@diffci.com/diffci 0.1.2 → 0.1.4

package/dist-client/src/repo/graph.js

@@ -3,6 +3,7 @@ import { createTestFileMatcher, DEFAULT_TEST_FILE_MATCHER, testFileMatcherForPro
 import { isBuiltin } from "node:module";
 import { dirname, extname, join, normalize, relative, resolve, sep } from "node:path";
 import ts from "typescript";
+import { adapterFiles, REPOSITORY_ADAPTERS } from "./adapters/index.js";
 import { analyzeRepository } from "./analyzer.js";
 const SOURCE_EXTENSIONS = new Set([
     ".ts",
@@ -13,6 +14,7 @@ const SOURCE_EXTENSIONS = new Set([
     ".cjs",
     ".mts",
     ".cts",
+    ".vue",
 ]);
 const ASSET_EXTENSIONS = new Set([
     ".css",
@@ -323,7 +325,7 @@ export function discoverNestedTsconfigPaths(repoPath) {
     // merged compiler options reproducible across filesystems (readdir order is OS-dependent).
     return found.sort();
 }
-function createProgram(repoPath, fallbackSourceRoots = []) {
+function createProgram(repoPath, fallbackSourceRoots = [], additionalSources = []) {
     // Phase 01 F5 (2026-08-26). This was `ts.findConfigFile(repoPath, ...)`, which starts at repoPath
     // and walks UP - so a repository cloned beneath any directory containing a tsconfig.json was
     // silently analysed against that ANCESTOR's project instead of its own. Flagged as a known latent
@@ -440,6 +442,10 @@ function createProgram(repoPath, fallbackSourceRoots = []) {
             options = { ...options, allowJs: true };
         }
     }
+    if (additionalSources.length) {
+        fileNames = [...new Set([...fileNames, ...additionalSources])];
+        options = { module: ts.ModuleKind.ESNext, moduleResolution: ts.ModuleResolutionKind.Bundler, target: ts.ScriptTarget.ES2022, ...options, allowJs: true };
+    }
     const program = ts.createProgram({
         rootNames: fileNames,
         options,
@@ -523,12 +529,44 @@ export async function buildDependencyGraph(options = {}) {
     const start = process.hrtime.bigint();
     const repoPath = options.repoPath ? resolve(options.repoPath) : process.cwd();
     const profile = analyzeRepository(options);
+    const files = adapterFiles(repoPath, options.excludeDirs);
+    const context = { repoPath, files, profile };
+    const contributions = REPOSITORY_ADAPTERS.filter((adapter) => adapter.detect(context)).map((adapter) => adapter.analyze(context));
+    const adapterBlockers = contributions.flatMap((item) => item.blockers);
+    if (contributions.some((item) => item.id === "go") && files.some((file) => /\.(?:[cm]?[jt]sx?|vue)$/.test(file))) {
+        adapterBlockers.push("Mixed Go/JavaScript repositories require explicit cross-language dependencies; full validation required");
+    }
+    if (contributions.length && files.some((file) => /\.(?:py|rs|java|kt|cs|svelte|astro)$/.test(file))) {
+        adapterBlockers.push("Unmodeled languages alongside an adapter require full validation");
+    }
+    profile.adapters = contributions.map(({ id, version, blockers }) => ({ id, version, blockers }));
+    profile.goTestPackages = Object.assign({}, ...contributions.map((item) => item.testPackages));
+    profile.goTestEnvironment = contributions.find((item) => item.id === "go")?.executionEnv;
+    const adapterTests = contributions.flatMap((item) => item.testFiles);
+    profile.testFilePaths = [...new Set([...profile.testFilePaths, ...adapterTests])].sort();
+    if (profile.testUniverse) {
+        profile.testUniverse.discoveredTestFiles = profile.testFilePaths.length;
+        profile.testUniverse.blindSpot = (profile.testUniverse.declaredFrameworks.length > 0 || contributions.some((item) => item.id === "go")) && profile.testFilePaths.length === 0;
+    }
     const entryPointPaths = new Set(profile.entryPoints.map((e) => e.path));
-    let { program, options: compilerOptions, resolvedViaProjectReferences } = createProgram(repoPath, profile.sourceRoots);
+    const vueSources = contributions.some((item) => item.id === "vue")
+        ? files.filter((file) => /\.[cm]?[jt]sx?$/.test(file)).map((file) => join(repoPath, file)) : [];
+    // Compiler include/exclude controls typechecking, not the runner's test universe. Parse every
+    // discovered JS/TS test so source changes can reach tests outside the compiler's root files.
+    // Adding those tests only as leaf nodes silently loses their dependency edges (ky, 2026-09-19).
+    const testSources = profile.testFilePaths
+        .filter((file) => /\.[cm]?[jt]sx?$/.test(file))
+        .map((file) => join(repoPath, file));
+    let { program, options: compilerOptions, resolvedViaProjectReferences } = createProgram(repoPath, profile.sourceRoots, [...vueSources, ...testSources]);
     let moduleResolutionCache = ts.createModuleResolutionCache(repoPath, (x) => x, compilerOptions);
     const sourceFiles = program
         .getSourceFiles()
         .filter((sf) => sf.fileName && !sf.fileName.endsWith(".d.ts"));
+    for (const item of contributions) {
+        for (const virtual of item.virtualSources) {
+            sourceFiles.push(ts.createSourceFile(join(repoPath, virtual.path), virtual.source, ts.ScriptTarget.Latest, true, ts.ScriptKind.TSX));
+        }
+    }
     const internalSourcePaths = new Set();
     for (const sf of sourceFiles) {
         const rel = toRelativeInternal(repoPath, sf.fileName);
@@ -536,11 +574,14 @@ export async function buildDependencyGraph(options = {}) {
             internalSourcePaths.add(rel);
         }
     }
-    const edges = [];
+    const edges = contributions.flatMap((item) => item.edges);
     const unresolved = [];
     const references = [];
-    const assetPaths = new Set();
-    const edgeKeys = new Set();
+    const assetPaths = new Set(contributions.flatMap((item) => item.assetPaths));
+    for (const item of contributions)
+        for (const path of item.sourcePaths)
+            internalSourcePaths.add(path);
+    const edgeKeys = new Set(edges.map((edge) => `${edge.from}|${edge.to}|${edge.kind}`));
     function addEdge(from, to, kind) {
         const key = `${from}|${to}|${kind}`;
         if (edgeKeys.has(key))
@@ -590,6 +631,20 @@ export async function buildDependencyGraph(options = {}) {
             }
             const specifierCategory = classifySpecifier(ref.specifier);
             const resolvableSpecifier = specifierCategory === "relative" || specifierCategory === "absolute" || specifierCategory === "alias" ? stripImportQuery(ref.specifier) : ref.specifier;
+            // TypeScript may resolve a Vue import to a declaration shim. Preserve the actual SFC edge.
+            if (resolvableSpecifier.endsWith(".vue")) {
+                const compilerAliases = Object.entries(compilerOptions.paths ?? {}).map(([pattern, substitutions]) => ({ pattern, substitutions }));
+                const candidate = findAssetCandidate(sf.fileName, resolvableSpecifier, compilerAliases.length ? compilerAliases : profile.pathAliases, compilerOptions.baseUrl ?? repoPath);
+                const target = candidate && toRelativeInternal(repoPath, candidate);
+                if (target && internalSourcePaths.has(target)) {
+                    addEdge(importerRel, target, ref.kind);
+                    recordReference("internal-source", importerRel, ref);
+                    continue;
+                }
+                recordUnresolved(importerRel, ref, "Vue component not found in analyzed source inventory");
+                recordReference("unresolved", importerRel, ref);
+                continue;
+            }
             const resolution = ts.resolveModuleName(resolvableSpecifier, sf.fileName, compilerOptions, ts.sys, moduleResolutionCache);
             if (!resolution.resolvedModule || !resolution.resolvedModule.resolvedFileName) {
                 const category = classifySpecifier(ref.specifier);
@@ -637,21 +692,12 @@ export async function buildDependencyGraph(options = {}) {
             }
         }
     }
-    // Nested-package test visibility (2026-08-24, biomejs/biome finding): `internalSourcePaths` above is
-    // strictly the TS PROGRAM's own file list (createProgram()'s `include`/nested-tsconfig-merged
-    // fileNames) - so a package whose own tsconfig deliberately excludes its test directory (a real,
-    // common pattern; confirmed verbatim on biome: `packages/@biomejs/js-api/tsconfig.json` has
-    // `"exclude": ["./tests", "./dist"], "include": ["./src"]`) NEVER contributes those files to the
-    // program, so they never became graph nodes and `totalTestsInGraph` stayed 0 even though
-    // `profile.testFilePaths` (the separate, tsconfig-agnostic glob walk in analyzer.ts's discoverTests())
-    // already found them correctly. Source-ROOT discovery itself was already correct (the 2026-08-21
-    // zod/trpc fallback already lists `packages`/`crates` as roots for exactly this monorepo shape) - the
-    // gap was narrower: the graph never incorporated what that walk found. Fix: union in any test file
-    // discoverTests() found that the TS program's own file list missed, as an ADDITIONAL leaf node
-    // (isTest true; no import edges - we have no real resolution info for a file the type-checker was
-    // never asked to see, so dependency-graph traversal through it is honestly absent, not guessed at).
-    // This does NOT add Rust visibility of any kind - testFilePaths only ever contains files already
-    // matched by the JS/TS test-file patterns; a `.rs` test is never in it and stays "unknown" as before.
+    if (unresolved.some((ref) => ref.importer.endsWith(".vue") || stripImportQuery(ref.specifier).endsWith(".vue"))) {
+        adapterBlockers.push("Unresolved Vue dependencies require full validation");
+    }
+    profile.adapterBlockers = [...adapterBlockers];
+    // Keep adapter-provided test identities visible as well. JS/TS tests are parsed above; their
+    // imports must not be replaced by disconnected leaf nodes merely because tsconfig excludes them.
     for (const testPath of profile.testFilePaths) {
         if (!internalSourcePaths.has(testPath) && !assetPaths.has(testPath))
             internalSourcePaths.add(testPath);
@@ -679,7 +725,7 @@ export async function buildDependencyGraph(options = {}) {
     profile.stats.testFiles = graph.nodes.filter((n) => n.isTest).length;
     const integrity = validateDependencyGraph(graph);
     const dynamicUnresolvedCount = unresolved.filter((u) => u.dynamic).length;
-    const confidence = computeConfidence(unresolved.length, dynamicUnresolvedCount, integrity.criticalCount, profile.stats.sourceFiles, resolvedViaProjectReferences);
+    const confidence = adapterBlockers.length ? "UNSAFE" : computeConfidence(unresolved.length, dynamicUnresolvedCount, integrity.criticalCount, profile.stats.sourceFiles, resolvedViaProjectReferences);
     const internalAssetEdges = edges.filter((e) => e.kind === "asset").length;
     const externalReferences = references.filter((r) => r.resolution === "external-package").length;
     const platformBuiltinReferences = references.filter((r) => r.resolution === "platform-builtin").length;
@@ -700,6 +746,7 @@ export async function buildDependencyGraph(options = {}) {
     };
     return {
         graph,
+        adapterBlockers,
         profile,
         unresolved,
         references,
@@ -713,6 +760,18 @@ export async function buildDependencyGraph(options = {}) {
         resolvedViaProjectReferences,
     };
 }
+/** Product eligibility includes native adapters; legacy TS corpus classification stays separate. */
+export function classifyRepositoryProject(repoPath) {
+    const typescript = classifyTypeScriptProject(repoPath);
+    if (typescript.capable)
+        return typescript;
+    const files = adapterFiles(repoPath);
+    if (files.includes("go.mod"))
+        return { capable: true, reason: "Go module (package-level analysis)" };
+    if (files.some((file) => file.endsWith(".vue")))
+        return { capable: true, reason: "Vue single-file components" };
+    return { capable: false, reason: "No TypeScript project, Vue components, or root Go module found" };
+}
 /**
  * Can DiffCI build a dependency graph for this repository? (Phase 01 F3, 2026-08-26.)
  *
@@ -899,6 +958,8 @@ function computeConfidence(unresolvedCount, dynamicUnresolvedCount, integrityCri
  * narrowing only applies when unresolved/dynamic-unresolved imports are the actual reason, never when
  * sourceFileCount or integrity triggered it. */
 export function refineConfidenceForDelta(result, changedFiles) {
+    if (result.adapterBlockers?.length)
+        return "UNSAFE";
     // Anything that was never UNSAFE in the first place passes through untouched - there is nothing to
     // narrow, and re-deriving sourceFileCount/integrity from raw fields here (rather than trusting the
     // already-computed confidence) would be both redundant and a real correctness risk: a caller's

package/dist-client/src/repo/impact.js

@@ -3,7 +3,7 @@ import { refineConfidenceForDelta } from "./graph.js";
 import { repositoryLayout, UNKNOWN_REPOSITORY_LAYOUT } from "./layout.js";
 import { DEFAULT_TEST_FILE_MATCHER, matchesGlob as matchesTestGlob, testFileMatcherForProfile } from "./test-discovery.js";
 import { resolveTestFixtureOwners } from "./test-fixture-ownership.js";
-const SOURCE_EXTENSIONS = new Set([".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs", ".mts", ".cts"]);
+const SOURCE_EXTENSIONS = new Set([".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs", ".mts", ".cts", ".vue", ".go"]);
 const ASSET_EXTENSIONS = new Set([".css", ".scss", ".sass", ".less", ".json", ".jsonc", ".svg", ".png", ".jpg", ".jpeg", ".gif", ".webp", ".ico", ".bmp", ".woff", ".woff2", ".ttf", ".otf", ".eot", ".wasm", ".md", ".txt"]);
 const NEXT_ENTRY_NAMES = new Set(["page", "layout", "route", "api", "loading", "error", "template", "not-found", "middleware", "generatemetadata", "generatestaticparams"]);
 function isSourceFilePath(filePath) { return SOURCE_EXTENSIONS.has(extname(filePath).toLowerCase()); }
@@ -18,6 +18,10 @@ function isDocumentationFile(filePath, layout) { return layout.isDocumentationPa
 function isConfigFile(filePath) {
     const CONFIG_FILE_NAMES = new Set(["package.json", "package-lock.json", "yarn.lock", "pnpm-lock.yaml", "bun.lockb", "bun.lock", "tsconfig.json", "tsconfig.base.json", "tsconfig.build.json", "jsconfig.json"]);
     const base = posix.basename(filePath);
+    if (["go.mod", "go.sum", "go.work", "go.work.sum"].includes(base))
+        return true;
+    if (/^(?:vite|vue|nuxt)\.config\./.test(base))
+        return true;
     if (CONFIG_FILE_NAMES.has(base))
         return true;
     if (base.startsWith("next.config"))
@@ -265,7 +269,12 @@ export class ImpactAnalyzer {
         const changedImpacts = delta.files.map((file) => ({ file, category: classifyChangedFile(file, this.isTestFile, this.layout, options.repositoryFiles), reasons: changedFileReasons(file) }));
         const evidence = [];
         const riskSignals = [];
-        const fallbackReasons = [];
+        const fallbackReasons = [...(graphResult.adapterBlockers ?? [])];
+        for (const file of delta.files) {
+            if (allChangePaths(file).some((path) => /(?:^|\/)(?:go\.(?:mod|sum|work)|go\.work\.sum|(?:vite|vue|nuxt)\.config\.[^/]+)$/.test(path))) {
+                fallbackReasons.push(`Language/framework configuration changed: ${file.path}`);
+            }
+        }
         this.applyGlobalRiskRules(delta, riskSignals, fallbackReasons);
         // Stage 1B fix (2026-08-21, docs/research/2026-08-21-stage1b-*.md): refine the graph's raw,
         // delta-independent confidence to THIS delta's changed files - see refineConfidenceForDelta()'s doc

package/dist-client/src/repo/test-discovery.js

@@ -370,6 +370,12 @@ export function createTestFileMatcher(patterns, options = {}) {
 /** The one place that turns a profile into a matcher, so analyzer discovery, graph node flags and
  * impact classification cannot disagree about what a test is. */
 export function testFileMatcherForProfile(profile) {
+    if (profile.goTestPackages && Object.keys(profile.goTestPackages).length) {
+        const jsMatcher = testFileMatcherForProfile({ ...profile, goTestPackages: undefined });
+        const matcher = ((path) => Object.hasOwn(profile.goTestPackages, path) || jsMatcher(path));
+        Object.defineProperty(matcher, "patterns", { value: jsMatcher.patterns });
+        return matcher;
+    }
     if (!profile.testPatterns)
         return DEFAULT_TEST_FILE_MATCHER;
     return createTestFileMatcher(profile.testPatterns, {

package/docs/distribution.md

@@ -3,6 +3,10 @@
 DiffCI has three install surfaces with the same initial contract: observe CI, write a report, and do
 not change what the host repository runs.
 
+The product model is open core. The npm CLI and basic GitHub Action are the open-source adoption path;
+DiffCI Cloud adds hosted history, organization dashboards, policies, managed operations, and support.
+See [`open-core-packaging.md`](open-core-packaging.md).
+
 ## GitHub App
 
 The DiffCI Shadow GitHub App is the lowest-friction research and design-partner path. It receives
@@ -25,10 +29,10 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - uses: DiffCI/DiffCI.com@v1
+      - uses: DiffCI/DiffCI.com@v0.1.4
 ```
 
-For the strongest supply-chain posture, pin the Action to a full commit SHA. `npx @diffci.com/diffci verify-workflow`
+For the strongest supply-chain posture, pin the Action to a full commit SHA. `npx @diffci.com/diffci@latest verify-workflow`
 checks that the job is dedicated, read-only, not required by other jobs, and unable to alter the rest
 of CI.
 
@@ -37,8 +41,8 @@ of CI.
 The CLI is the standalone npm package surface. The package name is `@diffci.com/diffci`:
 
 ```bash
-npx @diffci.com/diffci observe
-npx @diffci.com/diffci verify-workflow
+npx @diffci.com/diffci@latest observe
+npx @diffci.com/diffci@latest verify-workflow
 ```
 
 `observe` writes a JSON report outside the checkout by default. It never runs, skips, cancels, or
@@ -79,3 +83,10 @@ brew install diffci
 
 Those should ship only after the npm CLI and Action have signed releases, provenance, pinned build
 workflows, and repeatable package verification.
+
+## Supported OSS Channel
+
+Tidelift belongs to the open-source package channel. It can provide maintenance, security, license, and
+supply-chain assurance for the npm package without requiring a hosted DiffCI account. It should support
+the OSS core rather than define a separate feature tier. The readiness checklist lives in
+[`tidelift-package-support.md`](tidelift-package-support.md).

package/docs/language-support.md

@@ -0,0 +1,70 @@
+# Language and framework support
+
+DiffCI now has an extensible repository-adapter boundary and initial Vue and Go support.
+These additions propose selections in the existing observer; they do not enable production CI skipping.
+
+| Surface | Implemented scope | Boundaries |
+| --- | --- | --- |
+| JavaScript / TypeScript | Existing dependency analysis and ten existing test-runner command mappings | Runner recognition is not a guarantee of complete framework semantics |
+| Vue | SFC parsing with `@vue/compiler-sfc`; script imports, nested components, compiled template asset imports; propagation into importing JS/TS tests | Runtime component/directive resolution, preprocessors, external/custom SFC blocks, style URLs/imports, Nuxt conventions and glob imports require full validation |
+| Go | One root module; native `go list` metadata; package-level transitive test selection, external test packages, embedded files; `go test -json` commands and result parsing | Workspaces/nested modules, inactive Go files, cgo/native objects, runtime plugins, generation/linkname, external local replacements and incomplete metadata require full validation |
+| Mixed Go and JS/TS | Detected | Full validation until cross-language relationships are declared and modeled |
+| Python, Svelte, Astro, Java/Kotlin, C#, Rust | No new semantic support in this release | Require additional adapters and qualification |
+
+## Using the observer
+
+Use the existing `observe` command and commit range options. The observer now admits a root
+`go.mod` or Vue SFCs as well as a TypeScript project. Vue projects without a tsconfig have their
+JS/TS files parsed alongside their components. Existing TS-only corpus eligibility remains separate:
+this release does not silently enroll Go repositories in historical JS/TS research cohorts.
+
+For Go, install a compatible Go toolchain on the **same host and build environment** used for analysis
+and testing, and prepare the repository's dependencies first using its normal setup procedure.
+DiffCI invokes `go list -mod=readonly -deps -test -json ./...` with `GOTOOLCHAIN=local`, `GOPROXY=off`,
+`GOSUMDB=off`, and `GOWORK=off`. Missing toolchains or dependencies produce refusal/full fallback.
+Go may populate its own build cache but must not modify the checkout. It does not run `go generate`.
+Custom `GOFLAGS` currently require full validation. Discovered GOOS, GOARCH and CGO_ENABLED settings
+are carried into the structured test command.
+
+A selection such as `lib/value_test.go` becomes:
+
+```sh
+go test -mod=readonly -json -count=1 ./lib
+```
+
+It runs the entire package. Consumers must honor the emitted `CommandSpec.env`, preserve the build
+context, and check fallback/command-synthesis status before execution. Commands are not portable
+between different GOOS/GOARCH/GOFLAGS contexts. The controlled runner command policies accept `go`;
+hosted images still need a Go installation before Go workloads can run. No deployment is performed
+by these code changes.
+
+Go result parsing counts failing **packages**, records failing test names, and rejects incomplete
+JSON streams. It does not invent test-file counts from package counts, so file-based economics
+qualification may still report an unsupported denominator for Go.
+
+## Extension points
+
+- `src/repo/adapters/types.ts`: adapter context and graph contribution contract.
+- `src/repo/adapters/index.ts`: framework/language adapter registry and bounded file inventory.
+- `src/repo/adapters/vue.ts`: Vue compiler integration.
+- `src/repo/adapters/go.ts`: native Go package metadata and conservative dependency model.
+- `src/repo/adapters/go-test.ts`: structured Go outcome parsing.
+- `src/planner/test-command.ts`: runner command routing, including verified Go package targets.
+
+Adapters contribute source and asset nodes, dependency edges, virtual JS/TS source, runnable test
+identities and explicit blockers. Blockers persist into the profile and graph result and cannot be
+removed by delta-specific reachability refinement. Go graphs bypass the disk cache until every cache
+caller provides a complete toolchain/build-context identity. The cache schema was bumped to prevent
+reuse of graphs created before adapter support.
+
+## Validation and qualification
+
+`tests/repo/language-adapters.test.ts` covers transitive Vue selection, unsupported-feature fallbacks,
+Go package imports and embeds, metadata failures, command routing, and incomplete output.
+When Go is on PATH, its native integration test runs the observer against a real Git fixture,
+compares successful full/subset test runs, and verifies the subset catches an introduced fault.
+Without Go, that native test is explicitly skipped.
+
+These are implementation checks, not prospective customer safety or savings evidence. Each new
+ecosystem still needs real repository shadow observations and economic qualification before broader
+support or savings claims are made.

package/package.json

@@ -1,7 +1,12 @@
 {
   "name": "@diffci.com/diffci",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "DiffCI - deterministic change-aware CI planning",
+  "license": "AGPL-3.0-only",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/DiffCI/DiffCI.com.git"
+  },
   "private": false,
   "type": "module",
   "engines": {
@@ -18,7 +23,10 @@
     "dist-client/src/repo",
     "README.md",
     "docs/distribution.md",
-    "docs/language-support.md"
+    "docs/language-support.md",
+    "SECURITY.md",
+    "SUPPORT.md",
+    "COMMERCIAL.md"
   ],
   "exports": {
     "./*": {
@@ -90,10 +98,12 @@
     "qualify:universe": "tsx scripts/qualify-universe.ts",
     "corpus:register": "tsx scripts/register-corpus-entry.ts",
     "ci:benchmark": "tsx scripts/ci-inference-benchmark.ts",
-    "ci:reproduce": "tsx scripts/ci-reproduction.ts"
+    "ci:reproduce": "tsx scripts/ci-reproduction.ts",
+    "check:oss-boundary": "node scripts/check-oss-boundary.mjs"
   },
   "dependencies": {
     "@types/node": "^22.15.12",
+    "@vue/compiler-sfc": "3.5.42",
     "typescript": "^5.8.3",
     "yaml": "^2.9.0"
   },
@@ -114,9 +124,5 @@
       "**/validate-*.test.*",
       "scripts/**/*.test.mjs"
     ]
-  },
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/DiffCI/DiffCI.com"
   }
 }