npm - @copperbox/why - Versions diffs - 1.0.0 - Mend

@copperbox/why 1.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (48) hide show

package/dist/serve-assets.js ADDED Viewed

@@ -0,0 +1,55 @@
+// The `why serve` SPA assets: ui/ sources bundled by esbuild into one JS and
+// one CSS artifact, held in memory and served from there — the okf-mcp
+// `graph html` philosophy (embedded assets, zero CDN/network). Building when
+// the server starts (rather than at package build) keeps the assets exactly
+// in sync with ui/ whether the CLI runs from src/ via tsx or from dist/, and
+// test/serve.test.ts pins the self-containment guarantee: no http(s)://
+// reference may appear in any built asset.
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { build } from "esbuild";
+/** The UI could not be bundled — operational, not a bug in the bundle. */
+export class AssetError extends Error {
+}
+// src/ and dist/ both sit one level below the package root, so this resolves
+// from either layout.
+const UI_DIR = fileURLToPath(new URL("../ui/", import.meta.url));
+/** The page shell; app.js builds the whole UI into #app. */
+const PAGE = `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>why</title>
+<link rel="stylesheet" href="app.css">
+</head>
+<body>
+<div id="app"></div>
+<script src="app.js" defer></script>
+</body>
+</html>
+`;
+/** Bundle ui/ into self-contained in-memory assets. */
+export async function buildUiAssets() {
+    const result = await build({
+        entryPoints: [join(UI_DIR, "app.js"), join(UI_DIR, "style.css")],
+        bundle: true,
+        minify: true,
+        write: false,
+        format: "iife",
+        outdir: UI_DIR, // never written — write: false; only names the outputs
+        logLevel: "silent",
+    });
+    let js = "";
+    let css = "";
+    for (const file of result.outputFiles) {
+        if (file.path.endsWith(".js"))
+            js = file.text;
+        else if (file.path.endsWith(".css"))
+            css = file.text;
+    }
+    if (js === "" || css === "") {
+        throw new AssetError("esbuild produced no JS/CSS output for ui/ — the package's ui/ directory is missing or empty");
+    }
+    return { html: PAGE, js, css };
+}

package/dist/serve.d.ts ADDED Viewed

@@ -0,0 +1,53 @@
+import { type Server } from "node:http";
+/** A request or the server cannot be served honestly; carries the HTTP status. */
+export declare class ServeError extends Error {
+    readonly httpStatus: number;
+    constructor(message: string, httpStatus?: number);
+}
+/** Major versions of the serve-only payloads — policy in docs/ui-contract.md. */
+export declare const FILES_SCHEMA_VERSION = 1;
+export declare const GITBLAME_SCHEMA_VERSION = 1;
+/** `GET /api/files` (schemas/files.schema.json). */
+export interface FilesReport {
+    schemaVersion: typeof FILES_SCHEMA_VERSION;
+    files: string[];
+}
+export interface GitBlameLine {
+    /** Full sha of the commit that last touched this line. */
+    sha: string;
+    author: string;
+    /** Author date, YYYY-MM-DD in the author's timezone. */
+    date: string;
+    /** First line of the commit message. */
+    summary: string;
+    /** The line's content at HEAD, without its newline. */
+    text: string;
+}
+/** `GET /api/blame?path=…` (schemas/gitblame.schema.json). */
+export interface GitBlameReport {
+    schemaVersion: typeof GITBLAME_SCHEMA_VERSION;
+    path: string;
+    /** Full sha the blame ran at — the coverage payload carries the same. */
+    head: string;
+    lines: GitBlameLine[];
+}
+/** Every tracked file at HEAD. Untracked files have no story to show. */
+export declare function buildFileList(repo: string): FilesReport;
+/**
+ * `git blame --porcelain HEAD` for one file, parsed to one entry per line in
+ * file order. Blaming HEAD (not the working tree) keeps line numbers agreeing
+ * with the coverage payload computed at the same HEAD.
+ */
+export declare function buildGitBlame(repo: string, path: string): GitBlameReport;
+export interface ServeOptions {
+    /** Port to bind on 127.0.0.1; default 0 = a random free port. */
+    port?: number;
+}
+export interface RunningWhyServer {
+    server: Server;
+    port: number;
+    url: string;
+    close(): Promise<void>;
+}
+/** Start the UI server on 127.0.0.1. The caller owns printing the URL. */
+export declare function startWhyServer(bundleRoot: string, options?: ServeOptions): Promise<RunningWhyServer>;

package/dist/serve.js ADDED Viewed

@@ -0,0 +1,226 @@
+// `why serve` (issue 502): a localhost-only, read-only window onto the bundle
+// — git blame and why blame side by side. The server is deliberately thin:
+// every endpoint wraps the same library function the CLI uses (buildUiIndex,
+// buildBlameReport, buildGraph, buildDoctorReport) and emits a payload from
+// the UI data contract (docs/ui-contract.md); the SPA is a dumb renderer over
+// those payloads. No endpoint mutates the bundle or the repo: the anchor
+// index is loaded with `write: false`, git calls are read-only plumbing, and
+// non-GET methods are refused outright.
+import { createServer } from "node:http";
+import { dirname } from "node:path";
+import { loadAnchorIndex } from "./anchors.js";
+import { BlameTargetError, buildBlameReport, normalizePath } from "./blame.js";
+import { loadBundle } from "./bundle.js";
+import { buildDoctorReport, buildDoctorSummary } from "./doctor.js";
+import { buildGraph, buildUiIndex, ExportError } from "./export.js";
+import { git } from "./git.js";
+import { buildUiAssets } from "./serve-assets.js";
+/** A request or the server cannot be served honestly; carries the HTTP status. */
+export class ServeError extends Error {
+    httpStatus;
+    constructor(message, httpStatus = 500) {
+        super(message);
+        this.httpStatus = httpStatus;
+    }
+}
+/** Major versions of the serve-only payloads — policy in docs/ui-contract.md. */
+export const FILES_SCHEMA_VERSION = 1;
+export const GITBLAME_SCHEMA_VERSION = 1;
+/** Every tracked file at HEAD. Untracked files have no story to show. */
+export function buildFileList(repo) {
+    const result = git(repo, ["ls-files", "-z"]);
+    if (result.status !== 0) {
+        throw new ServeError(`git ls-files failed in ${repo}: ${result.stderr.trim()}`);
+    }
+    return {
+        schemaVersion: FILES_SCHEMA_VERSION,
+        files: result.stdout.split("\0").filter((path) => path !== ""),
+    };
+}
+/** Author epoch + `+HHMM`-style zone → the author's local calendar date. */
+function isoDate(epochSeconds, tz) {
+    const match = /^([+-])(\d{2})(\d{2})$/.exec(tz);
+    const offset = match
+        ? (match[1] === "-" ? -1 : 1) * (Number(match[2]) * 3600 + Number(match[3]) * 60)
+        : 0;
+    return new Date((epochSeconds + offset) * 1000).toISOString().slice(0, 10);
+}
+/**
+ * `git blame --porcelain HEAD` for one file, parsed to one entry per line in
+ * file order. Blaming HEAD (not the working tree) keeps line numbers agreeing
+ * with the coverage payload computed at the same HEAD.
+ */
+export function buildGitBlame(repo, path) {
+    const head = git(repo, ["rev-parse", "HEAD"]);
+    if (head.status !== 0) {
+        throw new ServeError("no resolvable HEAD — serve blame inside a git repository with at least one commit");
+    }
+    const blame = git(repo, ["blame", "--porcelain", "HEAD", "--", path]);
+    if (blame.status !== 0) {
+        throw new ServeError(`git blame HEAD -- ${path}: ${blame.stderr.trim()}`, 404);
+    }
+    // Porcelain interleaves commit headers, metadata (only on a commit's first
+    // appearance), and tab-prefixed content lines, already in file order.
+    const commits = new Map();
+    const lines = [];
+    let sha = "";
+    for (const raw of blame.stdout.split("\n")) {
+        if (raw.startsWith("\t")) {
+            const commit = commits.get(sha);
+            if (commit === undefined) {
+                throw new ServeError(`git blame emitted a content line before any commit header for ${path}`);
+            }
+            lines.push({
+                sha,
+                author: commit.author,
+                date: isoDate(commit.time, commit.tz),
+                summary: commit.summary,
+                text: raw.slice(1),
+            });
+            continue;
+        }
+        const header = /^([0-9a-f]{40,64}) \d+ \d+/.exec(raw);
+        if (header) {
+            sha = header[1];
+            if (!commits.has(sha))
+                commits.set(sha, { author: "", time: 0, tz: "", summary: "" });
+            continue;
+        }
+        const commit = commits.get(sha);
+        if (commit === undefined)
+            continue; // preamble before the first header
+        if (raw.startsWith("author "))
+            commit.author = raw.slice("author ".length);
+        else if (raw.startsWith("author-time "))
+            commit.time = Number(raw.slice("author-time ".length));
+        else if (raw.startsWith("author-tz "))
+            commit.tz = raw.slice("author-tz ".length);
+        else if (raw.startsWith("summary "))
+            commit.summary = raw.slice("summary ".length);
+    }
+    return { schemaVersion: GITBLAME_SCHEMA_VERSION, path, head: head.stdout.trim(), lines };
+}
+// --- HTTP server ---------------------------------------------------------------
+/** Localhost only — remote access is out of scope by design, not by option. */
+const HOST = "127.0.0.1";
+function sendJson(res, status, payload) {
+    res.writeHead(status, {
+        "content-type": "application/json; charset=utf-8",
+        "cache-control": "no-store",
+    });
+    res.end(`${JSON.stringify(payload, null, 2)}\n`);
+}
+function sendAsset(res, contentType, body) {
+    res.writeHead(200, { "content-type": contentType, "cache-control": "no-store" });
+    res.end(body);
+}
+function requiredParam(url, name) {
+    const value = url.searchParams.get(name);
+    if (value === null || value === "") {
+        throw new ServeError(`missing required query parameter "${name}"`, 400);
+    }
+    return value;
+}
+/** `path` (+ optional 1-based `start`/`end`) → the story target span. */
+function storyTarget(url) {
+    const target = { path: normalizePath(requiredParam(url, "path")) };
+    const start = url.searchParams.get("start");
+    const end = url.searchParams.get("end") ?? start;
+    if (start === null)
+        return target;
+    const lines = { start: Number(start), end: Number(end) };
+    if (!Number.isInteger(lines.start) ||
+        !Number.isInteger(lines.end) ||
+        lines.start < 1 ||
+        lines.end < lines.start) {
+        throw new ServeError(`"start"/"end" must be a 1-based low-high line range, got ${start}-${end}`, 400);
+    }
+    target.lines = lines;
+    return target;
+}
+/**
+ * The JSON API. Bundle-backed endpoints reload the bundle per request, so a
+ * concept edit or a new HEAD shows on the next refresh instead of serving a
+ * silently stale story; `write: false` keeps the index read-only on disk.
+ */
+async function apiPayload(bundleRoot, repo, url) {
+    switch (url.pathname) {
+        case "/api/files":
+            return buildFileList(repo);
+        case "/api/blame":
+            return buildGitBlame(repo, requiredParam(url, "path"));
+        case "/api/coverage": {
+            const bundle = await loadBundle(bundleRoot);
+            const { index } = await loadAnchorIndex(bundle, { write: false });
+            return buildUiIndex(bundle, index);
+        }
+        case "/api/story": {
+            const bundle = await loadBundle(bundleRoot);
+            const { index } = await loadAnchorIndex(bundle, { write: false });
+            return buildBlameReport(bundle, storyTarget(url), index);
+        }
+        case "/api/graph":
+            return buildGraph(await loadBundle(bundleRoot));
+        case "/api/doctor":
+            return buildDoctorSummary(await buildDoctorReport(await loadBundle(bundleRoot)));
+        default:
+            return undefined;
+    }
+}
+async function handle(bundleRoot, repo, assets, req, res) {
+    if (req.method !== "GET" && req.method !== "HEAD") {
+        sendJson(res, 405, { error: "read-only server — GET only" });
+        return;
+    }
+    const url = new URL(req.url ?? "/", `http://${HOST}`);
+    switch (url.pathname) {
+        case "/":
+            sendAsset(res, "text/html; charset=utf-8", assets.html);
+            return;
+        case "/app.js":
+            sendAsset(res, "text/javascript; charset=utf-8", assets.js);
+            return;
+        case "/app.css":
+            sendAsset(res, "text/css; charset=utf-8", assets.css);
+            return;
+    }
+    try {
+        const payload = await apiPayload(bundleRoot, repo, url);
+        if (payload === undefined) {
+            sendJson(res, 404, { error: `no such endpoint: ${url.pathname}` });
+            return;
+        }
+        sendJson(res, 200, payload);
+    }
+    catch (e) {
+        if (e instanceof ServeError)
+            sendJson(res, e.httpStatus, { error: e.message });
+        else if (e instanceof BlameTargetError)
+            sendJson(res, 400, { error: e.message });
+        else if (e instanceof ExportError)
+            sendJson(res, 500, { error: e.message });
+        else
+            sendJson(res, 500, { error: e instanceof Error ? e.message : String(e) });
+    }
+}
+/** Start the UI server on 127.0.0.1. The caller owns printing the URL. */
+export async function startWhyServer(bundleRoot, options = {}) {
+    const repo = dirname(bundleRoot);
+    const assets = await buildUiAssets();
+    const server = createServer((req, res) => {
+        handle(bundleRoot, repo, assets, req, res).catch(() => res.destroy());
+    });
+    await new Promise((resolve, reject) => {
+        server.once("error", (e) => reject(new ServeError(`cannot bind ${HOST}:${options.port ?? 0} — ${e.message}`)));
+        server.listen(options.port ?? 0, HOST, resolve);
+    });
+    const { port } = server.address();
+    return {
+        server,
+        port,
+        url: `http://${HOST}:${port}/`,
+        close: () => new Promise((resolve, reject) => {
+            server.close((e) => (e ? reject(e) : resolve()));
+        }),
+    };
+}

package/dist/trace-range.d.ts ADDED Viewed

@@ -0,0 +1,22 @@
+export interface LineRange {
+    /** 1-based, inclusive. */
+    start: number;
+    end: number;
+}
+export interface RangeAnchor {
+    /** Repo-relative POSIX path, valid at `asOf`. */
+    path: string;
+    lines: LineRange;
+    /** Commit-ish at which `path` + `lines` were valid. Must be an ancestor of HEAD. */
+    asOf: string;
+}
+export type LostReason = "file-deleted" | "content-rewritten";
+export type TraceResult = {
+    lost: false;
+    path: string;
+    lines: LineRange;
+} | {
+    lost: true;
+    reason: LostReason;
+};
+export declare function traceRange(repo: string, anchor: RangeAnchor): TraceResult;

package/dist/trace-range.js ADDED Viewed

@@ -0,0 +1,216 @@
+// Blame-trace resolver (DESIGN.md §4, resolution order step 2).
+//
+// Given an anchor claim {path, lines, as_of} — "at commit as_of, this concept
+// was about these lines" — compute where those lines live at HEAD, or prove
+// they are gone. Pure library function: no bundle knowledge, read-only git
+// commands only.
+//
+// Approach: `git log -L` cannot express this query (it interprets both the
+// range and the path at the *newest* revision, not at as_of, so it mistraces
+// or drops the anchor). Instead we walk a parent→child commit chain from as_of to
+// HEAD (see commitChain) and apply each step's zero-context diff hunks to the
+// tracked range:
+//
+//   - hunks entirely above the range shift it;
+//   - hunks overlapping the range kill the overlapped lines;
+//   - renames (git diff --find-renames) update the tracked path;
+//   - a delete of the tracked path is `lost: "file-deleted"`;
+//   - all lines killed is `lost: "content-rewritten"`.
+//
+// Shrink policy for partially-edited ranges: every anchored line is tracked
+// individually; the result is the *bounding span* of the lines that survived
+// (first surviving line .. last surviving line at HEAD). Interior edits and
+// insertions therefore widen or preserve the span rather than splitting the
+// anchor — an anchor on a function whose body was partially edited should
+// still cover the function. Lines at the edges only survive-or-die; the span
+// never includes unrelated code above or below the original claim.
+//
+// Never-silently-wrong guarantee: before returning a live result, every
+// surviving line's content at HEAD is compared byte-for-byte with its content
+// at as_of. Any line that fails verification is dropped; if none survive the
+// check, the result is `lost: "content-rewritten"`. A wrong range cannot be
+// emitted by hunk-math bugs alone — it would have to survive this check too.
+import { gitOrThrow, resolveAsOfCommit, showLines } from "./git.js";
+/** How `path` changed between `from` and `to`, or null if untouched. */
+function fileChange(repo, from, to, path) {
+    const out = gitOrThrow(repo, ["diff", "--name-status", "--find-renames", "-z", from, to]);
+    const tokens = out.split("\0");
+    let i = 0;
+    while (i < tokens.length && tokens[i] !== "") {
+        const status = tokens[i++];
+        const kind = status[0];
+        if (kind === "R" || kind === "C") {
+            const oldPath = tokens[i++];
+            const newPath = tokens[i++];
+            if (kind === "R" && oldPath === path)
+                return { status: "R", newPath };
+        }
+        else {
+            const p = tokens[i++];
+            if (p === path && (kind === "M" || kind === "D" || kind === "T")) {
+                return { status: kind, newPath: null };
+            }
+        }
+    }
+    return null;
+}
+/**
+ * Zero-context hunks for `path` (old side) between `from` and `to`.
+ * The diff is pathspec-limited to the old and new names, then the section
+ * whose old path matches is selected — pathspec alone could match another
+ * file that was renamed onto one of these names in the same commit.
+ */
+function hunksFor(repo, from, to, oldPath, newPath) {
+    const paths = oldPath === newPath ? [oldPath] : [oldPath, newPath];
+    const out = gitOrThrow(repo, [
+        "diff",
+        "--unified=0",
+        "--find-renames",
+        from,
+        to,
+        "--",
+        ...paths,
+    ]);
+    const sections = out.split(/^(?=diff --git )/m);
+    for (const section of sections) {
+        const fromRename = section.match(/^rename from (.*)$/m)?.[1];
+        const fromMinus = section.match(/^--- a\/(.*)$/m)?.[1];
+        if ((fromRename ?? fromMinus) !== oldPath)
+            continue;
+        const hunks = [];
+        const re = /^@@ -(\d+)(?:,(\d+))? \+\d+(?:,(\d+))? @@/gm;
+        let m;
+        while ((m = re.exec(section)) !== null) {
+            hunks.push({
+                oldStart: Number(m[1]),
+                oldCount: m[2] === undefined ? 1 : Number(m[2]),
+                newCount: m[3] === undefined ? 1 : Number(m[3]),
+            });
+        }
+        return hunks;
+    }
+    return [];
+}
+/**
+ * Apply one commit-step's hunks to the tracked lines. All hunk positions
+ * refer to the pre-step file, so deltas are computed against each line's
+ * pre-step `cur` and applied at once.
+ */
+function applyHunks(lines, hunks) {
+    const survivors = [];
+    for (const line of lines) {
+        let delta = 0;
+        let killed = false;
+        for (const h of hunks) {
+            if (h.oldCount === 0) {
+                // Pure insertion after old line `oldStart` (0 = top of file).
+                if (h.oldStart < line.cur)
+                    delta += h.newCount;
+                continue;
+            }
+            const oldEnd = h.oldStart + h.oldCount - 1;
+            if (line.cur >= h.oldStart && line.cur <= oldEnd) {
+                killed = true;
+                break;
+            }
+            if (line.cur > oldEnd)
+                delta += h.newCount - h.oldCount;
+        }
+        if (!killed)
+            survivors.push({ orig: line.orig, cur: line.cur + delta });
+    }
+    return survivors;
+}
+/**
+ * Parent→child commit chain from asOf (exclusive) to HEAD (inclusive), each
+ * element a child of the one before it, preferring first parents.
+ *
+ * `rev-list --first-parent asOf..HEAD` is not usable here: it lists HEAD's
+ * first-parent chain, so when asOf is reachable from HEAD only through a
+ * merge's *second* parent (anchor created on a feature branch, branch later
+ * merged — the normal workflow), consecutive listed commits are not parent
+ * and child of each other, and diffing them reads branch divergence as edits:
+ * a false `lost` verdict for content that is alive at HEAD. Instead, walk
+ * backwards from HEAD through the ancestry-path graph, descending at each
+ * merge into the first parent that still leads to asOf.
+ */
+function commitChain(repo, asOfSha) {
+    const out = gitOrThrow(repo, ["rev-list", "--ancestry-path", "--parents", `${asOfSha}..HEAD`]);
+    // Commits that are both descendants of asOf and ancestors of HEAD, each
+    // mapped to its parents (which may lie outside that set).
+    const parentsOf = new Map();
+    for (const line of out.split("\n")) {
+        if (line === "")
+            continue;
+        const [sha, ...parents] = line.split(" ");
+        parentsOf.set(sha, parents);
+    }
+    if (parentsOf.size === 0)
+        return []; // asOf is HEAD itself
+    const chain = [];
+    let cur = gitOrThrow(repo, ["rev-parse", "HEAD"]).trim();
+    while (cur !== asOfSha) {
+        chain.push(cur);
+        const next = parentsOf.get(cur)?.find((p) => p === asOfSha || parentsOf.has(p));
+        if (next === undefined) {
+            // Unreachable: resolveAsOfCommit guarantees asOf is an ancestor of
+            // HEAD, so every commit on an ancestry path has a parent on one.
+            throw new Error(`no parent chain from HEAD back to as_of ${asOfSha}`);
+        }
+        cur = next;
+    }
+    return chain.reverse();
+}
+export function traceRange(repo, anchor) {
+    const { path, lines, asOf } = anchor;
+    if (!Number.isInteger(lines.start) ||
+        !Number.isInteger(lines.end) ||
+        lines.start < 1 ||
+        lines.end < lines.start) {
+        throw new Error(`invalid line range ${lines.start}-${lines.end} (need 1 <= start <= end)`);
+    }
+    const asOfSha = resolveAsOfCommit(repo, asOf);
+    const origLines = showLines(repo, asOfSha, path);
+    if (origLines === null) {
+        throw new Error(`path "${path}" not found at as_of ${asOf}`);
+    }
+    if (lines.end > origLines.length) {
+        throw new Error(`range ${lines.start}-${lines.end} out of bounds: "${path}" has ${origLines.length} lines at as_of ${asOf}`);
+    }
+    let tracked = [];
+    for (let n = lines.start; n <= lines.end; n++)
+        tracked.push({ orig: n, cur: n });
+    let curPath = path;
+    const commits = commitChain(repo, asOfSha);
+    let prev = asOfSha;
+    for (const commit of commits) {
+        const change = fileChange(repo, prev, commit, curPath);
+        if (change !== null) {
+            if (change.status === "D")
+                return { lost: true, reason: "file-deleted" };
+            // Typechange (file became a symlink/submodule): the lines no longer
+            // exist as text content.
+            if (change.status === "T")
+                return { lost: true, reason: "content-rewritten" };
+            const newPath = change.newPath ?? curPath;
+            tracked = applyHunks(tracked, hunksFor(repo, prev, commit, curPath, newPath));
+            curPath = newPath;
+            if (tracked.length === 0)
+                return { lost: true, reason: "content-rewritten" };
+        }
+        prev = commit;
+    }
+    // Verification pass: the never-silently-wrong backstop. Only lines whose
+    // HEAD content matches their as_of content count as survivors.
+    const headLines = showLines(repo, "HEAD", curPath);
+    if (headLines === null)
+        return { lost: true, reason: "file-deleted" };
+    const verified = tracked.filter((l) => l.cur >= 1 && l.cur <= headLines.length && headLines[l.cur - 1] === origLines[l.orig - 1]);
+    if (verified.length === 0)
+        return { lost: true, reason: "content-rewritten" };
+    return {
+        lost: false,
+        path: curPath,
+        lines: { start: verified[0].cur, end: verified[verified.length - 1].cur },
+    };
+}

package/package.json ADDED Viewed

@@ -0,0 +1,44 @@
+{
+  "name": "@copperbox/why",
+  "version": "1.0.0",
+  "description": "Decision archaeology for codebases — recover, anchor, and audit the why behind code.",
+  "type": "module",
+  "license": "MIT",
+  "bin": {
+    "why": "dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "ui"
+  ],
+  "scripts": {
+    "why": "tsx src/cli.ts",
+    "typecheck": "tsc --noEmit",
+    "test": "tsx --test test/*.test.ts",
+    "test:torture": "tsx --test test/torture/torture.test.ts",
+    "test:e2e": "tsx --test test/e2e/*.e2e.test.ts",
+    "test:vscode": "tsx --test vscode-why/test/*.test.ts",
+    "verify": "npm run typecheck && npm run test && npm run test:vscode",
+    "build": "tsc -p tsconfig.build.json",
+    "sandcastle": "tsx .sandcastle/main.mts",
+    "sandcastle:loop": "scripts/sandcastle-loop.sh",
+    "sandcastle:gate": "tsx .sandcastle/gatekeeper.mts",
+    "sandcastle:auto": "scripts/autonomous-loop.sh"
+  },
+  "devDependencies": {
+    "@copperbox/sandcastle-workflow": "^0.4.2",
+    "@types/jsdom": "^28.0.3",
+    "@types/node": "^22.10.0",
+    "ajv": "^8.20.0",
+    "jsdom": "^29.1.1",
+    "tsx": "^4.19.0",
+    "typescript": "^5.7.0",
+    "yaml": "^2.9.0"
+  },
+  "dependencies": {
+    "@copperbox/okf-mcp": "^0.19.1",
+    "esbuild": "0.28.1",
+    "tree-sitter-wasms": "0.1.13",
+    "web-tree-sitter": "0.24.7"
+  }
+}