@diffci.com/diffci 0.1.0-alpha.3

package/dist-client/src/repo/layout.js

@@ -0,0 +1,75 @@
+/**
+ * What do this repository's directories MEAN? (Phase 01 follow-up, 2026-08-26.)
+ *
+ * WHY. After the first Phase 01 pass the engine named no particular repository, but it still
+ * *described* one. `src/repo/impact.ts` answered "is this a script?" with
+ * `path.startsWith("scripts/") || path.startsWith("ops/")` and "is this documentation?" with
+ * `startsWith("docs/")` - DiffCI's own directory vocabulary, applied to every repository regardless
+ * of what that repository actually has. A project keeping its tooling in `tools/` or `bin/` had
+ * those files classified as ordinary source; a project with no `ops/` had a rule that could never
+ * fire. And the Next.js entry-point rules ran everywhere: `classifyNextEntryPoint()` was called
+ * without checking whether the repository was a Next.js app at all, so any file named `route.ts`,
+ * `error.ts` or `page.ts` acquired Next.js semantics. Measured across the Phase 01 cohort, that
+ * mislabelled files in five of nine repositories - `unjs/h3` alone has seven, where `route` and
+ * `error` are HTTP concepts and nothing to do with Next.
+ *
+ * WHAT THIS IS. One place that turns a RepositoryProfile into answers about THAT repository's
+ * layout. Two kinds of input, and the distinction matters:
+ *
+ *   - DISCOVERED: `profile.sourceRoots` records the directories this repository actually has, with
+ *     the kind they were discovered as. A `scripts` root exists here only if the repository has one.
+ *   - CONVENTIONAL: a small list of names that mean the same thing across the ecosystem (`docs/`,
+ *     `doc/`, `documentation/`). These are conventions, not one repository's invention, and they are
+ *     applied only as names - never as an assumption that the directory exists.
+ *
+ * What is NOT here: anything derived from a specific repository's habits.
+ */
+import { extname } from "node:path";
+/**
+ * Directory names that mean "documentation" across the ecosystem. Deliberately short: a name earns a
+ * place here by being a convention many projects share, not by appearing in one repository.
+ */
+const CONVENTIONAL_DOC_DIRECTORIES = ["docs", "doc", "documentation"];
+function normalizeRoot(root) {
+    return root.replace(/\\/g, "/").replace(/^\.\//, "").replace(/\/+$/, "");
+}
+function isUnder(path, root) {
+    return path === root || path.startsWith(`${root}/`);
+}
+export function repositoryLayout(profile) {
+    const scriptRoots = Array.from(new Set((profile.sourceRoots ?? [])
+        .filter((root) => root.kind === "scripts" || root.kind === "operations")
+        .map((root) => normalizeRoot(root.path))
+        .filter((root) => root !== ""))).sort();
+    // A repository is a Next.js app if it says so - a next.config file, or a declared dependency. Both
+    // are the repository's own statement about itself, not an inference from a filename.
+    const declaresNext = profile.packageJson.dependencies.includes("next") || profile.packageJson.devDependencies.includes("next");
+    const isNextApp = profile.nextConfig?.exists === true || declaresNext;
+    return {
+        scriptRoots,
+        isNextApp,
+        isScriptPath(path) {
+            const normalized = normalizeRoot(path);
+            return scriptRoots.some((root) => isUnder(normalized, root));
+        },
+        isDocumentationPath(path) {
+            const normalized = normalizeRoot(path);
+            const ext = extname(normalized).toLowerCase();
+            if (ext === ".md" || ext === ".mdx")
+                return true;
+            const first = normalized.split("/")[0];
+            return first !== undefined && CONVENTIONAL_DOC_DIRECTORIES.includes(first.toLowerCase());
+        },
+    };
+}
+/** The layout of a repository nothing is known about: no script roots, not a Next.js app. Used where
+ * a profile genuinely is not available, so the absence is explicit rather than a silent default. */
+export const UNKNOWN_REPOSITORY_LAYOUT = {
+    scriptRoots: [],
+    isNextApp: false,
+    isScriptPath: () => false,
+    isDocumentationPath(path) {
+        const ext = extname(path).toLowerCase();
+        return ext === ".md" || ext === ".mdx";
+    },
+};

package/dist-client/src/repo/repo-config.js

@@ -0,0 +1,63 @@
+/**
+ * A repository's own DiffCI configuration (Phase 01 follow-up, 2026-08-26).
+ *
+ * WHY. `DEFAULT_ALWAYS_RUN_CHECKS` in src/repo/impact.ts forced certain test files to be selected
+ * regardless of what the dependency graph said, matching on patterns like `test-api-guardrails`,
+ * `verify-*.test.` and `scripts/*.test.mjs`. Those are DiffCI's and DentalPresence's own file names,
+ * compiled into the engine and applied to every repository it analysed. On an external repository
+ * they matched nothing, so the policy was simultaneously a repo-specific default AND dead weight.
+ *
+ * The policy itself is worth keeping - some tests really must run regardless of reachability, because
+ * they check global properties a dependency graph cannot see. What was wrong is WHERE the list lived.
+ * A repository is the only thing that can say which of its own tests those are, so it says so, here:
+ *
+ *     // package.json
+ *     { "diffci": { "alwaysRunTests": ["**\/security.test.*", "scripts/**\/*.test.mjs"] } }
+ *
+ * or in a `diffci.json` at the repository root, with the same shape. Absent configuration means no
+ * always-run policy - not a guessed one.
+ *
+ * Globs, not regular expressions: globs are already the vocabulary a repository uses to describe its
+ * tests (vitest `include`, jest `testMatch`), and they go through the same matcher as everything else
+ * so one definition of "does this path match" holds throughout.
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+function readJsonFile(path) {
+    if (!existsSync(path))
+        return undefined;
+    try {
+        const parsed = JSON.parse(readFileSync(path, "utf8"));
+        return parsed !== null && typeof parsed === "object" ? parsed : undefined;
+    }
+    catch {
+        // Unreadable or malformed configuration is treated as absent rather than as an error. Getting
+        // this wrong must not take down analysis of a repository that is otherwise fine; the cost of the
+        // mistake is that the repository's own always-run policy silently does not apply, which is the
+        // same position every repository was in before this existed.
+        return undefined;
+    }
+}
+function parseConfig(raw) {
+    if (raw === null || typeof raw !== "object")
+        return {};
+    const record = raw;
+    const alwaysRunTests = Array.isArray(record.alwaysRunTests)
+        ? record.alwaysRunTests.filter((entry) => typeof entry === "string" && entry.trim() !== "")
+        : undefined;
+    return alwaysRunTests && alwaysRunTests.length > 0 ? { alwaysRunTests } : {};
+}
+/**
+ * Reads the repository's DiffCI configuration. `diffci.json` at the root wins over a `diffci` key in
+ * `package.json`; a repository using both has stated a preference by creating the dedicated file.
+ */
+export function readRepositoryConfig(repoPath, packageJson) {
+    const dedicated = readJsonFile(join(repoPath, "diffci.json"));
+    if (dedicated) {
+        const parsed = parseConfig(dedicated);
+        if (parsed.alwaysRunTests)
+            return parsed;
+    }
+    const pkg = packageJson ?? readJsonFile(join(repoPath, "package.json"));
+    return parseConfig(pkg?.diffci);
+}

package/dist-client/src/repo/runner-universe.js

@@ -0,0 +1,253 @@
+/**
+ * The runner's OWN test universe — what the configured test runner can actually execute.
+ *
+ * WHY THIS EXISTS (defect 17, found 2026-08-31 closing M2 on the ts-jest mutation result).
+ *
+ * `test-discovery` answered "what looks like a test?" by scanning the tree for `.test.`/`.spec.`
+ * files and UNIONING that with whatever globs a config declared. On `kulshekhar/ts-jest` that
+ * reported a universe of 40 when jest executes 20: its `jest.config.ts` declares
+ * `testMatch: ['<rootDir>/src/**\/*.spec.ts']`, but
+ *
+ *   1. `<rootDir>/` was never stripped, so the declared glob matched NOTHING - a repo-relative path
+ *      never contains that token; and
+ *   2. even had it matched, the conventional defaults were unioned on top, so 20 `e2e/` and
+ *      `examples/` spec files that jest is configured never to touch stayed in the universe.
+ *
+ * On that repository the damage was confined to reporting, because none of the extra 20 was ever
+ * selected. That was luck. A change under `e2e/` could have led DiffCI to select files the runner
+ * ignores - selection that looks like coverage and detects nothing.
+ *
+ * THE SAFETY DIRECTION, which governs every decision in this file.
+ *
+ * Narrowing the modelled universe is the DANGEROUS direction. A test DiffCI cannot see is a test it
+ * cannot select, and an unselected test that the runner would have run is exactly the shape of a
+ * false green. Over-inclusion only wastes compute.
+ *
+ * So a declaration may replace the defaults ONLY when it was completely understood. The moment an
+ * element is a spread, an unresolved identifier, an interpolated template or a call, `complete` goes
+ * false and the caller keeps the old over-inclusive union. Half-understanding a config must never be
+ * enough to hide a test.
+ *
+ * STATIC ONLY. Config files are repository code and are never imported or executed.
+ */
+/** Jest's repo-root token. */
+const ROOT_DIR = "<rootDir>";
+function stripRootDir(value) {
+    return value.startsWith(ROOT_DIR) ? value.slice(ROOT_DIR.length).replace(/^\//, "") : value;
+}
+/** Blanks comments so a commented-out glob is not lifted. */
+export function stripComments(source) {
+    let out = "";
+    let i = 0;
+    while (i < source.length) {
+        const two = source.slice(i, i + 2);
+        if (two === "//") {
+            const end = source.indexOf("\n", i);
+            if (end === -1)
+                break;
+            out += "\n";
+            i = end + 1;
+        }
+        else if (two === "/*") {
+            const end = source.indexOf("*/", i + 2);
+            if (end === -1)
+                break;
+            out += " ".repeat(end + 2 - i);
+            i = end + 2;
+        }
+        else if (source[i] === "'" || source[i] === '"' || source[i] === "`") {
+            const quote = source[i];
+            let j = i + 1;
+            while (j < source.length && source[j] !== quote)
+                j += source[j] === "\\" ? 2 : 1;
+            out += source.slice(i, Math.min(j + 1, source.length));
+            i = j + 1;
+        }
+        else {
+            out += source[i];
+            i++;
+        }
+    }
+    return out;
+}
+/**
+ * Blanks `coverage: { ... }` blocks.
+ *
+ * Their `include` lists INSTRUMENTED SOURCE files, not tests. Lifting it would classify the whole
+ * `src/` tree as tests.
+ */
+export function blankCoverageBlocks(source) {
+    let out = source;
+    for (;;) {
+        const m = /\bcoverage\s*:\s*\{/.exec(out);
+        if (!m)
+            return out;
+        const open = m.index + m[0].length - 1;
+        let depth = 0;
+        let close = -1;
+        for (let i = open; i < out.length; i++) {
+            if (out[i] === "{")
+                depth++;
+            else if (out[i] === "}") {
+                depth--;
+                if (depth === 0) {
+                    close = i;
+                    break;
+                }
+            }
+        }
+        if (close === -1)
+            return out;
+        out = out.slice(0, m.index) + " ".repeat(close + 1 - m.index) + out.slice(close + 1);
+    }
+}
+/** A single-quoted, double-quoted or NON-interpolated template literal, and nothing else. */
+const PLAIN_LITERAL = /^(?:'([^'\n]*)'|"([^"\n]*)"|`([^`\n$]*)`)$/;
+/**
+ * Lift the runner's declared universe out of a config file.
+ *
+ * Never throws, never executes. Unreadable input yields `complete: false`, which the caller must
+ * treat as "keep the wide default universe".
+ */
+export function extractTestPatterns(source) {
+    const stripped = blankCoverageBlocks(stripComments(source));
+    const arrayBodyAt = (open) => {
+        let depth = 0;
+        for (let i = open; i < stripped.length; i++) {
+            if (stripped[i] === "[")
+                depth++;
+            else if (stripped[i] === "]") {
+                depth--;
+                if (depth === 0)
+                    return stripped.slice(open + 1, i);
+            }
+        }
+        return undefined;
+    };
+    // `const patterns = [ ... ]` so `include: patterns` can be resolved.
+    const arrays = new Map();
+    for (const m of stripped.matchAll(/(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*(?::[^=]+)?=\s*\[/g)) {
+        const body = arrayBodyAt(m.index + m[0].length - 1);
+        if (body !== undefined)
+            arrays.set(m[1], body);
+    }
+    /** Split on TOP-LEVEL commas, so a nested call or array stays one element. */
+    const elementsOf = (body) => {
+        const out = [];
+        let depth = 0;
+        let start = 0;
+        for (let i = 0; i < body.length; i++) {
+            const ch = body[i];
+            if (ch === "[" || ch === "(" || ch === "{")
+                depth++;
+            else if (ch === "]" || ch === ")" || ch === "}")
+                depth--;
+            else if (ch === "," && depth === 0) {
+                out.push(body.slice(start, i));
+                start = i + 1;
+            }
+        }
+        out.push(body.slice(start));
+        return out.map((e) => e.trim()).filter((e) => e.length > 0);
+    };
+    let complete = true;
+    const literalsOf = (body) => {
+        const out = [];
+        for (const element of elementsOf(body)) {
+            const m = PLAIN_LITERAL.exec(element);
+            if (!m) {
+                // A spread, an identifier, an interpolated template, a call. Not understood.
+                complete = false;
+                continue;
+            }
+            out.push(m[1] ?? m[2] ?? m[3] ?? "");
+        }
+        return out;
+    };
+    /** Returns undefined when the key is absent; [] when present but unreadable. */
+    const readKey = (key) => {
+        let found;
+        const re = new RegExp(`\\b${key}\\s*:\\s*(\\[|([A-Za-z_$][\\w$]*))`, "g");
+        for (const m of stripped.matchAll(re)) {
+            found ??= [];
+            if (m[1] === "[") {
+                const body = arrayBodyAt(m.index + m[0].length - 1);
+                if (body === undefined) {
+                    complete = false;
+                    continue;
+                }
+                found.push(...literalsOf(body));
+            }
+            else if (m[2] !== undefined && arrays.has(m[2])) {
+                found.push(...literalsOf(arrays.get(m[2])));
+            }
+            else {
+                complete = false;
+            }
+        }
+        return found;
+    };
+    const rawInclude = readKey("include");
+    const rawTestMatch = readKey("testMatch");
+    const declaresTests = rawInclude !== undefined || rawTestMatch !== undefined;
+    const includes = [];
+    for (const raw of [...(rawInclude ?? []), ...(rawTestMatch ?? [])]) {
+        // Negations and non-globs (env names and the like) are not part of the universe.
+        if (raw.startsWith("!") || !/[*/]/.test(raw))
+            continue;
+        const value = stripRootDir(raw);
+        if (value.includes(ROOT_DIR)) {
+            // `<rootDir>` somewhere other than the front - not resolvable without evaluating the config.
+            complete = false;
+            continue;
+        }
+        includes.push(value);
+    }
+    // A declaration that yielded no usable glob is a declaration we failed to read.
+    if (declaresTests && includes.length === 0)
+        complete = false;
+    const roots = (readKey("roots") ?? [])
+        .map(stripRootDir)
+        .map((r) => r.replace(/^\.\//, "").replace(/\/+$/, ""))
+        .filter((r) => r.length > 0 && !r.includes(ROOT_DIR));
+    return {
+        includes: Array.from(new Set(includes)),
+        excludeGlobs: Array.from(new Set((readKey("exclude") ?? []).map(stripRootDir).filter((g) => /[*/]/.test(g) && !g.includes(ROOT_DIR)))),
+        ignoreRegexSources: Array.from(new Set(readKey("testPathIgnorePatterns") ?? [])),
+        roots,
+        declaresTests,
+        complete,
+    };
+}
+/**
+ * Compile jest `testPathIgnorePatterns` to regexes.
+ *
+ * They are regex sources matched against the test path, and jest matches them against the ABSOLUTE
+ * path - which is why the default is `/node_modules/` with leading and trailing slashes. Repo-relative
+ * paths are therefore tested with a leading "/" prepended, so the same sources mean the same thing.
+ * An uncompilable source is DROPPED rather than thrown: an ignore we cannot read must not silently
+ * become an ignore-everything.
+ */
+export function compileIgnoreRegexes(sources) {
+    const out = [];
+    for (const source of sources) {
+        try {
+            out.push(new RegExp(source));
+        }
+        catch {
+            // Not a regex we can honour. Leaving it out keeps the universe WIDER, which is the safe side.
+        }
+    }
+    return out;
+}
+/** True when `path` is ignored by any of `regexes`, using jest's absolute-path convention. */
+export function isIgnoredPath(path, regexes) {
+    const absoluteish = path.startsWith("/") ? path : `/${path}`;
+    return regexes.some((r) => r.test(absoluteish));
+}
+/** True when `path` lies under one of `roots`. An empty `roots` means no restriction. */
+export function isUnderRoots(path, roots) {
+    if (roots.length === 0)
+        return true;
+    return roots.some((root) => root === "" || root === "." || path === root || path.startsWith(`${root}/`));
+}