@inerrata-corporation/errata 2.0.6-dev.2278 → 2.0.6-dev.2330

package/errata.mjs

@@ -600,6 +600,15 @@ var init_graph_events = __esm({
         prefixes: ["mergegate."],
         consumer: "graph-health.mjs 'Graph merge gate' triggers (truncation + refused backlog, pending a live baseline) beside ingest.judge.*"
       },
+      "graph.causalroutes": {
+        // Causal-route induction + its membrane heal (PRIV-causal-route-membrane), up to two
+        // events per nightly run: causalroutes.heal.* (what the heal did to Triages minted
+        // before the public-only gate) and causalroutes.mint.* (incl. skippedNonPublicPairs —
+        // the cost of the gate). causalroutes.heal.stillExposed is the alertable number:
+        // private-sourced text still publicly readable. It must be 0.
+        prefixes: ["causalroutes."],
+        consumer: "scripts/probes/deep-health.ts \xA710b (pnpm probe:graph-health) reads the same counters off the day's MemoryReport (triageHeal*) and recomputes stillExposed live; a graph-health.mjs trigger on causalroutes.heal.stillExposed > 0 is owed once a live baseline exists"
+      },
       "graph.census": {
         prefixes: [
           "nodes.",
@@ -16353,6 +16362,9 @@ function parsePackageJson(path2, text) {
   }
   return deps;
 }
+function isPep508DirectRef(spec) {
+  return /^[A-Za-z0-9][A-Za-z0-9._-]*(?:\[[^\]]*\])?\s*@\s*\S/.test(spec.trim());
+}
 function parseRequirements(path2, text) {
   const deps = [];
   for (const raw2 of text.split(/\r?\n/)) {
@@ -16360,7 +16372,14 @@ function parseRequirements(path2, text) {
     if (!line || line.startsWith("-") || line.startsWith("git+") || line.startsWith("http")) continue;
     const m = /^([A-Za-z0-9][A-Za-z0-9._-]*)(?:\[[^\]]*\])?\s*(?:([=<>!~]+)\s*([^\s;]+))?/.exec(line);
     if (m) {
-      deps.push({ ecosystem: "pypi", name: m[1] ?? "", version: m[2] ? m[3] ?? null : null, kind: "package", manifest: path2 });
+      deps.push({
+        ecosystem: "pypi",
+        name: m[1] ?? "",
+        version: m[2] ? m[3] ?? null : null,
+        kind: "package",
+        manifest: path2,
+        ...isPep508DirectRef(line) ? { directRef: true } : {}
+      });
     }
   }
   return deps;
@@ -16372,7 +16391,16 @@ function parsePyproject(path2, text) {
   for (const s of (m[1] ?? "").matchAll(/"([^"]+)"|'([^']+)'/g)) {
     const spec = s[1] || s[2] || "";
     const mm = /^([A-Za-z0-9][A-Za-z0-9._-]*)/.exec(spec);
-    if (mm) deps.push({ ecosystem: "pypi", name: mm[1] ?? "", version: null, kind: "package", manifest: path2 });
+    if (mm) {
+      deps.push({
+        ecosystem: "pypi",
+        name: mm[1] ?? "",
+        version: null,
+        kind: "package",
+        manifest: path2,
+        ...isPep508DirectRef(spec) ? { directRef: true } : {}
+      });
+    }
   }
   return deps;
 }
@@ -76512,10 +76540,13 @@ function isRuntimeToken(token) {
 function rankCandidates(cs) {
   return [...cs].sort((a, b) => b.weight - a.weight || a.name.localeCompare(b.name));
 }
+var VCS_HOST_SHORTHAND = /^(?:github|gitlab|bitbucket|gist):/;
+var SCP_STYLE_REMOTE = /^[\w.-]+@[\w.-]+:/;
+var BARE_REPO_SHORTHAND = /^[a-z0-9_.-]+\/[a-z0-9_.-]+(?:#.*)?$/;
 function isLocalSpec(version2) {
   if (!version2) return false;
   const v = version2.trim().toLowerCase();
-  return v.startsWith("workspace:") || v.startsWith("link:") || v.startsWith("file:") || v.startsWith("portal:") || v.startsWith("path:") || v.startsWith("git:") || v.startsWith("git+") || v.includes("://");
+  return v.startsWith("workspace:") || v.startsWith("link:") || v.startsWith("file:") || v.startsWith("portal:") || v.startsWith("path:") || v.startsWith("git:") || v.startsWith("git+") || v.includes("://") || VCS_HOST_SHORTHAND.test(v) || SCP_STYLE_REMOTE.test(v) || BARE_REPO_SHORTHAND.test(v);
 }
 function retrievalStackTokens(input) {
   const cap = input.cap ?? RETRIEVAL_STACK_CAP;
@@ -76564,7 +76595,7 @@ function retrievalStackTokens(input) {
       if (RUNTIME_KINDS.has(d.kind)) continue;
       const ecosystem = d.ecosystem.toLowerCase();
       if (lockfileKeys.has(ecoKey(ecosystem, d.name))) continue;
-      if (isLocalSpec(d.version)) continue;
+      if (d.directRef || isLocalSpec(d.version)) continue;
       if (!isPublicDep({ ecosystem, name: d.name }, registry2)) continue;
       const key = ecoKey(ecosystem, d.name);
       const prev = counted.get(key);
@@ -78093,7 +78124,7 @@ function createWatchBreaker(deps) {
 }
 
 // src/engine.ts
-var DAEMON_VERSION = true ? "2.0.6-dev.2278" : "2.0.0-alpha.0";
+var DAEMON_VERSION = true ? "2.0.6-dev.2330" : "2.0.0-alpha.0";
 var IGNORED_PATH = /[\\/](?:\.git|node_modules|\.errata|\.claude|\.codex|\.cursor|\.turbo|\.next|dist|coverage|test-results|playwright-report|__pycache__)(?:[\\/]|$)/;
 var IGNORED_NOISE = /castalia\.db|eventlog\.sqlite|turn-cursors/;
 var GIT_OP_MUTE_MS = 4e3;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inerrata-corporation/errata",
-  "version": "2.0.6-dev.2278",
+  "version": "2.0.6-dev.2330",
   "description": "errata - local-first observation engine for AI coding agents",
   "type": "module",
   "bin": {