@opensip-cli/graph 0.1.0

package/dist/rules/no-side-effect-path.js

@@ -0,0 +1,217 @@
+/**
+ * graph:no-side-effect-path — flag functions that are pure-by-design
+ * AND whose return value is discarded by at least one caller, i.e.
+ * functions whose computation has no observable effect on the program.
+ *
+ * Heuristic, in order:
+ *   1. The function's entire transitive callee set is side-effect free
+ *      (no I/O, logging, mutation, or unresolved edges).
+ *   2. At least one inbound caller invokes this function as an
+ *      ExpressionStatement (its return value is discarded).
+ *
+ * Step 2 is what makes the signal actionable. A pure function that
+ * returns data is a feature when its return value is consumed
+ * (`const x = pureHelper(...)`); it is dead code when the value is
+ * thrown away (`pureHelper(...);` as a standalone statement).
+ *
+ * Catalogs from older runs that lack the `discarded` field on call
+ * edges fall back to the legacy "any pure callee" check.
+ *
+ * Side-effect primitives are language-specific. The active adapter
+ * supplies `ruleHints.sideEffectPrimitives` (e.g. `print`, `os.system`
+ * for Python; `println!`, `panic!` for Rust). When the hint is
+ * absent — older adapters, third-party adapters that don't populate
+ * it, unit tests that don't pass hints — we fall back to a
+ * TypeScript-shaped textual regex so the rule never silently goes
+ * dark on a TS project. The fidelity matrix in the graph
+ * rules-and-gating documentation enumerates which rules degrade
+ * gracefully when an adapter omits a given hint.
+ */
+import { createGraphSignal } from './create-graph-signal.js';
+import { defineRule } from './define-rule.js';
+const TYPESCRIPT_FALLBACK_REGEX = /\b(?:console|logger|fs\.|http\.|fetch|process\.exit|throw\s+new)\b/;
+function buildSideEffectDetector(hints) {
+    const primitives = hints?.sideEffectPrimitives;
+    if (!primitives || primitives.length === 0) {
+        return (text) => TYPESCRIPT_FALLBACK_REGEX.test(text);
+    }
+    // Adapter-supplied primitives are textual prefixes a developer would
+    // write at the start of a call expression: "print", "os.system",
+    // "console.log", "println!". Match by substring presence — call text
+    // is already truncated to ≤80 chars by the inventory pipeline, so
+    // searching every primitive across every call text is O(P · 80) per
+    // call, cheap.
+    const primitiveSet = [...primitives];
+    return (text) => {
+        for (const p of primitiveSet) {
+            if (p.length === 0)
+                continue;
+            if (text.includes(p))
+                return true;
+        }
+        return false;
+    };
+}
+export const noSideEffectPathRule = defineRule({
+    slug: 'graph:no-side-effect-path',
+    defaultSeverity: 'warning',
+    featureDeps: ['bodyLines'],
+    evaluate({ indexes, hints, features, config }) {
+        const detector = buildSideEffectDetector(hints);
+        const sideEffecting = computeSideEffecting(indexes, detector);
+        const signals = [];
+        for (const occ of indexes.byBodyHash.values()) {
+            if (!isPureCandidate(occ, sideEffecting, features))
+                continue;
+            const reachable = transitiveCallees(occ, indexes);
+            const anyEffecting = [...reachable].some((h) => sideEffecting.has(h));
+            if (anyEffecting)
+                continue;
+            if (!hasDiscardedCaller(occ, indexes))
+                continue;
+            signals.push(createGraphSignal('graph:no-side-effect-path', config, {
+                severity: 'low',
+                category: 'quality',
+                message: `${occ.simpleName} is pure but at least one caller discards its return value, so the call has no observable effect.`,
+                code: { file: occ.filePath, line: occ.line, column: occ.column },
+                suggestion: 'Either consume the return value at the call site, or remove the call.',
+                metadata: {
+                    qualifiedName: occ.qualifiedName,
+                    transitiveCount: reachable.size,
+                },
+            }));
+        }
+        return signals;
+    },
+});
+function scanCallerEdges(occ, indexes) {
+    const callerHashes = indexes.callers.get(occ.bodyHash) ?? [];
+    let sawMatchingEdge = false;
+    let sawDiscardedField = false;
+    for (const callerHash of callerHashes) {
+        const caller = indexes.byBodyHash.get(callerHash);
+        /* v8 ignore next */
+        if (!caller)
+            continue;
+        for (const edge of caller.calls) {
+            if (!edge.to.includes(occ.bodyHash))
+                continue;
+            sawMatchingEdge = true;
+            if (edge.discarded === undefined)
+                continue;
+            sawDiscardedField = true;
+            if (edge.discarded)
+                return { foundDiscarded: true, sawMatchingEdge, sawDiscardedField };
+        }
+    }
+    return { foundDiscarded: false, sawMatchingEdge, sawDiscardedField };
+}
+function hasDiscardedCaller(occ, indexes) {
+    const scan = scanCallerEdges(occ, indexes);
+    if (scan.foundDiscarded)
+        return true;
+    // Legacy fallback (`!sawDiscardedField`) only applies when we
+    // actually observed an edge that targets this occurrence — otherwise
+    // the index pointed at this occ but no caller edge resolved to it
+    // (stale index / unresolved catalog), and the right answer is "no
+    // discarded caller" not "assume yes".
+    return scan.sawMatchingEdge && !scan.sawDiscardedField;
+}
+/**
+ * Declared return types that mean "this function yields no value." A
+ * void-like return type covers every language the graph tool ingests:
+ * `void`/`undefined`/`never` (TS), `Promise<void>` (async TS that
+ * resolves nothing), `()` (Rust unit), `None` (Python).
+ *
+ * Matched case-insensitively after trimming.
+ */
+const VOID_LIKE_RETURN_TYPES = new Set([
+    'void',
+    'undefined',
+    'never',
+    'promise<void>',
+    '()',
+    'none',
+]);
+/**
+ * True when the function's DECLARED return type proves it has no return
+ * value to discard.
+ *
+ * The rule's whole actionable premise is "a caller is throwing away a
+ * return value, so the call is dead computation." For a function declared
+ * `: void` (or any void-like type) there is no value to throw away — the
+ * function exists for its effect, not its result. The textual purity
+ * heuristic (`textualSideEffect`) cannot see effects like closure-binding
+ * reassignment, throw-delegation, or out-parameter mutation, so such
+ * effect-only functions look "pure" and get flagged falsely. Rejecting
+ * void-like return types makes the premise non-vacuous.
+ *
+ * IMPORTANT: a `null` return type means "unknown / not annotated", NOT
+ * "void". Rejecting `null` would introduce false negatives on genuinely
+ * pure, un-annotated functions whose result is dropped — so `null` passes
+ * through. Only the explicit void-like strings are rejected.
+ */
+function returnsNoValue(returnType) {
+    if (returnType === null)
+        return false;
+    return VOID_LIKE_RETURN_TYPES.has(returnType.trim().toLowerCase());
+}
+/** Filters out occurrences we never want to flag — short, test-only, has unresolved edges, etc. */
+function isPureCandidate(occ, sideEffecting, features) {
+    if (occ.kind === 'module-init')
+        return false;
+    if (occ.inTestFile)
+        return false;
+    if (occ.calls.length < 2)
+        return false;
+    // bodyLines feature column is the canonical span; the inline
+    // `endLine − line + 1` is the single sanctioned graceful-degrade fallback
+    // for features-absent calls, not a duplicate of the engine derivation.
+    const span = features?.function.get(occ.bodyHash)?.bodyLines ?? occ.endLine - occ.line + 1;
+    if (span < 10)
+        return false;
+    if (occ.calls.some((e) => e.to.length === 0))
+        return false;
+    if (sideEffecting.has(occ.bodyHash))
+        return false;
+    if (occ.visibility !== 'exported')
+        return false;
+    // Effect-only functions (void-like return type) have no return value to
+    // discard, so the "discarded return value" signal is vacuous for them.
+    if (returnsNoValue(occ.returnType))
+        return false;
+    return true;
+}
+function computeSideEffecting(indexes, detector) {
+    const set = new Set();
+    for (const occ of indexes.byBodyHash.values()) {
+        if (textualSideEffect(occ, detector))
+            set.add(occ.bodyHash);
+    }
+    return set;
+}
+function textualSideEffect(occ, detector) {
+    for (const edge of occ.calls) {
+        if (detector(edge.text))
+            return true;
+    }
+    return false;
+}
+function transitiveCallees(start, indexes) {
+    const visited = new Set();
+    const queue = [start.bodyHash];
+    while (queue.length > 0) {
+        const cur = queue.shift();
+        if (cur === undefined || visited.has(cur))
+            continue;
+        visited.add(cur);
+        const next = indexes.callees.get(cur) ?? [];
+        for (const n of next) {
+            if (!visited.has(n))
+                queue.push(n);
+        }
+    }
+    visited.delete(start.bodyHash);
+    return visited;
+}
+//# sourceMappingURL=no-side-effect-path.js.map

package/dist/rules/no-side-effect-path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-side-effect-path.js","sourceRoot":"","sources":["../../src/rules/no-side-effect-path.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAK9C,MAAM,yBAAyB,GAC7B,oEAAoE,CAAC;AAWvE,SAAS,uBAAuB,CAAC,KAA4B;IAC3D,MAAM,UAAU,GAAG,KAAK,EAAE,oBAAoB,CAAC;IAC/C,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3C,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxD,CAAC;IACD,qEAAqE;IACrE,iEAAiE;IACjE,qEAAqE;IACrE,kEAAkE;IAClE,oEAAoE;IACpE,eAAe;IACf,MAAM,YAAY,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC;IACrC,OAAO,CAAC,IAAI,EAAE,EAAE;QACd,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;YAC7B,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YAC7B,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;QACpC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAG,UAAU,CAAC;IAC7C,IAAI,EAAE,2BAA2B;IACjC,eAAe,EAAE,SAAS;IAC1B,WAAW,EAAE,CAAC,WAAW,CAAC;IAC1B,QAAQ,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE;QAC3C,MAAM,QAAQ,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;QAChD,MAAM,aAAa,GAAG,oBAAoB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC9D,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;YAC9C,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,aAAa,EAAE,QAAQ,CAAC;gBAAE,SAAS;YAC7D,MAAM,SAAS,GAAG,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAClD,MAAM,YAAY,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACtE,IAAI,YAAY;gBAAE,SAAS;YAC3B,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,OAAO,CAAC;gBAAE,SAAS;YAChD,OAAO,CAAC,IAAI,CACV,iBAAiB,CAAC,2BAA2B,EAAE,MAAM,EAAE;gBACrD,QAAQ,EAAE,KAAK;gBACf,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE,GAAG,GAAG,CAAC,UAAU,mGAAmG;gBAC7H,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE;gBAChE,UAAU,EAAE,uEAAuE;gBACnF,QAAQ,EAAE;oBACR,aAAa,EAAE,GAAG,CAAC,aAAa;oBAChC,eAAe,EAAE,SAAS,CAAC,IAAI;iBAChC;aACF,CAAC,CACH,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF,CAAC,CAAC;AAeH,SAAS,eAAe,CAAC,GAAuB,EAAE,OAAgB;IAChE,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC7D,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAC9B,KAAK,MAAM,UAAU,IAAI,YAAY,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAClD,oBAAoB;QACpB,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YAChC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAAE,SAAS;YAC9C,eAAe,GAAG,IAAI,CAAC;YACvB,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS;gBAAE,SAAS;YAC3C,iBAAiB,GAAG,IAAI,CAAC;YACzB,IAAI,IAAI,CAAC,SAAS;gBAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,eAAe,EAAE,iBAAiB,EAAE,CAAC;QAC1F,CAAC;IACH,CAAC;IACD,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,CAAC;AACvE,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAuB,EAAE,OAAgB;IACnE,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC3C,IAAI,IAAI,CAAC,cAAc;QAAE,OAAO,IAAI,CAAC;IACrC,8DAA8D;IAC9D,qEAAqE;IACrE,kEAAkE;IAClE,kEAAkE;IAClE,sCAAsC;IACtC,OAAO,IAAI,CAAC,eAAe,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC;AACzD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,sBAAsB,GAAwB,IAAI,GAAG,CAAC;IAC1D,MAAM;IACN,WAAW;IACX,OAAO;IACP,eAAe;IACf,IAAI;IACJ,MAAM;CACP,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,cAAc,CAAC,UAAyB;IAC/C,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACtC,OAAO,sBAAsB,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;AACrE,CAAC;AAED,mGAAmG;AACnG,SAAS,eAAe,CACtB,GAAuB,EACvB,aAAkC,EAClC,QAAkC;IAElC,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa;QAAE,OAAO,KAAK,CAAC;IAC7C,IAAI,GAAG,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IACjC,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,6DAA6D;IAC7D,0EAA0E;IAC1E,uEAAuE;IACvE,MAAM,IAAI,GAAG,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,SAAS,IAAI,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC;IAC3F,IAAI,IAAI,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC;IAC5B,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3D,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAClD,IAAI,GAAG,CAAC,UAAU,KAAK,UAAU;QAAE,OAAO,KAAK,CAAC;IAChD,wEAAwE;IACxE,uEAAuE;IACvE,IAAI,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IACjD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAgB,EAAE,QAA4B;IAC1E,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;QAC9C,IAAI,iBAAiB,CAAC,GAAG,EAAE,QAAQ,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAuB,EAAE,QAA4B;IAC9E,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACvC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAyB,EAAE,OAAgB;IACpE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,KAAK,GAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACzC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;QAC1B,IAAI,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QACpD,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjB,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5C,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC/B,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/rules/orphan-subtree.d.ts

@@ -0,0 +1,11 @@
+/**
+ * graph:orphan-subtree — find functions not reachable from any entry point.
+ *
+ * Reachability: BFS from inferEntryPoints + config.entryPointHashes
+ * across the forward callees adjacency. Any FunctionOccurrence not
+ * visited is an orphan. Test-only reachability is a separate rule
+ * (test-only-reachable); orphan-subtree treats test files as part of
+ * the graph (their module-init is its own entry by name-match).
+ */
+export declare const orphanSubtreeRule: import("../types.js").Rule;
+//# sourceMappingURL=orphan-subtree.d.ts.map

package/dist/rules/orphan-subtree.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"orphan-subtree.d.ts","sourceRoot":"","sources":["../../src/rules/orphan-subtree.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAUH,eAAO,MAAM,iBAAiB,4BAkD5B,CAAC"}

package/dist/rules/orphan-subtree.js

@@ -0,0 +1,104 @@
+/**
+ * graph:orphan-subtree — find functions not reachable from any entry point.
+ *
+ * Reachability: BFS from inferEntryPoints + config.entryPointHashes
+ * across the forward callees adjacency. Any FunctionOccurrence not
+ * visited is an orphan. Test-only reachability is a separate rule
+ * (test-only-reachable); orphan-subtree treats test files as part of
+ * the graph (their module-init is its own entry by name-match).
+ */
+import { approximateSuffix } from './_approximation.js';
+import { inferEntryPoints } from './_entry-points.js';
+import { createGraphSignal } from './create-graph-signal.js';
+import { defineRule } from './define-rule.js';
+export const orphanSubtreeRule = defineRule({
+    slug: 'graph:orphan-subtree',
+    defaultSeverity: 'warning',
+    featureDeps: ['reachableFromEntry'],
+    evaluate({ catalog, indexes, config, features }) {
+        // Reachability comes from the engine feature column when present; the local
+        // computeReachable is the graceful-degrade fallback (canonical home is now
+        // pipeline/features.ts). Built once, outside the loop.
+        const isReachable = buildReachablePredicate(catalog, indexes, config, features);
+        // On a fast catalog a missing caller-edge can fake an orphan; mark it.
+        const caveat = approximateSuffix(catalog);
+        const orphans = [];
+        for (const occ of indexes.byBodyHash.values()) {
+            if (isReachable(occ.bodyHash))
+                continue;
+            // module-init occurrences are entry points themselves; never orphan.
+            if (occ.kind === 'module-init')
+                continue;
+            // Skip occurrences with empty filePath (defensive — shouldn't happen).
+            /* v8 ignore next */
+            if (!occ.filePath)
+                continue;
+            // Precision filter (D3): a finding must be actionable ("delete it").
+            // Exported surface is not dead for lack of an internal caller — it
+            // may be consumed across a package boundary the graph can't resolve.
+            if (occ.visibility === 'exported' && !config.flagExportedOrphans)
+                continue;
+            // Test-file reachability is graph:test-only-reachable's job; flagging
+            // here would double-report and over-trigger on test-only helpers.
+            if (occ.inTestFile && !config.flagTestOrphans)
+                continue;
+            // Decorated functions are framework-dispatched (DI, routes, CLI
+            // commands), not called by name — a missing caller edge is expected.
+            if (occ.decorators.length > 0)
+                continue;
+            orphans.push(createGraphSignal('graph:orphan-subtree', config, {
+                severity: 'medium',
+                category: 'quality',
+                message: `${occ.simpleName} is not reachable from any inferred entry point.${caveat}`,
+                code: { file: occ.filePath, line: occ.line, column: occ.column },
+                suggestion: 'Either delete the function, mark it as an entry point in opensip-cli.config.yml, or add a caller.',
+                metadata: {
+                    simpleName: occ.simpleName,
+                    qualifiedName: occ.qualifiedName,
+                    kind: occ.kind,
+                    visibility: occ.visibility,
+                    inTestFile: occ.inTestFile,
+                    bodyHash: occ.bodyHash,
+                },
+            }));
+        }
+        return orphans;
+    },
+});
+/**
+ * Reachability predicate for a body hash. Prefers the engine
+ * `reachableFromEntry` feature column (Plan C) when present; otherwise builds
+ * the local reachable set once (the graceful-degrade fallback) and tests
+ * membership.
+ */
+function buildReachablePredicate(catalog, indexes, config, features) {
+    if (features) {
+        return (h) => features.function.get(h)?.reachableFromEntry === true;
+    }
+    const reachable = computeReachable(catalog, indexes, config);
+    return (h) => reachable.has(h);
+}
+function computeReachable(catalog, indexes, config) {
+    const entryPoints = inferEntryPoints(catalog, indexes);
+    const seeds = new Set();
+    for (const ep of entryPoints)
+        seeds.add(ep.bodyHash);
+    for (const h of config.entryPointHashes ?? [])
+        seeds.add(h);
+    const visited = new Set();
+    const queue = [...seeds];
+    while (queue.length > 0) {
+        const cur = queue.shift();
+        /* v8 ignore next */
+        if (cur === undefined || visited.has(cur))
+            continue;
+        visited.add(cur);
+        const next = indexes.callees.get(cur) ?? [];
+        for (const n of next) {
+            if (!visited.has(n))
+                queue.push(n);
+        }
+    }
+    return visited;
+}
+//# sourceMappingURL=orphan-subtree.js.map

package/dist/rules/orphan-subtree.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"orphan-subtree.js","sourceRoot":"","sources":["../../src/rules/orphan-subtree.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAK9C,MAAM,CAAC,MAAM,iBAAiB,GAAG,UAAU,CAAC;IAC1C,IAAI,EAAE,sBAAsB;IAC5B,eAAe,EAAE,SAAS;IAC1B,WAAW,EAAE,CAAC,oBAAoB,CAAC;IACnC,QAAQ,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE;QAC7C,4EAA4E;QAC5E,2EAA2E;QAC3E,uDAAuD;QACvD,MAAM,WAAW,GAAG,uBAAuB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAChF,uEAAuE;QACvE,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;YAC9C,IAAI,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAAE,SAAS;YACxC,qEAAqE;YACrE,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa;gBAAE,SAAS;YACzC,uEAAuE;YACvE,oBAAoB;YACpB,IAAI,CAAC,GAAG,CAAC,QAAQ;gBAAE,SAAS;YAC5B,qEAAqE;YACrE,mEAAmE;YACnE,qEAAqE;YACrE,IAAI,GAAG,CAAC,UAAU,KAAK,UAAU,IAAI,CAAC,MAAM,CAAC,mBAAmB;gBAAE,SAAS;YAC3E,sEAAsE;YACtE,kEAAkE;YAClE,IAAI,GAAG,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,eAAe;gBAAE,SAAS;YACxD,gEAAgE;YAChE,qEAAqE;YACrE,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;gBAAE,SAAS;YACxC,OAAO,CAAC,IAAI,CACV,iBAAiB,CAAC,sBAAsB,EAAE,MAAM,EAAE;gBAChD,QAAQ,EAAE,QAAQ;gBAClB,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE,GAAG,GAAG,CAAC,UAAU,mDAAmD,MAAM,EAAE;gBACrF,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE;gBAChE,UAAU,EACR,mGAAmG;gBACrG,QAAQ,EAAE;oBACR,UAAU,EAAE,GAAG,CAAC,UAAU;oBAC1B,aAAa,EAAE,GAAG,CAAC,aAAa;oBAChC,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,UAAU,EAAE,GAAG,CAAC,UAAU;oBAC1B,UAAU,EAAE,GAAG,CAAC,UAAU;oBAC1B,QAAQ,EAAE,GAAG,CAAC,QAAQ;iBACvB;aACF,CAAC,CACH,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF,CAAC,CAAC;AAEH;;;;;GAKG;AACH,SAAS,uBAAuB,CAC9B,OAAgB,EAChB,OAAgB,EAChB,MAAmB,EACnB,QAAkC;IAElC,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,CAAC,CAAS,EAAW,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,kBAAkB,KAAK,IAAI,CAAC;IACvF,CAAC;IACD,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC7D,OAAO,CAAC,CAAS,EAAW,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAgB,EAAE,OAAgB,EAAE,MAAmB;IAC/E,MAAM,WAAW,GAAG,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,EAAE,IAAI,WAAW;QAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;IACrD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,gBAAgB,IAAI,EAAE;QAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAE5D,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,KAAK,GAAa,CAAC,GAAG,KAAK,CAAC,CAAC;IACnC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;QAC1B,oBAAoB;QACpB,IAAI,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QACpD,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjB,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5C,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/rules/registry.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Rule registry — per-RunScope.
+ *
+ * Each `RunScope` owns its own rule registry (Item 1 / D7). The graph
+ * tool's `contributeScope` hook constructs a fresh registry per CLI
+ * invocation and attaches it to `scope.graph.rules`. The registry is
+ * seeded with the built-in rules at construction.
+ *
+ * Built on the kernel's unified `Registry<T>` with
+ * `duplicatePolicy: 'warn-first-wins'` — re-registering the same rule
+ * slug keeps the incumbent and emits a structured warning.
+ *
+ * v0.2 shipped with the first built-in rules; runtime rule loading is
+ * deferred to v0.3 per DEC-6. The legacy `rules` array export was a
+ * process-level snapshot read by `orchestrate`/`graph` CLI commands;
+ * it's gone. Callers now use the `currentRules()` helper.
+ */
+import type { Rule } from '../types.js';
+/**
+ * Per-RunScope rule registry. Wraps the kernel `Registry<T>` with
+ * built-in seeding at construction.
+ */
+export declare class GraphRulesRegistry {
+    private readonly inner;
+    constructor();
+    getAll(): readonly Rule[];
+}
+/** Factory used by the graph tool's `contributeScope` hook. */
+export declare function createRulesRegistry(): GraphRulesRegistry;
+/**
+ * Snapshot of every registered rule in the current scope, in
+ * registration order. Replaces the prior module-level `rules` export.
+ */
+export declare function currentRules(): readonly Rule[];
+//# sourceMappingURL=registry.d.ts.map

package/dist/rules/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/rules/registry.ts"],"names":[],"mappings":"AACA;;;;;;;;;;;;;;;;GAgBG;AAeH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAyBxC;;;GAGG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAInB;;IAQH,MAAM,IAAI,SAAS,IAAI,EAAE;CAG1B;AAED,+DAA+D;AAC/D,wBAAgB,mBAAmB,IAAI,kBAAkB,CAExD;AA2BD;;;GAGG;AACH,wBAAgB,YAAY,IAAI,SAAS,IAAI,EAAE,CAE9C"}

package/dist/rules/registry.js

@@ -0,0 +1,96 @@
+// @fitness-ignore-file batch-operation-limits -- iterates bounded collection (registered rules + getAll() returning the rule list per RunScope)
+/**
+ * Rule registry — per-RunScope.
+ *
+ * Each `RunScope` owns its own rule registry (Item 1 / D7). The graph
+ * tool's `contributeScope` hook constructs a fresh registry per CLI
+ * invocation and attaches it to `scope.graph.rules`. The registry is
+ * seeded with the built-in rules at construction.
+ *
+ * Built on the kernel's unified `Registry<T>` with
+ * `duplicatePolicy: 'warn-first-wins'` — re-registering the same rule
+ * slug keeps the incumbent and emits a structured warning.
+ *
+ * v0.2 shipped with the first built-in rules; runtime rule loading is
+ * deferred to v0.3 per DEC-6. The legacy `rules` array export was a
+ * process-level snapshot read by `orchestrate`/`graph` CLI commands;
+ * it's gone. Callers now use the `currentRules()` helper.
+ */
+import { Registry, currentScope } from '@opensip-cli/core';
+import { alwaysThrowsBranchRule } from './always-throws-branch.js';
+import { cycleRule } from './cycle.js';
+import { duplicatedFunctionBodyRule } from './duplicated-function-body.js';
+import { highBlastUntestedRule } from './high-blast-untested.js';
+import { largeFunctionRule } from './large-function.js';
+import { noSideEffectPathRule } from './no-side-effect-path.js';
+import { orphanSubtreeRule } from './orphan-subtree.js';
+import { testOnlyReachableRule } from './test-only-reachable.js';
+import { unexpectedCouplingRule } from './unexpected-coupling.js';
+import { wideFunctionRule } from './wide-function.js';
+/** Built-in rule list, in fixed registration order — preserved across
+ *  reconstruction so callers that depend on snapshot ordering keep
+ *  their semantics. */
+const BUILT_IN_RULES = [
+    orphanSubtreeRule,
+    duplicatedFunctionBodyRule,
+    noSideEffectPathRule,
+    testOnlyReachableRule,
+    alwaysThrowsBranchRule,
+    // Plan D structural rules, in stable order.
+    largeFunctionRule,
+    wideFunctionRule,
+    highBlastUntestedRule,
+    cycleRule,
+    unexpectedCouplingRule,
+];
+/**
+ * Per-RunScope rule registry. Wraps the kernel `Registry<T>` with
+ * built-in seeding at construction.
+ */
+export class GraphRulesRegistry {
+    inner = new Registry({
+        module: 'graph:rules',
+        duplicatePolicy: 'warn-first-wins',
+        evtPrefix: 'graph.rule.registry',
+    });
+    constructor() {
+        for (const rule of BUILT_IN_RULES) {
+            this.inner.register({ id: rule.slug, name: rule.slug, rule });
+        }
+    }
+    getAll() {
+        return this.inner.getAll().map((r) => r.rule);
+    }
+}
+/** Factory used by the graph tool's `contributeScope` hook. */
+export function createRulesRegistry() {
+    return new GraphRulesRegistry();
+}
+/**
+ * Read the current scope's graph rule registry. Throws when no scope
+ * is active or when the graph subscope is missing.
+ *
+ * @throws {Error} When called outside `runWithScope(...)`, or when the
+ *   active scope has no graph subscope.
+ */
+function currentRulesRegistry() {
+    const scope = currentScope();
+    if (!scope) {
+        throw new Error('graph: currentRulesRegistry() called outside a RunScope. ' +
+            'Wrap the call site in runWithScope (production: pre-action-hook handles ' +
+            'this; tests: use makeTestScope + graphTool.contributeScope).');
+    }
+    if (!scope.graph) {
+        throw new Error('graph: scope.graph is missing. The graph tool must be registered and ' +
+            'its contributeScope hook must run before rule reads.');
+    }
+    return scope.graph.rules;
+}
+/**
+ * Snapshot of every registered rule in the current scope, in
+ * registration order. Replaces the prior module-level `rules` export.
+ */
+export function currentRules() {
+    return currentRulesRegistry().getAll();
+}
+//# sourceMappingURL=registry.js.map

package/dist/rules/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/rules/registry.ts"],"names":[],"mappings":"AAAA,gJAAgJ;AAChJ;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAqB,MAAM,mBAAmB,CAAC;AAE9E,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAUtD;;uBAEuB;AACvB,MAAM,cAAc,GAAoB;IACtC,iBAAiB;IACjB,0BAA0B;IAC1B,oBAAoB;IACpB,qBAAqB;IACrB,sBAAsB;IACtB,4CAA4C;IAC5C,iBAAiB;IACjB,gBAAgB;IAChB,qBAAqB;IACrB,SAAS;IACT,sBAAsB;CACvB,CAAC;AAEF;;;GAGG;AACH,MAAM,OAAO,kBAAkB;IACZ,KAAK,GAAG,IAAI,QAAQ,CAAmB;QACtD,MAAM,EAAE,aAAa;QACrB,eAAe,EAAE,iBAAiB;QAClC,SAAS,EAAE,qBAAqB;KACjC,CAAC,CAAC;IAEH;QACE,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;YAClC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAED,MAAM;QACJ,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAChD,CAAC;CACF;AAED,+DAA+D;AAC/D,MAAM,UAAU,mBAAmB;IACjC,OAAO,IAAI,kBAAkB,EAAE,CAAC;AAClC,CAAC;AAED;;;;;;GAMG;AACH,SAAS,oBAAoB;IAC3B,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;IAC7B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,2DAA2D;YACzD,0EAA0E;YAC1E,8DAA8D,CACjE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,uEAAuE;YACrE,sDAAsD,CACzD,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO,oBAAoB,EAAE,CAAC,MAAM,EAAE,CAAC;AACzC,CAAC"}

package/dist/rules/test-only-reachable.d.ts

@@ -0,0 +1,9 @@
+/**
+ * graph:test-only-reachable — flag functions whose only callers live
+ * in test files. Productive code should not depend on tests; functions
+ * called *exclusively* from test files are likely test fixtures that
+ * should live in __tests__/, not in the production tree.
+ */
+import type { Rule } from '../types.js';
+export declare const testOnlyReachableRule: Rule;
+//# sourceMappingURL=test-only-reachable.d.ts.map

package/dist/rules/test-only-reachable.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-only-reachable.d.ts","sourceRoot":"","sources":["../../src/rules/test-only-reachable.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,OAAO,KAAK,EAAW,IAAI,EAAE,MAAM,aAAa,CAAC;AAGjD,eAAO,MAAM,qBAAqB,MA4ChC,CAAC"}

package/dist/rules/test-only-reachable.js

@@ -0,0 +1,101 @@
+/**
+ * graph:test-only-reachable — flag functions whose only callers live
+ * in test files. Productive code should not depend on tests; functions
+ * called *exclusively* from test files are likely test fixtures that
+ * should live in __tests__/, not in the production tree.
+ */
+import { approximateSuffix } from './_approximation.js';
+import { inferEntryPoints } from './_entry-points.js';
+import { createGraphSignal } from './create-graph-signal.js';
+import { defineRule } from './define-rule.js';
+export const testOnlyReachableRule = defineRule({
+    slug: 'graph:test-only-reachable',
+    defaultSeverity: 'warning',
+    featureDeps: ['reachableOnlyFromTests'],
+    evaluate({ catalog, indexes, features, config }) {
+        // The reachableOnlyFromTests feature column folds the not-prod-reachable +
+        // has-callers + all-callers-in-test predicate. When features are absent
+        // (3/4-arg test calls), fall back to the local prod-reachability BFS — the
+        // canonical home is now pipeline/features.ts. Compute the fallback set
+        // ONLY when needed.
+        const reachableFromProd = features
+            ? new Set()
+            : bfsReachable(computeProductionEntries(catalog, indexes), indexes);
+        const isTestOnly = (h) => features
+            ? features.function.get(h)?.reachableOnlyFromTests === true
+            : computeTestOnlyLocal(h, indexes, reachableFromProd);
+        // Missing prod-caller edges on a fast catalog can fake "test-only".
+        const caveat = approximateSuffix(catalog);
+        const signals = [];
+        for (const occ of indexes.byBodyHash.values()) {
+            if (occ.kind === 'module-init')
+                continue;
+            if (occ.inTestFile)
+                continue; // Tests-of-tests are fine.
+            if (occ.definedInGenerated)
+                continue;
+            if (!isTestOnly(occ.bodyHash))
+                continue; // not-prod-reachable + all-test callers
+            // Skip exports — they may be intentionally test-callable APIs.
+            if (occ.visibility === 'exported')
+                continue;
+            const callers = indexes.callers.get(occ.bodyHash) ?? [];
+            signals.push(createGraphSignal('graph:test-only-reachable', config, {
+                severity: 'low',
+                category: 'testing',
+                message: `${occ.simpleName} is reached only from test files.${caveat}`,
+                code: { file: occ.filePath, line: occ.line, column: occ.column },
+                suggestion: 'Move this function to a __tests__/ helper or co-locate it with its tests.',
+                metadata: {
+                    qualifiedName: occ.qualifiedName,
+                    testCallers: callers.length,
+                },
+            }));
+        }
+        return signals;
+    },
+});
+/**
+ * Features-absent fallback for the `reachableOnlyFromTests` column: a function
+ * is test-only-reachable when it is NOT reachable from any production entry,
+ * HAS callers, and ALL of its callers live in test files. Byte-equivalent to
+ * the canonical computation in `pipeline/features.ts` (`isReachableOnlyFromTests`).
+ */
+function computeTestOnlyLocal(hash, indexes, reachableFromProd) {
+    if (reachableFromProd.has(hash))
+        return false;
+    const callers = indexes.callers.get(hash) ?? [];
+    if (callers.length === 0)
+        return false;
+    return callers.every((h) => indexes.byBodyHash.get(h)?.inTestFile === true);
+}
+function computeProductionEntries(catalog, indexes) {
+    const out = new Set();
+    for (const ep of inferEntryPoints(catalog, indexes)) {
+        const occ = indexes.byBodyHash.get(ep.bodyHash);
+        /* v8 ignore next */
+        if (!occ)
+            continue;
+        if (occ.inTestFile)
+            continue; // Test-runner entries don't count.
+        out.add(ep.bodyHash);
+    }
+    return out;
+}
+function bfsReachable(seeds, indexes) {
+    const visited = new Set();
+    const queue = [...seeds];
+    while (queue.length > 0) {
+        const cur = queue.shift();
+        /* v8 ignore next */
+        if (cur === undefined || visited.has(cur))
+            continue;
+        visited.add(cur);
+        const next = indexes.callees.get(cur) ?? [];
+        for (const n of next)
+            if (!visited.has(n))
+                queue.push(n);
+    }
+    return visited;
+}
+//# sourceMappingURL=test-only-reachable.js.map

package/dist/rules/test-only-reachable.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-only-reachable.js","sourceRoot":"","sources":["../../src/rules/test-only-reachable.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAK9C,MAAM,CAAC,MAAM,qBAAqB,GAAG,UAAU,CAAC;IAC9C,IAAI,EAAE,2BAA2B;IACjC,eAAe,EAAE,SAAS;IAC1B,WAAW,EAAE,CAAC,wBAAwB,CAAC;IACvC,QAAQ,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE;QAC7C,2EAA2E;QAC3E,wEAAwE;QACxE,2EAA2E;QAC3E,uEAAuE;QACvE,oBAAoB;QACpB,MAAM,iBAAiB,GAAwB,QAAQ;YACrD,CAAC,CAAC,IAAI,GAAG,EAAE;YACX,CAAC,CAAC,YAAY,CAAC,wBAAwB,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;QACtE,MAAM,UAAU,GAAG,CAAC,CAAS,EAAW,EAAE,CACxC,QAAQ;YACN,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,sBAAsB,KAAK,IAAI;YAC3D,CAAC,CAAC,oBAAoB,CAAC,CAAC,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC;QAC1D,oEAAoE;QACpE,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;YAC9C,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa;gBAAE,SAAS;YACzC,IAAI,GAAG,CAAC,UAAU;gBAAE,SAAS,CAAC,2BAA2B;YACzD,IAAI,GAAG,CAAC,kBAAkB;gBAAE,SAAS;YACrC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAAE,SAAS,CAAC,wCAAwC;YACjF,+DAA+D;YAC/D,IAAI,GAAG,CAAC,UAAU,KAAK,UAAU;gBAAE,SAAS;YAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACxD,OAAO,CAAC,IAAI,CACV,iBAAiB,CAAC,2BAA2B,EAAE,MAAM,EAAE;gBACrD,QAAQ,EAAE,KAAK;gBACf,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE,GAAG,GAAG,CAAC,UAAU,oCAAoC,MAAM,EAAE;gBACtE,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE;gBAChE,UAAU,EAAE,2EAA2E;gBACvF,QAAQ,EAAE;oBACR,aAAa,EAAE,GAAG,CAAC,aAAa;oBAChC,WAAW,EAAE,OAAO,CAAC,MAAM;iBAC5B;aACF,CAAC,CACH,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF,CAAC,CAAC;AAEH;;;;;GAKG;AACH,SAAS,oBAAoB,CAC3B,IAAY,EACZ,OAAgB,EAChB,iBAAsC;IAEtC,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAChD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,UAAU,KAAK,IAAI,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,wBAAwB,CAC/B,OAAwC,EACxC,OAAgB;IAEhB,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,EAAE,IAAI,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;QACpD,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;QAChD,oBAAoB;QACpB,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,IAAI,GAAG,CAAC,UAAU;YAAE,SAAS,CAAC,mCAAmC;QACjE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CAAC,KAA0B,EAAE,OAAgB;IAChE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,KAAK,GAAa,CAAC,GAAG,KAAK,CAAC,CAAC;IACnC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;QAC1B,oBAAoB;QACpB,IAAI,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QACpD,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjB,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5C,KAAK,MAAM,CAAC,IAAI,IAAI;YAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/rules/unexpected-coupling.d.ts

@@ -0,0 +1,29 @@
+/**
+ * graph:unexpected-coupling — flag **package dependency cycles** (A→B→A).
+ *
+ * ADR-0001 (governing): this gate ships exactly ONE project-agnostic signal —
+ * a bounded, breakable package cycle. The statistical "coupling outlier" (a
+ * package-pair edge count far above the distribution) is a **ranking** → a
+ * dashboard insight, NOT a gate rule — it is deliberately NOT emitted here.
+ * No declared-layering input is read; the rule runs with zero project-specific
+ * config and never bakes in this repo's layer names (that kills genericity).
+ *
+ * Reads the `packageCoupling` feature column's directed package `edge` rows
+ * (Phase C, derived from `dependencies[]`/resolved call edges). A package cycle
+ * is a pair of distinct packages A, B with BOTH A→B and B→A present. Detecting
+ * the 2-cycle is a bounded membership check over the edge set — NOT an in-rule
+ * Tarjan (the SCC algorithm is Phase C's job). One signal per unordered
+ * package-pair-cycle; base `high` (bounded — reaches zero when the cycle is
+ * broken).
+ *
+ * De-dup with graph:cycle: that rule reports per-SCC at function granularity;
+ * this rule reports per-package-pair at package granularity. Distinct `ruleId`
+ * + distinct `code` location → distinct fingerprints (never collide). The two
+ * are cross-linked via metadata (`relatedSccCount` here ↔ `relatedPackageCycle`
+ * there).
+ *
+ * Emitted severity routes through the opt-in `applySeverityOverride` clamp
+ * (ADR-0005).
+ */
+export declare const unexpectedCouplingRule: import("../types.js").Rule;
+//# sourceMappingURL=unexpected-coupling.d.ts.map

package/dist/rules/unexpected-coupling.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unexpected-coupling.d.ts","sourceRoot":"","sources":["../../src/rules/unexpected-coupling.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAUH,eAAO,MAAM,sBAAsB,4BAmCjC,CAAC"}