code-auditor-mcp 3.1.0 → 3.4.0

package/dist/coverage/lcovParser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lcovParser.js","sourceRoot":"","sources":["../../src/coverage/lcovParser.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAiBH;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,OAAe;IACvC,MAAM,OAAO,GAAgB,EAAE,CAAC;IAChC,IAAI,OAAO,GAAqB,IAAI,CAAC;IACrC,6EAA6E;IAC7E,IAAI,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,cAAc;IAC1D,IAAI,eAAmC,CAAC;IAExC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,eAAe,EAAE,CAAC;YAClD,IAAI,OAAO,KAAK,eAAe,IAAI,OAAO,EAAE,CAAC;gBAC3C,OAAO,GAAG,IAAI,CAAC;gBACf,UAAU,GAAG,IAAI,GAAG,EAAE,CAAC;gBACvB,eAAe,GAAG,SAAS,CAAC;YAC9B,CAAC;YACD,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,QAAQ,GAAG,CAAC;YAAE,SAAS;QAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;QAE9C,QAAQ,GAAG,EAAE,CAAC;YACZ,KAAK,IAAI;gBACP,sEAAsE;gBACtE,eAAe,GAAG,KAAK,CAAC;gBACxB,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,OAAO,GAAG,gBAAgB,EAAE,CAAC;gBAC/B,CAAC;gBACD,OAAO,CAAC,QAAQ,GAAG,KAAK,CAAC;gBACzB,MAAM;YAER,KAAK,IAAI;gBACP,yCAAyC;gBACzC,OAAO,GAAG,gBAAgB,EAAE,CAAC;gBAC7B,OAAO,CAAC,UAAU,GAAG,KAAK,CAAC;gBAC3B,IAAI,eAAe,EAAE,CAAC;oBACpB,OAAO,CAAC,QAAQ,GAAG,eAAe,CAAC;oBACnC,eAAe,GAAG,SAAS,CAAC;gBAC9B,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACtB,MAAM;YAER,KAAK,IAAI,EAAE,CAAC;gBACV,IAAI,CAAC,OAAO;oBAAE,MAAM;gBACpB,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACtD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;oBACrC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;gBACvC,CAAC;gBACD,MAAM;YACR,CAAC;YAED,KAAK,IAAI;gBACP,IAAI,OAAO;oBAAE,OAAO,CAAC,UAAU,GAAG,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;gBAC3D,MAAM;YAER,KAAK,IAAI;gBACP,IAAI,OAAO;oBAAE,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;gBACzD,MAAM;YAER,KAAK,IAAI,EAAE,CAAC;gBACV,IAAI,CAAC,OAAO;oBAAE,MAAM;gBACpB,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;gBAC5C,IAAI,OAAO,KAAK,IAAI,IAAI,MAAM,EAAE,CAAC;oBAC/B,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBAClC,CAAC;gBACD,MAAM;YACR,CAAC;YAED,KAAK,MAAM,EAAE,CAAC;gBACZ,IAAI,CAAC,OAAO;oBAAE,MAAM;gBACpB,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;gBAC7C,MAAM,KAAK,GAAG,QAAQ,IAAI,GAAG,CAAC;gBAC9B,IAAI,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC5B,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;oBACpC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE;wBAC5B,IAAI,EAAE,IAAI,IAAI,CAAC;wBACf,QAAQ,EAAE,KAAK;qBAChB,CAAC,CAAC;gBACL,CAAC;gBACD,MAAM;YACR,CAAC;YAED,KAAK,MAAM,CAAC;YACZ,KAAK,KAAK,CAAC;YACX,KAAK,KAAK;gBACR,4DAA4D;gBAC5D,MAAM;QACV,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAoB;IACrD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC3C,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YACxC,IAAI,KAAK,GAAG,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QACD,iEAAiE;QACjE,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC3C,IAAI,QAAQ,EAAE,CAAC;YACb,KAAK,MAAM,CAAC,IAAI,OAAO;gBAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC3C,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAoB;IACzD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC3C,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,KAAK,MAAM,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACrD,IAAI,QAAQ,GAAG,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACxC,CAAC;QACD,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC3C,IAAI,QAAQ,EAAE,CAAC;YACb,KAAK,MAAM,CAAC,IAAI,OAAO;gBAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC3C,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4EAA4E;AAE5E,SAAS,gBAAgB;IACvB,OAAO;QACL,UAAU,EAAE,EAAE;QACd,KAAK,EAAE,EAAE;QACT,SAAS,EAAE,IAAI,GAAG,EAAE;QACpB,UAAU,EAAE,CAAC;QACb,QAAQ,EAAE,CAAC;KACZ,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,SAAS,UAAU,CAAC,KAAa;IAC/B,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAChC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI,IAAI,CAAC,CAAC;AACjD,CAAC"}

package/dist/fingerprint.d.ts

@@ -1,3 +1,4 @@
+import type { Violation } from './types.js';
 export interface FingerprintInput {
     analyzer: string;
     rule: string;
@@ -12,4 +13,20 @@ export interface FingerprintInput {
  * boundary.
  */
 export declare function fingerprint(input: FingerprintInput): string;
+/**
+ * Build the canonical {analyzer, rule, file, symbol} tuple for a violation.
+ *
+ * This is the ONE place rule-id resolution happens. If a violation stores its
+ * rule identifier in a field not listed here, that violation fingerprints
+ * with an empty rule — add the missing field to the chain below.
+ *
+ * Precedence (first populated wins):
+ *   1. `violation.rule`       — universal analyzers, invariants, react (hooks)
+ *   2. `violation.principle`   — CrossLanguageSOLID
+ *   3. `violation.violationType` — SchemaValidator, reactAnalyzer
+ *   4. `violation.contractType` — APIContractAnalyzer
+ *   5. `violation.type`         — structural type (rarely a rule id; last-resort)
+ *   6. `violation.details?.rule` — nested rule (react)
+ */
+export declare function buildFingerprintInput(violation: Violation): FingerprintInput;
 //# sourceMappingURL=fingerprint.d.ts.map

package/dist/fingerprint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fingerprint.d.ts","sourceRoot":"","sources":["../src/fingerprint.ts"],"names":[],"mappings":"AAgBA,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,MAAM,CAQ3D"}
+{"version":3,"file":"fingerprint.d.ts","sourceRoot":"","sources":["../src/fingerprint.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAG5C,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,MAAM,CAQ3D;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,SAAS,GAAG,gBAAgB,CAqB5E"}

package/dist/fingerprint.js

@@ -11,8 +11,15 @@
  *   Spec 04 — diff-scoped auditing
  *   Spec 06 — SARIF partial fingerprints (same tuple underlies a SARIF
  *             partialFingerprints entry)
+ *
+ * buildFingerprintInput() is the SINGLE canonical source for the
+ * {analyzer, rule, file, symbol} tuple. Every surface that fingerprints a
+ * violation (baseline, from_audit, SARIF) calls this function — no surface
+ * resolves the rule-id chain or symbol inline. If a new analyzer stores its
+ * rule id in a novel field, add that field HERE.
  */
 import { createHash } from 'node:crypto';
+import { extractSymbol } from './symbols.js';
 /**
  * Produce a stable hex SHA-256 digest from the canonical four-tuple.
  *
@@ -29,4 +36,39 @@ export function fingerprint(input) {
     ]);
     return createHash('sha256').update(canonical).digest('hex');
 }
+/**
+ * Build the canonical {analyzer, rule, file, symbol} tuple for a violation.
+ *
+ * This is the ONE place rule-id resolution happens. If a violation stores its
+ * rule identifier in a field not listed here, that violation fingerprints
+ * with an empty rule — add the missing field to the chain below.
+ *
+ * Precedence (first populated wins):
+ *   1. `violation.rule`       — universal analyzers, invariants, react (hooks)
+ *   2. `violation.principle`   — CrossLanguageSOLID
+ *   3. `violation.violationType` — SchemaValidator, reactAnalyzer
+ *   4. `violation.contractType` — APIContractAnalyzer
+ *   5. `violation.type`         — structural type (rarely a rule id; last-resort)
+ *   6. `violation.details?.rule` — nested rule (react)
+ */
+export function buildFingerprintInput(violation) {
+    const rule = (typeof violation.rule === 'string' ? violation.rule : undefined) ??
+        (typeof violation.principle === 'string' ? violation.principle : undefined) ??
+        (typeof violation.violationType === 'string' ? violation.violationType : undefined) ??
+        (typeof violation.contractType === 'string' ? violation.contractType : undefined) ??
+        (typeof violation.type === 'string' ? violation.type : undefined) ??
+        (violation.details &&
+            typeof violation.details === 'object' &&
+            !Array.isArray(violation.details) &&
+            typeof violation.details.rule === 'string'
+            ? violation.details.rule
+            : undefined) ??
+        '';
+    return {
+        analyzer: violation.analyzer ?? '',
+        rule,
+        file: violation.file ?? '',
+        symbol: extractSymbol(violation),
+    };
+}
 //# sourceMappingURL=fingerprint.js.map

package/dist/fingerprint.js.map

@@ -1 +1 @@
-{"version":3,"file":"fingerprint.js","sourceRoot":"","sources":["../src/fingerprint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AASzC;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,KAAuB;IACjD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAC/B,KAAK,CAAC,QAAQ;QACd,KAAK,CAAC,IAAI;QACV,KAAK,CAAC,IAAI;QACV,KAAK,CAAC,MAAM;KACb,CAAC,CAAC;IACH,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9D,CAAC"}
+{"version":3,"file":"fingerprint.js","sourceRoot":"","sources":["../src/fingerprint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAS7C;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,KAAuB;IACjD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAC/B,KAAK,CAAC,QAAQ;QACd,KAAK,CAAC,IAAI;QACV,KAAK,CAAC,IAAI;QACV,KAAK,CAAC,MAAM;KACb,CAAC,CAAC;IACH,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,qBAAqB,CAAC,SAAoB;IACxD,MAAM,IAAI,GACR,CAAC,OAAO,SAAS,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACjE,CAAC,OAAO,SAAS,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3E,CAAC,OAAO,SAAS,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;QACnF,CAAC,OAAO,SAAS,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;QACjF,CAAC,OAAO,SAAS,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACjE,CAAC,SAAS,CAAC,OAAO;YACjB,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ;YACrC,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC;YACjC,OAAO,SAAS,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ;YACzC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI;YACxB,CAAC,CAAC,SAAS,CAAC;QACd,EAAE,CAAC;IAEL,OAAO;QACL,QAAQ,EAAE,SAAS,CAAC,QAAQ,IAAI,EAAE;QAClC,IAAI;QACJ,IAAI,EAAE,SAAS,CAAC,IAAI,IAAI,EAAE;QAC1B,MAAM,EAAE,aAAa,CAAC,SAAS,CAAC;KACjC,CAAC;AACJ,CAAC"}

package/dist/graph/blastRadius.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Spec 14 R6 — Blast Radius Impact Computation
+ *
+ * Estimates the impact of editing a set of functions using recursive CTE
+ * traversal of the caller graph. Designed for the hook path: ≤100ms budget.
+ *
+ * Uses targeted traversal via SQLite recursive CTE — no full adjacency load.
+ * Cost scales with the BFS neighborhood size, not the codebase size.
+ *
+ * If latency > 100ms, the feature ships disabled-by-default.
+ */
+import type Database from 'better-sqlite3';
+import type { BlastRadiusImpact } from '../types.js';
+declare const LATENCY_BUDGET_MS = 100;
+/**
+ * Compute blast-radius impact for a set of edited function IDs.
+ *
+ * Uses a recursive CTE against `graph_cache` (falling back to
+ * `function_calls` if cache is empty) to walk the caller graph upward.
+ *
+ * @param db - SQLite database handle
+ * @param functionIds - IDs of edited/changed functions
+ * @returns Impact estimate with latency measurement
+ */
+export declare function computeImpact(db: Database.Database, functionIds: number[]): BlastRadiusImpact;
+export { LATENCY_BUDGET_MS };
+//# sourceMappingURL=blastRadius.d.ts.map

package/dist/graph/blastRadius.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"blastRadius.d.ts","sourceRoot":"","sources":["../../src/graph/blastRadius.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAC3C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAGrD,QAAA,MAAM,iBAAiB,MAAM,CAAC;AAE9B;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACrB,WAAW,EAAE,MAAM,EAAE,GACpB,iBAAiB,CA0CnB;AAwGD,OAAO,EAAE,iBAAiB,EAAE,CAAC"}

package/dist/graph/blastRadius.js

@@ -0,0 +1,150 @@
+/**
+ * Spec 14 R6 — Blast Radius Impact Computation
+ *
+ * Estimates the impact of editing a set of functions using recursive CTE
+ * traversal of the caller graph. Designed for the hook path: ≤100ms budget.
+ *
+ * Uses targeted traversal via SQLite recursive CTE — no full adjacency load.
+ * Cost scales with the BFS neighborhood size, not the codebase size.
+ *
+ * If latency > 100ms, the feature ships disabled-by-default.
+ */
+const MAX_DEPTH = 10;
+const LATENCY_BUDGET_MS = 100;
+/**
+ * Compute blast-radius impact for a set of edited function IDs.
+ *
+ * Uses a recursive CTE against `graph_cache` (falling back to
+ * `function_calls` if cache is empty) to walk the caller graph upward.
+ *
+ * @param db - SQLite database handle
+ * @param functionIds - IDs of edited/changed functions
+ * @returns Impact estimate with latency measurement
+ */
+export function computeImpact(db, functionIds) {
+    const startMs = performance.now();
+    if (functionIds.length === 0) {
+        return {
+            editedFunctionCount: 0,
+            transitiveCallers: 0,
+            reachableExports: 0,
+            depthReached: 0,
+            latencyMs: performance.now() - startMs,
+        };
+    }
+    // Check if graph_cache has call edges — use it if available (fast path)
+    const cacheCount = db.prepare("SELECT COUNT(*) as cnt FROM graph_cache WHERE graph_type = 'call'").get().cnt;
+    let reachableIds;
+    if (cacheCount > 0) {
+        // Fast path: use graph_cache
+        reachableIds = computeImpactFromCache(db, functionIds);
+    }
+    else {
+        // Fallback: use function_calls directly
+        reachableIds = computeImpactFromCalls(db, functionIds);
+    }
+    // Count exported functions among reachable callers
+    const exportedCount = reachableIds.length > 0
+        ? countExported(db, reachableIds)
+        : 0;
+    const elapsedMs = performance.now() - startMs;
+    return {
+        editedFunctionCount: functionIds.length,
+        transitiveCallers: reachableIds.length,
+        reachableExports: exportedCount,
+        depthReached: MAX_DEPTH, // The CTE caps at MAX_DEPTH
+        latencyMs: Math.round(elapsedMs * 100) / 100,
+    };
+}
+/**
+ * Walk the caller graph using `graph_cache` (fast path).
+ * Finds all transitive callers up to MAX_DEPTH.
+ */
+function computeImpactFromCache(db, functionIds) {
+    // Build initial set as comma-separated IDs
+    const idList = functionIds.join(',');
+    // Recursive CTE: follow (neighbor → node) edges in the call graph.
+    // In graph_cache, node_key = caller, neighbor_key = callee.
+    // So to find callers, we search WHERE neighbor_key = our_function
+    // and node_key is the caller.
+    try {
+        const rows = db.prepare(`
+      WITH RECURSIVE callers(id, depth) AS (
+        -- Base: start from the edited functions themselves
+        SELECT DISTINCT node_key, 0
+        FROM graph_cache
+        WHERE graph_type = 'call' AND neighbor_key IN (${idList})
+
+        UNION
+
+        -- Recursive: find callers of callers
+        SELECT DISTINCT gc.node_key, callers.depth + 1
+        FROM graph_cache gc
+        JOIN callers ON gc.neighbor_key = callers.id
+        WHERE gc.graph_type = 'call'
+          AND callers.depth < ${MAX_DEPTH}
+      )
+      SELECT DISTINCT id FROM callers
+    `).all();
+        return rows.map(r => parseInt(r.id, 10)).filter(id => !isNaN(id));
+    }
+    catch {
+        // If recursive CTE fails (e.g., malformed cache), return empty
+        return [];
+    }
+}
+/**
+ * Fallback: walk the caller graph using `function_calls`.
+ * Find all functions that transitively call the given function IDs.
+ */
+function computeImpactFromCalls(db, functionIds) {
+    // First, get the names of the edited functions
+    const idPlaceholders = functionIds.map(() => '?').join(',');
+    const fnNames = db.prepare(`SELECT DISTINCT name FROM functions WHERE id IN (${idPlaceholders})`).all(...functionIds);
+    const names = fnNames.map(r => r.name);
+    if (names.length === 0)
+        return [];
+    // Use recursive CTE on function_calls
+    // function_calls: caller_id calls callee_name
+    // To find callers: find rows where callee_name matches our function,
+    // then recursively follow from those callers
+    try {
+        const nameList = names.map(n => `'${n.replace(/'/g, "''")}'`).join(',');
+        const rows = db.prepare(`
+      WITH RECURSIVE callers(id, depth) AS (
+        -- Base: functions that directly call our edited functions
+        SELECT fc.caller_id, 1
+        FROM function_calls fc
+        WHERE fc.callee_name IN (${nameList})
+
+        UNION
+
+        -- Recursive: functions that call the current set of callers
+        SELECT fc2.caller_id, callers.depth + 1
+        FROM function_calls fc2
+        JOIN functions f ON f.id = fc2.caller_id
+        JOIN callers ON fc2.callee_name IN (
+          SELECT f2.name FROM functions f2 WHERE f2.id = callers.id
+        )
+        WHERE callers.depth < ${MAX_DEPTH}
+      )
+      SELECT DISTINCT id FROM callers
+    `).all();
+        return rows.map(r => r.id).filter(id => !functionIds.includes(id));
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Count how many of the given function IDs are exported.
+ */
+function countExported(db, functionIds) {
+    if (functionIds.length === 0)
+        return 0;
+    const idPlaceholders = functionIds.map(() => '?').join(',');
+    const row = db.prepare(`SELECT COUNT(*) as cnt FROM functions WHERE id IN (${idPlaceholders}) AND is_exported = 1`).get(...functionIds);
+    return row.cnt;
+}
+export { LATENCY_BUDGET_MS };
+//# sourceMappingURL=blastRadius.js.map

package/dist/graph/blastRadius.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"blastRadius.js","sourceRoot":"","sources":["../../src/graph/blastRadius.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAKH,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAE9B;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAC3B,EAAqB,EACrB,WAAqB;IAErB,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAElC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,mBAAmB,EAAE,CAAC;YACtB,iBAAiB,EAAE,CAAC;YACpB,gBAAgB,EAAE,CAAC;YACnB,YAAY,EAAE,CAAC;YACf,SAAS,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO;SACvC,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,MAAM,UAAU,GAAI,EAAE,CAAC,OAAO,CAC5B,mEAAmE,CACpE,CAAC,GAAG,EAAsB,CAAC,GAAG,CAAC;IAEhC,IAAI,YAAsB,CAAC;IAE3B,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;QACnB,6BAA6B;QAC7B,YAAY,GAAG,sBAAsB,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;IACzD,CAAC;SAAM,CAAC;QACN,wCAAwC;QACxC,YAAY,GAAG,sBAAsB,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;IACzD,CAAC;IAED,mDAAmD;IACnD,MAAM,aAAa,GAAG,YAAY,CAAC,MAAM,GAAG,CAAC;QAC3C,CAAC,CAAC,aAAa,CAAC,EAAE,EAAE,YAAY,CAAC;QACjC,CAAC,CAAC,CAAC,CAAC;IAEN,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;IAE9C,OAAO;QACL,mBAAmB,EAAE,WAAW,CAAC,MAAM;QACvC,iBAAiB,EAAE,YAAY,CAAC,MAAM;QACtC,gBAAgB,EAAE,aAAa;QAC/B,YAAY,EAAE,SAAS,EAAE,4BAA4B;QACrD,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,GAAG,CAAC,GAAG,GAAG;KAC7C,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,sBAAsB,CAAC,EAAqB,EAAE,WAAqB;IAC1E,2CAA2C;IAC3C,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAErC,mEAAmE;IACnE,4DAA4D;IAC5D,kEAAkE;IAClE,8BAA8B;IAC9B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC;;;;;yDAK6B,MAAM;;;;;;;;;gCAS/B,SAAS;;;KAGpC,CAAC,CAAC,GAAG,EAA2B,CAAC;QAElC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,+DAA+D;QAC/D,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,sBAAsB,CAAC,EAAqB,EAAE,WAAqB;IAC1E,+CAA+C;IAC/C,MAAM,cAAc,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,CACxB,oDAAoD,cAAc,GAAG,CACtE,CAAC,GAAG,CAAC,GAAG,WAAW,CAA4B,CAAC;IAEjD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAEvC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAElC,sCAAsC;IACtC,8CAA8C;IAC9C,qEAAqE;IACrE,6CAA6C;IAC7C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAExE,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC;;;;;mCAKO,QAAQ;;;;;;;;;;;gCAWX,SAAS;;;KAGpC,CAAC,CAAC,GAAG,EAA2B,CAAC;QAElC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,EAAqB,EAAE,WAAqB;IACjE,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAEvC,MAAM,cAAc,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CACpB,sDAAsD,cAAc,uBAAuB,CAC5F,CAAC,GAAG,CAAC,GAAG,WAAW,CAAoB,CAAC;IAEzC,OAAO,GAAG,CAAC,GAAG,CAAC;AACjB,CAAC;AAED,OAAO,EAAE,iBAAiB,EAAE,CAAC"}

package/dist/graph/callGraph.d.ts

@@ -0,0 +1,78 @@
+/**
+ * Spec 14 R1, R2 — Call Graph Construction, Centrality, and Risk Ranking
+ *
+ * Builds a weighted call graph from the `function_calls` table, computes
+ * PageRank and betweenness centrality, and produces a risk ranking.
+ *
+ * All advisory — zero violations. Reports and annotations only.
+ */
+import type Database from 'better-sqlite3';
+import type { RiskEntry, GraphStats } from '../types.js';
+export interface CallGraph {
+    /** Adjacency: nodeId → (neighborId → edgeWeight) */
+    adjacency: Map<number, Map<number, number>>;
+    /** Set of all node IDs in the graph */
+    nodeIds: Set<number>;
+    /** nodeId → function name */
+    nodeNames: Map<number, string>;
+    /** nodeId → file path */
+    nodePaths: Map<number, string>;
+}
+export interface CentralityScores {
+    pageRank: Map<number, number>;
+    betweenness: Map<number, number>;
+    /** Number of pivots sampled (Brandes-Pich when > 0) */
+    betweennessPivotCount: number;
+}
+/**
+ * Build a weighted call graph from the `function_calls` table.
+ *
+ * Resolves `callee_name` TEXT → `functions.id` via name join. Edge weight
+ * is the count of call sites between the same (caller, callee) pair.
+ */
+export declare function buildCallGraph(db: Database.Database): {
+    graph: CallGraph;
+    unresolvedCount: number;
+    unresolvedShare: number;
+};
+/**
+ * Build a call graph from the persistent `graph_cache` table (fast path).
+ */
+export declare function buildCallGraphFromCache(db: Database.Database): {
+    graph: CallGraph;
+    unresolvedCount: number;
+    unresolvedShare: number;
+};
+/**
+ * Populate `graph_cache` with call and import graph edges.
+ * Called after a full sync or scoped sync.
+ */
+export declare function populateCallGraphCache(db: Database.Database): void;
+/**
+ * Compute PageRank on a weighted directed graph.
+ *
+ * Standard iterative algorithm: damping factor 0.85, convergence 1e-6,
+ * max 100 iterations.
+ */
+export declare function computePageRank(adjacency: Map<number, Map<number, number>>, nodeIds: Set<number>, damping?: number, convergence?: number): Map<number, number>;
+/**
+ * Compute Brandes betweenness centrality.
+ *
+ * When `nodeCount <= 2000`, uses exact Brandes.
+ * Above that, uses Brandes-Pich pivot sampling with `BETWEENNESS_PIVOT_COUNT` pivots.
+ * Returns scores and the number of pivots sampled (0 = exact).
+ */
+export declare function computeBetweenness(adjacency: Map<number, Map<number, number>>, nodeIds: Set<number>): {
+    scores: Map<number, number>;
+    pivotCount: number;
+};
+/**
+ * Compute a risk score for every function.
+ *
+ * risk = max(pageRank percentile, betweenness percentile)
+ *      × complexity percentile
+ *      × (1 + untested)  — where untested = 1 if true, 0 otherwise
+ */
+export declare function computeRisk(db: Database.Database, adjacency: Map<number, Map<number, number>>, nodeIds: Set<number>, nodeNames: Map<number, string>, nodePaths: Map<number, string>): RiskEntry[];
+export declare function getGraphStats(db: Database.Database): GraphStats;
+//# sourceMappingURL=callGraph.d.ts.map

package/dist/graph/callGraph.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"callGraph.d.ts","sourceRoot":"","sources":["../../src/graph/callGraph.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAC3C,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAqB,MAAM,aAAa,CAAC;AAI5E,MAAM,WAAW,SAAS;IACxB,oDAAoD;IACpD,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5C,uCAAuC;IACvC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACrB,6BAA6B;IAC7B,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,yBAAyB;IACzB,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,uDAAuD;IACvD,qBAAqB,EAAE,MAAM,CAAC;CAC/B;AAID;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,GAAG;IACrD,KAAK,EAAE,SAAS,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;CACzB,CAwEA;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,GAAG;IAC9D,KAAK,EAAE,SAAS,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;CACzB,CA2CA;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,GAAG,IAAI,CA0BlE;AAID;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAC3C,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,EACpB,OAAO,SAAO,EACd,WAAW,SAAO,GACjB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CA0ErB;AAOD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAC3C,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,GACnB;IAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAsBrD;AA4MD;;;;;;GAMG;AACH,wBAAgB,WAAW,CACzB,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACrB,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAC3C,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,EACpB,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC7B,SAAS,EAAE,CAuEb;AAID,wBAAgB,aAAa,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,GAAG,UAAU,CAgC/D"}