@cejel/cejel 0.4.5 → 0.4.6

package/README.md

@@ -79,7 +79,7 @@ if (-not $expected -or $actual -ne $expected.ToLowerInvariant()) {
 ```
 
 > **Windows signing status:** `cejel-Windows-x86_64.exe` is intentionally unsigned in
-> 0.4.5 and may trigger Microsoft SmartScreen. The release build removes Node's inherited
+> 0.4.6 and may trigger Microsoft SmartScreen. The release build removes Node's inherited
 > signature before SEA injection and fails unless Windows reports the result as `NotSigned`;
 > it does not ship an invalid signature. Before running it, verify `SHA256SUMS` and the
 > GitHub build-provenance attestation. Each binary also has an attached SPDX SBOM and an
@@ -102,7 +102,7 @@ docker run --rm --network=none -v "$PWD:/w" -w /w -v "$PWD/cejel:/cejel:ro" debi
 npx @cejel/cejel@latest .
 ```
 
-> **Distribution note:** Cejel `0.4.5` is the coordinated release version for npm,
+> **Distribution note:** Cejel `0.4.6` is the coordinated release version for npm,
 > standalone binaries, Docker/OCI, GitHub Action, Homebrew, and MCP Registry.
 
 `npx` can reuse a stale cached package. Force the current npm release with the `@latest`
@@ -139,6 +139,9 @@ The npm package is scoped as `@cejel/cejel`; its executable remains the short co
     min-score: "2.5"   # optional: fail the build below this
 ```
 
+For an executed public example that binds a release artifact to the same commit named by its
+Cejel certificate, see [Certified releases with GitHub build provenance](./docs/certified-release-example.md).
+
 **From source** — it is AGPL and it runs offline, so reading it is rather the point:
 
 ```bash
@@ -161,16 +164,16 @@ gh attestation verify ./cejel-Windows-x86_64.exe -R BargLabs/cejel
 This is cryptographically signed provenance. It is distinct from Apple Developer ID or
 Microsoft Authenticode code-signing.
 
-**Docker / OCI.** The current container release is `0.4.5`:
+**Docker / OCI.** The current container release is `0.4.6`:
 
 ```bash
-docker run --rm -i -v "$PWD:/workspace:ro" ghcr.io/barglabs/cejel:0.4.5
+docker run --rm -i -v "$PWD:/workspace:ro" ghcr.io/barglabs/cejel:0.4.6
 ```
 
 The image defaults to `cejel-mcp` over stdio. To use the CLI instead:
 
 ```bash
-docker run --rm -v "$PWD:/workspace:ro" --entrypoint cejel ghcr.io/barglabs/cejel:0.4.5 .
+docker run --rm -v "$PWD:/workspace:ro" --entrypoint cejel ghcr.io/barglabs/cejel:0.4.6 .
 ```
 
 The OCI image carries an SBOM, maximum-mode build provenance, and a signed registry
@@ -348,6 +351,7 @@ Three ways a scanner's output gets ingested:
 
    ```json
    {
+     "version": "1.0",
      "tool": "my-scanner",
      "signals": [
        {
@@ -370,6 +374,12 @@ Three ways a scanner's output gets ingested:
    (0–1, default `0.5`) bounds how much this signal can move that dimension; `severity` is
    `critical` | `warning` | `info`; `location` is optional.
 
+   The version field is required. Cejel rejects unversioned generic documents and unknown major
+   versions rather than guessing. See the [generic ingest contract](docs/ingest-contract.md), its
+   [published JSON Schema](docs/schemas/cejel-ingest-v1.schema.json), and the
+   [synthetic CI heal-log mapping](docs/heal-log-mapping.md). Output-field stability and version
+   routing are documented in [format stability](docs/format-stability.md).
+
 ## Displaying the trust badge
 
 Endpoint JSON (host `badge.json` anywhere static — a repo file, a gist, GitHub Pages — and
@@ -485,7 +495,7 @@ The OCI image is an alternative when Docker is the preferred execution boundary.
 the host path with the repository OpenClaw should allow Cejel to read:
 
 ```bash
-npx -y openclaw@latest mcp set cejel-oci '{"command":"docker","args":["run","--rm","-i","-v","/absolute/path/to/repo:/workspace:ro","ghcr.io/barglabs/cejel:0.4.5"]}'
+npx -y openclaw@latest mcp set cejel-oci '{"command":"docker","args":["run","--rm","-i","-v","/absolute/path/to/repo:/workspace:ro","ghcr.io/barglabs/cejel:0.4.6"]}'
 npx -y openclaw@latest mcp doctor cejel-oci --probe
 ```
 

package/dist/calibration/llm-detector.js

@@ -5,20 +5,20 @@ import {
   deriveProductIdentity,
   runCejelScan,
   serializeWitanReport
-} from "../chunk-4IXESHG7.js";
+} from "../chunk-VEJLHO5F.js";
 import {
   listCejelLlmPackFiles
-} from "../chunk-RW6YJVHZ.js";
-import "../chunk-EPK7UTIK.js";
+} from "../chunk-QRWLHTGR.js";
+import "../chunk-BZXBLDCJ.js";
 import {
   external_exports
-} from "../chunk-KGFGX3TP.js";
+} from "../chunk-Y6NO5HAI.js";
 import {
   init_esm_shims,
   readRepoText,
   recordContentSkip,
   recordFilesystemSkip
-} from "../chunk-R4DPQLS2.js";
+} from "../chunk-H55KECVT.js";
 
 // src/calibration/llm-detector.ts
 init_esm_shims();

package/dist/{chunk-EW6NAHE4.js → chunk-2IBG5OBF.js}

@@ -7,7 +7,7 @@ import {
   __filename,
   __require,
   init_esm_shims
-} from "./chunk-R4DPQLS2.js";
+} from "./chunk-H55KECVT.js";
 
 // node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/typescript.js
 var require_typescript = __commonJS({

package/dist/{chunk-EPK7UTIK.js → chunk-BZXBLDCJ.js}

@@ -3,7 +3,7 @@ import { createRequire as __cejelCreateRequire } from 'node:module';
 const require = __cejelCreateRequire(import.meta.url);
 import {
   init_esm_shims
-} from "./chunk-R4DPQLS2.js";
+} from "./chunk-H55KECVT.js";
 
 // src/witan/git-exec.ts
 init_esm_shims();

package/dist/{chunk-R4DPQLS2.js → chunk-H55KECVT.js}

@@ -54,6 +54,10 @@ var init_esm_shims = __esm({
   }
 });
 
+// src/filesystem-limits.ts
+init_esm_shims();
+var MAX_REPOSITORY_CONTENT_BYTES = 512e3;
+
 // src/witan/content-reads.ts
 init_esm_shims();
 import { closeSync, lstatSync, openSync, readFileSync, readSync } from "fs";
@@ -145,6 +149,13 @@ function withContentReadCriterion(criterion, collect) {
 function recordContentSkip(path2, reason, deduplicate = false) {
   recordSkip(path2, reason, void 0, false, deduplicate);
 }
+function recordContentSkipForCriteria(path2, reason, criteria, deduplicate = false) {
+  const session = activeSession;
+  if (session) {
+    for (const criterion of criteria) session.affectedCriteria.add(criterion);
+  }
+  recordSkip(path2, reason, void 0, false, deduplicate);
+}
 function recordFilesystemSkip(path2, error, deniedContext = false, deduplicate = true) {
   const errno = errnoClass(error);
   if (!errno) throw error;
@@ -161,6 +172,10 @@ function readRepoText(path2, encoding = "utf8") {
       recordSkip(path2, "non_regular_file", void 0, true, true);
       return "";
     }
+    if (stat.size > MAX_REPOSITORY_CONTENT_BYTES) {
+      recordSkip(path2, "too_large", void 0, true, true);
+      return "";
+    }
   } catch (error) {
     recordFilesystemSkip(path2, error);
     return "";
@@ -211,9 +226,11 @@ export {
   __dirname,
   __filename,
   init_esm_shims,
+  MAX_REPOSITORY_CONTENT_BYTES,
   trackContentReads,
   withContentReadCriterion,
   recordContentSkip,
+  recordContentSkipForCriteria,
   recordFilesystemSkip,
   readRepoText,
   readRepoTextPrefix

package/dist/{chunk-RW6YJVHZ.js → chunk-QRWLHTGR.js}

@@ -5,10 +5,10 @@ import {
   describeGitFailure,
   execGit,
   isExpectedGitAbsence
-} from "./chunk-EPK7UTIK.js";
+} from "./chunk-BZXBLDCJ.js";
 import {
   init_esm_shims
-} from "./chunk-R4DPQLS2.js";
+} from "./chunk-H55KECVT.js";
 
 // src/packs/llm/files.ts
 init_esm_shims();