@alimaandev/ripple 0.6.0 → 0.7.1

package/dist/bin.js

@@ -1,18 +1,20 @@
 #!/usr/bin/env node
-import { rippleConfigSchema, DEFAULT_CONFIG, formatSchemaIssues } from './chunk-CFH4UW2E.js';
+import { rippleConfigSchema, DEFAULT_CONFIG, formatSchemaIssues } from './chunk-VSLCAPAH.js';
 import { CommanderError, Command } from 'commander';
 import { createJiti } from 'jiti';
 import path8 from 'path';
-import fs from 'fs/promises';
-import fs2 from 'fs';
+import fs4 from 'fs/promises';
+import fs3 from 'fs';
 import { Project, ts, SyntaxKind } from 'ts-morph';
 import chalk from 'chalk';
 import figures from 'figures';
 import treeify from 'treeify';
+import { createHash, randomUUID } from 'crypto';
 import fg from 'fast-glob';
 import ora from 'ora';
-import picomatch from 'picomatch';
 import { execFileSync } from 'child_process';
+import picomatch from 'picomatch';
+import { createInterface } from 'readline';
 
 // src/output/writer.ts
 var TerminalWriter = class {
@@ -38,7 +40,7 @@ var ExitCode = {
 };
 async function pathExists(filePath) {
   try {
-    await fs.access(filePath);
+    await fs4.access(filePath);
     return true;
   } catch {
     return false;
@@ -46,7 +48,7 @@ async function pathExists(filePath) {
 }
 function pathExistsSync(filePath) {
   try {
-    fs2.accessSync(filePath);
+    fs3.accessSync(filePath);
     return true;
   } catch {
     return false;
@@ -54,7 +56,7 @@ function pathExistsSync(filePath) {
 }
 async function readFileSafe(filePath) {
   try {
-    return await fs.readFile(filePath, "utf8");
+    return await fs4.readFile(filePath, "utf8");
   } catch {
     return void 0;
   }
@@ -269,8 +271,8 @@ async function loadProjectContext(cwd, explicitConfigPath) {
 function cycleMemberPaths(graph) {
   const members = /* @__PURE__ */ new Set();
   for (const cycle of graph.cycles) {
-    for (const path13 of cycle.members) {
-      members.add(path13);
+    for (const path15 of cycle.members) {
+      members.add(path15);
     }
   }
   return members;
@@ -285,14 +287,31 @@ function computeConfidence(stats, targetInCycle) {
   if (targetInCycle) confidence *= 0.95;
   return Math.round(Math.min(1, Math.max(0, confidence)) * 100);
 }
-var SOURCE_EXTENSIONS = [".ts", ".tsx", ".js", ".jsx"];
-var RESOLVABLE_EXTENSIONS = [...SOURCE_EXTENSIONS, ".mjs", ".cjs", ".d.ts"];
+var SOURCE_EXTENSIONS = [
+  ".ts",
+  ".tsx",
+  ".js",
+  ".jsx",
+  ".mts",
+  ".cts",
+  ".mjs",
+  ".cjs"
+];
+var RESOLVABLE_EXTENSIONS = [...SOURCE_EXTENSIONS, ".d.ts"];
 function toPosix(filePath) {
   return filePath.replace(/\\/g, "/");
 }
 function normalizeAbsolute(filePath, cwd) {
   return path8.resolve(cwd, filePath);
 }
+function realPath(filePath, cwd) {
+  const absolute = path8.resolve(cwd, filePath);
+  try {
+    return fs3.realpathSync.native(absolute);
+  } catch {
+    return absolute;
+  }
+}
 function pathKey(filePath, cwd) {
   const absolute = normalizeAbsolute(filePath, cwd);
   const posix = toPosix(absolute);
@@ -306,13 +325,22 @@ function sourceFileKind(filePath) {
 function extensionCandidates(basePath) {
   return RESOLVABLE_EXTENSIONS.map((ext) => basePath + ext);
 }
-function jsToTsCandidate(candidate) {
-  const ext = path8.extname(candidate);
-  if (ext === ".js") return candidate.slice(0, -3) + ".ts";
-  if (ext === ".jsx") return candidate.slice(0, -4) + ".tsx";
-  if (ext === ".mjs") return candidate.slice(0, -4) + ".mts";
-  if (ext === ".cjs") return candidate.slice(0, -4) + ".cts";
-  return candidate;
+function jsToTsCandidates(candidate) {
+  const ext = path8.extname(candidate).toLowerCase();
+  if (ext === "") return [];
+  const stem = candidate.slice(0, -ext.length);
+  switch (ext) {
+    case ".js":
+      return [`${stem}.ts`, `${stem}.tsx`];
+    case ".jsx":
+      return [`${stem}.tsx`];
+    case ".mjs":
+      return [`${stem}.mts`];
+    case ".cjs":
+      return [`${stem}.cts`];
+    default:
+      return [];
+  }
 }
 function displayPath(filePath, cwd) {
   const relative = path8.relative(cwd, filePath);
@@ -393,6 +421,7 @@ function createCategorizer(options) {
   };
 }
 async function detectEntryPoints(rootDir) {
+  const started = Date.now();
   const entryPoints = /* @__PURE__ */ new Set();
   const packageJsonPath = await findPackageJson(rootDir);
   if (packageJsonPath) {
@@ -411,6 +440,9 @@ async function detectEntryPoints(rootDir) {
       }
     }
   }
+  if (process.env.RIPPLE_TRACE === "1") {
+    console.error(`[trace] detectEntryPoints: ${Date.now() - started}ms`);
+  }
   return entryPoints;
 }
 
@@ -827,11 +859,9 @@ function impactLine(result, style) {
   if (summary.utilities > 0) parts.push(pluralize(summary.utilities, "utility"));
   return parts.length > 0 ? parts.join(" \xB7 ") : dim("none", style);
 }
-function buildAffectedTree(result, cwd, style) {
+function buildAffectedTree(result, cwd, style, limit) {
   const { affected, graph } = result;
-  const sorted = [...affected.entries()].sort(
-    ([, a], [, b]) => a.depth - b.depth || a.path.localeCompare(b.path)
-  );
+  const sorted = [...affected.entries()].sort(([, a], [, b]) => a.depth - b.depth || a.path.localeCompare(b.path)).slice(0, limit);
   const nodesByKey = /* @__PURE__ */ new Map();
   const depthByKey = /* @__PURE__ */ new Map();
   for (const [key, file] of sorted) {
@@ -905,9 +935,9 @@ function renderAnalyzeReport(result, options, writer) {
   writer.writeLine();
   if (summary.affectedFiles > 0) {
     writer.writeLine(sectionHeader(`Affected files (${summary.affectedFiles})`, style));
-    const tree = buildAffectedTree(result, options.cwd, style);
-    writer.writeLine(renderTree(tree));
     const limit = options.listLimit ?? DEFAULT_LIST_LIMIT;
+    const tree = buildAffectedTree(result, options.cwd, style, limit);
+    writer.writeLine(renderTree(tree));
     if (summary.affectedFiles > limit) {
       writer.writeLine(
         dim(`${summary.affectedFiles - limit} more\u2026 use --json for the full list`, style)
@@ -939,7 +969,7 @@ function renderAnalyzeReport(result, options, writer) {
   }
 }
 function buildAnalyzeJsonReport(result, version, cwd) {
-  const realPath = (key) => result.graph.nodes.get(key)?.path ?? key;
+  const realPath2 = (key) => result.graph.nodes.get(key)?.path ?? key;
   const affected = [...result.affected.values()].sort((a, b) => a.depth - b.depth || a.path.localeCompare(b.path)).map((file) => ({ ...file, path: displayPath(file.path, cwd) }));
   return {
     tool: "ripple",
@@ -950,8 +980,8 @@ function buildAnalyzeJsonReport(result, version, cwd) {
     summary: result.summary,
     affected,
     cycles: result.graph.cycles.map((cycle) => ({
-      members: cycle.members.map((key) => displayPath(realPath(key), cwd)),
-      path: cycle.path.map((key) => displayPath(realPath(key), cwd))
+      members: cycle.members.map((key) => displayPath(realPath2(key), cwd)),
+      path: cycle.path.map((key) => displayPath(realPath2(key), cwd))
     })),
     targetInCycle: result.targetInCycle,
     durationMs: result.durationMs
@@ -974,12 +1004,12 @@ function renderGraphReport(input, options, writer) {
   writer.writeLine();
   if (input.forward) {
     writer.writeLine(sectionHeader("Dependants (forward)", style));
-    writer.writeLine(renderTree(input.forward.map((path13) => ({ label: path13 }))));
+    writer.writeLine(renderTree(input.forward.map((path15) => ({ label: path15 }))));
     writer.writeLine();
   }
   if (input.reverse) {
     writer.writeLine(sectionHeader("Dependents (reverse)", style));
-    writer.writeLine(renderTree(input.reverse.map((path13) => ({ label: path13 }))));
+    writer.writeLine(renderTree(input.reverse.map((path15) => ({ label: path15 }))));
     writer.writeLine();
   }
   writer.writeLine(sectionHeader("Circular dependencies", style));
@@ -996,7 +1026,7 @@ function renderGraphReport(input, options, writer) {
   }
 }
 function buildGraphJsonReport(input, version) {
-  const realPath = (key) => input.nodes.get(key)?.path ?? key;
+  const realPath2 = (key) => input.nodes.get(key)?.path ?? key;
   return {
     tool: "ripple",
     version,
@@ -1005,8 +1035,8 @@ function buildGraphJsonReport(input, version) {
     edgeCount: input.stats.internalEdges,
     externalEdgeCount: input.stats.externalEdges,
     cycles: input.cycles.map((cycle) => ({
-      members: cycle.members.map((key) => displayPath(realPath(key), input.cwd)),
-      path: cycle.path.map((key) => displayPath(realPath(key), input.cwd))
+      members: cycle.members.map((key) => displayPath(realPath2(key), input.cwd)),
+      path: cycle.path.map((key) => displayPath(realPath2(key), input.cwd))
     })),
     ...input.forward ? { forward: input.forward } : {},
     ...input.reverse ? { reverse: input.reverse } : {}
@@ -1018,6 +1048,159 @@ function serializeJson(report) {
   return `${JSON.stringify(report, null, 2)}
 `;
 }
+var LEVEL_INDEX = { LOW: 0, MEDIUM: 1, HIGH: 2, CRITICAL: 3 };
+var GATE_INDEX = { medium: 1, high: 2, critical: 3 };
+var INFORMATION_URI = "https://github.com/alimaandev/ripple";
+function riskToSarifLevel(level) {
+  switch (level) {
+    case "CRITICAL":
+    case "HIGH":
+      return "error";
+    case "MEDIUM":
+      return "warning";
+    default:
+      return "note";
+  }
+}
+function primaryLocationHash(ruleId, uri) {
+  return createHash("sha256").update(`${ruleId}|${uri}`).digest("hex");
+}
+var RISK_RULE = {
+  id: "ripple/risk",
+  name: "riskScore",
+  shortDescription: {
+    text: "Risk of changing a file's blast radius"
+  },
+  fullDescription: {
+    text: "Ripple scores how risky a change to a file is \u2014 its impact area, affected files, and circular-dependency membership \u2014 and gates merges on the resulting level."
+  },
+  defaultConfiguration: { level: "warning" },
+  properties: { tags: ["ripple", "impact-analysis"] }
+};
+function fileResult(entry, gate) {
+  const { rel, result, allowed } = entry;
+  const uri = entry.repoRel ?? rel;
+  const level = allowed ? "note" : riskToSarifLevel(result.risk.level);
+  const blocked = LEVEL_INDEX[result.risk.level] >= GATE_INDEX[gate];
+  const score = result.risk.score.toFixed(1);
+  const affected = result.summary.affectedFiles;
+  const message = allowed ? `Allowlisted: ${result.risk.level} risk (${score}/100) - ${affected} affected file(s)` : `${result.risk.level} risk (${score}/100) - ${affected} affected file(s)`;
+  const entryResult = {
+    ruleId: "ripple/risk",
+    level,
+    message: { text: message },
+    locations: [
+      {
+        physicalLocation: {
+          artifactLocation: { uri },
+          region: { startLine: 1 }
+        }
+      }
+    ],
+    partialFingerprints: {
+      primaryLocationLineHash: primaryLocationHash("ripple/risk", uri)
+    },
+    properties: {
+      ripple: {
+        score: result.risk.score,
+        level: result.risk.level,
+        affectedFiles: result.summary.affectedFiles,
+        targetInCycle: result.targetInCycle,
+        allowed,
+        blocked,
+        gate
+      }
+    }
+  };
+  if (allowed) {
+    entryResult.suppressions = [
+      { kind: "inSource", justification: "Allowlisted via diff.allow in ripple config" }
+    ];
+  }
+  return entryResult;
+}
+function buildDiffSarif(options) {
+  const { baseLabel, entries, gate, counts, blocked, durationMs, version } = options;
+  const results = entries.map((entry) => fileResult(entry, gate));
+  return {
+    $schema: "https://json.schemastore.org/sarif-2.1.0.json",
+    version: "2.1.0",
+    runs: [
+      {
+        tool: {
+          driver: {
+            name: "ripple",
+            fullName: "Ripple \u2014 dependency impact analysis",
+            informationUri: INFORMATION_URI,
+            version,
+            rules: [RISK_RULE]
+          }
+        },
+        results,
+        properties: {
+          ripple: {
+            command: "diff",
+            base: baseLabel,
+            gate,
+            blocked,
+            counts,
+            durationMs
+          }
+        }
+      }
+    ]
+  };
+}
+function buildAnalyzeSarif(options) {
+  const { result, cwd, version } = options;
+  const rel = result.targetPath.slice(cwd.length).replace(/^[/\\]+/, "").replace(/\\/g, "/");
+  const uri = rel || result.targetPath;
+  return {
+    $schema: "https://json.schemastore.org/sarif-2.1.0.json",
+    version: "2.1.0",
+    runs: [
+      {
+        tool: {
+          driver: {
+            name: "ripple",
+            fullName: "Ripple \u2014 dependency impact analysis",
+            informationUri: INFORMATION_URI,
+            version,
+            rules: [RISK_RULE]
+          }
+        },
+        results: [
+          {
+            ruleId: "ripple/risk",
+            level: riskToSarifLevel(result.risk.level),
+            message: {
+              text: `${result.risk.level} risk (${result.risk.score.toFixed(1)}/100) - ${result.summary.affectedFiles} affected file(s)`
+            },
+            locations: [
+              {
+                physicalLocation: {
+                  artifactLocation: { uri },
+                  region: { startLine: 1 }
+                }
+              }
+            ],
+            partialFingerprints: {
+              primaryLocationLineHash: primaryLocationHash("ripple/risk", uri)
+            },
+            properties: {
+              ripple: {
+                score: result.risk.score,
+                level: result.risk.level,
+                affectedFiles: result.summary.affectedFiles,
+                targetInCycle: result.targetInCycle
+              }
+            }
+          }
+        ]
+      }
+    ]
+  };
+}
 function createTsProject() {
   return new Project({
     skipAddingFilesFromTsConfig: true,
@@ -1057,7 +1240,7 @@ function isSourceFile(filePath) {
 
 // src/scanner/discover.ts
 async function discoverSourceFiles(options) {
-  const ignoreGlobs = options.ignore.map(toIgnoreGlob).filter((glob) => glob !== "").concat(["**/node_modules/**"]);
+  const ignoreGlobs = options.ignore.map(toIgnoreGlob).filter((glob) => glob !== "").concat(["**/node_modules/**", "**/.ripple/**"]);
   const files = await globFiles({
     cwd: options.rootDir,
     patterns: options.include,
@@ -1185,30 +1368,80 @@ function extractSymbols(sourceFile) {
 }
 
 // src/parser/parse.ts
-function parseSourceFile(project, filePath) {
+var MAX_REPORTED_DIAGNOSTICS = 3;
+function diagnosticText(diagnostic) {
+  const message = diagnostic.getMessageText();
+  return typeof message === "string" ? message : message.getMessageText();
+}
+function formatDiagnostics(diagnostics) {
+  const parts = diagnostics.slice(0, MAX_REPORTED_DIAGNOSTICS).map((diagnostic) => {
+    const line = diagnostic.getLineNumber();
+    return `${line !== void 0 ? `line ${line}: ` : ""}${diagnosticText(diagnostic)}`;
+  });
+  const suffix = diagnostics.length > MAX_REPORTED_DIAGNOSTICS ? ` (+${diagnostics.length - MAX_REPORTED_DIAGNOSTICS} more)` : "";
+  return `${parts.join("; ")}${suffix}`;
+}
+function collectSyntacticErrors(project, filePaths) {
+  const errors = /* @__PURE__ */ new Map();
+  if (filePaths.length === 0) return errors;
+  const targets = new Set(filePaths.map((filePath) => pathKey(filePath, process.cwd())));
+  let diagnostics;
+  try {
+    diagnostics = project.getProgram().getSyntacticDiagnostics();
+  } catch {
+    return errors;
+  }
+  const byFile = /* @__PURE__ */ new Map();
+  for (const diagnostic of diagnostics) {
+    const key = pathKey(diagnostic.getSourceFile().getFilePath(), process.cwd());
+    if (!targets.has(key)) continue;
+    const list = byFile.get(key) ?? [];
+    list.push(diagnostic);
+    byFile.set(key, list);
+  }
+  for (const [key, list] of byFile) {
+    errors.set(key, formatDiagnostics(list));
+  }
+  return errors;
+}
+function emptySurface(filePath, kind, parseError) {
+  return {
+    path: filePath,
+    kind,
+    imports: [],
+    exports: { named: [], hasDefault: false, reExportedFrom: [], reExportedAll: [] },
+    symbols: { functions: [], classes: [], interfaces: [], enums: [], typeAliases: [] },
+    parseError
+  };
+}
+function parseSurface(project, filePath) {
+  const kind = sourceFileKind(filePath) ?? "ts";
   let sourceFile;
   try {
     sourceFile = project.addSourceFileAtPath(filePath);
   } catch (error) {
+    return emptySurface(filePath, kind, error instanceof Error ? error.message : String(error));
+  }
+  try {
     return {
       path: filePath,
-      kind: sourceFileKind(filePath) ?? "ts",
-      imports: [],
-      exports: { named: [], hasDefault: false, reExportedFrom: [], reExportedAll: [] },
-      symbols: { functions: [], classes: [], interfaces: [], enums: [], typeAliases: [] },
-      parseError: error instanceof Error ? error.message : String(error)
+      kind,
+      imports: extractImports(sourceFile),
+      exports: extractExports(sourceFile),
+      symbols: extractSymbols(sourceFile)
     };
+  } catch (error) {
+    return emptySurface(filePath, kind, error instanceof Error ? error.message : String(error));
   }
-  return {
-    path: filePath,
-    kind: sourceFileKind(filePath) ?? "ts",
-    imports: extractImports(sourceFile),
-    exports: extractExports(sourceFile),
-    symbols: extractSymbols(sourceFile)
-  };
 }
 function parseMany(project, filePaths) {
-  return filePaths.map((filePath) => parseSourceFile(project, filePath));
+  const parsed = filePaths.map((filePath) => parseSurface(project, filePath));
+  const syntaxErrors = collectSyntacticErrors(project, filePaths);
+  return parsed.map((parsedFile) => {
+    if (parsedFile.parseError !== void 0) return parsedFile;
+    const error = syntaxErrors.get(pathKey(parsedFile.path, process.cwd()));
+    return error === void 0 ? parsedFile : emptySurface(parsedFile.path, parsedFile.kind, error);
+  });
 }
 
 // src/graph/cycles.ts
@@ -1271,8 +1504,8 @@ function findCycles(graph) {
     }
     const members = [...component].sort();
     const componentSet = new Set(component);
-    const path13 = representativeCyclePath(graph, component, componentSet);
-    cycles.push({ members, path: path13 ?? [members[0], members[0]] });
+    const path15 = representativeCyclePath(graph, component, componentSet);
+    cycles.push({ members, path: path15 ?? [members[0], members[0]] });
   }
   cycles.sort(
     (a, b) => a.members.length - b.members.length || a.members[0].localeCompare(b.members[0])
@@ -1281,14 +1514,14 @@ function findCycles(graph) {
 }
 function representativeCyclePath(graph, component, componentSet) {
   const inPath = /* @__PURE__ */ new Set();
-  const path13 = [];
+  const path15 = [];
   let current = component[0];
   for (let steps = 0; steps <= component.length * 2 && current !== void 0; steps++) {
     const firstOccurrence = inPath.has(current);
     if (firstOccurrence) {
-      const start = path13.indexOf(current);
+      const start = path15.indexOf(current);
       if (start === -1) return void 0;
-      const cycle = path13.slice(start);
+      const cycle = path15.slice(start);
       if (cycle.length > 1 || graph.forward.get(current)?.has(current)) {
         cycle.push(current);
         return cycle;
@@ -1296,7 +1529,7 @@ function representativeCyclePath(graph, component, componentSet) {
       return void 0;
     }
     inPath.add(current);
-    path13.push(current);
+    path15.push(current);
     const next = [...graph.forward.get(current) ?? []].find(
       (candidate) => componentSet.has(candidate)
     );
@@ -1309,16 +1542,15 @@ function probeCandidates(base, fileKeys, rootDir) {
     const key = pathKey(candidate, rootDir);
     if (fileKeys.has(key)) return path8.normalize(candidate);
   }
-  const jsSwapped = jsToTsCandidate(base);
-  if (jsSwapped !== base) {
-    const swappedKey = pathKey(jsSwapped, rootDir);
-    if (fileKeys.has(swappedKey)) return path8.normalize(jsSwapped);
+  for (const swapped of jsToTsCandidates(base)) {
+    const swappedKey = pathKey(swapped, rootDir);
+    if (fileKeys.has(swappedKey)) return path8.normalize(swapped);
   }
   return void 0;
 }
 function existsOnDisk(filePath) {
   try {
-    fs2.accessSync(filePath);
+    fs3.accessSync(filePath);
     return true;
   } catch {
     return false;
@@ -1342,7 +1574,7 @@ function resolveToFile(base, context) {
   if (fileKeys.has(exactKey)) return path8.normalize(base);
   const probed = probeCandidates(base, fileKeys, rootDir);
   if (probed) return probed;
-  if (existsOnDisk(base) && fs2.statSync(base).isDirectory()) {
+  if (existsOnDisk(base) && fs3.statSync(base).isDirectory()) {
     const indexProbed = probeCandidates(path8.join(base, "index"), fileKeys, rootDir);
     if (indexProbed) return indexProbed;
   }
@@ -1379,7 +1611,14 @@ function resolveImports(fromPath, importSpecifiers, context) {
 
 // src/graph/build.ts
 function buildGraph(project, filePaths, context) {
-  const parsedFiles = parseMany(project, filePaths);
+  return buildGraphFromParsed(parseMany(project, filePaths), context);
+}
+function buildGraphFromParsed(parsedFiles, context) {
+  const started = Date.now();
+  const trace = process.env.RIPPLE_TRACE === "1";
+  const mark = (label) => {
+    if (trace) console.error(`[trace] graph.${label}: ${Date.now() - started}ms`);
+  };
   const nodes = /* @__PURE__ */ new Map();
   const forward = /* @__PURE__ */ new Map();
   const reverse = /* @__PURE__ */ new Map();
@@ -1393,6 +1632,7 @@ function buildGraph(project, filePaths, context) {
     nodes.set(key, { path: parsed.path, parsed });
     if (!parsed.parseError) parsedCount++;
   }
+  mark("nodes");
   for (const parsed of parsedFiles) {
     const fromKey = pathKey(parsed.path, context.rootDir);
     const targets = /* @__PURE__ */ new Set();
@@ -1436,26 +1676,212 @@ function buildGraph(project, filePaths, context) {
       cycles: 0
     }
   };
+  mark("edges");
   graph.cycles = findCycles(graph);
   graph.stats.cycles = graph.cycles.length;
+  mark("cycles");
   return graph;
 }
 
+// package.json
+var package_default = {
+  version: "0.7.1"};
+
+// src/cache/parsed.ts
+var CACHE_SCHEMA = 3;
+var CACHE_FILE = path8.join(".ripple", "cache", "parsed-v3.json");
+var cacheEnabled = () => process.env.RIPPLE_NO_CACHE !== "1";
+async function contentHash(filePath) {
+  const bytes = await fs4.readFile(filePath);
+  return createHash("sha256").update(bytes).digest("hex");
+}
+function configCacheHash(config) {
+  const stable = {
+    parser: `${CACHE_SCHEMA}:${package_default.version}`,
+    include: [...config.include].sort(),
+    ignore: [...config.ignore].sort()
+  };
+  return createHash("sha256").update(JSON.stringify(stable)).digest("hex");
+}
+function relPosix(rootDir, absPath) {
+  return toPosix(path8.relative(rootDir, absPath));
+}
+function cachePath(rootDir) {
+  return path8.join(rootDir, CACHE_FILE);
+}
+async function loadParsedCache(rootDir, configHash) {
+  let raw;
+  try {
+    raw = await fs4.readFile(cachePath(rootDir), "utf8");
+  } catch {
+    return /* @__PURE__ */ new Map();
+  }
+  try {
+    const manifest = JSON.parse(raw);
+    if (manifest.schema !== CACHE_SCHEMA || manifest.configHash !== configHash) {
+      return /* @__PURE__ */ new Map();
+    }
+    return new Map(Object.entries(manifest.files ?? {}));
+  } catch {
+    return /* @__PURE__ */ new Map();
+  }
+}
+async function saveParsedCache(rootDir, configHash, entries) {
+  const manifest = {
+    schema: CACHE_SCHEMA,
+    configHash,
+    files: Object.fromEntries(entries)
+  };
+  const target = cachePath(rootDir);
+  const tmp = `${target}.${process.pid}.${randomUUID()}.tmp`;
+  try {
+    await fs4.mkdir(path8.dirname(target), { recursive: true });
+    await fs4.writeFile(tmp, JSON.stringify(manifest), "utf8");
+    await fs4.rename(tmp, target);
+  } catch {
+    try {
+      await fs4.rm(tmp, { force: true });
+    } catch {
+    }
+  }
+}
+async function loadParsedFiles(options) {
+  const { project, rootDir, filePaths, config } = options;
+  if (!cacheEnabled()) {
+    return {
+      parsedFiles: parseMany(project, filePaths),
+      stats: { hits: 0, misses: filePaths.length }
+    };
+  }
+  const configHash = configCacheHash(config);
+  const cached = await loadParsedCache(rootDir, configHash);
+  const trace = process.env.RIPPLE_TRACE === "1";
+  const traceAt = (label, from) => {
+    if (trace) console.error(`[trace] cache.${label}: ${Date.now() - from}ms`);
+    return Date.now();
+  };
+  let stage = Date.now();
+  const states = await Promise.all(
+    filePaths.map(async (abs) => {
+      try {
+        const stat = await fs4.stat(abs);
+        return { abs, rel: relPosix(rootDir, abs), size: stat.size, mtimeMs: stat.mtimeMs };
+      } catch {
+        return { abs, rel: relPosix(rootDir, abs), size: -1, mtimeMs: -1 };
+      }
+    })
+  );
+  stage = traceAt("load-cache", stage);
+  const stateByRel = new Map(states.map((state) => [state.rel, state]));
+  const hashByRel = /* @__PURE__ */ new Map();
+  const hits = /* @__PURE__ */ new Map();
+  const stale = [];
+  const parsed = /* @__PURE__ */ new Map();
+  let dirty = false;
+  for (const state of states) {
+    const entry = cached.get(state.rel);
+    if (entry !== void 0 && entry.size === state.size && entry.mtimeMs === state.mtimeMs && state.mtimeMs > 0) {
+      hits.set(state.rel, entry);
+      parsed.set(state.rel, { ...entry.parsed, path: state.abs });
+      continue;
+    }
+    let hash = "";
+    try {
+      hash = await contentHash(state.abs);
+    } catch {
+    }
+    hashByRel.set(state.rel, hash);
+    if (entry !== void 0 && entry.hash === hash) {
+      if (entry.mtimeMs !== state.mtimeMs || entry.size !== state.size) {
+        hits.set(state.rel, { ...entry, size: state.size, mtimeMs: state.mtimeMs });
+        dirty = true;
+      } else {
+        hits.set(state.rel, entry);
+      }
+      parsed.set(state.rel, { ...entry.parsed, path: state.abs });
+    } else {
+      stale.push(state.abs);
+      dirty = true;
+    }
+  }
+  if (stale.length > 0) {
+    for (const filePath of stale) {
+      project.getSourceFile(filePath)?.forget();
+    }
+    for (const parsedFile of parseMany(project, stale)) {
+      parsed.set(relPosix(rootDir, parsedFile.path), parsedFile);
+    }
+  }
+  traceAt("freshness+parse", stage);
+  if (dirty) {
+    const next = new Map(hits);
+    for (const stalePath of stale) {
+      const rel = relPosix(rootDir, stalePath);
+      const parsedFile = parsed.get(rel);
+      if (parsedFile === void 0) continue;
+      const state = stateByRel.get(rel);
+      next.set(rel, {
+        hash: hashByRel.get(rel) ?? "",
+        size: state?.size ?? -1,
+        mtimeMs: state?.mtimeMs ?? -1,
+        parsed: { ...parsedFile, path: rel }
+      });
+    }
+    await saveParsedCache(rootDir, configHash, next);
+    traceAt("save", stage);
+  }
+  const parsedFiles = filePaths.map((abs) => {
+    const rel = relPosix(rootDir, abs);
+    const parsedFile = parsed.get(rel);
+    if (parsedFile === void 0) {
+      return {
+        path: abs,
+        kind: "ts",
+        imports: [],
+        exports: { named: [], hasDefault: false, reExportedFrom: [], reExportedAll: [] },
+        symbols: { functions: [], classes: [], interfaces: [], enums: [], typeAliases: [] },
+        parseError: "file disappeared during discovery"
+      };
+    }
+    return parsedFile;
+  });
+  return {
+    parsedFiles,
+    stats: { hits: hits.size, misses: stale.length }
+  };
+}
+
 // src/commands/pipeline.ts
 async function runPipeline(context) {
   const started = Date.now();
+  const trace = process.env.RIPPLE_TRACE === "1";
+  const mark = (label) => {
+    if (trace) console.error(`[trace] pipeline.${label}: ${Date.now() - started}ms`);
+  };
   const project = createTsProject();
+  mark("ts-project");
   const filePaths = await discoverSourceFiles({
     rootDir: context.rootDir,
     include: context.config.include,
     ignore: context.config.ignore
   });
-  const graph = buildGraph(project, filePaths, {
+  mark("discover");
+  const { parsedFiles, stats } = await loadParsedFiles({
+    project,
+    rootDir: context.rootDir,
+    filePaths,
+    config: context.config
+  });
+  if (trace) console.error(`[trace] cache: ${stats.hits} hits, ${stats.misses} misses`);
+  mark("parsed");
+  const graph = buildGraphFromParsed(parsedFiles, {
     rootDir: context.rootDir,
     aliases: context.aliases,
     fileKeys: new Set(filePaths.map((p) => pathKey(p, context.rootDir)))
   });
+  mark("graph");
   const entryPoints = await detectEntryPoints(context.rootDir);
+  mark("entry-points");
   return { graph, filePaths, entryPoints, durationMs: Date.now() - started };
 }
 function resolveTargetFile(fileArg, cwd) {
@@ -1475,29 +1901,35 @@ async function analyzeCommand(fileArg, options, ctx2) {
   if (!await pathExists(targetPath)) {
     throw new RippleError(`File not found: ${fileArg}`, ExitCode.NotFound);
   }
-  const tracker = createStageTracker(!options.json);
+  const tracker = createStageTracker(!options.json && !options.sarif);
   tracker.next("Loading config");
   const started = Date.now();
   const context = await loadProjectContext(ctx2.cwd, options.config);
   tracker.next("Building dependency graph");
-  const { graph, entryPoints, durationMs: pipelineMs } = await runPipeline(context);
+  const { graph, entryPoints } = await runPipeline(context);
   tracker.next("Analyzing impact");
-  const completed = Date.now();
   const result = analyzeFile({
     graph,
     context,
     entryPoints,
     targetKey: requireNode(graph, targetPath, context.rootDir).key,
     targetPath,
-    durationMs: pipelineMs + (completed - started),
+    durationMs: 0,
     ...options.depth !== void 0 ? { maxDepth: options.depth } : {}
   });
+  result.durationMs = Date.now() - started;
   tracker.done();
   if (options.json) {
     const report = buildAnalyzeJsonReport(result, ctx2.version, ctx2.cwd);
     ctx2.writer.write(serializeJson(report));
     return ExitCode.Success;
   }
+  if (options.sarif) {
+    ctx2.writer.write(
+      serializeJson(buildAnalyzeSarif({ result, cwd: ctx2.cwd, version: ctx2.version }))
+    );
+    return ExitCode.Success;
+  }
   renderAnalyzeReport(
     result,
     {
@@ -1811,7 +2243,11 @@ async function doctorCommand(options, ctx2) {
     results.push({ label, state, detail });
   };
   try {
-    check("Node.js runtime", "ok", process.version);
+    check(
+      "Node.js runtime",
+      "ok",
+      options.verbose ? `${process.version} \xB7 ${process.platform}/${process.arch}` : process.version
+    );
     const packageJson = await findPackageJson(ctx2.cwd);
     if (packageJson) {
       check("package.json", "ok", path8.relative(ctx2.cwd, packageJson));
@@ -1875,6 +2311,13 @@ async function doctorCommand(options, ctx2) {
     } else {
       check("circular dependencies", "warn", `${stats.cycles} cycle group(s)`);
     }
+    if (options.verbose) {
+      check(
+        "graph",
+        "ok",
+        `${stats.files} files \xB7 ${stats.internalEdges} internal edges \xB7 ${stats.externalEdges} external \xB7 ${stats.unresolvedEdges} unresolved`
+      );
+    }
   } finally {
     spinner.stop();
   }
@@ -1900,7 +2343,7 @@ function renderResults(results, ctx2, color) {
   }
   ctx2.writer.writeLine();
 }
-var SCHEMA_REF = "./node_modules/@alimaandev/ripple/ripple.schema.json";
+var SCHEMA_REF = "https://raw.githubusercontent.com/alimaandev/ripple/main/ripple.schema.json";
 function jsonPayload(full) {
   const payload = full ? { ...DEFAULT_CONFIG } : { include: DEFAULT_CONFIG.include };
   return { ...payload, $schema: SCHEMA_REF };
@@ -1952,7 +2395,7 @@ async function initCommand(options, ctx2) {
   const fileName = options.ts ? "ripple.config.ts" : "ripple.config.json";
   const target = path8.join(ctx2.cwd, fileName);
   try {
-    await fs.access(target);
+    await fs4.access(target);
     if (!options.force) {
       const mark = style.color ? chalk.red(icon("cross")) : icon("cross");
       ctx2.writer.writeLine(`${mark} ${fileName} already exists. Pass --force to overwrite it.`);
@@ -1963,7 +2406,7 @@ async function initCommand(options, ctx2) {
   const content = options.ts ? tsPayload(Boolean(options.full)) : `${JSON.stringify(jsonPayload(Boolean(options.full)), null, 2)}
 `;
   try {
-    await fs.writeFile(target, content, "utf8");
+    await fs4.writeFile(target, content, "utf8");
     const mark = style.color ? chalk.green(icon("tick")) : icon("tick");
     ctx2.writer.writeLine(`${mark} Wrote ${fileName}`);
     ctx2.writer.writeLine(
@@ -1978,22 +2421,54 @@ async function initCommand(options, ctx2) {
     return ExitCode.Failure;
   }
 }
-var DEFAULT_BASES = ["origin/main", "main", "HEAD~1"];
-function git(args, cwd) {
+var DEFAULT_BASES = ["origin/HEAD", "origin/main", "origin/master", "main", "master"];
+function gitRaw(args, cwd) {
   return execFileSync("git", args, {
     cwd,
     encoding: "utf8",
     stdio: ["ignore", "pipe", "pipe"]
-  }).trim();
+  });
+}
+function chomp(text) {
+  return text.replace(/\r?\n$/, "");
+}
+function git(args, cwd) {
+  return gitRaw(args, cwd).trim();
+}
+function repoRootFor(cwd) {
+  try {
+    const root = chomp(gitRaw(["rev-parse", "--show-toplevel"], cwd));
+    if (root) return realPath(root, cwd);
+  } catch {
+  }
+  throw new RippleError(
+    `Not a git repository: ${cwd}`,
+    ExitCode.NotFound,
+    "ripple diff needs a git repository. Run it from inside one, or pass --base only in a repo."
+  );
 }
 function refExists(ref, cwd) {
   try {
-    const out = git(["rev-parse", "--verify", ref], cwd);
+    const out = git(["rev-parse", "--verify", "--quiet", `${ref}^{commit}`], cwd);
     return out.length > 0;
   } catch {
     return false;
   }
 }
+function sameCommit(left, right, cwd) {
+  try {
+    return git(["rev-parse", `${left}^{commit}`], cwd) === git(["rev-parse", `${right}^{commit}`], cwd);
+  } catch {
+    return false;
+  }
+}
+function hasUncommittedChanges(cwd) {
+  try {
+    return git(["status", "--porcelain", "--untracked-files=normal"], cwd).length > 0;
+  } catch {
+    return false;
+  }
+}
 function resolveBase(cwd, requested) {
   if (requested) {
     if (!refExists(requested, cwd)) {
@@ -2001,37 +2476,77 @@ function resolveBase(cwd, requested) {
     }
     return requested;
   }
-  for (const candidate of DEFAULT_BASES) {
-    if (refExists(candidate, cwd)) return candidate;
+  const candidates = [];
+  const githubBase = process.env.GITHUB_BASE_REF?.trim();
+  if (githubBase) {
+    candidates.push(`origin/${githubBase}`, githubBase);
+  }
+  candidates.push(...DEFAULT_BASES);
+  const seen = /* @__PURE__ */ new Set();
+  let headCandidate;
+  for (const candidate of candidates) {
+    if (seen.has(candidate)) continue;
+    seen.add(candidate);
+    if (!refExists(candidate, cwd)) continue;
+    if (sameCommit(candidate, "HEAD", cwd)) {
+      headCandidate ??= candidate;
+      continue;
+    }
+    return candidate;
+  }
+  if (headCandidate !== void 0) {
+    const detail = hasUncommittedChanges(cwd) ? "Only uncommitted changes are analyzed" : "The working tree is clean, so the change set is empty";
+    process.stderr.write(
+      `ripple: warning: base ref "${headCandidate}" resolves to HEAD. ${detail} \u2014 pass --base <ref> to compare against a branch.
+`
+    );
+    return headCandidate;
+  }
+  if (refExists("HEAD~1", cwd)) {
+    process.stderr.write(
+      "ripple: warning: no branch base found; falling back to HEAD~1. Only the last commit will be analyzed \u2014 pass --base <ref> for a full change set.\n"
+    );
+    return "HEAD~1";
   }
   throw new RippleError(
-    "No git base ref found (tried origin/main, main, HEAD~1). Pass --base <ref> explicitly.",
+    `No git base ref found (tried ${candidates.join(", ")}). Pass --base <ref> explicitly.`,
     ExitCode.NotFound
   );
 }
+function nulPaths(output) {
+  return output.split("\0").filter((entry) => entry.length > 0);
+}
+function isRippleArtifact(repoPath) {
+  return repoPath.replace(/\\/g, "/").split("/").includes(".ripple");
+}
 function changedFiles(cwd, base) {
-  const baseLabel = resolveBase(cwd, base);
+  const repoRoot = repoRootFor(cwd);
+  const baseLabel = resolveBase(repoRoot, base);
   let baseCommit = baseLabel;
   try {
-    const mergeBase = git(["merge-base", baseLabel, "HEAD"], cwd);
+    const mergeBase = git(["merge-base", baseLabel, "HEAD"], repoRoot).split(/\r?\n/)[0]?.trim();
     if (mergeBase) baseCommit = mergeBase;
   } catch {
   }
   const files = /* @__PURE__ */ new Set();
-  const tracked = git(["diff", "--name-only", "--diff-filter=ACMRT", baseCommit], cwd);
-  for (const line of tracked.split("\n")) {
-    if (line.trim()) files.add(line.trim());
+  const tracked = nulPaths(
+    gitRaw(["diff", "--name-only", "-z", "--diff-filter=ACMRT", baseCommit, "--"], repoRoot)
+  );
+  for (const file of tracked) {
+    if (!isRippleArtifact(file)) files.add(file);
   }
-  const untracked = git(["ls-files", "--others", "--exclude-standard"], cwd);
-  for (const line of untracked.split("\n")) {
-    if (line.trim()) files.add(line.trim());
+  const untracked = nulPaths(
+    gitRaw(["ls-files", "--others", "--exclude-standard", "-z"], repoRoot)
+  );
+  for (const file of untracked) {
+    if (!isRippleArtifact(file)) files.add(file);
   }
-  return { baseLabel, files: [...files].sort() };
+  return { baseLabel, repoRoot, files: [...files].sort() };
 }
 
 // src/formatter/annotations.ts
-var LEVEL_INDEX = { LOW: 0, MEDIUM: 1, HIGH: 2, CRITICAL: 3 };
-var GATE_INDEX = { medium: 1, high: 2, critical: 3 };
+var LEVEL_INDEX2 = { LOW: 0, MEDIUM: 1, HIGH: 2, CRITICAL: 3 };
+var GATE_INDEX2 = { medium: 1, high: 2, critical: 3 };
 function escapeProperty(value) {
   return value.replace(/%/g, "%25").replace(/\r/g, "%0D").replace(/\n/g, "%0A").replace(/:/g, "%3A").replace(/,/g, "%2C");
 }
@@ -2044,7 +2559,7 @@ function renderAnnotation(annotation) {
 }
 function buildFileAnnotations(files, gate) {
   return files.map(({ file, result }) => {
-    const blocked = LEVEL_INDEX[result.risk.level] >= GATE_INDEX[gate];
+    const blocked = LEVEL_INDEX2[result.risk.level] >= GATE_INDEX2[gate];
     return {
       level: blocked ? "error" : "warning",
       file,
@@ -2054,12 +2569,12 @@ function buildFileAnnotations(files, gate) {
   });
 }
 function buildGateAnnotation(blocked, gate, counts) {
-  const gateIndex = GATE_INDEX[gate];
+  const gateIndex = GATE_INDEX2[gate];
   const parts = [];
-  if (LEVEL_INDEX.CRITICAL >= gateIndex && counts.critical > 0)
+  if (LEVEL_INDEX2.CRITICAL >= gateIndex && counts.critical > 0)
     parts.push(`${counts.critical} CRITICAL`);
-  if (LEVEL_INDEX.HIGH >= gateIndex && counts.high > 0) parts.push(`${counts.high} HIGH`);
-  if (LEVEL_INDEX.MEDIUM >= gateIndex && counts.medium > 0) parts.push(`${counts.medium} MEDIUM`);
+  if (LEVEL_INDEX2.HIGH >= gateIndex && counts.high > 0) parts.push(`${counts.high} HIGH`);
+  if (LEVEL_INDEX2.MEDIUM >= gateIndex && counts.medium > 0) parts.push(`${counts.medium} MEDIUM`);
   const atGate = parts.length > 0 ? parts.join(" \xB7 ") : "none";
   return {
     level: "notice",
@@ -2067,10 +2582,13 @@ function buildGateAnnotation(blocked, gate, counts) {
     message: blocked ? `Gate blocked: ${atGate} at or above ${gate}` : `Gate passed: nothing at ${gate} or above`
   };
 }
-
-// src/commands/diff.ts
-var LEVEL_INDEX2 = { LOW: 0, MEDIUM: 1, HIGH: 2, CRITICAL: 3 };
-var GATE_INDEX2 = { medium: 1, high: 2, critical: 3 };
+var LEVEL_INDEX3 = {
+  LOW: 0,
+  MEDIUM: 1,
+  HIGH: 2,
+  CRITICAL: 3
+};
+var GATE_INDEX3 = { medium: 1, high: 2, critical: 3 };
 var VERDICT_NOTE = {
   medium: "no MEDIUM or worse",
   high: "no HIGH or CRITICAL",
@@ -2083,22 +2601,68 @@ function countLevels(results) {
   }
   return counts;
 }
-function isAllowedByDiffAllowlist(relPath, patterns) {
+function isAllowedByDiffAllowlist(relPath2, patterns) {
   if (patterns.length === 0) return false;
-  const rel = toPosix(relPath);
+  const rel = toPosix(relPath2);
   const matcher = picomatch(patterns.map(toPosix), { dot: true });
   return matcher(rel);
 }
 function riskySummary(counts, gate) {
-  const gateIndex = GATE_INDEX2[gate];
+  const gateIndex = GATE_INDEX3[gate];
   const parts = [];
-  if (LEVEL_INDEX2.CRITICAL >= gateIndex && counts.critical > 0)
+  if (LEVEL_INDEX3.CRITICAL >= gateIndex && counts.critical > 0)
     parts.push(`${counts.critical} CRITICAL`);
-  if (LEVEL_INDEX2.HIGH >= gateIndex && counts.high > 0) parts.push(`${counts.high} HIGH`);
-  if (LEVEL_INDEX2.MEDIUM >= gateIndex && counts.medium > 0) parts.push(`${counts.medium} MEDIUM`);
-  if (LEVEL_INDEX2.LOW >= gateIndex && counts.low > 0) parts.push(`${counts.low} LOW`);
+  if (LEVEL_INDEX3.HIGH >= gateIndex && counts.high > 0) parts.push(`${counts.high} HIGH`);
+  if (LEVEL_INDEX3.MEDIUM >= gateIndex && counts.medium > 0) parts.push(`${counts.medium} MEDIUM`);
+  if (LEVEL_INDEX3.LOW >= gateIndex && counts.low > 0) parts.push(`${counts.low} LOW`);
   return parts.length > 0 ? parts.join(" \xB7 ") : "none";
 }
+function projectRelativePath(absPath, rootDir) {
+  const rel = toPosix(path8.relative(realPath(rootDir, rootDir), realPath(absPath, rootDir)));
+  return rel === "" ? "." : rel;
+}
+function evaluateGate(input) {
+  const { context, graph, entryPoints, changed, gate, allowPatterns, maxDepth } = input;
+  const changes = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const repoPath of changed.files) {
+    const gitPath = path8.resolve(changed.repoRoot, repoPath);
+    const file = projectRelativePath(gitPath, context.rootDir);
+    const absPath = file === "." ? context.rootDir : path8.resolve(context.rootDir, file);
+    const key = pathKey(absPath, context.rootDir);
+    if (seen.has(key)) continue;
+    seen.add(key);
+    if (!graph.nodes.has(key)) {
+      changes.push({ file, repoPath, absPath, allowed: false });
+      continue;
+    }
+    const result = analyzeFile({
+      graph,
+      context,
+      entryPoints,
+      targetKey: key,
+      targetPath: absPath,
+      durationMs: 0,
+      ...maxDepth !== void 0 ? { maxDepth } : {}
+    });
+    changes.push({
+      file,
+      repoPath,
+      absPath,
+      result,
+      allowed: isAllowedByDiffAllowlist(file, allowPatterns)
+    });
+  }
+  const entries = changes.filter((change) => change.result !== void 0).sort((a, b) => b.result.risk.score - a.result.risk.score || a.file.localeCompare(b.file));
+  const skipped = changes.filter((change) => change.result === void 0);
+  const gateResults = entries.filter((entry) => !entry.allowed).map((entry) => entry.result);
+  const counts = countLevels(gateResults);
+  const allowedCount = entries.filter((entry) => entry.allowed).length;
+  const blocked = gateResults.some((result) => LEVEL_INDEX3[result.risk.level] >= GATE_INDEX3[gate]);
+  return { changes, entries, skipped, counts, allowedCount, blocked, gate };
+}
+
+// src/commands/diff.ts
 async function diffCommand(options, ctx2) {
   const format = options.format ?? (options.json ? "json" : "terminal");
   const style = { color: resolveColor(options.color) };
@@ -2111,46 +2675,30 @@ async function diffCommand(options, ctx2) {
   const changed = changedFiles(ctx2.cwd, base);
   tracker.next("Analyzing changed files");
   const { graph, entryPoints } = await runPipeline(context);
-  const byRel = /* @__PURE__ */ new Map();
-  const skipped = [];
-  for (const rel of changed.files) {
-    const abs = path8.resolve(ctx2.cwd, rel);
-    const key = pathKey(abs, context.rootDir);
-    if (!graph.nodes.has(key)) {
-      skipped.push(rel);
-      continue;
-    }
-    byRel.set(
-      rel,
-      analyzeFile({
-        graph,
-        context,
-        entryPoints,
-        targetKey: key,
-        targetPath: abs,
-        durationMs: 0,
-        ...options.depth !== void 0 ? { maxDepth: options.depth } : {}
-      })
-    );
-  }
-  tracker.done();
   const allowPatterns = [...options.allow ?? [], ...context.config.diff.allow ?? []];
-  const allowedByRel = /* @__PURE__ */ new Map();
-  for (const rel of byRel.keys()) {
-    allowedByRel.set(rel, isAllowedByDiffAllowlist(rel, allowPatterns));
-  }
-  const entries = [...byRel.entries()].map(([rel, result]) => ({ rel, result, allowed: allowedByRel.get(rel) ?? false })).sort((a, b) => b.result.risk.score - a.result.risk.score);
-  const gateResults = entries.filter((entry) => !entry.allowed).map((entry) => entry.result);
-  const counts = countLevels(gateResults);
-  const allowedCount = entries.filter((entry) => entry.allowed).length;
-  const blocked = gateResults.some((result) => LEVEL_INDEX2[result.risk.level] >= GATE_INDEX2[gate]);
+  const evaluation = evaluateGate({
+    context,
+    graph,
+    entryPoints,
+    changed,
+    gate,
+    allowPatterns,
+    ...options.depth !== void 0 ? { maxDepth: options.depth } : {}
+  });
+  tracker.done();
+  const { changes, entries, skipped, counts, allowedCount, blocked } = evaluation;
+  const byRel = new Map(entries.map((entry) => [entry.file, entry.result]));
+  const allowedByRel = new Map(
+    entries.map((entry) => [entry.file, entry.allowed])
+  );
+  const changedNames = changes.map((change) => change.file);
   const durationMs = Date.now() - started;
   if (format === "json") {
     ctx2.writer.write(
       serializeJson(
         buildDiffJsonReport(
           changed.baseLabel,
-          changed.files,
+          changedNames,
           byRel,
           allowedByRel,
           gate,
@@ -2164,10 +2712,31 @@ async function diffCommand(options, ctx2) {
     );
     return blocked ? ExitCode.Failure : ExitCode.Success;
   }
+  if (format === "sarif") {
+    ctx2.writer.write(
+      serializeJson(
+        buildDiffSarif({
+          baseLabel: changed.baseLabel,
+          entries: entries.map((entry) => ({
+            rel: entry.file,
+            repoRel: entry.repoPath,
+            result: entry.result,
+            allowed: entry.allowed
+          })),
+          gate,
+          counts,
+          blocked,
+          durationMs,
+          version: ctx2.version
+        })
+      )
+    );
+    return blocked ? ExitCode.Failure : ExitCode.Success;
+  }
   if (format === "github") {
     const annotations = [
       ...buildFileAnnotations(
-        [...byRel.entries()].filter(([rel]) => !(allowedByRel.get(rel) ?? false)).map(([file, result]) => ({ file, result })),
+        entries.filter((entry) => !entry.allowed).map((entry) => ({ file: entry.repoPath, result: entry.result })),
         gate
       ),
       buildGateAnnotation(blocked, gate, counts)
@@ -2180,15 +2749,20 @@ async function diffCommand(options, ctx2) {
     {
       cwd: ctx2.cwd,
       baseLabel: changed.baseLabel,
-      files: changed.files,
-      entries,
-      skipped,
+      files: changedNames,
+      entries: entries.map((entry) => ({
+        rel: entry.file,
+        result: entry.result,
+        allowed: entry.allowed
+      })),
+      skipped: skipped.map((change) => change.file),
       counts,
       allowedCount,
       gate,
       blocked,
       durationMs,
-      style
+      style,
+      verbose: options.verbose
     },
     ctx2.writer
   );
@@ -2206,7 +2780,8 @@ function renderDiffReport(input, writer) {
     gate,
     blocked,
     durationMs,
-    style
+    style,
+    verbose = false
   } = input;
   writer.writeLine(brandHeader({ label: `diff vs ${baseLabel}`, style }));
   writer.writeLine();
@@ -2232,7 +2807,7 @@ function renderDiffReport(input, writer) {
   writer.writeLine();
   writer.writeLine(sectionHeader(`Risk analysis (${entries.length} files)`, style));
   for (const { result, allowed } of entries) {
-    const risky = LEVEL_INDEX2[result.risk.level] >= GATE_INDEX2[gate];
+    const risky = LEVEL_INDEX3[result.risk.level] >= GATE_INDEX3[gate];
     const fileIcon = risky ? icon("cross") : icon("tick");
     const fileIconText = style.color ? risky ? chalk.red(fileIcon) : chalk.green(fileIcon) : fileIcon;
     const score = result.risk.score.toFixed(1);
@@ -2242,6 +2817,14 @@ function renderDiffReport(input, writer) {
     writer.writeLine(
       `${fileIconText} ${file}  ${riskBadge(result.risk.level, style)} \xB7 ${score}/100${gauge ? ` ${gauge}` : ""}${allowedTag}`
     );
+    if (verbose) {
+      writer.writeLine(
+        `  ${dim(
+          `${pluralize(result.summary.affectedFiles, "file")} affected \xB7 max depth ${result.summary.maxDepth} \xB7 confidence ${result.summary.confidence}%`,
+          style
+        )}`
+      );
+    }
   }
   for (const rel of skipped) {
     writer.writeLine(
@@ -2280,6 +2863,438 @@ function buildDiffJsonReport(baseLabel, changedFileNames, byRel, allowedByRel, g
   };
 }
 
+// src/mcp/server.ts
+var PROTOCOL_VERSION = "2025-06-18";
+var ERR_PARSE = -32700;
+var ERR_INVALID_REQUEST = -32600;
+var ERR_INTERNAL = -32603;
+function isObject(value) {
+  return typeof value === "object" && value !== null;
+}
+var McpServer = class {
+  options;
+  tools = /* @__PURE__ */ new Map();
+  constructor(options) {
+    this.options = options;
+    for (const tool of options.tools) {
+      this.tools.set(tool.name, tool);
+    }
+  }
+  /**
+   * Process one inbound message. Returns the JSON-RPC response line to write
+   * back, or `null` for notifications and invalid requests.
+   */
+  async handleLine(line) {
+    let message;
+    try {
+      message = JSON.parse(line);
+    } catch {
+      return this.response(void 0, {
+        code: ERR_PARSE,
+        message: "Parse error: not valid JSON"
+      });
+    }
+    if (!isObject(message) || message.jsonrpc !== "2.0") {
+      return this.response(void 0, {
+        code: ERR_INVALID_REQUEST,
+        message: "Invalid Request: expected a JSON-RPC 2.0 object"
+      });
+    }
+    const hasId = "id" in message;
+    if (message.method === "notifications/initialized") {
+      return null;
+    }
+    if (!hasId) {
+      return null;
+    }
+    const method = message.method;
+    if (typeof method !== "string") {
+      return this.response(message.id, {
+        code: ERR_INVALID_REQUEST,
+        message: "Invalid Request: method must be a string"
+      });
+    }
+    try {
+      const result = await this.dispatch(method, message.params);
+      return this.response(message.id, result);
+    } catch (error) {
+      return this.response(message.id, {
+        code: ERR_INTERNAL,
+        message: error instanceof Error ? error.message : "Internal error"
+      });
+    }
+  }
+  async dispatch(method, params) {
+    switch (method) {
+      case "initialize":
+        return {
+          protocolVersion: this.protocolVersion(params),
+          capabilities: { tools: { listChanged: false } },
+          serverInfo: { name: this.options.name, version: this.options.version }
+        };
+      case "ping":
+        return {};
+      case "tools/list":
+        return {
+          tools: [...this.tools.values()].map((tool) => ({
+            name: tool.name,
+            description: tool.description,
+            inputSchema: tool.inputSchema
+          }))
+        };
+      case "tools/call":
+        return this.callTool(params);
+      case "tools/list_changed":
+        throw new Error("Tool list changes are not supported by this server");
+      default:
+        throw new Error(`Method not found: ${method}`);
+    }
+  }
+  protocolVersion(params) {
+    if (isObject(params) && typeof params.protocolVersion === "string") {
+      return params.protocolVersion;
+    }
+    return PROTOCOL_VERSION;
+  }
+  async callTool(params) {
+    if (!isObject(params) || typeof params.name !== "string") {
+      throw new Error("Invalid params: expected { name: string, arguments?: object }");
+    }
+    const tool = this.tools.get(params.name);
+    if (!tool) {
+      throw new Error(`Unknown tool: ${params.name}`);
+    }
+    const args = isObject(params.arguments) || params.arguments === void 0 ? params.arguments ?? {} : null;
+    if (args === null) {
+      throw new Error(`Invalid arguments for tool ${params.name}: expected an object`);
+    }
+    try {
+      const result = await tool.handler(args);
+      return {
+        content: [{ type: "text", text: result.text }],
+        ...result.isError ? { isError: true } : {}
+      };
+    } catch (error) {
+      return {
+        content: [
+          {
+            type: "text",
+            text: error instanceof Error ? error.message : "Tool failed"
+          }
+        ],
+        isError: true
+      };
+    }
+  }
+  response(id, payload) {
+    if (typeof payload === "object" && payload !== null && "code" in payload && typeof payload.code === "number") {
+      const errorPayload = payload;
+      const error = { code: errorPayload.code, message: String(errorPayload.message) };
+      return `${JSON.stringify({ jsonrpc: "2.0", id: id ?? null, error })}
+`;
+    }
+    return `${JSON.stringify({ jsonrpc: "2.0", id: id ?? null, result: payload })}
+`;
+  }
+};
+var MAX_DEPENDENTS = 200;
+function ok(text) {
+  return { text };
+}
+function fail(error) {
+  return { text: error instanceof Error ? error.message : "Tool failed", isError: true };
+}
+function requireString(args, key, tool) {
+  const value = args[key];
+  if (typeof value !== "string" || value.trim() === "") {
+    throw new RippleError(`Missing required argument "${key}" for ${tool}`, ExitCode.Failure);
+  }
+  return value;
+}
+function optionalPositiveInt(args, key, tool) {
+  const value = args[key];
+  if (value === void 0) return void 0;
+  if (typeof value !== "number" || !Number.isInteger(value) || value < 1) {
+    throw new RippleError(
+      `Argument "${key}" for ${tool} must be a positive integer`,
+      ExitCode.Failure
+    );
+  }
+  return value;
+}
+function resolveFile(cwd, file) {
+  return path8.isAbsolute(file) ? file : path8.join(cwd, file);
+}
+function analyzeIn(project, cwd, file, maxDepth) {
+  const { context, graph, entryPoints } = project;
+  const targetPath = resolveFile(cwd, file);
+  const key = pathKey(targetPath, context.rootDir);
+  const node = graph.nodes.get(key);
+  if (!node) {
+    throw new RippleError(
+      `File not found in the project graph: ${file}. Is it a source file covered by ripple's discovery?`,
+      ExitCode.NotFound
+    );
+  }
+  return analyzeFile({
+    graph,
+    context,
+    entryPoints,
+    targetKey: key,
+    targetPath,
+    durationMs: 0,
+    ...maxDepth !== void 0 ? { maxDepth } : {}
+  });
+}
+function relPath(targetPath, cwd) {
+  const rel = path8.relative(cwd, targetPath);
+  return toPosix(rel || path8.basename(targetPath));
+}
+var IMPACT_SCHEMA = {
+  type: "object",
+  properties: {
+    file: {
+      type: "string",
+      description: "Project-relative or absolute path of the file to analyze."
+    },
+    maxDepth: {
+      type: "integer",
+      minimum: 1,
+      description: "Cap the reverse traversal depth (default: unlimited)."
+    }
+  },
+  required: ["file"]
+};
+var DEPENDENTS_SCHEMA = {
+  type: "object",
+  properties: {
+    file: {
+      type: "string",
+      description: "Project-relative or absolute path of the file."
+    },
+    depth: {
+      type: "integer",
+      minimum: 1,
+      description: "Max dependency depth to report (default: 1, direct dependents only)."
+    }
+  },
+  required: ["file"]
+};
+var RISK_SCHEMA = {
+  type: "object",
+  properties: {
+    file: {
+      type: "string",
+      description: "Project-relative or absolute path of the file."
+    }
+  },
+  required: ["file"]
+};
+var GATE_SCHEMA = {
+  type: "object",
+  properties: {
+    base: {
+      type: "string",
+      description: "Git ref to diff against (default: GitHub base, origin/main, origin/master, main, master)."
+    },
+    gate: {
+      type: "string",
+      enum: ["medium", "high", "critical"],
+      description: "Risk level that blocks the merge (default: high)."
+    }
+  }
+};
+function createMcpTools(deps) {
+  const { cwd, loadProject, getChanged } = deps;
+  return [
+    {
+      name: "impact",
+      description: "Blast-radius analysis of a file: how many files, routes, tests and components would be affected by changing it, plus its risk score. Call before editing or refactoring a file so the change set stays low-risk.",
+      inputSchema: IMPACT_SCHEMA,
+      handler: async (args) => {
+        try {
+          const file = requireString(args, "file", "impact");
+          const maxDepth = optionalPositiveInt(args, "maxDepth", "impact");
+          const project = await loadProject();
+          const result = analyzeIn(project, cwd, file, maxDepth);
+          return ok(
+            JSON.stringify(
+              {
+                file: relPath(result.targetPath, cwd),
+                risk: { score: result.risk.score, level: result.risk.level },
+                summary: result.summary,
+                targetInCycle: result.targetInCycle
+              },
+              null,
+              2
+            )
+          );
+        } catch (error) {
+          return fail(error);
+        }
+      }
+    },
+    {
+      name: "dependents",
+      description: "List the files that depend on a file (its importers), up to a depth. Depth 1 is direct dependents; deeper levels are transitive. Useful to know who breaks when the file changes.",
+      inputSchema: DEPENDENTS_SCHEMA,
+      handler: async (args) => {
+        try {
+          const file = requireString(args, "file", "dependents");
+          const depth = optionalPositiveInt(args, "depth", "dependents") ?? 1;
+          const project = await loadProject();
+          const result = analyzeIn(project, cwd, file, depth);
+          const dependents = [...result.affected.values()].filter((affected) => affected.depth <= depth).sort((a, b) => a.depth - b.depth || a.path.localeCompare(b.path)).map((affected) => ({
+            path: relPath(affected.path, cwd),
+            depth: affected.depth,
+            direct: affected.direct,
+            inCycle: affected.inCycle,
+            categories: affected.categories
+          }));
+          return ok(
+            JSON.stringify(
+              {
+                file: relPath(result.targetPath, cwd),
+                depth,
+                count: dependents.length,
+                truncated: dependents.length > MAX_DEPENDENTS,
+                dependents: dependents.slice(0, MAX_DEPENDENTS)
+              },
+              null,
+              2
+            )
+          );
+        } catch (error) {
+          return fail(error);
+        }
+      }
+    },
+    {
+      name: "risk",
+      description: "The risk score (0-100) of changing a file and the factor breakdown behind it. Cheap way to compare the danger of different refactor targets.",
+      inputSchema: RISK_SCHEMA,
+      handler: async (args) => {
+        try {
+          const file = requireString(args, "file", "risk");
+          const project = await loadProject();
+          const result = analyzeIn(project, cwd, file);
+          return ok(
+            JSON.stringify(
+              {
+                file: relPath(result.targetPath, cwd),
+                score: result.risk.score,
+                level: result.risk.level,
+                targetInCycle: result.targetInCycle,
+                factors: result.risk.factors
+              },
+              null,
+              2
+            )
+          );
+        } catch (error) {
+          return fail(error);
+        }
+      }
+    },
+    {
+      name: "gate_status",
+      description: "Check the current change set against the ripple merge gate: which files changed since the base ref, their risk levels, and whether the gate passes or blocks. Call after editing files to verify the changes are safe to merge.",
+      inputSchema: GATE_SCHEMA,
+      handler: async (args) => {
+        try {
+          const base = args.base;
+          const gate = args.gate;
+          if (base !== void 0 && typeof base !== "string") {
+            return fail(
+              new RippleError('Argument "base" for gate_status must be a string', ExitCode.Failure)
+            );
+          }
+          if (gate !== void 0 && gate !== "medium" && gate !== "high" && gate !== "critical") {
+            return fail(
+              new RippleError(
+                'Argument "gate" for gate_status must be medium | high | critical',
+                ExitCode.Failure
+              )
+            );
+          }
+          const project = await loadProject();
+          const resolvedGate = gate ?? project.context.config.diff.gate ?? "high";
+          const changed = getChanged(base ?? project.context.config.diff.base);
+          const evaluation = evaluateGate({
+            context: project.context,
+            graph: project.graph,
+            entryPoints: project.entryPoints,
+            changed,
+            gate: resolvedGate,
+            allowPatterns: project.context.config.diff.allow ?? []
+          });
+          const files = evaluation.changes.map((change) => {
+            if (!change.result) return { file: change.file, analyzed: false };
+            return {
+              file: change.file,
+              analyzed: true,
+              level: change.result.risk.level,
+              score: change.result.risk.score,
+              affectedFiles: change.result.summary.affectedFiles,
+              targetInCycle: change.result.targetInCycle,
+              allowed: change.allowed
+            };
+          });
+          return ok(
+            JSON.stringify(
+              {
+                base: changed.baseLabel,
+                changedFiles: evaluation.changes.length,
+                files,
+                counts: evaluation.counts,
+                gate: {
+                  level: resolvedGate,
+                  blocked: evaluation.blocked,
+                  verdict: evaluation.blocked ? "block" : "pass",
+                  allowed: evaluation.allowedCount
+                }
+              },
+              null,
+              2
+            )
+          );
+        } catch (error) {
+          return fail(error);
+        }
+      }
+    }
+  ];
+}
+
+// src/commands/mcp.ts
+async function mcpCommand(options, ctx2) {
+  const loadProject = async () => {
+    const context = await loadProjectContext(ctx2.cwd, options.config);
+    const { graph, entryPoints } = await runPipeline(context);
+    return { context, graph, entryPoints };
+  };
+  const server = new McpServer({
+    name: "ripple",
+    version: ctx2.version,
+    tools: createMcpTools({
+      cwd: ctx2.cwd,
+      loadProject,
+      getChanged: (base) => changedFiles(ctx2.cwd, base)
+    })
+  });
+  const stdin = createInterface({ input: process.stdin, crlfDelay: Infinity });
+  await new Promise((resolve) => {
+    stdin.on("line", (line) => {
+      if (!line.trim()) return;
+      void server.handleLine(line).then((response) => {
+        if (response) process.stdout.write(response);
+      });
+    });
+    stdin.on("close", () => resolve());
+  });
+  return ExitCode.Success;
+}
+
 // src/cli/program.ts
 var PROGRAM_NAME = "ripple";
 function helpExamples(examples) {
@@ -2297,11 +3312,12 @@ function createProgram(ctx2) {
       "ripple analyze src/authentication/login.ts",
       "ripple analyze src/index.ts --depth 3"
     ])
-  ).option("-j, --json", "emit a machine-readable JSON report").option("-v, --verbose", "include the risk factor breakdown").option("-d, --depth <number>", "cap the reverse traversal depth", parsePositiveInt).option("-c, --config <path>", "path to a ripple config file").option("--no-color", "disable ANSI colors").action(async (file, options) => {
+  ).option("-j, --json", "emit a machine-readable JSON report").option("--sarif", "emit a SARIF 2.1.0 report for code scanning").option("-v, --verbose", "include the risk factor breakdown").option("-d, --depth <number>", "cap the reverse traversal depth", parsePositiveInt).option("-c, --config <path>", "path to a ripple config file").option("--no-color", "disable ANSI colors").action(async (file, options) => {
     const exitCode2 = await analyzeCommand(
       file,
       {
         json: Boolean(options.json),
+        sarif: Boolean(options.sarif),
         verbose: Boolean(options.verbose),
         ...options.depth !== void 0 ? { depth: options.depth } : {},
         ...options.config !== void 0 ? { config: options.config } : {},
@@ -2345,7 +3361,14 @@ function createProgram(ctx2) {
   program.command("diff").description("Analyze changed files since a base ref and gate risky changes").addHelpText(
     "after",
     helpExamples(["ripple diff --base main --gate critical", "ripple diff --format github"])
-  ).option("-j, --json", "emit a machine-readable JSON report").option("-f, --format <format>", "output format: terminal | json | github", parseDiffFormat).option("-v, --verbose", "include extra sections").option("-b, --base <ref>", "git ref to diff against (default: origin/main, main, HEAD~1)").option(
+  ).option("-j, --json", "emit a machine-readable JSON report").option(
+    "-f, --format <format>",
+    "output format: terminal | json | github | sarif",
+    parseDiffFormat
+  ).option("-v, --verbose", "include extra sections").option(
+    "-b, --base <ref>",
+    "git ref to diff against (default: GitHub base, origin/HEAD, origin/main, origin/master, main, master)"
+  ).option(
     "-g, --gate <level>",
     "risk level that blocks the gate (medium | high | critical)",
     parseGateLevel
@@ -2395,6 +3418,20 @@ function createProgram(ctx2) {
       throw new ExitError(exitCode2);
     }
   });
+  program.command("mcp").description("Serve Ripple analysis tools over the Model Context Protocol (stdio)").addHelpText(
+    "after",
+    helpExamples(['ripple mcp  # point an MCP client (Claude, Cursor, ...) at "ripple mcp"'])
+  ).option("-c, --config <path>", "path to a ripple config file").action(async (options) => {
+    const exitCode2 = await mcpCommand(
+      {
+        config: options.config
+      },
+      ctx2
+    );
+    if (exitCode2 !== ExitCode.Success) {
+      throw new ExitError(exitCode2);
+    }
+  });
   program.command("version").description("Print the Ripple version").addHelpText("after", helpExamples(["ripple version"])).action(() => {
     ctx2.writer.writeLine(ctx2.version);
   });
@@ -2435,13 +3472,13 @@ function parseGateLevel(value) {
   );
 }
 function parseDiffFormat(value) {
-  if (value === "terminal" || value === "json" || value === "github") {
+  if (value === "terminal" || value === "json" || value === "github" || value === "sarif") {
     return value;
   }
   throw new CommanderError(
     1,
     "commander.invalidArgument",
-    `expected one of terminal | json | github, got "${value}"`
+    `expected one of terminal | json | github | sarif, got "${value}"`
   );
 }
 function parseGraphFormat(value) {
@@ -2485,10 +3522,6 @@ async function run({ argv, ctx: ctx2 }) {
   }
 }
 
-// package.json
-var package_default = {
-  version: "0.6.0"};
-
 // src/cli/bin.ts
 var ctx = {
   writer: new TerminalWriter(),