weavatrix 0.3.14 → 1.1.0

package/src/analysis/internal-audit.run.js

@@ -1,256 +0,0 @@
-import { existsSync } from "node:fs";
-import { basename, join } from "node:path";
-import { computeDead, computeUnusedExports } from "./dead-check.js";
-import { computePyDepFindings, computeScopedDepFindings } from "./dep-check.js";
-import { computeStructureFindings } from "./dep-rules.js";
-import { makeFinding, sortFindings, summarizeFindings } from "./findings.js";
-import { graphOutDirForRepo } from "../graph/layout.js";
-import {
-  TEST_FILE_RE,
-  collectConfigTexts,
-  collectNonRuntimeRoots,
-  collectPackageScopes,
-  collectPyManifest,
-  collectSourceTexts,
-  listRepoFiles,
-  readJson,
-  readRepoJson,
-  workspacePkgNames,
-} from "./internal-audit.collect.js";
-import { computeReachability, entryFiles } from "./internal-audit.reach.js";
-import { PATH_CLASS_NAMES, createPathClassifier, hasPathClass } from "../path-classification.js";
-import { createRepoBoundary } from "../repo-path.js";
-import { analyzeSourceCorrectness } from "./source-correctness.js";
-import { collectJvmDependencyEvidence } from "./jvm-dependency-evidence.js";
-import { buildDependencyHealth } from "./internal-audit/dependency-health.js";
-import { runSupplyChainChecks } from "./internal-audit/supply-chain.js";
-import { collectGoDependencyEvidence } from "./go-dependency-evidence.js";
-import { collectCargoDependencyEvidence } from "./cargo-dependency-evidence.js";
-
-export async function runInternalAudit(repoPath, {
-  graph,
-  advisoryStorePath,
-  skipMalwareScan = false,
-  malwareExclusions = {},
-  rgPath = "",
-} = {}) {
-  if (!existsSync(repoPath)) return { ok: false, error: "Repo path not found" };
-  const boundary = createRepoBoundary(repoPath);
-  if (!boundary.root) return { ok: false, error: "Repository path is unreadable" };
-  if (!graph) {
-    graph = readJson(join(graphOutDirForRepo(repoPath), "graph.json"));
-    if (!graph) return { ok: false, error: "Build the graph first (no graph.json)" };
-  }
-  const pkg = readRepoJson(boundary, "package.json") || {};
-  const packageScopes = collectPackageScopes(repoPath, pkg);
-  const externalImports = graph.externalImports || [];
-  const dynamicTargets = new Set(externalImports.filter((entry) => entry.dynamic && entry.target).map((entry) => entry.target));
-  const rules = readRepoJson(boundary, ".weavatrix-deps.json") || {};
-  const repoFiles = listRepoFiles(repoPath);
-  const sources = collectSourceTexts(repoPath, graph);
-  const nonRuntimeRoots = collectNonRuntimeRoots(repoPath, rules);
-
-  const pathClassifier = createPathClassifier(repoPath);
-  const pathClassifications = new Map();
-  const classifyPath = (file) => {
-    const normalized = String(file || "").replace(/\\/g, "/");
-    if (!pathClassifications.has(normalized)) {
-      pathClassifications.set(normalized, pathClassifier.explain(normalized, { content: sources.get(normalized) }));
-    }
-    return pathClassifications.get(normalized);
-  };
-  const isNonProductPath = (file) => {
-    const info = classifyPath(file);
-    return info.excluded || hasPathClass(info, "test", "e2e", "generated", "vendored", "mock", "story", "docs", "benchmark", "temp");
-  };
-
-  const conventionEvidence = [];
-  const entries = entryFiles(graph, packageScopes, dynamicTargets, {
-    declaredEntries: rules.entrypoints || rules.entries || [],
-    sources,
-    conventionEvidence,
-  });
-  for (const file of sources.keys()) {
-    if (nonRuntimeRoots.some((root) => file === root || file.startsWith(`${root}/`))) entries.add(file);
-    if (isNonProductPath(file)) entries.add(file);
-  }
-  const dead = computeDead(graph, sources, { entrySet: entries });
-  const unusedExports = computeUnusedExports(graph, sources, { dynamicTargets, entrySet: entries });
-  const reachable = computeReachability(graph, entries);
-  const configTexts = collectConfigTexts(repoPath);
-  const npmDependencyImports = externalImports.filter((entry) => entry.ecosystem
-    ? entry.ecosystem === "npm"
-    : !/\.(?:java|go|py)$/i.test(entry.file || ""));
-  const dep = computeScopedDepFindings({
-    externalImports: npmDependencyImports,
-    packageScopes,
-    workspacePkgNames: workspacePkgNames(repoPath, pkg),
-    configTexts,
-    sourceTexts: sources,
-    nonRuntimeRoots,
-    sourceFiles: [...sources.keys()],
-  });
-  const goDep = collectGoDependencyEvidence(repoPath, { files: repoFiles, externalImports, nonRuntimeRoots });
-  const asList = (value) => Array.isArray(value) ? value : typeof value === "string" ? [value] : [];
-  const pyRules = rules.python || {}, depRules = rules.dependencies || {};
-  const managedPython = [...new Set([
-    ...asList(rules.managedPythonDependencies), ...asList(pyRules.managed), ...asList(pyRules.managedDependencies), ...asList(depRules.managedPython),
-  ])];
-  const ignoredPython = [...new Set([
-    ...asList(rules.ignorePythonDependencies), ...asList(pyRules.ignore), ...asList(pyRules.ignoreDependencies), ...asList(depRules.ignorePython),
-  ])];
-  const pyManifest = collectPyManifest(repoPath);
-  const pyDep = computePyDepFindings({
-    externalImports,
-    pyManifest,
-    configTexts,
-    managedDependencies: managedPython,
-    ignoredDependencies: ignoredPython,
-    nonRuntimeRoots,
-  });
-  const jvmDependencies = collectJvmDependencyEvidence(repoPath, { files: repoFiles, externalImports });
-  const cargoDep = collectCargoDependencyEvidence(repoPath, { files: repoFiles, externalImports });
-
-  const externalImportFiles = new Set(externalImports.filter((entry) => entry.pkg && !entry.builtin).map((entry) => entry.file));
-  const structure = computeStructureFindings(graph, { rules, entrySet: entries, externalImportFiles });
-  const correctness = analyzeSourceCorrectness(sources, { isNonProductPath });
-  const findings = [
-    ...dep.findings, ...goDep.findings, ...pyDep.findings,
-    ...jvmDependencies.maven.findings, ...jvmDependencies.gradle.findings, ...cargoDep.findings,
-    ...correctness.findings,
-  ];
-  const deadFileSet = new Set(dead.deadFiles.map((finding) => finding.file));
-  for (const finding of structure.findings) {
-    if (!(finding.rule === "orphan-file" && (deadFileSet.has(finding.file) || entries.has(finding.file)))) findings.push(finding);
-  }
-
-  const actionableDeadFiles = dead.deadFiles.filter((finding) => !isNonProductPath(finding.file));
-  for (const finding of actionableDeadFiles) {
-    if (entries.has(finding.file) || dynamicTargets.has(finding.file) || TEST_FILE_RE.test(finding.file)) continue;
-    findings.push(makeFinding({
-      category: "unused",
-      rule: "unused-file",
-      severity: "low",
-      confidence: reachable.has(finding.file) ? "medium" : "high",
-      title: `Unused file: ${finding.file}`,
-      detail: `${finding.reason}${reachable.has(finding.file) ? "" : "; also unreachable from every entry point"}. Dynamic loading and framework conventions can't be fully ruled out — review before deleting.`,
-      file: finding.file,
-      graphNodeId: finding.file,
-      source: "internal",
-      fixHint: "review, then delete the file",
-    }));
-  }
-  let unusedExportCount = 0;
-  for (const symbol of unusedExports) {
-    if (symbol.test || isNonProductPath(symbol.file) || entries.has(symbol.file) || dynamicTargets.has(symbol.file)) continue;
-    if (/(^|\/)[^/]*\.config\.[a-z0-9]+$|(^|\/)\.[^/]+rc(\.[a-z]+)?$/i.test(symbol.file)) continue;
-    findings.push(makeFinding({
-      category: "unused",
-      rule: "unused-export",
-      severity: "info",
-      confidence: "low",
-      title: `Unused export: ${symbol.label.replace(/\(\)$/, "")} — ${symbol.file}`,
-      detail: `${symbol.reason}. This is unused module-surface evidence, not proof that the implementation is dead: downstream packages and runtime registration can be invisible to the repository graph. Review external consumers first; remove only the export keyword when the symbol is still used internally, and delete the implementation only after separate dead-code verification.`,
-      file: symbol.file,
-      symbol: symbol.label,
-      graphNodeId: symbol.id,
-      source: "internal",
-      classification: "unused-export-surface",
-      deadCodeCandidate: false,
-      fixHint: "check downstream/runtime consumers, then remove only the export surface or run a separate exact dead-code review before deleting the implementation",
-    }));
-    unusedExportCount++;
-  }
-  for (const symbol of dead.testOnlySymbols || []) {
-    if (isNonProductPath(symbol.file) || entries.has(symbol.file) || dynamicTargets.has(symbol.file)) continue;
-    findings.push(makeFinding({
-      category: "unused",
-      rule: "test-only-symbol",
-      severity: "low",
-      confidence: symbol.publicApi ? "low" : "medium",
-      title: `Production symbol used only by tests: ${symbol.label}`,
-      detail: `${symbol.reason}. Static analysis cannot rule out external or reflective consumers, so review before removal.`,
-      file: symbol.file,
-      graphNodeId: symbol.id,
-      source: "internal",
-      fixHint: "verify production/config consumers, then keep as intentional test support or remove it together with obsolete tests",
-    }));
-  }
-
-  const supplyChain = await runSupplyChainChecks(repoPath, {
-    externalImports,
-    packageScopes,
-    isNonProductPath,
-    advisoryStorePath,
-    skipMalwareScan,
-    malwareExclusions,
-    rgPath,
-  });
-  findings.push(...supplyChain.findings);
-  const sorted = sortFindings(findings);
-  const dependencyHealth = buildDependencyHealth({
-    repoPath,
-    graph,
-    repoFiles,
-    pyManifest,
-    dep,
-    goDep,
-    pyDep,
-    jvmDependencies,
-    cargoDep,
-    externalImports,
-    findings: sorted,
-    packageScopes,
-    sourceFiles: [...sources.keys()],
-    correctnessCoverage: correctness.coverage,
-    checks: supplyChain.checks,
-  });
-
-  return {
-    ok: true,
-    engine: "internal",
-    repo: basename(repoPath),
-    path: repoPath,
-    savedAt: new Date().toISOString(),
-    scanned: {
-      files: dead.stats.files,
-      symbols: dead.stats.symbols,
-      manifestDeps: dependencyHealth.manifestDeps,
-      externalImports: externalImports.length,
-      nodeModulesPresent: boundary.resolve("node_modules").ok,
-      installedPackages: supplyChain.installedCount,
-      advisoryDbDate: supplyChain.advisoryDbDate,
-      advisoryStatus: supplyChain.checks.osv.status,
-      malwareScanMode: supplyChain.malwareScan?.scanMode || "skipped",
-      malwareStatus: supplyChain.checks.malware.status,
-      packageScopes: packageScopes.length,
-      managedPythonDependencies: managedPython.length,
-      nonRuntimeRoots,
-      pathClassifications: Object.fromEntries(PATH_CLASS_NAMES.map((name) => [
-        name,
-        [...pathClassifications.values()].filter((info) => info.classes.includes(name)).length,
-      ])),
-      pathClassificationExcluded: [...pathClassifications.values()].filter((info) => info.excluded).length,
-      conventionEntrypoints: conventionEvidence.length,
-    },
-    summary: summarizeFindings(sorted),
-    findings: sorted,
-    dependencyReport: dependencyHealth.dependencyReport,
-    deadReport: {
-      deadSymbols: dead.deadSymbols.filter((symbol) => !isNonProductPath(symbol.file)).length,
-      deadFiles: actionableDeadFiles.length,
-      unusedExports: unusedExportCount,
-      testOnlySymbols: (dead.testOnlySymbols || []).filter((symbol) => !isNonProductPath(symbol.file)).length,
-    },
-    conventionReachability: {
-      count: conventionEvidence.length,
-      entries: conventionEvidence.slice(0, 100),
-      truncated: conventionEvidence.length > 100,
-    },
-    structureReport: structure.stats,
-    sourceCorrectnessReport: correctness.coverage,
-    healthCapabilities: dependencyHealth.healthCapabilities,
-    checks: supplyChain.checks,
-    malwareScan: supplyChain.malwareScan,
-  };
-}

package/src/analysis/java-source.js

@@ -1,36 +0,0 @@
-// Replace Java comments and string/char literal contents with spaces while preserving length and
-// newlines. Regex-based signal extractors can then trust match positions without accepting examples
-// from comments, docs, or string constants as executable annotations.
-export function maskJavaNonCode(source) {
-  const text = String(source || "");
-  const chars = [...text];
-  let state = "code";
-  let escaped = false;
-  for (let i = 0; i < text.length; i++) {
-    const ch = text[i];
-    const next = text[i + 1];
-    if (state === "code") {
-      if (ch === "/" && next === "/") { chars[i] = chars[i + 1] = " "; i++; state = "line"; }
-      else if (ch === "/" && next === "*") { chars[i] = chars[i + 1] = " "; i++; state = "block"; }
-      else if (ch === '"') { chars[i] = " "; state = "string"; escaped = false; }
-      else if (ch === "'") { chars[i] = " "; state = "char"; escaped = false; }
-      continue;
-    }
-    if (state === "line") {
-      if (ch === "\n" || ch === "\r") state = "code";
-      else chars[i] = " ";
-      continue;
-    }
-    if (state === "block") {
-      if (ch === "*" && next === "/") { chars[i] = chars[i + 1] = " "; i++; state = "code"; }
-      else if (ch !== "\n" && ch !== "\r") chars[i] = " ";
-      continue;
-    }
-    if (ch === "\n" || ch === "\r") { escaped = false; continue; }
-    chars[i] = " ";
-    if (escaped) escaped = false;
-    else if (ch === "\\") escaped = true;
-    else if ((state === "string" && ch === '"') || (state === "char" && ch === "'")) state = "code";
-  }
-  return chars.join("");
-}

package/src/analysis/jvm-artifact-index.js

@@ -1,87 +0,0 @@
-import { existsSync, readFileSync, readdirSync } from "node:fs";
-import { homedir } from "node:os";
-import { join } from "node:path";
-
-const concreteVersion = (value) => !!value && !/[\[\](),${}*+]/.test(String(value));
-const safeEntries = (path) => { try { return readdirSync(path, { withFileTypes: true }); } catch { return []; } };
-
-function findEndOfCentralDirectory(buffer) {
-  const minimum = Math.max(0, buffer.length - 65_557);
-  for (let offset = buffer.length - 22; offset >= minimum; offset--) {
-    if (buffer.readUInt32LE(offset) === 0x06054b50) return offset;
-  }
-  return -1;
-}
-
-// JARs are ZIP files. Reading only the central directory avoids extraction and code execution.
-export function readJarClassNames(path, { maxClasses = 250_000 } = {}) {
-  const buffer = readFileSync(path);
-  const end = findEndOfCentralDirectory(buffer);
-  if (end < 0) throw new Error("ZIP central directory is missing");
-  const entries = buffer.readUInt16LE(end + 10);
-  let offset = buffer.readUInt32LE(end + 16);
-  const classes = new Set(), packages = new Set();
-  let truncated = false;
-  for (let index = 0; index < entries && offset + 46 <= buffer.length; index++) {
-    if (buffer.readUInt32LE(offset) !== 0x02014b50) throw new Error("invalid ZIP central directory entry");
-    const nameLength = buffer.readUInt16LE(offset + 28);
-    const extraLength = buffer.readUInt16LE(offset + 30);
-    const commentLength = buffer.readUInt16LE(offset + 32);
-    let name = buffer.subarray(offset + 46, offset + 46 + nameLength).toString("utf8");
-    offset += 46 + nameLength + extraLength + commentLength;
-    name = name.replace(/^META-INF\/versions\/\d+\//, "");
-    if (!name.endsWith(".class") || /(?:^|\/)(?:module-info|package-info)\.class$/.test(name)) continue;
-    const identity = name.slice(0, -6).replace(/\$/g, ".").replace(/\//g, ".");
-    classes.add(identity);
-    packages.add(identity.includes(".") ? identity.slice(0, identity.lastIndexOf(".")) : "");
-    if (classes.size >= maxClasses) { truncated = true; break; }
-  }
-  return { classes, packages, truncated };
-}
-
-function artifactCandidates(dependency, home) {
-  if (!dependency.group || !dependency.artifact || !concreteVersion(dependency.version)) return [];
-  const file = `${dependency.artifact}-${dependency.version}.jar`;
-  const maven = join(home, ".m2", "repository", ...dependency.group.split("."), dependency.artifact, dependency.version, file);
-  const gradleRoot = join(home, ".gradle", "caches", "modules-2", "files-2.1", dependency.group, dependency.artifact, dependency.version);
-  const gradle = safeEntries(gradleRoot).filter((entry) => entry.isDirectory()).flatMap((entry) =>
-    safeEntries(join(gradleRoot, entry.name)).filter((child) => child.isFile() && child.name.endsWith(".jar"))
-      .map((child) => join(gradleRoot, entry.name, child.name)));
-  return [maven, ...gradle].filter((candidate, index, all) => existsSync(candidate) && all.indexOf(candidate) === index);
-}
-
-const addOwner = (map, key, owner) => {
-  const owners = map.get(key) || new Set();
-  owners.add(owner); map.set(key, owners);
-};
-
-// Exact import -> artifact evidence from already-installed Maven/Gradle JARs. This is offline and
-// read-only: no build tool, plugin, class loader or repository code is executed.
-export function collectJvmArtifactIndex(dependencies, { home = homedir(), maxArtifacts = 256, maxClasses = 500_000 } = {}) {
-  const unique = [...new Map(dependencies.map((dependency) => [dependency.name, dependency])).values()];
-  const classes = new Map(), packages = new Map(), errors = [];
-  let artifactsIndexed = 0, artifactsMissing = 0, classCount = 0, truncated = false;
-  for (const dependency of unique) {
-    if (artifactsIndexed >= maxArtifacts || classCount >= maxClasses) { truncated = true; break; }
-    const candidates = artifactCandidates(dependency, home);
-    if (!candidates.length) { artifactsMissing++; continue; }
-    try {
-      const remaining = Math.max(1, maxClasses - classCount);
-      const content = readJarClassNames(candidates[0], { maxClasses: remaining });
-      for (const identity of content.classes) addOwner(classes, identity, dependency.name);
-      for (const identity of content.packages) addOwner(packages, identity, dependency.name);
-      classCount += content.classes.size; artifactsIndexed++; truncated ||= content.truncated;
-    } catch (error) {
-      errors.push(`${dependency.name}: ${error instanceof Error ? error.message : String(error)}`);
-    }
-  }
-  const resolve = (spec) => {
-    const imported = String(spec || "").replace(/\.\*$/, "");
-    const owners = String(spec || "").endsWith(".*") ? packages.get(imported) : classes.get(imported);
-    return [...(owners || [])].sort();
-  };
-  return {
-    resolve, artifactsRequired: unique.length, artifactsIndexed, artifactsMissing,
-    classCount, errors, truncated,
-  };
-}

package/src/analysis/jvm-dependency-evidence.js

@@ -1,138 +0,0 @@
-import { createRepoBoundary } from "../repo-path.js";
-import { dependencyVerification, makeFinding } from "./findings.js";
-import { parseGradleDependencies, parseGradleVersionCatalog, parseMavenPom } from "./jvm-manifests.js";
-import { collectJvmArtifactIndex } from "./jvm-artifact-index.js";
-import { listRepoFiles, readRepoText } from "./internal-audit.collect.js";
-
-const normalize = (value) => String(value || "").toLowerCase().replace(/[^a-z0-9]+/g, "");
-const javaBuiltin = (name) => /^(?:java|jdk|sun)\.|^(?:org\.w3c\.dom|org\.xml\.sax)(?:\.|$)/.test(name);
-
-function mappingScore(spec, dependency) {
-  const imported = String(spec || "").replace(/\.\*$/, "");
-  if (!imported || !dependency.group) return 0;
-  if (imported === dependency.group || imported.startsWith(`${dependency.group}.`)) return 1_000 + dependency.group.length;
-  const compactImport = normalize(imported), compactArtifact = normalize(dependency.artifact);
-  if (compactArtifact.length >= 4 && compactImport.includes(compactArtifact)) return 500 + compactArtifact.length;
-  const artifactTokens = String(dependency.artifact).toLowerCase().split(/[-_.]+/).filter((part) => part.length >= 4 && !["core", "java", "client", "common", "api"].includes(part));
-  const hits = artifactTokens.filter((part) => imported.toLowerCase().split(".").some((segment) => normalize(segment) === normalize(part))).length;
-  return hits ? 100 + hits : 0;
-}
-
-function bestDependency(spec, dependencies) {
-  const ranked = dependencies.map((dependency) => ({ dependency, score: mappingScore(spec, dependency) }))
-    .filter((item) => item.score > 0).sort((left, right) => right.score - left.score || left.dependency.name.localeCompare(right.dependency.name));
-  if (!ranked.length || (ranked[1] && ranked[1].score === ranked[0].score)) return null;
-  return ranked[0].dependency;
-}
-
-function analyze(ecosystem, manifests, dependencies, imports, unresolvedDeclarations, mappingDependencies = dependencies, includeMissing = true, artifactEvidence) {
-  const findings = [], used = new Map(), missing = new Map();
-  const owned = new Set(dependencies.map((dependency) => dependency.name));
-  let exactMappedImports = 0, heuristicMappedImports = 0, ambiguousImports = 0;
-  for (const item of imports) {
-    const exactOwners = artifactEvidence.resolve(item.spec || item.pkg);
-    if (exactOwners.length > 1) ambiguousImports++;
-    const dependency = exactOwners.length === 1
-      ? mappingDependencies.find((candidate) => candidate.name === exactOwners[0])
-      : bestDependency(item.spec || item.pkg, mappingDependencies);
-    if (dependency) {
-      if (exactOwners.length === 1) exactMappedImports++; else heuristicMappedImports++;
-      if (owned.has(dependency.name)) {
-        const list = used.get(dependency.name) || [];
-        list.push(item); used.set(dependency.name, list);
-      }
-    } else {
-      const key = item.spec || item.pkg;
-      const list = missing.get(key) || [];
-      list.push(item); missing.set(key, list);
-    }
-  }
-  const runtimeOnly = /runtime|provided|classpath|annotationProcessor|kapt/i;
-  for (const dependency of dependencies) {
-    const evidence = used.get(dependency.name) || [];
-    if (evidence.length || dependency.optional || runtimeOnly.test(dependency.scope || "")) continue;
-    findings.push(makeFinding({
-      category: "unused", rule: "unused-dep", severity: "low", confidence: "low",
-      title: `Unused ${ecosystem} dependency: ${dependency.name}`,
-      reason: "No indexed Java import mapped to this declared artifact; reflection, service loading, generated code and runtime-only use remain possible.",
-      detail: `"${dependency.name}" is declared in ${dependency.file}, but no indexed Java import maps to it. Review framework, reflection, ServiceLoader and generated-source use before removal.`,
-      package: dependency.name, version: dependency.version, manifest: dependency.file, source: "internal",
-      verification: dependencyVerification(dependency.file, [], "REVIEW_REQUIRED", "group-prefix/artifact-token"),
-      fixHint: `remove ${dependency.name} only after the ${ecosystem} build and tests confirm it is unused`,
-    }));
-  }
-  for (const [spec, evidence] of includeMissing ? missing : []) {
-    if (javaBuiltin(spec)) continue;
-    findings.push(makeFinding({
-      category: "unused", rule: "missing-dep", severity: "medium", confidence: "medium",
-      title: `Unmapped Java import: ${spec}`,
-      reason: `The indexed Java import did not map to any declared ${ecosystem} artifact.`,
-      detail: `"${spec}" is imported by ${evidence.length} file(s), but no ${ecosystem} declaration has a matching group prefix or artifact token. Add the owning artifact or configure/build the source that supplies it.`,
-      package: spec, file: evidence[0].file, line: evidence[0].line || 0,
-      evidence: evidence.slice(0, 5).map((item) => ({ file: item.file, line: item.line || 0, snippet: item.spec || "" })),
-      source: "internal",
-      verification: { evidenceModel: "MANIFEST_PLUS_INDEXED_SOURCE", decision: "ACTION_REQUIRED", manifestDeclaration: { status: "NOT_FOUND", files: manifests }, indexedSourceImports: { status: "FOUND", count: evidence.length, files: evidence.map((item) => item.file).slice(0, 10) }, mapping: "group-prefix/artifact-token" },
-      fixHint: `identify the artifact that owns ${spec} and declare it in the nearest ${ecosystem} manifest`,
-    }));
-  }
-  const present = manifests.length > 0;
-  const exactComplete = present && unresolvedDeclarations === 0 && !artifactEvidence.truncated
-    && artifactEvidence.errors.length === 0 && artifactEvidence.artifactsMissing === 0
-    && artifactEvidence.artifactsIndexed === artifactEvidence.artifactsRequired
-    && exactMappedImports === imports.length && ambiguousImports === 0;
-  return {
-    present,
-    status: present ? "CHECKED" : "NOT_PRESENT",
-    completeness: present ? (exactComplete ? "COMPLETE" : "PARTIAL") : "NOT_APPLICABLE",
-    manifests,
-    declared: dependencies.length,
-    mappedImports: [...used.values()].reduce((sum, list) => sum + list.length, 0),
-    unmappedImports: [...missing.values()].reduce((sum, list) => sum + list.length, 0),
-    unresolvedDeclarations,
-    exactArtifactEvidence: {
-      artifactsRequired: artifactEvidence.artifactsRequired,
-      artifactsIndexed: artifactEvidence.artifactsIndexed,
-      artifactsMissing: artifactEvidence.artifactsMissing,
-      classesIndexed: artifactEvidence.classCount,
-      exactMappedImports,
-      heuristicMappedImports,
-      ambiguousImports,
-      truncated: artifactEvidence.truncated,
-      errors: artifactEvidence.errors.slice(0, 10),
-    },
-    sample: dependencies.slice(0, 20).map(({ file, name, version }) => ({ file, identity: name, version })),
-    reason: !present
-      ? `No ${ecosystem === "maven" ? "pom.xml" : "Gradle build file"} was discovered.`
-      : exactComplete
-        ? `${dependencies.length} declarations were compared with every indexed non-JDK Java import using exact class ownership from ${artifactEvidence.artifactsIndexed} installed JAR(s).`
-        : `${dependencies.length} declarations and every indexed non-JDK Java import were checked, but exact artifact evidence is partial: ${unresolvedDeclarations} unresolved declaration(s), ${artifactEvidence.artifactsMissing} installed JAR(s) missing, ${heuristicMappedImports} heuristic mapping(s), ${ambiguousImports} ambiguous mapping(s). Heuristic missing/unused findings remain review evidence, never compiler proof.`,
-    findings,
-  };
-}
-
-export function collectJvmDependencyEvidence(repoRoot, { files = listRepoFiles(repoRoot), externalImports = [] } = {}) {
-  const boundary = createRepoBoundary(repoRoot);
-  const mavenFiles = files.filter((file) => /(^|\/)pom\.xml$/i.test(file));
-  const gradleFiles = files.filter((file) => /(^|\/)(?:build|settings|[^/]+)\.gradle(?:\.kts)?$/i.test(file));
-  const catalogFiles = files.filter((file) => /(^|\/)libs\.versions\.toml$/i.test(file));
-  const catalog = new Map();
-  for (const file of catalogFiles) for (const [alias, entry] of parseGradleVersionCatalog(readRepoText(boundary, file))) catalog.set(alias, entry);
-  let mavenUnresolved = 0, gradleUnresolved = 0;
-  const mavenDependencies = mavenFiles.flatMap((file) => {
-    const parsed = parseMavenPom(readRepoText(boundary, file));
-    mavenUnresolved += parsed.unresolvedDeclarations;
-    return parsed.dependencies.map((dependency) => ({ ...dependency, file }));
-  });
-  const gradleDependencies = gradleFiles.flatMap((file) => {
-    const parsed = parseGradleDependencies(readRepoText(boundary, file), catalog);
-    gradleUnresolved += parsed.unresolvedDeclarations || 0;
-    return parsed.map((dependency) => ({ ...dependency, file }));
-  });
-  const javaImports = externalImports.filter((entry) => entry.ecosystem === "Maven" && entry.pkg && !entry.builtin && !entry.unresolved);
-  const allDependencies = [...mavenDependencies, ...gradleDependencies];
-  const artifactEvidence = collectJvmArtifactIndex(allDependencies);
-  return {
-    maven: analyze("maven", mavenFiles, mavenDependencies, javaImports, mavenUnresolved, allDependencies, true, artifactEvidence),
-    gradle: analyze("gradle", [...gradleFiles, ...catalogFiles], gradleDependencies, javaImports, gradleUnresolved, allDependencies, mavenFiles.length === 0, artifactEvidence),
-  };
-}

package/src/analysis/jvm-manifests.js

@@ -1,114 +0,0 @@
-const stripComments = (value) => String(value || "").replace(/<!--[\s\S]*?-->/g, " ");
-const clean = (value) => String(value || "").trim().replace(/^['"]|['"]$/g, "");
-
-function xmlValue(body, name) {
-  return new RegExp(`<${name}>\\s*([^<]+?)\\s*</${name}>`, "i").exec(body)?.[1]?.trim() || "";
-}
-
-function resolveMavenValue(value, properties) {
-  let output = String(value || "");
-  for (let pass = 0; pass < 8; pass++) {
-    let changed = false;
-    output = output.replace(/\$\{([^}]+)}/g, (whole, key) => {
-      if (!properties.has(key)) return whole;
-      changed = true;
-      return properties.get(key);
-    });
-    if (!changed) break;
-  }
-  return /\$\{/.test(output) ? "" : output.trim();
-}
-
-export function parseMavenPom(text) {
-  const source = stripComments(text);
-  const properties = new Map();
-  const propertyBlock = /<properties\b[^>]*>([\s\S]*?)<\/properties>/i.exec(source)?.[1] || "";
-  for (const match of propertyBlock.matchAll(/<([A-Za-z0-9_.-]+)>\s*([^<]+?)\s*<\/\1>/g)) properties.set(match[1], match[2].trim());
-  const parent = /<parent\b[^>]*>([\s\S]*?)<\/parent>/i.exec(source)?.[1] || "";
-  const beforeDependencies = source.split(/<dependencies\b/i)[0];
-  const projectVersion = xmlValue(beforeDependencies, "version") || xmlValue(parent, "version");
-  const projectGroup = xmlValue(beforeDependencies, "groupId") || xmlValue(parent, "groupId");
-  properties.set("project.version", projectVersion); properties.set("pom.version", projectVersion);
-  properties.set("project.groupId", projectGroup); properties.set("pom.groupId", projectGroup);
-  const managed = new Map();
-  for (const block of source.matchAll(/<dependencyManagement\b[^>]*>([\s\S]*?)<\/dependencyManagement>/gi)) {
-    for (const dep of block[1].matchAll(/<dependency\b[^>]*>([\s\S]*?)<\/dependency>/gi)) {
-      const group = resolveMavenValue(xmlValue(dep[1], "groupId"), properties);
-      const artifact = resolveMavenValue(xmlValue(dep[1], "artifactId"), properties);
-      const version = resolveMavenValue(xmlValue(dep[1], "version"), properties);
-      if (group && artifact && version) managed.set(`${group}:${artifact}`, version);
-    }
-  }
-  const directSource = source.replace(/<dependencyManagement\b[^>]*>[\s\S]*?<\/dependencyManagement>/gi, " ");
-  const dependencies = [];
-  const directBlocks = [...directSource.matchAll(/<dependency\b[^>]*>([\s\S]*?)<\/dependency>/gi)];
-  for (const match of directBlocks) {
-    const group = resolveMavenValue(xmlValue(match[1], "groupId"), properties);
-    const artifact = resolveMavenValue(xmlValue(match[1], "artifactId"), properties);
-    if (!group || !artifact) continue;
-    dependencies.push({
-      group, artifact, name: `${group}:${artifact}`,
-      version: resolveMavenValue(xmlValue(match[1], "version"), properties) || managed.get(`${group}:${artifact}`) || "",
-      scope: xmlValue(match[1], "scope") || "compile",
-      optional: xmlValue(match[1], "optional") === "true",
-    });
-  }
-  return { projectGroup, projectVersion, dependencies, unresolvedDeclarations: directBlocks.length - dependencies.length };
-}
-
-export function parseGradleVersionCatalog(text) {
-  const versions = new Map(), libraries = new Map();
-  let section = "";
-  for (const raw of String(text || "").split(/\r?\n/)) {
-    const line = raw.replace(/(^|\s)#.*$/, "").trim();
-    const header = /^\[([^\]]+)]$/.exec(line);
-    if (header) { section = header[1]; continue; }
-    const kv = /^([A-Za-z0-9_.-]+)\s*=\s*(.+)$/.exec(line);
-    if (!kv) continue;
-    if (section === "versions") { versions.set(kv[1], clean(kv[2])); continue; }
-    if (section !== "libraries") continue;
-    const alias = kv[1], value = kv[2];
-    const module = /\bmodule\s*=\s*["']([^"']+)["']/.exec(value)?.[1]
-      || /\bgroup\s*=\s*["']([^"']+)["'][\s\S]*?\bname\s*=\s*["']([^"']+)["']/.exec(value)?.slice(1, 3).join(":")
-      || (/^["'][^"']+:[^"']+["']$/.test(value) ? clean(value) : "");
-    if (!module) continue;
-    const explicit = /\bversion\s*=\s*["']([^"']+)["']/.exec(value)?.[1] || "";
-    const reference = /\bversion\.ref\s*=\s*["']([^"']+)["']/.exec(value)?.[1] || "";
-    libraries.set(alias.replace(/[_.]/g, "-"), { module, version: explicit || versions.get(reference) || "" });
-  }
-  return libraries;
-}
-
-export function parseGradleDependencies(text, catalog = new Map()) {
-  const source = String(text || "").replace(/\/\*[\s\S]*?\*\//g, " ").replace(/(^|\s)\/\/.*$/gm, "$1");
-  const dependencies = [];
-  const configurations = "api|implementation|compile|compileOnly|runtimeOnly|annotationProcessor|kapt|classpath|testImplementation|testCompileOnly|testRuntimeOnly|androidTestImplementation";
-  const matcher = new RegExp(`^\\s*(${configurations})\\s*(?:\\(\\s*)?([^\\r\\n]+)`, "gmi");
-  const declarations = [...source.matchAll(matcher)];
-  for (const match of declarations) {
-    const expression = match[2].trim().replace(/[),;]+\s*$/, "");
-    const coordinate = /["']([^"']+:[^"']+)["']/.exec(expression)?.[1] || "";
-    if (coordinate) {
-      const [group, artifact, version = ""] = coordinate.split(":");
-      if (group && artifact) dependencies.push({ group, artifact, name: `${group}:${artifact}`, version, scope: match[1] });
-      continue;
-    }
-    const alias = /\blibs((?:\.[A-Za-z_]\w*)+)/.exec(expression)?.[1]?.slice(1).replace(/\./g, "-") || "";
-    const entry = catalog.get(alias);
-    if (entry) {
-      const [group, artifact] = entry.module.split(":");
-      dependencies.push({ group, artifact, name: entry.module, version: entry.version, scope: match[1], catalogAlias: alias });
-    }
-  }
-  dependencies.unresolvedDeclarations = declarations.length - dependencies.length;
-  return dependencies;
-}
-
-export function parseGradleLockPackages(text) {
-  const packages = [];
-  for (const raw of String(text || "").split(/\r?\n/)) {
-    const match = /^([^#=\s:]+(?:\.[^#=\s:]+)*):([^#=\s:]+):([^#=\s=]+)=/.exec(raw.trim());
-    if (match) packages.push({ ecosystem: "Maven", name: `${match[1]}:${match[2]}`, version: match[3], dev: false, integrity: "", source: "gradle-lock" });
-  }
-  return packages;
-}