@opensip-cli/graph 0.1.0

package/dist/rules/duplicated-function-body.js

@@ -0,0 +1,232 @@
+/**
+ * graph:duplicated-function-body — group catalog entries whose body
+ * normalizes to the same hash and report duplicate bodies. The rule has
+ * two complementary code paths under one slug:
+ *
+ *   1. **Per-instance (size-gated).** A "duplicate" is two or more
+ *      functions whose normalized body is byte-identical
+ *      (whitespace/comment normalization handled by hashFunctionBody).
+ *      Two thresholds filter out non-actionable hits:
+ *
+ *        - minDuplicateBodyLines (default 5): the source span must be at
+ *          least this many lines.
+ *        - minDuplicateBodySize  (default 200): the *normalized* body
+ *          (post comment-strip + whitespace-collapse) must be at least
+ *          this many characters. This catches the common case of a
+ *          `defineCheck({ ... analyze(content) { return analyzeFile(...) } })`
+ *          wrapper where the source spans 8+ lines but the executable
+ *          body is only ~80 characters once normalized — structurally
+ *          identical to every other thin wrapper, but never an actionable
+ *          refactor target.
+ *
+ *      Emits N-1 signals per group (one per non-primary occurrence).
+ *
+ *   2. **Aggregate (cross-package).** For each body hash present in
+ *      ≥ minCrossPackageDuplicatePackages (default 3) DISTINCT packages
+ *      (via `pkgOf`), the rule emits ONE aggregate signal naming the
+ *      packages and SUPPRESSES the per-instance signals for that same hash
+ *      (no double-reporting). Bodies that don't reach N packages flow
+ *      through path (1) unchanged.
+ *
+ *      This path applies a LIGHTER, body-size-only floor
+ *      (`minCrossPackageDuplicateBodySize`, default 80 chars — no line floor)
+ *      rather than the per-instance floor: a *small* body copied across
+ *      packages is exactly what this path exists to catch, so the floor is
+ *      tuned only to drop TRIVIAL bodies (empty DI-constructor shims,
+ *      one-line getters, thin delegators) that are never consolidation
+ *      targets, while keeping genuinely-small shared utilities visible.
+ */
+import { pkgOf } from '../resolve-callee.js';
+import { createGraphSignal } from './create-graph-signal.js';
+import { defineRule } from './define-rule.js';
+const DEFAULT_MIN_LINES = 5;
+const DEFAULT_MIN_BODY_SIZE = 200;
+const DEFAULT_MIN_CROSS_PACKAGE_PACKAGES = 3;
+// Lighter than DEFAULT_MIN_BODY_SIZE (the per-instance floor) and applied with
+// NO line floor: the aggregate path is meant to catch genuinely-small shared
+// utilities copied across packages, so its floor only drops trivial bodies
+// (empty DI shims, one-line getters/delegators).
+const DEFAULT_MIN_CROSS_PACKAGE_BODY_SIZE = 80;
+const SLUG = 'graph:duplicated-function-body';
+export const duplicatedFunctionBodyRule = defineRule({
+    slug: SLUG,
+    defaultSeverity: 'warning',
+    featureDeps: ['bodyLines'],
+    evaluate({ catalog, config, features }) {
+        const minLines = config.minDuplicateBodyLines ?? DEFAULT_MIN_LINES;
+        const minBodySize = config.minDuplicateBodySize ?? DEFAULT_MIN_BODY_SIZE;
+        const minPackages = config.minCrossPackageDuplicatePackages ?? DEFAULT_MIN_CROSS_PACKAGE_PACKAGES;
+        const minCrossPackageBodySize = config.minCrossPackageDuplicateBodySize ?? DEFAULT_MIN_CROSS_PACKAGE_BODY_SIZE;
+        const signals = [];
+        // Aggregate path first: group every kind/test-eligible occurrence by
+        // body hash (no line floor) so we can detect cross-package spread and
+        // decide which hashes to suppress on the per-instance path below.
+        const aggregateBuckets = groupByHashUnfloored(catalog);
+        const suppressedHashes = new Set();
+        for (const [bodyHash, occs] of aggregateBuckets) {
+            const packages = [...new Set(occs.map((o) => pkgOf(o)))].sort();
+            if (packages.length < minPackages)
+                continue;
+            const anchor = lowestByQualifiedName(occs);
+            // Lighter, body-size-only floor (NO line floor): keeps the aggregate
+            // path catching genuinely-small shared utilities copied across packages,
+            // while dropping trivial bodies — empty DI-constructor shims, one-line
+            // getters, thin delegators — that are not consolidation targets. A body
+            // that fails this won't surface on the per-instance path either (its
+            // 200-char floor is stricter), so there is nothing to suppress.
+            if (anchor.bodySize !== undefined && anchor.bodySize < minCrossPackageBodySize)
+                continue;
+            // This hash is owned by the aggregate path; suppress its per-instance
+            // signals so a single duplicate group never double-reports.
+            suppressedHashes.add(bodyHash);
+            signals.push(createGraphSignal(SLUG, config, {
+                severity: 'low',
+                category: 'quality',
+                message: `This body is duplicated across ${String(packages.length)} packages (${packages.join(', ')}) in ${String(occs.length)} occurrences — hoist it into a shared package.`,
+                code: { file: anchor.filePath, line: anchor.line, column: anchor.column },
+                suggestion: 'Hoist the shared body into a single shared package and have every copy import it.',
+                metadata: {
+                    packages,
+                    packageCount: packages.length,
+                    occurrenceCount: occs.length,
+                    bodyHash,
+                },
+            }));
+        }
+        // Per-instance path: size-gated groups, skipping any hash already
+        // claimed by an aggregate signal so a group never double-reports.
+        const groups = groupByHash(catalog, minLines, minBodySize, features);
+        signals.push(...emitPerInstanceSignals(groups, suppressedHashes, config));
+        return signals;
+    },
+});
+/**
+ * Per-instance duplicate signals: N-1 per size-gated group, skipping any hash
+ * already claimed by an aggregate signal (no double-reporting). Extracted from
+ * evaluate() to keep its cognitive complexity within budget.
+ */
+function emitPerInstanceSignals(groups, suppressedHashes, config) {
+    const signals = [];
+    for (const group of groups) {
+        if (group.length < 2)
+            continue;
+        const primary = group[0];
+        /* v8 ignore next */
+        if (!primary)
+            continue;
+        if (suppressedHashes.has(primary.bodyHash))
+            continue;
+        for (let i = 1; i < group.length; i++) {
+            const occ = group[i];
+            /* v8 ignore next */
+            if (!occ)
+                continue;
+            signals.push(createGraphSignal(SLUG, config, {
+                severity: 'low',
+                category: 'quality',
+                message: `${occ.simpleName} has the same body as ${primary.qualifiedName} (${primary.filePath}:${String(primary.line)}).`,
+                code: { file: occ.filePath, line: occ.line, column: occ.column },
+                suggestion: 'Extract the shared body to a single function and have both call sites import it.',
+                metadata: {
+                    primary: primary.qualifiedName,
+                    duplicate: occ.qualifiedName,
+                    groupSize: group.length,
+                },
+            }));
+        }
+    }
+    return signals;
+}
+function groupByHash(catalog, minLines, minBodySize, features) {
+    // Walk the catalog directly; the byBodyHash index dedupes by hash,
+    // which is exactly what we need to NOT do here.
+    const buckets = new Map();
+    for (const name of Object.keys(catalog.functions)) {
+        const occs = catalog.functions[name];
+        /* v8 ignore next */
+        if (!occs)
+            continue;
+        for (const occ of occs) {
+            if (!isInterestingForDup(occ, minLines, minBodySize, features))
+                continue;
+            let bucket = buckets.get(occ.bodyHash);
+            if (!bucket) {
+                bucket = [];
+                buckets.set(occ.bodyHash, bucket);
+            }
+            bucket.push(occ);
+        }
+    }
+    return [...buckets.values()];
+}
+/**
+ * Group occurrences by body hash applying ONLY the kind/test-file
+ * exclusions (no size/line floor) — the grouping the aggregate
+ * cross-package path consumes. Returns a Map so callers keep the body
+ * hash key for suppression bookkeeping.
+ */
+function groupByHashUnfloored(catalog) {
+    const buckets = new Map();
+    for (const name of Object.keys(catalog.functions)) {
+        const occs = catalog.functions[name];
+        /* v8 ignore next */
+        if (!occs)
+            continue;
+        for (const occ of occs) {
+            if (!isEligibleKind(occ))
+                continue;
+            let bucket = buckets.get(occ.bodyHash);
+            if (!bucket) {
+                bucket = [];
+                buckets.set(occ.bodyHash, bucket);
+            }
+            bucket.push(occ);
+        }
+    }
+    return buckets;
+}
+function lowestByQualifiedName(occs) {
+    return occs.reduce((lo, c) => (c.qualifiedName < lo.qualifiedName ? c : lo));
+}
+/**
+ * The kind/test-file exclusions shared by both code paths. Inline arrows
+ * / function expressions / module-init occurrences are never an
+ * extract/hoist target:
+ *  - test-suite arrows with identical 5-line bodies are common boilerplate
+ *  - module-inits hash whatever is at top level; identical hashes mean
+ *    twin files, not a dup-extraction opportunity
+ *  - constructor/getter/setter/method dups are interesting; keep those
+ *
+ * Test-file occurrences are excluded on both paths.
+ */
+function isEligibleKind(occ) {
+    if (occ.kind === 'arrow' || occ.kind === 'function-expression' || occ.kind === 'module-init') {
+        return false;
+    }
+    if (occ.inTestFile)
+        return false;
+    return true;
+}
+/**
+ * The per-instance dup-body filter: the shared kind/test exclusions plus
+ * the size/line floor. The bodySize threshold drops trivial wrappers — a
+ * `defineCheck` or pass-through analyze that contains an `if`-guard plus a
+ * delegating call. These have identical normalized bodies across many
+ * files but are never the right refactor target. Catalogs from older runs
+ * that lack `bodySize` skip the size check (treated as "passes").
+ */
+function isInterestingForDup(occ, minLines, minBodySize, features) {
+    if (!isEligibleKind(occ))
+        return false;
+    // The bodyLines feature column is the canonical span (computed once in
+    // pipeline/features.ts). The inline `endLine − line + 1` here is the single
+    // sanctioned graceful-degrade fallback for features-absent calls (3/4-arg
+    // test evaluate), not a duplicate of the engine derivation.
+    const span = features?.function.get(occ.bodyHash)?.bodyLines ?? occ.endLine - occ.line + 1;
+    if (span < minLines)
+        return false;
+    if (occ.bodySize !== undefined && occ.bodySize < minBodySize)
+        return false;
+    return true;
+}
+//# sourceMappingURL=duplicated-function-body.js.map

package/dist/rules/duplicated-function-body.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"duplicated-function-body.js","sourceRoot":"","sources":["../../src/rules/duplicated-function-body.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAE7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAK9C,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAC5B,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAClC,MAAM,kCAAkC,GAAG,CAAC,CAAC;AAC7C,+EAA+E;AAC/E,6EAA6E;AAC7E,2EAA2E;AAC3E,iDAAiD;AACjD,MAAM,mCAAmC,GAAG,EAAE,CAAC;AAC/C,MAAM,IAAI,GAAG,gCAAgC,CAAC;AAE9C,MAAM,CAAC,MAAM,0BAA0B,GAAG,UAAU,CAAC;IACnD,IAAI,EAAE,IAAI;IACV,eAAe,EAAE,SAAS;IAC1B,WAAW,EAAE,CAAC,WAAW,CAAC;IAC1B,QAAQ,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE;QACpC,MAAM,QAAQ,GAAG,MAAM,CAAC,qBAAqB,IAAI,iBAAiB,CAAC;QACnE,MAAM,WAAW,GAAG,MAAM,CAAC,oBAAoB,IAAI,qBAAqB,CAAC;QACzE,MAAM,WAAW,GACf,MAAM,CAAC,gCAAgC,IAAI,kCAAkC,CAAC;QAChF,MAAM,uBAAuB,GAC3B,MAAM,CAAC,gCAAgC,IAAI,mCAAmC,CAAC;QAEjF,MAAM,OAAO,GAAa,EAAE,CAAC;QAE7B,qEAAqE;QACrE,sEAAsE;QACtE,kEAAkE;QAClE,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QACvD,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;QAE3C,KAAK,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,gBAAgB,EAAE,CAAC;YAChD,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAChE,IAAI,QAAQ,CAAC,MAAM,GAAG,WAAW;gBAAE,SAAS;YAC5C,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;YAC3C,qEAAqE;YACrE,yEAAyE;YACzE,uEAAuE;YACvE,wEAAwE;YACxE,qEAAqE;YACrE,gEAAgE;YAChE,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,GAAG,uBAAuB;gBAAE,SAAS;YACzF,sEAAsE;YACtE,4DAA4D;YAC5D,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC/B,OAAO,CAAC,IAAI,CACV,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE;gBAC9B,QAAQ,EAAE,KAAK;gBACf,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE,kCAAkC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,gDAAgD;gBAC9K,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;gBACzE,UAAU,EACR,mFAAmF;gBACrF,QAAQ,EAAE;oBACR,QAAQ;oBACR,YAAY,EAAE,QAAQ,CAAC,MAAM;oBAC7B,eAAe,EAAE,IAAI,CAAC,MAAM;oBAC5B,QAAQ;iBACT;aACF,CAAC,CACH,CAAC;QACJ,CAAC;QAED,kEAAkE;QAClE,kEAAkE;QAClE,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QACrE,OAAO,CAAC,IAAI,CAAC,GAAG,sBAAsB,CAAC,MAAM,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAAC;QAC1E,OAAO,OAAO,CAAC;IACjB,CAAC;CACF,CAAC,CAAC;AAEH;;;;GAIG;AACH,SAAS,sBAAsB,CAC7B,MAAkD,EAClD,gBAAqC,EACrC,MAAmB;IAEnB,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QAC/B,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACzB,oBAAoB;QACpB,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,IAAI,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC;YAAE,SAAS;QACrD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACrB,oBAAoB;YACpB,IAAI,CAAC,GAAG;gBAAE,SAAS;YACnB,OAAO,CAAC,IAAI,CACV,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE;gBAC9B,QAAQ,EAAE,KAAK;gBACf,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE,GAAG,GAAG,CAAC,UAAU,yBAAyB,OAAO,CAAC,aAAa,KAAK,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI;gBACzH,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE;gBAChE,UAAU,EACR,kFAAkF;gBACpF,QAAQ,EAAE;oBACR,OAAO,EAAE,OAAO,CAAC,aAAa;oBAC9B,SAAS,EAAE,GAAG,CAAC,aAAa;oBAC5B,SAAS,EAAE,KAAK,CAAC,MAAM;iBACxB;aACF,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,WAAW,CAClB,OAAgB,EAChB,QAAgB,EAChB,WAAmB,EACnB,QAAkC;IAElC,mEAAmE;IACnE,gDAAgD;IAChD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAgC,CAAC;IACxD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,GAA8C,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAChF,oBAAoB;QACpB,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC;gBAAE,SAAS;YACzE,IAAI,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACvC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,GAAG,EAAE,CAAC;gBACZ,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACpC,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,OAAgB;IAC5C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAgC,CAAC;IACxD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,GAA8C,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAChF,oBAAoB;QACpB,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC;gBAAE,SAAS;YACnC,IAAI,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACvC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,GAAG,EAAE,CAAC;gBACZ,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACpC,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAmC;IAChE,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,GAAG,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,cAAc,CAAC,GAAuB;IAC7C,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,IAAI,GAAG,CAAC,IAAI,KAAK,qBAAqB,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QAC7F,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,GAAG,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IACjC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAC1B,GAAuB,EACvB,QAAgB,EAChB,WAAmB,EACnB,QAAkC;IAElC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,uEAAuE;IACvE,4EAA4E;IAC5E,0EAA0E;IAC1E,4DAA4D;IAC5D,MAAM,IAAI,GAAG,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,SAAS,IAAI,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC;IAC3F,IAAI,IAAI,GAAG,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClC,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,GAAG,CAAC,QAAQ,GAAG,WAAW;QAAE,OAAO,KAAK,CAAC;IAC3E,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/rules/high-blast-untested.d.ts

@@ -0,0 +1,26 @@
+/**
+ * graph:high-blast-untested (flagship) — flag high-reach functions that are
+ * NOT exercised by any test. The combination gate ADR-0001 sanctions: a raw
+ * metric (`blast`) gates only as an **ABSOLUTE-threshold input** to a bounded,
+ * actionable predicate, never as a ranking/percentile.
+ *
+ * Predicate (per occurrence): `blast.score >= absoluteThreshold && !testReachable`.
+ *   - test-reachable → skip (a high-blast TESTED function emits nothing).
+ *   - `blast.score < warn` → skip (a LOW-blast untested function emits nothing — noise).
+ *   - `blast.score >= error` → base `high`; else (`[warn, error)`) → base `medium`.
+ *
+ * The count reaches zero once every high-blast function is test-covered →
+ * bounded → gateable. The fix is one verb: add a test. Thresholds are in-rule
+ * opinionated ABSOLUTE constants, overridable via `config.highBlastWarnThreshold`
+ * / `highBlastErrorThreshold` (Phase A). Emitted severity routes through the
+ * opt-in `applySeverityOverride` clamp (ADR-0005).
+ *
+ * Feature columns: `blast` (composite reach score `direct + 0.5 × transitive`)
+ * and `testReachable` (the boolean companion to `reachableOnlyFromTests`).
+ * Both are needed-only `featureDeps`. When the columns are absent (e.g. a
+ * 3/4-arg test call with no features), the rule degrades to emitting nothing
+ * (spec Applicable Conventions: absent column → emit nothing) — blast/test
+ * reachability are NOT cheaply recomputable in-rule, so there is no fallback.
+ */
+export declare const highBlastUntestedRule: import("../types.js").Rule;
+//# sourceMappingURL=high-blast-untested.d.ts.map

package/dist/rules/high-blast-untested.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"high-blast-untested.d.ts","sourceRoot":"","sources":["../../src/rules/high-blast-untested.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAUH,eAAO,MAAM,qBAAqB,4BAiDhC,CAAC"}

package/dist/rules/high-blast-untested.js

@@ -0,0 +1,82 @@
+/**
+ * graph:high-blast-untested (flagship) — flag high-reach functions that are
+ * NOT exercised by any test. The combination gate ADR-0001 sanctions: a raw
+ * metric (`blast`) gates only as an **ABSOLUTE-threshold input** to a bounded,
+ * actionable predicate, never as a ranking/percentile.
+ *
+ * Predicate (per occurrence): `blast.score >= absoluteThreshold && !testReachable`.
+ *   - test-reachable → skip (a high-blast TESTED function emits nothing).
+ *   - `blast.score < warn` → skip (a LOW-blast untested function emits nothing — noise).
+ *   - `blast.score >= error` → base `high`; else (`[warn, error)`) → base `medium`.
+ *
+ * The count reaches zero once every high-blast function is test-covered →
+ * bounded → gateable. The fix is one verb: add a test. Thresholds are in-rule
+ * opinionated ABSOLUTE constants, overridable via `config.highBlastWarnThreshold`
+ * / `highBlastErrorThreshold` (Phase A). Emitted severity routes through the
+ * opt-in `applySeverityOverride` clamp (ADR-0005).
+ *
+ * Feature columns: `blast` (composite reach score `direct + 0.5 × transitive`)
+ * and `testReachable` (the boolean companion to `reachableOnlyFromTests`).
+ * Both are needed-only `featureDeps`. When the columns are absent (e.g. a
+ * 3/4-arg test call with no features), the rule degrades to emitting nothing
+ * (spec Applicable Conventions: absent column → emit nothing) — blast/test
+ * reachability are NOT cheaply recomputable in-rule, so there is no fallback.
+ */
+import { createGraphSignal } from './create-graph-signal.js';
+import { defineRule } from './define-rule.js';
+const DEFAULT_WARN_BLAST = 75;
+const DEFAULT_ERROR_BLAST = 150;
+export const highBlastUntestedRule = defineRule({
+    slug: 'graph:high-blast-untested',
+    defaultSeverity: 'warning',
+    featureDeps: ['blast', 'reachableOnlyFromTests'],
+    evaluate({ indexes, config, features }) {
+        // Absent feature table → emit nothing (no in-rule recompute of blast/test
+        // reachability; the canonical home is pipeline/features.ts).
+        if (!features)
+            return [];
+        const warn = config.highBlastWarnThreshold ?? DEFAULT_WARN_BLAST;
+        const error = config.highBlastErrorThreshold ?? DEFAULT_ERROR_BLAST;
+        const signals = [];
+        for (const occ of indexes.byBodyHash.values()) {
+            /* v8 ignore next */
+            if (!occ.filePath)
+                continue;
+            // A function DEFINED in a test file is itself test code — asking whether
+            // it "is reached by a test" is meaningless, so it must never be flagged
+            // as a high-blast untested production function. Skip test-file occurrences.
+            if (occ.inTestFile)
+                continue;
+            const row = features.function.get(occ.bodyHash);
+            const blast = row?.blast;
+            // Blast column absent for this row → can't gate → skip.
+            if (!blast)
+                continue;
+            // A high-blast TESTED function is not a defect — skip. `testReachable`
+            // absent ⇒ treat as not-reachable (the column was requested, so absence
+            // means the row genuinely has no production/test coverage signal).
+            if (row.testReachable === true)
+                continue;
+            const score = blast.score;
+            if (score < warn)
+                continue;
+            const base = score >= error ? 'high' : 'medium';
+            signals.push(createGraphSignal('graph:high-blast-untested', config, {
+                severity: base,
+                category: 'testing',
+                message: `${occ.simpleName} has a high blast radius (score ${String(score)}) but is not reached by any test.`,
+                code: { file: occ.filePath, line: occ.line, column: occ.column },
+                suggestion: 'Add a test that exercises this high-reach function.',
+                metadata: {
+                    blast: score,
+                    blastDirect: blast.direct,
+                    blastTransitive: blast.transitive,
+                    testReachable: false,
+                    qualifiedName: occ.qualifiedName,
+                },
+            }));
+        }
+        return signals;
+    },
+});
+//# sourceMappingURL=high-blast-untested.js.map

package/dist/rules/high-blast-untested.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"high-blast-untested.js","sourceRoot":"","sources":["../../src/rules/high-blast-untested.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAI9C,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAC9B,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEhC,MAAM,CAAC,MAAM,qBAAqB,GAAG,UAAU,CAAC;IAC9C,IAAI,EAAE,2BAA2B;IACjC,eAAe,EAAE,SAAS;IAC1B,WAAW,EAAE,CAAC,OAAO,EAAE,wBAAwB,CAAC;IAChD,QAAQ,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE;QACpC,0EAA0E;QAC1E,6DAA6D;QAC7D,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,CAAC,sBAAsB,IAAI,kBAAkB,CAAC;QACjE,MAAM,KAAK,GAAG,MAAM,CAAC,uBAAuB,IAAI,mBAAmB,CAAC;QAEpE,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;YAC9C,oBAAoB;YACpB,IAAI,CAAC,GAAG,CAAC,QAAQ;gBAAE,SAAS;YAC5B,yEAAyE;YACzE,wEAAwE;YACxE,4EAA4E;YAC5E,IAAI,GAAG,CAAC,UAAU;gBAAE,SAAS;YAC7B,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAChD,MAAM,KAAK,GAAG,GAAG,EAAE,KAAK,CAAC;YACzB,wDAAwD;YACxD,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,uEAAuE;YACvE,wEAAwE;YACxE,mEAAmE;YACnE,IAAI,GAAG,CAAC,aAAa,KAAK,IAAI;gBAAE,SAAS;YACzC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;YAC1B,IAAI,KAAK,GAAG,IAAI;gBAAE,SAAS;YAC3B,MAAM,IAAI,GAAG,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;YAChD,OAAO,CAAC,IAAI,CACV,iBAAiB,CAAC,2BAA2B,EAAE,MAAM,EAAE;gBACrD,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE,GAAG,GAAG,CAAC,UAAU,mCAAmC,MAAM,CAAC,KAAK,CAAC,mCAAmC;gBAC7G,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE;gBAChE,UAAU,EAAE,qDAAqD;gBACjE,QAAQ,EAAE;oBACR,KAAK,EAAE,KAAK;oBACZ,WAAW,EAAE,KAAK,CAAC,MAAM;oBACzB,eAAe,EAAE,KAAK,CAAC,UAAU;oBACjC,aAAa,EAAE,KAAK;oBACpB,aAAa,EAAE,GAAG,CAAC,aAAa;iBACjC;aACF,CAAC,CACH,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF,CAAC,CAAC"}

package/dist/rules/large-function.d.ts

@@ -0,0 +1,22 @@
+/**
+ * graph:large-function — flag functions whose body is large enough to be
+ * worth splitting. A two-band predicate over the `bodyLines` feature column
+ * (Phase C: `endLine − line + 1`).
+ *
+ * Bands (`bodyLines` is the PHYSICAL span `endLine − line + 1`, so it counts
+ * comments + blank lines). The gate defaults are calibrated higher than the
+ * dashboard's "~80 worth questioning / ~150 too much" heuristic so the gate
+ * flags genuinely oversized functions rather than every long-but-fine one
+ * (on a real codebase ~80/~150 floods the baseline). Override per-project via
+ * config:
+ *   - `bodyLines <= warn`  → no signal.
+ *   - `(warn, error]`      → base `medium`.
+ *   - `> error`            → base `high`.
+ *
+ * Thresholds are in-rule opinionated constants, overridable via
+ * `config.largeFunctionWarnLines` / `largeFunctionErrorLines` (Phase A). The
+ * emitted severity routes through the opt-in `applySeverityOverride` clamp
+ * (ADR-0005). Language-agnostic: every adapter emits `endLine`.
+ */
+export declare const largeFunctionRule: import("../types.js").Rule;
+//# sourceMappingURL=large-function.d.ts.map

package/dist/rules/large-function.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"large-function.d.ts","sourceRoot":"","sources":["../../src/rules/large-function.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAWH,eAAO,MAAM,iBAAiB,4BAsC5B,CAAC"}

package/dist/rules/large-function.js

@@ -0,0 +1,72 @@
+/**
+ * graph:large-function — flag functions whose body is large enough to be
+ * worth splitting. A two-band predicate over the `bodyLines` feature column
+ * (Phase C: `endLine − line + 1`).
+ *
+ * Bands (`bodyLines` is the PHYSICAL span `endLine − line + 1`, so it counts
+ * comments + blank lines). The gate defaults are calibrated higher than the
+ * dashboard's "~80 worth questioning / ~150 too much" heuristic so the gate
+ * flags genuinely oversized functions rather than every long-but-fine one
+ * (on a real codebase ~80/~150 floods the baseline). Override per-project via
+ * config:
+ *   - `bodyLines <= warn`  → no signal.
+ *   - `(warn, error]`      → base `medium`.
+ *   - `> error`            → base `high`.
+ *
+ * Thresholds are in-rule opinionated constants, overridable via
+ * `config.largeFunctionWarnLines` / `largeFunctionErrorLines` (Phase A). The
+ * emitted severity routes through the opt-in `applySeverityOverride` clamp
+ * (ADR-0005). Language-agnostic: every adapter emits `endLine`.
+ */
+import { createGraphSignal } from './create-graph-signal.js';
+import { defineRule } from './define-rule.js';
+const DEFAULT_WARN_LINES = 300;
+const DEFAULT_ERROR_LINES = 500;
+export const largeFunctionRule = defineRule({
+    slug: 'graph:large-function',
+    defaultSeverity: 'warning',
+    featureDeps: ['bodyLines'],
+    evaluate({ indexes, config, features }) {
+        const warn = config.largeFunctionWarnLines ?? DEFAULT_WARN_LINES;
+        const error = config.largeFunctionErrorLines ?? DEFAULT_ERROR_LINES;
+        const signals = [];
+        for (const occ of indexes.byBodyHash.values()) {
+            // Skip occurrences with empty filePath (defensive, as orphan-subtree does).
+            /* v8 ignore next */
+            if (!occ.filePath)
+                continue;
+            // The synthetic `<module-init>` occurrence is the file's whole top-level
+            // body, not a function — flagging it turns this into a "file too long"
+            // check (a signal that already lives in the fitness file-length check),
+            // and test files are not production functions to split. Skip both so this
+            // rule flags actual long FUNCTIONS in production code.
+            if (occ.kind === 'module-init' || occ.inTestFile)
+                continue;
+            const bodyLines = resolveBodyLines(occ, features);
+            if (bodyLines <= warn)
+                continue;
+            const base = bodyLines > error ? 'high' : 'medium';
+            signals.push(createGraphSignal('graph:large-function', config, {
+                severity: base,
+                category: 'quality',
+                message: `${occ.simpleName} is ${String(bodyLines)} lines long.`,
+                code: { file: occ.filePath, line: occ.line, column: occ.column },
+                suggestion: 'Split this function into smaller units.',
+                metadata: {
+                    bodyLines,
+                    qualifiedName: occ.qualifiedName,
+                },
+            }));
+        }
+        return signals;
+    },
+});
+/**
+ * Body length from the `bodyLines` feature column when present; otherwise the
+ * inline `endLine − line + 1` span (the single sanctioned graceful-degrade
+ * fallback — same formula the engine's feature derivation uses).
+ */
+function resolveBodyLines(occ, features) {
+    return features?.function.get(occ.bodyHash)?.bodyLines ?? occ.endLine - occ.line + 1;
+}
+//# sourceMappingURL=large-function.js.map

package/dist/rules/large-function.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"large-function.js","sourceRoot":"","sources":["../../src/rules/large-function.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAK9C,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAC/B,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEhC,MAAM,CAAC,MAAM,iBAAiB,GAAG,UAAU,CAAC;IAC1C,IAAI,EAAE,sBAAsB;IAC5B,eAAe,EAAE,SAAS;IAC1B,WAAW,EAAE,CAAC,WAAW,CAAC;IAC1B,QAAQ,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE;QACpC,MAAM,IAAI,GAAG,MAAM,CAAC,sBAAsB,IAAI,kBAAkB,CAAC;QACjE,MAAM,KAAK,GAAG,MAAM,CAAC,uBAAuB,IAAI,mBAAmB,CAAC;QAEpE,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;YAC9C,4EAA4E;YAC5E,oBAAoB;YACpB,IAAI,CAAC,GAAG,CAAC,QAAQ;gBAAE,SAAS;YAC5B,yEAAyE;YACzE,uEAAuE;YACvE,wEAAwE;YACxE,0EAA0E;YAC1E,uDAAuD;YACvD,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa,IAAI,GAAG,CAAC,UAAU;gBAAE,SAAS;YAC3D,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YAClD,IAAI,SAAS,IAAI,IAAI;gBAAE,SAAS;YAChC,MAAM,IAAI,GAAG,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;YACnD,OAAO,CAAC,IAAI,CACV,iBAAiB,CAAC,sBAAsB,EAAE,MAAM,EAAE;gBAChD,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE,GAAG,GAAG,CAAC,UAAU,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc;gBAChE,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE;gBAChE,UAAU,EAAE,yCAAyC;gBACrD,QAAQ,EAAE;oBACR,SAAS;oBACT,aAAa,EAAE,GAAG,CAAC,aAAa;iBACjC;aACF,CAAC,CACH,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF,CAAC,CAAC;AAEH;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,GAAuB,EAAE,QAAkC;IACnF,OAAO,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,SAAS,IAAI,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC;AACvF,CAAC"}

package/dist/rules/no-side-effect-path.d.ts

@@ -0,0 +1,31 @@
+/**
+ * graph:no-side-effect-path — flag functions that are pure-by-design
+ * AND whose return value is discarded by at least one caller, i.e.
+ * functions whose computation has no observable effect on the program.
+ *
+ * Heuristic, in order:
+ *   1. The function's entire transitive callee set is side-effect free
+ *      (no I/O, logging, mutation, or unresolved edges).
+ *   2. At least one inbound caller invokes this function as an
+ *      ExpressionStatement (its return value is discarded).
+ *
+ * Step 2 is what makes the signal actionable. A pure function that
+ * returns data is a feature when its return value is consumed
+ * (`const x = pureHelper(...)`); it is dead code when the value is
+ * thrown away (`pureHelper(...);` as a standalone statement).
+ *
+ * Catalogs from older runs that lack the `discarded` field on call
+ * edges fall back to the legacy "any pure callee" check.
+ *
+ * Side-effect primitives are language-specific. The active adapter
+ * supplies `ruleHints.sideEffectPrimitives` (e.g. `print`, `os.system`
+ * for Python; `println!`, `panic!` for Rust). When the hint is
+ * absent — older adapters, third-party adapters that don't populate
+ * it, unit tests that don't pass hints — we fall back to a
+ * TypeScript-shaped textual regex so the rule never silently goes
+ * dark on a TS project. The fidelity matrix in the graph
+ * rules-and-gating documentation enumerates which rules degrade
+ * gracefully when an adapter omits a given hint.
+ */
+export declare const noSideEffectPathRule: import("../types.js").Rule;
+//# sourceMappingURL=no-side-effect-path.d.ts.map

package/dist/rules/no-side-effect-path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-side-effect-path.d.ts","sourceRoot":"","sources":["../../src/rules/no-side-effect-path.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAyCH,eAAO,MAAM,oBAAoB,4BA8B/B,CAAC"}