@eviano/tribunal 0.1.2 → 0.2.0

package/dist/cli.js

@@ -1,30 +1,65 @@
 #!/usr/bin/env node
-import { runTribunal } from './index.js';
+import { runTribunal, analyzers as defaultAnalyzers } from './index.js';
 import { exitCode, renderJson, renderMarkdown } from './report/render.js';
 import { parseClaims } from './claims.js';
-import { readFileSync } from 'node:fs';
+import { readFileSync, writeFileSync } from 'node:fs';
+import { runPropose } from './propose.js';
+import { renderSarif } from './report/render.js';
+import { setSkipGenerated, setExtraGeneratedPaths } from './analyzers/riskyDiffNoTest.js';
+import { loadConfig, setKnownAnalyzerIds } from './config/loadConfig.js';
+// Register the known analyzer ids so loadConfig can validate `analyzers:` keys (fail-loud on typos).
+setKnownAnalyzerIds(defaultAnalyzers.map((a) => a.id));
 const HELP = `tribunal — a deterministic, no-LLM CI gate for agent-authored PRs
 
 Usage:
-  tribunal check [options]
+  tribunal check [options]        Deterministically verify a PR (default).
+  tribunal propose [options]      Ask an LLM to PROPOSE claims; never adjudicates.
 
-Options:
+check — options:
   --base <ref>     Base ref for a range diff (e.g. the PR base branch).
   --head <ref>     Head ref for a range diff. Defaults to working tree vs HEAD.
   --diff <file>    Read a unified diff from a file instead of invoking git.
   --claims <file>  Read machine-readable claims from a file (whole file, or a tribunal fenced block).
   --pr-body <file> Read claims ONLY from a \`\`\`tribunal fenced block in a PR-body file.
   --cwd <dir>      Repo root to run in (default: current directory).
-  --format <fmt>   Output format: md (default) or json.
+  --format <fmt>   Output format: md (default), json, or sarif (upload via github/codeql-action/upload-sarif).
   --hard-fail      Exit non-zero when there is at least one CONTRADICTED finding.
                    Off by default (report-only). Gates ONLY on CONTRADICTED.
-  -h, --help       Show this help.
+  --no-skip-generated  Don't skip generated/build-output paths in risky-diff-no-test
+                   (dist/, *.min.js, …). Default skips them; this re-enables flagging them.
+  --config <file>  Path to tribunal.yml (default: <repo-root>/tribunal.yml). Configures per-analyzer
+                   enable/disable and extra generated-path patterns. Absent = all defaults.
+
+propose — options:
+  --diff <file>      Diff to propose claims for (required for propose).
+  --pr-body <file>   Optional PR body to give the model extra context.
+  --endpoint <url>   OpenAI-compatible chat-completions base URL (env: TRIBUNAL_ENDPOINT).
+  --model <name>     Model name (env: TRIBUNAL_MODEL).
+  --api-key <key>    Bearer token (env: TRIBUNAL_API_KEY).
+  --allow-send-diff  Actually send the diff to the endpoint. WITHOUT this flag, propose prints the
+                     prompt and sends NOTHING (the diff is source code — review before publishing).
+                     Also set via TRIBUNAL_ALLOW_SEND_DIFF=1.
+  --out <file>       Write the claims block to a file (default: stdout).
+  --cwd <dir>        Repo root (default: current directory).
+
+  The propose → check loop:
+    tribunal propose --diff pr.diff --allow-send-diff --out claims.md
+    tribunal check   --diff pr.diff --pr-body claims.md
 
 Tribunal gates only on CONTRADICTED (a syntactic certainty). UNVERIFIED never blocks,
-and no LLM is in the verification path.
+and no LLM is in the verification path. propose only suggests claims for check to verify.
+
+  -h, --help       Show this help.
 `;
 function parseArgs(argv) {
-    const opts = { command: '', cwd: process.cwd(), format: 'md', hardFail: false };
+    const opts = {
+        command: '',
+        cwd: process.cwd(),
+        format: 'md',
+        hardFail: false,
+        allowSendDiff: false,
+        noSkipGenerated: false,
+    };
     const rest = [...argv];
     while (rest.length) {
         const a = rest.shift();
@@ -46,22 +81,46 @@ function parseArgs(argv) {
                 opts.claimsFile = rest.shift();
                 break;
             case '--pr-body':
+                // In `propose`, --pr-body is context for the model; in `check`, it's a fenced claims source.
+                // We resolve which meaning applies at dispatch time; stash the path on both fields.
                 opts.prBodyFile = rest.shift();
+                opts.proposePrBodyFile = opts.prBodyFile;
+                break;
+            case '--endpoint':
+                opts.endpoint = rest.shift();
+                break;
+            case '--model':
+                opts.model = rest.shift();
+                break;
+            case '--api-key':
+                opts.apiKey = rest.shift();
+                break;
+            case '--allow-send-diff':
+                opts.allowSendDiff = true;
+                break;
+            case '--out':
+                opts.outFile = rest.shift();
                 break;
             case '--cwd':
                 opts.cwd = rest.shift() ?? opts.cwd;
                 break;
             case '--format': {
                 const f = rest.shift();
-                if (f === 'md' || f === 'json')
+                if (f === 'md' || f === 'json' || f === 'sarif')
                     opts.format = f;
                 else
-                    throw new Error(`Unknown format: ${f} (expected md or json)`);
+                    throw new Error(`Unknown format: ${f} (expected md, json, or sarif)`);
                 break;
             }
             case '--hard-fail':
                 opts.hardFail = true;
                 break;
+            case '--no-skip-generated':
+                opts.noSkipGenerated = true;
+                break;
+            case '--config':
+                opts.configFile = rest.shift();
+                break;
             default:
                 if (!a.startsWith('-') && !opts.command)
                     opts.command = a;
@@ -71,21 +130,70 @@ function parseArgs(argv) {
     }
     return opts;
 }
-function main() {
-    let opts;
-    try {
-        opts = parseArgs(process.argv.slice(2));
+/** Resolve the propose provider config from flags, then env, failing loudly if incomplete. */
+function resolveProvider(opts) {
+    const endpoint = opts.endpoint ?? process.env.TRIBUNAL_ENDPOINT;
+    const model = opts.model ?? process.env.TRIBUNAL_MODEL;
+    const apiKey = opts.apiKey ?? process.env.TRIBUNAL_API_KEY;
+    if (!endpoint) {
+        throw new Error('propose: no endpoint. Pass --endpoint <url> or set TRIBUNAL_ENDPOINT ' +
+            '(an OpenAI-compatible chat-completions base URL).');
     }
-    catch (err) {
-        process.stderr.write(`${err.message}\n\n${HELP}`);
-        process.exit(2);
+    if (!model) {
+        throw new Error('propose: no model. Pass --model <name> or set TRIBUNAL_MODEL.');
     }
-    if (opts.command === 'help' || opts.command === '') {
-        process.stdout.write(HELP);
-        process.exit(0);
+    return { endpoint, model, apiKey };
+}
+async function runProposeCmd(opts) {
+    if (!opts.diffFile) {
+        throw new Error('propose: --diff <file> is required (the diff to propose claims for).');
     }
-    if (opts.command !== 'check') {
-        process.stderr.write(`Unknown command: ${opts.command}\n\n${HELP}`);
+    const diff = readFileSync(opts.diffFile, 'utf8');
+    const prBody = opts.proposePrBodyFile ? readFileSync(opts.proposePrBodyFile, 'utf8') : undefined;
+    const allowSendDiff = opts.allowSendDiff || process.env.TRIBUNAL_ALLOW_SEND_DIFF === '1' ||
+        process.env.TRIBUNAL_ALLOW_SEND_DIFF === 'true';
+    const provider = resolveProvider(opts);
+    const result = await runPropose({ diff, prBody, provider, allowSendDiff });
+    if (opts.outFile) {
+        writeFileSync(opts.outFile, `${result.block}\n`);
+        process.stderr.write(result.sent
+            ? `propose: wrote ${result.claims.length} candidate claim(s) to ${opts.outFile}\n`
+            : `propose: send-guard withheld the request; wrote an empty block to ${opts.outFile}\n`);
+    }
+    else if (result.sent) {
+        // When the prompt was already printed by the send-guard path, avoid duplicating it; only print the
+        // block when we actually sent and got a response.
+        process.stdout.write(`${result.block}\n`);
+    }
+    process.exit(0);
+}
+function runCheckCmd(opts) {
+    // riskyDiffNoTest skips generated/build-output paths by default. Disable via --no-skip-generated or
+    // TRIBUNAL_NO_SKIP_GENERATED=1 (an opinionated default must never silently suppress a wanted file).
+    if (opts.noSkipGenerated ||
+        process.env.TRIBUNAL_NO_SKIP_GENERATED === '1' ||
+        process.env.TRIBUNAL_NO_SKIP_GENERATED === 'true') {
+        setSkipGenerated(false);
+    }
+    // Load tribunal.yml (auto-discovered at repo root, or --config / TRIBUNAL_CONFIG). Absent = all
+    // defaults, no behavior change. Present-but-malformed fails loud. Applied: extra generated-paths are
+    // appended to the built-ins (extend-defaults); analyzers: false disables that analyzer.
+    let analyzerOverride;
+    try {
+        const config = loadConfig(opts.cwd, opts.configFile);
+        if (config) {
+            if (config.generatedPaths && config.generatedPaths.length) {
+                setExtraGeneratedPaths(config.generatedPaths);
+            }
+            if (config.analyzers) {
+                const disabled = Object.entries(config.analyzers).filter(([, v]) => v === false).map(([k]) => k);
+                if (disabled.length)
+                    analyzerOverride = defaultAnalyzers.filter((a) => !disabled.includes(a.id));
+            }
+        }
+    }
+    catch (err) {
+        process.stderr.write(`tribunal: ${err.message}\n`);
         process.exit(2);
     }
     let claims;
@@ -102,15 +210,50 @@ function main() {
     };
     let report;
     try {
-        report = runTribunal(src);
+        report = runTribunal(src, analyzerOverride ? { analyzers: analyzerOverride } : {});
     }
     catch (err) {
         process.stderr.write(`tribunal: ${err.message}\n`);
         process.exit(2);
     }
-    const out = opts.format === 'json' ? renderJson(report) : renderMarkdown(report, opts.hardFail);
+    let out;
+    if (opts.format === 'json')
+        out = renderJson(report);
+    else if (opts.format === 'sarif')
+        out = renderSarif(report);
+    else
+        out = renderMarkdown(report, opts.hardFail);
     process.stdout.write(`${out}\n`);
     process.exit(exitCode(report, opts.hardFail));
 }
+async function main() {
+    let opts;
+    try {
+        opts = parseArgs(process.argv.slice(2));
+    }
+    catch (err) {
+        process.stderr.write(`${err.message}\n\n${HELP}`);
+        process.exit(2);
+    }
+    if (opts.command === 'help' || opts.command === '') {
+        process.stdout.write(HELP);
+        process.exit(0);
+    }
+    if (opts.command === 'propose') {
+        try {
+            await runProposeCmd(opts);
+        }
+        catch (err) {
+            process.stderr.write(`tribunal: ${err.message}\n`);
+            process.exit(2);
+        }
+        return;
+    }
+    if (opts.command !== 'check') {
+        process.stderr.write(`Unknown command: ${opts.command}\n\n${HELP}`);
+        process.exit(2);
+    }
+    runCheckCmd(opts);
+}
 main();
 //# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAE1E,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAcvC,MAAM,IAAI,GAAG;;;;;;;;;;;;;;;;;;;CAmBZ,CAAC;AAEF,SAAS,SAAS,CAAC,IAAc;IAC/B,MAAM,IAAI,GAAe,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC5F,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;IACvB,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,EAAG,CAAC;QACxB,QAAQ,CAAC,EAAE,CAAC;YACV,KAAK,IAAI,CAAC;YACV,KAAK,QAAQ;gBACX,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;gBACtB,MAAM;YACR,KAAK,QAAQ;gBACX,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;gBACzB,MAAM;YACR,KAAK,QAAQ;gBACX,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;gBACzB,MAAM;YACR,KAAK,QAAQ;gBACX,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC7B,MAAM;YACR,KAAK,UAAU;gBACb,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC/B,MAAM;YACR,KAAK,WAAW;gBACd,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC/B,MAAM;YACR,KAAK,OAAO;gBACV,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC;gBACpC,MAAM;YACR,KAAK,UAAU,CAAC,CAAC,CAAC;gBAChB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;gBACvB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,MAAM;oBAAE,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;;oBAC3C,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,wBAAwB,CAAC,CAAC;gBACnE,MAAM;YACR,CAAC;YACD,KAAK,aAAa;gBAChB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;gBACrB,MAAM;YACR;gBACE,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO;oBAAE,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC;;oBACrD,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,IAAI;IACX,IAAI,IAAgB,CAAC;IACrB,IAAI,CAAC;QACH,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAI,GAAa,CAAC,OAAO,OAAO,IAAI,EAAE,CAAC,CAAC;QAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,IAAI,CAAC,OAAO,KAAK,MAAM,IAAI,IAAI,CAAC,OAAO,KAAK,EAAE,EAAE,CAAC;QACnD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,IAAI,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,IAAI,CAAC,OAAO,OAAO,IAAI,EAAE,CAAC,CAAC;QACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,MAA2B,CAAC;IAChC,IAAI,IAAI,CAAC,UAAU;QAAE,MAAM,GAAG,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;SAC5E,IAAI,IAAI,CAAC,UAAU;QAAE,MAAM,GAAG,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;IAE9G,MAAM,GAAG,GAAe;QACtB,QAAQ,EAAE,IAAI,CAAC,GAAG;QAClB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;QACzE,MAAM;KACP,CAAC;IAEF,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAc,GAAa,CAAC,OAAO,IAAI,CAAC,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;IACjC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,IAAI,EAAE,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,WAAW,EAAE,SAAS,IAAI,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACxE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAE1E,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EAAE,UAAU,EAAwB,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAC1F,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAEzE,qGAAqG;AACrG,mBAAmB,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AA0BvD,MAAM,IAAI,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyCZ,CAAC;AAEF,SAAS,SAAS,CAAC,IAAc;IAC/B,MAAM,IAAI,GAAe;QACvB,OAAO,EAAE,EAAE;QACX,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;QAClB,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,KAAK;QACf,aAAa,EAAE,KAAK;QACpB,eAAe,EAAE,KAAK;KACvB,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;IACvB,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,EAAG,CAAC;QACxB,QAAQ,CAAC,EAAE,CAAC;YACV,KAAK,IAAI,CAAC;YACV,KAAK,QAAQ;gBACX,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;gBACtB,MAAM;YACR,KAAK,QAAQ;gBACX,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;gBACzB,MAAM;YACR,KAAK,QAAQ;gBACX,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;gBACzB,MAAM;YACR,KAAK,QAAQ;gBACX,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC7B,MAAM;YACR,KAAK,UAAU;gBACb,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC/B,MAAM;YACR,KAAK,WAAW;gBACd,6FAA6F;gBAC7F,oFAAoF;gBACpF,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC/B,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,UAAU,CAAC;gBACzC,MAAM;YACR,KAAK,YAAY;gBACf,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC7B,MAAM;YACR,KAAK,SAAS;gBACZ,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC1B,MAAM;YACR,KAAK,WAAW;gBACd,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC3B,MAAM;YACR,KAAK,mBAAmB;gBACtB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;gBAC1B,MAAM;YACR,KAAK,OAAO;gBACV,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC5B,MAAM;YACR,KAAK,OAAO;gBACV,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC;gBACpC,MAAM;YACR,KAAK,UAAU,CAAC,CAAC,CAAC;gBAChB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;gBACvB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,OAAO;oBAAE,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;;oBAC5D,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,gCAAgC,CAAC,CAAC;gBAC3E,MAAM;YACR,CAAC;YACD,KAAK,aAAa;gBAChB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;gBACrB,MAAM;YACR,KAAK,qBAAqB;gBACxB,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;gBAC5B,MAAM;YACR,KAAK,UAAU;gBACb,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC/B,MAAM;YACR;gBACE,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO;oBAAE,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC;;oBACrD,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8FAA8F;AAC9F,SAAS,eAAe,CAAC,IAAgB;IACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAChE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IACvD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC3D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,uEAAuE;YACrE,mDAAmD,CACtD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AACrC,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAgB;IAC3C,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEjG,MAAM,aAAa,GACjB,IAAI,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,GAAG;QAClE,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,MAAM,CAAC;IAElD,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC;IAE3E,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;QACjD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,MAAM,CAAC,IAAI;YACT,CAAC,CAAC,kBAAkB,MAAM,CAAC,MAAM,CAAC,MAAM,0BAA0B,IAAI,CAAC,OAAO,IAAI;YAClF,CAAC,CAAC,qEAAqE,IAAI,CAAC,OAAO,IAAI,CAC1F,CAAC;IACJ,CAAC;SAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QACvB,mGAAmG;QACnG,kDAAkD;QAClD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,WAAW,CAAC,IAAgB;IACnC,oGAAoG;IACpG,oGAAoG;IACpG,IACE,IAAI,CAAC,eAAe;QACpB,OAAO,CAAC,GAAG,CAAC,0BAA0B,KAAK,GAAG;QAC9C,OAAO,CAAC,GAAG,CAAC,0BAA0B,KAAK,MAAM,EACjD,CAAC;QACD,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAED,gGAAgG;IAChG,qGAAqG;IACrG,wFAAwF;IACxF,IAAI,gBAAgB,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACrD,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC;gBAC1D,sBAAsB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;YAChD,CAAC;YACD,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;gBACrB,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;gBACjG,IAAI,QAAQ,CAAC,MAAM;oBAAE,gBAAgB,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACnG,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAc,GAAa,CAAC,OAAO,IAAI,CAAC,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,MAA2B,CAAC;IAChC,IAAI,IAAI,CAAC,UAAU;QAAE,MAAM,GAAG,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;SAC5E,IAAI,IAAI,CAAC,UAAU;QAAE,MAAM,GAAG,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;IAE9G,MAAM,GAAG,GAAe;QACtB,QAAQ,EAAE,IAAI,CAAC,GAAG;QAClB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;QACzE,MAAM;KACP,CAAC;IAEF,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACrF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAc,GAAa,CAAC,OAAO,IAAI,CAAC,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,GAAW,CAAC;IAChB,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM;QAAE,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;SAChD,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO;QAAE,GAAG,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;;QACvD,GAAG,GAAG,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;IACjC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,IAAI,IAAgB,CAAC;IACrB,IAAI,CAAC;QACH,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAI,GAAa,CAAC,OAAO,OAAO,IAAI,EAAE,CAAC,CAAC;QAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,IAAI,CAAC,OAAO,KAAK,MAAM,IAAI,IAAI,CAAC,OAAO,KAAK,EAAE,EAAE,CAAC;QACnD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAc,GAAa,CAAC,OAAO,IAAI,CAAC,CAAC;YAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,IAAI,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,IAAI,CAAC,OAAO,OAAO,IAAI,EAAE,CAAC,CAAC;QACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,WAAW,CAAC,IAAI,CAAC,CAAC;AACpB,CAAC;AAED,IAAI,EAAE,CAAC"}

package/dist/config/loadConfig.d.ts

@@ -0,0 +1,19 @@
+import type { TribunalConfig } from './types.js';
+export declare const CONFIG_FILENAME = "tribunal.yml";
+/**
+ * Register the known analyzer ids (once, at CLI/program startup). loadConfig validates `analyzers:` keys
+ * against this set so a typo fails loudly instead of silently no-op'ing.
+ */
+export declare function setKnownAnalyzerIds(ids: readonly string[]): void;
+/**
+ * Load + validate a TribunalConfig.
+ *
+ * Resolution order for the file path:
+ *   1. an explicit `configPath` argument (the `--config` flag value)
+ *   2. the `TRIBUNAL_CONFIG` env var
+ *   3. `<repoRoot>/tribunal.yml` (auto-discovery)
+ *
+ * Returns `null` when no file is present (≡ all defaults). Throws on a present-but-malformed file or on
+ * an unknown analyzer id (fail-loud, never silently degrade).
+ */
+export declare function loadConfig(repoRoot: string, configPath?: string): TribunalConfig | null;

package/dist/config/loadConfig.js

@@ -0,0 +1,89 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { parseYamlSubset } from './parseYaml.js';
+export const CONFIG_FILENAME = 'tribunal.yml';
+/** The set of analyzer ids accepted under `analyzers:` — injected so loadConfig has no analyzer import cycle. */
+let knownAnalyzerIds = [];
+/**
+ * Register the known analyzer ids (once, at CLI/program startup). loadConfig validates `analyzers:` keys
+ * against this set so a typo fails loudly instead of silently no-op'ing.
+ */
+export function setKnownAnalyzerIds(ids) {
+    knownAnalyzerIds = ids;
+}
+/**
+ * Load + validate a TribunalConfig.
+ *
+ * Resolution order for the file path:
+ *   1. an explicit `configPath` argument (the `--config` flag value)
+ *   2. the `TRIBUNAL_CONFIG` env var
+ *   3. `<repoRoot>/tribunal.yml` (auto-discovery)
+ *
+ * Returns `null` when no file is present (≡ all defaults). Throws on a present-but-malformed file or on
+ * an unknown analyzer id (fail-loud, never silently degrade).
+ */
+export function loadConfig(repoRoot, configPath) {
+    const explicit = configPath ?? process.env.TRIBUNAL_CONFIG;
+    const file = explicit ? resolve(explicit) : join(repoRoot, CONFIG_FILENAME);
+    if (!existsSync(file))
+        return null;
+    let raw;
+    try {
+        raw = readFileSync(file, 'utf8');
+    }
+    catch (err) {
+        throw new Error(`tribunal.yml: could not read ${file}: ${err.message}`);
+    }
+    let parsed;
+    try {
+        parsed = parseYamlSubset(raw);
+    }
+    catch (err) {
+        throw new Error(`${err.message} (in ${file})`);
+    }
+    const config = {};
+    // analyzers: map of id → boolean, validated against the known registry.
+    if ('analyzers' in parsed && parsed.analyzers != null) {
+        const a = parsed.analyzers;
+        if (typeof a !== 'object' || Array.isArray(a)) {
+            throw new Error(`tribunal.yml: 'analyzers' must be a map of id: true|false (in ${file})`);
+        }
+        const known = new Set(knownAnalyzerIds);
+        if (known.size === 0) {
+            // Defensive: caller forgot to register ids. Allow through without validation rather than block.
+        }
+        const out = {};
+        for (const [k, v] of Object.entries(a)) {
+            if (known.size > 0 && !known.has(k)) {
+                throw new Error(`tribunal.yml: unknown analyzer '${k}'. Known: ${[...known].sort().join(', ')} (in ${file})`);
+            }
+            if (typeof v !== 'boolean') {
+                throw new Error(`tribunal.yml: analyzers.${k} must be true|false, got ${JSON.stringify(v)} (in ${file})`);
+            }
+            out[k] = v;
+        }
+        config.analyzers = out;
+    }
+    // generated-paths: list of strings, appended to built-ins at match time.
+    if ('generated-paths' in parsed && parsed['generated-paths'] != null) {
+        const gp = parsed['generated-paths'];
+        if (!Array.isArray(gp)) {
+            throw new Error(`tribunal.yml: 'generated-paths' must be a list (in ${file})`);
+        }
+        config.generatedPaths = gp.map((item, idx) => {
+            if (typeof item !== 'string') {
+                throw new Error(`tribunal.yml: generated-paths[${idx}] must be a string (in ${file})`);
+            }
+            return item;
+        });
+    }
+    // Reject unknown top-level keys (fail-loud — typos shouldn't silently no-op).
+    const knownKeys = new Set(['analyzers', 'generated-paths']);
+    for (const k of Object.keys(parsed)) {
+        if (!knownKeys.has(k)) {
+            throw new Error(`tribunal.yml: unknown key '${k}'. Supported: ${[...knownKeys].join(', ')} (in ${file})`);
+        }
+    }
+    return config;
+}
+//# sourceMappingURL=loadConfig.js.map

package/dist/config/loadConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loadConfig.js","sourceRoot":"","sources":["../../src/config/loadConfig.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAGjD,MAAM,CAAC,MAAM,eAAe,GAAG,cAAc,CAAC;AAE9C,iHAAiH;AACjH,IAAI,gBAAgB,GAAsB,EAAE,CAAC;AAE7C;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAsB;IACxD,gBAAgB,GAAG,GAAG,CAAC;AACzB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,UAAU,CAAC,QAAgB,EAAE,UAAmB;IAC9D,MAAM,QAAQ,GAAG,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAC3D,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC5E,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAEnC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACrF,CAAC;IAED,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,GAAI,GAAa,CAAC,OAAO,QAAQ,IAAI,GAAG,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,MAAM,GAAmB,EAAE,CAAC;IAElC,wEAAwE;IACxE,IAAI,WAAW,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;QACtD,MAAM,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC;QAC3B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,iEAAiE,IAAI,GAAG,CAAC,CAAC;QAC5F,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC;QACxC,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACrB,gGAAgG;QAClG,CAAC;QACD,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAA4B,CAAC,EAAE,CAAC;YAClE,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CACb,mCAAmC,CAAC,aAAa,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,GAAG,CAC7F,CAAC;YACJ,CAAC;YACD,IAAI,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,4BAA4B,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC,CAAC;YAC5G,CAAC;YACD,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACb,CAAC;QACD,MAAM,CAAC,SAAS,GAAG,GAAG,CAAC;IACzB,CAAC;IAED,yEAAyE;IACzE,IAAI,iBAAiB,IAAI,MAAM,IAAI,MAAM,CAAC,iBAAiB,CAAC,IAAI,IAAI,EAAE,CAAC;QACrE,MAAM,EAAE,GAAG,MAAM,CAAC,iBAAiB,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,sDAAsD,IAAI,GAAG,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,CAAC,cAAc,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YAC3C,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CAAC,iCAAiC,GAAG,0BAA0B,IAAI,GAAG,CAAC,CAAC;YACzF,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED,8EAA8E;IAC9E,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAC5D,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CACb,8BAA8B,CAAC,iBAAiB,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,GAAG,CACzF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/config/parseYaml.d.ts

@@ -0,0 +1,17 @@
+/**
+ * A tiny, zero-dependency parser for the narrow YAML *subset* that tribunal.yml uses.
+ *
+ * This is deliberately NOT a general YAML parser — it covers exactly what the config schema needs and
+ * rejects anything else with a clear error, so a malformed config never silently degrades to defaults:
+ *
+ *   - top-level `key: value` (value = scalar: string | boolean | number)
+ *   - inline list value: `key: [a, b, "c"]`
+ *   - block list: a `key:` line followed by `  - item` lines (two-space indent)
+ *   - one level of nesting: a `key:` line followed by `  child: value` lines (the `analyzers:` map)
+ *   - `#` line comments and trailing comments, blank lines
+ *
+ * No anchors, no multiline strings, no flow mappings, no deeper nesting. If the schema grows, either
+ * extend this or swap in a real parser (js-yaml) — but for now keeping zero runtime deps is a project
+ * value, and this subset is fully covered by unit tests.
+ */
+export declare function parseYamlSubset(text: string): Record<string, unknown>;

package/dist/config/parseYaml.js

@@ -0,0 +1,131 @@
+/**
+ * A tiny, zero-dependency parser for the narrow YAML *subset* that tribunal.yml uses.
+ *
+ * This is deliberately NOT a general YAML parser — it covers exactly what the config schema needs and
+ * rejects anything else with a clear error, so a malformed config never silently degrades to defaults:
+ *
+ *   - top-level `key: value` (value = scalar: string | boolean | number)
+ *   - inline list value: `key: [a, b, "c"]`
+ *   - block list: a `key:` line followed by `  - item` lines (two-space indent)
+ *   - one level of nesting: a `key:` line followed by `  child: value` lines (the `analyzers:` map)
+ *   - `#` line comments and trailing comments, blank lines
+ *
+ * No anchors, no multiline strings, no flow mappings, no deeper nesting. If the schema grows, either
+ * extend this or swap in a real parser (js-yaml) — but for now keeping zero runtime deps is a project
+ * value, and this subset is fully covered by unit tests.
+ */
+/** Parse a scalar token (after stripping comments) into string | boolean | number. */
+function parseScalar(raw) {
+    const s = raw.trim();
+    if (s === '')
+        return '';
+    // strip surrounding quotes (single or double) → always a string
+    if ((s.startsWith('"') && s.endsWith('"')) || (s.startsWith("'") && s.endsWith("'"))) {
+        return s.slice(1, -1);
+    }
+    if (s === 'true' || s === 'True' || s === 'TRUE')
+        return true;
+    if (s === 'false' || s === 'False' || s === 'FALSE')
+        return false;
+    // integer/float only — reject hex/leading-zero quirks by deferring to Number
+    if (/^-?\d+$/.test(s))
+        return parseInt(s, 10);
+    if (/^-?\d+\.\d+$/.test(s))
+        return parseFloat(s);
+    return s; // bare string
+}
+/** Parse an inline flow list `[a, b, "c"]` into a (string|number|boolean)[]. */
+function parseInlineList(raw) {
+    const inner = raw.trim();
+    if (!inner.startsWith('[') || !inner.endsWith(']')) {
+        throw new Error(`Expected an inline list '[...]', got: ${raw}`);
+    }
+    const body = inner.slice(1, -1).trim();
+    if (body === '')
+        return [];
+    return body.split(',').map((part) => parseScalar(part));
+}
+/**
+ * Strip a trailing `# comment` from a value-bearing line. A `#` only counts as a comment start when
+ * preceded by whitespace or at line start (so `#fff` in a value is preserved, ` # note` is stripped).
+ */
+function stripTrailingComment(line) {
+    // naive but sufficient for this subset: a `#` that has a space before it (or is at col 0) is a comment.
+    const hash = line.search(/\s#|\s$|^#/);
+    if (hash === -1)
+        return line;
+    if (line[hash] === '#')
+        return ''; // whole line is a comment
+    return line.slice(0, hash);
+}
+export function parseYamlSubset(text) {
+    const result = {};
+    const lines = text.split('\n');
+    // State for the current top-level key we're filling (a list or nested map).
+    let listKey = null;
+    let mapKey = null;
+    const finishBlock = () => {
+        listKey = null;
+        mapKey = null;
+    };
+    for (let i = 0; i < lines.length; i++) {
+        const original = lines[i];
+        const stripped = stripTrailingComment(original);
+        // Skip blank / full-comment lines.
+        if (stripped.trim() === '' || stripped.trim().startsWith('#'))
+            continue;
+        const indent = stripped.length - stripped.trimStart().length;
+        // Indented block item under the current list key: `  - value`.
+        if (listKey && /^-\s+/.test(stripped.trim())) {
+            const item = parseScalar(stripped.trim().replace(/^-\s+/, ''));
+            result[listKey].push(item);
+            continue;
+        }
+        // Indented child under the current map key: `  child: value`.
+        if (mapKey && indent >= 2 && /^[\w-]+:\s*/.test(stripped.trim())) {
+            const m = stripped.trim().match(/^([\w-]+):\s*(.*)$/);
+            if (!m)
+                throw new Error(`tribunal.yml:${i + 1}: malformed map entry: ${original.trim()}`);
+            const [, childKey, childValRaw] = m;
+            if (childValRaw.trim() === '') {
+                throw new Error(`tribunal.yml:${i + 1}: nested map under '${mapKey}.${childKey}' is not supported`);
+            }
+            result[mapKey][childKey] = parseScalar(childValRaw);
+            continue;
+        }
+        // Otherwise: a top-level `key: value` or `key:` (opening a block). Must be at indent 0.
+        if (indent !== 0) {
+            throw new Error(`tribunal.yml:${i + 1}: unexpected indentation (no open block): ${original.trim()}`);
+        }
+        finishBlock();
+        const m = stripped.trim().match(/^([\w-]+):\s*(.*)$/);
+        if (!m)
+            throw new Error(`tribunal.yml:${i + 1}: expected 'key: value', got: ${original.trim()}`);
+        const [, key, valRaw] = m;
+        const val = valRaw.trim();
+        if (val === '') {
+            // Opens a block — we don't yet know if it's a list or a map; decide on the next non-blank line.
+            // For our schema, `analyzers:` is a map and `generated-paths:` is a list. Peek ahead.
+            const nextNonBlank = lines
+                .slice(i + 1)
+                .find((l) => stripTrailingComment(l).trim() !== '' && !stripTrailingComment(l).trim().startsWith('#'));
+            if (nextNonBlank && /^-\s+/.test(nextNonBlank.trim())) {
+                result[key] = [];
+                listKey = key;
+            }
+            else {
+                result[key] = {};
+                mapKey = key;
+            }
+            continue;
+        }
+        if (val.startsWith('[')) {
+            result[key] = parseInlineList(val);
+            continue;
+        }
+        result[key] = parseScalar(val);
+    }
+    finishBlock();
+    return result;
+}
+//# sourceMappingURL=parseYaml.js.map

package/dist/config/parseYaml.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parseYaml.js","sourceRoot":"","sources":["../../src/config/parseYaml.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,sFAAsF;AACtF,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACrB,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IACxB,gEAAgE;IAChE,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QACrF,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAC9D,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAClE,6EAA6E;IAC7E,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9C,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,CAAC,CAAC,cAAc;AAC1B,CAAC;AAED,gFAAgF;AAChF,SAAS,eAAe,CAAC,GAAW;IAClC,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,yCAAyC,GAAG,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACvC,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IAC3B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED;;;GAGG;AACH,SAAS,oBAAoB,CAAC,IAAY;IACxC,wGAAwG;IACxG,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACvC,IAAI,IAAI,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7B,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC,CAAC,0BAA0B;IAC7D,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAE/B,4EAA4E;IAC5E,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,MAAM,GAAkB,IAAI,CAAC;IAEjC,MAAM,WAAW,GAAG,GAAS,EAAE;QAC7B,OAAO,GAAG,IAAI,CAAC;QACf,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC,CAAC;IAEF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,QAAQ,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAChD,mCAAmC;QACnC,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAExE,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,GAAG,QAAQ,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC;QAE7D,+DAA+D;QAC/D,IAAI,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;YAC9D,MAAM,CAAC,OAAO,CAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1C,SAAS;QACX,CAAC;QACD,8DAA8D;QAC9D,IAAI,MAAM,IAAI,MAAM,IAAI,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACjE,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;YACtD,IAAI,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,0BAA0B,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC1F,MAAM,CAAC,EAAE,QAAQ,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC;YACpC,IAAI,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,uBAAuB,MAAM,IAAI,QAAQ,oBAAoB,CAAC,CAAC;YACtG,CAAC;YACA,MAAM,CAAC,MAAM,CAA6B,CAAC,QAAQ,CAAC,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;YACjF,SAAS;QACX,CAAC;QAED,wFAAwF;QACxF,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,gBAAgB,CAAC,GAAG,CAAC,6CAA6C,QAAQ,CAAC,IAAI,EAAE,EAAE,CACpF,CAAC;QACJ,CAAC;QACD,WAAW,EAAE,CAAC;QAEd,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACtD,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,iCAAiC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACjG,MAAM,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAE1B,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;YACf,gGAAgG;YAChG,sFAAsF;YACtF,MAAM,YAAY,GAAG,KAAK;iBACvB,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC;iBACZ,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;YACzG,IAAI,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;gBACtD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;gBACjB,OAAO,GAAG,GAAG,CAAC;YAChB,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;gBACjB,MAAM,GAAG,GAAG,CAAC;YACf,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,CAAC,GAAG,CAAC,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;YACnC,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;IAED,WAAW,EAAE,CAAC;IACd,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/config/types.d.ts

@@ -0,0 +1,17 @@
+/**
+ * The tribunal.yml config shape. All fields optional — an absent file means "all defaults" and is
+ * indistinguishable from no config (config is purely additive).
+ */
+export interface TribunalConfig {
+    /**
+     * Per-analyzer enable/disable, keyed by analyzer id. Default: every analyzer enabled. Unknown ids are
+     * rejected at load time (typo guard), so a misspelled key fails loudly rather than silently no-op'ing.
+     */
+    analyzers?: Record<string, boolean>;
+    /**
+     * EXTRA generated/build-output paths, appended to the built-in defaults. The built-ins (`dist/`,
+     * `action-dist/`, …) are always present — config can only ADD coverage, never drop a safety net.
+     * See src/paths.ts for the defaults and src/config/loadConfig.ts for merge semantics.
+     */
+    generatedPaths?: string[];
+}

package/dist/config/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/config/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/config/types.ts"],"names":[],"mappings":""}

package/dist/diff/parseUnifiedDiff.d.ts

@@ -5,5 +5,9 @@ import type { ChangedFile } from '../types.js';
  *
  * We deliberately track only new-file line numbers: analyzers reason about the post-change tree, so a
  * "touched" node is one whose new-file line range overlaps `addedLines`.
+ *
+ * Both git-style diffs (`diff --git`) and plain unified diffs (no `diff --git` header, e.g. `diff -u` or
+ * a `git format-patch` body) are supported. A plain diff opens a file record on its first `---`/`+++`
+ * header so a hand-written or piped patch is never silently dropped to `[]`.
  */
 export declare function parseUnifiedDiff(diff: string): ChangedFile[];