circle-ir-ai 2.22.0 → 2.27.0

package/dist/cache/tree-cache.js

@@ -0,0 +1,171 @@
+/**
+ * Tree Cache
+ *
+ * Persistent on-disk cache for `runPatternMatch` output (cognium-ai#153,
+ * P3 of epic #155). Pattern-match output is a pure function of file
+ * content + engine version, so caching it eliminates the parse +
+ * AST-walk + SAST-rule firing on warm runs.
+ *
+ * Empirically (v2.20.6 gson re-verify, 2026-06-29) the scan stage ate
+ * 179s of 358s end-to-end — ~half the wall-clock is re-discovering
+ * structure circle-ir already knows. Caching the pattern-match seam
+ * is the smallest empirical win in the cache stack (no LLM-token
+ * reduction, only CPU + wall-clock), but it stacks cleanly on the
+ * #145 static pre-filter — a cached tree means the pre-filter has
+ * more to chew on, which reduces enrichment calls downstream.
+ *
+ * **Scope:** caches `PatternMatchResult` only, NOT full `CircleIR`.
+ * The full graph (cross-file CFG, project-level type hierarchy) is
+ * too entangled with project context to cache safely without a full
+ * `CircleIR.serialize()` upstream — that's a separate D3 design
+ * question, file separately if pursued.
+ *
+ * **Key composition:**
+ *   content = SHA-256(sourceCode) + '\0' +
+ *             circleIrVersion + '\0' +
+ *             circleIrAiVersion + '\0' +
+ *             language + '\0' +
+ *             ruleSetFingerprint
+ *   classifier = 'tree-pattern-match'
+ *
+ * Any of: file edit, circle-ir bump, circle-ir-ai bump, language
+ * change, or rule-set change → cache miss.
+ *
+ * **Storage:** `ClassificationCache<PatternMatchResult>` under
+ * `.cognium/cache/tree/`, 7-day TTL (longer than discovery cache
+ * because the input is structural and stable — pattern-match output
+ * doesn't drift between scans the way an LLM call would).
+ *
+ * **Env toggles:**
+ *   LLM_TREE_CACHE=0  → disable persistent tree cache.
+ *
+ * **Versioning note:** unlike discovery-cache / verify-cache, this
+ * cache is NOT keyed on the LLM model fingerprint (pattern-match is
+ * static — circle-ir doesn't call any LLM). It IS keyed on the
+ * circle-ir and circle-ir-ai package versions because either bump
+ * can change the workflow-level transforms applied to the result.
+ */
+import * as crypto from 'crypto';
+import * as fs from 'fs';
+import * as path from 'path';
+import { createRequire } from 'module';
+import { ClassificationCache } from './classification-cache.js';
+const TREE_CACHE_SUBDIR = path.join('.cognium', 'cache', 'tree');
+const TREE_CACHE_TTL_MS = 7 * 24 * 60 * 60 * 1000; // 7 days — structural, stable
+/**
+ * Module-scoped singleton — distinct from the verify/discovery
+ * singletons so the tree cache (which doesn't depend on the LLM model)
+ * doesn't get invalidated when the operator swaps discovery model.
+ */
+let _instance = null;
+/**
+ * Read package versions once at module load (best-effort). Wrapped in a
+ * try/catch so unit tests that don't ship a package.json next to the
+ * source can still construct the cache; in that case the version
+ * component degrades to 'unknown' and the cache still works (just isn't
+ * cross-version-safe).
+ */
+function safeReadVersion(spec, baseUrl) {
+    try {
+        const require = createRequire(baseUrl);
+        return require(spec).version || 'unknown';
+    }
+    catch {
+        return 'unknown';
+    }
+}
+const _circleIrVersion = safeReadVersion('circle-ir/package.json', import.meta.url);
+const _circleIrAiVersion = (() => {
+    // The package's own version is harder to resolve via require, so read
+    // it directly from disk by walking up from this file.
+    try {
+        // Compiled output sits at dist/cache/tree-cache.js → ../../package.json
+        const candidates = [
+            path.resolve(new URL(import.meta.url).pathname, '../../../package.json'),
+            path.resolve(new URL(import.meta.url).pathname, '../../package.json'),
+        ];
+        for (const p of candidates) {
+            if (fs.existsSync(p)) {
+                const pkg = JSON.parse(fs.readFileSync(p, 'utf8'));
+                if (pkg.name === 'circle-ir-ai' && pkg.version) {
+                    return pkg.version;
+                }
+            }
+        }
+    }
+    catch {
+        /* fallthrough */
+    }
+    return 'unknown';
+})();
+/**
+ * Get the tree-cache singleton. When `LLM_TREE_CACHE=0` returns a
+ * disabled cache that no-ops on get/set (callers don't need to branch).
+ */
+export function getTreeCache() {
+    const enabled = process.env.LLM_TREE_CACHE !== '0';
+    if (!_instance) {
+        _instance = new ClassificationCache({
+            cacheDir: path.join(process.cwd(), TREE_CACHE_SUBDIR),
+            maxAge: TREE_CACHE_TTL_MS,
+            enabled,
+        });
+    }
+    return _instance;
+}
+/** Reset the module-scoped singleton — test-only. */
+export function resetTreeCache() {
+    _instance = null;
+}
+/**
+ * Compute the `(content, classifier)` tuple for the underlying
+ * ClassificationCache.
+ *
+ * Components:
+ *   - source code SHA-256 — file edit invalidates only that file's entry
+ *   - circleIrVersion — bumping circle-ir invalidates all entries
+ *   - circleIrAiVersion — bumping circle-ir-ai (which may change
+ *     workflow-level transforms applied to pattern-match output)
+ *     invalidates all entries
+ *   - language — same source, different language tag must miss (the
+ *     analyzer's behavior depends on the language argument)
+ *   - ruleSetFingerprint — caller-supplied digest of the active rule
+ *     set (disabledPasses + projectProfile). Empty string is fine for
+ *     the default rule set.
+ */
+export function computeTreeCacheKey(input) {
+    const sourceSha = crypto.createHash('sha256').update(input.sourceCode).digest('hex');
+    const ruleSet = input.ruleSetFingerprint ?? '';
+    return {
+        content: `${sourceSha}\0${_circleIrVersion}\0${_circleIrAiVersion}\0${input.language}\0${ruleSet}`,
+        classifier: 'tree-pattern-match',
+    };
+}
+/**
+ * Compute a stable fingerprint over an arbitrary rule-set descriptor
+ * (disabledPasses array + projectProfile object). Result is suitable to
+ * pass as `ruleSetFingerprint` to `computeTreeCacheKey`. Order-stable
+ * for arrays so re-ordering `--disable a,b` vs `--disable b,a` still
+ * hits the cache.
+ */
+export function computeRuleSetFingerprint(input) {
+    const passes = [...(input.disabledPasses ?? [])].sort().join(',');
+    // projectProfile JSON-stringifies; key order in objects matters only
+    // if the producer is non-deterministic — `@cognium/project-profile-detect`
+    // emits stable keys, so this is fine. If a future profile producer is
+    // less stable we can switch to a sorted-keys serializer.
+    const profile = input.projectProfile === undefined
+        ? ''
+        : JSON.stringify(input.projectProfile);
+    if (!passes && !profile)
+        return '';
+    return crypto.createHash('sha256').update(`${passes}\0${profile}`).digest('hex');
+}
+/** Test-only: expose the captured engine versions for assertions. */
+export function getTreeCacheVersions() {
+    return {
+        circleIrVersion: _circleIrVersion,
+        circleIrAiVersion: _circleIrAiVersion,
+    };
+}
+//# sourceMappingURL=tree-cache.js.map

package/dist/cache/tree-cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tree-cache.js","sourceRoot":"","sources":["../../src/cache/tree-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAGhE,MAAM,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;AACjE,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,8BAA8B;AAiBjF;;;;GAIG;AACH,IAAI,SAAS,GAAmD,IAAI,CAAC;AAErE;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,IAAY,EAAE,OAAe;IACpD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACvC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,IAAI,SAAS,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,gBAAgB,GAAG,eAAe,CAAC,wBAAwB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACpF,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE;IAC/B,sEAAsE;IACtE,sDAAsD;IACtD,IAAI,CAAC;QACH,wEAAwE;QACxE,MAAM,UAAU,GAAG;YACjB,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,uBAAuB,CAAC;YACxE,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,oBAAoB,CAAC;SACtE,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,IAAI,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;gBACnD,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;oBAC/C,OAAO,GAAG,CAAC,OAAiB,CAAC;gBAC/B,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB;IACnB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC,EAAE,CAAC;AAEL;;;GAGG;AACH,MAAM,UAAU,YAAY;IAC1B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,GAAG,CAAC;IACnD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,SAAS,GAAG,IAAI,mBAAmB,CAAqB;YACtD,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,iBAAiB,CAAC;YACrD,MAAM,EAAE,iBAAiB;YACzB,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,cAAc;IAC5B,SAAS,GAAG,IAAI,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAInC;IACC,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrF,MAAM,OAAO,GAAG,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC;IAC/C,OAAO;QACL,OAAO,EAAE,GAAG,SAAS,KAAK,gBAAgB,KAAK,kBAAkB,KAAK,KAAK,CAAC,QAAQ,KAAK,OAAO,EAAE;QAClG,UAAU,EAAE,oBAAoB;KACjC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAGzC;IACC,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClE,qEAAqE;IACrE,2EAA2E;IAC3E,sEAAsE;IACtE,yDAAyD;IACzD,MAAM,OAAO,GAAG,KAAK,CAAC,cAAc,KAAK,SAAS;QAChD,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACnC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,KAAK,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnF,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,oBAAoB;IAIlC,OAAO;QACL,eAAe,EAAE,gBAAgB;QACjC,iBAAiB,EAAE,kBAAkB;KACtC,CAAC;AACJ,CAAC"}

package/dist/cache/verify-cache.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Verify Cache
+ *
+ * Persistent on-disk cache for LLM verification batch results
+ * (cognium-ai#152, P1 of epic #155). Sits in front of the in-memory
+ * `_verifierDedupCache` from verification.ts (#138 step 3) so that
+ * identical `(file SHA, pair-set)` requests survive across processes,
+ * CI runs, and developer iterations — not just within one process.
+ *
+ * Built on top of `ClassificationCache<BatchVerificationResult>` (which
+ * already carries the cognium-ai#151 model-fingerprint key dimension),
+ * with verify-specific key construction:
+ *
+ *   content    = SHA-256(code) + '\\0' + pairsFingerprint
+ *   classifier = 'verify-batch'
+ *   fingerprint = getPhaseModelFingerprint(config)  // includes verify model
+ *
+ * Cache directory: `.cognium/cache/verify/` (separate from the
+ * discovery-phase `.cognium/cache/` so a `rm -rf .cognium/cache/verify/`
+ * only nukes verifier entries).
+ *
+ * Invalidation matrix (acceptance criteria #152):
+ *   - Edit one file in a project   → only that file's entries invalidate
+ *     (file SHA-256 is part of the cache content key)
+ *   - Add a new sink to the engine → existing entries still hit if the
+ *     new sink doesn't change the pair-set for that file
+ *   - Change verification model    → entire cache invalidates
+ *     (model fingerprint is part of the singleton key)
+ *
+ * Env toggles:
+ *   LLM_VERIFY_CACHE=0  → disable persistent verify cache (in-memory
+ *                         dedup from #138 still applies)
+ */
+import { ClassificationCache } from './classification-cache.js';
+import { type LLMConfig } from '../llm/config.js';
+import type { BatchVerificationInput, BatchVerificationResult } from '../llm/verification.js';
+/**
+ * Get the verify-phase persistent cache, keyed by per-phase model
+ * fingerprint. When `LLM_VERIFY_CACHE=0` returns a disabled cache that
+ * no-ops on get/set (callers don't need to branch).
+ */
+export declare function getVerifyCache(config?: LLMConfig): ClassificationCache<BatchVerificationResult>;
+/** Reset the module-scoped singleton — test-only. */
+export declare function resetVerifyCache(): void;
+/**
+ * Compute the `(content, classifier)` tuple for the underlying
+ * ClassificationCache. The fingerprint dimension is folded in by the
+ * cache itself (see classification-cache.ts:computeKey).
+ *
+ * Components:
+ *   - file SHA-256 — file edit invalidates only that file's entry
+ *   - pairs fingerprint — sort-invariant over the source/sink set
+ *   - classifier 'verify-batch' — namespace for future
+ *     'verify-pair' / 'verify-flow' tiers without collision
+ */
+export declare function computeVerifyCacheKey(input: BatchVerificationInput): {
+    content: string;
+    classifier: string;
+};
+//# sourceMappingURL=verify-cache.d.ts.map

package/dist/cache/verify-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-cache.d.ts","sourceRoot":"","sources":["../../src/cache/verify-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAIH,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAiD,KAAK,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,KAAK,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAa9F;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,MAAM,GAAE,SAAiC,GACxC,mBAAmB,CAAC,uBAAuB,CAAC,CAc9C;AAED,qDAAqD;AACrD,wBAAgB,gBAAgB,IAAI,IAAI,CAGvC;AAiBD;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,sBAAsB,GAC5B;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAOzC"}

package/dist/cache/verify-cache.js

@@ -0,0 +1,103 @@
+/**
+ * Verify Cache
+ *
+ * Persistent on-disk cache for LLM verification batch results
+ * (cognium-ai#152, P1 of epic #155). Sits in front of the in-memory
+ * `_verifierDedupCache` from verification.ts (#138 step 3) so that
+ * identical `(file SHA, pair-set)` requests survive across processes,
+ * CI runs, and developer iterations — not just within one process.
+ *
+ * Built on top of `ClassificationCache<BatchVerificationResult>` (which
+ * already carries the cognium-ai#151 model-fingerprint key dimension),
+ * with verify-specific key construction:
+ *
+ *   content    = SHA-256(code) + '\\0' + pairsFingerprint
+ *   classifier = 'verify-batch'
+ *   fingerprint = getPhaseModelFingerprint(config)  // includes verify model
+ *
+ * Cache directory: `.cognium/cache/verify/` (separate from the
+ * discovery-phase `.cognium/cache/` so a `rm -rf .cognium/cache/verify/`
+ * only nukes verifier entries).
+ *
+ * Invalidation matrix (acceptance criteria #152):
+ *   - Edit one file in a project   → only that file's entries invalidate
+ *     (file SHA-256 is part of the cache content key)
+ *   - Add a new sink to the engine → existing entries still hit if the
+ *     new sink doesn't change the pair-set for that file
+ *   - Change verification model    → entire cache invalidates
+ *     (model fingerprint is part of the singleton key)
+ *
+ * Env toggles:
+ *   LLM_VERIFY_CACHE=0  → disable persistent verify cache (in-memory
+ *                         dedup from #138 still applies)
+ */
+import * as crypto from 'crypto';
+import * as path from 'path';
+import { ClassificationCache } from './classification-cache.js';
+import { getDefaultLLMConfig, getPhaseModelFingerprint } from '../llm/config.js';
+const VERIFY_CACHE_SUBDIR = path.join('.cognium', 'cache', 'verify');
+/**
+ * Module-scoped singleton — distinct from the discovery-phase singleton
+ * in `classification-cache.ts` so the two phases can carry different
+ * model fingerprints (e.g. cheap discovery + strong verifier) without
+ * thrashing each other's cache instance.
+ */
+let _instance = null;
+let _instanceFingerprint = '';
+/**
+ * Get the verify-phase persistent cache, keyed by per-phase model
+ * fingerprint. When `LLM_VERIFY_CACHE=0` returns a disabled cache that
+ * no-ops on get/set (callers don't need to branch).
+ */
+export function getVerifyCache(config = getDefaultLLMConfig()) {
+    const enabled = process.env.LLM_VERIFY_CACHE !== '0';
+    const fingerprint = getPhaseModelFingerprint(config);
+    if (!_instance || _instanceFingerprint !== fingerprint || _instance.getModelFingerprint() !== fingerprint) {
+        _instance = new ClassificationCache({
+            cacheDir: path.join(process.cwd(), VERIFY_CACHE_SUBDIR),
+            modelFingerprint: fingerprint,
+            enabled,
+        });
+        _instanceFingerprint = fingerprint;
+    }
+    return _instance;
+}
+/** Reset the module-scoped singleton — test-only. */
+export function resetVerifyCache() {
+    _instance = null;
+    _instanceFingerprint = '';
+}
+/**
+ * Stable sort over the source/sink pair-set; never mutates the caller's
+ * arrays. Mirrors `_serializeVerifierPairs` in verification.ts so
+ * persistent + in-memory dedup agree on what counts as "the same call".
+ */
+function serializeVerifyPairs(input) {
+    const sources = [...input.sources]
+        .map((s) => `${s.line}|${s.type}|${s.variable ?? ''}`)
+        .sort();
+    const sinks = [...input.sinks]
+        .map((s) => `${s.line}|${s.type}|${s.cwe}|${s.method ?? ''}`)
+        .sort();
+    return JSON.stringify({ sources, sinks });
+}
+/**
+ * Compute the `(content, classifier)` tuple for the underlying
+ * ClassificationCache. The fingerprint dimension is folded in by the
+ * cache itself (see classification-cache.ts:computeKey).
+ *
+ * Components:
+ *   - file SHA-256 — file edit invalidates only that file's entry
+ *   - pairs fingerprint — sort-invariant over the source/sink set
+ *   - classifier 'verify-batch' — namespace for future
+ *     'verify-pair' / 'verify-flow' tiers without collision
+ */
+export function computeVerifyCacheKey(input) {
+    const fileSha = crypto.createHash('sha256').update(input.code).digest('hex');
+    const pairsFp = crypto.createHash('sha256').update(serializeVerifyPairs(input)).digest('hex');
+    return {
+        content: `${fileSha}\0${pairsFp}`,
+        classifier: 'verify-batch',
+    };
+}
+//# sourceMappingURL=verify-cache.js.map

package/dist/cache/verify-cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-cache.js","sourceRoot":"","sources":["../../src/cache/verify-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,wBAAwB,EAAkB,MAAM,kBAAkB,CAAC;AAGjG,MAAM,mBAAmB,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;AAErE;;;;;GAKG;AACH,IAAI,SAAS,GAAwD,IAAI,CAAC;AAC1E,IAAI,oBAAoB,GAAG,EAAE,CAAC;AAE9B;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,SAAoB,mBAAmB,EAAE;IAEzC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,GAAG,CAAC;IACrD,MAAM,WAAW,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAErD,IAAI,CAAC,SAAS,IAAI,oBAAoB,KAAK,WAAW,IAAI,SAAS,CAAC,mBAAmB,EAAE,KAAK,WAAW,EAAE,CAAC;QAC1G,SAAS,GAAG,IAAI,mBAAmB,CAA0B;YAC3D,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,mBAAmB,CAAC;YACvD,gBAAgB,EAAE,WAAW;YAC7B,OAAO;SACR,CAAC,CAAC;QACH,oBAAoB,GAAG,WAAW,CAAC;IACrC,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,gBAAgB;IAC9B,SAAS,GAAG,IAAI,CAAC;IACjB,oBAAoB,GAAG,EAAE,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,KAA6B;IACzD,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC;SAC/B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;SACrD,IAAI,EAAE,CAAC;IACV,MAAM,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;SAC3B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;SAC5D,IAAI,EAAE,CAAC;IACV,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAA6B;IAE7B,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7E,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9F,OAAO;QACL,OAAO,EAAE,GAAG,OAAO,KAAK,OAAO,EAAE;QACjC,UAAU,EAAE,cAAc;KAC3B,CAAC;AACJ,CAAC"}

package/dist/cluster/cluster.d.ts

@@ -0,0 +1,174 @@
+/**
+ * Cluster Layer — Foundation
+ *
+ * Top-of-pipeline file clustering (cognium-ai#154, P4 of epic #155).
+ * Groups files in a repo by their static structural fingerprint (CK
+ * metrics + import/annotation set) so downstream passes can apply
+ * per-cluster policy bundles ("library bootstrap" vs "controller
+ * surface" vs "data-access shim") instead of one-size-fits-all
+ * discovery/verification.
+ *
+ * This file ships the **foundation only**:
+ *   - `extractClusterVector(circleIr)` — pull CK vector from analyze() output
+ *   - `clusterFiles(inputs)` — deterministic k-medoids, returns
+ *     `Map<filePath, clusterId>` per acceptance #1
+ *   - distance functions (Euclidean on normalized CK + Jaccard on
+ *     imports/annotations) + the k-medoids loop itself
+ *   - `ClusterPolicy` type so downstream wiring can land in a
+ *     follow-up without re-declaring shape
+ *
+ * **Explicitly out of scope here** (tracked as follow-up tickets):
+ *   - `meta.json.files[*].clusterId` field — needs scan-emit schema
+ *     migration (Acceptance #3)
+ *   - top-100 HIGH/CRIT reduction validation (Acceptance #4)
+ *   - CWE-Bench-Java regression check (Acceptance #5)
+ *   - `--cluster-policy <profile>` CLI flag in cognium-ai
+ *     (Acceptance #6)
+ *   - LLM cluster labeling pass (optional future per the issue)
+ *
+ * The split is deliberate: P1-P3 of epic #155 were single-shot
+ * cache wins; P4's policy bundles + the two benchmark validation
+ * gates need empirical tuning that can't complete in a single
+ * release cycle. Foundation-first lets cognium-ai start consuming
+ * `clusterFiles()` as an opaque grouping signal while the policy
+ * resolver is iterated separately.
+ *
+ * **Determinism:** k-medoids is seeded from a digest of (sorted
+ * file paths || vector signature) so re-runs on the same input
+ * produce the same cluster assignments. Tie-breaking on equal
+ * distances falls back to lexicographic path order.
+ */
+import type { CircleIR } from 'circle-ir';
+/**
+ * Per-file structural fingerprint used as the clustering signal.
+ * CK metrics default to 0 when circle-ir's metric pass didn't run
+ * (e.g. procedural-only files, languages without classes).
+ */
+export interface ClusterVector {
+    cbo: number;
+    rfc: number;
+    lcom: number;
+    dit: number;
+    noc: number;
+    wmc: number;
+    imports: string[];
+    publicSurface: number;
+    annotations: string[];
+}
+export interface ClusterInput {
+    filePath: string;
+    vector: ClusterVector;
+}
+export interface ClusterAssignment {
+    filePath: string;
+    clusterId: number;
+}
+export interface ClusterResult {
+    k: number;
+    assignments: ClusterAssignment[];
+    /** Medoid file path per cluster id (index = clusterId). */
+    medoids: string[];
+    /** Iterations until convergence (for tuning visibility). */
+    iterations: number;
+}
+/**
+ * Downstream policy bundle attached to a cluster. Shape locked here
+ * so wiring tickets can land without re-negotiating the contract;
+ * default policy ("application", everything on) is what consumers
+ * should apply until cluster-specific overrides ship.
+ */
+export type ContextProfile = 'application' | 'library' | 'framework' | 'tool';
+export interface ClusterPolicy {
+    contextProfile: ContextProfile;
+    /** Discovery source kinds permitted; empty array = all. */
+    sourceWhitelist: string[];
+    /** Verification sink classes permitted; empty array = all. */
+    sinkWhitelist: string[];
+    /** When false, downstream LLM passes skip this cluster entirely. */
+    llmEnabled: boolean;
+}
+export declare const DEFAULT_CLUSTER_POLICY: ClusterPolicy;
+/**
+ * Extract a ClusterVector from a single-file `CircleIR` analyze()
+ * result. Missing metrics default to 0 — the cluster vector is
+ * structural, so a procedural file with no CK numbers will land
+ * in the "low-complexity" cluster naturally (it's a valid signal,
+ * not missing data).
+ */
+export declare function extractClusterVector(circleIr: CircleIR): ClusterVector;
+/**
+ * Per-axis max-normalize the CK + publicSurface scalars across the
+ * input set. Max-normalize (rather than z-score) is deliberate:
+ * cluster boundaries should be robust to outliers (one god-class
+ * with WMC=400 shouldn't squash everything else into the same
+ * cluster), and max-normalize gives a clean [0,1] domain that
+ * combines naturally with Jaccard.
+ *
+ * Returns the maxima so callers can normalize new vectors against
+ * the same scale (e.g. for the k-medoids loop on the same set).
+ */
+export declare function computeNormalization(inputs: ClusterInput[]): {
+    cboMax: number;
+    rfcMax: number;
+    lcomMax: number;
+    ditMax: number;
+    nocMax: number;
+    wmcMax: number;
+    publicSurfaceMax: number;
+};
+/** Euclidean distance on the max-normalized CK + publicSurface scalars. */
+export declare function euclideanCkDistance(a: ClusterVector, b: ClusterVector, norm: ReturnType<typeof computeNormalization>): number;
+/**
+ * Jaccard distance on two string sets (1 - |intersection|/|union|).
+ * Returns 0 when both sets are empty (semantically: nothing
+ * distinguishes them on this axis).
+ */
+export declare function jaccardDistance(a: string[], b: string[]): number;
+/**
+ * Combined per-pair distance. Weights mirror the issue's signal
+ * vector ordering (CK is the primary signal; imports + annotations
+ * are tiebreakers). Total is in [0,1] so it composes cleanly with
+ * other metric-space algorithms.
+ *
+ * Weights chosen to sum to 1:
+ *   0.6 — CK + publicSurface Euclidean (clamped to 1 by sqrt of 7
+ *         normalized components, since each (a-b)/max is in [-1,1])
+ *   0.2 — imports Jaccard
+ *   0.2 — annotations Jaccard
+ *
+ * Euclidean is divided by sqrt(7) to renormalize to [0,1] before
+ * weighting — without this, the CK term can exceed 1 and the total
+ * stops being a proper [0,1] distance.
+ */
+export declare function mixedDistance(a: ClusterVector, b: ClusterVector, norm: ReturnType<typeof computeNormalization>): number;
+interface KMedoidsOptions {
+    /** Desired cluster count. Clamped to `[1, inputs.length]`. */
+    k: number;
+    /** Maximum iterations before bailing. Default 50. */
+    maxIter?: number;
+    /** Override the deterministic seed (test-only). */
+    seed?: number;
+}
+/**
+ * PAM-lite k-medoids on `inputs`.
+ *
+ * 1. Seed selection ("build" phase): pick the medoid that minimizes
+ *    total distance to all points, then iteratively pick the point
+ *    that maximizes minimum distance to existing medoids. This is
+ *    deterministic given the seed and degenerates gracefully when
+ *    `inputs.length <= k`.
+ * 2. Assignment: each point joins its closest medoid (lex path
+ *    tiebreak on equal distances).
+ * 3. Swap phase: for each cluster, find the point that minimizes
+ *    intra-cluster distance and promote it to medoid. Repeat until
+ *    no medoid changes (or `maxIter` hits).
+ *
+ * Complexity is O(n^2 * iter) on the distance matrix. For the
+ * top-100 sweep (n ≈ 5000 per repo at the high end) this is ~25M
+ * pairwise computations per iteration — fine for the <2s budget
+ * in Acceptance #2 because distances are scalar arithmetic on
+ * a 9-dim vector.
+ */
+export declare function clusterFiles(inputs: ClusterInput[], options: KMedoidsOptions): ClusterResult;
+export {};
+//# sourceMappingURL=cluster.d.ts.map

package/dist/cluster/cluster.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cluster.d.ts","sourceRoot":"","sources":["../../src/cluster/cluster.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAe,MAAM,WAAW,CAAC;AAMvD;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,aAAa,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,CAAC,EAAE,MAAM,CAAC;IACV,WAAW,EAAE,iBAAiB,EAAE,CAAC;IACjC,2DAA2D;IAC3D,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,4DAA4D;IAC5D,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG,aAAa,GAAG,SAAS,GAAG,WAAW,GAAG,MAAM,CAAC;AAE9E,MAAM,WAAW,aAAa;IAC5B,cAAc,EAAE,cAAc,CAAC;IAC/B,2DAA2D;IAC3D,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,8DAA8D;IAC9D,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,oEAAoE;IACpE,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,eAAO,MAAM,sBAAsB,EAAE,aAKpC,CAAC;AAsBF;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,GAAG,aAAa,CAyDtE;AAMD;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,CAAC;CAC1B,CAYA;AAED,2EAA2E;AAC3E,wBAAgB,mBAAmB,CACjC,CAAC,EAAE,aAAa,EAChB,CAAC,EAAE,aAAa,EAChB,IAAI,EAAE,UAAU,CAAC,OAAO,oBAAoB,CAAC,GAC5C,MAAM,CAWR;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,CAShE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,aAAa,CAC3B,CAAC,EAAE,aAAa,EAChB,CAAC,EAAE,aAAa,EAChB,IAAI,EAAE,UAAU,CAAC,OAAO,oBAAoB,CAAC,GAC5C,MAAM,CAKR;AAwCD,UAAU,eAAe;IACvB,8DAA8D;IAC9D,CAAC,EAAE,MAAM,CAAC;IACV,qDAAqD;IACrD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mDAAmD;IACnD,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,YAAY,EAAE,EACtB,OAAO,EAAE,eAAe,GACvB,aAAa,CAsJf"}