weavatrix 0.3.14 → 1.1.0

package/src/analysis/architecture/contract-storage.js

@@ -1,35 +0,0 @@
-import {existsSync, readFileSync, writeFileSync, mkdirSync} from 'node:fs'
-import {dirname, join} from 'node:path'
-import {createRepoBoundary} from '../../repo-path.js'
-import {normalizeArchitectureContract} from './contract-schema.js'
-
-export const CONTRACT_PATHS = ['.weavatrix/architecture.json', '.weavatrix-architecture.json']
-
-const readContract = (path, source) => {
-    try {
-        return {contract: normalizeArchitectureContract(JSON.parse(readFileSync(path, 'utf8'))), source}
-    } catch (error) {
-        return {contract: null, source, error: error.message}
-    }
-}
-
-export function loadArchitectureContract(repoRoot, graphPath) {
-    const boundary = createRepoBoundary(repoRoot)
-    for (const relative of CONTRACT_PATHS) {
-        const resolved = boundary.resolve(relative)
-        if (resolved.ok && existsSync(resolved.path)) return readContract(resolved.path, relative)
-    }
-    const cached = graphPath ? join(dirname(graphPath), 'architecture.contract.json') : null
-    return cached && existsSync(cached)
-        ? readContract(cached, 'extension-cache')
-        : {contract: null, source: null, error: null}
-}
-
-export function writeCachedArchitectureContract(graphPath, input) {
-    if (!graphPath) throw new Error('graph path is required for extension contract cache')
-    const contract = normalizeArchitectureContract(input)
-    const path = join(dirname(graphPath), 'architecture.contract.json')
-    mkdirSync(dirname(path), {recursive: true})
-    writeFileSync(path, JSON.stringify(contract, null, 2), 'utf8')
-    return {path, contract}
-}

package/src/analysis/architecture/contract-verification.js

@@ -1,168 +0,0 @@
-import {
-    architectureHash,
-    architecturePathPrefix,
-    finiteArchitectureBudget,
-    normalizeArchitectureContract,
-} from './contract-schema.js'
-import {
-    architectureViolation as violation,
-    collectComponentEdges,
-    collectComponentFitness,
-    componentForFile,
-    fileOfNode,
-    isSymbolNode,
-    matchComponentSelector as matches,
-    runtimeFileGraph,
-    stronglyConnected,
-} from './contract-graph.js'
-
-function dependencyViolations(componentEdges, contract) {
-    const violations = []
-    for (const edge of componentEdges.values()) {
-        const applicable = contract.dependencyRules.filter((rule) =>
-            rule.kinds.some((kind) => kind === 'any' || kind === edge.kind) && matches(rule.from, edge.from))
-        for (const rule of applicable) if (rule.action === 'forbid' && matches(rule.to, edge.to)) {
-            violations.push(violation(rule.id, 'dependency', `${edge.from} -> ${edge.to} (${edge.kind})`, edge.count, 0))
-        }
-        const allowRules = applicable.filter((rule) => rule.action === 'allow')
-        if (allowRules.length && !allowRules.some((rule) => matches(rule.to, edge.to))) {
-            const ruleId = allowRules.map((rule) => rule.id).sort().join('+')
-            violations.push(violation(ruleId, 'dependency', `${edge.from} -> ${edge.to} (${edge.kind}; outside allow-list)`, edge.count, 0))
-        }
-    }
-    return violations
-}
-
-function componentBudgetViolations(componentEdges, stats, contract) {
-    const violations = []
-    const targetsByComponent = new Map()
-    for (const edge of componentEdges.values()) if (edge.kind === 'runtime') {
-        const targets = targetsByComponent.get(edge.from) || new Set()
-        targets.add(edge.to)
-        targetsByComponent.set(edge.from, targets)
-    }
-    if (contract.budgets.maxRuntimeDependenciesPerComponent != null) for (const [component, targets] of targetsByComponent) {
-        if (targets.size > contract.budgets.maxRuntimeDependenciesPerComponent) violations.push(violation(
-            'budget.maxRuntimeDependenciesPerComponent', 'budget', `${component} runtime dependencies`, targets.size,
-            contract.budgets.maxRuntimeDependenciesPerComponent,
-        ))
-    }
-    for (const [component, item] of stats) {
-        const internal = item.internalPairs.size, boundary = item.boundaryPairs.size
-        const cohesion = internal + boundary ? internal / (internal + boundary) : 1
-        const boundaryRatio = internal + boundary ? boundary / (internal + boundary) : 0
-        if (contract.budgets.maxModuleFiles != null && item.files.size > contract.budgets.maxModuleFiles) {
-            violations.push(violation('budget.maxModuleFiles', 'budget', `${component} files`, item.files.size, contract.budgets.maxModuleFiles))
-        }
-        if (contract.budgets.minModuleCohesion != null && cohesion < contract.budgets.minModuleCohesion) {
-            violations.push(violation('budget.minModuleCohesion', 'budget', `${component} cohesion`, Number(cohesion.toFixed(4)), contract.budgets.minModuleCohesion))
-        }
-        if (contract.budgets.maxModuleBoundaryRatio != null && boundaryRatio > contract.budgets.maxModuleBoundaryRatio) {
-            violations.push(violation('budget.maxModuleBoundaryRatio', 'budget', `${component} boundary ratio`, Number(boundaryRatio.toFixed(4)), contract.budgets.maxModuleBoundaryRatio))
-        }
-    }
-    return violations
-}
-
-function codeBudgetViolations(nodes, byId, contract) {
-    const violations = []
-    for (const node of nodes) {
-        const loc = finiteArchitectureBudget(node?.complexity?.loc)
-        const cyclomatic = finiteArchitectureBudget(node?.complexity?.cyclomatic)
-        const params = finiteArchitectureBudget(node?.complexity?.params)
-        const evidence = `${node.source_file || fileOfNode(node.id, byId)}#${node.label || node.id}`
-        if (contract.budgets.maxFunctionLoc != null && loc != null && loc > contract.budgets.maxFunctionLoc) {
-            violations.push(violation('budget.maxFunctionLoc', 'budget', evidence, loc, contract.budgets.maxFunctionLoc))
-        }
-        if (contract.budgets.maxCyclomatic != null && cyclomatic != null && cyclomatic > contract.budgets.maxCyclomatic) {
-            violations.push(violation('budget.maxCyclomatic', 'budget', evidence, cyclomatic, contract.budgets.maxCyclomatic))
-        }
-        if (contract.budgets.maxParams != null && params != null && params > contract.budgets.maxParams) {
-            violations.push(violation('budget.maxParams', 'budget', evidence, params, contract.budgets.maxParams))
-        }
-    }
-    if (contract.budgets.maxFileLoc != null) for (const node of nodes.filter((item) => !isSymbolNode(item.id))) {
-        const file = String(node.source_file || node.id)
-        const physicalLoc = finiteArchitectureBudget(node.physical_loc)
-        if (physicalLoc != null && physicalLoc > contract.budgets.maxFileLoc) {
-            violations.push(violation('budget.maxFileLoc', 'budget', file, physicalLoc, contract.budgets.maxFileLoc))
-        }
-    }
-    return violations
-}
-
-function technologyViolations(contract, technologies) {
-    const techSet = new Set(technologies.map((item) => String(item ?? '').trim()).filter(Boolean))
-    const violations = []
-    for (const required of contract.technologies.required) if (!techSet.has(required)) {
-        violations.push(violation('technology.required', 'technology', `missing ${required}`))
-    }
-    for (const forbidden of contract.technologies.forbidden) if (techSet.has(forbidden)) {
-        violations.push(violation('technology.forbidden', 'technology', `forbidden ${forbidden}`))
-    }
-    return violations
-}
-
-const componentFitnessMetrics = (stats) => Object.fromEntries([...stats].map(([component, item]) => {
-    const internal = item.internalPairs.size, boundary = item.boundaryPairs.size
-    return [component, {
-        files: item.files.size,
-        cohesion: internal + boundary ? Number((internal / (internal + boundary)).toFixed(4)) : 1,
-        boundaryRatio: internal + boundary ? Number((boundary / (internal + boundary)).toFixed(4)) : 0,
-    }]
-}))
-
-export function verifyArchitecture({graph, contract: rawContract, technologies = []}) {
-    const contract = rawContract?.contractHash ? rawContract : normalizeArchitectureContract(rawContract)
-    const {nodes, links, byId, componentEdges} = collectComponentEdges(graph, contract)
-    const stats = collectComponentFitness(nodes, links, byId, contract)
-    const runtimeCycles = stronglyConnected(runtimeFileGraph(graph))
-    const violations = [
-        ...dependencyViolations(componentEdges, contract),
-        ...componentBudgetViolations(componentEdges, stats, contract),
-        ...codeBudgetViolations(nodes, byId, contract),
-        ...technologyViolations(contract, technologies),
-    ]
-    if (contract.budgets.runtimeCycles != null && runtimeCycles.length > contract.budgets.runtimeCycles) {
-        violations.push(violation('budget.runtimeCycles', 'budget', `runtime cycles: ${runtimeCycles.length}`, runtimeCycles.length, contract.budgets.runtimeCycles))
-    }
-    const exceptions = new Set(contract.exceptions
-        .filter((item) => !item.expires || item.expires >= new Date().toISOString().slice(0, 10))
-        .map((item) => item.fingerprint))
-    const active = violations.filter((item) => !exceptions.has(item.fingerprint))
-    const baseline = new Set(contract.ratchet.baseline.fingerprints)
-    const current = new Set(active.map((item) => item.fingerprint))
-    const fresh = active.filter((item) => !baseline.has(item.fingerprint))
-    const existing = active.filter((item) => baseline.has(item.fingerprint))
-    const fixed = [...baseline].filter((fingerprint) => !current.has(fingerprint))
-    const status = contract.enforcement === 'advisory'
-        ? 'ADVISORY'
-        : contract.enforcement === 'strict' ? (active.length ? 'FAIL' : 'PASS') : (fresh.length ? 'FAIL' : 'PASS')
-    const result = {
-        architectureVerificationV: 1,
-        contractHash: contract.contractHash,
-        status,
-        enforcement: contract.enforcement,
-        metrics: {
-            runtimeCycles: runtimeCycles.length,
-            violations: active.length,
-            componentDependencies: componentEdges.size,
-            mappedComponents: contract.components.length,
-            componentFitness: componentFitnessMetrics(stats),
-        },
-        new: fresh,
-        existing,
-        fixed,
-        excepted: violations.filter((item) => exceptions.has(item.fingerprint)),
-        componentEdges: [...componentEdges.values()].sort((a, b) => a.from.localeCompare(b.from) || a.to.localeCompare(b.to) || a.kind.localeCompare(b.kind)),
-        runtimeCycles: runtimeCycles.slice(0, 100),
-    }
-    return {...result, verificationHash: architectureHash(result)}
-}
-
-export function contractForChange(contract, files = []) {
-    const normalized = (Array.isArray(files) ? files.slice(0, 200) : []).map(architecturePathPrefix).filter(Boolean)
-    const components = [...new Set(normalized.map((file) => componentForFile(file, contract.components)))]
-    const rules = contract.dependencyRules.filter((rule) => components.some((component) => matches(rule.from, component) || matches(rule.to, component)))
-    return {files: normalized, components, rules, budgets: contract.budgets, technologies: contract.technologies}
-}

package/src/analysis/architecture-contract.js

@@ -1,16 +0,0 @@
-// Stable public facade for target-architecture contracts.
-// Owner-specific implementation lives under analysis/architecture so storage,
-// normalization and graph verification can evolve independently.
-export {
-    ARCHITECTURE_CONTRACT_V,
-    normalizeArchitectureContract,
-} from './architecture/contract-schema.js'
-export {
-    CONTRACT_PATHS,
-    loadArchitectureContract,
-    writeCachedArchitectureContract,
-} from './architecture/contract-storage.js'
-export {
-    contractForChange,
-    verifyArchitecture,
-} from './architecture/contract-verification.js'

package/src/analysis/audit-debt.js

@@ -1,94 +0,0 @@
-// Deterministic health-debt comparison. Supply-chain findings are deliberately excluded: an
-// immutable source checkout has no trustworthy per-repository OSV refresh stamp or installed-package
-// malware state, so calling those findings new/fixed would manufacture certainty.
-const OPTIONAL_CATEGORIES = new Set(["vulnerability", "malware"]);
-
-const normalizePath = (value) => String(value || "").trim()
-  .replace(/\\/g, "/")
-  .replace(/^\.\//, "")
-  .replace(/\/{2,}/g, "/")
-  .replace(/\/$/, "");
-
-export function normalizeAuditScopeFiles(input, maxFiles = 500) {
-  if (!Array.isArray(input)) return { ok: true, files: null };
-  const files = [];
-  const seen = new Set();
-  for (const raw of input) {
-    const file = normalizePath(raw);
-    if (!file || file.includes("\0") || file.startsWith("/") || /^[A-Za-z]:\//.test(file) || file === ".." || file.startsWith("../") || file.includes("/../") || file.startsWith("-")) {
-      return { ok: false, files: [], error: `changed_files contains an invalid repo-relative path: ${String(raw || "(empty)")}` };
-    }
-    if (!seen.has(file)) { seen.add(file); files.push(file); }
-    if (files.length > maxFiles) return { ok: false, files: [], error: `changed_files exceeds the ${maxFiles}-file safety bound` };
-  }
-  if (!files.length) return { ok: false, files: [], error: "changed_files was provided but empty" };
-  return { ok: true, files: files.sort((a, b) => a.localeCompare(b)) };
-}
-
-export function auditFindingFiles(finding) {
-  const values = [finding?.file, finding?.manifest, finding?.graphNodeId];
-  for (const evidence of finding?.evidence || []) values.push(evidence?.file);
-  return [...new Set(values
-    .map((value) => normalizePath(String(value || "").split("#", 1)[0]))
-    .filter(Boolean))]
-    .sort((a, b) => a.localeCompare(b));
-}
-
-export function findingTouchesAuditScope(finding, changedFiles) {
-  if (changedFiles == null) return true;
-  const scope = changedFiles instanceof Set ? changedFiles : new Set(changedFiles.map(normalizePath));
-  return auditFindingFiles(finding).some((file) => scope.has(file));
-}
-
-export function scopeAuditFindings(findings, changedFiles) {
-  const scope = changedFiles == null ? null : new Set(changedFiles.map(normalizePath));
-  return (findings || []).filter((finding) => findingTouchesAuditScope(finding, scope));
-}
-
-const comparable = (findings) => (findings || []).filter((finding) => !OPTIONAL_CATEGORIES.has(finding.category));
-const optional = (findings) => (findings || []).filter((finding) => OPTIONAL_CATEGORIES.has(finding.category));
-
-// Findings already carry stable IDs from makeFinding(). Compare globally first, then apply the
-// changed-file scope. This prevents pre-existing debt in an edited file from becoming "new".
-export function compareAuditDebt(currentAudit, baselineAudit, changedFiles = null, { completeChangeSet = false } = {}) {
-  const current = comparable(currentAudit?.findings);
-  const baseline = comparable(baselineAudit?.findings);
-  const currentIds = new Set(current.map((finding) => String(finding.id)));
-  const baselineIds = new Set(baseline.map((finding) => String(finding.id)));
-  const scopedCurrent = scopeAuditFindings(current, changedFiles);
-  const scopedBaseline = scopeAuditFindings(baseline, changedFiles);
-  const globalFresh = current.filter((finding) => !baselineIds.has(String(finding.id)));
-  const globalFixedFindings = baseline.filter((finding) => !currentIds.has(String(finding.id)));
-  // A complete, automatically derived Git diff is the causal boundary: a new manifest-level finding
-  // can be caused by editing only its former importer, so path intersection would hide it. Explicit
-  // changed_files may be a subset of other working-tree changes and therefore stays path-scoped.
-  const fresh = completeChangeSet ? globalFresh : scopedCurrent.filter((finding) => !baselineIds.has(String(finding.id)));
-  const existing = scopedCurrent.filter((finding) => baselineIds.has(String(finding.id)));
-  const fixed = completeChangeSet ? globalFixedFindings : scopedBaseline.filter((finding) => !currentIds.has(String(finding.id)));
-  const all = [...fresh, ...existing].sort((a, b) => String(a.id).localeCompare(String(b.id)));
-  const globalNew = globalFresh.length;
-  const globalExisting = current.length - globalNew;
-  const globalFixed = globalFixedFindings.length;
-  return {
-    scope: {strategy: completeChangeSet ? "complete-change-set-causality" : "path-intersection"},
-    new: fresh,
-    existing,
-    fixed,
-    all: all.map((finding) => ({ ...finding, debtState: baselineIds.has(String(finding.id)) ? "existing" : "new" })),
-    optional: {
-      current: optional(currentAudit?.findings),
-      baseline: optional(baselineAudit?.findings),
-      checks: ["osv", "malware"].map((name) => ({
-        name,
-        status: "UNCOMPARABLE",
-        current: currentAudit?.checks?.[name]?.status || "ERROR",
-        baseline: baselineAudit?.checks?.[name]?.status || "ERROR",
-        reason: "The immutable source checkout cannot reproduce the current advisory-refresh or installed-package scan state.",
-      })),
-    },
-    totals: {
-      scope: { new: fresh.length, existing: existing.length, fixed: fixed.length, active: fresh.length + existing.length },
-      repository: { new: globalNew, existing: globalExisting, fixed: globalFixed, active: current.length },
-    },
-  };
-}

package/src/analysis/audit-extensions.js

@@ -1,60 +0,0 @@
-import {sortFindings, summarizeFindings} from './findings.js'
-
-const VALID_STATUS = new Set(['CHECKED', 'NOT_CHECKED', 'PARTIAL', 'ERROR', 'NOT_SUPPORTED'])
-const VALID_COMPLETENESS = new Set(['COMPLETE', 'PARTIAL'])
-
-const providerFailure = (provider, reason) => ({
-    id: provider.id,
-    extension: provider.extension || null,
-    status: 'ERROR',
-    completeness: 'PARTIAL',
-    detail: reason,
-    findings: [],
-})
-
-const normalizeResult = (provider, value) => {
-    if (!value || typeof value !== 'object') return providerFailure(provider, 'provider returned no result envelope')
-    const status = VALID_STATUS.has(value.status) ? value.status : 'ERROR'
-    const completeness = VALID_COMPLETENESS.has(value.completeness) ? value.completeness : 'PARTIAL'
-    const findings = Array.isArray(value.findings) ? value.findings.map((finding) => ({
-        ...finding,
-        source: finding?.source || `extension:${provider.extension || provider.id}`,
-    })) : []
-    return {
-        id: provider.id,
-        extension: provider.extension || null,
-        status,
-        completeness,
-        detail: String(value.detail || (status === 'ERROR' ? 'provider returned an invalid status' : 'extension analyzer completed')),
-        findings,
-        evidence: value.evidence ?? null,
-    }
-}
-
-// Extension analyzers are deliberately local. A provider failure stays explicit ERROR/PARTIAL and
-// never converts missing evidence into a clean result for the core audit.
-export async function applyAuditExtensions(coreAudit, {providers = [], repoRoot, graph, args = {}} = {}) {
-    if (!coreAudit?.ok || !providers.length) return coreAudit
-    const results = []
-    for (const provider of providers) {
-        try {
-            const value = await provider.run({repoRoot, graph, args, coreAudit})
-            results.push(normalizeResult(provider, value))
-        } catch (error) {
-            results.push(providerFailure(provider, error instanceof Error ? error.message : String(error)))
-        }
-    }
-    const findings = sortFindings([
-        ...coreAudit.findings,
-        ...results.flatMap((result) => result.findings),
-    ])
-    return {
-        ...coreAudit,
-        findings,
-        summary: summarizeFindings(findings),
-        extensionCapabilities: results.map(({findings: providerFindings, ...result}) => ({
-            ...result,
-            findingCount: providerFindings.length,
-        })),
-    }
-}

package/src/analysis/cargo-dependency-evidence.js

@@ -1,108 +0,0 @@
-import { createRepoBoundary } from "../repo-path.js";
-import { cargoName, parseCargoToml } from "./cargo-manifests.js";
-import { dependencyVerification, makeFinding } from "./findings.js";
-import { listRepoFiles, readRepoText } from "./internal-audit.collect.js";
-import { dependencyScopeOwnsFile, dependencyScopeRoot } from "./dependency/scoped-dependencies.js";
-
-export function collectCargoDependencyEvidence(repoRoot, { files = listRepoFiles(repoRoot), externalImports = [] } = {}) {
-  const boundary = createRepoBoundary(repoRoot);
-  const manifests = files.filter((file) => /(^|\/)Cargo\.toml$/i.test(file));
-  const scopes = manifests.map((file) => ({ file, root: dependencyScopeRoot(file), ...parseCargoToml(readRepoText(boundary, file)) }))
-    .sort((left, right) => right.root.length - left.root.length || left.root.localeCompare(right.root));
-  const workspaceDeps = new Map();
-  for (const scope of scopes) for (const dependency of scope.workspaceDependencies) workspaceDeps.set(cargoName(dependency.alias), dependency);
-  const issues = [];
-  for (const scope of scopes) {
-    scope.dependencies = scope.dependencies.map((dependency) => {
-      if (!dependency.inherited) return dependency;
-      const inherited = workspaceDeps.get(cargoName(dependency.alias));
-      if (!inherited) { issues.push(`${scope.file}: workspace dependency ${dependency.alias} is unresolved`); return dependency; }
-      return { ...dependency, name: inherited.name, version: inherited.version, inherited: true };
-    });
-  }
-  const importsByScope = new Map(scopes.map((scope) => [scope, []]));
-  for (const entry of externalImports) {
-    if (entry.ecosystem !== "crates.io" || !entry.pkg || entry.builtin || entry.unresolved) continue;
-    const owner = scopes.find((scope) => dependencyScopeOwnsFile(scope.root, entry.file));
-    if (owner) importsByScope.get(owner).push(entry);
-  }
-  const findings = [], declared = new Set();
-  let mappedImports = 0, unmappedImports = 0;
-  if (!scopes.length) {
-    const missing = new Map();
-    for (const entry of externalImports.filter((item) => item.ecosystem === "crates.io" && item.pkg && !item.builtin && !item.unresolved)) {
-      if (!missing.has(cargoName(entry.pkg))) missing.set(cargoName(entry.pkg), entry);
-    }
-    for (const [name, entry] of missing) findings.push(makeFinding({
-      category: "unused", rule: "missing-dep", severity: "low", confidence: "high",
-      title: `Rust crate path without Cargo.toml: ${name}`,
-      reason: "An indexed external Rust crate path exists, but no Cargo.toml was discovered.",
-      detail: `"${entry.spec || name}" is used by ${entry.file}, but no Cargo manifest owns the file.`,
-      package: name, file: entry.file, line: entry.line || 0, source: "internal",
-      verification: { evidenceModel: "MANIFEST_PLUS_INDEXED_SOURCE", decision: "ACTION_REQUIRED", manifestDeclaration: { status: "NOT_PRESENT" }, indexedSourceImports: { status: "FOUND", count: 1, files: [entry.file] }, mapping: "Cargo crate name normalization" },
-      fixHint: "initialize or restore the owning Cargo manifest",
-    }));
-  }
-  for (const scope of scopes) {
-    const imports = importsByScope.get(scope);
-    const used = new Map(), missingSeen = new Set();
-    for (const entry of imports) {
-      const imported = cargoName(entry.pkg);
-      // A crate referencing its own package name (routine in examples/, tests/, benches/ and the
-      // [[bin]] that pairs with a [lib]) is a self-reference, never a missing dependency.
-      if (scope.packageName && imported === cargoName(scope.packageName)) { mappedImports++; continue; }
-      const dependency = scope.dependencies.find((item) => cargoName(item.alias) === imported || cargoName(item.name) === imported);
-      if (dependency) {
-        const evidence = used.get(dependency.alias) || [];
-        evidence.push(entry); used.set(dependency.alias, evidence); mappedImports++;
-        continue;
-      }
-      unmappedImports++;
-      if (missingSeen.has(imported)) continue;
-      missingSeen.add(imported);
-      findings.push(makeFinding({
-        category: "unused", rule: "missing-dep", severity: "medium", confidence: "high",
-        title: `Missing Cargo dependency: ${entry.pkg}`,
-        reason: "An indexed external Rust crate path has no matching dependency alias or package name in the nearest Cargo.toml.",
-        detail: `"${entry.spec || entry.pkg}" is used by ${entry.file}, but ${scope.file} does not declare crate "${entry.pkg}" (including workspace inheritance and renamed packages).`,
-        package: entry.pkg, file: entry.file, line: entry.line || 0, manifest: scope.file,
-        evidence: [{ file: entry.file, line: entry.line || 0, snippet: entry.spec || "" }], source: "internal",
-        verification: { evidenceModel: "MANIFEST_PLUS_INDEXED_SOURCE", decision: "ACTION_REQUIRED", manifestDeclaration: { status: "NOT_FOUND", file: scope.file }, indexedSourceImports: { status: "FOUND", count: 1, files: [entry.file] }, mapping: "Cargo alias/package normalization" },
-        fixHint: `cargo add ${entry.pkg}`,
-      }));
-    }
-    for (const dependency of scope.dependencies) {
-      const identity = cargoName(dependency.name);
-      if (!identity) continue;
-      declared.add(`${scope.root || "."}:${identity}`);
-      const evidence = used.get(dependency.alias) || [];
-      if (evidence.length || dependency.optional || dependency.build) continue;
-      findings.push(makeFinding({
-        category: "unused", rule: "unused-dep", severity: dependency.dev ? "info" : "low", confidence: "low",
-        title: `Unused Cargo dependency: ${dependency.name}`,
-        reason: "No indexed Rust use/path/extern-crate evidence maps to this dependency; feature-only, proc-macro, generated and reflective registration remain possible.",
-        detail: `"${dependency.name}" (${dependency.alias}) is declared in ${scope.file}, but no indexed .rs file in that Cargo scope references its crate path. Confirm with cargo check/test and feature combinations before removal.`,
-        package: dependency.name, version: dependency.version, manifest: scope.file, source: "internal",
-        verification: dependencyVerification(scope.file, [], "REVIEW_REQUIRED", "Cargo alias/package normalization"),
-        fixHint: `cargo remove ${dependency.alias} after checking all features and targets`,
-      }));
-    }
-  }
-  const present = manifests.length > 0;
-  return {
-    present,
-    status: present ? "CHECKED" : "NOT_PRESENT",
-    completeness: present ? (issues.length ? "PARTIAL" : "COMPLETE") : "NOT_APPLICABLE",
-    manifests,
-    declared,
-    mappedImports,
-    unmappedImports,
-    findings,
-    reasons: issues,
-    reason: !present
-      ? "No Cargo.toml was discovered."
-      : issues.length
-        ? `Cargo declarations and indexed crate paths were checked, but ${issues.length} workspace inheritance reference(s) remain unresolved.`
-        : `Cargo declarations from ${manifests.length} scope(s), workspace inheritance, renamed packages and every indexed external crate path were compared.`,
-  };
-}

package/src/analysis/cargo-manifests.js

@@ -1,81 +0,0 @@
-const clean = (value) => String(value || "").trim().replace(/^['"]|['"]$/g, "");
-export const cargoName = (value) => clean(value).toLowerCase().replace(/_/g, "-");
-
-function inlineTable(value) {
-  const fields = new Map();
-  for (const match of String(value || "").matchAll(/([A-Za-z][\w.-]*)\s*=\s*("(?:\\.|[^"])*"|'(?:\\.|[^'])*'|true|false)/g)) {
-    fields.set(match[1], clean(match[2]));
-  }
-  return fields;
-}
-
-// Bounded Cargo.toml parser for package/workspace dependency tables. It intentionally owns
-// dependency identity, aliases and concrete versions; feature activation is not treated as usage.
-export function parseCargoToml(text) {
-  const source = String(text || "");
-  const dependencies = [];
-  const workspaceDependencies = [];
-  let section = "", packageName = "", workspace = false;
-  for (const raw of source.split(/\r?\n/)) {
-    const line = raw.replace(/(^|\s)#.*$/, "").trim();
-    if (!line) continue;
-    // Array-of-tables headers ([[bin]], [[example]], [[test]], [[bench]]) are neither the [package]
-    // table nor a dependency table. Recognise them so their `name =`/`path =` keys are not mis-read:
-    // a [[bin]] renamed to a crate ([[bin]] name = "foo") would otherwise overwrite the package name and
-    // make every foo:: import look like a self-reference, and a [[bin]] after [dependencies] would leak
-    // phantom "name"/"path" dependencies.
-    const arrayHeader = /^\[\[([^\]]+)]]$/.exec(line);
-    if (arrayHeader) { section = arrayHeader[1].trim(); continue; }
-    const header = /^\[([^\]]+)]$/.exec(line);
-    if (header) { section = header[1].trim(); workspace ||= section === "workspace"; continue; }
-    const kv = /^([A-Za-z0-9_-]+)\s*=\s*(.+)$/.exec(line);
-    if (!kv) continue;
-    if (section === "package" && kv[1] === "name") { packageName = clean(kv[2]); continue; }
-    const dependencyTable = /^(?:target\..+\.)?(dependencies|dev-dependencies|build-dependencies)$/.exec(section);
-    const workspaceTable = section === "workspace.dependencies";
-    if (!dependencyTable && !workspaceTable) continue;
-    const alias = kv[1], value = kv[2].trim();
-    const table = value.startsWith("{") ? inlineTable(value) : new Map();
-    const version = value.startsWith("{") ? clean(table.get("version")) : clean(value);
-    const name = clean(table.get("package")) || alias;
-    const record = {
-      alias,
-      name,
-      version: /^\d/.test(version) || /^=?\s*\d/.test(version) ? version.replace(/^=\s*/, "") : "",
-      dev: dependencyTable?.[1] === "dev-dependencies",
-      build: dependencyTable?.[1] === "build-dependencies",
-      optional: table.get("optional") === "true",
-      inherited: table.get("workspace") === "true",
-    };
-    (workspaceTable ? workspaceDependencies : dependencies).push(record);
-  }
-  return { packageName, workspace, dependencies, workspaceDependencies };
-}
-
-// Cargo.lock v3/v4 [[package]] records. Registry packages are exact installed crates; workspace
-// and git packages are excluded because OSV crates.io versions must not be inferred for them.
-export function parseCargoLockPackages(text) {
-  const packages = [];
-  let current = null;
-  const flush = () => {
-    if (current?.name && current.version && /^registry\+https:\/\/github\.com\/rust-lang\/crates\.io-index|^registry\+https:\/\/index\.crates\.io\//.test(current.source)) {
-      packages.push({ ecosystem: "crates.io", name: current.name, version: current.version, dev: false, integrity: current.checksum || "", source: "cargo-lock" });
-    }
-  };
-  for (const raw of String(text || "").split(/\r?\n/)) {
-    const line = raw.trim();
-    if (line === "[[package]]") { flush(); current = { name: "", version: "", source: "", checksum: "" }; continue; }
-    if (!current) continue;
-    if (/^\[/.test(line)) { flush(); current = null; continue; }
-    const match = /^(name|version|source|checksum)\s*=\s*"([^"]+)"/.exec(line);
-    if (match) current[match[1]] = match[2];
-  }
-  flush();
-  const seen = new Set();
-  return packages.filter((pkg) => {
-    const key = `${pkg.name}@${pkg.version}`;
-    if (seen.has(key)) return false;
-    seen.add(key);
-    return true;
-  });
-}