@opencodehub/ingestion 0.1.0

package/dist/pipeline/phases/default-set.js

@@ -0,0 +1,133 @@
+/**
+ * Default pipeline phase set — full 14-phase DAG.
+ *
+ * The runner treats this array as the canonical ordering source. Adding or
+ * removing a phase is a one-line change here; the DAG validator catches
+ * missing dependencies and cycles on the next run.
+ *
+ * Phase ordering (topologically):
+ *   scan → profile
+ *        → structure → markdown → parse → complexity → routes → tools →
+ *                                         orm → crossFile → mro →
+ *                                         communities → dead-code →
+ *                                         processes → temporal → annotate
+ *
+ * `markdown` depends on `structure` and could run alongside `parse`; the
+ * runner serialises everything since determinism dominates the latency
+ * win at MVP scale. `profile` and `temporal` are pure leaves on `scan`
+ * and could run in parallel with any post-scan phase once the runner
+ * learns to fan out. `profile` emits a single ProjectProfile node that
+ * scanner phases will consult to decide which scanners to invoke.
+ */
+import { accessesPhase } from "./accesses.js";
+import { annotatePhase } from "./annotate.js";
+import { cochangePhase } from "./cochange.js";
+import { communitiesPhase } from "./communities.js";
+import { complexityPhase } from "./complexity.js";
+import { confidenceDemotePhase } from "./confidence-demote.js";
+import { crossFilePhase } from "./cross-file.js";
+import { deadCodePhase } from "./dead-code.js";
+import { dependenciesPhase } from "./dependencies.js";
+import { embeddingsPhase } from "./embeddings.js";
+import { fetchesPhase } from "./fetches.js";
+import { incrementalScopePhase } from "./incremental-scope.js";
+import { markdownPhase } from "./markdown.js";
+import { mroPhase } from "./mro.js";
+import { openapiPhase } from "./openapi.js";
+import { ormPhase } from "./orm.js";
+import { ownershipPhase } from "./ownership.js";
+import { parsePhase } from "./parse.js";
+import { processesPhase } from "./processes.js";
+import { profilePhase } from "./profile.js";
+import { repoNodePhase } from "./repo-node.js";
+import { riskSnapshotPhase } from "./risk-snapshot.js";
+import { routesPhase } from "./routes.js";
+import { sbomPhase } from "./sbom.js";
+import { scanPhase } from "./scan.js";
+import { scipIndexPhase } from "./scip-index.js";
+import { structurePhase } from "./structure.js";
+import { summarizePhase } from "./summarize.js";
+import { temporalPhase } from "./temporal.js";
+import { toolsPhase } from "./tools.js";
+export const DEFAULT_PHASES = [
+    scanPhase,
+    profilePhase,
+    // `repo-node` emits one RepoNode and runs immediately after
+    // `profile` so it inherits the detected-languages list when deriving
+    // `languageStats`. It has no downstream dependents — the node is read
+    // from the graph by MCP tools at query time, not consumed by later phases.
+    repoNodePhase,
+    structurePhase,
+    markdownPhase,
+    parsePhase,
+    // incremental-scope is passive at v1.0: it consumes scan output and emits
+    // a closure hint for future consumers. Placed after parse so later phases
+    // can plumb `ctx.phaseOutputs.incremental-scope.closureFiles` once they
+    // learn to honour it. It has no downstream dependents today.
+    incrementalScopePhase,
+    complexityPhase,
+    routesPhase,
+    openapiPhase,
+    toolsPhase,
+    ormPhase,
+    crossFilePhase,
+    // `accesses` depends on parse (symbol boundaries + source) and cross-file
+    // (stable CALLS graph before we layer ACCESSES on top). Runs before
+    // communities so ACCESSES can participate in Leiden weights if we later
+    // decide to surface receiver ↔ field coupling.
+    accessesPhase,
+    // `scip-index` replaces the four per-language LSP upgrade phases.
+    // It runs the appropriate SCIP indexer (scip-typescript / scip-python
+    // / scip-go / rust-analyzer --scip / scip-java), parses the resulting
+    // index, and emits CodeRelation edges with confidence=1.0 and
+    // reason=`scip:<indexer>@<version>`. No long-running language servers,
+    // no stdio JSON-RPC, no per-symbol roundtrips. Runs after the
+    // tree-sitter heuristic tier so its oracle edges can upgrade the
+    // heuristic graph in-place.
+    scipIndexPhase,
+    // `confidence-demote` runs immediately after `scip-index` and before
+    // `mro`. It demotes any confidence-0.5 heuristic edge whose triple is
+    // also covered by a confidence-1.0 SCIP-sourced edge to 0.2 with a
+    // `+scip-unconfirmed` reason suffix.
+    confidenceDemotePhase,
+    mroPhase,
+    communitiesPhase,
+    // Dead-code classification. Depends on cross-file (for inbound
+    // edges), MRO (for METHOD_OVERRIDES / METHOD_IMPLEMENTS keep-alive edges),
+    // and communities (for ghost-community rollups). Runs before processes so
+    // later phases can observe `deadness` on callable nodes.
+    deadCodePhase,
+    processesPhase,
+    // Outbound HTTP → Route detection runs after processes so enclosing-symbol
+    // anchors are consistent with Process entry-point ids, and after routes so
+    // local Route nodes are available for matching.
+    fetchesPhase,
+    temporalPhase,
+    cochangePhase,
+    // Ownership depends on temporal (for decayedChurn / top-contributor-last-seen /
+    // coauthorCount), communities (to denormalise truck-factor + drift), and parse
+    // (for symbol boundaries). Runs once per analyse cycle so blame happens once.
+    ownershipPhase,
+    dependenciesPhase,
+    // `sbom` depends on `dependencies` and is a silent no-op unless
+    // `options.sbom === true`. When enabled, it emits
+    // `.codehub/sbom.cyclonedx.json` + `.codehub/sbom.spdx.json`.
+    sbomPhase,
+    annotatePhase,
+    // `risk-snapshot` depends on `annotate` and captures a per-community +
+    // findings-histogram snapshot under `.codehub/history/` for trend analysis.
+    // Rotation keeps the last 100 snapshots.
+    riskSnapshotPhase,
+    // `summarize` runs after every LSP phase (via its dep on
+    // `confidence-demote`) so trust filtering observes finalised edge
+    // provenance, and BEFORE `embeddings` so a future follow-up can embed
+    // summary text alongside the existing signature/description vectors.
+    // The phase is a silent no-op unless `options.summaries === true`, and
+    // it is a hard no-op whenever `options.offline === true`.
+    summarizePhase,
+    // `embeddings` depends on `annotate` so it observes the final graph. The
+    // phase is a silent no-op unless `options.embeddings === true`. Keeping it
+    // at the tail means downstream hashing can key embeddings to graph state.
+    embeddingsPhase,
+];
+//# sourceMappingURL=default-set.js.map

package/dist/pipeline/phases/default-set.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"default-set.js","sourceRoot":"","sources":["../../../src/pipeline/phases/default-set.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,MAAM,CAAC,MAAM,cAAc,GAA6B;IACtD,SAAS;IACT,YAAY;IACZ,4DAA4D;IAC5D,qEAAqE;IACrE,sEAAsE;IACtE,2EAA2E;IAC3E,aAAa;IACb,cAAc;IACd,aAAa;IACb,UAAU;IACV,0EAA0E;IAC1E,0EAA0E;IAC1E,wEAAwE;IACxE,6DAA6D;IAC7D,qBAAqB;IACrB,eAAe;IACf,WAAW;IACX,YAAY;IACZ,UAAU;IACV,QAAQ;IACR,cAAc;IACd,0EAA0E;IAC1E,oEAAoE;IACpE,wEAAwE;IACxE,+CAA+C;IAC/C,aAAa;IACb,kEAAkE;IAClE,sEAAsE;IACtE,sEAAsE;IACtE,8DAA8D;IAC9D,uEAAuE;IACvE,8DAA8D;IAC9D,iEAAiE;IACjE,4BAA4B;IAC5B,cAAc;IACd,qEAAqE;IACrE,sEAAsE;IACtE,mEAAmE;IACnE,qCAAqC;IACrC,qBAAqB;IACrB,QAAQ;IACR,gBAAgB;IAChB,+DAA+D;IAC/D,2EAA2E;IAC3E,0EAA0E;IAC1E,yDAAyD;IACzD,aAAa;IACb,cAAc;IACd,2EAA2E;IAC3E,2EAA2E;IAC3E,gDAAgD;IAChD,YAAY;IACZ,aAAa;IACb,aAAa;IACb,gFAAgF;IAChF,+EAA+E;IAC/E,8EAA8E;IAC9E,cAAc;IACd,iBAAiB;IACjB,gEAAgE;IAChE,kDAAkD;IAClD,8DAA8D;IAC9D,SAAS;IACT,aAAa;IACb,uEAAuE;IACvE,4EAA4E;IAC5E,yCAAyC;IACzC,iBAAiB;IACjB,yDAAyD;IACzD,kEAAkE;IAClE,sEAAsE;IACtE,qEAAqE;IACrE,uEAAuE;IACvE,0DAA0D;IAC1D,cAAc;IACd,yEAAyE;IACzE,2EAA2E;IAC3E,0EAA0E;IAC1E,eAAe;CAChB,CAAC"}

package/dist/pipeline/phases/dependencies.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Dependencies phase — materialises external packages as Dependency
+ * nodes and links them to the manifest File node via DEPENDS_ON.
+ *
+ * Inputs: scan output (file list). We classify every scanned file by
+ * basename (optionally extension) and dispatch to a per-ecosystem parser
+ * (see `../dep-parsers/`). Each parser returns a list of
+ * `ParsedDependency` tuples; the phase promotes them to `DependencyNode`
+ * entries with the canonical id scheme
+ *
+ *     `Dependency:${ecosystem}:${name}@${version}`
+ *
+ * and adds DEPENDS_ON edges:
+ *
+ *     File(manifestPath) --DEPENDS_ON--> Dependency(...)
+ *
+ * This is intentionally coarse — v1.0 emits one DEPENDS_ON per
+ * (manifest, dep) rather than per-importing-source-file. A later pass
+ * can refine this to per-file once the parse phase exposes package
+ * resolution data.
+ *
+ * Determinism:
+ *   - Manifests visited in scan order (scan output is already sorted).
+ *   - Dependencies sorted canonically by
+ *     (ecosystem, name, version, lockfileSource) before graph insertion.
+ *   - `skippedEcosystems` output is sorted ascending.
+ *
+ * The phase is tolerant: any parser error becomes a warning and the
+ * offending manifest is skipped. Network access is forbidden.
+ *
+ * Phase dependency: `scan`. The phase is designed to eventually also
+ * depend on the ProjectProfile phase — we only need the scan output
+ * today, and the profile phase does not yet exist in default-set.
+ */
+import { type Ecosystem, type ParseDepsFn } from "../dep-parsers/index.js";
+import type { PipelinePhase } from "../types.js";
+export declare const DEPENDENCIES_PHASE_NAME: "dependencies";
+export interface DependenciesOutput {
+    readonly dependenciesEmitted: number;
+    readonly manifestsScanned: number;
+    /** Ecosystems with no discovered manifests (alphabetical). */
+    readonly skippedEcosystems: readonly Ecosystem[];
+}
+interface ManifestDispatch {
+    readonly ecosystem: Ecosystem;
+    readonly parse: ParseDepsFn;
+}
+/**
+ * Classify a scanned file by its basename + extension to decide which
+ * ecosystem parser should receive it. Order of checks matters: `go.mod`
+ * and `go.sum` must beat a generic `.mod` / `.sum` rule that does not
+ * exist (we are explicit to stay deterministic).
+ *
+ * Returns `undefined` for files we don't care about.
+ */
+export declare function classifyManifest(relPath: string): ManifestDispatch | undefined;
+export declare const dependenciesPhase: PipelinePhase<DependenciesOutput>;
+export {};
+//# sourceMappingURL=dependencies.d.ts.map

package/dist/pipeline/phases/dependencies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependencies.d.ts","sourceRoot":"","sources":["../../../src/pipeline/phases/dependencies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAKH,OAAO,EAGL,KAAK,SAAS,EACd,KAAK,WAAW,EAEjB,MAAM,yBAAyB,CAAC;AAMjC,OAAO,KAAK,EAAmB,aAAa,EAAE,MAAM,aAAa,CAAC;AAIlE,eAAO,MAAM,uBAAuB,EAAG,cAAuB,CAAC;AAE/D,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,8DAA8D;IAC9D,QAAQ,CAAC,iBAAiB,EAAE,SAAS,SAAS,EAAE,CAAC;CAClD;AAED,UAAU,gBAAgB;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;CAC7B;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAqD9E;AAED,eAAO,MAAM,iBAAiB,EAAE,aAAa,CAAC,kBAAkB,CAc/D,CAAC"}

package/dist/pipeline/phases/dependencies.js

@@ -0,0 +1,281 @@
+/**
+ * Dependencies phase — materialises external packages as Dependency
+ * nodes and links them to the manifest File node via DEPENDS_ON.
+ *
+ * Inputs: scan output (file list). We classify every scanned file by
+ * basename (optionally extension) and dispatch to a per-ecosystem parser
+ * (see `../dep-parsers/`). Each parser returns a list of
+ * `ParsedDependency` tuples; the phase promotes them to `DependencyNode`
+ * entries with the canonical id scheme
+ *
+ *     `Dependency:${ecosystem}:${name}@${version}`
+ *
+ * and adds DEPENDS_ON edges:
+ *
+ *     File(manifestPath) --DEPENDS_ON--> Dependency(...)
+ *
+ * This is intentionally coarse — v1.0 emits one DEPENDS_ON per
+ * (manifest, dep) rather than per-importing-source-file. A later pass
+ * can refine this to per-file once the parse phase exposes package
+ * resolution data.
+ *
+ * Determinism:
+ *   - Manifests visited in scan order (scan output is already sorted).
+ *   - Dependencies sorted canonically by
+ *     (ecosystem, name, version, lockfileSource) before graph insertion.
+ *   - `skippedEcosystems` output is sorted ascending.
+ *
+ * The phase is tolerant: any parser error becomes a warning and the
+ * offending manifest is skipped. Network access is forbidden.
+ *
+ * Phase dependency: `scan`. The phase is designed to eventually also
+ * depend on the ProjectProfile phase — we only need the scan output
+ * today, and the profile phase does not yet exist in default-set.
+ */
+import { makeNodeId } from "@opencodehub/core-types";
+import { parseGoDeps } from "../dep-parsers/go.js";
+import { compareParsedDependency, dedupAndSort, } from "../dep-parsers/index.js";
+import { parseMavenDeps } from "../dep-parsers/maven.js";
+import { parseNpmDeps } from "../dep-parsers/npm.js";
+import { parseNugetDeps } from "../dep-parsers/nuget.js";
+import { parsePythonDeps } from "../dep-parsers/python.js";
+import { parseRustDeps } from "../dep-parsers/rust.js";
+import { PROFILE_PHASE_NAME } from "./profile.js";
+import { SCAN_PHASE_NAME } from "./scan.js";
+export const DEPENDENCIES_PHASE_NAME = "dependencies";
+/**
+ * Classify a scanned file by its basename + extension to decide which
+ * ecosystem parser should receive it. Order of checks matters: `go.mod`
+ * and `go.sum` must beat a generic `.mod` / `.sum` rule that does not
+ * exist (we are explicit to stay deterministic).
+ *
+ * Returns `undefined` for files we don't care about.
+ */
+export function classifyManifest(relPath) {
+    // Use forward-slash splitting; scan emits POSIX paths.
+    const parts = relPath.split("/");
+    const basename = parts[parts.length - 1] ?? relPath;
+    // npm
+    if (basename === "package-lock.json" || basename === "pnpm-lock.yaml") {
+        return { ecosystem: "npm", parse: parseNpmDeps };
+    }
+    // Bare package.json (lockfile preferred when both are present — we
+    // handle that at the phase level by skipping package.json when a
+    // sibling lockfile is in the manifest set).
+    if (basename === "package.json") {
+        return { ecosystem: "npm", parse: parseNpmDeps };
+    }
+    // python
+    if (basename === "pyproject.toml") {
+        return { ecosystem: "pypi", parse: parsePythonDeps };
+    }
+    if (basename === "uv.lock") {
+        return { ecosystem: "pypi", parse: parsePythonDeps };
+    }
+    if (basename === "requirements.txt" || /^requirements-.*\.txt$/.test(basename)) {
+        return { ecosystem: "pypi", parse: parsePythonDeps };
+    }
+    // go
+    if (basename === "go.mod" || basename === "go.sum") {
+        return { ecosystem: "go", parse: parseGoDeps };
+    }
+    // rust
+    if (basename === "Cargo.lock" || basename === "Cargo.toml") {
+        return { ecosystem: "cargo", parse: parseRustDeps };
+    }
+    // maven
+    if (basename === "pom.xml") {
+        return { ecosystem: "maven", parse: parseMavenDeps };
+    }
+    // nuget
+    if (basename === "packages.lock.json" ||
+        basename.endsWith(".csproj") ||
+        basename.endsWith(".fsproj") ||
+        basename.endsWith(".vbproj")) {
+        return { ecosystem: "nuget", parse: parseNugetDeps };
+    }
+    return undefined;
+}
+export const dependenciesPhase = {
+    name: DEPENDENCIES_PHASE_NAME,
+    // Depends on `profile` so we only classify manifests the profile phase
+    // already vetted — and so the dependency phase runs strictly after
+    // ProjectProfile (this guarantees profile-driven ecosystem gating when
+    // the profile's manifest list becomes a hard filter in v1.1).
+    deps: [SCAN_PHASE_NAME, PROFILE_PHASE_NAME],
+    async run(ctx) {
+        const scan = ctx.phaseOutputs.get(SCAN_PHASE_NAME);
+        if (scan === undefined) {
+            throw new Error("dependencies: scan output missing from phase outputs");
+        }
+        return runDependencies(ctx, scan);
+    },
+};
+async function runDependencies(ctx, scan) {
+    const classified = selectManifests(scan.files);
+    const ecoWithDeps = new Set();
+    const allParsed = [];
+    let manifestsScanned = 0;
+    for (const entry of classified) {
+        manifestsScanned += 1;
+        const deps = await entry.dispatch.parse({
+            absPath: entry.file.absPath,
+            relPath: entry.file.relPath,
+            repoRoot: ctx.repoPath,
+            onWarn: (m) => {
+                ctx.onProgress?.({
+                    phase: DEPENDENCIES_PHASE_NAME,
+                    kind: "warn",
+                    message: m,
+                });
+            },
+        });
+        for (const d of deps) {
+            allParsed.push(d);
+            ecoWithDeps.add(d.ecosystem);
+        }
+    }
+    // Dedup + canonical sort before emitting nodes/edges. Two manifests in
+    // the same repo (e.g. package.json + package-lock.json) will typically
+    // yield overlapping sets; dedup on
+    // (ecosystem, name, version, lockfileSource) retains both sources'
+    // edges while keeping a single node per coordinate.
+    const deduped = dedupAndSort(allParsed);
+    // Build Dependency nodes (one node per (ecosystem, name, version)
+    // coordinate — lockfileSource is *not* part of node identity, but
+    // remembered on the node via `lockfileSource` field using the first
+    // source encountered in canonical order).
+    const nodeById = new Map();
+    for (const d of deduped) {
+        const id = depNodeId(d.ecosystem, d.name, d.version);
+        const license = normalizeLicenseField(d.license);
+        const existing = nodeById.get(id);
+        if (existing === undefined) {
+            const node = {
+                id,
+                kind: "Dependency",
+                name: d.name,
+                filePath: d.lockfileSource,
+                version: d.version,
+                ecosystem: d.ecosystem,
+                lockfileSource: d.lockfileSource,
+                license,
+            };
+            nodeById.set(id, node);
+        }
+        else if (existing.license === "UNKNOWN" && license !== "UNKNOWN") {
+            // Upgrade UNKNOWN when a later source for the same coordinate
+            // carries a real license.
+            nodeById.set(id, { ...existing, license });
+        }
+    }
+    // Insert into graph in canonical order for byte-stable hashing.
+    const nodes = [...nodeById.values()].sort(compareNodeByIdString);
+    for (const n of nodes) {
+        ctx.graph.addNode(n);
+    }
+    // DEPENDS_ON edges: File(manifestPath) --> Dependency(...).
+    // Emit each edge at most once (same manifest referencing the same dep
+    // across npm's package.json + package-lock.json would otherwise double).
+    emitDependencyEdges(ctx.graph, deduped);
+    const dependenciesEmitted = nodeById.size;
+    const ALL_ECOS = ["npm", "pypi", "go", "cargo", "maven", "nuget"];
+    const skippedEcosystems = ALL_ECOS.filter((e) => !ecoWithDeps.has(e)).sort();
+    return {
+        dependenciesEmitted,
+        manifestsScanned,
+        skippedEcosystems,
+    };
+}
+/**
+ * Walk the scan file list and pick the manifests we know how to parse.
+ * npm has a prefer-lockfile rule: if a directory has
+ * `package-lock.json`, we skip the sibling `package.json` to avoid
+ * emitting two versions for the same tree (one specifier string, one
+ * resolved version). Same for `pnpm-lock.yaml`.
+ */
+function selectManifests(files) {
+    // Index of directory -> set of basenames (used for the prefer-lockfile rule).
+    const dirBasenames = new Map();
+    for (const f of files) {
+        const slash = f.relPath.lastIndexOf("/");
+        const dir = slash === -1 ? "" : f.relPath.slice(0, slash);
+        const base = slash === -1 ? f.relPath : f.relPath.slice(slash + 1);
+        let set = dirBasenames.get(dir);
+        if (!set) {
+            set = new Set();
+            dirBasenames.set(dir, set);
+        }
+        set.add(base);
+    }
+    const out = [];
+    for (const f of files) {
+        const dispatch = classifyManifest(f.relPath);
+        if (!dispatch)
+            continue;
+        const slash = f.relPath.lastIndexOf("/");
+        const dir = slash === -1 ? "" : f.relPath.slice(0, slash);
+        const basename = slash === -1 ? f.relPath : f.relPath.slice(slash + 1);
+        if (basename === "package.json") {
+            const sib = dirBasenames.get(dir);
+            if (sib && (sib.has("package-lock.json") || sib.has("pnpm-lock.yaml"))) {
+                continue;
+            }
+        }
+        if (basename === "Cargo.toml") {
+            const sib = dirBasenames.get(dir);
+            if (sib?.has("Cargo.lock"))
+                continue;
+        }
+        if (basename === "go.mod") {
+            // Prefer go.sum when present; it enumerates transitives explicitly
+            // and dedups to the exact module graph.
+            const sib = dirBasenames.get(dir);
+            if (sib?.has("go.sum"))
+                continue;
+        }
+        out.push({ file: f, dispatch });
+    }
+    return out;
+}
+function emitDependencyEdges(graph, deps) {
+    // Sorted insertion matches the pre-dedup sort; confidence is a fixed
+    // 1.0 because a lockfile is authoritative evidence of dependence.
+    const sorted = [...deps].sort(compareParsedDependency);
+    for (const d of sorted) {
+        const fileId = makeNodeId("File", d.lockfileSource, d.lockfileSource);
+        const depId = depNodeId(d.ecosystem, d.name, d.version);
+        graph.addEdge({
+            from: fileId,
+            to: depId,
+            type: "DEPENDS_ON",
+            confidence: 1.0,
+            reason: `manifest:${d.ecosystem}`,
+        });
+    }
+}
+function depNodeId(ecosystem, name, version) {
+    return makeNodeId("Dependency", ecosystem, `${name}@${version}`);
+}
+function compareNodeByIdString(a, b) {
+    const av = a.id;
+    const bv = b.id;
+    if (av === bv)
+        return 0;
+    return av < bv ? -1 : 1;
+}
+/**
+ * Normalize a parser-supplied license value onto the DependencyNode.
+ * Drops empty strings, collapses to `"UNKNOWN"` when the parser did not
+ * find one, and leaves SPDX-normalisation to downstream callers that
+ * need it (the `license_audit` tool does its own pass).
+ */
+function normalizeLicenseField(raw) {
+    if (raw === undefined)
+        return "UNKNOWN";
+    const trimmed = raw.trim();
+    if (trimmed.length === 0)
+        return "UNKNOWN";
+    return trimmed;
+}
+//# sourceMappingURL=dependencies.js.map

package/dist/pipeline/phases/dependencies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependencies.js","sourceRoot":"","sources":["../../../src/pipeline/phases/dependencies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EACL,uBAAuB,EACvB,YAAY,GAIb,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,eAAe,EAAqC,MAAM,WAAW,CAAC;AAE/E,MAAM,CAAC,MAAM,uBAAuB,GAAG,cAAuB,CAAC;AAc/D;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,uDAAuD;IACvD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,OAAO,CAAC;IAEpD,MAAM;IACN,IAAI,QAAQ,KAAK,mBAAmB,IAAI,QAAQ,KAAK,gBAAgB,EAAE,CAAC;QACtE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IACnD,CAAC;IACD,mEAAmE;IACnE,iEAAiE;IACjE,4CAA4C;IAC5C,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;QAChC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IACnD,CAAC;IAED,SAAS;IACT,IAAI,QAAQ,KAAK,gBAAgB,EAAE,CAAC;QAClC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;IACvD,CAAC;IACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;IACvD,CAAC;IACD,IAAI,QAAQ,KAAK,kBAAkB,IAAI,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/E,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;IACvD,CAAC;IAED,KAAK;IACL,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACnD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IACjD,CAAC;IAED,OAAO;IACP,IAAI,QAAQ,KAAK,YAAY,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC3D,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;IACtD,CAAC;IAED,QAAQ;IACR,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;IACvD,CAAC;IAED,QAAQ;IACR,IACE,QAAQ,KAAK,oBAAoB;QACjC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5B,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5B,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,EAC5B,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;IACvD,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAsC;IAClE,IAAI,EAAE,uBAAuB;IAC7B,uEAAuE;IACvE,mEAAmE;IACnE,uEAAuE;IACvE,8DAA8D;IAC9D,IAAI,EAAE,CAAC,eAAe,EAAE,kBAAkB,CAAC;IAC3C,KAAK,CAAC,GAAG,CAAC,GAAG;QACX,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,CAA2B,CAAC;QAC7E,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACpC,CAAC;CACF,CAAC;AAEF,KAAK,UAAU,eAAe,CAC5B,GAAoB,EACpB,IAAgB;IAEhB,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAE/C,MAAM,WAAW,GAAG,IAAI,GAAG,EAAa,CAAC;IACzC,MAAM,SAAS,GAAuB,EAAE,CAAC;IACzC,IAAI,gBAAgB,GAAG,CAAC,CAAC;IAEzB,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC/B,gBAAgB,IAAI,CAAC,CAAC;QACtB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;YACtC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO;YAC3B,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO;YAC3B,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE;gBACZ,GAAG,CAAC,UAAU,EAAE,CAAC;oBACf,KAAK,EAAE,uBAAuB;oBAC9B,IAAI,EAAE,MAAM;oBACZ,OAAO,EAAE,CAAC;iBACX,CAAC,CAAC;YACL,CAAC;SACF,CAAC,CAAC;QACH,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,uEAAuE;IACvE,mCAAmC;IACnC,mEAAmE;IACnE,oDAAoD;IACpD,MAAM,OAAO,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IAExC,kEAAkE;IAClE,kEAAkE;IAClE,oEAAoE;IACpE,0CAA0C;IAC1C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA0B,CAAC;IACnD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,qBAAqB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAmB;gBAC3B,EAAE;gBACF,IAAI,EAAE,YAAY;gBAClB,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,QAAQ,EAAE,CAAC,CAAC,cAAc;gBAC1B,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,cAAc,EAAE,CAAC,CAAC,cAAc;gBAChC,OAAO;aACR,CAAC;YACF,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACzB,CAAC;aAAM,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YACnE,8DAA8D;YAC9D,0BAA0B;YAC1B,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IAED,gEAAgE;IAChE,MAAM,KAAK,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACjE,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC;IAED,4DAA4D;IAC5D,sEAAsE;IACtE,yEAAyE;IACzE,mBAAmB,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAExC,MAAM,mBAAmB,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC1C,MAAM,QAAQ,GAAyB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACxF,MAAM,iBAAiB,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAE7E,OAAO;QACL,mBAAmB;QACnB,gBAAgB;QAChB,iBAAiB;KAClB,CAAC;AACJ,CAAC;AAOD;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,KAA6B;IACpD,8EAA8E;IAC9E,MAAM,YAAY,GAAG,IAAI,GAAG,EAAuB,CAAC;IACpD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC1D,MAAM,IAAI,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACnE,IAAI,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC;YAChB,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC7B,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC;IAED,MAAM,GAAG,GAAyB,EAAE,CAAC;IACrC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,CAAC,QAAQ;YAAE,SAAS;QACxB,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACvE,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC;gBACvE,SAAS;YACX,CAAC;QACH,CAAC;QACD,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;YAC9B,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC;gBAAE,SAAS;QACvC,CAAC;QACD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,mEAAmE;YACnE,wCAAwC;YACxC,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC;gBAAE,SAAS;QACnC,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAqB,EAAE,IAAiC;IACnF,qEAAqE;IACrE,kEAAkE;IAClE,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IACvD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC;QACtE,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QACxD,KAAK,CAAC,OAAO,CAAC;YACZ,IAAI,EAAE,MAAM;YACZ,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,YAAY;YAClB,UAAU,EAAE,GAAG;YACf,MAAM,EAAE,YAAY,CAAC,CAAC,SAAS,EAAE;SAClC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,SAAoB,EAAE,IAAY,EAAE,OAAe;IACpE,OAAO,UAAU,CAAC,YAAY,EAAE,SAAS,EAAE,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,qBAAqB,CAAC,CAAiB,EAAE,CAAiB;IACjE,MAAM,EAAE,GAAG,CAAC,CAAC,EAAY,CAAC;IAC1B,MAAM,EAAE,GAAG,CAAC,CAAC,EAAY,CAAC;IAC1B,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,CAAC,CAAC;IACxB,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;GAKG;AACH,SAAS,qBAAqB,CAAC,GAAuB;IACpD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/pipeline/phases/embedder-pool.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Worker-pool `Embedder` facade.
+ *
+ * Wraps a Piscina pool of OnnxEmbedder workers behind the same
+ * `{ embed, embedBatch, close }` surface the embeddings phase already
+ * consumes. Each worker holds its own OnnxEmbedder; tasks are partitioned
+ * by batch index so repeat runs visit the same work → same worker
+ * assignment for a fixed pool size, preserving byte-identical output.
+ *
+ * Determinism note: the underlying ONNX session pins all thread counts to 1
+ * and disables graph optimization, so a given input text produces the same
+ * vector regardless of *which* worker computes it. The ordering guarantee
+ * here is belt-and-braces: we reassemble results in input order before
+ * returning.
+ */
+import type { Embedder } from "@opencodehub/embedder";
+export interface EmbedderPoolOptions {
+    readonly workers: number;
+    readonly variant: "fp32" | "int8";
+    readonly modelDir?: string;
+}
+/**
+ * Open a worker-pool-backed embedder. Caller must invoke `close()` when
+ * done; that tears the pool down.
+ *
+ * The pool is sized with `minThreads === maxThreads === workers` so worker
+ * allocation is stable across a run. Workers lazy-load their OnnxEmbedder
+ * on first task, so pool construction itself is cheap.
+ */
+export declare function openOnnxEmbedderPool(opts: EmbedderPoolOptions): Embedder;
+//# sourceMappingURL=embedder-pool.d.ts.map

package/dist/pipeline/phases/embedder-pool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"embedder-pool.d.ts","sourceRoot":"","sources":["../../../src/pipeline/phases/embedder-pool.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAQtD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;IAClC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,mBAAmB,GAAG,QAAQ,CAgDxE"}

package/dist/pipeline/phases/embedder-pool.js

@@ -0,0 +1,79 @@
+/**
+ * Worker-pool `Embedder` facade.
+ *
+ * Wraps a Piscina pool of OnnxEmbedder workers behind the same
+ * `{ embed, embedBatch, close }` surface the embeddings phase already
+ * consumes. Each worker holds its own OnnxEmbedder; tasks are partitioned
+ * by batch index so repeat runs visit the same work → same worker
+ * assignment for a fixed pool size, preserving byte-identical output.
+ *
+ * Determinism note: the underlying ONNX session pins all thread counts to 1
+ * and disables graph optimization, so a given input text produces the same
+ * vector regardless of *which* worker computes it. The ordering guarantee
+ * here is belt-and-braces: we reassemble results in input order before
+ * returning.
+ */
+import { fileURLToPath } from "node:url";
+import { embedderModelId } from "@opencodehub/embedder";
+import { Piscina } from "piscina";
+const WORKER_FILENAME = fileURLToPath(new URL("./embedder-worker.js", import.meta.url));
+/**
+ * Open a worker-pool-backed embedder. Caller must invoke `close()` when
+ * done; that tears the pool down.
+ *
+ * The pool is sized with `minThreads === maxThreads === workers` so worker
+ * allocation is stable across a run. Workers lazy-load their OnnxEmbedder
+ * on first task, so pool construction itself is cheap.
+ */
+export function openOnnxEmbedderPool(opts) {
+    const workerData = {
+        variant: opts.variant,
+    };
+    if (opts.modelDir !== undefined)
+        workerData.modelDir = opts.modelDir;
+    const pool = new Piscina({
+        filename: WORKER_FILENAME,
+        minThreads: opts.workers,
+        maxThreads: opts.workers,
+        // Each worker owns an ~300 MB ONNX session; don't recycle on idle.
+        idleTimeout: Number.POSITIVE_INFINITY,
+        workerData,
+    });
+    let closed = false;
+    const dim = 768; // gte-modernbert-base — matches OnnxEmbedder's EMBED_DIM.
+    async function embedBatch(texts) {
+        if (closed)
+            throw new Error("Embedder pool is closed");
+        if (texts.length === 0)
+            return [];
+        const result = await pool.run({ texts: [...texts] });
+        if (result.count === 0)
+            return [];
+        const flat = new Float32Array(result.buffer);
+        const out = [];
+        for (let i = 0; i < result.count; i++) {
+            // Slice copies into a fresh, non-shared Float32Array so callers can
+            // hang onto each vector independently of the transport buffer.
+            out.push(flat.slice(i * result.dim, (i + 1) * result.dim));
+        }
+        return out;
+    }
+    return {
+        dim,
+        modelId: embedderModelId(opts.variant),
+        async embed(text) {
+            const [vec] = await embedBatch([text]);
+            if (vec === undefined)
+                throw new Error("embedBatch returned empty result");
+            return vec;
+        },
+        embedBatch,
+        async close() {
+            if (closed)
+                return;
+            closed = true;
+            await pool.destroy();
+        },
+    };
+}
+//# sourceMappingURL=embedder-pool.js.map

package/dist/pipeline/phases/embedder-pool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"embedder-pool.js","sourceRoot":"","sources":["../../../src/pipeline/phases/embedder-pool.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAIlC,MAAM,eAAe,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,sBAAsB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAQxF;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAyB;IAC5D,MAAM,UAAU,GAAoD;QAClE,OAAO,EAAE,IAAI,CAAC,OAAO;KACtB,CAAC;IACF,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;QAAE,UAAU,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAErE,MAAM,IAAI,GAAG,IAAI,OAAO,CAAmC;QACzD,QAAQ,EAAE,eAAe;QACzB,UAAU,EAAE,IAAI,CAAC,OAAO;QACxB,UAAU,EAAE,IAAI,CAAC,OAAO;QACxB,mEAAmE;QACnE,WAAW,EAAE,MAAM,CAAC,iBAAiB;QACrC,UAAU;KACX,CAAC,CAAC;IAEH,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,0DAA0D;IAE3E,KAAK,UAAU,UAAU,CAAC,KAAwB;QAChD,IAAI,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACvD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC;QACrD,IAAI,MAAM,CAAC,KAAK,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAmB,EAAE,CAAC;QAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,oEAAoE;YACpE,+DAA+D;YAC/D,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,OAAO;QACL,GAAG;QACH,OAAO,EAAE,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC;QACtC,KAAK,CAAC,KAAK,CAAC,IAAY;YACtB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YACvC,IAAI,GAAG,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;YAC3E,OAAO,GAAG,CAAC;QACb,CAAC;QACD,UAAU;QACV,KAAK,CAAC,KAAK;YACT,IAAI,MAAM;gBAAE,OAAO;YACnB,MAAM,GAAG,IAAI,CAAC;YACd,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACvB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/pipeline/phases/embedder-worker.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Piscina worker entry point for the embeddings phase.
+ *
+ * Each worker lazy-opens its own OnnxEmbedder on first task and caches it for
+ * the lifetime of the worker. Tasks carry a flat list of chunk texts; the
+ * worker returns the vectors in input order.
+ *
+ * Determinism contract: `openOnnxEmbedder()` pins intraOpNumThreads=1,
+ * interOpNumThreads=1, and graphOptimizationLevel="disabled" — the same
+ * input produces byte-identical output regardless of which worker processed
+ * it. Callers partition work deterministically (block-chunked by batch
+ * index) so repeat runs reproduce the same byte-level output.
+ */
+export interface EmbedBatchTask {
+    readonly texts: readonly string[];
+}
+export interface EmbedBatchResult {
+    /**
+     * Flat binary payload of `texts.length * dim` float32 values, laid out as
+     * `[vec0, vec1, ...]`. Shipping a single ArrayBuffer avoids the per-vector
+     * structured-clone overhead when batches are large.
+     */
+    readonly buffer: ArrayBuffer;
+    readonly dim: number;
+    readonly count: number;
+}
+export default function embedBatch(task: EmbedBatchTask): Promise<EmbedBatchResult>;
+//# sourceMappingURL=embedder-worker.d.ts.map

package/dist/pipeline/phases/embedder-worker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"embedder-worker.d.ts","sourceRoot":"","sources":["../../../src/pipeline/phases/embedder-worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAWH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAeD,wBAA8B,UAAU,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAcxF"}