@diffci.com/diffci 0.1.10 → 0.1.12

package/node_modules/@diffci.com/core/src/repo/graph.ts

@@ -1,10 +1,11 @@
-import { existsSync, readdirSync } from "node:fs";
+import { existsSync, readFileSync, readdirSync, realpathSync, statSync } from "node:fs";
 import { createTestFileMatcher, DEFAULT_TEST_FILE_MATCHER, testFileMatcherForProfile, type TestFileMatcher } from "./test-discovery.js";
 import { isBuiltin } from "node:module";
 import { dirname, extname, join, normalize, relative, resolve, sep } from "node:path";
 import ts from "typescript";
 import { adapterFiles, REPOSITORY_ADAPTERS } from "./adapters/index.js";
 import { analyzeRepository, type AnalyzeRepositoryOptions } from "./analyzer.js";
+import { applyVueScope, inVuePackage } from "./vue-scope.js";
 import type {
   DependencyEdge,
   DependencyEdgeKind,
@@ -382,6 +383,7 @@ function createProgram(
   repoPath: string,
   fallbackSourceRoots: SourceRoot[] = [],
   additionalSources: string[] = [],
+  syntaxOnly = false,
 ): {
   program: ts.Program;
   options: ts.CompilerOptions;
@@ -521,7 +523,10 @@ function createProgram(
   }
   const program = ts.createProgram({
     rootNames: fileNames,
-    options,
+    // Scoped analysis already inventories every implementation file. It extracts
+    // syntax/import edges, never asks TypeScript for semantic diagnostics. Keep
+    // the original options below for explicit module resolution.
+    options: syntaxOnly ? { ...options, noResolve: true, noLib: true, types: [] } : options,
     configFileParsingDiagnostics,
   });
 
@@ -600,45 +605,82 @@ function findAssetCandidate(
   return undefined;
 }
 
-export interface BuildDependencyGraphOptions extends AnalyzeRepositoryOptions {}
+export interface BuildDependencyGraphOptions extends AnalyzeRepositoryOptions {
+  vueAnalysisCache?: { directory: string; version: string };
+}
 
 export async function buildDependencyGraph(
   options: BuildDependencyGraphOptions = {},
 ): Promise<DependencyGraphResult> {
   const start = process.hrtime.bigint();
+  const phasesMs: Record<string, number> = {};
+  let phaseStart = start;
+  const markPhase = (name: string) => {
+    const now = process.hrtime.bigint();
+    phasesMs[name] = Number(now - phaseStart) / 1_000_000;
+    phaseStart = now;
+  };
   const repoPath = options.repoPath ? resolve(options.repoPath) : process.cwd();
 
   const profile = analyzeRepository(options);
-  const files = adapterFiles(repoPath, options.excludeDirs);
-  const context = { repoPath, files, profile };
-  const contributions = REPOSITORY_ADAPTERS.filter((adapter) => adapter.detect(context)).map((adapter) => adapter.analyze(context));
-  const adapterBlockers = contributions.flatMap((item) => item.blockers);
+  markPhase("repositoryDiscovery");
+  const scopeBlockers = applyVueScope(repoPath, profile);
+  markPhase("scopeDiscovery");
+  const scope = profile.vueScope;
+  const physicalRepoRoot = scope ? realpathSync.native(repoPath) : "";
+  const physicalPackageRoot = scope ? realpathSync.native(join(repoPath, scope.packageRoot)) : "";
+  const scopePathChecks = new Map<string, boolean>();
+  const outsideScope = (path: string): boolean => {
+    if (!scope) return false;
+    const cached = scopePathChecks.get(path);
+    if (cached !== undefined) return cached;
+    const lexicalOutside = !inVuePackage(path, scope.packageRoot) && !path.split("/").includes("node_modules");
+    let outside = lexicalOutside;
+    if (!outside && existsSync(join(repoPath, path))) {
+      const physical = realpathSync.native(join(repoPath, path));
+      const packageRelative = relative(physicalPackageRoot, physical).replace(/\\/g, "/");
+      const repositoryRelative = relative(physicalRepoRoot, physical).replace(/\\/g, "/");
+      outside = (packageRelative === ".." || packageRelative.startsWith("../") || /^[A-Za-z]:|^\//.test(packageRelative)) &&
+        !(!repositoryRelative.startsWith("../") && !/^[A-Za-z]:|^\//.test(repositoryRelative) && (repositoryRelative.startsWith("node_modules/") || repositoryRelative.includes("/node_modules/")));
+    }
+    scopePathChecks.set(path, outside);
+    return outside;
+  };
+  const files = adapterFiles(repoPath, options.excludeDirs).filter(path => !scope || inVuePackage(path, scope.packageRoot));
+  markPhase("adapterInventory");
+  const context = { repoPath, files, profile, vueAnalysisSession: {} };
+  const cachedVue = options.vueAnalysisCache ? (await import("../cache/vue-analysis-cache.js")).analyzeVueCached : undefined;
+  const contributions = REPOSITORY_ADAPTERS.filter((adapter) => adapter.detect(context)).map((adapter) => adapter.id === "vue" && cachedVue && options.vueAnalysisCache
+    ? cachedVue(context, options.vueAnalysisCache.directory, options.vueAnalysisCache.version) : adapter.analyze(context));
+  markPhase("adapters");
+  const adapterBlockers = [...scopeBlockers, ...contributions.flatMap((item) => item.blockers)];
+  if (profile.diffciConfig?.configurationError && !adapterBlockers.includes(profile.diffciConfig.configurationError)) adapterBlockers.push(profile.diffciConfig.configurationError);
   if (contributions.some((item) => item.id === "go") && files.some((file) => /\.(?:[cm]?[jt]sx?|vue)$/.test(file))) {
     adapterBlockers.push("Mixed Go/JavaScript repositories require explicit cross-language dependencies; full validation required");
   }
-  if (contributions.length && files.some((file) => /\.(?:py|rs|java|kt|cs|svelte|astro)$/.test(file))) {
+  if (contributions.length && files.some((file) => /\.(?:py|rs|cs|svelte|astro)$/.test(file) || !contributions.some((item) => item.id === "maven") && /\.(?:java|kt)$/.test(file))) {
     adapterBlockers.push("Unmodeled languages alongside an adapter require full validation");
   }
   profile.adapters = contributions.map(({ id, version, blockers }) => ({ id, version, blockers }));
   profile.goTestPackages = Object.assign({}, ...contributions.map((item) => item.testPackages));
   profile.goTestEnvironment = contributions.find((item) => item.id === "go")?.executionEnv;
+  profile.mavenTestModules = Object.assign({}, ...contributions.filter((item) => item.id === "maven").map((item) => item.testPackages));
   const adapterTests = contributions.flatMap((item) => item.testFiles);
   profile.testFilePaths = [...new Set([...profile.testFilePaths, ...adapterTests])].sort();
   if (profile.testUniverse) {
     profile.testUniverse.discoveredTestFiles = profile.testFilePaths.length;
-    profile.testUniverse.blindSpot = (profile.testUniverse.declaredFrameworks.length > 0 || contributions.some((item) => item.id === "go")) && profile.testFilePaths.length === 0;
+    profile.testUniverse.blindSpot = (profile.testUniverse.declaredFrameworks.length > 0 || contributions.some((item) => item.id === "go" || item.id === "maven")) && profile.testFilePaths.length === 0;
   }
   const entryPointPaths = new Set(profile.entryPoints.map((e) => e.path));
 
-  const vueSources = contributions.some((item) => item.id === "vue")
+  const vueSources = scope || contributions.some((item) => item.id === "vue")
     ? files.filter((file) => /\.[cm]?[jt]sx?$/.test(file)).map((file) => join(repoPath, file)) : [];
-  // Compiler include/exclude controls typechecking, not the runner's test universe. Parse every
-  // discovered JS/TS test so source changes can reach tests outside the compiler's root files.
-  // Adding those tests only as leaf nodes silently loses their dependency edges (ky, 2026-09-19).
+  // Runner tests excluded by tsconfig still need their import edges in the graph.
   const testSources = profile.testFilePaths
     .filter((file) => /\.[cm]?[jt]sx?$/.test(file))
     .map((file) => join(repoPath, file));
-  let { program, options: compilerOptions, resolvedViaProjectReferences } = createProgram(repoPath, profile.sourceRoots, [...vueSources, ...testSources]);
+  let { program, options: compilerOptions, resolvedViaProjectReferences } = createProgram(scope ? join(repoPath, scope.packageRoot) : repoPath, scope ? [] : profile.sourceRoots, [...vueSources, ...testSources], Boolean(scope));
+  markPhase("typescriptProgram");
   let moduleResolutionCache = ts.createModuleResolutionCache(
     repoPath,
     (x) => x,
@@ -647,7 +689,7 @@ export async function buildDependencyGraph(
 
   const sourceFiles = program
     .getSourceFiles()
-    .filter((sf) => sf.fileName && !sf.fileName.endsWith(".d.ts"));
+    .filter((sf) => sf.fileName && !sf.fileName.endsWith(".d.ts") && (!scope || inVuePackage(toRelativeInternal(repoPath, sf.fileName) ?? "", scope.packageRoot)));
   for (const item of contributions) {
     for (const virtual of item.virtualSources) {
       sourceFiles.push(ts.createSourceFile(join(repoPath, virtual.path), virtual.source, ts.ScriptTarget.Latest, true, ts.ScriptKind.TSX));
@@ -710,7 +752,8 @@ export async function buildDependencyGraph(
     addEdge(importerRel, assetRel, "asset");
   }
 
-  const filesParsed = sourceFiles.length;
+  let filesParsed = sourceFiles.length;
+  let followedImplementationFiles = 0;
 
   for (const sf of sourceFiles) {
     const importerRel = toRelativeInternal(repoPath, sf.fileName);
@@ -718,6 +761,7 @@ export async function buildDependencyGraph(
     if (isExcludedPath(importerRel, options.excludeDirs ?? [])) continue;
 
     const refs = extractImportRefs(sf);
+    if (scope && sf.referencedFiles.length) adapterBlockers.push(`Triple-slash file references in the scoped suite require full validation: ${importerRel}`);
     for (const ref of refs) {
       if (!ref.specifier) {
         recordUnresolved(importerRel, ref, "empty specifier");
@@ -781,8 +825,34 @@ export async function buildDependencyGraph(
 
       const resolved = resolution.resolvedModule.resolvedFileName;
       const targetRel = toRelativeInternal(repoPath, resolved);
+      // The generic internal-path helper intentionally hides root node_modules.
+      // Scope validation must still follow those paths to catch workspace symlinks.
+      const scopeTarget = scope ? relative(physicalRepoRoot, realpathSync.native(resolved)).replace(/\\/g, "/") : targetRel;
+      if (scopeTarget && outsideScope(scopeTarget)) {
+        adapterBlockers.push(`Vue dependency crosses the declared package boundary: ${importerRel} -> ${scopeTarget}`);
+        continue;
+      }
+      if (scope && resolution.resolvedModule.isExternalLibraryImport && (!targetRel || targetRel.split("/").includes("node_modules"))) {
+        recordReference("external-package", importerRel, ref);
+        continue;
+      }
 
       if (targetRel && isSourceFileName(resolved)) {
+        if (scope && !resolved.endsWith(".d.ts") && !internalSourcePaths.has(targetRel)) {
+          // A real import can reach generated implementation excluded from the
+          // initial walk. Parse it (and its imports) rather than silently dropping
+          // the edge or loading every TypeScript declaration library again.
+          try {
+            if (isExcludedPath(targetRel, options.excludeDirs ?? []) || followedImplementationFiles >= 500 || statSync(resolved).size > 5 * 1024 * 1024) throw new Error("excluded or exceeds parse budget");
+            const followed = ts.createSourceFile(resolved, readFileSync(resolved, "utf8"), ts.ScriptTarget.Latest, true);
+            if ((followed as unknown as { parseDiagnostics?: unknown[] }).parseDiagnostics?.length) throw new Error("invalid implementation syntax");
+            sourceFiles.push(followed);
+            followedImplementationFiles++;
+          } catch {
+            adapterBlockers.push(`Resolved implementation cannot be included in the scoped source inventory: ${targetRel}`);
+            continue;
+          }
+        }
         internalSourcePaths.add(targetRel);
         addEdge(importerRel, targetRel, ref.kind);
         recordReference("internal-source", importerRel, ref);
@@ -808,13 +878,65 @@ export async function buildDependencyGraph(
     }
   }
 
+  // Only a verified scoped suite can establish that a component is not executed.
+  // Every test and setup/config root must actually have been parsed, not merely
+  // added as a leaf test node. Unknown reachable components still block the suite.
+  if (scope && scopeBlockers.length === 0 && profile.testFilePaths.length) {
+    const roots = [...profile.testFilePaths, ...(profile.vueSetupPaths ?? [])];
+    const parsedPaths = new Set(sourceFiles.map(file => toRelativeInternal(repoPath, file.fileName)).filter(Boolean));
+    if (roots.every(path => parsedPaths.has(path))) {
+      const outgoing = new Map<string, string[]>();
+      for (const edge of edges) outgoing.set(edge.from, [...(outgoing.get(edge.from) ?? []), edge.to]);
+      const reachable = new Set(roots); const pending = [...roots];
+      while (pending.length) for (const target of outgoing.get(pending.pop()!) ?? []) if (!reachable.has(target)) { reachable.add(target); pending.push(target); }
+      const vue = contributions.find(item => item.id === "vue");
+      const irrelevant = new Set((vue?.fileBlockers ?? []).filter(item => !reachable.has(item.path)).map(item => item.reason));
+      const outOfSuiteBlockers = irrelevant.size;
+      if (profile.vueRuntimeIsolationVerified) {
+        const closure = (starts: string[]) => {
+          const visited = new Set(starts); const queue = [...starts];
+          while (queue.length) for (const target of outgoing.get(queue.pop()!) ?? []) if (!visited.has(target)) { visited.add(target); queue.push(target); }
+          return visited;
+        };
+        const shared = closure(profile.vueSetupPaths ?? []);
+        const runtime = (vue?.fileBlockers ?? []).filter(item => item.reason === `Vue ${item.path}: runtime component/directive resolution requires full validation` && reachable.has(item.path));
+        // Unknown outgoing runtime edges affect every test reaching this component.
+        // Run all such isolated test files for EVERY delta, regardless of static impact.
+        // Shared setup/configuration uncertainty cannot be confined to those files.
+        if (runtime.length && runtime.every(item => !shared.has(item.path))) {
+          const targets = new Set(runtime.map(item => item.path));
+          profile.vueRuntimeAlwaysRunPaths = profile.testFilePaths.filter(path => [...closure([path])].some(dependency => targets.has(dependency)));
+          for (const item of runtime) irrelevant.add(item.reason);
+        }
+      }
+      for (let i = adapterBlockers.length - 1; i >= 0; i--) if (irrelevant.has(adapterBlockers[i])) adapterBlockers.splice(i, 1);
+      if (vue?.performance) Object.assign(vue.performance.counts, { verifiedSuiteRoots: roots.length, reachablePaths: reachable.size, outOfSuiteBlockers, runtimeAlwaysRunTests: profile.vueRuntimeAlwaysRunPaths?.length ?? 0 });
+    }
+  }
   if (unresolved.some((ref) => ref.importer.endsWith(".vue") || stripImportQuery(ref.specifier).endsWith(".vue"))) {
     adapterBlockers.push("Unresolved Vue dependencies require full validation");
   }
+  filesParsed = sourceFiles.length;
+  if (scope && unresolved.length) adapterBlockers.push("Unresolved dependencies in the declared Vue suite require full validation");
+  if (scope && edges.some(edge => outsideScope(edge.from) || outsideScope(edge.to))) adapterBlockers.push("Vue asset or macro dependency crosses the declared package boundary");
   profile.adapterBlockers = [...adapterBlockers];
-
-  // Keep adapter-provided test identities visible as well. JS/TS tests are parsed above; their
-  // imports must not be replaced by disconnected leaf nodes merely because tsconfig excludes them.
+  markPhase("importExtractionAndResolution");
+
+  // Nested-package test visibility (2026-08-24, biomejs/biome finding): `internalSourcePaths` above is
+  // strictly the TS PROGRAM's own file list (createProgram()'s `include`/nested-tsconfig-merged
+  // fileNames) - so a package whose own tsconfig deliberately excludes its test directory (a real,
+  // common pattern; confirmed verbatim on biome: `packages/@biomejs/js-api/tsconfig.json` has
+  // `"exclude": ["./tests", "./dist"], "include": ["./src"]`) NEVER contributes those files to the
+  // program, so they never became graph nodes and `totalTestsInGraph` stayed 0 even though
+  // `profile.testFilePaths` (the separate, tsconfig-agnostic glob walk in analyzer.ts's discoverTests())
+  // already found them correctly. Source-ROOT discovery itself was already correct (the 2026-08-21
+  // zod/trpc fallback already lists `packages`/`crates` as roots for exactly this monorepo shape) - the
+  // gap was narrower: the graph never incorporated what that walk found. Fix: union in any test file
+  // discoverTests() found that the TS program's own file list missed, as an ADDITIONAL leaf node
+  // (isTest true; no import edges - we have no real resolution info for a file the type-checker was
+  // never asked to see, so dependency-graph traversal through it is honestly absent, not guessed at).
+  // This does NOT add Rust visibility of any kind - testFilePaths only ever contains files already
+  // matched by the JS/TS test-file patterns; a `.rs` test is never in it and stays "unknown" as before.
   for (const testPath of profile.testFilePaths) {
     if (!internalSourcePaths.has(testPath) && !assetPaths.has(testPath)) internalSourcePaths.add(testPath);
   }
@@ -867,9 +989,12 @@ export async function buildDependencyGraph(
   };
 
   const durationMs = Number(process.hrtime.bigint() - start) / 1_000_000;
+  markPhase("graphFinalization");
 
   const performance: GraphPerformanceMetrics = {
     durationMs,
+    phasesMs,
+    adapterMetrics: Object.fromEntries(contributions.filter(item => item.performance).map(item => [item.id, item.performance!])),
     heapUsedMb: heapDuringBuildMb,
     heapAfterExtractionMb,
     filesDiscovered: filesParsed,
@@ -902,7 +1027,8 @@ export function classifyRepositoryProject(repoPath: string): { capable: boolean;
   const files = adapterFiles(repoPath);
   if (files.includes("go.mod")) return { capable: true, reason: "Go module (package-level analysis)" };
   if (files.some((file) => file.endsWith(".vue"))) return { capable: true, reason: "Vue single-file components" };
-  return { capable: false, reason: "No TypeScript project, Vue components, or root Go module found" };
+  if (files.includes("pom.xml") && files.some((file) => file.endsWith(".java") || file.endsWith(".kt"))) return { capable: true, reason: "Maven reactor (module-level Java analysis)" };
+  return { capable: false, reason: "No TypeScript project, Vue components, root Go module, or Maven reactor found" };
 }
 
 export interface TypeScriptProjectCapability {

package/node_modules/@diffci.com/core/src/repo/impact.ts

@@ -1,4 +1,6 @@
 import { extname, posix } from "node:path";
+import { isGoDiscoveryIgnoredPath } from "./adapters/go.js";
+import { inVuePackage } from "./vue-scope.js";
 import type { ChangedFile, GitDelta } from "../git/types.js";
 import type { DependencyGraph, DependencyGraphNode, DependencyGraphResult, EntryPoint, RepositoryProfile } from "./types.js";
 import type { ChangedImpact, EntryPointImpact, ImpactEvidence, ImpactEvidencePath, ImpactReason, ImpactResult, ImpactRiskSignal, TestImpact } from "./impact-types.js";
@@ -7,7 +9,7 @@ import { repositoryLayout, UNKNOWN_REPOSITORY_LAYOUT, type RepositoryLayout } fr
 import { DEFAULT_TEST_FILE_MATCHER, matchesGlob as matchesTestGlob, testFileMatcherForProfile } from "./test-discovery.js";
 import { resolveTestFixtureOwners } from "./test-fixture-ownership.js";
 
-const SOURCE_EXTENSIONS = new Set([".ts",".tsx",".js",".jsx",".mjs",".cjs",".mts",".cts",".vue",".go"]);
+const SOURCE_EXTENSIONS = new Set([".ts",".tsx",".js",".jsx",".mjs",".cjs",".mts",".cts",".vue",".go",".java",".kt"]);
 const ASSET_EXTENSIONS = new Set([".css",".scss",".sass",".less",".json",".jsonc",".svg",".png",".jpg",".jpeg",".gif",".webp",".ico",".bmp",".woff",".woff2",".ttf",".otf",".eot",".wasm",".md",".txt"]);
 const NEXT_ENTRY_NAMES = new Set(["page","layout","route","api","loading","error","template","not-found","middleware","generatemetadata","generatestaticparams"]);
 
@@ -242,8 +244,21 @@ export class ImpactAnalyzer {
     const evidence: ImpactEvidence[] = [];
     const riskSignals: ImpactRiskSignal[] = [];
     const fallbackReasons: string[] = [...(graphResult.adapterBlockers ?? [])];
+    if (profile.vueScope) {
+      const scope = profile.vueScope;
+      if (delta.files.some(file => allChangePaths(file).some(path => !inVuePackage(path, scope.packageRoot)))) fallbackReasons.push("Changes outside the declared Vue package require full validation");
+      const setupDependencies = new Set((profile.vueSetupPaths ?? []).flatMap(path => [path, ...graph.transitiveDependenciesOf(path)]));
+      if (delta.files.some(file => allChangePaths(file).some(path => setupDependencies.has(path)))) fallbackReasons.push("Vue suite configuration or shared setup dependency changed; full validation required");
+    }
+    if (profile.adapters?.some(adapter => adapter.id === "go") && delta.files.some(file => allChangePaths(file).some(isGoDiscoveryIgnoredPath))) {
+      fallbackReasons.push("Changes in Go discovery-excluded paths require full validation, including runtime test data");
+    }
+    const excludedGoRoots = profile.goExcludedModuleRoots ?? [];
+    if (delta.files.some(file => allChangePaths(file).some(path => excludedGoRoots.some(root => path.startsWith(root))))) {
+      fallbackReasons.push("Changes in a Go module outside the declared root-module scope require full validation");
+    }
     for (const file of delta.files) {
-      if (allChangePaths(file).some((path) => /(?:^|\/)(?:go\.(?:mod|sum|work)|go\.work\.sum|(?:vite|vue|nuxt)\.config\.[^/]+)$/.test(path))) {
+      if (allChangePaths(file).some((path) => /(?:^|\/)(?:diffci\.json|go\.(?:mod|sum|work)|go\.work\.sum|(?:vite|vue|nuxt)\.config\.[^/]+)$/.test(path))) {
         fallbackReasons.push(`Language/framework configuration changed: ${file.path}`);
       }
     }
@@ -293,7 +308,7 @@ export class ImpactAnalyzer {
 
     this.handleStructuralNextLayout(changedImpacts, profile, affectedEntryPoints, affectedSources, evidence);
     this.handleAddedEntryPoints(delta, affectedEntryPoints, affectedSources, affectedTests, evidence, fallbackReasons);
-    this.collectAlwaysRunTests(profile, graph, affectedTests, evidence);
+    this.collectAlwaysRunTests(profile, graph, affectedTests, evidence, graphResult.profile.vueRuntimeAlwaysRunPaths ?? []);
 
     // Changed-test self-selection invariant (2026-08-24): every executable directly-changed test
     // (added / modified / renamed-destination / copied-destination) MUST be present in the final
@@ -632,8 +647,9 @@ export class ImpactAnalyzer {
     graph: DependencyGraph,
     affectedTests: Map<string, TestImpact>,
     evidence: ImpactEvidence[],
+    graphRuntimeTests: readonly string[],
   ): void {
-    const alwaysRunPaths = new Set<string>();
+    const alwaysRunPaths = new Set<string>([...(profile.vueTypeTestPaths ?? []), ...(profile.vueRuntimeAlwaysRunPaths ?? []), ...graphRuntimeTests]);
     const knownTestPaths = new Set<string>();
     for (const testLocation of profile.tests) {
       for (const node of graph.nodes) {

package/node_modules/@diffci.com/core/src/repo/repo-config.ts

@@ -27,6 +27,13 @@ import { join } from "node:path";
 export interface DiffCiRepositoryConfig {
   /** Globs for tests that must be selected on every analysed change, regardless of reachability. */
   alwaysRunTests?: string[];
+  /** Explicitly limit Go selection to the root module's `go test ./...` universe. */
+  go?: { scope: "root-module" };
+  /** One package's default Vitest suite; paths are relative to the repository/package respectively. */
+  vue?: { packageRoot: string; testConfig: string };
+  /** Match the Maven lifecycle and profiles used by this repository's CI job. */
+  maven?: { goal: "test" | "verify"; profiles?: string[] };
+  configurationError?: string;
 }
 
 function readJsonFile(path: string): Record<string, unknown> | undefined {
@@ -49,7 +56,18 @@ function parseConfig(raw: unknown): DiffCiRepositoryConfig {
   const alwaysRunTests = Array.isArray(record.alwaysRunTests)
     ? record.alwaysRunTests.filter((entry): entry is string => typeof entry === "string" && entry.trim() !== "")
     : undefined;
-  return alwaysRunTests && alwaysRunTests.length > 0 ? { alwaysRunTests } : {};
+  const go = record.go as Record<string, unknown> | undefined;
+  const vue = record.vue as Record<string, unknown> | undefined;
+  const maven = record.maven as Record<string, unknown> | undefined;
+  const safePath = (value: unknown): value is string => typeof value === "string" && /^(?:[A-Za-z0-9_][A-Za-z0-9_.-]*)(?:\/[A-Za-z0-9_][A-Za-z0-9_.-]*)*$/.test(value) && !value.split("/").some(part => part === "." || part === "..");
+  const validVue = vue && (vue.packageRoot === "." || safePath(vue.packageRoot)) && safePath(vue.testConfig) && /^vitest\.config\.[cm]?[jt]s$/.test(vue.testConfig);
+  const validMaven = maven && (maven.goal === "test" || maven.goal === "verify") && (maven.profiles === undefined || Array.isArray(maven.profiles) && maven.profiles.every((profile: unknown) => typeof profile === "string" && /^[A-Za-z0-9_.-]+$/.test(profile)));
+  return {
+    ...(alwaysRunTests && alwaysRunTests.length > 0 ? { alwaysRunTests } : {}),
+    ...(go?.scope === "root-module" ? { go: { scope: "root-module" as const } } : {}),
+    ...(validVue ? { vue: { packageRoot: vue.packageRoot as string, testConfig: vue.testConfig as string } } : record.vue !== undefined ? { configurationError: "Invalid Vue package/suite scope" } : {}),
+    ...(validMaven ? { maven: { goal: maven.goal as "test" | "verify", ...(maven.profiles ? { profiles: maven.profiles as string[] } : {}) } } : record.maven !== undefined ? { configurationError: "Invalid Maven lifecycle goal or profiles" } : {}),
+  };
 }
 
 /**
@@ -60,7 +78,7 @@ export function readRepositoryConfig(repoPath: string, packageJson?: Record<stri
   const dedicated = readJsonFile(join(repoPath, "diffci.json"));
   if (dedicated) {
     const parsed = parseConfig(dedicated);
-    if (parsed.alwaysRunTests) return parsed;
+    if (parsed.alwaysRunTests || parsed.go || parsed.vue || parsed.maven || parsed.configurationError) return parsed;
   }
   const pkg = packageJson ?? readJsonFile(join(repoPath, "package.json"));
   return parseConfig(pkg?.diffci);

package/node_modules/@diffci.com/core/src/repo/test-discovery.ts

@@ -314,6 +314,8 @@ function translateExtglobBody(body: string): string {
 }
 
 function globToRegex(pattern: string): RegExp {
+  // Runner globs are relative to their configured root; a leading ./ is not a directory.
+  pattern = pattern.replace(/^(?:\.\/)+/, "");
   // Extglob bodies contain `*`, `?` and `|` that must not be rewritten by the wildcard rules below,
   // so they are lifted out behind placeholders first and restored last.
   const groups: string[] = [];

package/node_modules/@diffci.com/core/src/repo/types.ts

@@ -44,6 +44,15 @@ export interface RepositoryProfile {
   adapterBlockers?: string[];
   goTestPackages?: Record<string, string>;
   goTestEnvironment?: Record<string, string>;
+  /** Maven/JUnit test file to owning reactor module (repo-relative, "." for root). */
+  mavenTestModules?: Record<string, string>;
+  /** Nested modules excluded by an explicit root-module execution scope. Changes here force full CI. */
+  goExcludedModuleRoots?: string[];
+  vueScope?: { packageRoot: string; testConfig: string };
+  vueSetupPaths?: string[];
+  vueTypeTestPaths?: string[];
+  vueRuntimeIsolationVerified?: boolean;
+  vueRuntimeAlwaysRunPaths?: string[];
   packageManager: PackageManager;
   packageJson: {
     name?: string;
@@ -205,6 +214,8 @@ export interface GraphIntegrityReport {
 
 export interface GraphPerformanceMetrics {
   durationMs: number;
+  phasesMs?: Record<string, number>;
+  adapterMetrics?: Record<string, { phasesMs: Record<string, number>; counts: Record<string, number> }>;
   heapUsedMb?: number;
   heapAfterExtractionMb?: number;
   filesDiscovered: number;

package/node_modules/@diffci.com/core/src/repo/vue-scope.ts

@@ -0,0 +1,122 @@
+import { existsSync, readFileSync, realpathSync } from "node:fs";
+import { isAbsolute, join, relative, resolve } from "node:path";
+import ts from "typescript";
+import { analyzeRepository } from "./analyzer.js";
+import type { RepositoryProfile } from "./types.js";
+import { adapterFiles } from "./adapters/index.js";
+
+export function inVuePackage(path: string, root: string): boolean {
+  return root === "." || path === root || path.startsWith(`${root}/`);
+}
+
+/** Scope is an explicit CI declaration, never inferred from a convenient source directory. */
+export function applyVueScope(repoPath: string, profile: RepositoryProfile): string[] {
+  const scope = profile.diffciConfig?.vue;
+  if (!scope) return profile.diffciConfig?.configurationError ? [profile.diffciConfig.configurationError] : [];
+  const packagePath = join(repoPath, scope.packageRoot);
+  const prefix = (path: string) => scope.packageRoot === "." ? path.replace(/^\.\//, "") : `${scope.packageRoot}/${path.replace(/^\.\//, "")}`;
+  if (!existsSync(join(packagePath, "package.json")) || !existsSync(join(packagePath, scope.testConfig))) return ["Vue scope requires an existing package.json and default Vitest config"];
+  const actual = relative(realpathSync(repoPath), realpathSync(packagePath));
+  if (actual === ".." || actual.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) || isAbsolute(actual)) return ["Vue package scope escapes the repository"];
+  const physicallyLocal = (path: string) => {
+    const physical = relative(realpathSync(packagePath), realpathSync(join(packagePath, path))).replace(/\\/g, "/");
+    return physical !== ".." && !physical.startsWith("../") && !isAbsolute(physical);
+  };
+  if (!["package.json", scope.testConfig].every(physicallyLocal)) return ["Vue package manifest or config crosses the physical package boundary"];
+  const scoped = analyzeRepository({ repoPath: packagePath });
+  const configs = scoped.testRunnerConfigs ?? [];
+  if (configs.length !== 1 || configs[0].file !== scope.testConfig || configs[0].runner !== "vitest") return ["Vue scope requires exactly one verified default Vitest suite"];
+  if (configs[0].declaresTests && !configs[0].authoritative) return ["Vue scoped test patterns could not be fully verified"];
+  if ([...configs[0].includes, ...configs[0].roots].some(path => /^(?:\/|\\|[A-Za-z]:)/.test(path) || path.split(/[\\/]/).includes(".."))) return ["Vue test discovery crosses the package boundary"];
+  const config = ts.createSourceFile(scope.testConfig, readFileSync(join(packagePath, scope.testConfig), "utf8"), ts.ScriptTarget.Latest, true);
+  const blockers: string[] = [];
+  const setup: string[] = [prefix(scope.testConfig)];
+  let typecheckEnabled = false;
+  let runtimeIsolation = true;
+  const allowedImports = new Set(["vitest/config", "@vitejs/plugin-vue", "node:path", "node:url", "path", "url"]);
+  const factories = new Set<string>();
+  const vuePlugins = new Set<string>();
+  for (const statement of config.statements) {
+    if (!ts.isImportDeclaration(statement) || !ts.isStringLiteral(statement.moduleSpecifier)) continue;
+    if (statement.moduleSpecifier.text === "@vitejs/plugin-vue" && statement.importClause?.name) vuePlugins.add(statement.importClause.name.text);
+    if (statement.moduleSpecifier.text === "vitest/config" && statement.importClause?.namedBindings && ts.isNamedImports(statement.importClause.namedBindings)) {
+      for (const element of statement.importClause.namedBindings.elements) if ((element.propertyName ?? element.name).text === "defineConfig") factories.add(element.name.text);
+    }
+  }
+  const exported = config.statements.find(ts.isExportAssignment);
+  let definition = exported?.expression;
+  if (definition && ts.isCallExpression(definition) && ts.isIdentifier(definition.expression) && factories.has(definition.expression.text) && definition.arguments.length === 1) definition = definition.arguments[0];
+  if (!definition || !ts.isObjectLiteralExpression(definition)) blockers.push("Vue scope requires a literal default Vitest configuration");
+  function visit(node: ts.Node): void {
+    if (ts.isSpreadAssignment(node) || ts.isComputedPropertyName(node)) blockers.push("Vue scoped config contains unmodeled configuration composition");
+    if (ts.isImportDeclaration(node) && ts.isStringLiteral(node.moduleSpecifier) && !allowedImports.has(node.moduleSpecifier.text)) blockers.push("Vue scoped Vitest config has an unsupported plugin or config helper");
+    if (ts.isPropertyAssignment(node) && (ts.isIdentifier(node.name) || ts.isStringLiteral(node.name))) {
+      const name = node.name.text;
+      if (name === "isolate" && node.initializer.kind !== ts.SyntaxKind.TrueKeyword) runtimeIsolation = false;
+      if (["runner", "browser", "poolOptions", "poolMatchGlobs", "environmentMatchGlobs"].includes(name)) runtimeIsolation = false;
+      if (name === "pool" && (!ts.isStringLiteral(node.initializer) || !["threads", "forks"].includes(node.initializer.text))) runtimeIsolation = false;
+      if (name === "environment" && (!ts.isStringLiteral(node.initializer) || !["node", "jsdom", "happy-dom"].includes(node.initializer.text))) runtimeIsolation = false;
+      if (name === "typecheck") {
+        if (!ts.isObjectLiteralExpression(node.initializer)) blockers.push("Vue typecheck configuration must be literal");
+        else for (const property of node.initializer.properties) {
+          if (!ts.isPropertyAssignment(property) || !(ts.isIdentifier(property.name) || ts.isStringLiteral(property.name))) { blockers.push("Vue typecheck configuration is not fully modeled"); continue; }
+          if (property.name.text === "enabled") {
+            if (property.initializer.kind === ts.SyntaxKind.TrueKeyword) typecheckEnabled = true;
+            else if (property.initializer.kind !== ts.SyntaxKind.FalseKeyword) blockers.push("Vue typecheck enabled flag must be literal");
+          }
+          if (["include", "exclude", "only"].includes(property.name.text)) blockers.push("Custom Vue type-test discovery requires full validation");
+        }
+      }
+      if (name === "plugins" && (!ts.isArrayLiteralExpression(node.initializer) || node.initializer.elements.some(element => !ts.isCallExpression(element) || !ts.isIdentifier(element.expression) || !vuePlugins.has(element.expression.text) || element.arguments.length !== 0))) blockers.push("Vue scope supports only the default Vue compiler plugin");
+      if (["root", "projects", "workspace", "extends"].includes(name)) blockers.push("Vue scoped Vitest config overrides its package boundary");
+      if (["setupFiles", "globalSetup"].includes(name)) {
+        const values = ts.isArrayLiteralExpression(node.initializer) ? [...node.initializer.elements] : [node.initializer];
+        for (const value of values) {
+          if (!ts.isStringLiteral(value)) { blockers.push("Vue scoped setup paths must be literal package-local files"); continue; }
+          const path = relative(packagePath, resolve(packagePath, value.text)).replace(/\\/g, "/");
+          if (path.startsWith("../") || isAbsolute(path) || !existsSync(join(packagePath, path)) || !physicallyLocal(path)) blockers.push("Vue scoped setup path escapes or is missing from the package");
+          else setup.push(prefix(path));
+        }
+      }
+    }
+    ts.forEachChild(node, visit);
+  }
+  visit(config);
+  // Only a literal test object can establish the default isolated Vitest contract.
+  const testDefinitions = definition && ts.isObjectLiteralExpression(definition) ? definition.properties.filter(p => p.name && (ts.isIdentifier(p.name) || ts.isStringLiteral(p.name)) && p.name.text === "test") : [];
+  const testDefinition = testDefinitions.length === 1 ? testDefinitions[0] : undefined;
+  const literalProperties = (node: ts.Node): boolean => {
+    if (ts.isObjectLiteralExpression(node) && node.properties.some(p => !ts.isPropertyAssignment(p) || ts.isComputedPropertyName(p.name))) return false;
+    let valid = true;
+    ts.forEachChild(node, child => { if (!literalProperties(child)) valid = false; });
+    return valid;
+  };
+  profile.vueRuntimeIsolationVerified = runtimeIsolation && blockers.length === 0 && !!testDefinition && ts.isPropertyAssignment(testDefinition) && ts.isObjectLiteralExpression(testDefinition.initializer) && literalProperties(testDefinition.initializer);
+  // Package discovery supplies the runner universe. Do not let repository-wide docs,
+  // playground configs or other frameworks expand or replace this declared suite.
+  profile.vueScope = scope;
+  profile.vueSetupPaths = setup;
+  profile.packageJson = scoped.packageJson;
+  profile.sourceRoots = scoped.sourceRoots.map(root => ({ ...root, path: prefix(root.path) }));
+  profile.testFilePaths = scoped.testFilePaths.map(prefix);
+  profile.testPatterns = scoped.testPatterns?.map(prefix);
+  profile.testExcludePatterns = scoped.testExcludePatterns?.map(prefix);
+  profile.testAuthoritativePatterns = scoped.testAuthoritativePatterns?.map(prefix);
+  if (typecheckEnabled) {
+    // Vitest's typecheck.include default is independent from its runtime test include.
+    // Keep every type suite, rather than applying runtime reachability to type checking.
+    profile.vueTypeTestPaths = adapterFiles(packagePath).filter(path => /\.(?:test|spec)-d\.[cm]?[jt]sx?$/.test(path)).map(prefix);
+    profile.testFilePaths = [...new Set([...profile.testFilePaths, ...profile.vueTypeTestPaths])].sort();
+    profile.testPatterns = [...(profile.testPatterns ?? []), ...profile.vueTypeTestPaths];
+    profile.testAuthoritativePatterns = [...(profile.testAuthoritativePatterns ?? []), ...profile.vueTypeTestPaths];
+    if (!profile.vueTypeTestPaths.length) blockers.push("Enabled Vue type checking has no discovered type suites");
+  }
+  profile.testIgnoreRegexSources = scoped.testIgnoreRegexSources;
+  profile.testRoots = scope.packageRoot === "." ? undefined : [scope.packageRoot];
+  profile.tests = scoped.tests.map(test => ({ ...test, glob: prefix(test.glob) }));
+  profile.testRunnerConfigs = configs.map(config => ({ ...config, file: prefix(config.file), includes: config.includes.map(prefix), excludeGlobs: config.excludeGlobs.map(prefix), roots: config.roots.map(prefix) }));
+  profile.testUniverse = scoped.testUniverse;
+  profile.entryPoints = scoped.entryPoints.map(entry => ({ ...entry, path: prefix(entry.path) }));
+  profile.pathAliases = scoped.pathAliases.map(alias => ({ ...alias, substitutions: alias.substitutions.map(prefix) }));
+  return [...blockers, ...(profile.testFilePaths.length ? [] : ["Declared Vue suite has no discovered tests"])];
+}