@opensip-cli/graph 0.1.0

package/dist/rules/__tests__/signal-output.snapshot.test.js

@@ -0,0 +1,55 @@
+/**
+ * @fileoverview Signal-output snapshot — locks each rule's full emitted Signal
+ * shape (ruleId, severity, category, message, filePath, line, column, metadata)
+ * over the shared fixture (Plan B, Phase 5 Task 5.2). Catches message /
+ * metadata / severity drift the fingerprint multiset (location-only) cannot.
+ *
+ * The non-deterministic Signal fields (`id`, `createdAt`) are stripped before
+ * snapshotting so the snapshot is stable run-to-run.
+ */
+import { describe, expect, it } from 'vitest';
+import { buildIndexes } from '../../pipeline/indexes.js';
+import { alwaysThrowsBranchRule } from '../always-throws-branch.js';
+import { duplicatedFunctionBodyRule } from '../duplicated-function-body.js';
+import { noSideEffectPathRule } from '../no-side-effect-path.js';
+import { orphanSubtreeRule } from '../orphan-subtree.js';
+import { testOnlyReachableRule } from '../test-only-reachable.js';
+import { buildAllRulesFixture } from './__fixtures__/catalog.fixture.js';
+const EMPTY_CONFIG = {};
+const RULES = [
+    orphanSubtreeRule,
+    duplicatedFunctionBodyRule,
+    noSideEffectPathRule,
+    testOnlyReachableRule,
+    alwaysThrowsBranchRule,
+];
+/** Strip run-varying fields so the snapshot is deterministic. */
+function stable(s) {
+    return {
+        ruleId: s.ruleId,
+        source: s.source,
+        provider: s.provider,
+        severity: s.severity,
+        category: s.category,
+        message: s.message,
+        suggestion: s.suggestion,
+        filePath: s.filePath,
+        line: s.line,
+        column: s.column,
+        metadata: s.metadata,
+    };
+}
+describe('rule signal-output snapshot', () => {
+    it('the full emitted Signal set matches the snapshot', () => {
+        const catalog = buildAllRulesFixture();
+        const indexes = buildIndexes(catalog);
+        const signals = [];
+        for (const rule of RULES) {
+            signals.push(...rule.evaluate(catalog, indexes, EMPTY_CONFIG, undefined));
+        }
+        const sortKey = (s) => `${s.ruleId}|${s.filePath}|${String(s.line ?? 0)}`;
+        const sorted = [...signals].sort((a, b) => sortKey(a).localeCompare(sortKey(b))).map(stable);
+        expect(sorted).toMatchSnapshot();
+    });
+});
+//# sourceMappingURL=signal-output.snapshot.test.js.map

package/dist/rules/__tests__/signal-output.snapshot.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signal-output.snapshot.test.js","sourceRoot":"","sources":["../../../src/rules/__tests__/signal-output.snapshot.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,EAAE,0BAA0B,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAElE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAKzE,MAAM,YAAY,GAAgB,EAAE,CAAC;AAErC,MAAM,KAAK,GAAoB;IAC7B,iBAAiB;IACjB,0BAA0B;IAC1B,oBAAoB;IACpB,qBAAqB;IACrB,sBAAsB;CACvB,CAAC;AAEF,iEAAiE;AACjE,SAAS,MAAM,CAAC,CAAS;IACvB,OAAO;QACL,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,QAAQ,EAAE,CAAC,CAAC,QAAQ;KACrB,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;IAC3C,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,OAAO,GAAG,oBAAoB,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,OAAO,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,QAAQ,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,CAAC;QAC1F,MAAM,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7F,MAAM,CAAC,MAAM,CAAC,CAAC,eAAe,EAAE,CAAC;IACnC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/rules/_approximation.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Shared helper for rules that depend on edge completeness.
+ *
+ * On a fast (syntactic) catalog, call edges are approximate: a missing
+ * edge can make an absence-based rule (orphan detection, test-only
+ * reachability) emit a false positive — a function looks unreachable
+ * only because its sole caller's edge wasn't resolved. Rather than
+ * silently emitting findings that read as exact, such rules annotate
+ * their findings so a reader on a fast catalog knows the caveat.
+ *
+ * Structural rules (duplicated body, always-throws) don't depend on
+ * edges and don't use this.
+ */
+import type { Catalog } from '../types.js';
+/** True when the catalog was produced by the approximate (fast) tier. */
+export declare function isApproximateCatalog(catalog: Catalog): boolean;
+/**
+ * Suffix appended to an edge-dependent finding's message on a fast
+ * catalog. Empty string for exact catalogs, so the common case is
+ * unchanged and the call site reads as `message + approximateSuffix(catalog)`.
+ */
+export declare function approximateSuffix(catalog: Catalog): string;
+//# sourceMappingURL=_approximation.d.ts.map

package/dist/rules/_approximation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"_approximation.d.ts","sourceRoot":"","sources":["../../src/rules/_approximation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAE3C,yEAAyE;AACzE,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAE9D;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAI1D"}

package/dist/rules/_approximation.js

@@ -0,0 +1,28 @@
+/**
+ * Shared helper for rules that depend on edge completeness.
+ *
+ * On a fast (syntactic) catalog, call edges are approximate: a missing
+ * edge can make an absence-based rule (orphan detection, test-only
+ * reachability) emit a false positive — a function looks unreachable
+ * only because its sole caller's edge wasn't resolved. Rather than
+ * silently emitting findings that read as exact, such rules annotate
+ * their findings so a reader on a fast catalog knows the caveat.
+ *
+ * Structural rules (duplicated body, always-throws) don't depend on
+ * edges and don't use this.
+ */
+/** True when the catalog was produced by the approximate (fast) tier. */
+export function isApproximateCatalog(catalog) {
+    return catalog.resolutionMode === 'fast';
+}
+/**
+ * Suffix appended to an edge-dependent finding's message on a fast
+ * catalog. Empty string for exact catalogs, so the common case is
+ * unchanged and the call site reads as `message + approximateSuffix(catalog)`.
+ */
+export function approximateSuffix(catalog) {
+    return isApproximateCatalog(catalog)
+        ? ' [approximate: based on fast-mode syntactic edges — a missing edge may make this a false positive; confirm with --resolution exact]'
+        : '';
+}
+//# sourceMappingURL=_approximation.js.map

package/dist/rules/_approximation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_approximation.js","sourceRoot":"","sources":["../../src/rules/_approximation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,yEAAyE;AACzE,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,OAAO,OAAO,CAAC,cAAc,KAAK,MAAM,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAgB;IAChD,OAAO,oBAAoB,CAAC,OAAO,CAAC;QAClC,CAAC,CAAC,qIAAqI;QACvI,CAAC,CAAC,EAAE,CAAC;AACT,CAAC"}

package/dist/rules/_entry-points.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Entry-point inference (shared by orphan-subtree, test-only-reachable).
+ *
+ * A function is an entry point if:
+ *  1. It's the bin entry (declared in package.json `bin`).
+ *  2. It's a Tool registration's commands handler.
+ *  3. Its name matches a heuristic list (main, start, register, init, etc.).
+ *  4. Its `<module-init>` is reachable (top-level statements always run).
+ *  5. It's exported AND has no *external* in-project caller (someone
+ *     outside the project might call it). A self-recursive edge does not
+ *     count as a caller here: an exported public function whose only
+ *     in-project caller is itself (e.g. a recursive renderer consumed
+ *     only across a package boundary, where the cross-package call edge
+ *     does not resolve) is still an external entry point — counting its
+ *     own recursion as a "caller" would wrongly hide it (and its whole
+ *     file-local helper subtree) as an orphan.
+ *
+ * v0.2 ships heuristics 3, 4, 5; 1 and 2 are project-specific and
+ * deferred until cross-package call resolution is reliable.
+ */
+import type { Catalog, Indexes } from '../types.js';
+export interface EntryPoint {
+    readonly bodyHash: string;
+    readonly reason: 'module-init' | 'name-match' | 'no-callers-exported';
+}
+export declare function inferEntryPoints(catalog: Catalog, indexes: Indexes): readonly EntryPoint[];
+//# sourceMappingURL=_entry-points.d.ts.map

package/dist/rules/_entry-points.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"_entry-points.d.ts","sourceRoot":"","sources":["../../src/rules/_entry-points.ts"],"names":[],"mappings":"AACA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAsB,OAAO,EAAE,MAAM,aAAa,CAAC;AAYxE,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,aAAa,GAAG,YAAY,GAAG,qBAAqB,CAAC;CACvE;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,SAAS,UAAU,EAAE,CAW1F"}

package/dist/rules/_entry-points.js

@@ -0,0 +1,81 @@
+// @fitness-ignore-file batch-operation-limits -- iterates bounded collection (catalog entries within a single graph build)
+/**
+ * Entry-point inference (shared by orphan-subtree, test-only-reachable).
+ *
+ * A function is an entry point if:
+ *  1. It's the bin entry (declared in package.json `bin`).
+ *  2. It's a Tool registration's commands handler.
+ *  3. Its name matches a heuristic list (main, start, register, init, etc.).
+ *  4. Its `<module-init>` is reachable (top-level statements always run).
+ *  5. It's exported AND has no *external* in-project caller (someone
+ *     outside the project might call it). A self-recursive edge does not
+ *     count as a caller here: an exported public function whose only
+ *     in-project caller is itself (e.g. a recursive renderer consumed
+ *     only across a package boundary, where the cross-package call edge
+ *     does not resolve) is still an external entry point — counting its
+ *     own recursion as a "caller" would wrongly hide it (and its whole
+ *     file-local helper subtree) as an orphan.
+ *
+ * v0.2 ships heuristics 3, 4, 5; 1 and 2 are project-specific and
+ * deferred until cross-package call resolution is reliable.
+ */
+const NAME_HEURISTICS = new Set([
+    'main',
+    'run',
+    'start',
+    'register',
+    'initialize',
+    'init',
+    'bootstrap',
+]);
+export function inferEntryPoints(catalog, indexes) {
+    const out = [];
+    for (const occ of indexes.byBodyHash.values()) {
+        const reason = classify(occ, indexes);
+        if (reason !== null)
+            out.push({ bodyHash: occ.bodyHash, reason });
+    }
+    // Honor caller-supplied override at the rule level via GraphConfig
+    // (handled by the consuming rule). This module returns the inferred
+    // set; rules merge it with config.entryPointHashes.
+    void catalog;
+    return out;
+}
+function classify(occ, indexes) {
+    // Every <module-init> is an entry point. Top-level statements run
+    // whenever the file is part of the import closure of a real
+    // entry point. We don't track import edges, so a conservative
+    // approximation is "every file's module-init is alive." Combined
+    // with creation edges (parent-function → nested-function), this
+    // gives transitive reachability for everything except top-level
+    // function declarations that are never named-called and never
+    // referenced as values.
+    if (occ.kind === 'module-init')
+        return 'module-init';
+    if (NAME_HEURISTICS.has(occ.simpleName))
+        return 'name-match';
+    if (occ.visibility === 'exported' && !hasExternalCaller(occ, indexes)) {
+        // Exported but no *external* in-project caller — likely an external
+        // entry point (consumed cross-package, where the call edge may not
+        // resolve). Self-recursion does not count as an external caller.
+        return 'no-callers-exported';
+    }
+    return null;
+}
+/**
+ * True iff some in-project occurrence other than `occ` itself calls it.
+ * A self-recursive edge (`callers` contains `occ.bodyHash`) is excluded:
+ * recursion does not make a function reachable, so an otherwise-uncalled
+ * exported function must still be treated as an external entry point.
+ */
+function hasExternalCaller(occ, indexes) {
+    const callers = indexes.callers.get(occ.bodyHash);
+    if (callers === undefined)
+        return false;
+    for (const caller of callers) {
+        if (caller !== occ.bodyHash)
+            return true;
+    }
+    return false;
+}
+//# sourceMappingURL=_entry-points.js.map

package/dist/rules/_entry-points.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_entry-points.js","sourceRoot":"","sources":["../../src/rules/_entry-points.ts"],"names":[],"mappings":"AAAA,2HAA2H;AAC3H;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,MAAM;IACN,KAAK;IACL,OAAO;IACP,UAAU;IACV,YAAY;IACZ,MAAM;IACN,WAAW;CACZ,CAAC,CAAC;AAOH,MAAM,UAAU,gBAAgB,CAAC,OAAgB,EAAE,OAAgB;IACjE,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACtC,IAAI,MAAM,KAAK,IAAI;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,mEAAmE;IACnE,oEAAoE;IACpE,oDAAoD;IACpD,KAAK,OAAO,CAAC;IACb,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,QAAQ,CAAC,GAAuB,EAAE,OAAgB;IACzD,kEAAkE;IAClE,4DAA4D;IAC5D,8DAA8D;IAC9D,iEAAiE;IACjE,gEAAgE;IAChE,gEAAgE;IAChE,8DAA8D;IAC9D,wBAAwB;IACxB,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa;QAAE,OAAO,aAAa,CAAC;IACrD,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,OAAO,YAAY,CAAC;IAC7D,IAAI,GAAG,CAAC,UAAU,KAAK,UAAU,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC;QACtE,oEAAoE;QACpE,mEAAmE;QACnE,iEAAiE;QACjE,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,GAAuB,EAAE,OAAgB;IAClE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACxC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,KAAK,GAAG,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;IAC3C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/rules/_severity-override.d.ts

@@ -0,0 +1,32 @@
+/**
+ * `applySeverityOverride` — the opt-in, baseline-neutral severity clamp
+ * (ADR-0005, resolved 2026-06-02).
+ *
+ * A rule's per-signal severity (including Phase D's multi-band ladders) is the
+ * **base**. `GraphConfig.severityOverrides[slug]` clamps it **only when
+ * explicitly set** (`'error' → 'high'`, `'warning' → 'medium'`);
+ * `defaultSeverity` stays metadata, never the emitted value. With NO override
+ * configured the base is returned unchanged — so every existing rule's emitted
+ * severity is byte-for-byte identical to before this wiring (no baseline /
+ * Code-Scanning churn). A naive `defaultSeverity → severity` mapping was
+ * rejected: it would push the four `low` rules to `medium` and churn the
+ * baseline.
+ *
+ * Lives under `rules/` (peer to the prefixed helpers `_approximation.ts`,
+ * `_entry-points.ts`) — no new layer crossing.
+ */
+import type { GraphConfig } from '../types.js';
+import type { SignalSeverity } from '@opensip-cli/core';
+/**
+ * Clamp a rule's base severity per the opt-in override channel. Launch
+ * (§5.9): delegates the clamp to the central `SeverityPolicy.applyOverride`
+ * (byte-identical — base unchanged with no override, `error → high`,
+ * `warning → medium` when set); this stays as the graph-config lookup seam.
+ *
+ * @param base   The severity the rule's predicate chose for this signal.
+ * @param slug   The rule's `graph:<slug>` id (the override key).
+ * @param config The active {@link GraphConfig}.
+ * @returns The override target when an override is set for `slug`, else `base`.
+ */
+export declare function applySeverityOverride(base: SignalSeverity, slug: string, config: GraphConfig): SignalSeverity;
+//# sourceMappingURL=_severity-override.d.ts.map

package/dist/rules/_severity-override.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"_severity-override.d.ts","sourceRoot":"","sources":["../../src/rules/_severity-override.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAExD;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,cAAc,EACpB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,WAAW,GAClB,cAAc,CAEhB"}

package/dist/rules/_severity-override.js

@@ -0,0 +1,33 @@
+/**
+ * `applySeverityOverride` — the opt-in, baseline-neutral severity clamp
+ * (ADR-0005, resolved 2026-06-02).
+ *
+ * A rule's per-signal severity (including Phase D's multi-band ladders) is the
+ * **base**. `GraphConfig.severityOverrides[slug]` clamps it **only when
+ * explicitly set** (`'error' → 'high'`, `'warning' → 'medium'`);
+ * `defaultSeverity` stays metadata, never the emitted value. With NO override
+ * configured the base is returned unchanged — so every existing rule's emitted
+ * severity is byte-for-byte identical to before this wiring (no baseline /
+ * Code-Scanning churn). A naive `defaultSeverity → severity` mapping was
+ * rejected: it would push the four `low` rules to `medium` and churn the
+ * baseline.
+ *
+ * Lives under `rules/` (peer to the prefixed helpers `_approximation.ts`,
+ * `_entry-points.ts`) — no new layer crossing.
+ */
+import { SeverityPolicy } from '@opensip-cli/core';
+/**
+ * Clamp a rule's base severity per the opt-in override channel. Launch
+ * (§5.9): delegates the clamp to the central `SeverityPolicy.applyOverride`
+ * (byte-identical — base unchanged with no override, `error → high`,
+ * `warning → medium` when set); this stays as the graph-config lookup seam.
+ *
+ * @param base   The severity the rule's predicate chose for this signal.
+ * @param slug   The rule's `graph:<slug>` id (the override key).
+ * @param config The active {@link GraphConfig}.
+ * @returns The override target when an override is set for `slug`, else `base`.
+ */
+export function applySeverityOverride(base, slug, config) {
+    return SeverityPolicy.applyOverride(base, config.severityOverrides?.[slug]);
+}
+//# sourceMappingURL=_severity-override.js.map

package/dist/rules/_severity-override.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_severity-override.js","sourceRoot":"","sources":["../../src/rules/_severity-override.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAKnD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAAoB,EACpB,IAAY,EACZ,MAAmB;IAEnB,OAAO,cAAc,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,iBAAiB,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;AAC9E,CAAC"}

package/dist/rules/always-throws-branch.d.ts

@@ -0,0 +1,26 @@
+/**
+ * graph:always-throws-branch — heuristic CFG analysis to flag
+ * functions whose body is dominated by throw statements.
+ *
+ * v0.2 ships a textual heuristic against the catalog's per-call text
+ * + the function's overall outbound edge set: a function whose only
+ * calls are `throw new <Error>()` style expressions (resolution
+ * 'unknown' but text matches `throw new`) is likely an
+ * always-throws helper masquerading as a real function.
+ *
+ * Throw-statement syntax is language-specific. The active adapter
+ * supplies `ruleHints.throwSyntaxRegex`: TypeScript matches
+ * `throw new Error(...)`; Python matches `raise SomeError(...)`;
+ * Rust matches `panic!(...)`. When the hint is absent — older
+ * adapters, third-party adapters that don't populate it, unit tests
+ * that don't pass hints — we fall back to the TypeScript-shaped
+ * regex so the rule keeps firing on the language it was originally
+ * authored for. The fidelity matrix in the graph rules-and-gating
+ * documentation enumerates which rules degrade gracefully when an
+ * adapter omits a given hint.
+ *
+ * Rules that need full CFG (per-branch reachability) are deferred to
+ * v0.3.
+ */
+export declare const alwaysThrowsBranchRule: import("../types.js").Rule;
+//# sourceMappingURL=always-throws-branch.d.ts.map

package/dist/rules/always-throws-branch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"always-throws-branch.d.ts","sourceRoot":"","sources":["../../src/rules/always-throws-branch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AASH,eAAO,MAAM,sBAAsB,4BAoCjC,CAAC"}

package/dist/rules/always-throws-branch.js

@@ -0,0 +1,66 @@
+/**
+ * graph:always-throws-branch — heuristic CFG analysis to flag
+ * functions whose body is dominated by throw statements.
+ *
+ * v0.2 ships a textual heuristic against the catalog's per-call text
+ * + the function's overall outbound edge set: a function whose only
+ * calls are `throw new <Error>()` style expressions (resolution
+ * 'unknown' but text matches `throw new`) is likely an
+ * always-throws helper masquerading as a real function.
+ *
+ * Throw-statement syntax is language-specific. The active adapter
+ * supplies `ruleHints.throwSyntaxRegex`: TypeScript matches
+ * `throw new Error(...)`; Python matches `raise SomeError(...)`;
+ * Rust matches `panic!(...)`. When the hint is absent — older
+ * adapters, third-party adapters that don't populate it, unit tests
+ * that don't pass hints — we fall back to the TypeScript-shaped
+ * regex so the rule keeps firing on the language it was originally
+ * authored for. The fidelity matrix in the graph rules-and-gating
+ * documentation enumerates which rules degrade gracefully when an
+ * adapter omits a given hint.
+ *
+ * Rules that need full CFG (per-branch reachability) are deferred to
+ * v0.3.
+ */
+import { createGraphSignal } from './create-graph-signal.js';
+import { defineRule } from './define-rule.js';
+const TYPESCRIPT_FALLBACK_THROW_REGEX = /^\s*throw\s+(?:new\s+)?[A-Z]\w*/;
+export const alwaysThrowsBranchRule = defineRule({
+    slug: 'graph:always-throws-branch',
+    defaultSeverity: 'warning',
+    evaluate({ indexes, hints, config }) {
+        const throwRegex = hints?.throwSyntaxRegex ?? TYPESCRIPT_FALLBACK_THROW_REGEX;
+        const signals = [];
+        for (const occ of indexes.byBodyHash.values()) {
+            if (occ.kind === 'module-init')
+                continue;
+            // An always-throwing arrow in a test file is an intentional
+            // `expect(...).toThrow()` fixture (`() => { throw boom }`), not a
+            // production control-flow smell. This rule targets production code,
+            // so skip test-file occurrences — same guard the no-side-effect-path
+            // rule applies.
+            if (occ.inTestFile)
+                continue;
+            if (occ.calls.length === 0)
+                continue;
+            // All edges look like throw shapes — every documented call site
+            // is a throw / raise / panic per the adapter's regex.
+            const everyCallIsThrow = occ.calls.every((e) => throwRegex.test(e.text));
+            if (!everyCallIsThrow)
+                continue;
+            signals.push(createGraphSignal('graph:always-throws-branch', config, {
+                severity: 'low',
+                category: 'quality',
+                message: `${occ.simpleName} appears to always throw.`,
+                code: { file: occ.filePath, line: occ.line, column: occ.column },
+                suggestion: 'Inline the throw at every caller, or document the precondition this function enforces.',
+                metadata: {
+                    qualifiedName: occ.qualifiedName,
+                    edgeCount: occ.calls.length,
+                },
+            }));
+        }
+        return signals;
+    },
+});
+//# sourceMappingURL=always-throws-branch.js.map

package/dist/rules/always-throws-branch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"always-throws-branch.js","sourceRoot":"","sources":["../../src/rules/always-throws-branch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAI9C,MAAM,+BAA+B,GAAG,iCAAiC,CAAC;AAE1E,MAAM,CAAC,MAAM,sBAAsB,GAAG,UAAU,CAAC;IAC/C,IAAI,EAAE,4BAA4B;IAClC,eAAe,EAAE,SAAS;IAC1B,QAAQ,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE;QACjC,MAAM,UAAU,GAAG,KAAK,EAAE,gBAAgB,IAAI,+BAA+B,CAAC;QAC9E,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;YAC9C,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa;gBAAE,SAAS;YACzC,4DAA4D;YAC5D,kEAAkE;YAClE,oEAAoE;YACpE,qEAAqE;YACrE,gBAAgB;YAChB,IAAI,GAAG,CAAC,UAAU;gBAAE,SAAS;YAC7B,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YACrC,gEAAgE;YAChE,sDAAsD;YACtD,MAAM,gBAAgB,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YACzE,IAAI,CAAC,gBAAgB;gBAAE,SAAS;YAChC,OAAO,CAAC,IAAI,CACV,iBAAiB,CAAC,4BAA4B,EAAE,MAAM,EAAE;gBACtD,QAAQ,EAAE,KAAK;gBACf,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE,GAAG,GAAG,CAAC,UAAU,2BAA2B;gBACrD,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE;gBAChE,UAAU,EACR,wFAAwF;gBAC1F,QAAQ,EAAE;oBACR,aAAa,EAAE,GAAG,CAAC,aAAa;oBAChC,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM;iBAC5B;aACF,CAAC,CACH,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF,CAAC,CAAC"}

package/dist/rules/create-graph-signal.d.ts

@@ -0,0 +1,38 @@
+/**
+ * createGraphSignal — the graph rule signal factory (north-star §5.9, release
+ * launch).
+ *
+ * Graph rules used to hand-assemble fingerprint-relevant identity in every body:
+ * `createSignal({ source: 'graph', ruleId: 'graph:<slug>', severity:
+ * applySeverityOverride(base, 'graph:<slug>', config), … })`. This factory STAMPS
+ * that identity from the rule's slug + config — `source` is always `'graph'`,
+ * `ruleId` IS the slug, and the override clamp is applied internally — so a rule
+ * names its slug once and never retypes `source`/`ruleId` or re-calls the override.
+ * Output is byte-identical to the former hand-assembly.
+ *
+ * The `body.severity` is the rule's per-signal CHOICE (its data, not identity);
+ * the override (`GraphConfig.severityOverrides[slug]`) is applied on top here.
+ */
+import { type Signal, type SignalCategory, type SignalSeverity } from '@opensip-cli/core';
+import type { GraphConfig } from '../types.js';
+/** The per-signal data a graph rule supplies — everything EXCEPT the stamped identity. */
+export interface GraphSignalBody {
+    /** The rule's chosen base severity for this signal (clamped by any override). */
+    readonly severity: SignalSeverity;
+    readonly category: SignalCategory | string;
+    readonly message: string;
+    readonly code?: {
+        file?: string;
+        line?: number;
+        column?: number;
+    };
+    readonly suggestion?: string;
+    readonly metadata?: Record<string, unknown>;
+}
+/**
+ * Build a graph {@link Signal}, stamping `source: 'graph'` + `ruleId: slug` and
+ * applying the per-slug severity override — the rule supplies only its slug, the
+ * active config, and the per-signal body.
+ */
+export declare function createGraphSignal(slug: string, config: GraphConfig, body: GraphSignalBody): Signal;
+//# sourceMappingURL=create-graph-signal.d.ts.map

package/dist/rules/create-graph-signal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-graph-signal.d.ts","sourceRoot":"","sources":["../../src/rules/create-graph-signal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAEL,KAAK,MAAM,EACX,KAAK,cAAc,EACnB,KAAK,cAAc,EACpB,MAAM,mBAAmB,CAAC;AAI3B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C,0FAA0F;AAC1F,MAAM,WAAW,eAAe;IAC9B,iFAAiF;IACjF,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAElC,QAAQ,CAAC,QAAQ,EAAE,cAAc,GAAG,MAAM,CAAC;IAC3C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAClE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC7C;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,eAAe,GACpB,MAAM,CAWR"}

package/dist/rules/create-graph-signal.js

@@ -0,0 +1,35 @@
+/**
+ * createGraphSignal — the graph rule signal factory (north-star §5.9, release
+ * launch).
+ *
+ * Graph rules used to hand-assemble fingerprint-relevant identity in every body:
+ * `createSignal({ source: 'graph', ruleId: 'graph:<slug>', severity:
+ * applySeverityOverride(base, 'graph:<slug>', config), … })`. This factory STAMPS
+ * that identity from the rule's slug + config — `source` is always `'graph'`,
+ * `ruleId` IS the slug, and the override clamp is applied internally — so a rule
+ * names its slug once and never retypes `source`/`ruleId` or re-calls the override.
+ * Output is byte-identical to the former hand-assembly.
+ *
+ * The `body.severity` is the rule's per-signal CHOICE (its data, not identity);
+ * the override (`GraphConfig.severityOverrides[slug]`) is applied on top here.
+ */
+import { createSignal, } from '@opensip-cli/core';
+import { applySeverityOverride } from './_severity-override.js';
+/**
+ * Build a graph {@link Signal}, stamping `source: 'graph'` + `ruleId: slug` and
+ * applying the per-slug severity override — the rule supplies only its slug, the
+ * active config, and the per-signal body.
+ */
+export function createGraphSignal(slug, config, body) {
+    return createSignal({
+        source: 'graph',
+        ruleId: slug,
+        severity: applySeverityOverride(body.severity, slug, config),
+        category: body.category,
+        message: body.message,
+        code: body.code,
+        suggestion: body.suggestion,
+        metadata: body.metadata,
+    });
+}
+//# sourceMappingURL=create-graph-signal.js.map

package/dist/rules/create-graph-signal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-graph-signal.js","sourceRoot":"","sources":["../../src/rules/create-graph-signal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EACL,YAAY,GAIb,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAgBhE;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAY,EACZ,MAAmB,EACnB,IAAqB;IAErB,OAAO,YAAY,CAAC;QAClB,MAAM,EAAE,OAAO;QACf,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,qBAAqB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC;QAC5D,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC,CAAC;AACL,CAAC"}

package/dist/rules/cycle.d.ts

@@ -0,0 +1,29 @@
+/**
+ * graph:cycle — flag call-graph cycles (strongly-connected components of size
+ * ≥ 2) at function/SCC granularity. Reads the `scc` feature column (Phase C's
+ * Tarjan; NO in-rule cycle detection). Bounded + actionable per ADR-0001: the
+ * count reaches zero when every cycle is broken; the fix is "invert one
+ * dependency or extract the shared piece."
+ *
+ * Severity ladder (defaults from the dashboard's former SCCs view,
+ * `view-sccs.ts`: "size 2 usually fine; size 3+ spanning packages is a layering
+ * smell"):
+ *   - `sccSize === 1`         → no signal (not a cycle).
+ *   - `crossesPackages`       → base `high` (regardless of size — cross-package
+ *                               cycles are the most expensive to unwind; they
+ *                               win the ladder).
+ *   - `sccSize === 2`         → `config.cycleSize2Severity` (default `'off'` →
+ *                               no signal; `'low'` → base `low`).
+ *   - `sccSize >= cycleMinSize` (default 3) → base `medium`.
+ *
+ * One signal PER SCC (not per member) — anchored on the lowest-`qualifiedName`
+ * member occurrence so a single tangle never produces N findings. This is the
+ * function/SCC-granularity de-dup counterpart to `unexpected-coupling`'s
+ * package granularity (distinct `ruleId` + `code` → distinct fingerprints,
+ * cross-linked via metadata).
+ *
+ * Emitted severity routes through the opt-in `applySeverityOverride` clamp
+ * (ADR-0005).
+ */
+export declare const cycleRule: import("../types.js").Rule;
+//# sourceMappingURL=cycle.d.ts.map

package/dist/rules/cycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cycle.d.ts","sourceRoot":"","sources":["../../src/rules/cycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAYH,eAAO,MAAM,SAAS,4BAsDpB,CAAC"}