weavatrix 0.3.14 → 1.1.0

package/src/analysis/manifests.js

@@ -1,123 +0,0 @@
-// Pure manifest parsers for the non-npm ecosystems (Go + Python) — text in, declared deps out.
-// NO filesystem here (internal-audit.js is the fs wrapper; internal-builder reads go.mod for resolvers).
-// Philosophy matches dep-check.js: tolerate real-world files, bias to FALSE-NEGATIVES on weird syntax.
-
-// pep503(name) — PyPI canonical form: lowercase, runs of -_. collapse to "-" (same as security/installed.js).
-export const pep503 = (name) => String(name || "").toLowerCase().replace(/[-_.]+/g, "-");
-
-// ---- go.mod → { module, requires: [{path, version, indirect}], replaces: [{from, to}] } ----
-// Handles single-line `require path v1` and `require ( … )` blocks; `// indirect` marks transitive
-// requires (never flagged unused — Go owns them via `go mod tidy`).
-export function parseGoMod(text) {
-  const src = String(text || "");
-  const out = { module: "", requires: [], replaces: [] };
-  const m = src.match(/^\s*module\s+(\S+)/m);
-  if (m) out.module = m[1].replace(/^"|"$/g, "");
-  const addReq = (line) => {
-    const r = line.match(/^\s*([^\s()=>]+)\s+(v[\w.+-]+)\s*(\/\/.*)?$/);
-    if (r) out.requires.push({ path: r[1].replace(/^"|"$/g, ""), version: r[2], indirect: /\/\/\s*indirect/.test(line) });
-  };
-  const addRepl = (line) => {
-    const r = line.match(/^\s*([^\s()=>]+)(?:\s+v[\w.+-]+)?\s*=>\s*(\S+)(?:\s+v[\w.+-]+)?\s*(\/\/.*)?$/);
-    if (r) out.replaces.push({ from: r[1].replace(/^"|"$/g, ""), to: r[2].replace(/^"|"$/g, "") });
-  };
-  for (const dir of ["require", "replace"]) {
-    const add = dir === "require" ? addReq : addRepl;
-    for (const blk of src.matchAll(new RegExp(`^\\s*${dir}\\s*\\(([\\s\\S]*?)^\\s*\\)`, "gm"))) for (const line of blk[1].split(/\r?\n/)) add(line);
-    for (const one of src.matchAll(new RegExp(`^\\s*${dir}\\s+([^(\\r\\n]+)$`, "gm"))) add(one[1]);
-  }
-  return out;
-}
-
-// ---- PEP 508 requirement line → dist name (extras/specifiers/markers stripped), or null ----
-// "-r other.txt", bare options, paths and URLs are skipped; VCS urls keep their #egg= name if present.
-export function requirementName(rawLine) {
-  const line = String(rawLine || "").replace(/(^|\s)#.*$/, "").trim();
-  if (!line) return null;
-  const egg = line.match(/#egg=([A-Za-z0-9][\w.-]*)/i);
-  if (egg) return egg[1];
-  if (line.startsWith("-") || /^(git\+|hg\+|svn\+|bzr\+|https?:|file:)/i.test(line) || /^\.{0,2}[\\/]/.test(line) || line === ".") return null;
-  const m = line.match(/^([A-Za-z0-9][A-Za-z0-9._-]*)/);
-  return m ? m[1] : null;
-}
-
-// requirements.txt (or *.in) text → [{name}] (unique by canonical name)
-export function parseRequirementsNames(text) {
-  const seen = new Set();
-  const out = [];
-  for (const raw of String(text || "").split(/\r?\n/)) {
-    const name = requirementName(raw);
-    if (!name || seen.has(pep503(name))) continue;
-    seen.add(pep503(name));
-    out.push({ name });
-  }
-  return out;
-}
-
-// ---- pyproject.toml → { present, deps: [{name, dev, buildSystem}] } ----
-// Line-based section scanner (no TOML dependency): covers PEP 621 [project] dependencies /
-// optional-dependencies, Poetry [tool.poetry.*dependencies] tables, PEP 735 [dependency-groups],
-// and [build-system] requires (declared-but-implicit → suppresses "missing", never checked "unused").
-export function parsePyprojectDeps(text) {
-  const src = String(text || "");
-  const deps = [];
-  const seen = new Set();
-  const add = (name, dev, buildSystem = false) => {
-    if (!name || name.toLowerCase() === "python" || seen.has(pep503(name))) return;
-    seen.add(pep503(name));
-    deps.push({ name, dev: !!dev, buildSystem });
-  };
-  let section = "";
-  let present = false;
-  let arr = null; // { dev, buildSystem } while inside a dependencies = [ … ] array
-  // bracket balance OUTSIDE string literals — "requests[security]" must not close the array
-  const bracketDelta = (s) => { const t = String(s).replace(/"[^"]*"|'[^']*'/g, ""); return ((t.match(/\[/g) || []).length) - ((t.match(/\]/g) || []).length); };
-  for (const raw of src.split(/\r?\n/)) {
-    const line = raw.replace(/(^|\s)#.*$/, "").trimEnd();
-    const sec = line.match(/^\s*\[+([^\]]+)\]+\s*$/);
-    if (!arr && sec) { section = sec[1].trim(); continue; }
-    if (arr) { // inside a multi-line array: pull every string literal
-      for (const s of line.matchAll(/["']([^"']+)["']/g)) add(requirementName(s[1]), arr.dev, arr.buildSystem);
-      if (bracketDelta(line) < 0) arr = null;
-      continue;
-    }
-    const kv = line.match(/^\s*([\w."'-]+)\s*=\s*(.*)$/);
-    if (!kv) continue;
-    const key = kv[1].replace(/^["']|["']$/g, "");
-    const val = kv[2].trim();
-    const startArray = (dev, buildSystem = false) => {
-      present = true;
-      for (const s of val.matchAll(/["']([^"']+)["']/g)) add(requirementName(s[1]), dev, buildSystem);
-      if (bracketDelta(val) > 0) arr = { dev, buildSystem };
-    };
-    if (section === "project" && key === "dependencies") startArray(false);
-    else if (section === "project.optional-dependencies" || section === "dependency-groups") startArray(true);
-    else if (section === "build-system" && key === "requires") startArray(true, true);
-    else if (section === "tool.poetry.dependencies") { present = true; add(key, false); }
-    else if (section === "tool.poetry.dev-dependencies" || /^tool\.poetry\.group\.[^.]+\.dependencies$/.test(section)) { present = true; add(key, true); }
-  }
-  return { present, deps };
-}
-
-// ---- Pipfile → { present, deps: [{name, dev}] } — [packages] / [dev-packages] table keys ----
-export function parsePipfileDeps(text) {
-  const deps = [];
-  const seen = new Set();
-  let section = "";
-  let present = false;
-  for (const raw of String(text || "").split(/\r?\n/)) {
-    const line = raw.replace(/(^|\s)#.*$/, "").trim();
-    // Match single [section] and array-of-tables [[section]] headers alike. Without the [[...]] case a
-    // `[[source]]` table following [packages] would leave section === "packages" and its name/url/verify_ssl
-    // keys would leak as phantom dependencies (the same blind spot fixed in the Cargo.toml parser).
-    const sec = line.match(/^\[+([^\]]+)\]+$/);
-    if (sec) { section = sec[1].trim().toLowerCase(); continue; }
-    if (section !== "packages" && section !== "dev-packages") continue;
-    const kv = line.match(/^["']?([A-Za-z0-9][\w.-]*)["']?\s*=/);
-    if (!kv || seen.has(pep503(kv[1]))) continue;
-    present = true;
-    seen.add(pep503(kv[1]));
-    deps.push({ name: kv[1], dev: section === "dev-packages" });
-  }
-  return { present, deps };
-}

package/src/analysis/package-reachability.js

@@ -1,39 +0,0 @@
-// Package-level reachability: correlate a dependency finding with the graph's external imports.
-// This is intentionally not function-level exploitability analysis. It only states whether product
-// code imports the package and preserves unknown as unknown.
-const PACKAGE_REACHABILITY_V = 1
-
-export function packageReachability(externalImports, packageName, {isNonProductPath = () => false} = {}) {
-    const imports = (Array.isArray(externalImports) ? externalImports : [])
-        .filter((item) => item?.pkg === packageName && item.builtin !== true)
-        .map((item) => ({
-            file: String(item.file || '').replace(/\\/g, '/'),
-            line: Number.isInteger(item.line) ? item.line : 0,
-            kind: String(item.kind || 'import'),
-            typeOnly: item.typeOnly === true,
-            dynamic: item.dynamic === true,
-        }))
-        .filter((item) => item.file)
-    const product = imports.filter((item) => !isNonProductPath(item.file))
-    const runtime = product.filter((item) => !item.typeOnly)
-    const state = runtime.length
-        ? 'DIRECT_RUNTIME_IMPORT'
-        : product.length
-            ? 'TYPE_ONLY_IMPORT'
-            : imports.length
-                ? 'NON_PRODUCT_IMPORT_ONLY'
-                : 'NOT_OBSERVED_IN_GRAPH'
-    return {
-        packageReachabilityV: PACKAGE_REACHABILITY_V,
-        level: 'package-import',
-        state,
-        directRuntimeImports: runtime.length,
-        directProductImports: product.length,
-        observedImports: imports.length,
-        files: [...new Set((runtime.length ? runtime : product.length ? product : imports).map((item) => item.file))].sort().slice(0, 20),
-        evidence: (runtime.length ? runtime : product.length ? product : imports).slice(0, 10),
-        note: state === 'NOT_OBSERVED_IN_GRAPH'
-            ? 'No static import was observed; implicit, dynamic, plugin and transitive runtime use remain unknown.'
-            : 'Package-level static import evidence; this does not prove vulnerable-function reachability.',
-    }
-}

package/src/analysis/source-complexity.ast.js

@@ -1,97 +0,0 @@
-// Tree-sitter node helpers shared by the source-complexity analysis modules.
-
-import { IO_PREFIXES } from "./source-complexity.constants.js";
-
-export function field(node, name) {
-  try { return node?.childForFieldName ? node.childForFieldName(name) : null; }
-  catch { return null; }
-}
-
-export function children(node) {
-  try { return Array.isArray(node?.namedChildren) ? node.namedChildren : []; }
-  catch { return []; }
-}
-
-export function allChildren(node) {
-  try { return Array.isArray(node?.children) ? node.children : children(node); }
-  catch { return children(node); }
-}
-
-export function sameNode(left, right) {
-  if (!left || !right) return false;
-  if (left === right) return true;
-  if (left.id != null && right.id != null) return left.id === right.id;
-  return left.type === right.type && left.startIndex === right.startIndex && left.endIndex === right.endIndex;
-}
-
-export function normalizedName(value) {
-  return String(value || "").replace(/[^A-Za-z0-9_$]+/g, "").toLowerCase();
-}
-
-export function looksLikeIoCall(value) {
-  const raw = String(value || "");
-  const lower = raw.toLowerCase();
-  return IO_PREFIXES.some((prefix) => {
-    if (!lower.startsWith(prefix)) return false;
-    const boundary = raw[prefix.length];
-    return boundary == null || /[A-Z_$]/.test(boundary);
-  });
-}
-
-export function callName(node) {
-  const callee = field(node, "function") || field(node, "name") || field(node, "constructor");
-  if (!callee) return "";
-  const member = field(callee, "property") || field(callee, "field") || field(callee, "attribute") || field(callee, "name");
-  return String((member || callee).text || "").replace(/\?$/, "");
-}
-
-export function logicalBranch(node) {
-  if (!/binary_expression|boolean_operator/.test(String(node?.type || ""))) return false;
-  return allChildren(node).some((child) => ["&&", "||", "??", "and", "or"].includes(String(child?.type || child?.text || "")));
-}
-
-export function isDefaultCase(node) {
-  const text = String(node?.text || "").trimStart();
-  return /^(default\b|case\s+default\b)/i.test(text);
-}
-
-export function directParameterCount(paramNode, family) {
-  if (!paramNode) return 0;
-  if (!/parameters|parameter_list|formal_parameters/.test(String(paramNode.type || ""))) {
-    return /^(self|cls)$/.test(String(paramNode.text || "").trim()) ? 0 : 1;
-  }
-  let count = 0;
-  for (const part of children(paramNode)) {
-    const type = String(part.type || "");
-    if (/comment|type_parameter|type_parameters/.test(type)) continue;
-    if (family === "go" && /parameter_declaration|variadic_parameter_declaration/.test(type)) {
-      const ids = children(part).filter((child) => /^(identifier|field_identifier)$/.test(String(child.type || "")));
-      count += Math.max(1, ids.length);
-      continue;
-    }
-    if (/^(self|cls)(\s*[:=].*)?$/.test(String(part.text || "").trim())) continue;
-    count++;
-  }
-  return count;
-}
-
-export function countObjectPatternFields(paramNode) {
-  if (!paramNode) return 0;
-  let total = 0;
-  const visit = (node, depth) => {
-    if (!node || depth > 5) return;
-    if (node.type === "object_pattern") {
-      total += children(node).filter((child) => !/type_annotation|comment/.test(String(child.type || ""))).length;
-      return;
-    }
-    for (const child of children(node)) visit(child, depth + 1);
-  };
-  visit(paramNode, 0);
-  return total;
-}
-
-export function sourceRange(node) {
-  const startLine = node?.startPosition ? node.startPosition.row + 1 : 0;
-  const endLine = node?.endPosition ? node.endPosition.row + 1 : startLine;
-  return { startLine, endLine, loc: startLine ? Math.max(1, endLine - startLine + 1) : 0 };
-}

package/src/analysis/source-complexity.constants.js

@@ -1,55 +0,0 @@
-// Syntax node-type and call-name tables for the source-complexity analysis.
-
-export const LOOP_NODES = new Set([
-  "for_statement", "for_in_statement", "for_each_statement", "enhanced_for_statement",
-  "while_statement", "do_statement", "for_in_clause"
-]);
-export const CALL_NODES = new Set(["call", "call_expression", "method_invocation", "object_creation_expression"]);
-export const RETURN_NODES = new Set(["return_statement"]);
-export const AWAIT_NODES = new Set(["await_expression"]);
-export const OBJECT_NODES = new Set(["object", "dictionary", "map", "record_literal"]);
-export const FIXED_ALLOCATION_NODES = new Set([
-  ...OBJECT_NODES,
-  "array", "list", "set", "tuple", "composite_literal", "new_expression",
-  "object_creation_expression", "array_creation_expression", "make_expression",
-  "list_comprehension", "set_comprehension", "dictionary_comprehension"
-]);
-export const VARIABLE_ALLOCATION_NODES = new Set(["list_comprehension", "set_comprehension", "dictionary_comprehension"]);
-export const SPREAD_NODES = new Set([
-  "spread_element", "list_splat", "dictionary_splat", "set_splat", "spread_expression"
-]);
-export const DECLARATION_BOUNDARIES = new Set([
-  "function_declaration", "generator_function_declaration", "function_definition",
-  "method_definition", "method_declaration", "constructor_declaration",
-  "class_declaration", "class_definition", "interface_declaration", "enum_declaration"
-]);
-export const EXPRESSION_CALLABLES = new Set([
-  "arrow_function", "function_expression", "generator_function", "lambda", "lambda_expression"
-]);
-export const ARGUMENT_NODES = new Set(["arguments", "argument_list"]);
-export const ITERATOR_CALLS = new Set([
-  "foreach", "map", "flatmap", "filter", "reduce", "reduceright", "some", "every",
-  "find", "findindex", "findlast", "findlastindex", "collect", "select"
-]);
-export const PRODUCER_CALLS = new Set([
-  "map", "flatmap", "filter", "slice", "concat", "split", "toarray", "tolist",
-  "keys", "values", "entries", "fromentries", "from", "copy", "clone", "collect", "make",
-  "all", "allsettled", "stringify", "parse"
-]);
-export const LINEAR_CALLS = new Set([
-  ...ITERATOR_CALLS,
-  ...PRODUCER_CALLS,
-  "includes", "indexof", "lastindexof", "join", "reverse", "stringify", "parse",
-  "all", "allsettled", "any", "race"
-]);
-export const SORT_CALLS = new Set(["sort", "sorted", "sortby", "orderby", "order_by"]);
-export const IO_PREFIXES = [
-  "fetch", "request", "query", "execute", "insert", "update", "delete", "save", "read",
-  "write", "send", "publish", "consume", "find", "load", "download", "upload", "connect", "transaction"
-];
-
-export const BRANCH_NODES = new Set([
-  "if_statement", "elif_clause", "catch_clause", "except_clause", "conditional_expression",
-  "ternary_expression", "switch_case", "case_statement", "expression_case", "type_case",
-  "communication_case", "match_case"
-]);

package/src/analysis/source-complexity.js

@@ -1,14 +0,0 @@
-// AST-backed, language-aware source complexity summary.
-//
-// This intentionally reports LOCAL algorithmic work separately from calls/I/O. A method with no loop
-// can be O(1) locally while its end-to-end latency remains callee-bound; object/array spreads are linear
-// shallow copies even without an explicit loop. Reports are plain JSON and are persisted on graph nodes,
-// so the renderer never needs a second implementation of the algorithm.
-//
-// Implementation lives in the sibling modules:
-//   source-complexity.constants.js — node-type and call-name tables
-//   source-complexity.ast.js       — tree-sitter node helpers
-//   source-complexity.report.js    — rank/label/evidence builders
-//   source-complexity.walk.js      — the syntax walk and summary assembly
-
-export { analyzeSyntaxComplexity } from "./source-complexity.walk.js";

package/src/analysis/source-complexity.report.js

@@ -1,81 +0,0 @@
-// Rank, score, label, and evidence builders for the source-complexity report.
-
-function timeScore(rank) {
-  return [0.2, 0.4, 0.65, 0.95, 1.3, 1.7][Math.max(0, Math.min(5, rank))] || 0.2;
-}
-
-function memoryScore(rank) {
-  return [0.15, 0.35, 0.85, 1.05, 1.4, 1.7][Math.max(0, Math.min(5, rank))] || 0.15;
-}
-
-function plural(n, one, many) {
-  return `${n} ${n === 1 ? one : many}`;
-}
-
-function deriveTimeRank(stats) {
-  if (stats.maxLoopDepth >= 3) return 5;
-  if (stats.maxLoopDepth === 2 || (stats.sorts && stats.maxSortLoopDepth > 0)) return 4;
-  if (stats.sorts) return 3;
-  if (stats.loops || stats.linearOps || stats.spreadCopies) return 2;
-  return 0;
-}
-
-function timeLabelForRank(stats, rank) {
-  if (stats.recursion) return "recursive local work — bound unknown";
-  if (rank >= 5) return "O(n^3+) local — deeply nested iteration";
-  if (rank === 4 && stats.sorts && stats.maxSortLoopDepth > 0) return "O(n^2 log n) local — sort inside iteration";
-  if (rank === 4) return "O(n^2) local — nested iteration";
-  if (rank === 3) return "O(n log n) local — sort";
-  if (rank === 2 && stats.spreadCopies) return `O(n) local — ${plural(stats.spreadCopies, "shallow copy", "shallow copies")}`;
-  if (rank === 2 && stats.loops) return `O(n) local — ${plural(stats.loops, "iteration", "iterations")}`;
-  return rank === 2 ? "O(n) local — collection traversal" : "O(1) local";
-}
-
-function buildTimeSummary(stats) {
-  const timeRank = stats.recursion ? Math.max(2, deriveTimeRank(stats)) : deriveTimeRank(stats);
-  let timeLabel = timeLabelForRank(stats, timeRank);
-  if (stats.asyncBoundaries || stats.externalCalls) timeLabel += " · I/O/callee-bound";
-  else if (stats.callCount && !stats.recursion) timeLabel += " · callee-bound";
-  if (stats.branches >= 8 && timeRank === 0) timeLabel += " · branch-heavy";
-  return { timeRank, timeScore: timeScore(timeRank), timeLabel };
-}
-
-function buildMemorySummary(stats) {
-  let memoryRank = 0;
-  let memoryLabel = "O(1) auxiliary";
-  const variableAllocation = stats.spreadCopies || stats.producerCalls;
-  if (variableAllocation) {
-    memoryRank = stats.maxVariableAllocationDepth >= 2 ? 4 : 2;
-    memoryLabel = memoryRank >= 4 ? "O(n^2) — nested collection copies" : stats.spreadCopies
-      ? `O(n) — ${plural(stats.spreadCopies, "shallow copy", "shallow copies")}`
-      : "O(n) — produced collection";
-  } else if (stats.recursion) {
-    memoryRank = 1;
-    memoryLabel = "O(depth) stack — recursive";
-  } else if (stats.allocations) {
-    memoryLabel = "O(1) auxiliary — fixed allocations";
-  }
-  return { memoryRank, memoryScore: memoryScore(memoryRank), memoryLabel };
-}
-
-export function buildLabels(stats) {
-  return { ...buildTimeSummary(stats), ...buildMemorySummary(stats) };
-}
-
-export function buildEvidence(stats) {
-  const out = [];
-  if (stats.loops) out.push(plural(stats.loops, "iteration", "iterations"));
-  if (stats.maxLoopDepth > 1) out.push(`loop depth ${stats.maxLoopDepth}`);
-  if (stats.sorts) out.push(plural(stats.sorts, "sort", "sorts"));
-  if (stats.spreadCopies) out.push(plural(stats.spreadCopies, "shallow copy", "shallow copies"));
-  if (stats.allocationsInLoops) out.push(`${plural(stats.allocationsInLoops, "allocation", "allocations")} inside iteration`);
-  if (stats.copiesInLoops) out.push(`${plural(stats.copiesInLoops, "copy", "copies")} inside iteration`);
-  if (stats.linearOpsInLoops) out.push(`${plural(stats.linearOpsInLoops, "linear operation", "linear operations")} inside iteration`);
-  if (stats.sortsInLoops) out.push(`${plural(stats.sortsInLoops, "sort", "sorts")} inside iteration`);
-  if (stats.recursionInLoops) out.push(`${plural(stats.recursionInLoops, "recursive call", "recursive calls")} inside iteration`);
-  if (stats.branches) out.push(plural(stats.branches, "branch point", "branch points"));
-  if (stats.awaits) out.push(plural(stats.awaits, "await boundary", "await boundaries"));
-  if (stats.callCount) out.push(plural(stats.callCount, "call", "calls"));
-  if (stats.recursion) out.push("direct recursion");
-  return out;
-}

package/src/analysis/source-complexity.walk.js

@@ -1,228 +0,0 @@
-// Syntax-tree walk that gathers complexity stats and assembles the summary report.
-
-import {
-  LOOP_NODES, CALL_NODES, RETURN_NODES, AWAIT_NODES, OBJECT_NODES,
-  FIXED_ALLOCATION_NODES, VARIABLE_ALLOCATION_NODES, SPREAD_NODES,
-  DECLARATION_BOUNDARIES, EXPRESSION_CALLABLES, ARGUMENT_NODES,
-  ITERATOR_CALLS, PRODUCER_CALLS, LINEAR_CALLS, SORT_CALLS, BRANCH_NODES
-} from "./source-complexity.constants.js";
-import {
-  field, children, sameNode, normalizedName, looksLikeIoCall, callName,
-  logicalBranch, isDefaultCase, directParameterCount, countObjectPatternFields, sourceRange
-} from "./source-complexity.ast.js";
-import { buildLabels, buildEvidence } from "./source-complexity.report.js";
-
-function createStats(parameters, family) {
-  return {
-    params: directParameterCount(parameters, family),
-    objectFields: countObjectPatternFields(parameters),
-    branches: 0,
-    loops: 0,
-    maxLoopDepth: 0,
-    returns: 0,
-    awaits: 0,
-    callCount: 0,
-    externalCalls: 0,
-    asyncBoundaries: 0,
-    allocations: 0,
-    objectLiterals: 0,
-    spreadCopies: 0,
-    sorts: 0,
-    linearOps: 0,
-    producerCalls: 0,
-    recursion: false,
-    maxSortLoopDepth: 0,
-    maxVariableAllocationDepth: 0,
-    allocationsInLoops: 0,
-    copiesInLoops: 0,
-    linearOpsInLoops: 0,
-    sortsInLoops: 0,
-    recursionInLoops: 0,
-    hotEvidence: []
-  };
-}
-
-function recordHotEvidence(stats, node, kind, detail) {
-  if (stats.hotEvidence.length >= 24) return;
-  const line = node?.startPosition ? node.startPosition.row + 1 : 0;
-  if (stats.hotEvidence.some((item) => item.kind === kind && item.line === line)) return;
-  stats.hotEvidence.push({ kind, line, detail });
-}
-
-function shouldSkipNode(root, node, state) {
-  if (sameNode(node, root)) return false;
-  const type = String(node.type || "");
-  if (DECLARATION_BOUNDARIES.has(type)) return true;
-  if (!EXPRESSION_CALLABLES.has(type) || state.callbackContext) return false;
-  const parent = state.parent;
-  return !(CALL_NODES.has(String(parent?.type || "")) && sameNode(field(parent, "function"), node));
-}
-
-function nodeFacts(node, state) {
-  const type = String(node.type || "");
-  const isCall = CALL_NODES.has(type);
-  const nameAtCall = isCall ? callName(node) : "";
-  const normalizedCall = normalizedName(nameAtCall);
-  return {
-    type,
-    isCall,
-    isLoop: LOOP_NODES.has(type),
-    nameAtCall,
-    normalizedCall,
-    iteratorCall: isCall && ITERATOR_CALLS.has(normalizedCall),
-    sortCall: isCall && SORT_CALLS.has(normalizedCall),
-    producerCall: isCall && PRODUCER_CALLS.has(normalizedCall),
-    currentDepth: Math.max(0, Number(state.loopDepth) || 0)
-  };
-}
-
-function recordBasicSignals(stats, node, facts) {
-  const { type, currentDepth } = facts;
-  if (BRANCH_NODES.has(type) && !(type.includes("case") && isDefaultCase(node))) stats.branches++;
-  else if (logicalBranch(node)) stats.branches++;
-  if (RETURN_NODES.has(type)) stats.returns++;
-  if (AWAIT_NODES.has(type)) { stats.awaits++; stats.asyncBoundaries++; }
-  if (OBJECT_NODES.has(type)) stats.objectLiterals++;
-  if (FIXED_ALLOCATION_NODES.has(type)) {
-    stats.allocations++;
-    if (currentDepth > 0) {
-      stats.allocationsInLoops++;
-      recordHotEvidence(stats, node, "allocation-in-loop", type);
-    }
-  }
-  if (!VARIABLE_ALLOCATION_NODES.has(type)) return;
-  stats.producerCalls++;
-  stats.maxVariableAllocationDepth = Math.max(stats.maxVariableAllocationDepth, currentDepth + 1);
-}
-
-function recordSpread(stats, node, facts, parent) {
-  if (!SPREAD_NODES.has(facts.type) || /parameters|parameter_list/.test(String(parent?.type || ""))) return;
-  stats.spreadCopies++;
-  stats.linearOps++;
-  stats.maxVariableAllocationDepth = Math.max(stats.maxVariableAllocationDepth, facts.currentDepth + 1);
-  if (facts.currentDepth > 0) {
-    stats.copiesInLoops++;
-    stats.linearOpsInLoops++;
-    recordHotEvidence(stats, node, "copy-in-loop", facts.type);
-  }
-}
-
-function recordCall(stats, node, facts, state, targetName) {
-  if (!facts.isCall) return;
-  stats.callCount++;
-  if (state.awaited || looksLikeIoCall(facts.nameAtCall)) stats.externalCalls++;
-  if (targetName && facts.normalizedCall === targetName) {
-    stats.recursion = true;
-    if (facts.currentDepth > 0) {
-      stats.recursionInLoops++;
-      recordHotEvidence(stats, node, "recursion-in-loop", facts.nameAtCall || targetName);
-    }
-  }
-  if (facts.sortCall) {
-    stats.sorts++;
-    stats.maxSortLoopDepth = Math.max(stats.maxSortLoopDepth, facts.currentDepth);
-    if (facts.currentDepth > 0) {
-      stats.sortsInLoops++;
-      recordHotEvidence(stats, node, "sort-in-loop", facts.nameAtCall || "sort");
-    }
-  } else if (LINEAR_CALLS.has(facts.normalizedCall) && !facts.iteratorCall) {
-    stats.linearOps++;
-    if (facts.currentDepth > 0) {
-      stats.linearOpsInLoops++;
-      recordHotEvidence(stats, node, "linear-scan-in-loop", facts.nameAtCall || "collection operation");
-    }
-  } else if (facts.iteratorCall && facts.currentDepth > 0) {
-    stats.linearOpsInLoops++;
-    recordHotEvidence(stats, node, "linear-scan-in-loop", facts.nameAtCall || "iterator");
-  }
-  if (!facts.producerCall) return;
-  stats.producerCalls++;
-  stats.allocations++;
-  stats.maxVariableAllocationDepth = Math.max(stats.maxVariableAllocationDepth, facts.currentDepth + 1);
-  if (facts.currentDepth > 0) {
-    stats.allocationsInLoops++;
-    recordHotEvidence(stats, node, "allocation-in-loop", facts.nameAtCall || "collection producer");
-  }
-}
-
-function recordLoop(stats, node, facts) {
-  if (!facts.isLoop && !facts.iteratorCall) return facts.currentDepth;
-  const nextDepth = facts.currentDepth + 1;
-  stats.loops++;
-  stats.maxLoopDepth = Math.max(stats.maxLoopDepth, nextDepth);
-  if (nextDepth > 1) recordHotEvidence(stats, node, "nested-iteration", `depth ${nextDepth}`);
-  return nextDepth;
-}
-
-function depthForChild(node, child, facts, nextDepth) {
-  const childIsArgs = ARGUMENT_NODES.has(String(child.type || ""));
-  if (facts.iteratorCall && childIsArgs) return nextDepth;
-  if (!facts.isLoop) return facts.currentDepth;
-  const loopBody = field(node, "body");
-  if (loopBody) return sameNode(child, loopBody) ? nextDepth : facts.currentDepth;
-  return facts.type === "for_in_clause" ? facts.currentDepth : nextDepth;
-}
-
-function walkSyntax(root, node, state, context) {
-  if (!node || shouldSkipNode(root, node, state)) return;
-  const parent = state.parent || null;
-  const callbackContext = state.callbackContext || ARGUMENT_NODES.has(String(parent?.type || ""));
-  const facts = nodeFacts(node, state);
-  recordBasicSignals(context.stats, node, facts);
-  recordSpread(context.stats, node, facts, parent);
-  recordCall(context.stats, node, facts, state, context.targetName);
-  const nextDepth = recordLoop(context.stats, node, facts);
-  for (const child of children(node)) {
-    const childIsArgs = ARGUMENT_NODES.has(String(child.type || ""));
-    walkSyntax(root, child, {
-      parent: node,
-      loopDepth: depthForChild(node, child, facts, nextDepth),
-      callbackContext: callbackContext || childIsArgs,
-      awaited: AWAIT_NODES.has(facts.type) && !facts.isCall
-    }, context);
-  }
-}
-
-export function analyzeSyntaxComplexity(root, { family = "", name = "" } = {}) {
-  const parameters = field(root, "parameters") || field(root, "parameter");
-  const stats = createStats(parameters, family);
-  walkSyntax(root, root, {}, { stats, targetName: normalizedName(name) });
-
-  const labels = buildLabels(stats);
-  const range = sourceRange(root);
-  const evidence = buildEvidence(stats);
-  const structuralWork = stats.loops || stats.sorts || stats.spreadCopies || stats.linearOps;
-  const confidence = stats.recursion ? "low" : structuralWork ? "medium" : stats.callCount ? "low" : "high";
-  return {
-    ...range,
-    family,
-    params: stats.params,
-    objectFields: stats.objectFields,
-    branches: stats.branches,
-    cyclomatic: stats.branches + 1,
-    loops: stats.loops,
-    maxLoopDepth: stats.maxLoopDepth,
-    returns: stats.returns,
-    awaits: stats.awaits,
-    callCount: stats.callCount,
-    externalCalls: stats.externalCalls,
-    asyncBoundaries: stats.asyncBoundaries,
-    allocations: stats.allocations,
-    objectLiterals: stats.objectLiterals,
-    spreadCopies: stats.spreadCopies,
-    sorts: stats.sorts,
-    linearOps: stats.linearOps,
-    recursion: stats.recursion,
-    allocationsInLoops: stats.allocationsInLoops,
-    copiesInLoops: stats.copiesInLoops,
-    linearOpsInLoops: stats.linearOpsInLoops,
-    sortsInLoops: stats.sortsInLoops,
-    recursionInLoops: stats.recursionInLoops,
-    hotEvidence: stats.hotEvidence,
-    ...labels,
-    scope: "local",
-    complexityScope: "local",
-    confidence,
-    evidence
-  };
-}