@iowarp/clio-coder 0.4.3 → 0.4.4

package/src/tools/verify/scripts.ts

@@ -1,17 +1,30 @@
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import path from "node:path";
-import { resolveSafeCwd } from "../../core/safe-exec.js";
+import { resolveSafeCwd, runCommandVector, type SafeCommandResult } from "../../core/safe-exec.js";
 import { declaredVerificationScripts, VERIFICATION_SCRIPT_FAMILY_HINT } from "../../core/verification-scripts.js";
 import type { ToolResult } from "../registry.js";
 import { runVectorTool } from "../safe-exec.js";
 import {
 	type DeclaredCheck,
 	type DeclaredCheckSource,
+	type DeclaredNumericCompare,
+	type DeclaredPerfBudget,
 	loadProjectVerifierCatalog,
 	PROJECT_VERIFIER_CATALOG_RELATIVE_PATH,
 	packageDeclaredCheck,
 	resolveProjectVerifierExecutionCwd,
 } from "./catalog.js";
+import { compareNumeric, type NumericCompareReport, parseNumericPayload, renderNumericReport } from "./numeric.js";
+import {
+	evaluatePerfBudget,
+	type PerfBaseline,
+	type PerfBudgetReport,
+	parsePerfBaseline,
+	renderPerfBaseline,
+} from "./perf.js";
+
+/** The structured verdict a numeric-compare or perf-budget check records beside the command facts. */
+export type DeclaredCheckReport = NumericCompareReport | PerfBudgetReport;
 
 /**
  * Package scripts and the project catalog meet here as one canonical check
@@ -197,6 +210,7 @@ function withDeclaredEvidence(result: ToolResult, check: DeclaredCheck): ToolRes
 			...result.details,
 			action: "verify",
 			check: check.id,
+			kind: check.kind,
 			source: { ...check.source },
 			description: check.description,
 			declaredCommand: [...check.command],
@@ -207,15 +221,228 @@ function withDeclaredEvidence(result: ToolResult, check: DeclaredCheck): ToolRes
 	};
 }
 
+/**
+ * The JSON object a numeric-compare command printed. The whole text is tried
+ * first; when the command also wrote diagnostics around it, the span from the
+ * first `{` to the last `}` is tried once more, so a preamble line does not
+ * turn a correct payload into a parse failure.
+ */
+export function extractNumericPayloadText(output: string): string {
+	const trimmed = output.trim();
+	try {
+		JSON.parse(trimmed);
+		return trimmed;
+	} catch {
+		const start = trimmed.indexOf("{");
+		const end = trimmed.lastIndexOf("}");
+		return start >= 0 && end > start ? trimmed.slice(start, end + 1) : trimmed;
+	}
+}
+
+/** Read a repository-relative check file inside the workspace root, as text. */
+function readCheckFile(workspaceRoot: string, relative: string, label: string): string | Error {
+	let resolved: string;
+	try {
+		resolved = resolveSafeCwd(relative, workspaceRoot);
+	} catch (error) {
+		return new Error(`${label} ${error instanceof Error ? error.message : String(error)}`);
+	}
+	if (!existsSync(resolved)) return new Error(`${label} '${relative}' does not exist`);
+	try {
+		return readFileSync(resolved, "utf8");
+	} catch (error) {
+		return new Error(`${label} '${relative}' cannot be read (${error instanceof Error ? error.message : String(error)})`);
+	}
+}
+
+/** Judge a numeric-compare command's stdout against reference text already read from disk. Pure. */
+export function judgeNumericTexts(
+	stdout: string,
+	referenceText: string,
+	tolerance: DeclaredNumericCompare["tolerance"],
+	referenceLabel: string,
+): NumericCompareReport | Error {
+	const reference = parseNumericPayload(referenceText, referenceLabel);
+	if (reference instanceof Error) return reference;
+	const actual = parseNumericPayload(extractNumericPayloadText(stdout), "command output");
+	if (actual instanceof Error) return actual;
+	return compareNumeric(actual, reference, tolerance);
+}
+
+/** Judge a numeric-compare command's stdout against the declared reference under the workspace root. */
+function judgeNumericCompare(
+	stdout: string,
+	numeric: DeclaredNumericCompare,
+	workspaceRoot: string,
+): NumericCompareReport | Error {
+	const referenceText = readCheckFile(workspaceRoot, numeric.reference, "reference");
+	if (referenceText instanceof Error) return referenceText;
+	return judgeNumericTexts(stdout, referenceText, numeric.tolerance, `reference '${numeric.reference}'`);
+}
+
+/** Judge a measured wall time against a budget, or against baseline text already read from disk. Pure. */
+export function judgePerfTexts(
+	measuredMs: number,
+	perf: DeclaredPerfBudget,
+	baselineText: string | undefined,
+	baselineLabel: string,
+): PerfBudgetReport | Error {
+	let baseline: PerfBaseline | undefined;
+	if (perf.baseline !== undefined) {
+		if (baselineText === undefined) {
+			return new Error(`${baselineLabel} is missing; record it with \`clio-coder verifiers baseline <id>\``);
+		}
+		const parsed = parsePerfBaseline(baselineText, baselineLabel);
+		if (parsed instanceof Error) return parsed;
+		baseline = parsed;
+	}
+	return evaluatePerfBudget(measuredMs, {
+		...(perf.budget !== undefined ? { budget: perf.budget } : {}),
+		...(baseline !== undefined ? { baseline } : {}),
+		...(perf.tolerance?.relative !== undefined ? { relative: perf.tolerance.relative } : {}),
+	});
+}
+
+/** Judge a measured wall time against the declared budget or the recorded baseline under the workspace root. */
+function judgePerfBudget(
+	measuredMs: number,
+	perf: DeclaredPerfBudget,
+	workspaceRoot: string,
+): PerfBudgetReport | Error {
+	let baselineText: string | undefined;
+	if (perf.baseline !== undefined) {
+		const text = readCheckFile(workspaceRoot, perf.baseline, "baseline");
+		if (text instanceof Error) {
+			return new Error(`${text.message}; record it with \`clio-coder verifiers baseline <id>\``);
+		}
+		baselineText = text;
+	}
+	return judgePerfTexts(measuredMs, perf, baselineText, `baseline '${perf.baseline ?? ""}'`);
+}
+
+function commandFacts(result: SafeCommandResult): Record<string, unknown> {
+	return {
+		command: [result.file, ...result.args].join(" "),
+		argv: [result.file, ...result.args],
+		cwd: result.cwd,
+		exitCode: result.exitCode,
+		durationMs: result.durationMs,
+		aborted: result.aborted,
+		timedOut: result.timedOut,
+		outputCapped: result.outputCapped,
+	};
+}
+
+/**
+ * Run a numeric-compare or perf-budget check: the command through the same
+ * safe-exec spine as a command check, then the pure judgement. A command that
+ * exits non-zero, times out, or is aborted fails before any comparison, so a
+ * crashed validator never reads as a tolerance verdict.
+ */
+async function runJudgedCheck(
+	check: DeclaredCheck,
+	file: string,
+	vector: ReadonlyArray<string>,
+	cwd: string,
+	options?: { signal?: AbortSignal },
+): Promise<ToolResult> {
+	let result: SafeCommandResult;
+	try {
+		result = await runCommandVector(file, vector, {
+			cwd,
+			timeoutMs: check.timeoutMs,
+			...(options?.signal !== undefined ? { signal: options.signal } : {}),
+		});
+	} catch (error) {
+		return { kind: "error", message: `verify: ${error instanceof Error ? error.message : String(error)}` };
+	}
+	const facts = commandFacts(result);
+	const tail = `${result.stdout}${result.stderr}`.trim().slice(-2_000);
+	if (result.aborted) return { kind: "error", message: "verify: aborted", details: facts };
+	if (result.timedOut) return { kind: "error", message: `verify: timed out after ${check.timeoutMs}ms`, details: facts };
+	if (result.exitCode !== 0) {
+		return {
+			kind: "error",
+			message: `verify: ${check.kind} command exited with code ${result.exitCode ?? "?"} before judgement: ${tail}`,
+			details: facts,
+		};
+	}
+	const report =
+		check.kind === "numeric-compare" && check.numeric !== undefined
+			? judgeNumericCompare(result.stdout, check.numeric, process.cwd())
+			: check.kind === "perf-budget" && check.perf !== undefined
+				? judgePerfBudget(result.durationMs, check.perf, process.cwd())
+				: new Error(`declared check '${check.id}' has kind ${check.kind} without its parameters`);
+	if (report instanceof Error) return { kind: "error", message: `verify: ${report.message}`, details: facts };
+	const rendered = report.kind === "numeric-compare" ? renderNumericReport(report) : report.summary;
+	const details = { ...facts, report };
+	if (!report.passed) return { kind: "error", message: `verify: ${rendered}`, details };
+	return { kind: "ok", output: `${rendered}\n`, details };
+}
+
 export async function runProjectCheck(check: DeclaredCheck, options?: { signal?: AbortSignal }): Promise<ToolResult> {
 	const [file, ...vector] = check.command;
 	if (file === undefined) return { kind: "error", message: `verify: declared check '${check.id}' has empty argv` };
 	const cwd = resolveProjectVerifierExecutionCwd(check.cwd, process.cwd());
 	if (cwd instanceof Error) return { kind: "error", message: `verify: ${cwd.message}` };
+	if (check.kind !== "command") {
+		return withDeclaredEvidence(await runJudgedCheck(check, file, vector, cwd, options), check);
+	}
 	const result = await runVectorTool("verify", file, vector, { cwd, timeout_ms: check.timeoutMs }, options);
 	return withDeclaredEvidence(result, check);
 }
 
+/**
+ * Run a perf-budget check once and write its wall time as the baseline the
+ * check's `baseline` path names. The command must exit cleanly; a failed run
+ * records nothing, so a baseline never encodes a broken command's timing.
+ */
+export async function recordPerfBaseline(
+	check: DeclaredCheck,
+	options?: { signal?: AbortSignal; now?: () => Date },
+): Promise<{ ok: true; path: string; wallTimeMs: number } | { ok: false; message: string }> {
+	if (check.kind !== "perf-budget" || check.perf?.baseline === undefined) {
+		return { ok: false, message: `check '${check.id}' is not a perf-budget check with a baseline path` };
+	}
+	const [file, ...vector] = check.command;
+	if (file === undefined) return { ok: false, message: `declared check '${check.id}' has empty argv` };
+	const cwd = resolveProjectVerifierExecutionCwd(check.cwd, process.cwd());
+	if (cwd instanceof Error) return { ok: false, message: cwd.message };
+	let result: SafeCommandResult;
+	try {
+		result = await runCommandVector(file, vector, {
+			cwd,
+			timeoutMs: check.timeoutMs,
+			...(options?.signal !== undefined ? { signal: options.signal } : {}),
+		});
+	} catch (error) {
+		return { ok: false, message: error instanceof Error ? error.message : String(error) };
+	}
+	if (result.aborted || result.timedOut || result.exitCode !== 0) {
+		return {
+			ok: false,
+			message: `command ${result.timedOut ? "timed out" : result.aborted ? "was aborted" : `exited with code ${result.exitCode ?? "?"}`}; no baseline recorded`,
+		};
+	}
+	let target: string;
+	try {
+		target = resolveSafeCwd(check.perf.baseline, process.cwd());
+	} catch (error) {
+		return { ok: false, message: `baseline ${error instanceof Error ? error.message : String(error)}` };
+	}
+	const recordedAt = (options?.now?.() ?? new Date()).toISOString();
+	try {
+		mkdirSync(path.dirname(target), { recursive: true });
+		writeFileSync(target, renderPerfBaseline({ wallTimeMs: result.durationMs, check: check.id, recordedAt }), "utf8");
+	} catch (error) {
+		return {
+			ok: false,
+			message: `cannot write baseline '${check.perf.baseline}' (${error instanceof Error ? error.message : String(error)})`,
+		};
+	}
+	return { ok: true, path: check.perf.baseline, wallTimeMs: result.durationMs };
+}
+
 export async function runScriptCheck(
 	check: string,
 	args: Record<string, unknown>,

package/dist/chunk-7DICMOS6.js

@@ -1,313 +0,0 @@
-import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
-import {
-  isProjectVerifierCheckId
-} from "./chunk-UL3WSD3F.js";
-import {
-  SAFE_EXEC_DEFAULT_TIMEOUT_MS,
-  resolveSafeCwd
-} from "./chunk-JSC3U7TI.js";
-import {
-  require_dist
-} from "./chunk-APJ265NV.js";
-import {
-  __toESM,
-  init_esm_shims
-} from "./chunk-3R73A4XB.js";
-
-// src/tools/verify/catalog.ts
-init_esm_shims();
-var import_yaml = __toESM(require_dist(), 1);
-import { existsSync, readFileSync, realpathSync, statSync } from "node:fs";
-import path from "node:path";
-
-// src/domains/evidence/ordering.ts
-init_esm_shims();
-function compareCodepoints(left, right) {
-  return left < right ? -1 : left > right ? 1 : 0;
-}
-
-// src/tools/verify/catalog.ts
-var PROJECT_VERIFIER_CATALOG_RELATIVE_PATH = ".clio-coder/verifiers.yaml";
-var PROJECT_VERIFIER_CATALOG_VERSION = 1;
-var PROJECT_VERIFIER_CATALOG_CAPS = Object.freeze({
-  fileBytes: 256 * 1024,
-  checks: 128,
-  idBytes: 64,
-  descriptionBytes: 512,
-  argvEntries: 64,
-  argumentBytes: 4096,
-  cwdBytes: 512,
-  timeoutMs: 9e5,
-  tags: 16,
-  tagBytes: 32
-});
-var ROOT_FIELDS = /* @__PURE__ */ new Set(["version", "checks"]);
-var CHECK_FIELDS = /* @__PURE__ */ new Set(["id", "description", "command", "cwd", "timeoutMs", "tags"]);
-var TAG_PATTERN = /^[a-z0-9][a-z0-9._-]*$/;
-var SHELL_EXECUTABLES = /* @__PURE__ */ new Set([
-  "bash",
-  "cmd",
-  "command.com",
-  "dash",
-  "fish",
-  "ksh",
-  "powershell",
-  "pwsh",
-  "sh",
-  "tcsh",
-  "zsh"
-]);
-function isRecord(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-function utf8Bytes(value) {
-  return Buffer.byteLength(value, "utf8");
-}
-function hasControlCharacter(value) {
-  for (let index = 0; index < value.length; index += 1) {
-    const code = value.charCodeAt(index);
-    if (code <= 31 || code === 127) return true;
-  }
-  return false;
-}
-function catalogDiagnostic(message) {
-  return { ok: false, reason: `${PROJECT_VERIFIER_CATALOG_RELATIVE_PATH}: ${message}` };
-}
-function unknownFields(record, allowed) {
-  return Object.keys(record).filter((key) => !allowed.has(key)).sort(compareCodepoints);
-}
-function relativeCwd(workspaceRoot, resolved) {
-  const relative = path.relative(workspaceRoot, resolved);
-  return relative.length === 0 ? "." : relative.split(path.sep).join("/");
-}
-function safelyResolveCatalogCwd(rawCwd, workspaceRoot, location) {
-  if (path.isAbsolute(rawCwd) || path.win32.isAbsolute(rawCwd)) {
-    return new Error(`${location} must be repository-relative; absolute cwd '${rawCwd}' is not allowed`);
-  }
-  let resolved;
-  try {
-    resolved = resolveSafeCwd(rawCwd, workspaceRoot);
-  } catch {
-    return new Error(`${location} escapes the workspace root: '${rawCwd}'`);
-  }
-  let realCwd;
-  try {
-    const cwdStat = statSync(resolved);
-    if (!cwdStat.isDirectory()) return new Error(`${location} is not a directory: '${rawCwd}'`);
-    const realRoot = realpathSync(workspaceRoot);
-    realCwd = realpathSync(resolved);
-    resolveSafeCwd(realCwd, realRoot);
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    if (message.includes("escapes workspace root")) {
-      return new Error(`${location} escapes the workspace root through a symbolic link: '${rawCwd}'`);
-    }
-    return new Error(`${location} cannot be resolved as a repository directory: '${rawCwd}' (${message})`);
-  }
-  return { declared: relativeCwd(workspaceRoot, resolved), execution: realCwd };
-}
-function resolveProjectVerifierExecutionCwd(rawCwd, workspaceRoot) {
-  const resolution = safelyResolveCatalogCwd(rawCwd, workspaceRoot, "project check cwd");
-  return resolution instanceof Error ? resolution : resolution.execution;
-}
-function validateId(value, location) {
-  if (typeof value !== "string" || value.length === 0) return new Error(`${location} must be a non-empty string`);
-  if (utf8Bytes(value) > PROJECT_VERIFIER_CATALOG_CAPS.idBytes) {
-    return new Error(`${location} exceeds the ${PROJECT_VERIFIER_CATALOG_CAPS.idBytes}-byte cap`);
-  }
-  if (!isProjectVerifierCheckId(value)) {
-    return new Error(`${location} must match /^[a-z0-9][a-z0-9._:-]*$/`);
-  }
-  if (value === "frontend") return new Error(`${location} uses reserved built-in check id 'frontend'`);
-  return value;
-}
-function validateDescription(value, location) {
-  if (typeof value !== "string" || value.length === 0) return new Error(`${location} must be a non-empty string`);
-  if (value.trim() !== value || hasControlCharacter(value)) {
-    return new Error(`${location} must be trimmed, single-line text without control characters`);
-  }
-  if (utf8Bytes(value) > PROJECT_VERIFIER_CATALOG_CAPS.descriptionBytes) {
-    return new Error(`${location} exceeds the ${PROJECT_VERIFIER_CATALOG_CAPS.descriptionBytes}-byte cap`);
-  }
-  return value;
-}
-function validateCommand(value, location) {
-  if (!Array.isArray(value) || value.length === 0) {
-    return new Error(`${location} must be a non-empty argv string array; shell command strings are not allowed`);
-  }
-  if (value.length > PROJECT_VERIFIER_CATALOG_CAPS.argvEntries) {
-    return new Error(`${location} exceeds the ${PROJECT_VERIFIER_CATALOG_CAPS.argvEntries}-entry cap`);
-  }
-  const command = [];
-  for (const [index, entry] of value.entries()) {
-    const entryLocation = `${location}[${index}]`;
-    if (typeof entry !== "string" || entry.length === 0) {
-      return new Error(`${entryLocation} must be a non-empty string`);
-    }
-    if (entry.includes("\0")) return new Error(`${entryLocation} must not contain a NUL byte`);
-    if (utf8Bytes(entry) > PROJECT_VERIFIER_CATALOG_CAPS.argumentBytes) {
-      return new Error(`${entryLocation} exceeds the ${PROJECT_VERIFIER_CATALOG_CAPS.argumentBytes}-byte cap`);
-    }
-    command.push(entry);
-  }
-  const executable = command[0] ?? "";
-  if (/\s/u.test(executable)) {
-    return new Error(`${location}[0] must be one executable token, not a shell command string`);
-  }
-  const executableName = path.basename(executable).toLowerCase().replace(/\.exe$/u, "");
-  if (SHELL_EXECUTABLES.has(executableName)) {
-    return new Error(`${location}[0] may not invoke shell executable '${executable}'`);
-  }
-  return command;
-}
-function validateTimeout(value, location) {
-  if (!Number.isInteger(value) || typeof value !== "number" || value <= 0) {
-    return new Error(`${location} must be a positive integer number of milliseconds`);
-  }
-  if (value > PROJECT_VERIFIER_CATALOG_CAPS.timeoutMs) {
-    return new Error(`${location} exceeds the ${PROJECT_VERIFIER_CATALOG_CAPS.timeoutMs}ms cap`);
-  }
-  return value;
-}
-function validateTags(value, location) {
-  if (!Array.isArray(value)) return new Error(`${location} must be an array of bounded tag strings`);
-  if (value.length > PROJECT_VERIFIER_CATALOG_CAPS.tags) {
-    return new Error(`${location} exceeds the ${PROJECT_VERIFIER_CATALOG_CAPS.tags}-tag cap`);
-  }
-  const tags = [];
-  const seen = /* @__PURE__ */ new Set();
-  for (const [index, entry] of value.entries()) {
-    const entryLocation = `${location}[${index}]`;
-    if (typeof entry !== "string" || entry.length === 0) {
-      return new Error(`${entryLocation} must be a non-empty string`);
-    }
-    if (utf8Bytes(entry) > PROJECT_VERIFIER_CATALOG_CAPS.tagBytes) {
-      return new Error(`${entryLocation} exceeds the ${PROJECT_VERIFIER_CATALOG_CAPS.tagBytes}-byte cap`);
-    }
-    if (!TAG_PATTERN.test(entry)) return new Error(`${entryLocation} must match /^[a-z0-9][a-z0-9._-]*$/`);
-    if (seen.has(entry)) return new Error(`${location} contains duplicate tag '${entry}'`);
-    seen.add(entry);
-    tags.push(entry);
-  }
-  return tags;
-}
-function sourcePathInsideWorkspace(catalogPath, workspaceRoot) {
-  try {
-    const realRoot = realpathSync(workspaceRoot);
-    const realCatalogPath = realpathSync(catalogPath);
-    resolveSafeCwd(realCatalogPath, realRoot);
-    return realCatalogPath;
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    return new Error(`catalog file must resolve inside the workspace root (${message})`);
-  }
-}
-function loadProjectVerifierCatalog(workspaceRoot) {
-  const catalogPath = path.join(workspaceRoot, PROJECT_VERIFIER_CATALOG_RELATIVE_PATH);
-  if (!existsSync(catalogPath)) return { ok: true, source: null };
-  const safeSourcePath = sourcePathInsideWorkspace(catalogPath, workspaceRoot);
-  if (safeSourcePath instanceof Error) return catalogDiagnostic(safeSourcePath.message);
-  let text;
-  try {
-    const stats = statSync(safeSourcePath);
-    if (!stats.isFile()) return catalogDiagnostic("catalog path must be a regular file");
-    if (stats.size > PROJECT_VERIFIER_CATALOG_CAPS.fileBytes) {
-      return catalogDiagnostic(`file exceeds the ${PROJECT_VERIFIER_CATALOG_CAPS.fileBytes}-byte cap`);
-    }
-    text = readFileSync(safeSourcePath, "utf8");
-  } catch (error) {
-    return catalogDiagnostic(`cannot read catalog (${error instanceof Error ? error.message : String(error)})`);
-  }
-  return parseProjectVerifierCatalogText(text, workspaceRoot, catalogPath);
-}
-function parseProjectVerifierCatalogText(text, workspaceRoot, catalogPath = path.join(workspaceRoot, PROJECT_VERIFIER_CATALOG_RELATIVE_PATH)) {
-  const document = (0, import_yaml.parseDocument)(text, { prettyErrors: false, strict: true, uniqueKeys: true });
-  if (document.errors.length > 0) {
-    return catalogDiagnostic(`invalid YAML: ${document.errors.map((error) => error.message).join("; ")}`);
-  }
-  let parsed;
-  try {
-    parsed = document.toJS({ maxAliasCount: 0 });
-  } catch (error) {
-    return catalogDiagnostic(`invalid YAML: ${error instanceof Error ? error.message : String(error)}`);
-  }
-  if (!isRecord(parsed)) return catalogDiagnostic("root must be an object with version and checks fields");
-  const rootUnknown = unknownFields(parsed, ROOT_FIELDS);
-  if (rootUnknown.length > 0) return catalogDiagnostic(`root has unknown field(s): ${rootUnknown.join(", ")}`);
-  if (!Object.hasOwn(parsed, "version")) return catalogDiagnostic("root.version is required");
-  if (parsed.version !== PROJECT_VERIFIER_CATALOG_VERSION) {
-    return catalogDiagnostic(
-      `unsupported version ${JSON.stringify(parsed.version)}; supported version is ${PROJECT_VERIFIER_CATALOG_VERSION}`
-    );
-  }
-  if (!Object.hasOwn(parsed, "checks")) return catalogDiagnostic("root.checks is required");
-  if (!Array.isArray(parsed.checks)) return catalogDiagnostic("root.checks must be an array");
-  if (parsed.checks.length > PROJECT_VERIFIER_CATALOG_CAPS.checks) {
-    return catalogDiagnostic(`root.checks exceeds the ${PROJECT_VERIFIER_CATALOG_CAPS.checks}-check cap`);
-  }
-  const sourceRef = { kind: "project-catalog", path: catalogPath };
-  const checks = [];
-  const ids = /* @__PURE__ */ new Map();
-  for (const [index, value] of parsed.checks.entries()) {
-    const location = `checks[${index}]`;
-    if (!isRecord(value)) return catalogDiagnostic(`${location} must be an object`);
-    const checkUnknown = unknownFields(value, CHECK_FIELDS);
-    if (checkUnknown.length > 0) {
-      return catalogDiagnostic(`${location} has unknown field(s): ${checkUnknown.join(", ")}`);
-    }
-    for (const field of CHECK_FIELDS) {
-      if (!Object.hasOwn(value, field)) return catalogDiagnostic(`${location}.${field} is required`);
-    }
-    const id = validateId(value.id, `${location}.id`);
-    if (id instanceof Error) return catalogDiagnostic(id.message);
-    const duplicateIndex = ids.get(id);
-    if (duplicateIndex !== void 0) {
-      return catalogDiagnostic(`${location}.id duplicates '${id}' from checks[${duplicateIndex}].id`);
-    }
-    const description = validateDescription(value.description, `${location}.description`);
-    if (description instanceof Error) return catalogDiagnostic(description.message);
-    const command = validateCommand(value.command, `${location}.command`);
-    if (command instanceof Error) return catalogDiagnostic(command.message);
-    if (typeof value.cwd !== "string" || value.cwd.length === 0) {
-      return catalogDiagnostic(`${location}.cwd must be a non-empty repository-relative string`);
-    }
-    if (value.cwd.includes("\0")) return catalogDiagnostic(`${location}.cwd must not contain a NUL byte`);
-    if (utf8Bytes(value.cwd) > PROJECT_VERIFIER_CATALOG_CAPS.cwdBytes) {
-      return catalogDiagnostic(`${location}.cwd exceeds the ${PROJECT_VERIFIER_CATALOG_CAPS.cwdBytes}-byte cap`);
-    }
-    const cwdResolution = safelyResolveCatalogCwd(value.cwd, workspaceRoot, `${location}.cwd`);
-    if (cwdResolution instanceof Error) return catalogDiagnostic(cwdResolution.message);
-    const cwd = cwdResolution.declared;
-    const timeoutMs = validateTimeout(value.timeoutMs, `${location}.timeoutMs`);
-    if (timeoutMs instanceof Error) return catalogDiagnostic(timeoutMs.message);
-    const tags = validateTags(value.tags, `${location}.tags`);
-    if (tags instanceof Error) return catalogDiagnostic(tags.message);
-    ids.set(id, index);
-    checks.push({ id, description, command, cwd, timeoutMs, tags, source: { ...sourceRef } });
-  }
-  checks.sort((left, right) => compareCodepoints(left.id, right.id));
-  return { ok: true, source: { ...sourceRef, checks } };
-}
-function packageDeclaredCheck(id, packagePath, cwd, tags) {
-  return {
-    id,
-    description: `Run package.json script '${id}'.`,
-    command: ["npm", "run", id],
-    cwd,
-    timeoutMs: SAFE_EXEC_DEFAULT_TIMEOUT_MS,
-    tags,
-    source: { kind: "package.json", path: packagePath }
-  };
-}
-
-export {
-  compareCodepoints,
-  PROJECT_VERIFIER_CATALOG_RELATIVE_PATH,
-  PROJECT_VERIFIER_CATALOG_VERSION,
-  PROJECT_VERIFIER_CATALOG_CAPS,
-  resolveProjectVerifierExecutionCwd,
-  loadProjectVerifierCatalog,
-  parseProjectVerifierCatalogText,
-  packageDeclaredCheck
-};
-//# sourceMappingURL=chunk-7DICMOS6.js.map

package/dist/chunk-RVG5JXAL.js

@@ -1,41 +0,0 @@
-import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
-import {
-  init_esm_shims
-} from "./chunk-3R73A4XB.js";
-
-// src/domains/safety/rigor.ts
-init_esm_shims();
-import { existsSync } from "node:fs";
-import path from "node:path";
-var VALIDATION_CONTRACT_FILES = [
-  path.join(".clio-coder", "validation.yaml"),
-  path.join(".clio-coder", "validation.yml"),
-  "validation.yaml",
-  "validation.yml",
-  "VALIDATION.md"
-];
-function resolveRigor(options) {
-  if (options.override === "high" || options.override === "normal") return options.override;
-  const cwd = options.cwd ?? process.cwd();
-  return hasValidationContract(cwd) ? "high" : "normal";
-}
-function parseRigorOverride(value) {
-  if (typeof value !== "string") return null;
-  const normalized = value.trim().toLowerCase();
-  if (normalized === "high") return "high";
-  if (normalized === "normal") return "normal";
-  return null;
-}
-function hasValidationContract(cwd) {
-  try {
-    return VALIDATION_CONTRACT_FILES.some((relative) => existsSync(path.join(cwd, relative)));
-  } catch {
-    return false;
-  }
-}
-
-export {
-  resolveRigor,
-  parseRigorOverride
-};
-//# sourceMappingURL=chunk-RVG5JXAL.js.map