@alimaandev/ripple 0.6.0 → 0.7.0

package/dist/bin.js

@@ -3,16 +3,18 @@ import { rippleConfigSchema, DEFAULT_CONFIG, formatSchemaIssues } from './chunk-
 import { CommanderError, Command } from 'commander';
 import { createJiti } from 'jiti';
 import path8 from 'path';
-import fs from 'fs/promises';
+import fs3 from 'fs/promises';
 import fs2 from 'fs';
 import { Project, ts, SyntaxKind } from 'ts-morph';
 import chalk from 'chalk';
 import figures from 'figures';
 import treeify from 'treeify';
+import { createHash } from 'crypto';
 import fg from 'fast-glob';
 import ora from 'ora';
 import picomatch from 'picomatch';
 import { execFileSync } from 'child_process';
+import { createInterface } from 'readline';
 
 // src/output/writer.ts
 var TerminalWriter = class {
@@ -38,7 +40,7 @@ var ExitCode = {
 };
 async function pathExists(filePath) {
   try {
-    await fs.access(filePath);
+    await fs3.access(filePath);
     return true;
   } catch {
     return false;
@@ -54,7 +56,7 @@ function pathExistsSync(filePath) {
 }
 async function readFileSafe(filePath) {
   try {
-    return await fs.readFile(filePath, "utf8");
+    return await fs3.readFile(filePath, "utf8");
   } catch {
     return void 0;
   }
@@ -269,8 +271,8 @@ async function loadProjectContext(cwd, explicitConfigPath) {
 function cycleMemberPaths(graph) {
   const members = /* @__PURE__ */ new Set();
   for (const cycle of graph.cycles) {
-    for (const path13 of cycle.members) {
-      members.add(path13);
+    for (const path15 of cycle.members) {
+      members.add(path15);
     }
   }
   return members;
@@ -393,6 +395,7 @@ function createCategorizer(options) {
   };
 }
 async function detectEntryPoints(rootDir) {
+  const started = Date.now();
   const entryPoints = /* @__PURE__ */ new Set();
   const packageJsonPath = await findPackageJson(rootDir);
   if (packageJsonPath) {
@@ -411,6 +414,9 @@ async function detectEntryPoints(rootDir) {
       }
     }
   }
+  if (process.env.RIPPLE_TRACE === "1") {
+    console.error(`[trace] detectEntryPoints: ${Date.now() - started}ms`);
+  }
   return entryPoints;
 }
 
@@ -974,12 +980,12 @@ function renderGraphReport(input, options, writer) {
   writer.writeLine();
   if (input.forward) {
     writer.writeLine(sectionHeader("Dependants (forward)", style));
-    writer.writeLine(renderTree(input.forward.map((path13) => ({ label: path13 }))));
+    writer.writeLine(renderTree(input.forward.map((path15) => ({ label: path15 }))));
     writer.writeLine();
   }
   if (input.reverse) {
     writer.writeLine(sectionHeader("Dependents (reverse)", style));
-    writer.writeLine(renderTree(input.reverse.map((path13) => ({ label: path13 }))));
+    writer.writeLine(renderTree(input.reverse.map((path15) => ({ label: path15 }))));
     writer.writeLine();
   }
   writer.writeLine(sectionHeader("Circular dependencies", style));
@@ -1018,6 +1024,158 @@ function serializeJson(report) {
   return `${JSON.stringify(report, null, 2)}
 `;
 }
+var LEVEL_INDEX = { LOW: 0, MEDIUM: 1, HIGH: 2, CRITICAL: 3 };
+var GATE_INDEX = { medium: 1, high: 2, critical: 3 };
+var INFORMATION_URI = "https://github.com/alimaandev/ripple";
+function riskToSarifLevel(level) {
+  switch (level) {
+    case "CRITICAL":
+    case "HIGH":
+      return "error";
+    case "MEDIUM":
+      return "warning";
+    default:
+      return "note";
+  }
+}
+function primaryLocationHash(ruleId, uri, score) {
+  return createHash("sha256").update(`${ruleId}|${uri}|${score.toFixed(1)}`).digest("hex");
+}
+var RISK_RULE = {
+  id: "ripple/risk",
+  name: "riskScore",
+  shortDescription: {
+    text: "Risk of changing a file's blast radius"
+  },
+  fullDescription: {
+    text: "Ripple scores how risky a change to a file is \u2014 its impact area, affected files, and circular-dependency membership \u2014 and gates merges on the resulting level."
+  },
+  defaultConfiguration: { level: "warning" },
+  properties: { tags: ["ripple", "impact-analysis"] }
+};
+function fileResult(entry, gate) {
+  const { rel, result, allowed } = entry;
+  const level = allowed ? "note" : riskToSarifLevel(result.risk.level);
+  const blocked = LEVEL_INDEX[result.risk.level] >= GATE_INDEX[gate];
+  const score = result.risk.score.toFixed(1);
+  const affected = result.summary.affectedFiles;
+  const message = allowed ? `Allowlisted: ${result.risk.level} risk (${score}/100) - ${affected} affected file(s)` : `${result.risk.level} risk (${score}/100) - ${affected} affected file(s)`;
+  const entryResult = {
+    ruleId: "ripple/risk",
+    level,
+    message: { text: message },
+    locations: [
+      {
+        physicalLocation: {
+          artifactLocation: { uri: rel },
+          region: { startLine: 1 }
+        }
+      }
+    ],
+    partialFingerprints: {
+      primaryLocationLineHash: primaryLocationHash("ripple/risk", rel, result.risk.score)
+    },
+    properties: {
+      ripple: {
+        score: result.risk.score,
+        level: result.risk.level,
+        affectedFiles: result.summary.affectedFiles,
+        targetInCycle: result.targetInCycle,
+        allowed,
+        blocked,
+        gate
+      }
+    }
+  };
+  if (allowed) {
+    entryResult.suppressions = [
+      { kind: "inSource", justification: "Allowlisted via diff.allow in ripple config" }
+    ];
+  }
+  return entryResult;
+}
+function buildDiffSarif(options) {
+  const { baseLabel, entries, gate, counts, blocked, durationMs, version } = options;
+  const results = entries.map((entry) => fileResult(entry, gate));
+  return {
+    $schema: "https://json.schemastore.org/sarif-2.1.0.json",
+    version: "2.1.0",
+    runs: [
+      {
+        tool: {
+          driver: {
+            name: "ripple",
+            fullName: "Ripple \u2014 dependency impact analysis",
+            informationUri: INFORMATION_URI,
+            version,
+            rules: [RISK_RULE]
+          }
+        },
+        results,
+        properties: {
+          ripple: {
+            command: "diff",
+            base: baseLabel,
+            gate,
+            blocked,
+            counts,
+            durationMs
+          }
+        }
+      }
+    ]
+  };
+}
+function buildAnalyzeSarif(options) {
+  const { result, cwd, version } = options;
+  const rel = result.targetPath.slice(cwd.length).replace(/^[/\\]+/, "").replace(/\\/g, "/");
+  const uri = rel || result.targetPath;
+  return {
+    $schema: "https://json.schemastore.org/sarif-2.1.0.json",
+    version: "2.1.0",
+    runs: [
+      {
+        tool: {
+          driver: {
+            name: "ripple",
+            fullName: "Ripple \u2014 dependency impact analysis",
+            informationUri: INFORMATION_URI,
+            version,
+            rules: [RISK_RULE]
+          }
+        },
+        results: [
+          {
+            ruleId: "ripple/risk",
+            level: riskToSarifLevel(result.risk.level),
+            message: {
+              text: `${result.risk.level} risk (${result.risk.score.toFixed(1)}/100) - ${result.summary.affectedFiles} affected file(s)`
+            },
+            locations: [
+              {
+                physicalLocation: {
+                  artifactLocation: { uri },
+                  region: { startLine: 1 }
+                }
+              }
+            ],
+            partialFingerprints: {
+              primaryLocationLineHash: primaryLocationHash("ripple/risk", uri, result.risk.score)
+            },
+            properties: {
+              ripple: {
+                score: result.risk.score,
+                level: result.risk.level,
+                affectedFiles: result.summary.affectedFiles,
+                targetInCycle: result.targetInCycle
+              }
+            }
+          }
+        ]
+      }
+    ]
+  };
+}
 function createTsProject() {
   return new Project({
     skipAddingFilesFromTsConfig: true,
@@ -1057,7 +1215,7 @@ function isSourceFile(filePath) {
 
 // src/scanner/discover.ts
 async function discoverSourceFiles(options) {
-  const ignoreGlobs = options.ignore.map(toIgnoreGlob).filter((glob) => glob !== "").concat(["**/node_modules/**"]);
+  const ignoreGlobs = options.ignore.map(toIgnoreGlob).filter((glob) => glob !== "").concat(["**/node_modules/**", "**/.ripple/**"]);
   const files = await globFiles({
     cwd: options.rootDir,
     patterns: options.include,
@@ -1199,13 +1357,24 @@ function parseSourceFile(project, filePath) {
       parseError: error instanceof Error ? error.message : String(error)
     };
   }
-  return {
-    path: filePath,
-    kind: sourceFileKind(filePath) ?? "ts",
-    imports: extractImports(sourceFile),
-    exports: extractExports(sourceFile),
-    symbols: extractSymbols(sourceFile)
-  };
+  try {
+    return {
+      path: filePath,
+      kind: sourceFileKind(filePath) ?? "ts",
+      imports: extractImports(sourceFile),
+      exports: extractExports(sourceFile),
+      symbols: extractSymbols(sourceFile)
+    };
+  } catch (error) {
+    return {
+      path: filePath,
+      kind: sourceFileKind(filePath) ?? "ts",
+      imports: [],
+      exports: { named: [], hasDefault: false, reExportedFrom: [], reExportedAll: [] },
+      symbols: { functions: [], classes: [], interfaces: [], enums: [], typeAliases: [] },
+      parseError: error instanceof Error ? error.message : String(error)
+    };
+  }
 }
 function parseMany(project, filePaths) {
   return filePaths.map((filePath) => parseSourceFile(project, filePath));
@@ -1271,8 +1440,8 @@ function findCycles(graph) {
     }
     const members = [...component].sort();
     const componentSet = new Set(component);
-    const path13 = representativeCyclePath(graph, component, componentSet);
-    cycles.push({ members, path: path13 ?? [members[0], members[0]] });
+    const path15 = representativeCyclePath(graph, component, componentSet);
+    cycles.push({ members, path: path15 ?? [members[0], members[0]] });
   }
   cycles.sort(
     (a, b) => a.members.length - b.members.length || a.members[0].localeCompare(b.members[0])
@@ -1281,14 +1450,14 @@ function findCycles(graph) {
 }
 function representativeCyclePath(graph, component, componentSet) {
   const inPath = /* @__PURE__ */ new Set();
-  const path13 = [];
+  const path15 = [];
   let current = component[0];
   for (let steps = 0; steps <= component.length * 2 && current !== void 0; steps++) {
     const firstOccurrence = inPath.has(current);
     if (firstOccurrence) {
-      const start = path13.indexOf(current);
+      const start = path15.indexOf(current);
       if (start === -1) return void 0;
-      const cycle = path13.slice(start);
+      const cycle = path15.slice(start);
       if (cycle.length > 1 || graph.forward.get(current)?.has(current)) {
         cycle.push(current);
         return cycle;
@@ -1296,7 +1465,7 @@ function representativeCyclePath(graph, component, componentSet) {
       return void 0;
     }
     inPath.add(current);
-    path13.push(current);
+    path15.push(current);
     const next = [...graph.forward.get(current) ?? []].find(
       (candidate) => componentSet.has(candidate)
     );
@@ -1379,7 +1548,14 @@ function resolveImports(fromPath, importSpecifiers, context) {
 
 // src/graph/build.ts
 function buildGraph(project, filePaths, context) {
-  const parsedFiles = parseMany(project, filePaths);
+  return buildGraphFromParsed(parseMany(project, filePaths), context);
+}
+function buildGraphFromParsed(parsedFiles, context) {
+  const started = Date.now();
+  const trace = process.env.RIPPLE_TRACE === "1";
+  const mark = (label) => {
+    if (trace) console.error(`[trace] graph.${label}: ${Date.now() - started}ms`);
+  };
   const nodes = /* @__PURE__ */ new Map();
   const forward = /* @__PURE__ */ new Map();
   const reverse = /* @__PURE__ */ new Map();
@@ -1393,6 +1569,7 @@ function buildGraph(project, filePaths, context) {
     nodes.set(key, { path: parsed.path, parsed });
     if (!parsed.parseError) parsedCount++;
   }
+  mark("nodes");
   for (const parsed of parsedFiles) {
     const fromKey = pathKey(parsed.path, context.rootDir);
     const targets = /* @__PURE__ */ new Set();
@@ -1436,26 +1613,206 @@ function buildGraph(project, filePaths, context) {
       cycles: 0
     }
   };
+  mark("edges");
   graph.cycles = findCycles(graph);
   graph.stats.cycles = graph.cycles.length;
+  mark("cycles");
   return graph;
 }
+var CACHE_SCHEMA = 2;
+var CACHE_FILE = path8.join(".ripple", "cache", "parsed-v2.json");
+var cacheEnabled = () => process.env.RIPPLE_NO_CACHE !== "1";
+async function contentHash(filePath) {
+  const bytes = await fs3.readFile(filePath);
+  return createHash("sha256").update(bytes).digest("hex");
+}
+function configCacheHash(config) {
+  const stable = {
+    include: [...config.include].sort(),
+    ignore: [...config.ignore].sort()
+  };
+  return createHash("sha256").update(JSON.stringify(stable)).digest("hex");
+}
+function relPosix(rootDir, absPath) {
+  return toPosix(path8.relative(rootDir, absPath));
+}
+function cachePath(rootDir) {
+  return path8.join(rootDir, CACHE_FILE);
+}
+async function loadParsedCache(rootDir, configHash) {
+  let raw;
+  try {
+    raw = await fs3.readFile(cachePath(rootDir), "utf8");
+  } catch {
+    return /* @__PURE__ */ new Map();
+  }
+  try {
+    const manifest = JSON.parse(raw);
+    if (manifest.schema !== CACHE_SCHEMA || manifest.configHash !== configHash) {
+      return /* @__PURE__ */ new Map();
+    }
+    return new Map(Object.entries(manifest.files ?? {}));
+  } catch {
+    return /* @__PURE__ */ new Map();
+  }
+}
+async function saveParsedCache(rootDir, configHash, entries) {
+  const manifest = {
+    schema: CACHE_SCHEMA,
+    configHash,
+    files: Object.fromEntries(entries)
+  };
+  const target = cachePath(rootDir);
+  const tmp = target + ".tmp";
+  try {
+    await fs3.mkdir(path8.dirname(target), { recursive: true });
+    await fs3.writeFile(tmp, JSON.stringify(manifest), "utf8");
+    await fs3.rename(tmp, target);
+  } catch {
+    try {
+      await fs3.rm(tmp, { force: true });
+    } catch {
+    }
+  }
+}
+async function loadParsedFiles(options) {
+  const { project, rootDir, filePaths, config } = options;
+  if (!cacheEnabled()) {
+    return {
+      parsedFiles: parseMany(project, filePaths),
+      stats: { hits: 0, misses: filePaths.length }
+    };
+  }
+  const configHash = configCacheHash(config);
+  const cached = await loadParsedCache(rootDir, configHash);
+  const trace = process.env.RIPPLE_TRACE === "1";
+  const traceAt = (label, from) => {
+    if (trace) console.error(`[trace] cache.${label}: ${Date.now() - from}ms`);
+    return Date.now();
+  };
+  let stage = Date.now();
+  const states = await Promise.all(
+    filePaths.map(async (abs) => {
+      try {
+        const stat = await fs3.stat(abs);
+        return { abs, rel: relPosix(rootDir, abs), size: stat.size, mtimeMs: stat.mtimeMs };
+      } catch {
+        return { abs, rel: relPosix(rootDir, abs), size: -1, mtimeMs: -1 };
+      }
+    })
+  );
+  stage = traceAt("load-cache", stage);
+  const hits = /* @__PURE__ */ new Map();
+  const stale = [];
+  const parsed = /* @__PURE__ */ new Map();
+  let dirty = false;
+  for (const state of states) {
+    const entry = cached.get(state.rel);
+    if (entry !== void 0 && entry.size === state.size && entry.mtimeMs === state.mtimeMs && state.mtimeMs > 0) {
+      hits.set(state.rel, entry);
+      parsed.set(state.rel, { ...entry.parsed, path: state.abs });
+      continue;
+    }
+    let hash = "";
+    try {
+      hash = await contentHash(state.abs);
+    } catch {
+    }
+    if (entry !== void 0 && entry.hash === hash) {
+      if (entry.mtimeMs !== state.mtimeMs || entry.size !== state.size) {
+        hits.set(state.rel, { ...entry, size: state.size, mtimeMs: state.mtimeMs });
+        dirty = true;
+      } else {
+        hits.set(state.rel, entry);
+      }
+      parsed.set(state.rel, { ...entry.parsed, path: state.abs });
+    } else {
+      stale.push(state.abs);
+      dirty = true;
+    }
+  }
+  if (stale.length > 0) {
+    for (const filePath of stale) {
+      project.getSourceFile(filePath)?.forget();
+    }
+    for (const parsedFile of parseMany(project, stale)) {
+      parsed.set(relPosix(rootDir, parsedFile.path), parsedFile);
+    }
+  }
+  traceAt("freshness+parse", stage);
+  if (dirty) {
+    const next = new Map(hits);
+    for (const parsedFile of parsed.values()) {
+      const rel = relPosix(rootDir, parsedFile.path);
+      if (next.has(rel)) continue;
+      const state = states.find((candidate) => candidate.rel === rel);
+      let hash = "";
+      try {
+        hash = await contentHash(parsedFile.path);
+      } catch {
+      }
+      next.set(rel, {
+        hash,
+        size: state?.size ?? -1,
+        mtimeMs: state?.mtimeMs ?? -1,
+        parsed: { ...parsedFile, path: rel }
+      });
+    }
+    await saveParsedCache(rootDir, configHash, next);
+    traceAt("save", stage);
+  }
+  const parsedFiles = filePaths.map((abs) => {
+    const rel = relPosix(rootDir, abs);
+    const parsedFile = parsed.get(rel);
+    if (parsedFile === void 0) {
+      return {
+        path: abs,
+        kind: "ts",
+        imports: [],
+        exports: { named: [], hasDefault: false, reExportedFrom: [], reExportedAll: [] },
+        symbols: { functions: [], classes: [], interfaces: [], enums: [], typeAliases: [] },
+        parseError: "file disappeared during discovery"
+      };
+    }
+    return parsedFile;
+  });
+  return {
+    parsedFiles,
+    stats: { hits: hits.size, misses: stale.length }
+  };
+}
 
 // src/commands/pipeline.ts
 async function runPipeline(context) {
   const started = Date.now();
+  const trace = process.env.RIPPLE_TRACE === "1";
+  const mark = (label) => {
+    if (trace) console.error(`[trace] pipeline.${label}: ${Date.now() - started}ms`);
+  };
   const project = createTsProject();
+  mark("ts-project");
   const filePaths = await discoverSourceFiles({
     rootDir: context.rootDir,
     include: context.config.include,
     ignore: context.config.ignore
   });
-  const graph = buildGraph(project, filePaths, {
+  mark("discover");
+  const { parsedFiles, stats } = await loadParsedFiles({
+    project,
+    rootDir: context.rootDir,
+    filePaths,
+    config: context.config
+  });
+  if (trace) console.error(`[trace] cache: ${stats.hits} hits, ${stats.misses} misses`);
+  mark("parsed");
+  const graph = buildGraphFromParsed(parsedFiles, {
     rootDir: context.rootDir,
     aliases: context.aliases,
     fileKeys: new Set(filePaths.map((p) => pathKey(p, context.rootDir)))
   });
+  mark("graph");
   const entryPoints = await detectEntryPoints(context.rootDir);
+  mark("entry-points");
   return { graph, filePaths, entryPoints, durationMs: Date.now() - started };
 }
 function resolveTargetFile(fileArg, cwd) {
@@ -1498,6 +1855,12 @@ async function analyzeCommand(fileArg, options, ctx2) {
     ctx2.writer.write(serializeJson(report));
     return ExitCode.Success;
   }
+  if (options.sarif) {
+    ctx2.writer.write(
+      serializeJson(buildAnalyzeSarif({ result, cwd: ctx2.cwd, version: ctx2.version }))
+    );
+    return ExitCode.Success;
+  }
   renderAnalyzeReport(
     result,
     {
@@ -1952,7 +2315,7 @@ async function initCommand(options, ctx2) {
   const fileName = options.ts ? "ripple.config.ts" : "ripple.config.json";
   const target = path8.join(ctx2.cwd, fileName);
   try {
-    await fs.access(target);
+    await fs3.access(target);
     if (!options.force) {
       const mark = style.color ? chalk.red(icon("cross")) : icon("cross");
       ctx2.writer.writeLine(`${mark} ${fileName} already exists. Pass --force to overwrite it.`);
@@ -1963,7 +2326,7 @@ async function initCommand(options, ctx2) {
   const content = options.ts ? tsPayload(Boolean(options.full)) : `${JSON.stringify(jsonPayload(Boolean(options.full)), null, 2)}
 `;
   try {
-    await fs.writeFile(target, content, "utf8");
+    await fs3.writeFile(target, content, "utf8");
     const mark = style.color ? chalk.green(icon("tick")) : icon("tick");
     ctx2.writer.writeLine(`${mark} Wrote ${fileName}`);
     ctx2.writer.writeLine(
@@ -2030,8 +2393,8 @@ function changedFiles(cwd, base) {
 }
 
 // src/formatter/annotations.ts
-var LEVEL_INDEX = { LOW: 0, MEDIUM: 1, HIGH: 2, CRITICAL: 3 };
-var GATE_INDEX = { medium: 1, high: 2, critical: 3 };
+var LEVEL_INDEX2 = { LOW: 0, MEDIUM: 1, HIGH: 2, CRITICAL: 3 };
+var GATE_INDEX2 = { medium: 1, high: 2, critical: 3 };
 function escapeProperty(value) {
   return value.replace(/%/g, "%25").replace(/\r/g, "%0D").replace(/\n/g, "%0A").replace(/:/g, "%3A").replace(/,/g, "%2C");
 }
@@ -2044,7 +2407,7 @@ function renderAnnotation(annotation) {
 }
 function buildFileAnnotations(files, gate) {
   return files.map(({ file, result }) => {
-    const blocked = LEVEL_INDEX[result.risk.level] >= GATE_INDEX[gate];
+    const blocked = LEVEL_INDEX2[result.risk.level] >= GATE_INDEX2[gate];
     return {
       level: blocked ? "error" : "warning",
       file,
@@ -2054,12 +2417,12 @@ function buildFileAnnotations(files, gate) {
   });
 }
 function buildGateAnnotation(blocked, gate, counts) {
-  const gateIndex = GATE_INDEX[gate];
+  const gateIndex = GATE_INDEX2[gate];
   const parts = [];
-  if (LEVEL_INDEX.CRITICAL >= gateIndex && counts.critical > 0)
+  if (LEVEL_INDEX2.CRITICAL >= gateIndex && counts.critical > 0)
     parts.push(`${counts.critical} CRITICAL`);
-  if (LEVEL_INDEX.HIGH >= gateIndex && counts.high > 0) parts.push(`${counts.high} HIGH`);
-  if (LEVEL_INDEX.MEDIUM >= gateIndex && counts.medium > 0) parts.push(`${counts.medium} MEDIUM`);
+  if (LEVEL_INDEX2.HIGH >= gateIndex && counts.high > 0) parts.push(`${counts.high} HIGH`);
+  if (LEVEL_INDEX2.MEDIUM >= gateIndex && counts.medium > 0) parts.push(`${counts.medium} MEDIUM`);
   const atGate = parts.length > 0 ? parts.join(" \xB7 ") : "none";
   return {
     level: "notice",
@@ -2069,8 +2432,8 @@ function buildGateAnnotation(blocked, gate, counts) {
 }
 
 // src/commands/diff.ts
-var LEVEL_INDEX2 = { LOW: 0, MEDIUM: 1, HIGH: 2, CRITICAL: 3 };
-var GATE_INDEX2 = { medium: 1, high: 2, critical: 3 };
+var LEVEL_INDEX3 = { LOW: 0, MEDIUM: 1, HIGH: 2, CRITICAL: 3 };
+var GATE_INDEX3 = { medium: 1, high: 2, critical: 3 };
 var VERDICT_NOTE = {
   medium: "no MEDIUM or worse",
   high: "no HIGH or CRITICAL",
@@ -2083,20 +2446,20 @@ function countLevels(results) {
   }
   return counts;
 }
-function isAllowedByDiffAllowlist(relPath, patterns) {
+function isAllowedByDiffAllowlist(relPath2, patterns) {
   if (patterns.length === 0) return false;
-  const rel = toPosix(relPath);
+  const rel = toPosix(relPath2);
   const matcher = picomatch(patterns.map(toPosix), { dot: true });
   return matcher(rel);
 }
 function riskySummary(counts, gate) {
-  const gateIndex = GATE_INDEX2[gate];
+  const gateIndex = GATE_INDEX3[gate];
   const parts = [];
-  if (LEVEL_INDEX2.CRITICAL >= gateIndex && counts.critical > 0)
+  if (LEVEL_INDEX3.CRITICAL >= gateIndex && counts.critical > 0)
     parts.push(`${counts.critical} CRITICAL`);
-  if (LEVEL_INDEX2.HIGH >= gateIndex && counts.high > 0) parts.push(`${counts.high} HIGH`);
-  if (LEVEL_INDEX2.MEDIUM >= gateIndex && counts.medium > 0) parts.push(`${counts.medium} MEDIUM`);
-  if (LEVEL_INDEX2.LOW >= gateIndex && counts.low > 0) parts.push(`${counts.low} LOW`);
+  if (LEVEL_INDEX3.HIGH >= gateIndex && counts.high > 0) parts.push(`${counts.high} HIGH`);
+  if (LEVEL_INDEX3.MEDIUM >= gateIndex && counts.medium > 0) parts.push(`${counts.medium} MEDIUM`);
+  if (LEVEL_INDEX3.LOW >= gateIndex && counts.low > 0) parts.push(`${counts.low} LOW`);
   return parts.length > 0 ? parts.join(" \xB7 ") : "none";
 }
 async function diffCommand(options, ctx2) {
@@ -2143,7 +2506,7 @@ async function diffCommand(options, ctx2) {
   const gateResults = entries.filter((entry) => !entry.allowed).map((entry) => entry.result);
   const counts = countLevels(gateResults);
   const allowedCount = entries.filter((entry) => entry.allowed).length;
-  const blocked = gateResults.some((result) => LEVEL_INDEX2[result.risk.level] >= GATE_INDEX2[gate]);
+  const blocked = gateResults.some((result) => LEVEL_INDEX3[result.risk.level] >= GATE_INDEX3[gate]);
   const durationMs = Date.now() - started;
   if (format === "json") {
     ctx2.writer.write(
@@ -2164,6 +2527,22 @@ async function diffCommand(options, ctx2) {
     );
     return blocked ? ExitCode.Failure : ExitCode.Success;
   }
+  if (format === "sarif") {
+    ctx2.writer.write(
+      serializeJson(
+        buildDiffSarif({
+          baseLabel: changed.baseLabel,
+          entries,
+          gate,
+          counts,
+          blocked,
+          durationMs,
+          version: ctx2.version
+        })
+      )
+    );
+    return blocked ? ExitCode.Failure : ExitCode.Success;
+  }
   if (format === "github") {
     const annotations = [
       ...buildFileAnnotations(
@@ -2232,7 +2611,7 @@ function renderDiffReport(input, writer) {
   writer.writeLine();
   writer.writeLine(sectionHeader(`Risk analysis (${entries.length} files)`, style));
   for (const { result, allowed } of entries) {
-    const risky = LEVEL_INDEX2[result.risk.level] >= GATE_INDEX2[gate];
+    const risky = LEVEL_INDEX3[result.risk.level] >= GATE_INDEX3[gate];
     const fileIcon = risky ? icon("cross") : icon("tick");
     const fileIconText = style.color ? risky ? chalk.red(fileIcon) : chalk.green(fileIcon) : fileIcon;
     const score = result.risk.score.toFixed(1);
@@ -2280,6 +2659,440 @@ function buildDiffJsonReport(baseLabel, changedFileNames, byRel, allowedByRel, g
   };
 }
 
+// src/mcp/server.ts
+var PROTOCOL_VERSION = "2025-06-18";
+var ERR_PARSE = -32700;
+var ERR_INVALID_REQUEST = -32600;
+var ERR_INTERNAL = -32603;
+function isObject(value) {
+  return typeof value === "object" && value !== null;
+}
+var McpServer = class {
+  options;
+  tools = /* @__PURE__ */ new Map();
+  constructor(options) {
+    this.options = options;
+    for (const tool of options.tools) {
+      this.tools.set(tool.name, tool);
+    }
+  }
+  /**
+   * Process one inbound message. Returns the JSON-RPC response line to write
+   * back, or `null` for notifications and invalid requests.
+   */
+  async handleLine(line) {
+    let message;
+    try {
+      message = JSON.parse(line);
+    } catch {
+      return this.response(void 0, {
+        code: ERR_PARSE,
+        message: "Parse error: not valid JSON"
+      });
+    }
+    if (!isObject(message) || message.jsonrpc !== "2.0") {
+      return this.response(void 0, {
+        code: ERR_INVALID_REQUEST,
+        message: "Invalid Request: expected a JSON-RPC 2.0 object"
+      });
+    }
+    const hasId = "id" in message;
+    if (message.method === "notifications/initialized") {
+      return null;
+    }
+    if (!hasId) {
+      return null;
+    }
+    const method = message.method;
+    if (typeof method !== "string") {
+      return this.response(message.id, {
+        code: ERR_INVALID_REQUEST,
+        message: "Invalid Request: method must be a string"
+      });
+    }
+    try {
+      const result = await this.dispatch(method, message.params);
+      return this.response(message.id, result);
+    } catch (error) {
+      return this.response(message.id, {
+        code: ERR_INTERNAL,
+        message: error instanceof Error ? error.message : "Internal error"
+      });
+    }
+  }
+  async dispatch(method, params) {
+    switch (method) {
+      case "initialize":
+        return {
+          protocolVersion: this.protocolVersion(params),
+          capabilities: { tools: { listChanged: false } },
+          serverInfo: { name: this.options.name, version: this.options.version }
+        };
+      case "ping":
+        return {};
+      case "tools/list":
+        return {
+          tools: [...this.tools.values()].map((tool) => ({
+            name: tool.name,
+            description: tool.description,
+            inputSchema: tool.inputSchema
+          }))
+        };
+      case "tools/call":
+        return this.callTool(params);
+      case "tools/list_changed":
+        throw new Error("Tool list changes are not supported by this server");
+      default:
+        throw new Error(`Method not found: ${method}`);
+    }
+  }
+  protocolVersion(params) {
+    if (isObject(params) && typeof params.protocolVersion === "string") {
+      return params.protocolVersion;
+    }
+    return PROTOCOL_VERSION;
+  }
+  async callTool(params) {
+    if (!isObject(params) || typeof params.name !== "string") {
+      throw new Error("Invalid params: expected { name: string, arguments?: object }");
+    }
+    const tool = this.tools.get(params.name);
+    if (!tool) {
+      throw new Error(`Unknown tool: ${params.name}`);
+    }
+    const args = isObject(params.arguments) || params.arguments === void 0 ? params.arguments ?? {} : null;
+    if (args === null) {
+      throw new Error(`Invalid arguments for tool ${params.name}: expected an object`);
+    }
+    try {
+      const result = await tool.handler(args);
+      return {
+        content: [{ type: "text", text: result.text }],
+        ...result.isError ? { isError: true } : {}
+      };
+    } catch (error) {
+      return {
+        content: [
+          {
+            type: "text",
+            text: error instanceof Error ? error.message : "Tool failed"
+          }
+        ],
+        isError: true
+      };
+    }
+  }
+  response(id, payload) {
+    if (typeof payload === "object" && payload !== null && "code" in payload && typeof payload.code === "number") {
+      const errorPayload = payload;
+      const error = { code: errorPayload.code, message: String(errorPayload.message) };
+      return `${JSON.stringify({ jsonrpc: "2.0", id: id ?? null, error })}
+`;
+    }
+    return `${JSON.stringify({ jsonrpc: "2.0", id: id ?? null, result: payload })}
+`;
+  }
+};
+var MAX_DEPENDENTS = 200;
+function ok(text) {
+  return { text };
+}
+function fail(error) {
+  return { text: error instanceof Error ? error.message : "Tool failed", isError: true };
+}
+function requireString(args, key, tool) {
+  const value = args[key];
+  if (typeof value !== "string" || value.trim() === "") {
+    throw new RippleError(`Missing required argument "${key}" for ${tool}`, ExitCode.Failure);
+  }
+  return value;
+}
+function optionalPositiveInt(args, key, tool) {
+  const value = args[key];
+  if (value === void 0) return void 0;
+  if (typeof value !== "number" || !Number.isInteger(value) || value < 1) {
+    throw new RippleError(
+      `Argument "${key}" for ${tool} must be a positive integer`,
+      ExitCode.Failure
+    );
+  }
+  return value;
+}
+function resolveFile(cwd, file) {
+  return path8.isAbsolute(file) ? file : path8.join(cwd, file);
+}
+function analyzeIn(project, cwd, file, maxDepth) {
+  const { context, graph, entryPoints } = project;
+  const targetPath = resolveFile(cwd, file);
+  const key = pathKey(targetPath, context.rootDir);
+  const node = graph.nodes.get(key);
+  if (!node) {
+    throw new RippleError(
+      `File not found in the project graph: ${file}. Is it a source file covered by ripple's discovery?`,
+      ExitCode.NotFound
+    );
+  }
+  return analyzeFile({
+    graph,
+    context,
+    entryPoints,
+    targetKey: key,
+    targetPath,
+    durationMs: 0,
+    ...maxDepth !== void 0 ? { maxDepth } : {}
+  });
+}
+function relPath(targetPath, cwd) {
+  const rel = targetPath.slice(cwd.length).replace(/^[/\\]+/, "");
+  return (rel || targetPath).replace(/\\/g, "/");
+}
+var IMPACT_SCHEMA = {
+  type: "object",
+  properties: {
+    file: {
+      type: "string",
+      description: "Project-relative or absolute path of the file to analyze."
+    },
+    maxDepth: {
+      type: "integer",
+      minimum: 1,
+      description: "Cap the reverse traversal depth (default: unlimited)."
+    }
+  },
+  required: ["file"]
+};
+var DEPENDENTS_SCHEMA = {
+  type: "object",
+  properties: {
+    file: {
+      type: "string",
+      description: "Project-relative or absolute path of the file."
+    },
+    depth: {
+      type: "integer",
+      minimum: 1,
+      description: "Max dependency depth to report (default: 1, direct dependents only)."
+    }
+  },
+  required: ["file"]
+};
+var RISK_SCHEMA = {
+  type: "object",
+  properties: {
+    file: {
+      type: "string",
+      description: "Project-relative or absolute path of the file."
+    }
+  },
+  required: ["file"]
+};
+var GATE_SCHEMA = {
+  type: "object",
+  properties: {
+    base: {
+      type: "string",
+      description: "Git ref to diff against (default: origin/main, main, or HEAD~1)."
+    },
+    gate: {
+      type: "string",
+      enum: ["medium", "high", "critical"],
+      description: "Risk level that blocks the merge (default: high)."
+    }
+  }
+};
+var LEVEL_INDEX4 = { LOW: 1, MEDIUM: 2, HIGH: 3, CRITICAL: 4 };
+function createMcpTools(deps) {
+  const { cwd, loadProject, getChanged } = deps;
+  return [
+    {
+      name: "impact",
+      description: "Blast-radius analysis of a file: how many files, routes, tests and components would be affected by changing it, plus its risk score. Call before editing or refactoring a file so the change set stays low-risk.",
+      inputSchema: IMPACT_SCHEMA,
+      handler: async (args) => {
+        try {
+          const file = requireString(args, "file", "impact");
+          const maxDepth = optionalPositiveInt(args, "maxDepth", "impact");
+          const project = await loadProject();
+          const result = analyzeIn(project, cwd, file, maxDepth);
+          return ok(
+            JSON.stringify(
+              {
+                file: relPath(result.targetPath, cwd),
+                risk: { score: result.risk.score, level: result.risk.level },
+                summary: result.summary,
+                targetInCycle: result.targetInCycle
+              },
+              null,
+              2
+            )
+          );
+        } catch (error) {
+          return fail(error);
+        }
+      }
+    },
+    {
+      name: "dependents",
+      description: "List the files that depend on a file (its importers), up to a depth. Depth 1 is direct dependents; deeper levels are transitive. Useful to know who breaks when the file changes.",
+      inputSchema: DEPENDENTS_SCHEMA,
+      handler: async (args) => {
+        try {
+          const file = requireString(args, "file", "dependents");
+          const depth = optionalPositiveInt(args, "depth", "dependents") ?? 1;
+          const project = await loadProject();
+          const result = analyzeIn(project, cwd, file);
+          const dependents = [...result.affected.values()].filter((affected) => affected.depth <= depth).sort((a, b) => a.depth - b.depth || a.path.localeCompare(b.path)).map((affected) => ({
+            path: relPath(affected.path, cwd),
+            depth: affected.depth,
+            direct: affected.direct,
+            inCycle: affected.inCycle,
+            categories: affected.categories
+          }));
+          return ok(
+            JSON.stringify(
+              {
+                file: relPath(result.targetPath, cwd),
+                depth,
+                count: dependents.length,
+                truncated: dependents.length > MAX_DEPENDENTS,
+                dependents: dependents.slice(0, MAX_DEPENDENTS)
+              },
+              null,
+              2
+            )
+          );
+        } catch (error) {
+          return fail(error);
+        }
+      }
+    },
+    {
+      name: "risk",
+      description: "The risk score (0-100) of changing a file and the factor breakdown behind it. Cheap way to compare the danger of different refactor targets.",
+      inputSchema: RISK_SCHEMA,
+      handler: async (args) => {
+        try {
+          const file = requireString(args, "file", "risk");
+          const project = await loadProject();
+          const result = analyzeIn(project, cwd, file);
+          return ok(
+            JSON.stringify(
+              {
+                file: relPath(result.targetPath, cwd),
+                score: result.risk.score,
+                level: result.risk.level,
+                targetInCycle: result.targetInCycle,
+                factors: result.risk.factors
+              },
+              null,
+              2
+            )
+          );
+        } catch (error) {
+          return fail(error);
+        }
+      }
+    },
+    {
+      name: "gate_status",
+      description: "Check the current change set against the ripple merge gate: which files changed since the base ref, their risk levels, and whether the gate passes or blocks. Call after editing files to verify the changes are safe to merge.",
+      inputSchema: GATE_SCHEMA,
+      handler: async (args) => {
+        try {
+          const base = args.base;
+          const gate = args.gate;
+          if (base !== void 0 && typeof base !== "string") {
+            return fail(
+              new RippleError('Argument "base" for gate_status must be a string', ExitCode.Failure)
+            );
+          }
+          if (gate !== void 0 && gate !== "medium" && gate !== "high" && gate !== "critical") {
+            return fail(
+              new RippleError(
+                'Argument "gate" for gate_status must be medium | high | critical',
+                ExitCode.Failure
+              )
+            );
+          }
+          const changed = getChanged(base);
+          const project = await loadProject();
+          const resolvedGate = gate ?? project.context.config.diff.gate ?? "high";
+          const gateIndex = LEVEL_INDEX4[resolvedGate.toUpperCase()] ?? 3;
+          const files = [];
+          const counts = { low: 0, medium: 0, high: 0, critical: 0 };
+          let blocked = false;
+          for (const rel of changed.files) {
+            try {
+              const result = analyzeIn(project, cwd, rel);
+              const level = result.risk.level;
+              counts[level.toLowerCase()] += 1;
+              if ((LEVEL_INDEX4[level] ?? 1) >= gateIndex) blocked = true;
+              files.push({
+                file: rel,
+                analyzed: true,
+                level,
+                score: result.risk.score,
+                affectedFiles: result.summary.affectedFiles,
+                targetInCycle: result.targetInCycle
+              });
+            } catch {
+              files.push({ file: rel, analyzed: false });
+            }
+          }
+          return ok(
+            JSON.stringify(
+              {
+                base: changed.baseLabel,
+                changedFiles: changed.files.length,
+                files,
+                counts,
+                gate: { level: resolvedGate, blocked, verdict: blocked ? "block" : "pass" }
+              },
+              null,
+              2
+            )
+          );
+        } catch (error) {
+          return fail(error);
+        }
+      }
+    }
+  ];
+}
+
+// src/commands/mcp.ts
+async function mcpCommand(options, ctx2) {
+  let snapshot = null;
+  const loadProject = async () => {
+    if (!snapshot) {
+      const context = await loadProjectContext(ctx2.cwd, options.config);
+      const { graph, entryPoints } = await runPipeline(context);
+      snapshot = { context, graph, entryPoints };
+    }
+    return snapshot;
+  };
+  const server = new McpServer({
+    name: "ripple",
+    version: ctx2.version,
+    tools: createMcpTools({
+      cwd: ctx2.cwd,
+      loadProject,
+      getChanged: (base) => changedFiles(ctx2.cwd, base)
+    })
+  });
+  const stdin = createInterface({ input: process.stdin, crlfDelay: Infinity });
+  await new Promise((resolve) => {
+    stdin.on("line", (line) => {
+      if (!line.trim()) return;
+      void server.handleLine(line).then((response) => {
+        if (response) process.stdout.write(response);
+      });
+    });
+    stdin.on("close", () => resolve());
+  });
+  return ExitCode.Success;
+}
+
 // src/cli/program.ts
 var PROGRAM_NAME = "ripple";
 function helpExamples(examples) {
@@ -2297,11 +3110,12 @@ function createProgram(ctx2) {
       "ripple analyze src/authentication/login.ts",
       "ripple analyze src/index.ts --depth 3"
     ])
-  ).option("-j, --json", "emit a machine-readable JSON report").option("-v, --verbose", "include the risk factor breakdown").option("-d, --depth <number>", "cap the reverse traversal depth", parsePositiveInt).option("-c, --config <path>", "path to a ripple config file").option("--no-color", "disable ANSI colors").action(async (file, options) => {
+  ).option("-j, --json", "emit a machine-readable JSON report").option("--sarif", "emit a SARIF 2.1.0 report for code scanning").option("-v, --verbose", "include the risk factor breakdown").option("-d, --depth <number>", "cap the reverse traversal depth", parsePositiveInt).option("-c, --config <path>", "path to a ripple config file").option("--no-color", "disable ANSI colors").action(async (file, options) => {
     const exitCode2 = await analyzeCommand(
       file,
       {
         json: Boolean(options.json),
+        sarif: Boolean(options.sarif),
         verbose: Boolean(options.verbose),
         ...options.depth !== void 0 ? { depth: options.depth } : {},
         ...options.config !== void 0 ? { config: options.config } : {},
@@ -2345,7 +3159,11 @@ function createProgram(ctx2) {
   program.command("diff").description("Analyze changed files since a base ref and gate risky changes").addHelpText(
     "after",
     helpExamples(["ripple diff --base main --gate critical", "ripple diff --format github"])
-  ).option("-j, --json", "emit a machine-readable JSON report").option("-f, --format <format>", "output format: terminal | json | github", parseDiffFormat).option("-v, --verbose", "include extra sections").option("-b, --base <ref>", "git ref to diff against (default: origin/main, main, HEAD~1)").option(
+  ).option("-j, --json", "emit a machine-readable JSON report").option(
+    "-f, --format <format>",
+    "output format: terminal | json | github | sarif",
+    parseDiffFormat
+  ).option("-v, --verbose", "include extra sections").option("-b, --base <ref>", "git ref to diff against (default: origin/main, main, HEAD~1)").option(
     "-g, --gate <level>",
     "risk level that blocks the gate (medium | high | critical)",
     parseGateLevel
@@ -2395,6 +3213,20 @@ function createProgram(ctx2) {
       throw new ExitError(exitCode2);
     }
   });
+  program.command("mcp").description("Serve Ripple analysis tools over the Model Context Protocol (stdio)").addHelpText(
+    "after",
+    helpExamples(['ripple mcp  # point an MCP client (Claude, Cursor, ...) at "ripple mcp"'])
+  ).option("-c, --config <path>", "path to a ripple config file").action(async (options) => {
+    const exitCode2 = await mcpCommand(
+      {
+        config: options.config
+      },
+      ctx2
+    );
+    if (exitCode2 !== ExitCode.Success) {
+      throw new ExitError(exitCode2);
+    }
+  });
   program.command("version").description("Print the Ripple version").addHelpText("after", helpExamples(["ripple version"])).action(() => {
     ctx2.writer.writeLine(ctx2.version);
   });
@@ -2435,13 +3267,13 @@ function parseGateLevel(value) {
   );
 }
 function parseDiffFormat(value) {
-  if (value === "terminal" || value === "json" || value === "github") {
+  if (value === "terminal" || value === "json" || value === "github" || value === "sarif") {
     return value;
   }
   throw new CommanderError(
     1,
     "commander.invalidArgument",
-    `expected one of terminal | json | github, got "${value}"`
+    `expected one of terminal | json | github | sarif, got "${value}"`
   );
 }
 function parseGraphFormat(value) {
@@ -2487,7 +3319,7 @@ async function run({ argv, ctx: ctx2 }) {
 
 // package.json
 var package_default = {
-  version: "0.6.0"};
+  version: "0.7.0"};
 
 // src/cli/bin.ts
 var ctx = {