@opensip-cli/graph 0.1.0

package/dist/cli/__tests__/shard-worker.test.js

@@ -0,0 +1,153 @@
+/**
+ * `graph-shard-worker` — the per-shard build subprocess entry
+ * (`executeShardWorker`). It reads a `ShardWorkerSpec` JSON file, runs
+ * the build over the shard's files via the scope's language adapter, and
+ * writes a `ShardBuildResult` JSON to stdout, exiting 0. A bad spec path
+ * (or any build error) is attributed to the shard: stderr names it and
+ * the exit code is 1.
+ */
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { enterScope, LanguageRegistry } from '@opensip-cli/core';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { makeGraphTestScope } from '../../__tests__/test-utils/with-graph-scope.js';
+import { currentAdapterRegistry } from '../../lang-adapter/registry.js';
+import { executeShardWorker } from '../shard-worker.js';
+function fakeAdapter(id = 'typescript', fileExtension = '.ts') {
+    return {
+        id,
+        fileExtensions: [fileExtension],
+        displayName: 'Fake',
+        discoverFiles: () => ({
+            projectDirAbs: '/unused',
+            files: [],
+            configPathAbs: undefined,
+            compilerOptions: undefined,
+        }),
+        parseProject: () => ({ project: { dummy: true }, parseErrors: [] }),
+        walkProject: () => ({
+            occurrences: {
+                fn: [
+                    {
+                        bodyHash: 'h1',
+                        simpleName: 'fn',
+                        qualifiedName: `pkg/a.${id}.fn`,
+                        filePath: `pkg/a${fileExtension}`,
+                        line: 1,
+                        column: 0,
+                        endLine: 2,
+                        kind: 'function-declaration',
+                        params: [],
+                        returnType: null,
+                        enclosingClass: null,
+                        decorators: [],
+                        visibility: 'exported',
+                        inTestFile: false,
+                        definedInGenerated: false,
+                        calls: [],
+                    },
+                ],
+            },
+            callSites: [],
+            parseErrors: [],
+        }),
+        resolveCallSites: () => ({
+            edgesByOwner: new Map([['h1', []]]),
+            stats: {
+                totalCallSites: 0,
+                resolvedHigh: 0,
+                resolvedMedium: 0,
+                resolvedLow: 0,
+                unresolved: 0,
+            },
+        }),
+        cacheKey: () => `fake-shard-v1:${id}`,
+    };
+}
+function mockCli() {
+    const setExitCode = vi.fn();
+    return {
+        cli: {
+            setExitCode,
+            scope: { languages: new LanguageRegistry() },
+        },
+        setExitCode,
+    };
+}
+let dir;
+let stdoutSpy;
+let stderrSpy;
+let stdout = '';
+let stderr = '';
+beforeEach(() => {
+    enterScope(makeGraphTestScope());
+    dir = mkdtempSync(join(tmpdir(), 'shard-worker-'));
+    stdout = '';
+    stderr = '';
+    stdoutSpy = vi.spyOn(process.stdout, 'write').mockImplementation((c) => {
+        stdout += typeof c === 'string' ? c : c.toString();
+        return true;
+    });
+    stderrSpy = vi.spyOn(process.stderr, 'write').mockImplementation((c) => {
+        stderr += typeof c === 'string' ? c : c.toString();
+        return true;
+    });
+});
+afterEach(() => {
+    currentAdapterRegistry().clear();
+    stdoutSpy.mockRestore();
+    stderrSpy.mockRestore();
+    rmSync(dir, { recursive: true, force: true });
+});
+describe('executeShardWorker', () => {
+    it('builds the shard and emits a ShardBuildResult JSON on stdout, exit 0', async () => {
+        currentAdapterRegistry().register(fakeAdapter());
+        const specPath = join(dir, 'spec.json');
+        const spec = {
+            shard: { id: 'pkg:a', rootDir: dir, files: ['pkg/a.ts'] },
+            projectRoot: dir,
+            resolutionMode: 'exact',
+        };
+        writeFileSync(specPath, JSON.stringify(spec), 'utf8');
+        const { cli, setExitCode } = mockCli();
+        await executeShardWorker(specPath, cli);
+        expect(setExitCode).toHaveBeenCalledWith(0);
+        const result = JSON.parse(stdout);
+        expect(result.shardId).toBe('pkg:a');
+        expect(result.fragment.language).toBe('typescript');
+        expect(result.fragment.functions.fn).toHaveLength(1);
+        expect(result.fingerprint).toContain('pkg/a.ts');
+        expect(result.boundaryCalls).toEqual([]);
+        expect(result.parseErrors).toEqual([]);
+    });
+    it('honors the explicit language in the shard spec when selecting an adapter', async () => {
+        currentAdapterRegistry().register(fakeAdapter('typescript', '.ts'));
+        currentAdapterRegistry().register(fakeAdapter('python', '.py'));
+        const specPath = join(dir, 'spec.json');
+        const spec = {
+            shard: { id: 'pkg:a', rootDir: dir, files: ['pkg/a.py'] },
+            projectRoot: dir,
+            language: 'python',
+            resolutionMode: 'exact',
+        };
+        writeFileSync(specPath, JSON.stringify(spec), 'utf8');
+        const { cli, setExitCode } = mockCli();
+        await executeShardWorker(specPath, cli);
+        expect(setExitCode).toHaveBeenCalledWith(0);
+        const result = JSON.parse(stdout);
+        expect(result.fragment.language).toBe('python');
+        expect(result.fragment.cacheKey).toContain('python');
+        expect(result.fingerprint).toContain('pkg/a.py');
+    });
+    it('attributes a read/parse failure to the shard: stderr names it, exit 1', async () => {
+        currentAdapterRegistry().register(fakeAdapter());
+        // Spec file does not exist → readFileSync throws inside the worker.
+        const { cli, setExitCode } = mockCli();
+        await executeShardWorker(join(dir, 'missing.json'), cli);
+        expect(setExitCode).toHaveBeenCalledWith(1);
+        expect(stderr).toContain('graph-shard-worker');
+        expect(stdout).toBe('');
+    });
+});
+//# sourceMappingURL=shard-worker.test.js.map

package/dist/cli/__tests__/shard-worker.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shard-worker.test.js","sourceRoot":"","sources":["../../../src/cli/__tests__/shard-worker.test.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAqB,MAAM,QAAQ,CAAC;AAE5F,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAYxD,SAAS,WAAW,CAAC,EAAE,GAAG,YAAY,EAAE,aAAa,GAAG,KAAK;IAC3D,OAAO;QACL,EAAE;QACF,cAAc,EAAE,CAAC,aAAa,CAAC;QAC/B,WAAW,EAAE,MAAM;QACnB,aAAa,EAAE,GAAmB,EAAE,CAAC,CAAC;YACpC,aAAa,EAAE,SAAS;YACxB,KAAK,EAAE,EAAE;YACT,aAAa,EAAE,SAAS;YACxB,eAAe,EAAE,SAAS;SAC3B,CAAC;QACF,YAAY,EAAE,GAAgB,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;QAChF,WAAW,EAAE,GAAe,EAAE,CAAC,CAAC;YAC9B,WAAW,EAAE;gBACX,EAAE,EAAE;oBACF;wBACE,QAAQ,EAAE,IAAI;wBACd,UAAU,EAAE,IAAI;wBAChB,aAAa,EAAE,SAAS,EAAE,KAAK;wBAC/B,QAAQ,EAAE,QAAQ,aAAa,EAAE;wBACjC,IAAI,EAAE,CAAC;wBACP,MAAM,EAAE,CAAC;wBACT,OAAO,EAAE,CAAC;wBACV,IAAI,EAAE,sBAAsB;wBAC5B,MAAM,EAAE,EAAE;wBACV,UAAU,EAAE,IAAI;wBAChB,cAAc,EAAE,IAAI;wBACpB,UAAU,EAAE,EAAE;wBACd,UAAU,EAAE,UAAU;wBACtB,UAAU,EAAE,KAAK;wBACjB,kBAAkB,EAAE,KAAK;wBACzB,KAAK,EAAE,EAAE;qBACV;iBACF;aACF;YACD,SAAS,EAAE,EAAE;YACb,WAAW,EAAE,EAAE;SAChB,CAAC;QACF,gBAAgB,EAAE,GAAkB,EAAE,CAAC,CAAC;YACtC,YAAY,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;YACnC,KAAK,EAAE;gBACL,cAAc,EAAE,CAAC;gBACjB,YAAY,EAAE,CAAC;gBACf,cAAc,EAAE,CAAC;gBACjB,WAAW,EAAE,CAAC;gBACd,UAAU,EAAE,CAAC;aACd;SACF,CAAC;QACF,QAAQ,EAAE,GAAG,EAAE,CAAC,iBAAiB,EAAE,EAAE;KACtC,CAAC;AACJ,CAAC;AAED,SAAS,OAAO;IACd,MAAM,WAAW,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;IAC5B,OAAO;QACL,GAAG,EAAE;YACH,WAAW;YACX,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,gBAAgB,EAAE,EAAE;SAChB;QAC9B,WAAW;KACZ,CAAC;AACJ,CAAC;AAED,IAAI,GAAW,CAAC;AAChB,IAAI,SAAoD,CAAC;AACzD,IAAI,SAAoD,CAAC;AACzD,IAAI,MAAM,GAAG,EAAE,CAAC;AAChB,IAAI,MAAM,GAAG,EAAE,CAAC;AAEhB,UAAU,CAAC,GAAG,EAAE;IACd,UAAU,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACjC,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,CAAC;IACnD,MAAM,GAAG,EAAE,CAAC;IACZ,MAAM,GAAG,EAAE,CAAC;IACZ,SAAS,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAsB,EAAE,EAAE;QAC1F,MAAM,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACnD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IACH,SAAS,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAsB,EAAE,EAAE;QAC1F,MAAM,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACnD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,SAAS,CAAC,GAAG,EAAE;IACb,sBAAsB,EAAE,CAAC,KAAK,EAAE,CAAC;IACjC,SAAS,CAAC,WAAW,EAAE,CAAC;IACxB,SAAS,CAAC,WAAW,EAAE,CAAC;IACxB,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAChD,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACpF,sBAAsB,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QACxC,MAAM,IAAI,GAAoB;YAC5B,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,UAAU,CAAC,EAAE;YACzD,WAAW,EAAE,GAAG;YAChB,cAAc,EAAE,OAAO;SACxB,CAAC;QACF,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;QAEtD,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,OAAO,EAAE,CAAC;QACvC,MAAM,kBAAkB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAExC,MAAM,CAAC,WAAW,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAqB,CAAC;QACtD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACpD,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACrD,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACjD,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,sBAAsB,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC;QACpE,sBAAsB,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QACxC,MAAM,IAAI,GAAoB;YAC5B,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,UAAU,CAAC,EAAE;YACzD,WAAW,EAAE,GAAG;YAChB,QAAQ,EAAE,QAAQ;YAClB,cAAc,EAAE,OAAO;SACxB,CAAC;QACF,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;QAEtD,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,OAAO,EAAE,CAAC;QACvC,MAAM,kBAAkB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAExC,MAAM,CAAC,WAAW,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAqB,CAAC;QACtD,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChD,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACrD,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,sBAAsB,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;QACjD,oEAAoE;QACpE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,OAAO,EAAE,CAAC;QACvC,MAAM,kBAAkB,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,GAAG,CAAC,CAAC;QAEzD,MAAM,CAAC,WAAW,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;QAC5C,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QAC/C,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/cli/__tests__/workspace-report.test.d.ts

@@ -0,0 +1,6 @@
+/**
+ * `graph --workspace` report renderers — the human terminal report and
+ * the JSON shape. Both are pure functions over a `WorkspaceUnitRunResult[]`.
+ */
+export {};
+//# sourceMappingURL=workspace-report.test.d.ts.map

package/dist/cli/__tests__/workspace-report.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-report.test.d.ts","sourceRoot":"","sources":["../../../src/cli/__tests__/workspace-report.test.ts"],"names":[],"mappings":"AAAA;;;GAGG"}

package/dist/cli/__tests__/workspace-report.test.js

@@ -0,0 +1,89 @@
+/**
+ * `graph --workspace` report renderers — the human terminal report and
+ * the JSON shape. Both are pure functions over a `WorkspaceUnitRunResult[]`.
+ */
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { renderWorkspaceJson, workspaceReportLines } from '../workspace-report.js';
+function signal(over = {}) {
+    return {
+        id: 'sig_cycle',
+        source: 'graph.architecture.cycle',
+        provider: 'opensip-cli',
+        severity: 'medium',
+        category: 'quality',
+        ruleId: 'graph.architecture.cycle',
+        message: 'cyclic dependency',
+        filePath: 'src/a.ts',
+        line: 12,
+        metadata: {},
+        createdAt: '2026-06-04T00:00:00.000Z',
+        ...over,
+    };
+}
+function unit(over = {}) {
+    return {
+        unitId: 'core',
+        rootDir: '/abs/packages/core',
+        displayPath: 'packages/core',
+        signals: [],
+        exitCode: 0,
+        stderr: '',
+        ...over,
+    };
+}
+afterEach(() => {
+    vi.restoreAllMocks();
+});
+// The human report is composed as plain lines (workspaceReportLines) and then
+// emitted through the render seam by writeWorkspaceReport; cross-renderer
+// equivalence is covered in the cli's renderer tests. Here we assert the
+// content composition directly.
+const text = (perUnit, durationMs) => workspaceReportLines(perUnit, durationMs).join('\n');
+describe('workspaceReportLines', () => {
+    it('renders an ok unit with its finding count and project-relative display path', () => {
+        const out = text([unit({ signals: [signal()] })], 1234);
+        expect(out).toContain('opensip graph --workspace');
+        expect(out).toContain('== Units (1) ==');
+        expect(out).toContain('packages/core: 1 finding(s) — ok');
+        expect(out).toContain('1 total finding(s) across 1 unit(s) in 1234 ms.');
+        // The single finding is previewed with its file:line and message.
+        expect(out).toContain('src/a.ts:12 — cyclic dependency');
+    });
+    it('marks a failed unit and includes a truncated stderr preview', () => {
+        const out = text([unit({ exitCode: 2, stderr: 'line1\nline2\nline3\nline4\nline5' })], 5);
+        expect(out).toContain('FAILED (exit 2)');
+        expect(out).toContain('stderr: line1');
+        expect(out).toContain('line3');
+        // Only the first three stderr lines are kept.
+        expect(out).not.toContain('line4');
+    });
+    it('falls back to rootDir when displayPath is empty', () => {
+        const out = text([unit({ displayPath: '', signals: [signal()] })], 1);
+        expect(out).toContain('/abs/packages/core: 1 finding(s)');
+    });
+    it('omits the line suffix when a finding has no line number', () => {
+        const out = text([unit({ signals: [signal({ line: undefined })] })], 1);
+        expect(out).toContain('src/a.ts — cyclic dependency');
+        expect(out).not.toContain('src/a.ts: ');
+    });
+    it('truncates a finding preview past the cap and reports the remainder', () => {
+        const many = Array.from({ length: 13 }, (_v, i) => signal({ message: `m${String(i)}`, line: i + 1 }));
+        const out = text([unit({ signals: many })], 1);
+        expect(out).toContain('... 3 more (use --json for full list)');
+        expect(out).toContain('13 total finding(s)');
+    });
+});
+describe('renderWorkspaceJson', () => {
+    it('produces a stable JSON document mirroring every unit', () => {
+        const json = renderWorkspaceJson([unit({ signals: [signal()] }), unit({ unitId: 'cli', signals: [] })], 99);
+        const parsed = JSON.parse(json);
+        expect(parsed.version).toBe('1.0');
+        expect(parsed.tool).toBe('graph');
+        expect(parsed.mode).toBe('workspace');
+        expect(parsed.durationMs).toBe(99);
+        expect(parsed.totalFindings).toBe(1);
+        expect(parsed.units.map((u) => u.unitId)).toEqual(['core', 'cli']);
+        expect(parsed.units[0]?.signals).toHaveLength(1);
+    });
+});
+//# sourceMappingURL=workspace-report.test.js.map

package/dist/cli/__tests__/workspace-report.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-report.test.js","sourceRoot":"","sources":["../../../src/cli/__tests__/workspace-report.test.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE7D,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAKnF,SAAS,MAAM,CAAC,OAAwB,EAAE;IACxC,OAAO;QACL,EAAE,EAAE,WAAW;QACf,MAAM,EAAE,0BAA0B;QAClC,QAAQ,EAAE,aAAa;QACvB,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,0BAA0B;QAClC,OAAO,EAAE,mBAAmB;QAC5B,QAAQ,EAAE,UAAU;QACpB,IAAI,EAAE,EAAE;QACR,QAAQ,EAAE,EAAE;QACZ,SAAS,EAAE,0BAA0B;QACrC,GAAG,IAAI;KACR,CAAC;AACJ,CAAC;AAED,SAAS,IAAI,CAAC,OAAwC,EAAE;IACtD,OAAO;QACL,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,oBAAoB;QAC7B,WAAW,EAAE,eAAe;QAC5B,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,CAAC;QACX,MAAM,EAAE,EAAE;QACV,GAAG,IAAI;KACR,CAAC;AACJ,CAAC;AAED,SAAS,CAAC,GAAG,EAAE;IACb,EAAE,CAAC,eAAe,EAAE,CAAC;AACvB,CAAC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,0EAA0E;AAC1E,yEAAyE;AACzE,gCAAgC;AAChC,MAAM,IAAI,GAAG,CAAC,OAA0C,EAAE,UAAkB,EAAU,EAAE,CACtF,oBAAoB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEvD,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,6EAA6E,EAAE,GAAG,EAAE;QACrF,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACxD,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAC;QACnD,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QACzC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAC;QAC1D,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,iDAAiD,CAAC,CAAC;QACzE,kEAAkE;QAClE,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,iCAAiC,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1F,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QACzC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QACvC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC/B,8CAA8C;QAC9C,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACtE,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACxE,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAC;QACtD,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAChD,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAClD,CAAC;QACF,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/C,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,uCAAuC,CAAC,CAAC;QAC/D,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,IAAI,GAAG,mBAAmB,CAC9B,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EACrE,EAAE,CACH,CAAC;QACF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAO7B,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QACnE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/cli/apply-suppressions.d.ts

@@ -0,0 +1,86 @@
+/**
+ * @fileoverview Graph inline-suppression application (ADR-0014).
+ *
+ * Binds the shared core suppression primitive to graph's explicit
+ * `@graph-ignore-file` / `@graph-ignore-next-line` directives, applied to a
+ * run's signals before they reach the gate baseline, the dashboard, or render.
+ * Suppression is unconditional (a directive with no `-- reason` still
+ * suppresses); reason quality is audited out-of-band by `graph-ignore-hygiene`.
+ *
+ * `graph:cycle` is one-signal-per-SCC anchored at a computed member, so a
+ * directive above ANY member must waive it — graph's `locate()` feeds the
+ * SCC's `memberLocations` (attached in `rules/cycle.ts`) as candidate
+ * locations. Every other rule falls back to the signal's own anchor.
+ */
+import type { Signal } from '@opensip-cli/core';
+export interface GraphSuppressionOutcome {
+    readonly kept: readonly Signal[];
+    readonly suppressedCount: number;
+}
+/**
+ * Phantom brand stamped onto a signal set that has crossed the single
+ * suppression chokepoint ({@link finalizeGraphSignals}). It carries no runtime
+ * data — `FINALIZED_BRAND` is a compile-time-only marker — so a `FinalizedSignals`
+ * serializes to a plain `{ signals, suppressedCount }` object across the worker
+ * IPC boundary, yet the type system forbids constructing one anywhere except the
+ * seam below.
+ */
+declare const FINALIZED_BRAND: unique symbol;
+/**
+ * The run's signal set AFTER `@graph-ignore` waivers have been applied — the
+ * ONLY signal shape that may be persisted, verdict-computed, or rendered.
+ *
+ * Structural-typing escape hatch closed via the {@link FINALIZED_BRAND} phantom:
+ * a raw `readonly Signal[]` is NOT assignable to `FinalizedSignals`, and the
+ * brand can only be minted by {@link finalizeGraphSignals}. A future fourth
+ * output path therefore CANNOT hand un-waived signals to the persist / verdict /
+ * render functions — the compiler rejects it. This is the structural guardrail
+ * that makes the TTY-leak class of bug (suppression applied on one path only)
+ * un-regressable rather than patched.
+ */
+export interface FinalizedSignals {
+    readonly signals: readonly Signal[];
+    readonly suppressedCount: number;
+    readonly [FINALIZED_BRAND]: true;
+}
+/**
+ * THE single suppression/finalize chokepoint. Apply `@graph-ignore` waivers to a
+ * run's raw engine signals and brand the result {@link FinalizedSignals}. Every
+ * output path — the static `dispatchGraphResult` family AND the live-view
+ * in-process + off-process-worker producers (via `buildLiveGraphOutput`) — MUST
+ * route through here; the branded return type is what enforces "one build → one
+ * finalize → many renderers" at compile time.
+ *
+ * `buildRoot` is the directory the signals' project-relative `code.file` paths
+ * are RELATIVE TO (the positional subtree / sharded-child / workspace-unit root,
+ * not necessarily `opts.cwd`). Resolving against the wrong base makes every
+ * directive file unreadable (ENOENT) and silently leaks the waiver — the
+ * `743fab98` class of regression.
+ */
+export declare function finalizeGraphSignals(rawSignals: readonly Signal[], buildRoot: string): Promise<FinalizedSignals>;
+/**
+ * Re-establish the {@link FinalizedSignals} brand on a signal set that has
+ * ALREADY crossed {@link finalizeGraphSignals} but lost its phantom brand by
+ * crossing a serialization boundary (the off-process graph worker streams back a
+ * plain `{ signals, suppressedCount }` payload over IPC). This is NOT a second
+ * suppression entry point — it ASSERTS a prior finalize, it does not perform one
+ * — so the "one seam" invariant holds: the worker finalizes once inside itself,
+ * and the parent merely re-stamps the brand the structured-clone dropped.
+ *
+ * @internal
+ */
+export declare function assertFinalizedAcrossBoundary(signals: readonly Signal[], suppressedCount: number): FinalizedSignals;
+/**
+ * Apply `@graph-ignore` waivers to a run's signals. `projectRoot` resolves the
+ * project-relative `code.file` paths the signals carry.
+ *
+ * Read-failure posture (ADR-0014 + fail-loud Phase 5): the core primitive is
+ * fail-loud. A genuinely-removed (`ENOENT`) directive file is non-fatal but
+ * attributed (the primitive logs `signals.suppress.directive-file-missing`);
+ * ANY other read failure PROPAGATES. This function deliberately does NOT
+ * catch it — the error reaches the CLI error boundary, which classifies it and
+ * exits, rather than letting a dropped waiver leak a signal as a finding.
+ */
+export declare function applyGraphSuppressions(signals: readonly Signal[], projectRoot: string): Promise<GraphSuppressionOutcome>;
+export {};
+//# sourceMappingURL=apply-suppressions.d.ts.map

package/dist/cli/apply-suppressions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply-suppressions.d.ts","sourceRoot":"","sources":["../../src/cli/apply-suppressions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAOH,OAAO,KAAK,EAAE,MAAM,EAA4C,MAAM,mBAAmB,CAAC;AAO1F,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED;;;;;;;GAOG;AACH,OAAO,CAAC,MAAM,eAAe,EAAE,OAAO,MAAM,CAAC;AAE7C;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,CAAC,eAAe,CAAC,EAAE,IAAI,CAAC;CAClC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,SAAS,MAAM,EAAE,EAC7B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,gBAAgB,CAAC,CAG3B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,eAAe,EAAE,MAAM,GACtB,gBAAgB,CAElB;AAMD;;;;;;;;;;GAUG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,uBAAuB,CAAC,CAUlC"}

package/dist/cli/apply-suppressions.js

@@ -0,0 +1,101 @@
+/**
+ * @fileoverview Graph inline-suppression application (ADR-0014).
+ *
+ * Binds the shared core suppression primitive to graph's explicit
+ * `@graph-ignore-file` / `@graph-ignore-next-line` directives, applied to a
+ * run's signals before they reach the gate baseline, the dashboard, or render.
+ * Suppression is unconditional (a directive with no `-- reason` still
+ * suppresses); reason quality is audited out-of-band by `graph-ignore-hygiene`.
+ *
+ * `graph:cycle` is one-signal-per-SCC anchored at a computed member, so a
+ * directive above ANY member must waive it — graph's `locate()` feeds the
+ * SCC's `memberLocations` (attached in `rules/cycle.ts`) as candidate
+ * locations. Every other rule falls back to the signal's own anchor.
+ */
+import { readFile as fsReadFile } from 'node:fs/promises';
+import { resolve as resolvePath } from 'node:path';
+import { filterSignalsBySuppressions } from '@opensip-cli/core';
+const GRAPH_KEYWORDS = {
+    file: '@graph-ignore-file',
+    nextLine: '@graph-ignore-next-line',
+};
+/**
+ * THE single suppression/finalize chokepoint. Apply `@graph-ignore` waivers to a
+ * run's raw engine signals and brand the result {@link FinalizedSignals}. Every
+ * output path — the static `dispatchGraphResult` family AND the live-view
+ * in-process + off-process-worker producers (via `buildLiveGraphOutput`) — MUST
+ * route through here; the branded return type is what enforces "one build → one
+ * finalize → many renderers" at compile time.
+ *
+ * `buildRoot` is the directory the signals' project-relative `code.file` paths
+ * are RELATIVE TO (the positional subtree / sharded-child / workspace-unit root,
+ * not necessarily `opts.cwd`). Resolving against the wrong base makes every
+ * directive file unreadable (ENOENT) and silently leaks the waiver — the
+ * `743fab98` class of regression.
+ */
+export async function finalizeGraphSignals(rawSignals, buildRoot) {
+    const { kept, suppressedCount } = await applyGraphSuppressions(rawSignals, buildRoot);
+    return brandFinalized(kept, suppressedCount);
+}
+/**
+ * Re-establish the {@link FinalizedSignals} brand on a signal set that has
+ * ALREADY crossed {@link finalizeGraphSignals} but lost its phantom brand by
+ * crossing a serialization boundary (the off-process graph worker streams back a
+ * plain `{ signals, suppressedCount }` payload over IPC). This is NOT a second
+ * suppression entry point — it ASSERTS a prior finalize, it does not perform one
+ * — so the "one seam" invariant holds: the worker finalizes once inside itself,
+ * and the parent merely re-stamps the brand the structured-clone dropped.
+ *
+ * @internal
+ */
+export function assertFinalizedAcrossBoundary(signals, suppressedCount) {
+    return brandFinalized(signals, suppressedCount);
+}
+function brandFinalized(signals, suppressedCount) {
+    return { signals, suppressedCount };
+}
+/**
+ * Apply `@graph-ignore` waivers to a run's signals. `projectRoot` resolves the
+ * project-relative `code.file` paths the signals carry.
+ *
+ * Read-failure posture (ADR-0014 + fail-loud Phase 5): the core primitive is
+ * fail-loud. A genuinely-removed (`ENOENT`) directive file is non-fatal but
+ * attributed (the primitive logs `signals.suppress.directive-file-missing`);
+ * ANY other read failure PROPAGATES. This function deliberately does NOT
+ * catch it — the error reaches the CLI error boundary, which classifies it and
+ * exits, rather than letting a dropped waiver leak a signal as a finding.
+ */
+export async function applyGraphSuppressions(signals, projectRoot) {
+    const readFile = (file) => fsReadFile(resolvePath(projectRoot, file), 'utf8');
+    const { kept, suppressed } = await filterSignalsBySuppressions({
+        signals,
+        keywords: GRAPH_KEYWORDS,
+        readFile,
+        locate: graphLocate,
+    });
+    return { kept, suppressedCount: suppressed.length };
+}
+/** Candidate locations a `@graph-ignore` directive may target for `signal`. */
+function graphLocate(signal) {
+    const members = signal.metadata.memberLocations;
+    if (Array.isArray(members)) {
+        const locations = [];
+        for (const member of members) {
+            if (isLocation(member))
+                locations.push({ file: member.file, line: member.line });
+        }
+        if (locations.length > 0)
+            return locations;
+    }
+    const file = signal.code?.file;
+    if (file === undefined)
+        return [];
+    return [{ file, line: signal.code?.line }];
+}
+function isLocation(value) {
+    return (typeof value === 'object' &&
+        value !== null &&
+        typeof value.file === 'string' &&
+        typeof value.line === 'number');
+}
+//# sourceMappingURL=apply-suppressions.js.map

package/dist/cli/apply-suppressions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply-suppressions.js","sourceRoot":"","sources":["../../src/cli/apply-suppressions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,QAAQ,IAAI,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AAEnD,OAAO,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAIhE,MAAM,cAAc,GAAwB;IAC1C,IAAI,EAAE,oBAAoB;IAC1B,QAAQ,EAAE,yBAAyB;CACpC,CAAC;AAmCF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,UAA6B,EAC7B,SAAiB;IAEjB,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,MAAM,sBAAsB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IACtF,OAAO,cAAc,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,6BAA6B,CAC3C,OAA0B,EAC1B,eAAuB;IAEvB,OAAO,cAAc,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,cAAc,CAAC,OAA0B,EAAE,eAAuB;IACzE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAsB,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAA0B,EAC1B,WAAmB;IAEnB,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAmB,EAAE,CACjD,UAAU,CAAC,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;IACrD,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,MAAM,2BAA2B,CAAC;QAC7D,OAAO;QACP,QAAQ,EAAE,cAAc;QACxB,QAAQ;QACR,MAAM,EAAE,WAAW;KACpB,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;AACtD,CAAC;AAED,+EAA+E;AAC/E,SAAS,WAAW,CAAC,MAAc;IACjC,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC;IAChD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,MAAM,SAAS,GAA0B,EAAE,CAAC;QAC5C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,UAAU,CAAC,MAAM,CAAC;gBAAE,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;IAC7C,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC;IAC/B,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAClC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,OAAQ,KAA4B,CAAC,IAAI,KAAK,QAAQ;QACtD,OAAQ,KAA4B,CAAC,IAAI,KAAK,QAAQ,CACvD,CAAC;AACJ,CAAC"}

package/dist/cli/apply-suppressions.test.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Coverage for `applyGraphSuppressions` (ADR-0014) — graph's binding of the
+ * shared core suppression primitive to `@graph-ignore` directives.
+ *
+ * Unlike the core primitive's test (which uses an in-memory readFile),
+ * `applyGraphSuppressions` reads files from disk via
+ * `fs.readFile(resolve(projectRoot, file))`. So these tests write real source
+ * fixtures into an `os.tmpdir()`-based directory and point `projectRoot` at it.
+ * Signals are built with the same `createSignal` the production rules use.
+ */
+export {};
+//# sourceMappingURL=apply-suppressions.test.d.ts.map

package/dist/cli/apply-suppressions.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply-suppressions.test.d.ts","sourceRoot":"","sources":["../../src/cli/apply-suppressions.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG"}

package/dist/cli/apply-suppressions.test.js

@@ -0,0 +1,85 @@
+/**
+ * Coverage for `applyGraphSuppressions` (ADR-0014) — graph's binding of the
+ * shared core suppression primitive to `@graph-ignore` directives.
+ *
+ * Unlike the core primitive's test (which uses an in-memory readFile),
+ * `applyGraphSuppressions` reads files from disk via
+ * `fs.readFile(resolve(projectRoot, file))`. So these tests write real source
+ * fixtures into an `os.tmpdir()`-based directory and point `projectRoot` at it.
+ * Signals are built with the same `createSignal` the production rules use.
+ */
+import { mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { createSignal } from '@opensip-cli/core';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { applyGraphSuppressions } from './apply-suppressions.js';
+let root;
+beforeEach(async () => {
+    root = await mkdtemp(join(tmpdir(), 'graph-suppress-'));
+});
+afterEach(async () => {
+    await rm(root, { recursive: true, force: true });
+});
+/** Write `content` to `file` (project-relative) under the temp root. */
+async function fixture(file, content) {
+    await writeFile(join(root, file), content, 'utf8');
+}
+/** Build a graph Signal anchored at `file:line`, optionally with metadata. */
+function sig(ruleId, file, line, metadata) {
+    return createSignal({
+        source: 'graph',
+        severity: 'medium',
+        category: 'architecture',
+        ruleId,
+        message: `${ruleId} at ${file}:${String(line)}`,
+        code: { file, line },
+        metadata,
+    });
+}
+describe('applyGraphSuppressions', () => {
+    it('removes a signal waived by a matching next-line directive', async () => {
+        await fixture('a.ts', [
+            '// @graph-ignore-next-line graph:large-function -- intentionally long',
+            'function big() {}',
+        ].join('\n'));
+        const res = await applyGraphSuppressions([sig('graph:large-function', 'a.ts', 2)], root);
+        expect(res.kept).toHaveLength(0);
+        expect(res.suppressedCount).toBe(1);
+    });
+    it('does not suppress when the directive names a different rule id', async () => {
+        await fixture('a.ts', ['// @graph-ignore-next-line graph:cycle -- not this rule', 'function big() {}'].join('\n'));
+        const res = await applyGraphSuppressions([sig('graph:large-function', 'a.ts', 2)], root);
+        expect(res.kept).toHaveLength(1);
+        expect(res.suppressedCount).toBe(0);
+    });
+    it('waives a graph:cycle signal via a directive above ANY member location', async () => {
+        // The signal anchors at anchor.ts but the directive sits above a DIFFERENT
+        // member (member.ts) — the any-member semantics graphLocate() implements
+        // from metadata.memberLocations.
+        await fixture('anchor.ts', 'function a() {}');
+        await fixture('member.ts', ['// @graph-ignore-next-line graph:cycle -- intentional recursion', 'function b() {}'].join('\n'));
+        const signal = sig('graph:cycle', 'anchor.ts', 1, {
+            memberLocations: [
+                { file: 'anchor.ts', line: 1 },
+                { file: 'member.ts', line: 2 },
+            ],
+        });
+        const res = await applyGraphSuppressions([signal], root);
+        expect(res.kept).toHaveLength(0);
+        expect(res.suppressedCount).toBe(1);
+    });
+    it('suppresses unconditionally — a directive with no -- reason still waives', async () => {
+        await fixture('a.ts', ['// @graph-ignore-next-line graph:cycle', 'function visit() {}'].join('\n'));
+        const res = await applyGraphSuppressions([sig('graph:cycle', 'a.ts', 2)], root);
+        expect(res.kept).toHaveLength(0);
+        expect(res.suppressedCount).toBe(1);
+    });
+    it('keeps a signal with no matching directive', async () => {
+        await fixture('a.ts', ['function visit() {}', 'function other() {}'].join('\n'));
+        const res = await applyGraphSuppressions([sig('graph:cycle', 'a.ts', 1)], root);
+        expect(res.kept).toHaveLength(1);
+        expect(res.suppressedCount).toBe(0);
+    });
+});
+//# sourceMappingURL=apply-suppressions.test.js.map

package/dist/cli/apply-suppressions.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply-suppressions.test.js","sourceRoot":"","sources":["../../src/cli/apply-suppressions.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAErE,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAIjE,IAAI,IAAY,CAAC;AAEjB,UAAU,CAAC,KAAK,IAAI,EAAE;IACpB,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;AAC1D,CAAC,CAAC,CAAC;AAEH,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACnD,CAAC,CAAC,CAAC;AAEH,wEAAwE;AACxE,KAAK,UAAU,OAAO,CAAC,IAAY,EAAE,OAAe;IAClD,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;AACrD,CAAC;AAED,8EAA8E;AAC9E,SAAS,GAAG,CACV,MAAc,EACd,IAAY,EACZ,IAAY,EACZ,QAAkC;IAElC,OAAO,YAAY,CAAC;QAClB,MAAM,EAAE,OAAO;QACf,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,cAAc;QACxB,MAAM;QACN,OAAO,EAAE,GAAG,MAAM,OAAO,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE;QAC/C,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;QACpB,QAAQ;KACT,CAAC,CAAC;AACL,CAAC;AAED,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,OAAO,CACX,MAAM,EACN;YACE,uEAAuE;YACvE,mBAAmB;SACpB,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,sBAAsB,CAAC,CAAC,GAAG,CAAC,sBAAsB,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACzF,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,OAAO,CACX,MAAM,EACN,CAAC,yDAAyD,EAAE,mBAAmB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAC5F,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,sBAAsB,CAAC,CAAC,GAAG,CAAC,sBAAsB,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACzF,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,2EAA2E;QAC3E,yEAAyE;QACzE,iCAAiC;QACjC,MAAM,OAAO,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;QAC9C,MAAM,OAAO,CACX,WAAW,EACX,CAAC,iEAAiE,EAAE,iBAAiB,CAAC,CAAC,IAAI,CACzF,IAAI,CACL,CACF,CAAC;QACF,MAAM,MAAM,GAAG,GAAG,CAAC,aAAa,EAAE,WAAW,EAAE,CAAC,EAAE;YAChD,eAAe,EAAE;gBACf,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,EAAE;gBAC9B,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,EAAE;aAC/B;SACF,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,sBAAsB,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;QACzD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,OAAO,CACX,MAAM,EACN,CAAC,wCAAwC,EAAE,qBAAqB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAC7E,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,sBAAsB,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAChF,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC,qBAAqB,EAAE,qBAAqB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACjF,MAAM,GAAG,GAAG,MAAM,sBAAsB,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAChF,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/cli/build-envelope.d.ts

@@ -0,0 +1,53 @@
+/**
+ * @fileoverview Graph's signal-envelope assembly (ADR-0011, Phase 5).
+ *
+ * Collapses a graph run's flat `Signal[]` into the one tool-run
+ * {@link SignalEnvelope}: the shared output currency the composition root
+ * renders (table), emits (`--json`), and delivers (cloud + `--report-to`).
+ *
+ * SARIF ruleId decision — Option A (ADR-0011, Phase 5): at envelope assembly
+ * each signal's engine slug (`graph:<rule>`) is mapped to its OpenSIP-
+ * convention rule ID (`graph.<family>.<rule>`) via
+ * {@link mapEngineSlugToOpenSipRuleId}, set on BOTH `ruleId` AND `source`. One
+ * canonical id then flows to `--json`, the terminal table (grouped by
+ * `signal.source`), and SARIF (`signal.ruleId`). `mapEngineSlugToOpenSipRuleId`
+ * stays graph-owned (tool vocabulary does not belong in the tool-agnostic
+ * output layer).
+ *
+ * Fingerprints (ADR-0036): this builder passes `graphFingerprintStrategy`
+ * (`ruleId|filePath|line|col`, `baseline-strategy.ts`) to
+ * {@link buildSignalEnvelope}, which stamps every signal at construction — so
+ * each built envelope (gate, `--json`, cloud, SARIF) is gate-ready, not just
+ * the gate path. The strategy is applied AFTER the Option-A `ruleId` remap
+ * below, so fingerprints are computed over the canonical (OpenSIP-convention)
+ * rule IDs — byte-identical to the prior post-hoc gate-path stamping. The
+ * dashboard session payload (`persistence/session-payload.ts`) keeps
+ * the engine slug (its metric-column keys are engine slugs).
+ *
+ * Pure: no IO, no clock, no id generation — `runId`/`createdAt` arrive on the
+ * input (formatter-purity contract).
+ */
+import type { SignalEnvelope } from '@opensip-cli/contracts';
+import type { Signal } from '@opensip-cli/core';
+/** Inputs to {@link buildGraphEnvelope}. */
+export interface BuildGraphEnvelopeInput {
+    readonly signals: readonly Signal[];
+    readonly recipe?: string;
+    readonly runId: string;
+    readonly createdAt: string;
+    /** Whole-run wall-clock; attributed to each unit row when known (else 0). */
+    readonly durationMs?: number;
+    readonly resolutionMode?: 'exact' | 'fast';
+}
+/**
+ * Assemble the graph run's {@link SignalEnvelope}.
+ *
+ * Each signal is remapped to its OpenSIP rule ID (Option A) on both `ruleId`
+ * and `source`; signals are then grouped by that mapped source into one
+ * {@link UnitResult} per rule that fired (`passed` ⇔ no `critical`/`high` in
+ * that group). A rule that emitted no signals produces no unit row — graph's
+ * `RunGraphResult` does not carry the full ran-rule set, matching the prior
+ * `buildCliOutput` behaviour (one `CheckOutput` per rule that fired).
+ */
+export declare function buildGraphEnvelope(input: BuildGraphEnvelopeInput): SignalEnvelope;
+//# sourceMappingURL=build-envelope.d.ts.map

package/dist/cli/build-envelope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-envelope.d.ts","sourceRoot":"","sources":["../../src/cli/build-envelope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAQH,OAAO,KAAK,EAAE,cAAc,EAAc,MAAM,wBAAwB,CAAC;AACzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAEhD,4CAA4C;AAC5C,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,6EAA6E;IAC7E,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;CAC5C;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,GAAG,cAAc,CA4CjF"}