@inerrata-corporation/errata 2.0.17-dev.3504 → 2.0.17-dev.3527

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inerrata-corporation/errata",
-  "version": "2.0.17-dev.3504",
+  "version": "2.0.17-dev.3527",
   "description": "errata - local-first observation engine for AI coding agents",
   "type": "module",
   "bin": {

package/pass-worker.mjs

@@ -693,6 +693,11 @@ var init_claim_id = __esm({
 });
 
 // ../../packages/shared/src/identity.ts
+function packageCanonicalId(p) {
+  const eco = p.ecosystem.toLowerCase();
+  const name2 = eco === "npm" ? p.name.toLowerCase() : p.name;
+  return `pkg:${eco}/${name2}${p.version ? `@${p.version}` : ""}`;
+}
 var init_identity = __esm({
   "../../packages/shared/src/identity.ts"() {
     "use strict";
@@ -1807,10 +1812,10 @@ var init_regexes = __esm({
     duration = /^P(?:(\d+W)|(?!.*W)(?=\d|T\d)(\d+Y)?(\d+M)?(\d+D)?(T(?=\d)(\d+H)?(\d+M)?(\d+([.,]\d+)?S)?)?)$/;
     extendedDuration = /^[-+]?P(?!$)(?:(?:[-+]?\d+Y)|(?:[-+]?\d+[.,]\d+Y$))?(?:(?:[-+]?\d+M)|(?:[-+]?\d+[.,]\d+M$))?(?:(?:[-+]?\d+W)|(?:[-+]?\d+[.,]\d+W$))?(?:(?:[-+]?\d+D)|(?:[-+]?\d+[.,]\d+D$))?(?:T(?=[\d+-])(?:(?:[-+]?\d+H)|(?:[-+]?\d+[.,]\d+H$))?(?:(?:[-+]?\d+M)|(?:[-+]?\d+[.,]\d+M$))?(?:[-+]?\d+(?:[.,]\d+)?S)?)??$/;
     guid = /^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$/;
-    uuid = (version2) => {
-      if (!version2)
+    uuid = (version3) => {
+      if (!version3)
         return /^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$/;
-      return new RegExp(`^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-${version2}[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$`);
+      return new RegExp(`^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-${version3}[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$`);
     };
     uuid4 = /* @__PURE__ */ uuid(4);
     uuid6 = /* @__PURE__ */ uuid(6);
@@ -14619,10 +14624,10 @@ function fromJSONSchema(schema, params) {
   if (typeof schema === "boolean") {
     return schema ? z.any() : z.never();
   }
-  const version2 = detectVersion(schema, params?.defaultTarget);
+  const version3 = detectVersion(schema, params?.defaultTarget);
   const defs = schema.$defs || schema.definitions || {};
   const ctx = {
-    version: version2,
+    version: version3,
     defs,
     refs: /* @__PURE__ */ new Map(),
     processing: /* @__PURE__ */ new Set(),
@@ -15094,6 +15099,50 @@ var init_history_evidence = __esm({
   }
 });
 
+// ../../packages/shared/src/history-dependencies.ts
+function historyDependencyIdentity(raw) {
+  const parsed = HistoryDependencyContextSchema.safeParse(raw);
+  if (!parsed.success || !parsed.data.complete || parsed.data.conflict) return null;
+  if (parsed.data.dependencies.some((d) => !exactHistoryDependencyVersion(d))) return null;
+  return digest(parsed.data.dependencies.map((d) => [d.packageId, d.manifestId, d.side, d.declaredRange, d.resolvedVersion]).sort((a, b) => JSON.stringify(a).localeCompare(JSON.stringify(b))));
+}
+function exactHistoryDependencyVersion(d) {
+  return d.resolvedVersion ?? (/^\d+\.\d+\.\d+(?:-[\w.-]+)?$/.test(d.declaredRange ?? "") ? d.declaredRange : null);
+}
+var version2, HistoryDependencySchema, HistoryDependencyContextSchema, HISTORY_RECONCILE_BUILD;
+var init_history_dependencies = __esm({
+  "../../packages/shared/src/history-dependencies.ts"() {
+    "use strict";
+    init_zod();
+    init_hash();
+    init_identity();
+    version2 = external_exports.string().max(160).nullable();
+    HistoryDependencySchema = external_exports.object({
+      packageId: external_exports.string().startsWith("pkg:").max(300),
+      ecosystem: external_exports.string().min(1).max(20),
+      name: external_exports.string().min(1).max(200),
+      kind: external_exports.enum(["package", "sdk", "engine", "runtime", "image"]),
+      manifestId: external_exports.string().regex(/^hmanifest_[a-f0-9]{32}$/),
+      sourceCommit: external_exports.string().regex(/^[a-f0-9]{7,64}$/),
+      side: external_exports.enum(["before", "after"]),
+      /** Environment-only entries constrain applicability but never mint a package edge. */
+      binding: external_exports.enum(["named", "import", "environment"]).optional(),
+      declaredRange: version2,
+      resolvedVersion: version2,
+      pathTokens: external_exports.array(external_exports.string().regex(/^p\d+$/)).max(500),
+      importTokens: external_exports.array(external_exports.string().regex(/^p\d+$/)).max(500)
+    }).refine((d) => d.packageId === packageCanonicalId({ ecosystem: d.ecosystem, name: d.name }), "package identity must match its evidence");
+    HistoryDependencyContextSchema = external_exports.object({
+      schemaVersion: external_exports.literal("history-deps-1"),
+      complete: external_exports.boolean(),
+      dependencies: external_exports.array(HistoryDependencySchema).max(256),
+      statedVersions: external_exports.array(external_exports.object({ packageId: external_exports.string().max(300), version: external_exports.string().max(80) })).max(64).optional(),
+      conflict: external_exports.boolean().optional()
+    });
+    HISTORY_RECONCILE_BUILD = "history-reconcile-2";
+  }
+});
+
 // ../../packages/shared/src/edge-rules.ts
 function isValidEdge(from, type, to) {
   const rule = EDGE_RULES[type];
@@ -15225,6 +15274,7 @@ var init_wire = __esm({
     "use strict";
     init_zod();
     init_history_evidence();
+    init_history_dependencies();
     init_castalia();
     init_edge_rules();
     init_symbol_intent();
@@ -15348,6 +15398,7 @@ var init_wire = __esm({
         extractedBy: external_exports.enum(INGEST_EXTRACTION_SOURCES).optional(),
         sourceSupport: external_exports.literal("supported").optional(),
         historicalAnchors: external_exports.array(HistoryAnchorSourceSchema).max(160).optional(),
+        dependencyEvidence: external_exports.array(HistoryDependencySchema).max(256).optional(),
         evidence: external_exports.array(HistoryEvidenceRefSchema).max(12).optional(),
         verificationEvidence: external_exports.array(HistoryEvidenceRefSchema).max(12).optional(),
         verifierBuild: external_exports.string().max(80).optional(),
@@ -15439,16 +15490,16 @@ var init_project_symbol = __esm({
 // ../../packages/shared/src/lockfile.ts
 function rankDirect(raw, ecosystem = "npm") {
   const byName = /* @__PURE__ */ new Map();
-  for (const { name: name2, version: version2 } of raw) {
+  for (const { name: name2, version: version3 } of raw) {
     const prev = byName.get(name2);
     if (prev) {
       prev.importers++;
       continue;
     }
     byName.set(name2, {
-      purl: `pkg:${ecosystem}/${name2}@${version2}`,
+      purl: `pkg:${ecosystem}/${name2}@${version3}`,
       name: name2,
-      version: version2,
+      version: version3,
       ecosystem,
       importers: 1
     });
@@ -15457,11 +15508,11 @@ function rankDirect(raw, ecosystem = "npm") {
     (a, b) => b.importers - a.importers || a.name.localeCompare(b.name)
   );
 }
-function npmPurl(name2, version2) {
-  return `pkg:npm/${name2}@${version2}`;
+function npmPurl(name2, version3) {
+  return `pkg:npm/${name2}@${version3}`;
 }
-function component(name2, version2) {
-  return { purl: npmPurl(name2, version2), name: name2, version: version2, ecosystem: "npm" };
+function component(name2, version3) {
+  return { purl: npmPurl(name2, version3), name: name2, version: version3, ecosystem: "npm" };
 }
 function isNpmImporterPath(path) {
   return path === "" || !path.includes("node_modules/");
@@ -15482,13 +15533,13 @@ function parsePackageLockJson(jsonText) {
     const ix = path.lastIndexOf("node_modules/");
     if (ix === -1) continue;
     const name2 = path.slice(ix + "node_modules/".length);
-    const version2 = typeof meta3.version === "string" ? meta3.version : "";
-    if (!name2 || !version2) continue;
-    components.push(component(name2, version2));
-    byPath.set(path, { name: name2, version: version2 });
+    const version3 = typeof meta3.version === "string" ? meta3.version : "";
+    if (!name2 || !version3) continue;
+    components.push(component(name2, version3));
+    byPath.set(path, { name: name2, version: version3 });
     const depth = path.split("node_modules/").length;
     const prev = hoisted.get(name2);
-    if (!prev || depth < prev.depth) hoisted.set(name2, { version: version2, depth });
+    if (!prev || depth < prev.depth) hoisted.set(name2, { version: version3, depth });
   }
   const dependencies = [];
   for (const [path, meta3] of Object.entries(packages)) {
@@ -15531,9 +15582,9 @@ function splitPnpmKey(raw) {
   const at = k.lastIndexOf("@");
   if (at <= 0) return null;
   const name2 = k.slice(0, at);
-  const version2 = k.slice(at + 1);
-  if (!name2 || !version2) return null;
-  return { name: name2, version: version2 };
+  const version3 = k.slice(at + 1);
+  if (!name2 || !version3) return null;
+  return { name: name2, version: version3 };
 }
 function parsePnpmImporters(lines) {
   const DEP_SECTIONS = /* @__PURE__ */ new Set(["dependencies:", "devDependencies:", "optionalDependencies:"]);
@@ -15569,14 +15620,14 @@ function parsePnpmImporters(lines) {
     if (indent === 8 && depName) {
       const t = line.trim();
       if (!t.startsWith("version:")) continue;
-      let version2 = t.slice("version:".length).trim().replace(/^['"]|['"]$/g, "");
-      const paren = version2.indexOf("(");
-      if (paren !== -1) version2 = version2.slice(0, paren);
-      if (!version2 || version2.startsWith("link:") || version2.startsWith("file:") || version2.includes("://")) {
+      let version3 = t.slice("version:".length).trim().replace(/^['"]|['"]$/g, "");
+      const paren = version3.indexOf("(");
+      if (paren !== -1) version3 = version3.slice(0, paren);
+      if (!version3 || version3.startsWith("link:") || version3.startsWith("file:") || version3.includes("://")) {
         depName = null;
         continue;
       }
-      raw.push({ name: depName, version: version2 });
+      raw.push({ name: depName, version: version3 });
       depName = null;
     }
   }
@@ -15692,19 +15743,19 @@ function parseGemfileLock(text) {
     const spec = specLine.exec(line);
     if (spec) {
       const name2 = spec[1];
-      const version2 = (spec[2] ?? "").trim();
+      const version3 = (spec[2] ?? "").trim();
       if (section === "path-or-git") {
         nonRegistry.add(name2);
         currentGem = null;
         continue;
       }
-      if (!version2) continue;
-      currentGem = { name: name2, version: version2 };
-      registryVersions.set(name2, version2);
-      const purl = `pkg:gem/${name2}@${version2}`;
+      if (!version3) continue;
+      currentGem = { name: name2, version: version3 };
+      registryVersions.set(name2, version3);
+      const purl = `pkg:gem/${name2}@${version3}`;
       if (!seen.has(purl)) {
         seen.add(purl);
-        components.push({ purl, name: name2, version: version2, ecosystem: "gem" });
+        components.push({ purl, name: name2, version: version3, ecosystem: "gem" });
       }
       continue;
     }
@@ -15774,8 +15825,8 @@ function parseGodot(path, text) {
   const m = /config\/features=PackedStringArray\(([^)]*)\)/.exec(text);
   if (!m) return [];
   const feats = (m[1] ?? "").split(",").map((f) => f.trim().replace(/^"|"$/g, "")).filter((f) => f.length > 0);
-  const version2 = feats.find((f) => /^\d+\.\d+/.test(f)) ?? null;
-  return [{ ecosystem: "godot", name: "godot", version: version2, kind: "engine", manifest: path }];
+  const version3 = feats.find((f) => /^\d+\.\d+/.test(f)) ?? null;
+  return [{ ecosystem: "godot", name: "godot", version: version3, kind: "engine", manifest: path }];
 }
 function parsePackageJson(path, text) {
   let obj;
@@ -15790,8 +15841,8 @@ function parsePackageJson(path, text) {
     const section = obj[key];
     if (!section || typeof section !== "object") continue;
     for (const [name2, ver] of Object.entries(section)) {
-      const version2 = ver ? String(ver) : null;
-      deps.push({ ecosystem: "npm", name: name2, version: version2, kind: "package", manifest: path });
+      const version3 = ver ? String(ver) : null;
+      deps.push({ ecosystem: "npm", name: name2, version: version3, kind: "package", manifest: path });
     }
   }
   return deps;
@@ -15896,12 +15947,12 @@ function parseGradle(path, text) {
   const re = new RegExp(`\\b(?:${GRADLE_CONFIGS})\\s*(?:\\(\\s*)?["']([^"']+)["']`, "g");
   for (const m of text.matchAll(re)) {
     const parts2 = (m[1] ?? "").split(":");
-    const [group, artifact, version2] = parts2;
+    const [group, artifact, version3] = parts2;
     if (!group || !artifact || parts2.length < 2) continue;
     deps.push({
       ecosystem: "maven",
       name: mavenName(group, artifact),
-      version: version2?.trim() || null,
+      version: version3?.trim() || null,
       kind: "package",
       manifest: path
     });
@@ -15915,18 +15966,18 @@ function parseVersionCatalog(path, text) {
   for (const line of (section[1] ?? "").split(/\r?\n/)) {
     if (!line.trim() || line.trimStart().startsWith("#")) continue;
     const module2 = /module\s*=\s*["']([^"']+)["']/.exec(line)?.[1];
-    const version2 = /version(?:\.ref)?\s*=\s*["']([^"']+)["']/.exec(line)?.[1] ?? null;
+    const version3 = /version(?:\.ref)?\s*=\s*["']([^"']+)["']/.exec(line)?.[1] ?? null;
     if (module2) {
       const [group2, artifact2] = module2.split(":");
       if (group2 && artifact2) {
-        deps.push({ ecosystem: "maven", name: mavenName(group2, artifact2), version: version2, kind: "package", manifest: path });
+        deps.push({ ecosystem: "maven", name: mavenName(group2, artifact2), version: version3, kind: "package", manifest: path });
       }
       continue;
     }
     const group = /\bgroup\s*=\s*["']([^"']+)["']/.exec(line)?.[1];
     const artifact = /\bname\s*=\s*["']([^"']+)["']/.exec(line)?.[1];
     if (group && artifact) {
-      deps.push({ ecosystem: "maven", name: mavenName(group, artifact), version: version2, kind: "package", manifest: path });
+      deps.push({ ecosystem: "maven", name: mavenName(group, artifact), version: version3, kind: "package", manifest: path });
     }
   }
   return deps;
@@ -16080,7 +16131,9 @@ function historyReadPolicy(node, options = {}) {
   const q = raw && typeof raw === "object" ? raw : {};
   const source = q["sourceSupport"] ?? "unreviewed";
   const applicability = q["applicability"] ?? "unknown";
-  const current = options.atCommit !== void 0 && q["evaluatedAtCommit"] === options.atCommit;
+  const proof = q["reconciliationEvidence"];
+  const environmentKnown = historyDependencyIdentity(q["dependencyContext"]) !== null && proof?.["build"] === HISTORY_RECONCILE_BUILD;
+  const current = options.atCommit !== void 0 && q["evaluatedAtCommit"] === options.atCommit && environmentKnown;
   const invalid = source === "contradicted" || source === "quarantined";
   const passive = options.mode === "passive";
   const validation = node.validationSource ?? attrs["validationSource"];
@@ -16090,12 +16143,13 @@ function historyReadPolicy(node, options = {}) {
   return {
     allow,
     history: true,
-    notice: `History-derived${at}; source ${String(source)}; applicability ${current ? String(applicability) : "unknown at this checkout"}; ${independentlyValidated ? "separate validation recorded" : "not independently validated"}.`
+    notice: `History-derived${at}; source ${String(source)}; applicability ${current ? String(applicability) : "unknown at this checkout"}; ${environmentKnown ? "dependency context checked" : "dependency applicability unverified"}; ${independentlyValidated ? "separate validation recorded" : "not independently validated"}.`
   };
 }
 var init_history_read = __esm({
   "../../packages/shared/src/history-read.ts"() {
     "use strict";
+    init_history_dependencies();
   }
 });
 
@@ -16114,6 +16168,7 @@ var init_history_revision = __esm({
     init_zod();
     init_hash();
     init_history_evidence();
+    init_history_dependencies();
     Sha = external_exports.string().regex(/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/);
     HistoryRevisionRequestSchema = external_exports.strictObject({
       atCommit: Sha,
@@ -16122,7 +16177,8 @@ var init_history_revision = __esm({
         occurrenceId: external_exports.string().min(1).max(100),
         symbols: external_exports.array(external_exports.strictObject({ symbolId: external_exports.string().regex(/^sym_[a-f0-9]{8,64}$/), bodyHash: external_exports.string().regex(/^[a-f0-9]{8,64}$/) })).max(32),
         /** Scrubbed, tokenized net change from this occurrence's source to atCommit. */
-        diff: external_exports.string().max(16e3).optional()
+        diff: external_exports.string().max(16e3).optional(),
+        dependencyContext: HistoryDependencyContextSchema.optional()
       })).max(50)
     });
   }
@@ -16169,6 +16225,7 @@ var init_src = __esm({
     init_history_temporal();
     init_history_revision();
     init_history_evidence();
+    init_history_dependencies();
     init_hash();
     init_error_signature();
     init_canonicalize();
@@ -21534,10 +21591,10 @@ ${JSON.stringify(symbolNames, null, 2)}`);
           this.language = null;
         } else if (language.constructor === Language) {
           address = language[0];
-          const version2 = C._ts_language_abi_version(address);
-          if (version2 < MIN_COMPATIBLE_VERSION || LANGUAGE_VERSION < version2) {
+          const version3 = C._ts_language_abi_version(address);
+          if (version3 < MIN_COMPATIBLE_VERSION || LANGUAGE_VERSION < version3) {
             throw new Error(
-              `Incompatible language version ${version2}. Compatibility range ${MIN_COMPATIBLE_VERSION} through ${LANGUAGE_VERSION}.`
+              `Incompatible language version ${version3}. Compatibility range ${MIN_COMPATIBLE_VERSION} through ${LANGUAGE_VERSION}.`
             );
           }
           this.language = language;
@@ -26439,8 +26496,8 @@ var SqliteGraphStore = class {
   freezeNode(liveId, t) {
     const live = this.getNode(liveId);
     if (!live) return null;
-    const version2 = live.version ?? 1;
-    const frozenId = `${liveId}@v${version2}`;
+    const version3 = live.version ?? 1;
+    const frozenId = `${liveId}@v${version3}`;
     if (this.getNode(frozenId)) {
       this.stmts.advanceLive.run({ live_id: liveId, t });
       return frozenId;
@@ -26784,13 +26841,13 @@ function linkProblemToPackages(store2, problemId, text, ts, index) {
   if (idx.size === 0) return { linked: [] };
   const already = new Set(store2.outEdges(problemId, ["DEPENDS_ON"]).map((e) => e.to));
   const linked = [];
-  for (const { node, version: version2 } of matchPackagesInText(text, idx)) {
+  for (const { node, version: version3 } of matchPackagesInText(text, idx)) {
     if (already.has(node.id)) continue;
     addDependency(store2, {
       fromId: problemId,
       toId: node.id,
       relation: "depends-on",
-      evidence: version2 ? `named in problem (@${version2})` : "named in problem statement",
+      evidence: version3 ? `named in problem (@${version3})` : "named in problem statement",
       ts,
       extractionSource: "daemon-extracted"
     });