@cejel/cejel 0.1.8 → 0.1.10

package/dist/index.js

@@ -9,7 +9,7 @@ import {
   runCejelScan,
   serializeWitanReport,
   verifyWitanAttestationBinding
-} from "./chunk-SFEPABAX.js";
+} from "./chunk-EFOUXVJE.js";
 
 // src/index.ts
 import { createHash } from "crypto";
@@ -18,16 +18,23 @@ import { join, resolve } from "path";
 import { pathToFileURL } from "url";
 
 // src/terminal.ts
+function renderMinScoreAbstentionFailure(summary, minScore) {
+  if (summary.verdict !== "Insufficient source" && summary.verdict !== "Insufficient evidence") {
+    throw new Error("A minimum-score abstention message requires an abstained Cejel summary.");
+  }
+  return `Cejel: cannot evaluate the required minimum ${minScore.toFixed(1)}/4.0 because this repository has ${summary.verdict.toLowerCase()}.
+`;
+}
 function renderTerminalCertificate(summary) {
-  const abstained = summary.verdict === "Insufficient source";
+  const abstained = summary.verdict === "Insufficient source" || summary.verdict === "Insufficient evidence";
   if (!abstained && (summary.overallScore === null || summary.codeTrustScore === null || summary.processTrustScore === null)) {
     throw new Error("A scored Cejel summary must carry numeric headline scores.");
   }
   const lines = abstained ? [
     `Cejel Trust Certificate \u2014 ${summary.productDisplayName}`,
     "",
-    "Insufficient source to certify.",
-    `  ${summary.insufficientSourceReason ?? "No ratable source was found."}`,
+    `${summary.verdict} to certify.`,
+    `  ${summary.insufficientSourceReason ?? "No ratable source or measurable evidence was found."}`,
     ""
   ] : [
     `Cejel Trust Certificate \u2014 ${summary.productDisplayName}`,
@@ -49,9 +56,13 @@ function renderTerminalCertificate(summary) {
   } else if (summary.topFindings.length === 0) {
     lines.push("No evidence-backed findings.");
   } else {
-    lines.push(`Top findings (${summary.findingCount} total):`);
+    lines.push(
+      `Top findings (${summary.findingCount} total; labels distinguish finding severity from dimension band):`
+    );
     for (const finding of summary.topFindings) {
-      lines.push(`  [${finding.severity}] ${finding.criterionId}: ${finding.summary}`);
+      lines.push(
+        `  [finding severity: ${finding.severity}] ${finding.criterionId} [dimension band: ${finding.dimensionBand}]: ${finding.displaySummary ?? finding.summary}`
+      );
     }
     const remaining = summary.findingCount - summary.topFindings.length;
     if (remaining > 0) {
@@ -96,6 +107,12 @@ var CLI_FLAG_SPECS = [
     description: "exit nonzero below this overall score",
     kind: "minScore"
   },
+  {
+    tokens: ["--name"],
+    value: "<display>",
+    description: "override the project name shown on the certificate",
+    kind: "name"
+  },
   {
     tokens: ["--ingest"],
     value: "<file>",
@@ -195,6 +212,7 @@ async function runWitanFreeCli(args) {
   }
   const { report, summary } = runCejelScan({
     repoPath: options.repoPath,
+    ...options.productDisplayName ? { productDisplayName: options.productDisplayName } : {},
     ingestPatterns: options.ingestPatterns,
     warnOnEmptyIngestMatch: !options.quiet
   });
@@ -229,10 +247,7 @@ Wrote:
   }
   if (options.minScore != null) {
     if (report.verdict === "insufficient_source") {
-      process.stderr.write(
-        `Cejel: cannot evaluate the required minimum ${options.minScore.toFixed(1)}/4.0 because this repository has insufficient source.
-`
-      );
+      process.stderr.write(renderMinScoreAbstentionFailure(summary, options.minScore));
       return 1;
     }
     if (report.overallScore < options.minScore) {
@@ -323,6 +338,7 @@ function parseArgs(args) {
   let repoPath;
   let outDir = DEFAULT_OUT_DIR;
   let minScore;
+  let productDisplayName;
   let quiet = false;
   let showHelp = false;
   let showVersion = false;
@@ -363,6 +379,19 @@ function parseArgs(args) {
           index += 1;
           break;
         }
+        case "name": {
+          const value = args[index + 1];
+          if (!value) throw new Error("Missing value for --name");
+          const trimmed = value.trim();
+          if (trimmed.length === 0 || trimmed.length > 120 || hasUnsafeDisplayNameCharacter(trimmed)) {
+            throw new Error(
+              "--name must be a single printable line containing between 1 and 120 characters"
+            );
+          }
+          productDisplayName = trimmed;
+          index += 1;
+          break;
+        }
         case "ingest": {
           const value = args[index + 1];
           if (!value) throw new Error("Missing value for --ingest");
@@ -383,12 +412,22 @@ function parseArgs(args) {
     repoPath: resolve(repoPath ?? "."),
     outDir,
     ...minScore != null ? { minScore } : {},
+    ...productDisplayName ? { productDisplayName } : {},
     quiet,
     showHelp,
     showVersion,
     ingestPatterns
   };
 }
+function hasUnsafeDisplayNameCharacter(value) {
+  for (const character of value) {
+    const codePoint = character.codePointAt(0);
+    if (codePoint === void 0 || codePoint <= 31 || codePoint >= 127 && codePoint <= 159 || codePoint === 8232 || codePoint === 8233) {
+      return true;
+    }
+  }
+  return false;
+}
 function isEntryPoint() {
   const invokedPath = process.argv[1];
   if (!invokedPath) return false;

package/dist/mcp/index.js

@@ -10,7 +10,7 @@ import {
   renderWitanBadgeSvg,
   renderWitanHtmlReport,
   runCejelScan
-} from "../chunk-SFEPABAX.js";
+} from "../chunk-EFOUXVJE.js";
 
 // node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/compile/codegen/code.js
 var require_code = __commonJS({
@@ -17061,7 +17061,7 @@ function createCejelMcpServer(identity) {
   });
   server.tool(
     "scan",
-    `Score a repository's engineering-trust signals (tests, secrets, isolation, claim-vs-reality, CI discipline) with the ${identity.packageName} trust-certificate scan \u2014 the exact same offline, deterministic scoring as running the ${identity.packageName} CLI on the path. Returns the trust cert as JSON: overall + code/process sub-scores (0-4) for a scored repository, or null scores with an insufficient-source verdict when Cejel cannot read it; plus the verdict and top findings. No network, no telemetry, no signup. After a scan, the full HTML certificate and SVG badge are readable as the resources ${certificateUri} and ${badgeUri}.`,
+    `Score a repository's engineering-trust signals (tests, secrets, isolation, claim-vs-reality, CI discipline) with the ${identity.packageName} trust-certificate scan \u2014 the exact same offline, deterministic scoring as running the ${identity.packageName} CLI on the path. Returns the trust cert as JSON: overall + code/process sub-scores (0-4) for a scored repository, or null scores with an abstention reason when Cejel establishes structural source absence or zero measurable free-core criteria; plus the verdict and top findings. No network, no telemetry, no signup. After a scan, the full HTML certificate and SVG badge are readable as the resources ${certificateUri} and ${badgeUri}.`,
     {
       path: external_exports.string().min(1).describe("Path to the repository to score (absolute, or relative to the server CWD)"),
       format: external_exports.enum(["summary", "json"]).optional().describe(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cejel/cejel",
-  "version": "0.1.8",
+  "version": "0.1.10",
   "mcpName": "io.github.BargLabs/cejel",
   "private": false,
   "publishConfig": {
@@ -44,16 +44,6 @@
   "engines": {
     "node": ">=18"
   },
-  "scripts": {
-    "build": "tsup",
-    "build:sea-js": "tsup --config tsup.public-sea.config.ts",
-    "validate:distribution": "node scripts/validate-distribution-metadata.mjs",
-    "prepublishOnly": "pnpm run build",
-    "prepack": "pnpm run build",
-    "dev": "tsx src/index.ts",
-    "typecheck": "tsc --noEmit -p tsconfig.json",
-    "test": "vitest run"
-  },
   "devDependencies": {
     "@modelcontextprotocol/sdk": "^1.0.0",
     "@types/node": "^25.9.1",
@@ -63,5 +53,13 @@
     "typescript": "^5.5.0",
     "vitest": "^2.0.0",
     "zod": "^3.23.0"
+  },
+  "scripts": {
+    "build": "tsup",
+    "build:sea-js": "tsup --config tsup.public-sea.config.ts",
+    "validate:distribution": "node scripts/validate-distribution-metadata.mjs",
+    "dev": "tsx src/index.ts",
+    "typecheck": "tsc --noEmit -p tsconfig.json",
+    "test": "vitest run"
   }
-}
+}