@opensip-cli/graph 0.1.0

package/dist/cli/pressure-monitor.js

@@ -0,0 +1,110 @@
+/**
+ * V8 heap pressure monitor.
+ *
+ * Polls `v8.getHeapStatistics()` to catch impending OOMs before V8
+ * itself SIGABRTs the process. The orchestrator calls `check()` at
+ * every stage boundary; for long-running stages the monitor also
+ * self-polls on a 1s interval. When old-gen usage crosses the
+ * configured fraction of the heap limit, `check()` throws
+ * `MemoryPressureError` and the orchestrator surfaces it through the
+ * normal error path.
+ *
+ * The 0.90 default leaves ~10% of headroom for V8 to complete one
+ * last major GC and for the exception to propagate. Below 0.85 we'd
+ * get false positives during normal GC churn; above 0.95 the bail-out
+ * itself runs out of headroom.
+ */
+import v8 from 'node:v8';
+import { EnvRegistry, ToolError } from '@opensip-cli/core';
+/**
+ * Graph-engine environment variables (launch, §5.12). Read through the
+ * {@link EnvRegistry} primitive (immutable spec table) so the env surface is
+ * governed and documentable; the `env-via-registry` guardrail forbids raw
+ * `process.env` reads. (`NODE_OPTIONS`, mutated by the heap-preflight before any
+ * opensip module loads, is a documented pre-scope exception, not registered here.)
+ */
+export const GRAPH_ENV_SPECS = [
+    {
+        canonical: 'OPENSIP_HEAP_NO_MONITOR',
+        coerce: (raw) => raw === '1',
+        default: false,
+        docs: 'Set to 1 to disable the V8 heap-pressure monitor (REPL embedding / custom allocators).',
+    },
+];
+const GRAPH_ENV = new EnvRegistry(GRAPH_ENV_SPECS);
+const DEFAULT_THRESHOLD = 0.9;
+const DEFAULT_POLL_INTERVAL_MS = 1000;
+/** Thrown when heap usage crosses the configured pressure threshold during graph work. */
+export class MemoryPressureError extends ToolError {
+    usedBytes;
+    limitBytes;
+    stage;
+    constructor(message, details, options) {
+        super(message, options?.code ?? 'MEMORY_PRESSURE', options);
+        this.name = 'MemoryPressureError';
+        this.usedBytes = details.usedBytes;
+        this.limitBytes = details.limitBytes;
+        this.stage = details.stage;
+    }
+}
+/**
+ * Create a pressure monitor. Disabled when `OPENSIP_HEAP_NO_MONITOR=1`
+ * — gives users an escape hatch for false positives in unusual GC
+ * scenarios (REPL embedding, custom allocators).
+ */
+export function createPressureMonitor(opts = {}) {
+    const threshold = opts.threshold ?? DEFAULT_THRESHOLD;
+    const pollIntervalMs = opts.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
+    const disabled = GRAPH_ENV.get('OPENSIP_HEAP_NO_MONITOR') === true;
+    let stage = 'unknown';
+    let timerId = null;
+    let lastError = null;
+    const evaluate = () => {
+        if (disabled)
+            return;
+        const stats = v8.getHeapStatistics();
+        const ratio = stats.total_heap_size / stats.heap_size_limit;
+        if (ratio < threshold)
+            return;
+        lastError = new MemoryPressureError(formatMessage(stage, stats.total_heap_size, stats.heap_size_limit), {
+            usedBytes: stats.total_heap_size,
+            limitBytes: stats.heap_size_limit,
+            stage,
+        });
+    };
+    // @fitness-ignore-next-line throws-documentation -- closure throws MemoryPressureError when heap usage crosses the limit ratio (lastError cache or fresh evaluate()); JSDoc cannot attach to a const-arrow
+    const check = () => {
+        const tripped = lastError;
+        if (tripped instanceof MemoryPressureError)
+            throw tripped;
+        evaluate();
+        const tripped2 = lastError;
+        if (tripped2 instanceof MemoryPressureError)
+            throw tripped2;
+    };
+    if (!disabled && pollIntervalMs > 0) {
+        timerId = setInterval(evaluate, pollIntervalMs);
+        timerId.unref?.();
+    }
+    return {
+        setStage: (s) => {
+            stage = s;
+        },
+        check,
+        dispose: () => {
+            if (timerId) {
+                clearInterval(timerId);
+                timerId = null;
+            }
+        },
+    };
+}
+const BYTES_PER_GB = 1024 * 1024 * 1024;
+function formatMessage(stage, usedBytes, limitBytes) {
+    const usedGb = (usedBytes / BYTES_PER_GB).toFixed(2);
+    const limitGb = (limitBytes / BYTES_PER_GB).toFixed(2);
+    return (`Heap headroom exhausted at stage "${stage}" (used ${usedGb} GB of ${limitGb} GB cap). ` +
+        `Aborted before V8 OOM. Try \`opensip graph --package <name>\` to scope to a single ` +
+        `workspace package, or \`--packages\` to fan out per-package (each child gets its own heap).`);
+}
+//# sourceMappingURL=pressure-monitor.js.map

package/dist/cli/pressure-monitor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pressure-monitor.js","sourceRoot":"","sources":["../../src/cli/pressure-monitor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB,OAAO,EAAE,WAAW,EAAE,SAAS,EAA0C,MAAM,mBAAmB,CAAC;AAEnG;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,eAAe,GAAmC;IAC7D;QACE,SAAS,EAAE,yBAAyB;QACpC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,GAAG;QAC5B,OAAO,EAAE,KAAK;QACd,IAAI,EAAE,wFAAwF;KAC/F;CACF,CAAC;AACF,MAAM,SAAS,GAAG,IAAI,WAAW,CAAC,eAAe,CAAC,CAAC;AAEnD,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,MAAM,wBAAwB,GAAG,IAAI,CAAC;AAEtC,0FAA0F;AAC1F,MAAM,OAAO,mBAAoB,SAAQ,SAAS;IACvC,SAAS,CAAS;IAClB,UAAU,CAAS;IACnB,KAAK,CAAS;IAEvB,YACE,OAAe,EACf,OAAiE,EACjE,OAA0B;QAE1B,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,IAAI,iBAAiB,EAAE,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC7B,CAAC;CACF;AAuBD;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAA+B,EAAE;IACrE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,iBAAiB,CAAC;IACtD,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,wBAAwB,CAAC;IACvE,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAU,yBAAyB,CAAC,KAAK,IAAI,CAAC;IAC5E,IAAI,KAAK,GAAG,SAAS,CAAC;IACtB,IAAI,OAAO,GAA0B,IAAI,CAAC;IAC1C,IAAI,SAAS,GAA+B,IAAI,CAAC;IAEjD,MAAM,QAAQ,GAAG,GAAS,EAAE;QAC1B,IAAI,QAAQ;YAAE,OAAO;QACrB,MAAM,KAAK,GAAG,EAAE,CAAC,iBAAiB,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,KAAK,CAAC,eAAe,GAAG,KAAK,CAAC,eAAe,CAAC;QAC5D,IAAI,KAAK,GAAG,SAAS;YAAE,OAAO;QAC9B,SAAS,GAAG,IAAI,mBAAmB,CACjC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,eAAe,CAAC,EAClE;YACE,SAAS,EAAE,KAAK,CAAC,eAAe;YAChC,UAAU,EAAE,KAAK,CAAC,eAAe;YACjC,KAAK;SACN,CACF,CAAC;IACJ,CAAC,CAAC;IAEF,2MAA2M;IAC3M,MAAM,KAAK,GAAG,GAAS,EAAE;QACvB,MAAM,OAAO,GAAG,SAAS,CAAC;QAC1B,IAAI,OAAO,YAAY,mBAAmB;YAAE,MAAM,OAAO,CAAC;QAC1D,QAAQ,EAAE,CAAC;QACX,MAAM,QAAQ,GAAG,SAAS,CAAC;QAC3B,IAAI,QAAQ,YAAY,mBAAmB;YAAE,MAAM,QAAQ,CAAC;IAC9D,CAAC,CAAC;IAEF,IAAI,CAAC,QAAQ,IAAI,cAAc,GAAG,CAAC,EAAE,CAAC;QACpC,OAAO,GAAG,WAAW,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;QAChD,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;IACpB,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE;YACd,KAAK,GAAG,CAAC,CAAC;QACZ,CAAC;QACD,KAAK;QACL,OAAO,EAAE,GAAG,EAAE;YACZ,IAAI,OAAO,EAAE,CAAC;gBACZ,aAAa,CAAC,OAAO,CAAC,CAAC;gBACvB,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,YAAY,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;AAExC,SAAS,aAAa,CAAC,KAAa,EAAE,SAAiB,EAAE,UAAkB;IACzE,MAAM,MAAM,GAAG,CAAC,SAAS,GAAG,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,CAAC,UAAU,GAAG,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACvD,OAAO,CACL,qCAAqC,KAAK,WAAW,MAAM,UAAU,OAAO,YAAY;QACxF,qFAAqF;QACrF,6FAA6F,CAC9F,CAAC;AACJ,CAAC"}

package/dist/cli/profile.d.ts

@@ -0,0 +1,82 @@
+/**
+ * Graph performance profile writer.
+ *
+ * The CLI already emits structured stage progress for the live view and spans
+ * for telemetry. This module turns the same progress stream into a portable
+ * JSON artifact users can attach to performance reports without enabling an
+ * OpenTelemetry SDK.
+ */
+import type { GraphProgressEvent } from './orchestrate/types.js';
+import type { RunGraphResult } from './orchestrate.js';
+import type { ResolutionMode } from '../types.js';
+export interface GraphProfileStage {
+    readonly name: string;
+    readonly status: 'done' | 'cached';
+    readonly durationMs?: number;
+    readonly detail?: string;
+}
+export interface GraphProfileRunSummary {
+    readonly cacheHit?: boolean;
+    readonly files?: number;
+    readonly functions?: number;
+    readonly signals?: number;
+    readonly totalCallSites?: number;
+    readonly resolvedHigh?: number;
+    readonly resolvedMedium?: number;
+    readonly resolvedLow?: number;
+    readonly unresolved?: number;
+    readonly boundaryCallSites?: number;
+    readonly shardCount?: number;
+    readonly shardsBuilt?: number;
+    readonly shardsCached?: number;
+    readonly shardSizes?: readonly number[];
+}
+export interface GraphProfileRun {
+    readonly label: string;
+    readonly cwd: string;
+    readonly mode: string;
+    readonly startedAt: string;
+    completedAt?: string;
+    durationMs?: number;
+    readonly stages: GraphProfileStage[];
+    summary?: GraphProfileRunSummary;
+}
+export interface GraphProfileDocument {
+    readonly version: '1.0';
+    readonly tool: 'graph';
+    readonly cwd: string;
+    readonly mode: string;
+    readonly resolutionMode?: ResolutionMode;
+    readonly startedAt: string;
+    completedAt?: string;
+    durationMs?: number;
+    readonly runs: GraphProfileRun[];
+}
+export declare class GraphProfileRunRecorder {
+    private readonly run;
+    private readonly activeStages;
+    private readonly startedMs;
+    constructor(run: GraphProfileRun);
+    readonly onProgress: (event: GraphProgressEvent) => void;
+    recordStage(name: string, durationMs?: number, detail?: string): void;
+    finish(result: RunGraphResult): void;
+    finishSummary(summary: GraphProfileRunSummary): void;
+}
+export declare class GraphProfileBuilder {
+    private readonly startedMs;
+    private readonly document;
+    constructor(input: {
+        readonly cwd: string;
+        readonly mode: string;
+        readonly resolutionMode?: ResolutionMode;
+        readonly startedAt?: string;
+    });
+    startRun(input: {
+        readonly label: string;
+        readonly cwd: string;
+        readonly mode: string;
+    }): GraphProfileRunRecorder;
+    complete(): GraphProfileDocument;
+}
+export declare function writeGraphProfile(outputPath: string, cwd: string, profile: GraphProfileDocument): string;
+//# sourceMappingURL=profile.d.ts.map

package/dist/cli/profile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.d.ts","sourceRoot":"","sources":["../../src/cli/profile.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,KAAK,EAAW,cAAc,EAAE,MAAM,aAAa,CAAC;AAE3D,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,CAAC;IACnC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAG7B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACzC;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC;IACrC,OAAO,CAAC,EAAE,sBAAsB,CAAC;CAClC;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,eAAe,EAAE,CAAC;CAClC;AAED,qBAAa,uBAAuB;IAItB,OAAO,CAAC,QAAQ,CAAC,GAAG;IAHhC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA6B;IAC1D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAc;gBAEX,GAAG,EAAE,eAAe;IAEjD,QAAQ,CAAC,UAAU,GAAI,OAAO,kBAAkB,KAAG,IAAI,CAUrD;IAEF,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI;IAYrE,MAAM,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI;IAIpC,aAAa,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI;CAMrD;AAED,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAc;IACxC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAuB;gBAEpC,KAAK,EAAE;QACjB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;QACzC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;KAC7B;IAYD,QAAQ,CAAC,KAAK,EAAE;QACd,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;KACvB,GAAG,uBAAuB;IAY3B,QAAQ,IAAI,oBAAoB;CAKjC;AAED,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,oBAAoB,GAC5B,MAAM,CAKR"}

package/dist/cli/profile.js

@@ -0,0 +1,120 @@
+/**
+ * Graph performance profile writer.
+ *
+ * The CLI already emits structured stage progress for the live view and spans
+ * for telemetry. This module turns the same progress stream into a portable
+ * JSON artifact users can attach to performance reports without enabling an
+ * OpenTelemetry SDK.
+ */
+import { mkdirSync, writeFileSync } from 'node:fs';
+import { dirname, isAbsolute, resolve } from 'node:path';
+export class GraphProfileRunRecorder {
+    run;
+    activeStages = new Map();
+    startedMs = Date.now();
+    constructor(run) {
+        this.run = run;
+    }
+    onProgress = (event) => {
+        if (event.type === 'stage-start') {
+            this.activeStages.set(event.stage, Date.now());
+            return;
+        }
+        if (event.type === 'stage-cached') {
+            this.run.stages.push({ name: event.stage, status: 'cached' });
+            return;
+        }
+        this.recordStage(event.stage, event.durationMs, event.detail);
+    };
+    recordStage(name, durationMs, detail) {
+        const started = this.activeStages.get(name);
+        const measured = durationMs ?? (started === undefined ? undefined : Date.now() - started);
+        this.activeStages.delete(name);
+        this.run.stages.push({
+            name,
+            status: 'done',
+            ...(measured === undefined ? {} : { durationMs: measured }),
+            ...(detail === undefined ? {} : { detail }),
+        });
+    }
+    finish(result) {
+        this.finishSummary(summaryFromResult(result));
+    }
+    finishSummary(summary) {
+        const completedAt = new Date();
+        this.run.completedAt = completedAt.toISOString();
+        this.run.durationMs = Date.now() - this.startedMs;
+        this.run.summary = summary;
+    }
+}
+export class GraphProfileBuilder {
+    startedMs = Date.now();
+    document;
+    constructor(input) {
+        this.document = {
+            version: '1.0',
+            tool: 'graph',
+            cwd: input.cwd,
+            mode: input.mode,
+            startedAt: input.startedAt ?? new Date().toISOString(),
+            runs: [],
+            ...(input.resolutionMode === undefined ? {} : { resolutionMode: input.resolutionMode }),
+        };
+    }
+    startRun(input) {
+        const run = {
+            label: input.label,
+            cwd: input.cwd,
+            mode: input.mode,
+            startedAt: new Date().toISOString(),
+            stages: [],
+        };
+        this.document.runs.push(run);
+        return new GraphProfileRunRecorder(run);
+    }
+    complete() {
+        this.document.completedAt = new Date().toISOString();
+        this.document.durationMs = Date.now() - this.startedMs;
+        return this.document;
+    }
+}
+export function writeGraphProfile(outputPath, cwd, profile) {
+    const resolved = isAbsolute(outputPath) ? outputPath : resolve(cwd, outputPath);
+    mkdirSync(dirname(resolved), { recursive: true });
+    writeFileSync(resolved, `${JSON.stringify(profile, null, 2)}\n`, 'utf8');
+    return resolved;
+}
+function summaryFromResult(result) {
+    const catalog = result.catalog;
+    return {
+        cacheHit: result.cacheHit,
+        files: catalog === null ? 0 : countCatalogFiles(catalog),
+        functions: catalog === null ? 0 : countCatalogFunctions(catalog),
+        signals: result.signals.length,
+        ...(result.resolutionStats === null
+            ? {}
+            : {
+                totalCallSites: result.resolutionStats.totalCallSites,
+                resolvedHigh: result.resolutionStats.resolvedHigh,
+                resolvedMedium: result.resolutionStats.resolvedMedium,
+                resolvedLow: result.resolutionStats.resolvedLow,
+                unresolved: result.resolutionStats.unresolved,
+            }),
+        ...(result.shardStats === undefined ? {} : { ...result.shardStats }),
+    };
+}
+function countCatalogFiles(catalog) {
+    const files = new Set();
+    for (const occs of Object.values(catalog.functions)) {
+        for (const occ of occs)
+            files.add(occ.filePath);
+    }
+    return files.size;
+}
+function countCatalogFunctions(catalog) {
+    let count = 0;
+    for (const occs of Object.values(catalog.functions))
+        count += occs.length;
+    return count;
+}
+//# sourceMappingURL=profile.js.map

package/dist/cli/profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.js","sourceRoot":"","sources":["../../src/cli/profile.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAuDzD,MAAM,OAAO,uBAAuB;IAIL;IAHZ,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAExC,YAA6B,GAAoB;QAApB,QAAG,GAAH,GAAG,CAAiB;IAAG,CAAC;IAE5C,UAAU,GAAG,CAAC,KAAyB,EAAQ,EAAE;QACxD,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YACjC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YAClC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC9D,OAAO;QACT,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAChE,CAAC,CAAC;IAEF,WAAW,CAAC,IAAY,EAAE,UAAmB,EAAE,MAAe;QAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,UAAU,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC;QAC1F,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;YACnB,IAAI;YACJ,MAAM,EAAE,MAAM;YACd,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;YAC3D,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;SAC5C,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,MAAsB;QAC3B,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,aAAa,CAAC,OAA+B;QAC3C,MAAM,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC;QAC/B,IAAI,CAAC,GAAG,CAAC,WAAW,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;QACjD,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;QAClD,IAAI,CAAC,GAAG,CAAC,OAAO,GAAG,OAAO,CAAC;IAC7B,CAAC;CACF;AAED,MAAM,OAAO,mBAAmB;IACb,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,QAAQ,CAAuB;IAEhD,YAAY,KAKX;QACC,IAAI,CAAC,QAAQ,GAAG;YACd,OAAO,EAAE,KAAK;YACd,IAAI,EAAE,OAAO;YACb,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACtD,IAAI,EAAE,EAAE;YACR,GAAG,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC;SACxF,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,KAIR;QACC,MAAM,GAAG,GAAoB;YAC3B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,MAAM,EAAE,EAAE;SACX,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,OAAO,IAAI,uBAAuB,CAAC,GAAG,CAAC,CAAC;IAC1C,CAAC;IAED,QAAQ;QACN,IAAI,CAAC,QAAQ,CAAC,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrD,IAAI,CAAC,QAAQ,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;QACvD,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;CACF;AAED,MAAM,UAAU,iBAAiB,CAC/B,UAAkB,EAClB,GAAW,EACX,OAA6B;IAE7B,MAAM,QAAQ,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAChF,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,aAAa,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACzE,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAsB;IAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC/B,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC;QACxD,SAAS,EAAE,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC;QAChE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM;QAC9B,GAAG,CAAC,MAAM,CAAC,eAAe,KAAK,IAAI;YACjC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,cAAc,EAAE,MAAM,CAAC,eAAe,CAAC,cAAc;gBACrD,YAAY,EAAE,MAAM,CAAC,eAAe,CAAC,YAAY;gBACjD,cAAc,EAAE,MAAM,CAAC,eAAe,CAAC,cAAc;gBACrD,WAAW,EAAE,MAAM,CAAC,eAAe,CAAC,WAAW;gBAC/C,UAAU,EAAE,MAAM,CAAC,eAAe,CAAC,UAAU;aAC9C,CAAC;QACN,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;KACrE,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAgB;IACzC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACpD,KAAK,MAAM,GAAG,IAAI,IAAI;YAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC;AACpB,CAAC;AAED,SAAS,qBAAqB,CAAC,OAAgB;IAC7C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;QAAE,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC;IAC1E,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/cli/report-data.d.ts

@@ -0,0 +1,46 @@
+/**
+ * @fileoverview Graph report-data catalog builders.
+ *
+ * Mirrors fitness's `collectFitnessReportData` (`fitness/.../cli/report-data.ts`):
+ * graph contributes a rule catalog + recipe catalog the dashboard renders on
+ * the Code Paths tab (Catalog + Recipes subtabs). These entry types are graph
+ * domain vocabulary, so they live here; the dashboard consumes them
+ * structurally via `DashboardInput` (typed `readonly unknown[]`) — the same
+ * opaque-payload model the fitness catalogs use, keeping `@opensip-cli/dashboard`
+ * decoupled from `@opensip-cli/graph`.
+ *
+ * **Distinct keys.** Graph contributes `graphRuleCatalog` / `graphRecipeCatalog`
+ * — NOT `checkCatalog` / `recipeCatalog`, which are fitness-owned globals the
+ * CLI merges via `Object.assign`. Reusing those keys would clobber fitness.
+ */
+import type { ToolScope } from '@opensip-cli/core';
+/** Rule catalog entry for dashboard display. */
+export interface GraphRuleCatalogEntry {
+    readonly slug: string;
+    readonly defaultSeverity: 'error' | 'warning';
+    readonly source: 'built-in';
+}
+/** Recipe catalog entry for dashboard display. */
+export interface GraphRecipeCatalogEntry {
+    readonly name: string;
+    readonly displayName: string;
+    readonly description: string;
+    readonly tags: readonly string[];
+    readonly selectorType: string;
+}
+/**
+ * Build the rule catalog from the scope's rule registry. Built-in graph
+ * rules are first-party, so `source` is hardcoded `'built-in'` for now —
+ * graph has no community-rule namespace registry yet (documented; a richer
+ * display can land with Plan D rules). Returns `[]` when the graph subscope
+ * is absent.
+ */
+export declare function buildGraphRuleCatalog(scope: ToolScope): GraphRuleCatalogEntry[];
+/**
+ * Build the recipe catalog from the scope's recipe registry. Graph recipes
+ * carry no execution block, so the entry has no `mode`/`timeout` (unlike
+ * fitness's `RecipeCatalogEntry`). Returns `[]` when the graph subscope is
+ * absent.
+ */
+export declare function buildGraphRecipeCatalog(scope: ToolScope): GraphRecipeCatalogEntry[];
+//# sourceMappingURL=report-data.d.ts.map

package/dist/cli/report-data.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"report-data.d.ts","sourceRoot":"","sources":["../../src/cli/report-data.ts"],"names":[],"mappings":"AACA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAEnD,gDAAgD;AAChD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,eAAe,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9C,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;CAC7B;AAED,kDAAkD;AAClD,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,SAAS,GAAG,qBAAqB,EAAE,CAO/E;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,SAAS,GAAG,uBAAuB,EAAE,CASnF"}

package/dist/cli/report-data.js

@@ -0,0 +1,48 @@
+// @fitness-ignore-file batch-operation-limits -- getAll() reads bounded in-memory rule/recipe registries (a handful of entries per RunScope), not a data store (cf. rules/registry.ts which suppresses the same check for the same reason).
+/**
+ * @fileoverview Graph report-data catalog builders.
+ *
+ * Mirrors fitness's `collectFitnessReportData` (`fitness/.../cli/report-data.ts`):
+ * graph contributes a rule catalog + recipe catalog the dashboard renders on
+ * the Code Paths tab (Catalog + Recipes subtabs). These entry types are graph
+ * domain vocabulary, so they live here; the dashboard consumes them
+ * structurally via `DashboardInput` (typed `readonly unknown[]`) — the same
+ * opaque-payload model the fitness catalogs use, keeping `@opensip-cli/dashboard`
+ * decoupled from `@opensip-cli/graph`.
+ *
+ * **Distinct keys.** Graph contributes `graphRuleCatalog` / `graphRecipeCatalog`
+ * — NOT `checkCatalog` / `recipeCatalog`, which are fitness-owned globals the
+ * CLI merges via `Object.assign`. Reusing those keys would clobber fitness.
+ */
+/**
+ * Build the rule catalog from the scope's rule registry. Built-in graph
+ * rules are first-party, so `source` is hardcoded `'built-in'` for now —
+ * graph has no community-rule namespace registry yet (documented; a richer
+ * display can land with Plan D rules). Returns `[]` when the graph subscope
+ * is absent.
+ */
+export function buildGraphRuleCatalog(scope) {
+    const rules = scope.graph?.rules.getAll() ?? [];
+    return rules.map((rule) => ({
+        slug: rule.slug,
+        defaultSeverity: rule.defaultSeverity,
+        source: 'built-in',
+    }));
+}
+/**
+ * Build the recipe catalog from the scope's recipe registry. Graph recipes
+ * carry no execution block, so the entry has no `mode`/`timeout` (unlike
+ * fitness's `RecipeCatalogEntry`). Returns `[]` when the graph subscope is
+ * absent.
+ */
+export function buildGraphRecipeCatalog(scope) {
+    const recipes = scope.graph?.recipes.getAllRecipes() ?? [];
+    return recipes.map((recipe) => ({
+        name: recipe.name,
+        displayName: recipe.displayName,
+        description: recipe.description,
+        tags: recipe.tags ?? [],
+        selectorType: recipe.rules.type,
+    }));
+}
+//# sourceMappingURL=report-data.js.map

package/dist/cli/report-data.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"report-data.js","sourceRoot":"","sources":["../../src/cli/report-data.ts"],"names":[],"mappings":"AAAA,4OAA4O;AAC5O;;;;;;;;;;;;;;GAcG;AAoBH;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAgB;IACpD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;IAChD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC1B,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,MAAM,EAAE,UAAmB;KAC5B,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAgB;IACtD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC;IAC3D,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC9B,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE;QACvB,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI;KAChC,CAAC,CAAC,CAAC;AACN,CAAC"}

package/dist/cli/resolve-adapters.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Resolve which language adapters apply to a graph run.
+ *
+ * Extracted from `graph.ts` so both the full-run orchestrator
+ * (`executeGraph`) and the discovery-only `--list-files` path
+ * (`executeListFiles`) share one adapter-selection rule rather than
+ * duplicating it — and so the new list-files module does not have to
+ * import the large graph command handler just for this helper.
+ */
+import type { GraphCommandOptions } from './graph-options.js';
+import type { LanguageAdapter, ToolCliContext } from '@opensip-cli/core';
+/**
+ * Resolve which language adapters apply to this run. With `--language`
+ * set, returns exactly that adapter (errors if unregistered). Without
+ * it, runs marker-based detection and returns every adapter the repo
+ * exposes a marker for (polyglot per spec D6).
+ */
+export declare function resolveAdaptersForRun(opts: GraphCommandOptions, cli: ToolCliContext): readonly LanguageAdapter[];
+//# sourceMappingURL=resolve-adapters.d.ts.map

package/dist/cli/resolve-adapters.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-adapters.d.ts","sourceRoot":"","sources":["../../src/cli/resolve-adapters.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEzE;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,mBAAmB,EACzB,GAAG,EAAE,cAAc,GAClB,SAAS,eAAe,EAAE,CAkB5B"}

package/dist/cli/resolve-adapters.js

@@ -0,0 +1,38 @@
+/**
+ * Resolve which language adapters apply to a graph run.
+ *
+ * Extracted from `graph.ts` so both the full-run orchestrator
+ * (`executeGraph`) and the discovery-only `--list-files` path
+ * (`executeListFiles`) share one adapter-selection rule rather than
+ * duplicating it — and so the new list-files module does not have to
+ * import the large graph command handler just for this helper.
+ */
+import { ConfigurationError } from '@opensip-cli/core';
+import { detectLanguages } from './detect.js';
+/**
+ * Resolve which language adapters apply to this run. With `--language`
+ * set, returns exactly that adapter (errors if unregistered). Without
+ * it, runs marker-based detection and returns every adapter the repo
+ * exposes a marker for (polyglot per spec D6).
+ */
+export function resolveAdaptersForRun(opts, cli) {
+    const registry = cli.scope.languages;
+    if (typeof opts.language === 'string' && opts.language.length > 0) {
+        const canonical = registry.canonicalize(opts.language) ?? opts.language;
+        const adapter = registry.get(canonical);
+        if (!adapter) {
+            throw new ConfigurationError(`--language '${opts.language}' is not a registered adapter.`);
+        }
+        return [adapter];
+    }
+    const detection = detectLanguages(opts.cwd, registry);
+    const adapters = [];
+    for (const id of detection.adapterIds) {
+        const adapter = registry.get(id);
+        /* v8 ignore next */
+        if (adapter)
+            adapters.push(adapter);
+    }
+    return adapters;
+}
+//# sourceMappingURL=resolve-adapters.js.map

package/dist/cli/resolve-adapters.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-adapters.js","sourceRoot":"","sources":["../../src/cli/resolve-adapters.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAEvD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAK9C;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAAyB,EACzB,GAAmB;IAEnB,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;IACrC,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClE,MAAM,SAAS,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC;QACxE,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,kBAAkB,CAAC,eAAe,IAAI,CAAC,QAAQ,gCAAgC,CAAC,CAAC;QAC7F,CAAC;QACD,OAAO,CAAC,OAAO,CAAC,CAAC;IACnB,CAAC;IACD,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,KAAK,MAAM,EAAE,IAAI,SAAS,CAAC,UAAU,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACjC,oBAAoB;QACpB,IAAI,OAAO;YAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/cli/sarif-export.d.ts

@@ -0,0 +1,40 @@
+/**
+ * @fileoverview `sarif-export` subcommand mode helper (DEC-498, opensip
+ * Phase 2/Phase 6).
+ *
+ * Builds the run's signal envelope (applying the OpenSIP rule-ID convention —
+ * Option A — at assembly) and writes the SARIF v2.1.0 document to the
+ * `--output-sarif <path>` file via the root-owned SARIF-file sink
+ * (`cli.writeSarif`, ADR-0011 Phase 5). The opensip
+ * `EngineSubprocessPort.runSarifExport` invokes this per commit-sync /
+ * dead-code run, then lands the file on opensip's `SarifProvider`. Its
+ * external behavior (the `--output-sarif` flag, byte-identical OpenSIP SARIF)
+ * is unchanged: the canonical signal → SARIF formatter (`formatSignalSarif` in
+ * `@opensip-cli/output`) emits the same bytes graph's former adapter did
+ * once the envelope carries the OpenSIP-mapped rule IDs.
+ *
+ * Per ADR-0011 (file is a sink; the root renders/delivers), SARIF-to-file is a
+ * root seam — graph no longer imports `@opensip-cli/output`. Validates the
+ * provenance flags the consumer contract requires (`--tenant-id`/`--repo-id`)
+ * so a misinvocation fails loudly (exit 2) rather than emitting an unscoped
+ * file.
+ */
+import type { Signal, ToolCliContext } from '@opensip-cli/core';
+/** Options consumed by the `sarif-export` subcommand. */
+export interface SarifExportOptions {
+    readonly outputSarif: string;
+    readonly tenantId?: string;
+    readonly repoId?: string;
+    readonly runId?: string;
+}
+/**
+ * Build the OpenSIP-convention SARIF envelope from the engine's findings and
+ * write it to `opts.outputSarif` through the root-owned `cli.writeSarif` seam.
+ *
+ * `tenantId` / `repoId` are not embedded in the SARIF body today — the SARIF
+ * shape carries no `properties` bag — but they are required at the boundary
+ * (the opensip side always supplies them and scopes the ingest by them) and
+ * `runId` is threaded into the log line for trace correlation.
+ */
+export declare function runSarifExportMode(opts: SarifExportOptions, signals: readonly Signal[], cli: ToolCliContext): Promise<void>;
+//# sourceMappingURL=sarif-export.d.ts.map

package/dist/cli/sarif-export.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sarif-export.d.ts","sourceRoot":"","sources":["../../src/cli/sarif-export.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AASH,OAAO,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAIhE,yDAAyD;AACzD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,GAAG,EAAE,cAAc,GAClB,OAAO,CAAC,IAAI,CAAC,CAmCf"}

package/dist/cli/sarif-export.js

@@ -0,0 +1,69 @@
+/**
+ * @fileoverview `sarif-export` subcommand mode helper (DEC-498, opensip
+ * Phase 2/Phase 6).
+ *
+ * Builds the run's signal envelope (applying the OpenSIP rule-ID convention —
+ * Option A — at assembly) and writes the SARIF v2.1.0 document to the
+ * `--output-sarif <path>` file via the root-owned SARIF-file sink
+ * (`cli.writeSarif`, ADR-0011 Phase 5). The opensip
+ * `EngineSubprocessPort.runSarifExport` invokes this per commit-sync /
+ * dead-code run, then lands the file on opensip's `SarifProvider`. Its
+ * external behavior (the `--output-sarif` flag, byte-identical OpenSIP SARIF)
+ * is unchanged: the canonical signal → SARIF formatter (`formatSignalSarif` in
+ * `@opensip-cli/output`) emits the same bytes graph's former adapter did
+ * once the envelope carries the OpenSIP-mapped rule IDs.
+ *
+ * Per ADR-0011 (file is a sink; the root renders/delivers), SARIF-to-file is a
+ * root seam — graph no longer imports `@opensip-cli/output`. Validates the
+ * provenance flags the consumer contract requires (`--tenant-id`/`--repo-id`)
+ * so a misinvocation fails loudly (exit 2) rather than emitting an unscoped
+ * file.
+ */
+import { randomUUID } from 'node:crypto';
+import { EXIT_CODES } from '@opensip-cli/contracts';
+import { ConfigurationError, logger } from '@opensip-cli/core';
+import { buildGraphEnvelope } from './build-envelope.js';
+const MODULE_GRAPH_RENDER = 'graph:render';
+/**
+ * Build the OpenSIP-convention SARIF envelope from the engine's findings and
+ * write it to `opts.outputSarif` through the root-owned `cli.writeSarif` seam.
+ *
+ * `tenantId` / `repoId` are not embedded in the SARIF body today — the SARIF
+ * shape carries no `properties` bag — but they are required at the boundary
+ * (the opensip side always supplies them and scopes the ingest by them) and
+ * `runId` is threaded into the log line for trace correlation.
+ */
+export async function runSarifExportMode(opts, signals, cli) {
+    if (typeof opts.tenantId !== 'string' || opts.tenantId.length === 0) {
+        throw new ConfigurationError('--output-sarif requires --tenant-id <id>.');
+    }
+    if (typeof opts.repoId !== 'string' || opts.repoId.length === 0) {
+        throw new ConfigurationError('--output-sarif requires --repo-id <id>.');
+    }
+    const runId = opts.runId ?? randomUUID();
+    logger.info({
+        evt: 'graph.render.sarif_export.start',
+        module: MODULE_GRAPH_RENDER,
+        runId,
+        output: opts.outputSarif,
+    });
+    // Option A: the envelope's signals carry the OpenSIP-mapped rule IDs, so the
+    // shared `formatSignalSarif` (behind `cli.writeSarif`) emits the same SARIF
+    // bytes graph's former adapter produced. `runId`/`createdAt` are SARIF-body-
+    // irrelevant for this formatter, so deterministic placeholders are fine.
+    const envelope = buildGraphEnvelope({
+        signals,
+        runId,
+        createdAt: new Date().toISOString(),
+    });
+    await cli.writeSarif(envelope, opts.outputSarif);
+    logger.info({
+        evt: 'graph.render.sarif_export.complete',
+        module: MODULE_GRAPH_RENDER,
+        runId,
+        output: opts.outputSarif,
+        signalCount: signals.length,
+    });
+    cli.setExitCode(EXIT_CODES.SUCCESS);
+}
+//# sourceMappingURL=sarif-export.js.map

package/dist/cli/sarif-export.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sarif-export.js","sourceRoot":"","sources":["../../src/cli/sarif-export.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAE/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAIzD,MAAM,mBAAmB,GAAG,cAAc,CAAC;AAU3C;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAwB,EACxB,OAA0B,EAC1B,GAAmB;IAEnB,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,kBAAkB,CAAC,2CAA2C,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,kBAAkB,CAAC,yCAAyC,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,EAAE,CAAC;IACzC,MAAM,CAAC,IAAI,CAAC;QACV,GAAG,EAAE,iCAAiC;QACtC,MAAM,EAAE,mBAAmB;QAC3B,KAAK;QACL,MAAM,EAAE,IAAI,CAAC,WAAW;KACzB,CAAC,CAAC;IAEH,6EAA6E;IAC7E,4EAA4E;IAC5E,6EAA6E;IAC7E,yEAAyE;IACzE,MAAM,QAAQ,GAAG,kBAAkB,CAAC;QAClC,OAAO;QACP,KAAK;QACL,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC,CAAC;IACH,MAAM,GAAG,CAAC,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IAEjD,MAAM,CAAC,IAAI,CAAC;QACV,GAAG,EAAE,oCAAoC;QACzC,MAAM,EAAE,mBAAmB;QAC3B,KAAK;QACL,MAAM,EAAE,IAAI,CAAC,WAAW;QACxB,WAAW,EAAE,OAAO,CAAC,MAAM;KAC5B,CAAC,CAAC;IACH,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;AACtC,CAAC"}

package/dist/cli/shard-worker.d.ts

@@ -0,0 +1,25 @@
+/**
+ * `graph-shard-worker <specPath>` — the per-shard build subprocess.
+ *
+ * One worker process builds ONE shard: it reads a {@link ShardWorkerSpec}
+ * JSON file, runs parse → walk → resolve over the shard's explicit file
+ * set (requesting cross-boundary descriptors), and writes a serializable
+ * {@link ShardBuildResult} JSON to stdout. The parent (the shard runner)
+ * spawns N of these under a concurrency cap and merges their fragments.
+ *
+ * This is an internal command, not a user-facing one — the shard runner
+ * invokes `node <cliScript> graph-shard-worker <specPath>`. It exists as a
+ * subcommand so the worker runs inside the bootstrapped CLI scope (the
+ * language-adapter registry is populated), letting `pickAdapter` resolve
+ * the adapter exactly as the main build does.
+ *
+ * The boundary is JSON only: no `ts.Node` / `ts.Program` ever crosses it.
+ */
+import type { ToolCliContext } from '@opensip-cli/core';
+/**
+ * Build one shard and emit its `ShardBuildResult` as JSON on stdout.
+ * Exits non-zero (via setExitCode) on failure so the parent can attribute
+ * the error to this shard.
+ */
+export declare function executeShardWorker(specPath: string, cli: ToolCliContext): Promise<void>;
+//# sourceMappingURL=shard-worker.d.ts.map