@cejel/cejel 0.4.2 → 0.4.3

package/README.md

@@ -68,7 +68,7 @@ if (-not $expected -or $actual -ne $expected.ToLowerInvariant()) {
 ```
 
 > **Windows signing status:** `cejel-Windows-x86_64.exe` is intentionally unsigned in
-> 0.4.2 and may trigger Microsoft SmartScreen. The release build removes Node's inherited
+> 0.4.3 and may trigger Microsoft SmartScreen. The release build removes Node's inherited
 > signature before SEA injection and fails unless Windows reports the result as `NotSigned`;
 > it does not ship an invalid signature. Before running it, verify `SHA256SUMS` and the
 > GitHub build-provenance attestation. Each binary also has an attached SPDX SBOM and an
@@ -91,7 +91,7 @@ docker run --rm --network=none -v "$PWD:/w" -w /w -v "$PWD/cejel:/cejel:ro" debi
 npx @cejel/cejel@latest .
 ```
 
-> **Distribution note:** Cejel `0.4.2` is the coordinated release version for npm,
+> **Distribution note:** Cejel `0.4.3` is the coordinated release version for npm,
 > standalone binaries, Docker/OCI, GitHub Action, Homebrew, and MCP Registry.
 
 `npx` can reuse a stale cached package. Force the current npm release with the `@latest`
@@ -105,7 +105,7 @@ If a root `package.json` still carries a template name, override only the certif
 name while keeping the repository-derived stable slug:
 
 ```bash
-npx @cejel/cejel . --name "Customer Portal"
+npx @cejel/cejel@latest . --name "Customer Portal"
 ```
 
 The npm package is scoped as `@cejel/cejel`; its executable remains the short command `cejel`.
@@ -140,16 +140,16 @@ gh attestation verify ./cejel-Windows-x86_64.exe -R BargLabs/cejel
 This is cryptographically signed provenance. It is distinct from Apple Developer ID or
 Microsoft Authenticode code-signing.
 
-**Docker / OCI.** The current container release is `0.4.2`:
+**Docker / OCI.** The current container release is `0.4.3`:
 
 ```bash
-docker run --rm -i -v "$PWD:/workspace:ro" ghcr.io/barglabs/cejel:0.4.2
+docker run --rm -i -v "$PWD:/workspace:ro" ghcr.io/barglabs/cejel:0.4.3
 ```
 
 The image defaults to `cejel-mcp` over stdio. To use the CLI instead:
 
 ```bash
-docker run --rm -v "$PWD:/workspace:ro" --entrypoint cejel ghcr.io/barglabs/cejel:0.4.2 .
+docker run --rm -v "$PWD:/workspace:ro" --entrypoint cejel ghcr.io/barglabs/cejel:0.4.3 .
 ```
 
 The OCI image carries an SBOM, maximum-mode build provenance, and a signed registry
@@ -162,7 +162,7 @@ projects, the public Cejel repository itself, and one explicitly labeled transpa
 snapshot from the private studio monorepo where Cejel was built, with a per-repository
 evidence report for every row under [`leaderboard/reports/`](./leaderboard/reports/). The
 board is also hosted at [cejel.dev](https://cejel.dev). Every score is produced by the same
-sealed public scorer used by `npx @cejel/cejel .`; no private domain collector contributes.
+sealed public scorer used by `npx @cejel/cejel@latest .`; no private domain collector contributes.
 For each public-repository row, check out the immutable source commit printed in its report
 and run the public scorer to reproduce the score, verdict, measured coverage, and evidence.
 The private Alfred snapshot discloses its limitation instead: its source commit and withheld
@@ -426,7 +426,7 @@ The OCI image is an alternative when Docker is the preferred execution boundary.
 the host path with the repository OpenClaw should allow Cejel to read:
 
 ```bash
-openclaw mcp set cejel-oci '{"command":"docker","args":["run","--rm","-i","-v","/absolute/path/to/repo:/workspace:ro","ghcr.io/barglabs/cejel:0.4.2"]}'
+openclaw mcp set cejel-oci '{"command":"docker","args":["run","--rm","-i","-v","/absolute/path/to/repo:/workspace:ro","ghcr.io/barglabs/cejel:0.4.3"]}'
 openclaw mcp doctor cejel-oci --probe
 ```
 

package/dist/{chunk-WLOMKEFR.js → chunk-ITHPLYKX.js}

@@ -4771,6 +4771,11 @@ function isCoverageNotMeasured(criterion, metric2) {
     ...criterion.findings.map((finding) => finding.evidence)
   ].some((evidence) => evidence.kind === "coverage");
 }
+function labelAlreadyStatesUnit(label, unit) {
+  if (!unit) return false;
+  const escapedUnit = unit.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return new RegExp(`(?:^|[\\s-])${escapedUnit}$`, "i").test(label.trim());
+}
 function formatCertificateMetricValue(criterion, metric2) {
   if (isCoverageNotMeasured(criterion, metric2)) {
     return "no coverage report found \u2014 not measured";
@@ -4781,7 +4786,7 @@ function formatCertificateMetricValue(criterion, metric2) {
     const comparison = `${tests} test file${metric2.value === 1 ? "" : "s"} / ${sources} source file${metric2.max === 1 ? "" : "s"}`;
     return metric2.value > metric2.max ? `${comparison} (credit capped at parity)` : comparison;
   }
-  const displayUnit = metric2.name === "prod_readiness_primitives" || metric2.name === "pr_trace_primitives" ? "checks" : metric2.unit;
+  const displayUnit = metric2.name === "prod_readiness_primitives" || metric2.name === "pr_trace_primitives" ? "checks" : labelAlreadyStatesUnit(formatCertificateMetricLabel(metric2), metric2.unit) ? void 0 : metric2.unit;
   const unit = displayUnit ? ` ${displayUnit}` : "";
   if (metric2.max === void 0) return `${formatMetricNumber(metric2.value)}${unit}`;
   if (metric2.kind === "saturating_count" && metric2.value > metric2.max) {
@@ -4892,7 +4897,7 @@ function renderFindingSummary(criterion, finding) {
   return `${criterion.id} dimension band is ${band} at ${score}/4.0. Lowest contributing measurements: ${measurements}. To improve: ${actions}.`;
 }
 function selectLowestDrivers(metrics) {
-  return [...metrics].filter((metric2) => metric2.max !== void 0).sort((left, right) => {
+  return [...metrics].filter((metric2) => metric2.max !== void 0 && normalizedMetricValue(metric2) < 1).sort((left, right) => {
     const leftRatio = normalizedMetricValue(left);
     const rightRatio = normalizedMetricValue(right);
     if (leftRatio !== rightRatio) return leftRatio - rightRatio;
@@ -5345,11 +5350,12 @@ h3 { font-size: 15px; line-height: 1.35; font-weight: 600; margin-bottom: 0; }
 .term-help { position: relative; cursor: help; outline: none; }
 .term-help:focus-visible { box-shadow: 0 0 0 2px var(--periwinkle); border-radius: 3px; }
 .term-tooltip {
-  position: absolute; z-index: 10; left: 0; bottom: calc(100% + 8px); width: min(320px, 75vw);
+  position: absolute; z-index: 100; left: 0; bottom: calc(100% + 8px); width: min(320px, 75vw);
   visibility: hidden; opacity: 0; pointer-events: none; white-space: normal;
   border: 1px solid var(--line-strong); border-radius: 6px; padding: 9px 11px;
   background: #101b2a; color: var(--text); font-family: var(--sans); font-size: 12px;
   font-weight: 400; line-height: 1.45; text-transform: none; letter-spacing: normal;
+  box-shadow: 0 10px 28px rgba(0, 0, 0, .55);
   transition: opacity .12s ease;
 }
 .term-help:hover > .term-tooltip, .term-help:focus-within > .term-tooltip { visibility: visible; opacity: 1; }
@@ -7128,7 +7134,7 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors) {
     metrics: [
       metric(
         "prod_readiness_primitives",
-        "Production-readiness primitive coverage",
+        "Production-readiness basic checks",
         [
           packageJson && (scripts.has("build") || scripts.has("typecheck")),
           workflows.length > 0,
@@ -7139,8 +7145,8 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors) {
         ].filter(Boolean).length,
         6,
         0.55,
-        "primitives",
-        "Counts distinct static production-readiness primitives instead of treating presence as enough."
+        "checks",
+        "Counts distinct static production-readiness checks instead of treating presence as enough."
       ),
       metric(
         "prod_workflow_depth",
@@ -7481,7 +7487,7 @@ function collectB2PrTraceEvidence(repoPath, repoFiles) {
       // sat well under half credit here even with a healthy PR-trace posture.
       metric(
         "pr_trace_primitives",
-        "PR trace primitive coverage",
+        "PR trace basic checks",
         workflows.length + (prTemplate ? 1 : 0) + (branchProtectionDoc ? 1 : 0),
         2,
         0.8,
@@ -11337,7 +11343,7 @@ function renderFindingSummary2(criterion, finding) {
   return `${criterion.id} dimension band is ${band} at ${score}/4.0. Lowest contributing measurements: ${measurements}. To improve: ${actions}.`;
 }
 function selectLowestDrivers2(metrics) {
-  return [...metrics].filter((metric2) => metric2.max !== void 0).sort((left, right) => {
+  return [...metrics].filter((metric2) => metric2.max !== void 0 && normalizedMetricValue2(metric2) < 1).sort((left, right) => {
     const leftRatio = normalizedMetricValue2(left);
     const rightRatio = normalizedMetricValue2(right);
     if (leftRatio !== rightRatio) return leftRatio - rightRatio;

package/dist/index.js

@@ -15,7 +15,7 @@ import {
   runCejelScan,
   serializeWitanReport,
   verifyWitanAttestationBinding
-} from "./chunk-WLOMKEFR.js";
+} from "./chunk-ITHPLYKX.js";
 import {
   init_esm_shims
 } from "./chunk-LZVKQV3R.js";

package/dist/mcp/index.js

@@ -9,7 +9,7 @@ import {
   renderWitanBadgeSvg,
   renderWitanHtmlReport,
   runCejelScan
-} from "../chunk-WLOMKEFR.js";
+} from "../chunk-ITHPLYKX.js";
 import {
   __commonJS,
   __export,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cejel/cejel",
-  "version": "0.4.2",
+  "version": "0.4.3",
   "mcpName": "io.github.BargLabs/cejel",
   "private": false,
   "publishConfig": {