@opensip-cli/graph 0.1.0

package/dist/cli/graph/graph-command-spec.js

@@ -0,0 +1,456 @@
+/**
+ * graph-command-spec — the declarative primary `graph` command (launch
+ * Phase 5 Task 5.1).
+ *
+ * Replaces graph's hand-rolled `registerGraphCommand()` body: the host mounts
+ * this spec via `mountCommandSpec`, applies the ADR-0021 common flags + graph's
+ * own options, and invokes {@link runGraphCommand}. The tool no longer touches
+ * Commander.
+ *
+ * `output: 'raw-stream'` because graph's handler owns its entire output surface —
+ * it dispatches at runtime between the interactive Ink live view (TTY-only
+ * default), a discovery-only `--list-files` short-circuit, the static
+ * gate/json/render path, and the `--sarif` file write, then performs its own
+ * cloud egress (`deliverSignals` / `--report-to`) and exit-code decision. None of
+ * that is expressible through the `signal-envelope` dispatch arm (which only does
+ * `emitEnvelope`/`render`), so the host renders nothing and the handler stays
+ * authoritative — byte-identical to the former `registerGraphCommand` action
+ * body.
+ *
+ * `--resolution` validation: the legacy action validated the raw string via
+ * `parseResolutionMode` inside the body (a `ValidationError` on a typo). That
+ * validation now lives in the declared `choices: ['exact', 'fast']` — the mount
+ * layer enforces membership at parse time (Commander rejects an out-of-set value
+ * before the handler runs), so the handler trusts the parsed value.
+ */
+import { EXIT_CODES } from '@opensip-cli/contracts';
+import { defineCommand } from '@opensip-cli/core';
+import { resolveSession } from '@opensip-cli/session-store';
+import { graphReplayFromSession } from '../../persistence/session-replay.js';
+import { resolveRecipeToRules } from '../../recipes/resolve.js';
+import { renderGraphLive } from '../graph-runner.js';
+import { executeGraph, resolveLiveEngineShards } from '../graph.js';
+import { runHeapPreflight } from '../heap-preflight.js';
+import { executeListFiles } from '../list-files.js';
+import { loadGraphConfig, resolveGraphRecipeSelection } from '../orchestrate.js';
+/**
+ * Live-view key graph contributes to the CLI's renderer registry. Owned by this
+ * package — the CLI dispatcher does NOT key off this literal; each tool decides
+ * its own live-view name. It matches the `graph` command name so the dispatcher's
+ * `renderLive(key)` lookup reads naturally next to the command that triggers it.
+ *
+ * The renderer is registered lazily inside the interactive branch of the handler
+ * via {@link setUpGraphLiveView} (the tool wires that callback in).
+ */
+export const GRAPH_LIVE_VIEW_KEY = 'graph';
+/**
+ * Set graph's live view up on the host context — a synchronous, void-returning
+ * map write (named with the `setUp` prefix to signal that; `register*` would trip
+ * the `detached-promises` dogfood heuristic). In the spec-mounted world there is
+ * no `register()` mount hook, so the handler sets the renderer up lazily on the
+ * interactive path (before any `cli.renderLive` lookup). `registerLiveView` is an
+ * idempotent map write, so doing this once per run — only on the live path that
+ * needs it — is equivalent to the old mount-time registration.
+ */
+function setUpGraphLiveView(cli) {
+    cli.registerLiveView(GRAPH_LIVE_VIEW_KEY, async (args, liveContext) => {
+        // The renderer returns a ToolRunCompletion; the HOST persists its `session`
+        // after this resolves (host-owned-run-timing Phase 2). Graph's cloud egress
+        // is on the static gate path, so the live wrapper emits no envelope.
+        return renderGraphLive(args, cli.scope.datastore(), { setExitCode: cli.setExitCode }, liveContext);
+    });
+}
+/**
+ * Dispatch the interactive (TTY) live `graph` view. Extracted from
+ * `runGraphCommand` so the handler's branching stays under the cognitive-
+ * complexity bound: this owns the lazy renderer setup, the ADR-0022 recipe
+ * resolution, and the live args (including the serializable `--recipe` NAME the
+ * off-process worker re-resolves, ADR-0028).
+ */
+async function dispatchGraphLiveView(opts, cli, resolution) {
+    // Spec-mounted world: no `register()` mount hook, so set the renderer up
+    // lazily here (idempotent map write) before the `cli.renderLive` lookup.
+    setUpGraphLiveView(cli);
+    // Resolve the recipe here (the handler runs inside the entered RunScope
+    // via the pre-action hook) for parity with `executeGraph`: tool-scoped
+    // precedence (`--recipe` > `graph.recipe` > `default`, ADR-0022), with
+    // config-sourced unknown names tolerantly
+    // falling back to `default` and explicit-flag typos still hard-failing.
+    const recipeSelection = resolveGraphRecipeSelection(opts.cwd, opts.recipe);
+    // Resolve the build engine HERE, on the dispatch seam — `resolveLiveEngineShards`
+    // needs the `cli` context (language registry + datastore) the React runner does
+    // not hold. The SAME policy the static path uses (ADR-0032): sharded when
+    // `--exact` is absent and the project yields >1 shard, exact otherwise. The
+    // runner reads `shards.length` to pick its transport (in-process sharded vs
+    // off-process exact worker). `isTTY` is never consulted — engine = exact +
+    // shardability alone.
+    const shards = await resolveLiveEngineShards({
+        cwd: opts.cwd,
+        noCache: opts.cache === false,
+        resolution,
+        exact: opts.exact,
+        cliScript: process.argv[1],
+    }, cli);
+    await cli.renderLive(GRAPH_LIVE_VIEW_KEY, {
+        cwd: opts.cwd,
+        noCache: opts.cache === false,
+        verbose: opts.verbose === true,
+        quiet: opts.quiet === true,
+        resolution,
+        // The engine selector (`--exact` + the pre-resolved shard set). Sharded runs
+        // in-process; exact forks the off-process worker (ADR-0028).
+        exact: opts.exact === true,
+        shards,
+        // The recipe NAME (serializable) for the off-process worker, which
+        // re-resolves rules itself (ADR-0028); `rules` below is the in-process path.
+        ...(opts.recipe === undefined ? {} : { recipe: opts.recipe }),
+        // Pass the resolved rule subset into the live path. Avoids a second
+        // scope read inside the React tree.
+        rules: resolveRecipeToRules(recipeSelection.name, { tolerant: recipeSelection.tolerant }),
+        // Honor the project's `graph:` config block in the interactive
+        // path too — parity with `executeGraph` (graph.ts), which loads
+        // it via the same helper. Loading here (not inside the React
+        // runner) keeps the fs read on the dispatch seam.
+        config: loadGraphConfig(opts.cwd),
+    });
+}
+/**
+ * The `graph` command handler — the former `registerGraphCommand()` action body,
+ * lifted to a spec handler. The host (`raw-stream`) renders nothing, so the
+ * handler keeps full ownership of the list-files/live/static dispatch, the
+ * `--sarif` write, the cloud egress, and the exit-code decision.
+ *
+ * host-owned-run-timing Phase 3: the static render path RETURNS a
+ * {@link ToolRunCompletion} carrying the run's `session` contribution; the host
+ * run plane persists it after this handler resolves (graph no longer writes the
+ * generic session row itself). The early-return branches (show / list-files /
+ * heap-preflight re-exec / TTY live view) return `void` — the live view path
+ * persists its own session via `renderLive`, and the other branches produce no
+ * session.
+ */
+async function runGraphCommand(rawOpts, cli) {
+    const opts = rawOpts;
+    // `--resolution`'s value is `exact`/`fast` by construction now (declared
+    // `choices`); the mount layer rejected any other value before we got here.
+    // Default is `exact` (the spec's declared default), so coerce undefined too.
+    const resolution = opts.resolution === 'fast' ? 'fast' : 'exact';
+    // --list-files short-circuits to discovery-only: print the resolved
+    // source-file set for this scope and exit, BEFORE heap preflight or any
+    // catalog build. Reuses the same scoping flags (paths / --workspace /
+    // --language) and honors --json.
+    //
+    // `[paths...]` is graph's sole positional, and it is variadic — Commander
+    // hands a variadic positional to its action as a SINGLE array argument, so
+    // the host's `_args` positional array carries that array as its first (and
+    // only) element. The variadic value is therefore `_args[0]` (the string[]),
+    // not `_args` itself. An invocation with no paths yields `_args === [[]]`
+    // (a single empty array), so `?? []` covers the absent case too.
+    const positionals = opts._args ?? [];
+    const paths = (positionals[0] ?? []);
+    if (opts.show !== undefined && opts.show.length > 0) {
+        await runGraphShowMode(opts, cli);
+        return;
+    }
+    if (opts.listFiles === true) {
+        await executeListFiles({
+            cwd: opts.cwd,
+            json: opts.json,
+            paths,
+            workspace: opts.workspace,
+            language: opts.language,
+        }, cli);
+        return;
+    }
+    // Preflight runs BEFORE any heavy work. If the repo's file count
+    // exceeds a threshold AND the current heap cap is too low, this
+    // re-execs the process with elevated `--max-old-space-size`. The
+    // re-execing parent never returns from this call (it `process.exit`s
+    // with the child's code), so `returned === true` only matters for
+    // the type checker. Skipped when the user has expressed an explicit
+    // scope (positional paths, --workspace, or --language): those runs
+    // either touch a fraction of files (positional/language) or spawn
+    // child processes per unit (workspace) and don't need the global
+    // heap sizing.
+    const hasExplicitScope = paths.length > 0 || opts.workspace === true || typeof opts.language === 'string';
+    if (!hasExplicitScope) {
+        const reExecing = await runHeapPreflight({ cwd: opts.cwd, verbose: opts.verbose === true });
+        /* v8 ignore next */
+        if (reExecing)
+            return;
+    }
+    // Determinism (ADR-0032, superseding ADR-0031): TTY selects only the RENDERER
+    // (the Ink live view vs the static `executeGraph` text/JSON path), NEVER the
+    // build engine. The build engine is chosen downstream — by `--exact` +
+    // shardability alone — and the live view drives WHICHEVER engine that policy
+    // selects (sharded in-process / exact off-process), so the live runner is
+    // engine-agnostic. A bare `graph` (sharded default) and `graph --exact` BOTH
+    // show the staged "Code Graph" checklist in a terminal; both fall through to
+    // the static path when piped. The live view is therefore eligible for any
+    // rendering run — there is no `--exact` gate. Every non-rendering mode (json/
+    // gate/report/profile/workspace/positional-paths/language) is excluded.
+    const isLiveViewEligible = opts.json !== true &&
+        opts.gateSave !== true &&
+        opts.gateCompare !== true &&
+        /* v8 ignore next */
+        (typeof opts.reportTo !== 'string' || opts.reportTo.length === 0) &&
+        (typeof opts.profile !== 'string' || opts.profile.length === 0) &&
+        opts.workspace !== true &&
+        paths.length === 0 &&
+        /* v8 ignore next */
+        typeof opts.language !== 'string';
+    // The animated live view is a TTY-only affordance (frame-driven Ink).
+    // In a pipe / CI / redirected run (non-TTY) it would emit garbled or
+    // empty frames, so fall through to the static `executeGraph` path, whose
+    // `graph-done` result is dual-rendered through the seam (`renderToText`)
+    // — the same report content (and the SAME engine the policy selects),
+    // consistent with the TTY final frame. Only the rendering surface differs
+    // by TTY.
+    if (isLiveViewEligible && process.stdout.isTTY === true) {
+        await dispatchGraphLiveView(opts, cli, resolution);
+        return;
+    }
+    const outcome = await executeGraph({
+        cwd: opts.cwd,
+        json: opts.json,
+        noCache: opts.cache === false,
+        resolution,
+        recipe: opts.recipe,
+        gateSave: opts.gateSave,
+        gateCompare: opts.gateCompare,
+        reportTo: opts.reportTo,
+        apiKey: opts.apiKey,
+        profileOutput: opts.profile,
+        paths,
+        workspace: opts.workspace,
+        exact: opts.exact,
+        concurrency: opts.concurrency,
+        language: opts.language,
+        verbose: opts.verbose,
+        cliScript: process.argv[1],
+    }, cli);
+    // `--sarif <path>`: write this run's findings as a SARIF 2.1.0 file via the
+    // root `cli.writeSarif` seam (the one place that formats an envelope to
+    // SARIF; the engine never imports @opensip-cli/output). Composes with
+    // --gate-save: executeGraph has already set the gate exit code, but the
+    // handler body still runs, so the SARIF lands even when the gate fails —
+    // GitHub Code Scanning then surfaces net-new graph findings on PRs.
+    if (opts.sarif !== undefined && opts.sarif !== '' && outcome?.envelope !== undefined) {
+        await cli.writeSarif(outcome.envelope, opts.sarif);
+    }
+    await deliverNonGateEgress(opts, outcome?.envelope, cli);
+    // host-owned-run-timing Phase 3: RETURN the generic-session contribution; the
+    // host run plane persists it after this handler resolves (no tool-side write).
+    return graphRunCompletion(outcome);
+}
+/**
+ * Build graph's run completion from the run outcome (host-owned-run-timing
+ * Phase 3): the generic-session contribution the host run plane persists. The
+ * export/carrier modes (`--json`, gate, `--report-to`) carry no session.
+ */
+function graphRunCompletion(outcome) {
+    return {
+        session: outcome?.session,
+    };
+}
+/**
+ * Effectful egress at the composition root (ADR-0011 / ADR-0008): cloud sync +
+ * `--report-to` (which owns exit 4). `executeGraph` returns the envelope for every
+ * mode that should deliver (catalog / default render / `--report-to`) and
+ * `undefined` for the modes that must not (plain `--json` workspace-child carrier,
+ * `--workspace` parent, error paths).
+ *
+ * ADR-0036: gate modes (`--gate-save`/`--gate-compare`) own their OWN
+ * deliverSignals call inside `runGateMode` — they feed the gate verdict to the
+ * host's runFailed override (the host derives the exit; no tool setExitCode), so
+ * the host must NOT deliver again here. The `--sarif` write still runs for gate
+ * mode (it reads the returned envelope), preserving `if: always()` export.
+ */
+async function deliverNonGateEgress(opts, envelope, cli) {
+    const isGateMode = opts.gateSave === true || opts.gateCompare === true;
+    if (envelope === undefined || isGateMode)
+        return;
+    await cli.deliverSignals(envelope, {
+        cwd: opts.cwd,
+        reportTo: opts.reportTo,
+        apiKey: opts.apiKey,
+    });
+}
+async function runGraphShowMode(opts, cli) {
+    const datastore = cli.scope.datastore();
+    if (datastore === undefined) {
+        await emitGraphShowError(opts, cli, 'datastore-unavailable', 'session replay requires a datastore');
+        return;
+    }
+    const resolved = resolveSession(datastore, { ref: opts.show ?? 'latest', tool: 'graph' });
+    if (!resolved.ok) {
+        await emitGraphShowError(opts, cli, resolved.reason, resolved.detail);
+        return;
+    }
+    try {
+        const replay = graphReplayFromSession(resolved.session);
+        if (opts.json === true) {
+            cli.emitJson(sessionShowJson(resolved.session, replay));
+            return;
+        }
+        await cli.render(sessionReplayResult(resolved.session, replay));
+    }
+    catch (error) {
+        await emitGraphShowError(opts, cli, 'decode-error', error instanceof Error ? error.message : String(error));
+    }
+}
+async function emitGraphShowError(opts, cli, reason, detail) {
+    if (opts.json === true) {
+        // emitError sets the exit code itself (process exit == reported outcome).
+        cli.emitError({ message: detail, exitCode: EXIT_CODES.CONFIGURATION_ERROR, code: reason });
+        return;
+    }
+    cli.setExitCode(EXIT_CODES.CONFIGURATION_ERROR);
+    await cli.render({
+        type: 'error',
+        message: detail,
+        exitCode: EXIT_CODES.CONFIGURATION_ERROR,
+    });
+}
+function sessionShowJson(session, replay) {
+    return {
+        session: {
+            id: session.id,
+            tool: session.tool,
+            startedAt: session.startedAt,
+            completedAt: session.completedAt,
+            recipe: session.recipe,
+            cwd: session.cwd,
+            score: session.score,
+            passed: session.passed,
+            durationMs: session.durationMs,
+        },
+        fidelity: replay.fidelity,
+        envelope: replay.envelope,
+    };
+}
+/** The tool-agnostic `session-replay` view result (rendered via the shared
+ *  envelope table; no live-run footer). `cli.render` takes `unknown`. */
+function sessionReplayResult(session, replay) {
+    return {
+        type: 'session-replay',
+        session: {
+            id: session.id,
+            tool: session.tool,
+            startedAt: session.startedAt,
+            completedAt: session.completedAt,
+            ...(session.recipe === undefined ? {} : { recipe: session.recipe }),
+            score: session.score,
+            passed: session.passed,
+            durationMs: session.durationMs,
+        },
+        envelope: replay.envelope,
+        fidelity: replay.fidelity,
+    };
+}
+/**
+ * Parse the `--concurrency <n>` value into a positive integer. A named
+ * declaration (not an inline arrow) so the `@throws` JSDoc attaches to the
+ * function node the throws-documentation check inspects.
+ *
+ * @throws {Error} When the value is not a positive integer (Commander surfaces
+ *   it as a usage/parse error, which the CLI boundary maps to exit 2).
+ */
+function parseConcurrency(v) {
+    const n = Number.parseInt(v, 10);
+    if (!Number.isFinite(n) || n < 1) {
+        throw new Error(`--concurrency must be a positive integer (received '${v}')`);
+    }
+    return n;
+}
+/**
+ * The declarative primary `graph` command (launch Phase 5 Task 5.1).
+ * The host mounts this spec, applies the ADR-0021 common flags + graph's options
+ * + the `[paths...]` variadic argument, and invokes {@link runGraphCommand}.
+ */
+export const graphCommandSpec = defineCommand({
+    name: 'graph',
+    description: 'Run static call-graph analysis (rules, entry points, catalog summary in one report)',
+    // ADR-0021 cross-tool flags from the single registry: --cwd, --json, --quiet,
+    // --verbose, --debug, --report-to, --api-key. `cwd` is seeded with
+    // process.cwd() by the mounter. graph-specific flags stay declared below.
+    commonFlags: ['cwd', 'json', 'quiet', 'verbose', 'debug', 'reportTo', 'apiKey'],
+    options: [
+        { flag: '--no-cache', description: 'Skip catalog cache (force full rebuild)', negatable: true },
+        {
+            flag: '--resolution',
+            value: '<mode>',
+            description: 'Edge resolution tier: exact (semantic) or fast (syntactic, no type checker)',
+            default: 'exact',
+            choices: ['exact', 'fast'],
+        },
+        {
+            flag: '--recipe',
+            value: '<name>',
+            description: 'Run a named recipe (a subset of graph rules). Default: all rules',
+        },
+        {
+            flag: '--show',
+            value: '<session>',
+            description: 'Replay a stored graph session by id, or latest for the latest graph session',
+        },
+        {
+            flag: '--gate-save',
+            description: 'Save current Signal set as the gate baseline',
+            default: false,
+        },
+        {
+            flag: '--gate-compare',
+            description: 'Compare current Signals to the gate baseline',
+            default: false,
+        },
+        {
+            flag: '--profile',
+            value: '<path>',
+            description: 'Write graph performance profile JSON to path',
+        },
+        {
+            flag: '--workspace',
+            description: 'Fan out across detected workspace units (memory-isolated; polyglot)',
+            default: false,
+        },
+        {
+            flag: '--exact',
+            description: 'Use the single-program exact build engine instead of the default parallel sharded engine (both resolve through one shared model — exact = the 1-shard case — held equivalent by the directional equivalence guardrail; --exact suits small/single-package repos).',
+            default: false,
+        },
+        {
+            flag: '--concurrency',
+            value: '<n>',
+            description: 'Concurrency cap for --workspace and the sharded build (default: cpus()-1)',
+            parse: parseConcurrency,
+        },
+        {
+            flag: '--language',
+            value: '<name>',
+            description: 'Force a specific language adapter (suppresses auto-detection)',
+        },
+        {
+            flag: '--list-files',
+            description: 'List the source files graph would discover for this scope and exit (no build; honors [paths...], --workspace, --language, --json)',
+            default: false,
+        },
+        {
+            flag: '--sarif',
+            value: '<path>',
+            description: 'Also write this run’s findings as a SARIF 2.1.0 file (for GitHub Code Scanning). Composes with --gate-save; written even when the gate fails.',
+        },
+    ],
+    args: [
+        {
+            name: 'paths',
+            variadic: true,
+            optional: true,
+            description: 'Subtrees to analyze (default: whole project)',
+        },
+    ],
+    scope: 'project',
+    output: 'raw-stream',
+    rawStreamReason: 'runtime-render-dispatch',
+    handler: runGraphCommand,
+});
+//# sourceMappingURL=graph-command-spec.js.map

package/dist/cli/graph/graph-command-spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph-command-spec.js","sourceRoot":"","sources":["../../../src/cli/graph/graph-command-spec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,UAAU,EAA2C,MAAM,wBAAwB,CAAC;AAC7F,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAOjF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,OAAO,CAAC;AA2B3C;;;;;;;;GAQG;AACH,SAAS,kBAAkB,CAAC,GAAmB;IAC7C,GAAG,CAAC,gBAAgB,CAAC,mBAAmB,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE;QACpE,4EAA4E;QAC5E,4EAA4E;QAC5E,qEAAqE;QACrE,OAAO,eAAe,CACpB,IAWC,EACD,GAAG,CAAC,KAAK,CAAC,SAAS,EAA2B,EAC9C,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,EAChC,WAAW,CACZ,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,qBAAqB,CAClC,IAAyB,EACzB,GAAmB,EACnB,UAA0B;IAE1B,yEAAyE;IACzE,yEAAyE;IACzE,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACxB,wEAAwE;IACxE,uEAAuE;IACvE,uEAAuE;IACvE,0CAA0C;IAC1C,wEAAwE;IACxE,MAAM,eAAe,GAAG,2BAA2B,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3E,kFAAkF;IAClF,gFAAgF;IAChF,0EAA0E;IAC1E,4EAA4E;IAC5E,4EAA4E;IAC5E,2EAA2E;IAC3E,sBAAsB;IACtB,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAC1C;QACE,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,OAAO,EAAE,IAAI,CAAC,KAAK,KAAK,KAAK;QAC7B,UAAU;QACV,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;KAC3B,EACD,GAAG,CACJ,CAAC;IACF,MAAM,GAAG,CAAC,UAAU,CAAC,mBAAmB,EAAE;QACxC,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,OAAO,EAAE,IAAI,CAAC,KAAK,KAAK,KAAK;QAC7B,OAAO,EAAE,IAAI,CAAC,OAAO,KAAK,IAAI;QAC9B,KAAK,EAAE,IAAI,CAAC,KAAK,KAAK,IAAI;QAC1B,UAAU;QACV,6EAA6E;QAC7E,6DAA6D;QAC7D,KAAK,EAAE,IAAI,CAAC,KAAK,KAAK,IAAI;QAC1B,MAAM;QACN,mEAAmE;QACnE,6EAA6E;QAC7E,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;QAC7D,oEAAoE;QACpE,oCAAoC;QACpC,KAAK,EAAE,oBAAoB,CAAC,eAAe,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,eAAe,CAAC,QAAQ,EAAE,CAAC;QACzF,+DAA+D;QAC/D,gEAAgE;QAChE,6DAA6D;QAC7D,kDAAkD;QAClD,MAAM,EAAE,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC;KAClC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,eAAe,CAC5B,OAAgB,EAChB,GAAmB;IAEnB,MAAM,IAAI,GAAG,OAA8B,CAAC;IAC5C,yEAAyE;IACzE,2EAA2E;IAC3E,6EAA6E;IAC7E,MAAM,UAAU,GAAmB,IAAI,CAAC,UAAU,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;IAEjF,oEAAoE;IACpE,wEAAwE;IACxE,sEAAsE;IACtE,iCAAiC;IACjC,EAAE;IACF,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,4EAA4E;IAC5E,0EAA0E;IAC1E,iEAAiE;IACjE,MAAM,WAAW,GAAI,IAAkD,CAAC,KAAK,IAAI,EAAE,CAAC;IACpF,MAAM,KAAK,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,CAAsB,CAAC;IAC1D,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpD,MAAM,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAClC,OAAO;IACT,CAAC;IACD,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAC5B,MAAM,gBAAgB,CACpB;YACE,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK;YACL,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,EACD,GAAG,CACJ,CAAC;QACF,OAAO;IACT,CAAC;IACD,iEAAiE;IACjE,gEAAgE;IAChE,iEAAiE;IACjE,qEAAqE;IACrE,kEAAkE;IAClE,oEAAoE;IACpE,mEAAmE;IACnE,kEAAkE;IAClE,iEAAiE;IACjE,eAAe;IACf,MAAM,gBAAgB,GACpB,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC;IACnF,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC,CAAC;QAC5F,oBAAoB;QACpB,IAAI,SAAS;YAAE,OAAO;IACxB,CAAC;IAED,8EAA8E;IAC9E,6EAA6E;IAC7E,uEAAuE;IACvE,6EAA6E;IAC7E,0EAA0E;IAC1E,6EAA6E;IAC7E,6EAA6E;IAC7E,0EAA0E;IAC1E,8EAA8E;IAC9E,wEAAwE;IACxE,MAAM,kBAAkB,GACtB,IAAI,CAAC,IAAI,KAAK,IAAI;QAClB,IAAI,CAAC,QAAQ,KAAK,IAAI;QACtB,IAAI,CAAC,WAAW,KAAK,IAAI;QACzB,oBAAoB;QACpB,CAAC,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC;QACjE,CAAC,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC;QAC/D,IAAI,CAAC,SAAS,KAAK,IAAI;QACvB,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,oBAAoB;QACpB,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC;IAEpC,sEAAsE;IACtE,qEAAqE;IACrE,yEAAyE;IACzE,yEAAyE;IACzE,sEAAsE;IACtE,0EAA0E;IAC1E,UAAU;IACV,IAAI,kBAAkB,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QACxD,MAAM,qBAAqB,CAAC,IAAI,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QACnD,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,YAAY,CAChC;QACE,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,OAAO,EAAE,IAAI,CAAC,KAAK,KAAK,KAAK;QAC7B,UAAU;QACV,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,aAAa,EAAE,IAAI,CAAC,OAAO;QAC3B,KAAK;QACL,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;KAC3B,EACD,GAAG,CACJ,CAAC;IAEF,4EAA4E;IAC5E,wEAAwE;IACxE,sEAAsE;IACtE,wEAAwE;IACxE,yEAAyE;IACzE,oEAAoE;IACpE,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,EAAE,IAAI,OAAO,EAAE,QAAQ,KAAK,SAAS,EAAE,CAAC;QACrF,MAAM,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,oBAAoB,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;IAEzD,8EAA8E;IAC9E,+EAA+E;IAC/E,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CACzB,OAAuF;IAEvF,OAAO;QACL,OAAO,EAAE,OAAO,EAAE,OAAuC;KAC1D,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,oBAAoB,CACjC,IAAyB,EACzB,QAAoC,EACpC,GAAmB;IAEnB,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC;IACvE,IAAI,QAAQ,KAAK,SAAS,IAAI,UAAU;QAAE,OAAO;IACjD,MAAM,GAAG,CAAC,cAAc,CAAC,QAAQ,EAAE;QACjC,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,IAAyB,EAAE,GAAmB;IAC5E,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,EAA2B,CAAC;IACjE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,kBAAkB,CACtB,IAAI,EACJ,GAAG,EACH,uBAAuB,EACvB,qCAAqC,CACtC,CAAC;QACF,OAAO;IACT,CAAC;IACD,MAAM,QAAQ,GAAG,cAAc,CAAC,SAAS,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,IAAI,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC1F,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,kBAAkB,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QACtE,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,sBAAsB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACxD,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACvB,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;YACxD,OAAO;QACT,CAAC;QACD,MAAM,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;IAClE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,kBAAkB,CACtB,IAAI,EACJ,GAAG,EACH,cAAc,EACd,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACvD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,IAAuC,EACvC,GAAmB,EACnB,MAAc,EACd,MAAc;IAEd,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACvB,0EAA0E;QAC1E,GAAG,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,mBAAmB,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3F,OAAO;IACT,CAAC;IACD,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC;IAChD,MAAM,GAAG,CAAC,MAAM,CAAC;QACf,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,MAAM;QACf,QAAQ,EAAE,UAAU,CAAC,mBAAmB;KACzC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CACtB,OAAsB,EACtB,MAAiD;IAEjD,OAAO;QACL,OAAO,EAAE;YACP,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,UAAU,EAAE,OAAO,CAAC,UAAU;SAC/B;QACD,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;KAC1B,CAAC;AACJ,CAAC;AAED;yEACyE;AACzE,SAAS,mBAAmB,CAC1B,OAAsB,EACtB,MAAiD;IAEjD,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE;YACP,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;YACnE,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,UAAU,EAAE,OAAO,CAAC,UAAU;SAC/B;QACD,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;KAC1B,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,gBAAgB,CAAC,CAAS;IACjC,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,IAAI,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAyC,aAAa,CAGjF;IACA,IAAI,EAAE,OAAO;IACb,WAAW,EACT,qFAAqF;IACvF,8EAA8E;IAC9E,mEAAmE;IACnE,0EAA0E;IAC1E,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC;IAC/E,OAAO,EAAE;QACP,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,yCAAyC,EAAE,SAAS,EAAE,IAAI,EAAE;QAC/F;YACE,IAAI,EAAE,cAAc;YACpB,KAAK,EAAE,QAAQ;YACf,WAAW,EAAE,6EAA6E;YAC1F,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;SAC3B;QACD;YACE,IAAI,EAAE,UAAU;YAChB,KAAK,EAAE,QAAQ;YACf,WAAW,EAAE,kEAAkE;SAChF;QACD;YACE,IAAI,EAAE,QAAQ;YACd,KAAK,EAAE,WAAW;YAClB,WAAW,EAAE,6EAA6E;SAC3F;QACD;YACE,IAAI,EAAE,aAAa;YACnB,WAAW,EAAE,8CAA8C;YAC3D,OAAO,EAAE,KAAK;SACf;QACD;YACE,IAAI,EAAE,gBAAgB;YACtB,WAAW,EAAE,8CAA8C;YAC3D,OAAO,EAAE,KAAK;SACf;QACD;YACE,IAAI,EAAE,WAAW;YACjB,KAAK,EAAE,QAAQ;YACf,WAAW,EAAE,8CAA8C;SAC5D;QACD;YACE,IAAI,EAAE,aAAa;YACnB,WAAW,EAAE,qEAAqE;YAClF,OAAO,EAAE,KAAK;SACf;QACD;YACE,IAAI,EAAE,SAAS;YACf,WAAW,EACT,mQAAmQ;YACrQ,OAAO,EAAE,KAAK;SACf;QACD;YACE,IAAI,EAAE,eAAe;YACrB,KAAK,EAAE,KAAK;YACZ,WAAW,EAAE,2EAA2E;YACxF,KAAK,EAAE,gBAAgB;SACxB;QACD;YACE,IAAI,EAAE,YAAY;YAClB,KAAK,EAAE,QAAQ;YACf,WAAW,EAAE,+DAA+D;SAC7E;QACD;YACE,IAAI,EAAE,cAAc;YACpB,WAAW,EACT,mIAAmI;YACrI,OAAO,EAAE,KAAK;SACf;QACD;YACE,IAAI,EAAE,SAAS;YACf,KAAK,EAAE,QAAQ;YACf,WAAW,EACT,+IAA+I;SAClJ;KACF;IACD,IAAI,EAAE;QACJ;YACE,IAAI,EAAE,OAAO;YACb,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,IAAI;YACd,WAAW,EAAE,8CAA8C;SAC5D;KACF;IACD,KAAK,EAAE,SAAS;IAChB,MAAM,EAAE,YAAY;IACpB,eAAe,EAAE,yBAAyB;IAC1C,OAAO,EAAE,eAAe;CACzB,CAAC,CAAC"}

package/dist/cli/graph-config-schema.d.ts

@@ -0,0 +1,70 @@
+/**
+ * graph-config-schema — the graph tool's namespaced Zod config schema
+ * (launch, ADR-0023, Phase 4 Task 4.1).
+ *
+ * Mirrors {@link GraphConfig} (`types.ts`) one-for-one as a Zod object so the
+ * host can compose it into the strict whole-document schema and the graph
+ * loader can read a VALIDATED `graph:` block instead of hand-projecting an
+ * arbitrary YAML object. Replaces the old permissive `projectGraphConfig`:
+ * a typo inside the `graph:` block (e.g. `minCrossPackageDuplicatePackges`)
+ * is now rejected, not silently dropped.
+ *
+ * The schema is exported two ways:
+ *   - `GraphConfigSchema` — the bare Zod object, used by `loadGraphConfig`
+ *     to parse just the `graph:` block (it `.strict()`-ens it locally).
+ *   - `graphConfigDeclaration` — the {@link ToolConfigDeclaration} the graph
+ *     tool hands the composition root (namespace `'graph'`), which makes the
+ *     namespace strict and optional at the document level.
+ *
+ * Every field is optional — an absent key means "use the rule's in-rule
+ * default" (the historical projection semantics), so a config that omits the
+ * whole `graph:` block, or any individual knob, is valid and yields `{}` /
+ * partial overrides.
+ */
+import { z } from 'zod';
+import type { ToolConfigDeclaration } from '@opensip-cli/config';
+/**
+ * Zod object mirroring {@link GraphConfig}. Field order follows the type
+ * declaration. Numeric knobs are non-negative integers (line counts, param
+ * counts, blast scores, SCC sizes — all whole, non-negative). `recipe` is a
+ * bounded string (matches `fitness.recipe` / `simulation.recipe`).
+ */
+export declare const GraphConfigSchema: z.ZodObject<{
+    minDuplicateBodyLines: z.ZodOptional<z.ZodNumber>;
+    minDuplicateBodySize: z.ZodOptional<z.ZodNumber>;
+    minCrossPackageDuplicatePackages: z.ZodOptional<z.ZodNumber>;
+    minCrossPackageDuplicateBodySize: z.ZodOptional<z.ZodNumber>;
+    recipe: z.ZodOptional<z.ZodString>;
+    partitionStrategy: z.ZodOptional<z.ZodEnum<{
+        "directory-depth": "directory-depth";
+        "file-count-chunks": "file-count-chunks";
+        hybrid: "hybrid";
+    }>>;
+    entryPointHashes: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
+    flagExportedOrphans: z.ZodOptional<z.ZodBoolean>;
+    flagTestOrphans: z.ZodOptional<z.ZodBoolean>;
+    largeFunctionWarnLines: z.ZodOptional<z.ZodNumber>;
+    largeFunctionErrorLines: z.ZodOptional<z.ZodNumber>;
+    wideFunctionWarnParams: z.ZodOptional<z.ZodNumber>;
+    wideFunctionErrorParams: z.ZodOptional<z.ZodNumber>;
+    highBlastWarnThreshold: z.ZodOptional<z.ZodNumber>;
+    highBlastErrorThreshold: z.ZodOptional<z.ZodNumber>;
+    cycleMinSize: z.ZodOptional<z.ZodNumber>;
+    cycleSize2Severity: z.ZodOptional<z.ZodEnum<{
+        low: "low";
+        off: "off";
+    }>>;
+    severityOverrides: z.ZodOptional<z.ZodReadonly<z.ZodRecord<z.ZodString, z.ZodEnum<{
+        error: "error";
+        warning: "warning";
+    }>>>>;
+}, z.core.$strip>;
+/**
+ * The graph tool's contribution to the composed configuration document
+ * (Phase 4). `namespace: 'graph'` is graph's top-level key in
+ * `opensip-cli.config.yml`; the composer makes it strict (typo-rejecting)
+ * and optional. No defaults are declared here — every knob defaults inside
+ * its rule, preserving the historical "absent → in-rule default" behaviour.
+ */
+export declare const graphConfigDeclaration: ToolConfigDeclaration;
+//# sourceMappingURL=graph-config-schema.d.ts.map

package/dist/cli/graph-config-schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph-config-schema.d.ts","sourceRoot":"","sources":["../../src/cli/graph-config-schema.ts"],"names":[],"mappings":"AACA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAQjE;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAmB5B,CAAC;AAiBH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,qBAIpC,CAAC"}

package/dist/cli/graph-config-schema.js

@@ -0,0 +1,68 @@
+// @fitness-ignore-file null-safety -- Zod schema builder chains (.optional()/.strict()) always return a valid schema object; there is no nullable access on the builder.
+/**
+ * graph-config-schema — the graph tool's namespaced Zod config schema
+ * (launch, ADR-0023, Phase 4 Task 4.1).
+ *
+ * Mirrors {@link GraphConfig} (`types.ts`) one-for-one as a Zod object so the
+ * host can compose it into the strict whole-document schema and the graph
+ * loader can read a VALIDATED `graph:` block instead of hand-projecting an
+ * arbitrary YAML object. Replaces the old permissive `projectGraphConfig`:
+ * a typo inside the `graph:` block (e.g. `minCrossPackageDuplicatePackges`)
+ * is now rejected, not silently dropped.
+ *
+ * The schema is exported two ways:
+ *   - `GraphConfigSchema` — the bare Zod object, used by `loadGraphConfig`
+ *     to parse just the `graph:` block (it `.strict()`-ens it locally).
+ *   - `graphConfigDeclaration` — the {@link ToolConfigDeclaration} the graph
+ *     tool hands the composition root (namespace `'graph'`), which makes the
+ *     namespace strict and optional at the document level.
+ *
+ * Every field is optional — an absent key means "use the rule's in-rule
+ * default" (the historical projection semantics), so a config that omits the
+ * whole `graph:` block, or any individual knob, is valid and yields `{}` /
+ * partial overrides.
+ */
+import { z } from 'zod';
+/** Severity posture for the size-2 cycle band — `off` or `low` (GraphConfig). */
+const cycleSize2Severity = z.enum(['off', 'low']);
+/** Per-rule severity-override value — `error` or `warning` (GraphConfig). */
+const severityOverrideValue = z.enum(['error', 'warning']);
+/**
+ * Zod object mirroring {@link GraphConfig}. Field order follows the type
+ * declaration. Numeric knobs are non-negative integers (line counts, param
+ * counts, blast scores, SCC sizes — all whole, non-negative). `recipe` is a
+ * bounded string (matches `fitness.recipe` / `simulation.recipe`).
+ */
+export const GraphConfigSchema = z.object({
+    minDuplicateBodyLines: z.number().int().min(0).optional(),
+    minDuplicateBodySize: z.number().int().min(0).optional(),
+    minCrossPackageDuplicatePackages: z.number().int().min(0).optional(),
+    minCrossPackageDuplicateBodySize: z.number().int().min(0).optional(),
+    recipe: z.string().min(1).max(128).optional(),
+    partitionStrategy: z.enum(['directory-depth', 'file-count-chunks', 'hybrid']).optional(),
+    entryPointHashes: z.array(z.string()).readonly().optional(),
+    flagExportedOrphans: z.boolean().optional(),
+    flagTestOrphans: z.boolean().optional(),
+    largeFunctionWarnLines: z.number().int().min(0).optional(),
+    largeFunctionErrorLines: z.number().int().min(0).optional(),
+    wideFunctionWarnParams: z.number().int().min(0).optional(),
+    wideFunctionErrorParams: z.number().int().min(0).optional(),
+    highBlastWarnThreshold: z.number().int().min(0).optional(),
+    highBlastErrorThreshold: z.number().int().min(0).optional(),
+    cycleMinSize: z.number().int().min(0).optional(),
+    cycleSize2Severity: cycleSize2Severity.optional(),
+    severityOverrides: z.record(z.string(), severityOverrideValue).readonly().optional(),
+});
+/**
+ * The graph tool's contribution to the composed configuration document
+ * (Phase 4). `namespace: 'graph'` is graph's top-level key in
+ * `opensip-cli.config.yml`; the composer makes it strict (typo-rejecting)
+ * and optional. No defaults are declared here — every knob defaults inside
+ * its rule, preserving the historical "absent → in-rule default" behaviour.
+ */
+export const graphConfigDeclaration = {
+    namespace: 'graph',
+    schema: GraphConfigSchema,
+    env: [{ envVar: 'OPENSIP_GRAPH_PARTITION_STRATEGY', key: 'partitionStrategy' }],
+};
+//# sourceMappingURL=graph-config-schema.js.map

package/dist/cli/graph-config-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph-config-schema.js","sourceRoot":"","sources":["../../src/cli/graph-config-schema.ts"],"names":[],"mappings":"AAAA,yKAAyK;AACzK;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,iFAAiF;AACjF,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AAElD,6EAA6E;AAC7E,MAAM,qBAAqB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;AAE3D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzD,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxD,gCAAgC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpE,gCAAgC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC7C,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,iBAAiB,EAAE,mBAAmB,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxF,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC3D,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC3C,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACvC,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1D,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3D,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1D,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3D,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1D,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3D,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAChD,kBAAkB,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IACjD,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,qBAAqB,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACrF,CAAC,CAAC;AAiBH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAA0B;IAC3D,SAAS,EAAE,OAAO;IAClB,MAAM,EAAE,iBAAiB;IACzB,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,kCAAkC,EAAE,GAAG,EAAE,mBAAmB,EAAE,CAAC;CAChF,CAAC"}