weavatrix 0.3.14 → 1.1.0

package/src/mcp/evidence-snapshot.duplicates.mjs

@@ -1,213 +0,0 @@
-import {createHash} from 'node:crypto'
-import {computeDuplicates} from '../analysis/duplicates.js'
-import {
-    CAPS, STATE, VERDICT, bounded, compareText, graphId, repoRelativePath,
-} from './evidence-snapshot.common.mjs'
-import {compareDuplicateMember} from './evidence/duplicate-member-order.mjs'
-
-const CLONE_MIN_SIMILARITY = 80
-const DIVERGENCE_MAX_SIMILARITY = 45
-const MIN_TOKENS = 50
-const FILTERED_CLASSES = new Set(['test', 'e2e', 'generated', 'vendored', 'mock', 'story', 'docs', 'benchmark', 'temp'])
-const SAFE_SYMBOL = /^[A-Za-z_$][A-Za-z0-9_$]*$/
-
-const DUPLICATE_EVIDENCE_THRESHOLDS = Object.freeze({
-    clones: Object.freeze({mode: 'renamed', minSimilarityPercent: CLONE_MIN_SIMILARITY, minTokens: MIN_TOKENS}),
-    divergence: Object.freeze({
-        sameName: true,
-        maxSimilarityPercent: DIVERGENCE_MAX_SIMILARITY,
-        minTokens: MIN_TOKENS,
-        maxImplementationsPerName: 12,
-    }),
-})
-
-const hash = (value) => createHash('sha256').update(value).digest('hex').slice(0, 24)
-const positiveInteger = (value) => Number.isFinite(value) && value >= 1 ? Math.trunc(value) : undefined
-
-function safeGraphNodeId(value, file) {
-    const id = graphId(value)
-    if (!id) return undefined
-    const hashIndex = id.indexOf('#')
-    if (hashIndex < 1 || id.slice(0, hashIndex) !== file) return undefined
-    const suffix = id.slice(hashIndex)
-    return /^#[^\s\\/\u0000-\u001f\u007f]{1,511}$/u.test(suffix) ? id : undefined
-}
-
-function member(fragment) {
-    if (!fragment || typeof fragment !== 'object' || fragment.kind === 'string' || fragment.excluded === true) return null
-    const classes = Array.isArray(fragment.classes) ? fragment.classes : []
-    if (fragment.test === true || classes.some((value) => FILTERED_CLASSES.has(value))) return null
-    const file = repoRelativePath(fragment.file)
-    const startLine = positiveInteger(fragment.start)
-    const endLine = positiveInteger(fragment.end)
-    const tokens = positiveInteger(fragment.n)
-    if (!file || !startLine || !endLine || endLine < startLine || !tokens || tokens < MIN_TOKENS) return null
-    const out = {file, startLine, endLine, tokens}
-    const nodeId = safeGraphNodeId(fragment.id, file)
-    if (nodeId) out.graphNodeId = nodeId
-    return out
-}
-
-function memberIdentity(value) {
-    return `${value.file}\0${value.startLine}\0${value.endLine}\0${value.graphNodeId || ''}`
-}
-
-function eligibleMembers(fragments) {
-    const out = new Map()
-    for (let index = 0; index < fragments.length; index++) {
-        const value = member(fragments[index])
-        if (value) out.set(index, value)
-    }
-    return out
-}
-
-function cloneGroups(data, membersByIndex) {
-    const parent = new Map([...membersByIndex.keys()].map((index) => [index, index]))
-    const find = (index) => {
-        let root = index
-        while (parent.get(root) !== root) root = parent.get(root)
-        while (parent.get(index) !== index) {
-            const next = parent.get(index)
-            parent.set(index, root)
-            index = next
-        }
-        return root
-    }
-    const union = (left, right) => {
-        const a = find(left), b = find(right)
-        if (a !== b) parent.set(a > b ? a : b, a > b ? b : a)
-    }
-    const links = []
-    for (const pair of Array.isArray(data?.modes?.renamed) ? data.modes.renamed : []) {
-        if (!Array.isArray(pair) || pair.length < 3) continue
-        const left = Number(pair[0]), right = Number(pair[1]), similarity = Number(pair[2])
-        if (!Number.isInteger(left) || !Number.isInteger(right) || left === right ||
-            !membersByIndex.has(left) || !membersByIndex.has(right) ||
-            !Number.isFinite(similarity) || similarity < CLONE_MIN_SIMILARITY || similarity > 100) continue
-        union(left, right)
-        links.push({left, right, similarity: Math.trunc(similarity)})
-    }
-
-    const components = new Map()
-    for (const index of membersByIndex.keys()) {
-        const root = find(index)
-        if (!components.has(root)) components.set(root, [])
-        components.get(root).push(index)
-    }
-
-    const groups = []
-    for (const indices of components.values()) {
-        if (indices.length < 2) continue
-        const unique = new Map()
-        for (const index of indices) {
-            const value = membersByIndex.get(index)
-            unique.set(memberIdentity(value), value)
-        }
-        const members = [...unique.values()].sort(compareDuplicateMember)
-        if (members.length < 2) continue
-        const indexSet = new Set(indices)
-        const similarities = links
-            .filter((link) => indexSet.has(link.left) && indexSet.has(link.right))
-            .map((link) => link.similarity)
-        if (!similarities.length) continue
-        const identity = members.map(memberIdentity).join('\0')
-        groups.push({
-            id: hash(`clone\0${identity}`),
-            memberCount: members.length,
-            totalTokens: members.reduce((sum, value) => sum + value.tokens, 0),
-            strongestSimilarity: Math.max(...similarities),
-            weakestLinkedSimilarity: Math.min(...similarities),
-            membersTruncated: members.length > CAPS.duplicateMembers,
-            members: members.slice(0, CAPS.duplicateMembers),
-        })
-    }
-    return groups.sort((a, b) => b.totalTokens - a.totalTokens || b.memberCount - a.memberCount ||
-        b.strongestSimilarity - a.strongestSimilarity || compareText(a.id, b.id))
-}
-
-function divergenceCandidates(data, membersByIndex) {
-    const candidates = []
-    for (const twin of Array.isArray(data?.nameTwins) ? data.nameTwins : []) {
-        const symbol = typeof twin?.label === 'string' && SAFE_SYMBOL.test(twin.label) ? twin.label : undefined
-        if (!symbol) continue
-        const pairs = []
-        for (const pair of Array.isArray(twin.pairs) ? twin.pairs : []) {
-            const left = Number(pair?.a), right = Number(pair?.b), similarity = Number(pair?.similarity)
-            const leftMember = membersByIndex.get(left), rightMember = membersByIndex.get(right)
-            if (!Number.isInteger(left) || !Number.isInteger(right) || left === right || !leftMember || !rightMember ||
-                leftMember.file === rightMember.file || !Number.isFinite(similarity) ||
-                similarity < 0 || similarity > DIVERGENCE_MAX_SIMILARITY) continue
-            const members = [leftMember, rightMember].sort(compareDuplicateMember)
-            pairs.push({
-                similarity: Math.trunc(similarity),
-                totalTokens: members[0].tokens + members[1].tokens,
-                members,
-                identity: members.map(memberIdentity).join('\0'),
-            })
-        }
-        pairs.sort((a, b) => a.similarity - b.similarity || b.totalTokens - a.totalTokens || compareText(a.identity, b.identity))
-        const selected = pairs[0]
-        if (!selected) continue
-        candidates.push({
-            id: hash(`divergence\0${symbol.toLowerCase()}\0${selected.identity}`),
-            symbol,
-            similarity: selected.similarity,
-            totalTokens: selected.totalTokens,
-            members: selected.members,
-        })
-    }
-    return candidates.sort((a, b) => b.totalTokens - a.totalTokens || a.similarity - b.similarity ||
-        compareText(a.symbol, b.symbol) || compareText(a.id, b.id))
-}
-
-function errorSection(reason = 'DUPLICATE_ANALYSIS_ERROR') {
-    return {
-        state: STATE.ERROR,
-        verdict: VERDICT.UNKNOWN,
-        thresholds: DUPLICATE_EVIDENCE_THRESHOLDS,
-        completeness: {
-            fragments: {total: 0, eligible: 0, filtered: 0},
-            cloneGroups: {total: 0, returned: 0, truncated: false},
-            divergenceCandidates: {total: 0, returned: 0, truncated: false},
-            reasons: [reason],
-        },
-        cloneGroups: [],
-        divergenceCandidates: [],
-    }
-}
-
-export function buildDuplicatesSection(repoRoot, graph) {
-    try {
-        const data = computeDuplicates(repoRoot, graph, {nameTwins: true, includeStrings: false})
-        if (!data?.ok || !Array.isArray(data.frags)) return errorSection()
-        const membersByIndex = eligibleMembers(data.frags)
-        const groups = bounded(cloneGroups(data, membersByIndex), CAPS.duplicateGroups)
-        const divergence = bounded(divergenceCandidates(data, membersByIndex), CAPS.divergenceCandidates)
-        const reasons = []
-        if (!Number.isFinite(data.graphSymbols) || data.graphSymbols < 1) reasons.push('NO_GRAPH_SYMBOLS')
-        if (data.completeness?.assetFiles?.truncated) reasons.push('ASSET_SCAN_TRUNCATED')
-        if (data.completeness?.nameTwinsTruncated) reasons.push('NAME_TWIN_SCAN_TRUNCATED')
-        if (groups.items.some((group) => group.membersTruncated)) reasons.push('CLONE_MEMBERS_TRUNCATED')
-        if (groups.completeness.truncated) reasons.push('CLONE_GROUPS_TRUNCATED')
-        if (divergence.completeness.truncated) reasons.push('DIVERGENCE_CANDIDATES_TRUNCATED')
-        return {
-            state: reasons.length ? STATE.PARTIAL : STATE.COMPLETE,
-            verdict: VERDICT.UNKNOWN,
-            thresholds: DUPLICATE_EVIDENCE_THRESHOLDS,
-            completeness: {
-                fragments: {
-                    total: data.frags.length,
-                    eligible: membersByIndex.size,
-                    filtered: data.frags.length - membersByIndex.size,
-                },
-                cloneGroups: groups.completeness,
-                divergenceCandidates: divergence.completeness,
-                reasons,
-            },
-            cloneGroups: groups.items,
-            divergenceCandidates: divergence.items,
-        }
-    } catch {
-        return errorSection()
-    }
-}

package/src/mcp/evidence-snapshot.health.mjs

@@ -1,102 +0,0 @@
-import {
-    CAPS, COMPLEXITY_THRESHOLDS, STATE, VERDICT, addIf, bounded, compareText, graphId,
-    normalizeCheckState, numericRecord, optionalNonNegativeInteger, privacySafeText, repoRelativePath,
-    sanitizeFinding,
-} from './evidence-snapshot.common.mjs'
-import {summarizeFindings} from '../analysis/findings.js'
-import {auditFindingPathScope} from './health/audit-format.mjs'
-
-function buildHotspots(graph) {
-    let analyzed = 0
-    const facts = []
-    for (const node of Array.isArray(graph?.nodes) ? graph.nodes : []) {
-        if (!node || typeof node !== 'object' || !node.complexity || typeof node.complexity !== 'object') continue
-        const id = graphId(node.id)
-        const file = repoRelativePath(node.source_file)
-        if (!id || !file) continue
-        analyzed++
-        const loc = optionalNonNegativeInteger(node.complexity.loc)
-        const cyclomatic = optionalNonNegativeInteger(node.complexity.cyclomatic)
-        const params = optionalNonNegativeInteger(node.complexity.params)
-        const breaches = []
-        let severity = 'medium'
-        if (loc !== undefined && loc >= COMPLEXITY_THRESHOLDS.loc.high) { breaches.push('LOC_HIGH'); severity = 'high' }
-        else if (loc !== undefined && loc >= COMPLEXITY_THRESHOLDS.loc.warning) breaches.push('LOC_WARNING')
-        if (cyclomatic !== undefined && cyclomatic >= COMPLEXITY_THRESHOLDS.cyclomatic.high) { breaches.push('CYCLOMATIC_HIGH'); severity = 'high' }
-        else if (cyclomatic !== undefined && cyclomatic >= COMPLEXITY_THRESHOLDS.cyclomatic.warning) breaches.push('CYCLOMATIC_WARNING')
-        if (params !== undefined && params >= COMPLEXITY_THRESHOLDS.params.high) { breaches.push('PARAMS_HIGH'); severity = 'high' }
-        else if (params !== undefined && params >= COMPLEXITY_THRESHOLDS.params.warning) breaches.push('PARAMS_WARNING')
-        if (!breaches.length) continue
-        const fact = {id, file, severity, breaches: breaches.sort(compareText)}
-        addIf(fact, 'symbol', privacySafeText(node.label, 256))
-        addIf(fact, 'startLine', optionalNonNegativeInteger(node.complexity.startLine))
-        addIf(fact, 'endLine', optionalNonNegativeInteger(node.complexity.endLine))
-        addIf(fact, 'loc', loc)
-        addIf(fact, 'cyclomatic', cyclomatic)
-        addIf(fact, 'params', params)
-        facts.push(fact)
-    }
-    facts.sort((a, b) => (a.severity === b.severity ? 0 : a.severity === 'high' ? -1 : 1) ||
-        (b.loc || 0) - (a.loc || 0) || (b.cyclomatic || 0) - (a.cyclomatic || 0) ||
-        (b.params || 0) - (a.params || 0) || compareText(a.id, b.id))
-    return {analyzed, ...bounded(facts, CAPS.hotspots)}
-}
-
-export function buildHealthSection(graph, audit, repoRoot = null) {
-    if (!audit?.ok) {
-        return {
-            state: STATE.ERROR,
-            verdict: VERDICT.UNKNOWN,
-            completeness: {reasons: ['AUDIT_ERROR']},
-            summary: {bySeverity: {}, byCategory: {}},
-            checks: {osv: STATE.ERROR, malware: STATE.ERROR},
-            findings: [],
-            complexity: {thresholds: COMPLEXITY_THRESHOLDS, analyzed: 0, hotspots: []},
-        }
-    }
-    // Source-free extension evidence follows the same production-first path policy as
-    // run_audit. Classified-only findings remain available locally through
-    // include_classified:true, but must not turn a production snapshot red.
-    const scopedFindings = auditFindingPathScope(audit.findings, {repoRoot}).findings
-    const scopedSummary = summarizeFindings(scopedFindings)
-    const findings = bounded(scopedFindings.map(sanitizeFinding).filter(Boolean)
-        .sort((a, b) => compareText(a.severity, b.severity) || compareText(a.category, b.category) ||
-            compareText(a.rule, b.rule) || compareText(a.file || a.package || '', b.file || b.package || '') || compareText(a.id, b.id)),
-    CAPS.findings)
-    const hotspots = buildHotspots(graph)
-    const checks = {
-        osv: normalizeCheckState(audit.checks?.osv?.status),
-        malware: normalizeCheckState(audit.checks?.malware?.status),
-    }
-    const state = Object.values(checks).every((value) => value === STATE.COMPLETE || value === STATE.NOT_APPLICABLE)
-        ? STATE.COMPLETE
-        : STATE.PARTIAL
-    return {
-        state,
-        verdict: findings.completeness.total > 0 || hotspots.completeness.total > 0
-            ? VERDICT.FAIL
-            : state === STATE.COMPLETE ? VERDICT.PASS : VERDICT.UNKNOWN,
-        completeness: {
-            findings: findings.completeness,
-            hotspots: hotspots.completeness,
-            complexity: {analyzed: hotspots.analyzed},
-            reasons: state === STATE.PARTIAL ? ['OPTIONAL_CHECKS_INCOMPLETE'] : [],
-        },
-        summary: {
-            bySeverity: numericRecord(scopedSummary.bySeverity, ['critical', 'high', 'medium', 'low', 'info']),
-            byCategory: numericRecord(scopedSummary.byCategory, ['unused', 'structure', 'vulnerability', 'malware']),
-            dead: numericRecord(audit.deadReport, ['deadSymbols', 'deadFiles', 'unusedExports']),
-            structure: numericRecord(audit.structureReport, [
-                'runtimeImportEdges', 'typeOnlyImportEdges', 'compileOnlyImportEdges', 'runtimeCycles',
-                'compileTimeCouplings', 'largestCycle', 'largestCompileTimeCoupling', 'orphans', 'boundaryViolations',
-            ]),
-        },
-        checks,
-        findings: findings.items,
-        complexity: {
-            thresholds: COMPLEXITY_THRESHOLDS,
-            analyzed: hotspots.analyzed,
-            hotspots: hotspots.items,
-        },
-    }
-}

package/src/mcp/evidence-snapshot.inventory.mjs

@@ -1,148 +0,0 @@
-import {
-    CAPS, STATE, VERDICT, addIf, bounded, compareText, metadataString, normalizeCheckState,
-    repoRelativePath, safeToken,
-} from './evidence-snapshot.common.mjs'
-import {buildPackageDependencyGraph} from './evidence-snapshot.package-graph.mjs'
-
-const FIXED_PACKAGE_SOURCES = new Set([
-    'package-lock', 'yarn-lock', 'requirements', 'venv', 'poetry-lock', 'uv-lock',
-    'pipfile-lock', 'go-sum', 'go-mod', 'node_modules',
-])
-const PACKAGE_SOURCE_FILE = /(^|\/)(?:package-lock\.json|npm-shrinkwrap\.json|yarn\.lock|pnpm-lock\.ya?ml|requirements[\w.-]*\.(?:txt|in)|poetry\.lock|uv\.lock|Pipfile\.lock|go\.(?:mod|sum))$/i
-
-function sanitizeBadge(category, value) {
-    if (!value || typeof value !== 'object' || Array.isArray(value)) return null
-    const id = safeToken(value.id, 128)
-    if (!id) return null
-    const out = {category, id}
-    addIf(out, 'name', metadataString(value.name || value.label, 128))
-    addIf(out, 'kind', safeToken(value.kind, 64))
-    addIf(out, 'title', metadataString(value.title, 128))
-    addIf(out, 'version', safeToken(value.version, 64))
-    return out
-}
-
-export function buildTechnologiesSection(stack, stackError) {
-    if (stackError) {
-        return {
-            state: STATE.ERROR,
-            verdict: VERDICT.UNKNOWN,
-            completeness: {badges: {total: 0, returned: 0, truncated: false}, reasons: ['STACK_DETECTION_ERROR']},
-            badges: [],
-        }
-    }
-    const categories = ['languages', 'runtimes', 'tests', 'infra', 'deploy']
-    const facts = categories.flatMap((category) => (Array.isArray(stack?.[category]) ? stack[category] : [])
-        .map((badge) => sanitizeBadge(category, badge)).filter(Boolean))
-        .sort((a, b) => compareText(a.category, b.category) || compareText(a.id, b.id))
-    const badges = bounded(facts, CAPS.stackBadges)
-    return {
-        state: STATE.PARTIAL,
-        verdict: VERDICT.UNKNOWN,
-        completeness: {
-            badges: badges.completeness,
-            reasons: ['MANIFEST_AND_FILE_HEURISTICS_ONLY', 'INFRA_IMPORT_DETECTION_DISABLED'],
-        },
-        badges: badges.items,
-    }
-}
-
-function packageSource(value) {
-    const raw = metadataString(value, 512)
-    if (!raw) return undefined
-    const normalized = raw.replace(/\\/g, '/')
-    if (FIXED_PACKAGE_SOURCES.has(normalized)) return normalized
-    const relative = repoRelativePath(normalized, 512)
-    return relative && PACKAGE_SOURCE_FILE.test(relative) ? relative : undefined
-}
-
-function sanitizePackage(value) {
-    const name = safeToken(value?.name)
-    const version = safeToken(value?.version, 128)
-    const ecosystem = safeToken(value?.ecosystem, 64)
-    const source = packageSource(value?.source)
-    if (!name || !version || !ecosystem || !source) return null
-    return {name, version, ecosystem, dev: value.dev === true, source}
-}
-
-function buildDirectUsage(externalImports) {
-    const usage = new Map()
-    for (const entry of Array.isArray(externalImports) ? externalImports : []) {
-        if (!entry || typeof entry !== 'object' || entry.builtin === true || entry.unresolved === true) continue
-        const name = safeToken(entry.pkg)
-        const ecosystem = safeToken(entry.ecosystem || 'npm', 64)
-        const file = repoRelativePath(entry.file)
-        if (!name || !ecosystem || !file) continue
-        const key = `${ecosystem}\0${name}`
-        let fact = usage.get(key)
-        if (!fact) usage.set(key, (fact = {name, ecosystem, importCount: 0, files: new Set(), kinds: new Set()}))
-        fact.importCount++
-        fact.files.add(file)
-        const kind = safeToken(entry.kind, 64)
-        if (kind) fact.kinds.add(kind)
-    }
-    return [...usage.values()].map((fact) => {
-        const files = [...fact.files].sort(compareText)
-        return {
-            name: fact.name,
-            ecosystem: fact.ecosystem,
-            importCount: fact.importCount,
-            fileCount: files.length,
-            files: files.slice(0, CAPS.usageFiles),
-            filesTruncated: files.length > CAPS.usageFiles,
-            kinds: [...fact.kinds].sort(compareText),
-        }
-    }).sort((a, b) => compareText(a.ecosystem, b.ecosystem) || compareText(a.name, b.name))
-}
-
-export function buildPackagesSection(installedResult, installedError, graph, audit, repoRoot) {
-    const dependencyGraph = buildPackageDependencyGraph(repoRoot)
-    const dependencyGraphCounts = {
-        dependencyGraphNodes: dependencyGraph.completeness.nodes,
-        dependencyGraphEdges: dependencyGraph.completeness.edges,
-    }
-    if (installedError) {
-        return {
-            state: STATE.ERROR,
-            verdict: VERDICT.UNKNOWN,
-            completeness: {...dependencyGraphCounts, reasons: ['PACKAGE_INVENTORY_ERROR']},
-            checks: {osv: normalizeCheckState(audit?.checks?.osv?.status), malware: normalizeCheckState(audit?.checks?.malware?.status)},
-            inventory: [],
-            directUsage: [],
-            dependencyGraph,
-        }
-    }
-    const inventory = bounded((installedResult?.installed || []).map(sanitizePackage).filter(Boolean)
-        .sort((a, b) => compareText(a.ecosystem, b.ecosystem) || compareText(a.name, b.name) ||
-            compareText(a.version, b.version) || compareText(a.source, b.source) || Number(a.dev) - Number(b.dev)),
-    CAPS.packages)
-    const usage = bounded(buildDirectUsage(graph?.externalImports), CAPS.directUsage)
-    const packageRules = new Set(['unused-dep', 'missing-dep', 'duplicate-dep', 'lockfile-drift', 'known-vuln', 'malicious-package', 'typosquat'])
-    const packageFailure = (audit?.findings || []).some((finding) => packageRules.has(finding?.rule))
-    const checks = {
-        osv: normalizeCheckState(audit?.checks?.osv?.status),
-        malware: normalizeCheckState(audit?.checks?.malware?.status),
-    }
-    const reasons = []
-    if (inventory.completeness.truncated) reasons.push('PACKAGE_INVENTORY_TRUNCATED')
-    if (usage.completeness.truncated) reasons.push('DIRECT_USAGE_TRUNCATED')
-    if (Object.values(checks).some((value) => ![STATE.COMPLETE, STATE.NOT_APPLICABLE].includes(value))) {
-        reasons.push('OPTIONAL_CHECKS_INCOMPLETE')
-    }
-    if ([STATE.PARTIAL, STATE.ERROR].includes(dependencyGraph.state)) reasons.push('PACKAGE_DEPENDENCY_GRAPH_PARTIAL')
-    const state = reasons.length ? STATE.PARTIAL : STATE.COMPLETE
-    return {
-        state,
-        verdict: packageFailure ? VERDICT.FAIL : state === STATE.COMPLETE ? VERDICT.PASS : VERDICT.UNKNOWN,
-        completeness: {
-            inventory: inventory.completeness,
-            directUsage: usage.completeness,
-            ...dependencyGraphCounts,
-            reasons,
-        },
-        checks,
-        inventory: inventory.items,
-        directUsage: usage.items,
-        dependencyGraph,
-    }
-}

package/src/mcp/evidence-snapshot.mjs

@@ -1,50 +0,0 @@
-// Bounded, deterministic and source-free evidence derived locally from a repository and its graph.
-// The sync wire layer applies a second allowlist because cached graph/evidence data is untrusted.
-import {aggregateGraph} from '../analysis/graph-analysis.js'
-import {runInternalAudit} from '../analysis/internal-audit.js'
-import {detectRepoStack} from '../scan/discover.js'
-import {collectInstalled} from '../security/installed.js'
-import {STATE, hashSnapshot} from './evidence-snapshot.common.mjs'
-import {buildArchitectureSection} from './evidence-snapshot.architecture.mjs'
-import {buildDuplicatesSection} from './evidence-snapshot.duplicates.mjs'
-import {buildHealthSection} from './evidence-snapshot.health.mjs'
-import {buildPackagesSection, buildTechnologiesSection} from './evidence-snapshot.inventory.mjs'
-import {buildStructureEvidence} from './evidence-snapshot.structure.mjs'
-
-export async function createEvidenceSnapshot({repoRoot, graph}) {
-    const inputGraph = graph && typeof graph === 'object' && !Array.isArray(graph)
-        ? graph
-        : {nodes: [], links: [], externalImports: []}
-
-    let aggregate = null
-    try { aggregate = aggregateGraph(inputGraph) } catch { aggregate = null }
-
-    let audit = null
-    try { audit = await runInternalAudit(repoRoot, {graph: inputGraph, skipMalwareScan: true}) } catch { audit = null }
-
-    let stack = null
-    let stackError = false
-    try { stack = detectRepoStack(repoRoot) } catch { stackError = true }
-
-    let installedResult = null
-    let installedError = false
-    try { installedResult = collectInstalled(repoRoot) } catch { installedError = true }
-
-    const structure = buildStructureEvidence(inputGraph, repoRoot)
-
-    const sections = {
-        architecture: buildArchitectureSection(inputGraph, aggregate, audit, structure),
-        duplicates: buildDuplicatesSection(repoRoot, inputGraph),
-        health: buildHealthSection(inputGraph, audit, repoRoot),
-        technologies: buildTechnologiesSection(stack, stackError),
-        packages: buildPackagesSection(installedResult, installedError, inputGraph, audit, repoRoot),
-    }
-    const sectionStates = Object.values(sections).map((section) => section.state)
-    const state = sectionStates.every((value) => value === STATE.ERROR)
-        ? STATE.ERROR
-        : sectionStates.every((value) => value === STATE.COMPLETE || value === STATE.NOT_APPLICABLE)
-            ? STATE.COMPLETE
-            : STATE.PARTIAL
-    const snapshot = {evidenceSnapshotV: 1, state, sections}
-    return {...snapshot, snapshotHash: hashSnapshot(snapshot)}
-}

package/src/mcp/evidence-snapshot.package-graph.mjs

@@ -1,34 +0,0 @@
-import {readFileSync, statSync} from 'node:fs'
-import {createRepoBoundary} from '../repo-path.js'
-import {STATE} from './evidence-snapshot.common.mjs'
-import {parseBunLock, parseJsonc} from './evidence/bun-lock-graph.mjs'
-import {MAX_LOCKFILE_BYTES, emptyGraph} from './evidence/package-graph-common.mjs'
-import {parsePackageLock} from './evidence/package-lock-graph.mjs'
-
-const LOCKFILES = ['npm-shrinkwrap.json', 'package-lock.json', 'bun.lock']
-
-export function buildPackageDependencyGraph(repoRoot) {
-    const boundary = createRepoBoundary(repoRoot)
-    if (!boundary.root) return emptyGraph(STATE.ERROR, 'INVALID_REPOSITORY_ROOT')
-
-    let selected = null
-    for (const lockfile of LOCKFILES) {
-        const resolved = boundary.resolve(lockfile)
-        if (resolved.ok) {
-            selected = {lockfile, path: resolved.path}
-            break
-        }
-    }
-    if (!selected) return emptyGraph(STATE.NOT_APPLICABLE, 'PACKAGE_LOCK_V2_V3_NOT_FOUND')
-
-    try {
-        if (statSync(selected.path).size > MAX_LOCKFILE_BYTES) {
-            return emptyGraph(STATE.ERROR, 'PACKAGE_LOCK_SIZE_LIMIT_REACHED', {lockfile: selected.lockfile})
-        }
-        const raw = readFileSync(selected.path, 'utf8')
-        if (selected.lockfile === 'bun.lock') return parseBunLock(parseJsonc(raw), selected.lockfile)
-        return parsePackageLock(JSON.parse(raw), selected.lockfile)
-    } catch {
-        return emptyGraph(STATE.ERROR, 'PACKAGE_LOCK_READ_ERROR', {lockfile: selected.lockfile})
-    }
-}

package/src/mcp/evidence-snapshot.structure.mjs

@@ -1,84 +0,0 @@
-import {createHash} from 'node:crypto'
-import {readFileSync} from 'node:fs'
-import {buildFileImportGraph, checkBoundaries, findSccs, isRustModuleTreeComponent, representativeCycle} from '../analysis/dep-rules.js'
-import {createRepoBoundary} from '../repo-path.js'
-import {CAPS, bounded, compareText, repoRelativePath, safeToken} from './evidence-snapshot.common.mjs'
-
-const MAX_CYCLE_MEMBERS = 200
-const SEVERITIES = new Set(['critical', 'high', 'medium', 'low', 'info'])
-const hash = (value) => createHash('sha256').update(value).digest('hex').slice(0, 24)
-
-function sortedSccs(adjacency) {
-    return findSccs(adjacency)
-        .map((members) => members.map((member) => repoRelativePath(member)).filter(Boolean).sort(compareText))
-        .filter((members) => members.length > 1)
-        .sort((a, b) => b.length - a.length || compareText(a.join('\0'), b.join('\0')))
-}
-
-function cycleFact(kind, adjacency, members) {
-    const representative = representativeCycle(adjacency, members).map((member) => repoRelativePath(member)).filter(Boolean)
-    return {
-        id: hash(`${kind}\0${members.join('\0')}`),
-        kind,
-        size: members.length,
-        members: members.slice(0, MAX_CYCLE_MEMBERS),
-        membersTruncated: members.length > MAX_CYCLE_MEMBERS,
-        representativePath: representative.slice(0, MAX_CYCLE_MEMBERS + 1),
-    }
-}
-
-function readRules(repoRoot) {
-    try {
-        const boundary = createRepoBoundary(repoRoot)
-        const resolved = boundary.resolve('.weavatrix-deps.json')
-        if (!resolved.ok) return {rules: {}, state: 'NOT_APPLICABLE'}
-        const parsed = JSON.parse(readFileSync(resolved.path, 'utf8'))
-        const hasRules = Array.isArray(parsed?.forbidden) && parsed.forbidden.length > 0 ||
-            Array.isArray(parsed?.allowedOnly) && parsed.allowedOnly.length > 0
-        return {rules: parsed && typeof parsed === 'object' ? parsed : {}, state: hasRules ? 'COMPLETE' : 'NOT_APPLICABLE'}
-    } catch {
-        return {rules: {}, state: 'ERROR'}
-    }
-}
-
-function boundaryFact(value) {
-    const from = repoRelativePath(value?.from), to = repoRelativePath(value?.to)
-    if (!from || !to || !['forbidden', 'allowedOnly'].includes(value?.kind)) return null
-    const name = safeToken(value?.name, 96)
-    return {
-        kind: value.kind,
-        ruleId: name || hash(String(value?.name || 'unnamed-rule')),
-        severity: SEVERITIES.has(value?.severity) ? value.severity : 'medium',
-        from,
-        to,
-    }
-}
-
-export function buildStructureEvidence(graph, repoRoot) {
-    try {
-        const imports = buildFileImportGraph(graph)
-        const runtimeSccs = sortedSccs(imports.runtimeAdj)
-        const runtimeKeys = new Set(runtimeSccs.map((members) => members.join('\0')))
-        // Same suppression as computeStructureFindings: a synced snapshot must not contradict the
-        // local structure findings on idiomatic Rust module trees.
-        const compileSccs = sortedSccs(imports.allAdj)
-            .filter((members) => !runtimeKeys.has(members.join('\0')) && !isRustModuleTreeComponent(members))
-        const allCycles = [
-            ...runtimeSccs.map((members) => cycleFact('runtime', imports.runtimeAdj, members)),
-            ...compileSccs.map((members) => cycleFact('compile-time', imports.allAdj, members)),
-        ].sort((a, b) => a.kind === b.kind ? b.size - a.size || compareText(a.id, b.id) : a.kind === 'runtime' ? -1 : 1)
-        const cycles = bounded(allCycles, CAPS.architectureFindings)
-        const rules = readRules(repoRoot)
-        const allBoundaries = checkBoundaries(imports.runtimeEdges, rules.rules)
-            .map(boundaryFact).filter(Boolean)
-            .sort((a, b) => compareText(a.ruleId, b.ruleId) || compareText(a.from, b.from) || compareText(a.to, b.to))
-        const boundaries = bounded(allBoundaries, CAPS.architectureFindings)
-        return {state: 'COMPLETE', rulesState: rules.state, cycles, boundaries}
-    } catch {
-        return {
-            state: 'ERROR', rulesState: 'ERROR',
-            cycles: {items: [], completeness: {total: 0, returned: 0, truncated: false}},
-            boundaries: {items: [], completeness: {total: 0, returned: 0, truncated: false}},
-        }
-    }
-}