commits: 0, additions: 0, deletions: 0, binaryChanges: 0}
-            entry.commits++
-            entry.additions += stat.additions
-            entry.deletions += stat.deletions
-            entry.binaryChanges += stat.binary ? 1 : 0
-            activity.set(stat.file, entry)
-            fileCommits.set(stat.file, (fileCommits.get(stat.file) || 0) + 1)
-            additions += stat.additions
-            deletions += stat.deletions
-            if (stat.binary) binaryChanges++
-        }
-    }
-    const {files: graphFiles, adjacency} = graphFilesAndAdjacency(graph)
-    const raw = [...activity.values()].map((entry) => ({...entry, churn: entry.additions + entry.deletions}))
-    const churnValues = raw.map((entry) => entry.churn).filter((value) => value > 0)
-    const connectivityValues = [...graphFiles].map((file) => adjacency.get(file)?.size || 0).filter((value) => value > 0)
-    const fileChurn = raw.map((entry) => {
-        const connectivity = adjacency.get(entry.file)?.size || 0
-        const churnPercentile = percentile(entry.churn, churnValues)
-        const connectivityPercentile = percentile(connectivity, connectivityValues)
-        return {...entry, connectivity, churnPercentile, connectivityPercentile, hotspotScore: round(Math.sqrt(churnPercentile * connectivityPercentile))}
-    }).sort((a, b) => b.churn - a.churn || b.commits - a.commits || a.file.localeCompare(b.file))
-    const hotspots = fileChurn.filter((entry) => entry.connectivity > 0)
-        .sort((a, b) => b.hotspotScore - a.hotspotScore || b.churn - a.churn || b.connectivity - a.connectivity || a.file.localeCompare(b.file))
-    return {fileCommits, graphFiles, adjacency, fileChurn, hotspots, additions, deletions, binaryChanges}
-}
-
-function coChangePairs(commits, fileCommits, limits) {
-    const counts = new Map()
-    let truncated = false
-    for (const commit of commits) {
-        const files = [...new Set(commit.files.map((entry) => entry.file))].sort()
-        for (let left = 0; left < files.length; left++) for (let right = left + 1; right < files.length; right++) {
-            const key = `${files[left]}\0${files[right]}`
-            if (!counts.has(key) && counts.size >= limits.maxPairCandidates) { truncated = true; continue }
-            counts.set(key, (counts.get(key) || 0) + 1)
-        }
-    }
-    const pairs = []
-    for (const [key, count] of counts) {
-        if (count < limits.minPairCount || !commits.length) continue
-        const split = key.indexOf('\0'), left = key.slice(0, split), right = key.slice(split + 1)
-        const leftCount = fileCommits.get(left) || 0, rightCount = fileCommits.get(right) || 0
-        const leftConfidence = count / leftCount, rightConfidence = count / rightCount
-        pairs.push({
-            left, right, count,
-            jaccard: round(count / (leftCount + rightCount - count)),
-            lift: round((count * commits.length) / (leftCount * rightCount)),
-            confidence: round(Math.max(leftConfidence, rightConfidence)),
-            leftConfidence: round(leftConfidence),
-            rightConfidence: round(rightConfidence),
-        })
-    }
-    return {pairs: pairs.sort(pairSort), totalCandidates: counts.size, truncated}
-}
-
-export function buildGitHistoryAnalytics({commits = [], graph = {}, window, limits = {}, status = 'complete'} = {}) {
-    const maxPairs = boundedHistoryInteger(limits.maxPairs, DEFAULTS.maxPairs, 1, HARD_CAPS.maxPairs)
-    const minPairCount = boundedHistoryInteger(limits.minPairCount, DEFAULTS.minPairCount, 1, 100)
-    const maxPairCandidates = boundedHistoryInteger(limits.maxPairCandidates, DEFAULTS.maxPairCandidates, 100, HARD_CAPS.maxPairCandidates)
-    const eligible = commits.filter((commit) => !commit.oversized && commit.files.length > 0)
-    const skipped = commits.filter((commit) => commit.oversized)
-    const activity = fileActivity(eligible, graph)
-    const cochange = coChangePairs(eligible, activity.fileCommits, {minPairCount, maxPairCandidates})
-    const observed = cochange.pairs.slice(0, maxPairs).map((pair) => publicPair(pair, graphDistanceAtMostTwo(pair.left, pair.right, activity.adjacency)))
-    const expectedTestSource = cochange.pairs.filter((pair) => isTestPath(pair.left) !== isTestPath(pair.right)).slice(0, maxPairs).map((pair) => {
-        const test = isTestPath(pair.left) ? pair.left : pair.right
-        const source = test === pair.left ? pair.right : pair.left
-        return {
-            source, test, count: pair.count, jaccard: pair.jaccard, lift: pair.lift, confidence: pair.confidence,
-            sourceConfidence: source === pair.left ? pair.leftConfidence : pair.rightConfidence,
-            testConfidence: test === pair.left ? pair.leftConfidence : pair.rightConfidence,
-            graphDistance: graphDistanceAtMostTwo(source, test, activity.adjacency),
-        }
-    })
-    const hidden = cochange.pairs.filter((pair) => !isTestPath(pair.left) && !isTestPath(pair.right)
-        && activity.graphFiles.has(pair.left) && activity.graphFiles.has(pair.right)
-        && graphDistanceAtMostTwo(pair.left, pair.right, activity.adjacency) === null)
-        .slice(0, maxPairs).map((pair) => publicPair(pair, null))
-    const reasons = [
-        skipped.length ? `${skipped.length} oversized change-set(s) excluded` : null,
-        cochange.truncated ? 'co-change candidate cap reached' : null,
-        status === 'partial' ? 'git output or commit window was truncated' : null,
-    ].filter(Boolean)
-    return {
-        gitHistoryV: GIT_HISTORY_V,
-        status: reasons.length ? 'partial' : status,
-        window: window || null,
-        limits: {maxCommits: limits.maxCommits ?? null, maxFilesPerCommit: limits.maxFilesPerCommit ?? null, maxPairs, minPairCount, maxPairCandidates},
-        completeness: {complete: reasons.length === 0, reasons},
-        totals: {
-            commitsRead: commits.length, commitsAnalyzed: eligible.length, oversizedCommitsSkipped: skipped.length,
-            files: activity.fileChurn.length, additions: activity.additions, deletions: activity.deletions,
-            churn: activity.additions + activity.deletions, binaryChanges: activity.binaryChanges,
-            ignoredFiles: commits.reduce((sum, commit) => sum + (commit.ignoredFiles || 0), 0),
-            invalidPaths: commits.reduce((sum, commit) => sum + (commit.invalidPaths || 0), 0),
-            graphFiles: activity.graphFiles.size,
-        },
-        fileChurn: activity.fileChurn,
-        hotspots: activity.hotspots,
-        coupling: {eligibleCommits: eligible.length, totalCandidates: cochange.totalCandidates, candidatesTruncated: cochange.truncated, observed, expectedTestSource, hidden},
-    }
-}

package/src/analysis/git-history/collector.js

@@ -1,67 +0,0 @@
-import {isWeavatrixIgnored} from '../../path-ignore.js'
-import {
-    boundedHistoryInteger,
-    GIT_HISTORY_DEFAULTS as DEFAULTS,
-    GIT_HISTORY_HARD_CAPS as HARD_CAPS,
-    safeHistoryPath,
-} from './options.js'
-
-const HEADER_SEPARATOR = '\x1e'
-const FIELD_SEPARATOR = '\x1f'
-
-// git subprocess execution (sync runGit + streaming boundedGitCommand) lives in ../../git-exec.js.
-
-const statNumber = (value) => value === '-'
-    ? {value: 0, binary: true}
-    : {value: Number(value), binary: false}
-
-export function parseGitNumstatLog(raw, options = {}) {
-    const maxFiles = boundedHistoryInteger(options.maxFilesPerCommit, DEFAULTS.maxFilesPerCommit, 2, HARD_CAPS.maxFilesPerCommit)
-    const ignoreRules = options.ignoreRules || []
-    const text = Buffer.isBuffer(raw) ? raw.toString('utf8') : String(raw || '')
-    const segments = text.split(HEADER_SEPARATOR).slice(1)
-    if (options.dropLastIncomplete && segments.length) segments.pop()
-    const commits = []
-    for (const segment of segments) {
-        const firstNul = segment.indexOf('\0')
-        if (firstNul < 0) continue
-        const header = segment.slice(0, firstNul).replace(/^[\r\n]+/, '')
-        const separator = header.indexOf(FIELD_SEPARATOR)
-        if (separator < 0) continue
-        const hash = header.slice(0, separator), timestamp = Number(header.slice(separator + 1))
-        if (!/^[a-f0-9]{40,64}$/i.test(hash) || !Number.isInteger(timestamp) || timestamp < 0) continue
-        const tokens = segment.slice(firstNul + 1).split('\0'), files = new Map()
-        let fileCount = 0, ignoredFiles = 0, invalidPaths = 0, oversized = false
-        for (let index = 0; index < tokens.length; index += 1) {
-            const token = tokens[index].replace(/^[\r\n]+/, '')
-            const match = /^(\d+|-)\t(\d+|-)\t(.*)$/s.exec(token)
-            if (!match) continue
-            let rawPath = match[3], renamedFrom = null
-            if (!rawPath) {
-                renamedFrom = safeHistoryPath(tokens[index + 1])
-                rawPath = tokens[index + 2]
-                index += 2
-            }
-            const path = safeHistoryPath(rawPath)
-            if (!path) { invalidPaths++; continue }
-            if (isWeavatrixIgnored(path, ignoreRules)) { ignoredFiles++; continue }
-            const additions = statNumber(match[1]), deletions = statNumber(match[2])
-            fileCount++
-            if (fileCount > maxFiles) { oversized = true; files.clear(); continue }
-            if (oversized) continue
-            const previous = files.get(path)
-            files.set(path, {
-                file: path,
-                additions: (previous?.additions || 0) + additions.value,
-                deletions: (previous?.deletions || 0) + deletions.value,
-                binary: Boolean(previous?.binary || additions.binary || deletions.binary),
-                ...(renamedFrom ? {renamedFrom} : previous?.renamedFrom ? {renamedFrom: previous.renamedFrom} : {}),
-            })
-        }
-        commits.push({
-            hash, timestamp, fileCount, ignoredFiles, invalidPaths, oversized,
-            files: oversized ? [] : [...files.values()].sort((a, b) => a.file.localeCompare(b.file)),
-        })
-    }
-    return commits
-}

package/src/analysis/git-history/options.js

@@ -1,66 +0,0 @@
-import {isAbsolute} from 'node:path'
-import {boundedInteger} from '../../util.js'
-
-export const GIT_HISTORY_V = 1
-export const GIT_HISTORY_WINDOWS = Object.freeze([3, 6, 12])
-export const GIT_HISTORY_DEFAULTS = Object.freeze({
-    months: 6,
-    maxCommits: 500,
-    maxFilesPerCommit: 80,
-    maxPairs: 100,
-    minPairCount: 2,
-    maxPairCandidates: 100_000,
-    maxOutputBytes: 16 * 1024 * 1024,
-    timeoutMs: 20_000,
-})
-export const GIT_HISTORY_HARD_CAPS = Object.freeze({
-    maxCommits: 2_000,
-    maxFilesPerCommit: 200,
-    maxPairs: 500,
-    maxPairCandidates: 250_000,
-    maxOutputBytes: 64 * 1024 * 1024,
-    timeoutMs: 60_000,
-})
-export const GIT_FORMAT = '%x1e%H%x1f%ct'
-
-export const graphEndpoint = (value) => value && typeof value === 'object' ? value.id : value
-export const roundHistoryNumber = (value, digits = 4) => {
-    if (!Number.isFinite(value)) return 0
-    const scale = 10 ** digits
-    return Math.round(value * scale) / scale
-}
-export const boundedHistoryInteger = boundedInteger
-
-export function safeHistoryPath(value) {
-    const path = String(value || '').replace(/\\/g, '/').replace(/^\.\//, '')
-    if (!path || path.includes('\0') || isAbsolute(path) || /^[a-z]:\//i.test(path)) return null
-    if (/[\x00-\x1f\x7f]/.test(path)) return null
-    const parts = path.split('/')
-    return parts.some((part) => !part || part === '.' || part === '..') ? null : path
-}
-
-export function utcMonthsBefore(date, months) {
-    const source = new Date(date)
-    if (!Number.isFinite(source.getTime())) throw new Error('now must be a valid date')
-    const targetMonth = source.getUTCMonth() - months
-    const first = new Date(Date.UTC(source.getUTCFullYear(), targetMonth, 1, source.getUTCHours(), source.getUTCMinutes(), source.getUTCSeconds(), source.getUTCMilliseconds()))
-    const lastDay = new Date(Date.UTC(first.getUTCFullYear(), first.getUTCMonth() + 1, 0)).getUTCDate()
-    first.setUTCDate(Math.min(source.getUTCDate(), lastDay))
-    return first
-}
-
-export function normalizeGitHistoryOptions(input = {}) {
-    const defaults = GIT_HISTORY_DEFAULTS, caps = GIT_HISTORY_HARD_CAPS
-    const months = Number(input.months ?? defaults.months)
-    if (!GIT_HISTORY_WINDOWS.includes(months)) throw new Error('months must be one of 3, 6 or 12')
-    return {
-        months,
-        maxCommits: boundedHistoryInteger(input.maxCommits, defaults.maxCommits, 1, caps.maxCommits),
-        maxFilesPerCommit: boundedHistoryInteger(input.maxFilesPerCommit, defaults.maxFilesPerCommit, 2, caps.maxFilesPerCommit),
-        maxPairs: boundedHistoryInteger(input.maxPairs, defaults.maxPairs, 1, caps.maxPairs),
-        minPairCount: boundedHistoryInteger(input.minPairCount, defaults.minPairCount, 1, 100),
-        maxPairCandidates: boundedHistoryInteger(input.maxPairCandidates, defaults.maxPairCandidates, 100, caps.maxPairCandidates),
-        maxOutputBytes: boundedHistoryInteger(input.maxOutputBytes, defaults.maxOutputBytes, 64 * 1024, caps.maxOutputBytes),
-        timeoutMs: boundedHistoryInteger(input.timeoutMs, defaults.timeoutMs, 1_000, caps.timeoutMs),
-    }
-}

package/src/analysis/git-history.js

@@ -1,143 +0,0 @@
-// Public facade and bounded local collector for behavioral Git-history intelligence.
-import {childProcessEnv} from '../child-env.js'
-import {createRepoBoundary} from '../repo-path.js'
-import {loadWeavatrixIgnore} from '../path-ignore.js'
-import {buildGitHistoryAnalytics} from './git-history/analytics.js'
-import {parseGitNumstatLog} from './git-history/collector.js'
-import {boundedGitCommand} from '../git-exec.js'
-import {
-    boundedHistoryInteger,
-    GIT_FORMAT,
-    GIT_HISTORY_V,
-    normalizeGitHistoryOptions,
-    utcMonthsBefore,
-} from './git-history/options.js'
-
-export {buildGitHistoryAnalytics} from './git-history/analytics.js'
-export {parseGitNumstatLog} from './git-history/collector.js'
-export {GIT_HISTORY_V, GIT_HISTORY_WINDOWS} from './git-history/options.js'
-
-const unavailableResult = (window, limits, reason) => ({
-    gitHistoryV: GIT_HISTORY_V,
-    status: 'unavailable',
-    window,
-    limits,
-    completeness: {complete: false, reasons: [reason]},
-    totals: {
-        commitsRead: 0, commitsAnalyzed: 0, oversizedCommitsSkipped: 0, files: 0,
-        additions: 0, deletions: 0, churn: 0, binaryChanges: 0, ignoredFiles: 0,
-        invalidPaths: 0, graphFiles: 0,
-    },
-    fileChurn: [],
-    hotspots: [],
-    coupling: {eligibleCommits: 0, totalCandidates: 0, candidatesTruncated: false, observed: [], expectedTestSource: [], hidden: []},
-})
-
-export async function analyzeGitHistory(input = {}) {
-    const options = normalizeGitHistoryOptions(input)
-    const now = new Date(input.now ?? Date.now())
-    if (!Number.isFinite(now.getTime())) throw new Error('now must be a valid date')
-    const since = utcMonthsBefore(now, options.months)
-    const window = {months: options.months, since: since.toISOString(), until: now.toISOString()}
-    const limits = {
-        maxCommits: options.maxCommits,
-        maxFilesPerCommit: options.maxFilesPerCommit,
-        maxPairs: options.maxPairs,
-        minPairCount: options.minPairCount,
-        maxPairCandidates: options.maxPairCandidates,
-    }
-    const boundary = createRepoBoundary(input.repoRoot)
-    if (!boundary.root) return unavailableResult(window, limits, 'repository root is unavailable')
-    const args = [
-        'log', '--no-merges', '--numstat', '-z', `--format=${GIT_FORMAT}`,
-        `--since=${window.since}`, `--until=${window.until}`, `--max-count=${options.maxCommits + 1}`,
-        '--', '.',
-    ]
-    let execution
-    try {
-        execution = await (input.runner || boundedGitCommand)('git', args, {
-            cwd: boundary.root,
-            env: childProcessEnv(),
-            timeoutMs: options.timeoutMs,
-            maxOutputBytes: options.maxOutputBytes,
-        })
-    } catch (error) {
-        return unavailableResult(window, limits, String(error?.message || 'git history collection failed').slice(0, 200))
-    }
-    if (execution.exitCode !== 0 && !execution.truncated) return unavailableResult(window, limits, 'git log failed')
-    const raw = Buffer.isBuffer(execution.stdout) ? execution.stdout : Buffer.from(String(execution.stdout || ''))
-    const tooLarge = raw.length > options.maxOutputBytes
-    const truncated = Boolean(execution.truncated || tooLarge)
-    const bounded = tooLarge ? raw.subarray(0, options.maxOutputBytes) : raw
-    const parsed = parseGitNumstatLog(bounded, {
-        maxFilesPerCommit: options.maxFilesPerCommit,
-        ignoreRules: loadWeavatrixIgnore(boundary.root),
-        dropLastIncomplete: truncated,
-    })
-    const commitsTruncated = parsed.length > options.maxCommits
-    return buildGitHistoryAnalytics({
-        commits: parsed.slice(0, options.maxCommits),
-        graph: input.graph || {},
-        window,
-        limits,
-        status: truncated || commitsTruncated ? 'partial' : 'complete',
-    })
-}
-
-export function formatGitHistoryAnalytics(result, options = {}) {
-    const topN = boundedHistoryInteger(options.topN, 10, 1, 50)
-    if (!result || result.status === 'unavailable') {
-        return `Git history intelligence: UNAVAILABLE — ${result?.completeness?.reasons?.[0] || 'history is unavailable'}`
-    }
-    const window = result.window
-        ? `${result.window.months} months (${result.window.since.slice(0, 10)} → ${result.window.until.slice(0, 10)})`
-        : 'configured window'
-    const lines = [
-        `Git history intelligence — ${window}`,
-        `Status: ${String(result.status).toUpperCase()} · ${result.totals.commitsAnalyzed}/${result.totals.commitsRead} commits analyzed · ${result.totals.files} files · ${result.totals.churn} changed lines`,
-        '',
-        'Hotspots (churn percentile × graph-connectivity percentile):',
-    ]
-    const hotspots = result.hotspots.slice(0, topN)
-    if (!hotspots.length) lines.push('- none')
-    for (const item of hotspots) lines.push(`- ${item.file}: score ${item.hotspotScore.toFixed(4)} · churn ${item.churn} in ${item.commits} commits · connectivity ${item.connectivity}`)
-    lines.push('', 'Hidden co-change coupling (no graph path within 2 hops):')
-    const hidden = result.coupling.hidden.slice(0, topN)
-    if (!hidden.length) lines.push('- none')
-    for (const pair of hidden) lines.push(`- ${pair.left} ↔ ${pair.right}: ${pair.count} commits · Jaccard ${pair.jaccard.toFixed(4)} · lift ${pair.lift.toFixed(4)} · confidence ${pair.confidence.toFixed(4)}`)
-    lines.push('', 'Expected test/source co-change:')
-    const expected = result.coupling.expectedTestSource.slice(0, topN)
-    if (!expected.length) lines.push('- none')
-    for (const pair of expected) lines.push(`- ${pair.test} ↔ ${pair.source}: ${pair.count} commits · confidence ${pair.confidence.toFixed(4)}`)
-    if (result.completeness.reasons.length) lines.push('', `Partial: ${result.completeness.reasons.join('; ')}.`)
-    return lines.join('\n')
-}
-
-export function boundGitHistoryAnalytics(result, options = {}) {
-    const topN = boundedHistoryInteger(options.topN, 10, 1, 50)
-    const source = result && typeof result === 'object' ? result : {}
-    const coupling = source.coupling && typeof source.coupling === 'object' ? source.coupling : {}
-    const collections = {}
-    const cap = (name, value) => {
-        const items = Array.isArray(value) ? value : []
-        const bounded = items.slice(0, topN)
-        collections[name] = {total: items.length, returned: bounded.length, truncated: items.length > bounded.length}
-        return bounded
-    }
-    const bounded = {
-        ...source,
-        limits: {...(source.limits || {}), topN},
-        fileChurn: cap('fileChurn', source.fileChurn),
-        hotspots: cap('hotspots', source.hotspots),
-        coupling: {
-            ...coupling,
-            observed: cap('coupling.observed', coupling.observed),
-            expectedTestSource: cap('coupling.expectedTestSource', coupling.expectedTestSource),
-            hidden: cap('coupling.hidden', coupling.hidden),
-        },
-    }
-    return {
-        result: bounded,
-        page: {limit: topN, truncated: Object.values(collections).some((entry) => entry.truncated), collections},
-    }
-}