@iowarp/clio-coder 0.4.3 → 0.4.5

package/dist/chunk-MDU3C27C.js

@@ -0,0 +1,674 @@
+import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
+import {
+  isProjectVerifierCheckId
+} from "./chunk-M4KFUXS7.js";
+import {
+  compareCodepoints
+} from "./chunk-B6UM3OZC.js";
+import {
+  SAFE_EXEC_DEFAULT_TIMEOUT_MS,
+  resolveSafeCwd
+} from "./chunk-GJ24ODAX.js";
+import {
+  require_dist
+} from "./chunk-B5GGDIHT.js";
+import {
+  __toESM,
+  init_esm_shims
+} from "./chunk-ECBHH7LU.js";
+
+// src/tools/verify/numeric.ts
+init_esm_shims();
+var NUMERIC_PAYLOAD_CAPS = Object.freeze({
+  keys: 4096,
+  elements: 1e6
+});
+function normalizeNumericTolerance(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return new Error("tolerance must be an object with relative, absolute, or ulp");
+  }
+  const record = value;
+  const unknown = Object.keys(record).filter((key) => key !== "relative" && key !== "absolute" && key !== "ulp");
+  if (unknown.length > 0) return new Error(`tolerance has unknown field(s): ${unknown.sort().join(", ")}`);
+  const tolerance = {};
+  for (const kind of ["relative", "absolute"]) {
+    if (!Object.hasOwn(record, kind)) continue;
+    const bound = record[kind];
+    if (typeof bound !== "number" || !Number.isFinite(bound) || bound < 0) {
+      return new Error(`tolerance.${kind} must be a finite non-negative number`);
+    }
+    tolerance[kind] = bound;
+  }
+  if (Object.hasOwn(record, "ulp")) {
+    const bound = record.ulp;
+    if (typeof bound !== "number" || !Number.isInteger(bound) || bound < 0) {
+      return new Error("tolerance.ulp must be a non-negative integer");
+    }
+    tolerance.ulp = bound;
+  }
+  if (tolerance.relative === void 0 && tolerance.absolute === void 0 && tolerance.ulp === void 0) {
+    return new Error("tolerance must name at least one of relative, absolute, or ulp");
+  }
+  return tolerance;
+}
+var ORDERED_VIEW = new DataView(new ArrayBuffer(8));
+function orderedBits(value) {
+  ORDERED_VIEW.setFloat64(0, value);
+  const bits = ORDERED_VIEW.getBigInt64(0);
+  return bits < 0n ? -(bits & 0x7fffffffffffffffn) : bits;
+}
+function ulpDistance(actual, expected) {
+  if (!Number.isFinite(actual) || !Number.isFinite(expected)) return Number.POSITIVE_INFINITY;
+  const distance = orderedBits(actual) - orderedBits(expected);
+  const magnitude = distance < 0n ? -distance : distance;
+  return magnitude > BigInt(Number.MAX_SAFE_INTEGER) ? Number.POSITIVE_INFINITY : Number(magnitude);
+}
+function parseNumericPayload(text, label) {
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch (error) {
+    return new Error(`${label} is not valid JSON: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    return new Error(`${label} must be a JSON object of string -> number | number[]`);
+  }
+  const record = parsed;
+  const keys = Object.keys(record);
+  if (keys.length > NUMERIC_PAYLOAD_CAPS.keys)
+    return new Error(`${label} exceeds the ${NUMERIC_PAYLOAD_CAPS.keys}-key cap`);
+  const payload = {};
+  let elements = 0;
+  for (const key of keys) {
+    const value = record[key];
+    if (typeof value === "number") {
+      payload[key] = value;
+      elements += 1;
+    } else if (Array.isArray(value) && value.every((entry) => typeof entry === "number")) {
+      payload[key] = [...value];
+      elements += value.length;
+    } else {
+      return new Error(`${label}.${key} must be a number or an array of numbers`);
+    }
+    if (elements > NUMERIC_PAYLOAD_CAPS.elements) {
+      return new Error(`${label} exceeds the ${NUMERIC_PAYLOAD_CAPS.elements}-element cap`);
+    }
+  }
+  return payload;
+}
+function deviation(actual, expected, index) {
+  const finite = Number.isFinite(actual) && Number.isFinite(expected);
+  const absolute = finite ? Math.abs(actual - expected) : Number.POSITIVE_INFINITY;
+  let relative = !finite ? null : expected === 0 ? absolute === 0 ? 0 : null : absolute / Math.abs(expected);
+  if (finite && !Number.isFinite(absolute)) {
+    relative = Math.abs(actual / expected - 1);
+  }
+  return {
+    ...index !== void 0 ? { index } : {},
+    actual,
+    expected,
+    absolute,
+    relative,
+    ulp: finite ? ulpDistance(actual, expected) : null
+  };
+}
+function violatedTolerances(item, tolerance) {
+  const failed = [];
+  if (tolerance.relative !== void 0 && (item.relative === null || item.relative > tolerance.relative)) {
+    failed.push("relative");
+  }
+  if (tolerance.absolute !== void 0 && item.absolute > tolerance.absolute) failed.push("absolute");
+  if (tolerance.ulp !== void 0 && (item.ulp === null || item.ulp > tolerance.ulp)) failed.push("ulp");
+  return failed;
+}
+function formatNumber(value) {
+  return Number.isFinite(value) ? value.toPrecision(6).replace(/\.?0+(e|$)/u, "$1") : String(value);
+}
+function describeDeviation(item) {
+  const where = item.index === void 0 ? "" : `[${item.index}]`;
+  const relative = item.relative === null ? "undefined" : formatNumber(item.relative);
+  const ulp = item.ulp === null ? "undefined" : String(item.ulp);
+  return `${where} actual=${formatNumber(item.actual)} expected=${formatNumber(item.expected)} abs=${formatNumber(item.absolute)} rel=${relative} ulp=${ulp}`;
+}
+function compareElements(key, actual, expected, tolerance) {
+  let worst;
+  let worstFailed = [];
+  for (let index = 0; index < expected.length; index += 1) {
+    const item = deviation(
+      actual[index],
+      expected[index],
+      expected.length === 1 && actual.length === 1 ? void 0 : index
+    );
+    const failed = !Number.isFinite(item.actual) || !Number.isFinite(item.expected) ? ["not-finite"] : violatedTolerances(item, tolerance);
+    const worse = worst === void 0 || failed.length > 0 && worstFailed.length === 0 || failed.length > 0 === worstFailed.length > 0 && item.absolute > worst.absolute;
+    if (worse) {
+      worst = item;
+      worstFailed = failed;
+    }
+  }
+  if (worst === void 0) return { key, passed: true, failed: [], detail: `${key}: empty array matches` };
+  const passed = worstFailed.length === 0;
+  return {
+    key,
+    passed,
+    failed: worstFailed,
+    worst,
+    detail: passed ? `${key}: within tolerance, worst${describeDeviation(worst)}` : `${key}: failed ${worstFailed.join(", ")} at worst${describeDeviation(worst)}`
+  };
+}
+function compareNumeric(actual, reference, tolerance) {
+  const keys = [.../* @__PURE__ */ new Set([...Object.keys(reference), ...Object.keys(actual)])].sort();
+  const reports = [];
+  for (const key of keys) {
+    const got = actual[key];
+    const want = reference[key];
+    if (got === void 0) {
+      reports.push({ key, passed: false, failed: ["missing-actual"], detail: `${key}: missing from the command output` });
+      continue;
+    }
+    if (want === void 0) {
+      reports.push({ key, passed: false, failed: ["missing-reference"], detail: `${key}: missing from the reference` });
+      continue;
+    }
+    if (Array.isArray(got) !== Array.isArray(want)) {
+      reports.push({
+        key,
+        passed: false,
+        failed: ["shape-mismatch"],
+        detail: `${key}: ${Array.isArray(got) ? "array" : "scalar"} in the command output but ${Array.isArray(want) ? "array" : "scalar"} in the reference`
+      });
+      continue;
+    }
+    const gotList = Array.isArray(got) ? got : [got];
+    const wantList = Array.isArray(want) ? want : [want];
+    if (gotList.length !== wantList.length) {
+      reports.push({
+        key,
+        passed: false,
+        failed: ["length-mismatch"],
+        detail: `${key}: ${gotList.length} element(s) in the command output but ${wantList.length} in the reference`
+      });
+      continue;
+    }
+    reports.push(compareElements(key, gotList, wantList, tolerance));
+  }
+  const failedKeys = reports.filter((report) => !report.passed).map((report) => report.key);
+  const passed = failedKeys.length === 0;
+  return {
+    kind: "numeric-compare",
+    passed,
+    tolerance: { ...tolerance },
+    keys: reports,
+    failedKeys,
+    summary: passed ? `numeric-compare passed: ${reports.length} key(s) within tolerance` : `numeric-compare failed: ${failedKeys.length} of ${reports.length} key(s) out of tolerance (${failedKeys.join(", ")})`
+  };
+}
+function renderNumericReport(report) {
+  const lines = [report.summary, `tolerance: ${JSON.stringify(report.tolerance)}`];
+  for (const key of report.keys) lines.push(`- ${key.detail}`);
+  return lines.join("\n");
+}
+
+// src/tools/verify/catalog.ts
+init_esm_shims();
+var import_yaml = __toESM(require_dist(), 1);
+import { existsSync, readFileSync, realpathSync, statSync } from "node:fs";
+import path from "node:path";
+
+// src/tools/verify/perf.ts
+init_esm_shims();
+var PERF_BASELINE_VERSION = 1;
+function normalizePerfBudget(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return new Error("budget must be an object with wallTimeMs");
+  }
+  const record = value;
+  const unknown = Object.keys(record).filter((key) => key !== "wallTimeMs" && key !== "tolerance");
+  if (unknown.length > 0) return new Error(`budget has unknown field(s): ${unknown.sort().join(", ")}`);
+  if (typeof record.wallTimeMs !== "number" || !Number.isFinite(record.wallTimeMs) || record.wallTimeMs <= 0) {
+    return new Error("budget.wallTimeMs must be a positive number of milliseconds");
+  }
+  const spec = { wallTimeMs: record.wallTimeMs };
+  if (Object.hasOwn(record, "tolerance")) {
+    const tolerance = normalizePerfTolerance(record.tolerance, "budget.tolerance");
+    if (tolerance instanceof Error) return tolerance;
+    spec.tolerance = tolerance;
+  }
+  return spec;
+}
+function normalizePerfTolerance(value, location) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return new Error(`${location} must be an object with relative`);
+  }
+  const record = value;
+  const unknown = Object.keys(record).filter((key) => key !== "relative");
+  if (unknown.length > 0) return new Error(`${location} has unknown field(s): ${unknown.sort().join(", ")}`);
+  if (!Object.hasOwn(record, "relative")) return {};
+  if (typeof record.relative !== "number" || !Number.isFinite(record.relative) || record.relative < 0) {
+    return new Error(`${location}.relative must be a finite non-negative number`);
+  }
+  return { relative: record.relative };
+}
+function parsePerfBaseline(text, label) {
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch (error) {
+    return new Error(`${label} is not valid JSON: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    return new Error(`${label} must be a JSON object with wallTimeMs`);
+  }
+  const record = parsed;
+  if (typeof record.wallTimeMs !== "number" || !Number.isFinite(record.wallTimeMs) || record.wallTimeMs <= 0) {
+    return new Error(`${label}.wallTimeMs must be a positive number of milliseconds`);
+  }
+  const baseline = { wallTimeMs: record.wallTimeMs };
+  if (typeof record.recordedAt === "string") baseline.recordedAt = record.recordedAt;
+  if (typeof record.check === "string") baseline.check = record.check;
+  return baseline;
+}
+function renderPerfBaseline(input) {
+  return `${JSON.stringify(
+    { version: PERF_BASELINE_VERSION, check: input.check, wallTimeMs: input.wallTimeMs, recordedAt: input.recordedAt },
+    null,
+    2
+  )}
+`;
+}
+function evaluatePerfBudget(measuredMs, spec) {
+  if (!Number.isFinite(measuredMs) || measuredMs < 0)
+    return new Error("measured wall time must be a non-negative number");
+  let source;
+  let referenceMs;
+  let relative;
+  if (spec.budget !== void 0) {
+    source = "budget";
+    referenceMs = spec.budget.wallTimeMs;
+    relative = spec.budget.tolerance?.relative ?? 0;
+  } else if (spec.baseline !== void 0) {
+    source = "baseline";
+    referenceMs = spec.baseline.wallTimeMs;
+    relative = spec.relative ?? 0;
+  } else {
+    return new Error("perf-budget needs a budget or a recorded baseline");
+  }
+  const budgetMs = referenceMs * (1 + relative);
+  const ratio = Math.round(measuredMs / budgetMs * 1e3) / 1e3;
+  const passed = measuredMs <= budgetMs;
+  const bound = `${Math.round(budgetMs)}ms (${source} ${Math.round(referenceMs)}ms${relative > 0 ? ` +${Math.round(relative * 100)}%` : ""})`;
+  return {
+    kind: "perf-budget",
+    passed,
+    measuredMs,
+    budgetMs,
+    ratio,
+    source,
+    referenceMs,
+    relative,
+    summary: passed ? `perf-budget passed: measured ${Math.round(measuredMs)}ms within ${bound}, ratio ${ratio}` : `perf-budget failed: measured ${Math.round(measuredMs)}ms exceeds ${bound}, ratio ${ratio}`
+  };
+}
+
+// src/tools/verify/catalog.ts
+var PROJECT_VERIFIER_CATALOG_RELATIVE_PATH = ".clio-coder/verifiers.yaml";
+var PROJECT_VERIFIER_CATALOG_VERSION = 2;
+var SUPPORTED_CATALOG_VERSIONS = [1, PROJECT_VERIFIER_CATALOG_VERSION];
+var PROJECT_VERIFIER_CATALOG_CAPS = Object.freeze({
+  fileBytes: 256 * 1024,
+  checks: 128,
+  idBytes: 64,
+  descriptionBytes: 512,
+  argvEntries: 64,
+  argumentBytes: 4096,
+  cwdBytes: 512,
+  timeoutMs: 9e5,
+  tags: 16,
+  tagBytes: 32
+});
+var DECLARED_CHECK_KINDS = ["command", "numeric-compare", "perf-budget"];
+var ROOT_FIELDS = /* @__PURE__ */ new Set(["version", "checks"]);
+var CHECK_FIELDS = /* @__PURE__ */ new Set(["id", "description", "command", "cwd", "timeoutMs", "tags"]);
+var CHECK_FIELDS_V2 = /* @__PURE__ */ new Set([...CHECK_FIELDS, "kind", "reference", "tolerance", "budget", "baseline"]);
+var TAG_PATTERN = /^[a-z0-9][a-z0-9._-]*$/;
+var SHELL_EXECUTABLES = /* @__PURE__ */ new Set([
+  "bash",
+  "cmd",
+  "command.com",
+  "dash",
+  "fish",
+  "ksh",
+  "powershell",
+  "pwsh",
+  "sh",
+  "tcsh",
+  "zsh"
+]);
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function utf8Bytes(value) {
+  return Buffer.byteLength(value, "utf8");
+}
+function hasControlCharacter(value) {
+  for (let index = 0; index < value.length; index += 1) {
+    const code = value.charCodeAt(index);
+    if (code <= 31 || code === 127) return true;
+  }
+  return false;
+}
+function catalogDiagnostic(message) {
+  return { ok: false, reason: `${PROJECT_VERIFIER_CATALOG_RELATIVE_PATH}: ${message}` };
+}
+function unknownFields(record, allowed) {
+  return Object.keys(record).filter((key) => !allowed.has(key)).sort(compareCodepoints);
+}
+function relativeCwd(workspaceRoot, resolved) {
+  const relative = path.relative(workspaceRoot, resolved);
+  return relative.length === 0 ? "." : relative.split(path.sep).join("/");
+}
+function safelyResolveCatalogCwd(rawCwd, workspaceRoot, location) {
+  if (path.isAbsolute(rawCwd) || path.win32.isAbsolute(rawCwd)) {
+    return new Error(`${location} must be repository-relative; absolute cwd '${rawCwd}' is not allowed`);
+  }
+  let resolved;
+  try {
+    resolved = resolveSafeCwd(rawCwd, workspaceRoot);
+  } catch {
+    return new Error(`${location} escapes the workspace root: '${rawCwd}'`);
+  }
+  let realCwd;
+  try {
+    const cwdStat = statSync(resolved);
+    if (!cwdStat.isDirectory()) return new Error(`${location} is not a directory: '${rawCwd}'`);
+    const realRoot = realpathSync(workspaceRoot);
+    realCwd = realpathSync(resolved);
+    resolveSafeCwd(realCwd, realRoot);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (message.includes("escapes workspace root")) {
+      return new Error(`${location} escapes the workspace root through a symbolic link: '${rawCwd}'`);
+    }
+    return new Error(`${location} cannot be resolved as a repository directory: '${rawCwd}' (${message})`);
+  }
+  return { declared: relativeCwd(workspaceRoot, resolved), execution: realCwd };
+}
+function validateRepositoryFile(value, location) {
+  if (typeof value !== "string" || value.length === 0) {
+    return new Error(`${location} must be a non-empty repository-relative path`);
+  }
+  if (value.includes("\0")) return new Error(`${location} must not contain a NUL byte`);
+  if (utf8Bytes(value) > PROJECT_VERIFIER_CATALOG_CAPS.cwdBytes) {
+    return new Error(`${location} exceeds the ${PROJECT_VERIFIER_CATALOG_CAPS.cwdBytes}-byte cap`);
+  }
+  if (path.isAbsolute(value) || path.win32.isAbsolute(value)) {
+    return new Error(`${location} must be repository-relative; absolute path '${value}' is not allowed`);
+  }
+  const normalized = path.posix.normalize(value.split(path.sep).join("/"));
+  if (normalized === ".." || normalized.startsWith("../")) {
+    return new Error(`${location} escapes the workspace root: '${value}'`);
+  }
+  return normalized;
+}
+function validateCheckKind(value, location, version) {
+  const kindValue = Object.hasOwn(value, "kind") ? value.kind : "command";
+  if (typeof kindValue !== "string" || !DECLARED_CHECK_KINDS.includes(kindValue)) {
+    return new Error(`${location}.kind must be one of ${DECLARED_CHECK_KINDS.join(", ")}`);
+  }
+  const kind = kindValue;
+  const present = (field) => Object.hasOwn(value, field);
+  const accepted = {
+    command: [],
+    "numeric-compare": ["reference", "tolerance"],
+    "perf-budget": ["budget", "baseline", "tolerance"]
+  };
+  const stray = ["reference", "tolerance", "budget", "baseline"].filter(
+    (field) => present(field) && !accepted[kind].includes(field)
+  );
+  if (stray.length > 0) return new Error(`${location} kind '${kind}' does not accept ${stray.join(", ")}`);
+  if (version === 1 && kind !== "command") return new Error(`${location}.kind requires catalog version 2`);
+  if (kind === "command") return { kind };
+  if (kind === "numeric-compare") {
+    if (!present("reference")) return new Error(`${location}.reference is required for kind numeric-compare`);
+    if (!present("tolerance")) return new Error(`${location}.tolerance is required for kind numeric-compare`);
+    const reference = validateRepositoryFile(value.reference, `${location}.reference`);
+    if (reference instanceof Error) return reference;
+    const tolerance = normalizeNumericTolerance(value.tolerance);
+    if (tolerance instanceof Error) return new Error(`${location}.${tolerance.message}`);
+    return { kind, numeric: { reference, tolerance } };
+  }
+  if (present("budget") === present("baseline")) {
+    return new Error(`${location} kind 'perf-budget' requires exactly one of budget or baseline`);
+  }
+  if (present("budget")) {
+    if (present("tolerance")) return new Error(`${location}.tolerance belongs inside budget when budget is given`);
+    const budget = normalizePerfBudget(value.budget);
+    if (budget instanceof Error) return new Error(`${location}.${budget.message}`);
+    return { kind, perf: { budget } };
+  }
+  const baseline = validateRepositoryFile(value.baseline, `${location}.baseline`);
+  if (baseline instanceof Error) return baseline;
+  const perf = { baseline };
+  if (present("tolerance")) {
+    const tolerance = normalizePerfTolerance(value.tolerance, `${location}.tolerance`);
+    if (tolerance instanceof Error) return tolerance;
+    perf.tolerance = tolerance;
+  }
+  return { kind, perf };
+}
+function resolveProjectVerifierExecutionCwd(rawCwd, workspaceRoot) {
+  const resolution = safelyResolveCatalogCwd(rawCwd, workspaceRoot, "project check cwd");
+  return resolution instanceof Error ? resolution : resolution.execution;
+}
+function validateId(value, location) {
+  if (typeof value !== "string" || value.length === 0) return new Error(`${location} must be a non-empty string`);
+  if (utf8Bytes(value) > PROJECT_VERIFIER_CATALOG_CAPS.idBytes) {
+    return new Error(`${location} exceeds the ${PROJECT_VERIFIER_CATALOG_CAPS.idBytes}-byte cap`);
+  }
+  if (!isProjectVerifierCheckId(value)) {
+    return new Error(`${location} must match /^[a-z0-9][a-z0-9._:-]*$/`);
+  }
+  if (value === "frontend") return new Error(`${location} uses reserved built-in check id 'frontend'`);
+  return value;
+}
+function validateDescription(value, location) {
+  if (typeof value !== "string" || value.length === 0) return new Error(`${location} must be a non-empty string`);
+  if (value.trim() !== value || hasControlCharacter(value)) {
+    return new Error(`${location} must be trimmed, single-line text without control characters`);
+  }
+  if (utf8Bytes(value) > PROJECT_VERIFIER_CATALOG_CAPS.descriptionBytes) {
+    return new Error(`${location} exceeds the ${PROJECT_VERIFIER_CATALOG_CAPS.descriptionBytes}-byte cap`);
+  }
+  return value;
+}
+function validateCommand(value, location) {
+  if (!Array.isArray(value) || value.length === 0) {
+    return new Error(`${location} must be a non-empty argv string array; shell command strings are not allowed`);
+  }
+  if (value.length > PROJECT_VERIFIER_CATALOG_CAPS.argvEntries) {
+    return new Error(`${location} exceeds the ${PROJECT_VERIFIER_CATALOG_CAPS.argvEntries}-entry cap`);
+  }
+  const command = [];
+  for (const [index, entry] of value.entries()) {
+    const entryLocation = `${location}[${index}]`;
+    if (typeof entry !== "string" || entry.length === 0) {
+      return new Error(`${entryLocation} must be a non-empty string`);
+    }
+    if (entry.includes("\0")) return new Error(`${entryLocation} must not contain a NUL byte`);
+    if (utf8Bytes(entry) > PROJECT_VERIFIER_CATALOG_CAPS.argumentBytes) {
+      return new Error(`${entryLocation} exceeds the ${PROJECT_VERIFIER_CATALOG_CAPS.argumentBytes}-byte cap`);
+    }
+    command.push(entry);
+  }
+  const executable = command[0] ?? "";
+  if (/\s/u.test(executable)) {
+    return new Error(`${location}[0] must be one executable token, not a shell command string`);
+  }
+  const executableName = path.basename(executable).toLowerCase().replace(/\.exe$/u, "");
+  if (SHELL_EXECUTABLES.has(executableName)) {
+    return new Error(`${location}[0] may not invoke shell executable '${executable}'`);
+  }
+  return command;
+}
+function validateTimeout(value, location) {
+  if (!Number.isInteger(value) || typeof value !== "number" || value <= 0) {
+    return new Error(`${location} must be a positive integer number of milliseconds`);
+  }
+  if (value > PROJECT_VERIFIER_CATALOG_CAPS.timeoutMs) {
+    return new Error(`${location} exceeds the ${PROJECT_VERIFIER_CATALOG_CAPS.timeoutMs}ms cap`);
+  }
+  return value;
+}
+function validateTags(value, location) {
+  if (!Array.isArray(value)) return new Error(`${location} must be an array of bounded tag strings`);
+  if (value.length > PROJECT_VERIFIER_CATALOG_CAPS.tags) {
+    return new Error(`${location} exceeds the ${PROJECT_VERIFIER_CATALOG_CAPS.tags}-tag cap`);
+  }
+  const tags = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const [index, entry] of value.entries()) {
+    const entryLocation = `${location}[${index}]`;
+    if (typeof entry !== "string" || entry.length === 0) {
+      return new Error(`${entryLocation} must be a non-empty string`);
+    }
+    if (utf8Bytes(entry) > PROJECT_VERIFIER_CATALOG_CAPS.tagBytes) {
+      return new Error(`${entryLocation} exceeds the ${PROJECT_VERIFIER_CATALOG_CAPS.tagBytes}-byte cap`);
+    }
+    if (!TAG_PATTERN.test(entry)) return new Error(`${entryLocation} must match /^[a-z0-9][a-z0-9._-]*$/`);
+    if (seen.has(entry)) return new Error(`${location} contains duplicate tag '${entry}'`);
+    seen.add(entry);
+    tags.push(entry);
+  }
+  return tags;
+}
+function sourcePathInsideWorkspace(catalogPath, workspaceRoot) {
+  try {
+    const realRoot = realpathSync(workspaceRoot);
+    const realCatalogPath = realpathSync(catalogPath);
+    resolveSafeCwd(realCatalogPath, realRoot);
+    return realCatalogPath;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return new Error(`catalog file must resolve inside the workspace root (${message})`);
+  }
+}
+function loadProjectVerifierCatalog(workspaceRoot) {
+  const catalogPath = path.join(workspaceRoot, PROJECT_VERIFIER_CATALOG_RELATIVE_PATH);
+  if (!existsSync(catalogPath)) return { ok: true, source: null };
+  const safeSourcePath = sourcePathInsideWorkspace(catalogPath, workspaceRoot);
+  if (safeSourcePath instanceof Error) return catalogDiagnostic(safeSourcePath.message);
+  let text;
+  try {
+    const stats = statSync(safeSourcePath);
+    if (!stats.isFile()) return catalogDiagnostic("catalog path must be a regular file");
+    if (stats.size > PROJECT_VERIFIER_CATALOG_CAPS.fileBytes) {
+      return catalogDiagnostic(`file exceeds the ${PROJECT_VERIFIER_CATALOG_CAPS.fileBytes}-byte cap`);
+    }
+    text = readFileSync(safeSourcePath, "utf8");
+  } catch (error) {
+    return catalogDiagnostic(`cannot read catalog (${error instanceof Error ? error.message : String(error)})`);
+  }
+  return parseProjectVerifierCatalogText(text, workspaceRoot, catalogPath);
+}
+function parseProjectVerifierCatalogText(text, workspaceRoot, catalogPath = path.join(workspaceRoot, PROJECT_VERIFIER_CATALOG_RELATIVE_PATH)) {
+  const document = (0, import_yaml.parseDocument)(text, { prettyErrors: false, strict: true, uniqueKeys: true });
+  if (document.errors.length > 0) {
+    return catalogDiagnostic(`invalid YAML: ${document.errors.map((error) => error.message).join("; ")}`);
+  }
+  let parsed;
+  try {
+    parsed = document.toJS({ maxAliasCount: 0 });
+  } catch (error) {
+    return catalogDiagnostic(`invalid YAML: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  if (!isRecord(parsed)) return catalogDiagnostic("root must be an object with version and checks fields");
+  const rootUnknown = unknownFields(parsed, ROOT_FIELDS);
+  if (rootUnknown.length > 0) return catalogDiagnostic(`root has unknown field(s): ${rootUnknown.join(", ")}`);
+  if (!Object.hasOwn(parsed, "version")) return catalogDiagnostic("root.version is required");
+  if (typeof parsed.version !== "number" || !SUPPORTED_CATALOG_VERSIONS.includes(parsed.version)) {
+    return catalogDiagnostic(
+      `unsupported version ${JSON.stringify(parsed.version)}; supported versions are ${SUPPORTED_CATALOG_VERSIONS.join(" and ")}`
+    );
+  }
+  const version = parsed.version;
+  if (!Object.hasOwn(parsed, "checks")) return catalogDiagnostic("root.checks is required");
+  if (!Array.isArray(parsed.checks)) return catalogDiagnostic("root.checks must be an array");
+  if (parsed.checks.length > PROJECT_VERIFIER_CATALOG_CAPS.checks) {
+    return catalogDiagnostic(`root.checks exceeds the ${PROJECT_VERIFIER_CATALOG_CAPS.checks}-check cap`);
+  }
+  const sourceRef = { kind: "project-catalog", path: catalogPath };
+  const checks = [];
+  const ids = /* @__PURE__ */ new Map();
+  for (const [index, value] of parsed.checks.entries()) {
+    const location = `checks[${index}]`;
+    if (!isRecord(value)) return catalogDiagnostic(`${location} must be an object`);
+    const checkUnknown = unknownFields(value, version === 1 ? CHECK_FIELDS : CHECK_FIELDS_V2);
+    if (checkUnknown.length > 0) {
+      return catalogDiagnostic(`${location} has unknown field(s): ${checkUnknown.join(", ")}`);
+    }
+    for (const field of CHECK_FIELDS) {
+      if (!Object.hasOwn(value, field)) return catalogDiagnostic(`${location}.${field} is required`);
+    }
+    const id = validateId(value.id, `${location}.id`);
+    if (id instanceof Error) return catalogDiagnostic(id.message);
+    const duplicateIndex = ids.get(id);
+    if (duplicateIndex !== void 0) {
+      return catalogDiagnostic(`${location}.id duplicates '${id}' from checks[${duplicateIndex}].id`);
+    }
+    const description = validateDescription(value.description, `${location}.description`);
+    if (description instanceof Error) return catalogDiagnostic(description.message);
+    const command = validateCommand(value.command, `${location}.command`);
+    if (command instanceof Error) return catalogDiagnostic(command.message);
+    if (typeof value.cwd !== "string" || value.cwd.length === 0) {
+      return catalogDiagnostic(`${location}.cwd must be a non-empty repository-relative string`);
+    }
+    if (value.cwd.includes("\0")) return catalogDiagnostic(`${location}.cwd must not contain a NUL byte`);
+    if (utf8Bytes(value.cwd) > PROJECT_VERIFIER_CATALOG_CAPS.cwdBytes) {
+      return catalogDiagnostic(`${location}.cwd exceeds the ${PROJECT_VERIFIER_CATALOG_CAPS.cwdBytes}-byte cap`);
+    }
+    const cwdResolution = safelyResolveCatalogCwd(value.cwd, workspaceRoot, `${location}.cwd`);
+    if (cwdResolution instanceof Error) return catalogDiagnostic(cwdResolution.message);
+    const cwd = cwdResolution.declared;
+    const timeoutMs = validateTimeout(value.timeoutMs, `${location}.timeoutMs`);
+    if (timeoutMs instanceof Error) return catalogDiagnostic(timeoutMs.message);
+    const tags = validateTags(value.tags, `${location}.tags`);
+    if (tags instanceof Error) return catalogDiagnostic(tags.message);
+    const kindFields = validateCheckKind(value, location, version);
+    if (kindFields instanceof Error) return catalogDiagnostic(kindFields.message);
+    ids.set(id, index);
+    checks.push({ id, description, command, cwd, timeoutMs, tags, source: { ...sourceRef }, ...kindFields });
+  }
+  checks.sort((left, right) => compareCodepoints(left.id, right.id));
+  return { ok: true, source: { ...sourceRef, checks } };
+}
+function packageDeclaredCheck(id, packagePath, cwd, tags) {
+  return {
+    id,
+    description: `Run package.json script '${id}'.`,
+    command: ["npm", "run", id],
+    cwd,
+    timeoutMs: SAFE_EXEC_DEFAULT_TIMEOUT_MS,
+    tags,
+    source: { kind: "package.json", path: packagePath },
+    kind: "command"
+  };
+}
+
+export {
+  normalizeNumericTolerance,
+  parseNumericPayload,
+  compareNumeric,
+  renderNumericReport,
+  parsePerfBaseline,
+  renderPerfBaseline,
+  evaluatePerfBudget,
+  PROJECT_VERIFIER_CATALOG_RELATIVE_PATH,
+  PROJECT_VERIFIER_CATALOG_VERSION,
+  PROJECT_VERIFIER_CATALOG_CAPS,
+  DECLARED_CHECK_KINDS,
+  resolveProjectVerifierExecutionCwd,
+  loadProjectVerifierCatalog,
+  parseProjectVerifierCatalogText,
+  packageDeclaredCheck
+};
+//# sourceMappingURL=chunk-MDU3C27C.js.map

package/dist/{chunk-6XLNIQDB.js → chunk-MYI32N4R.js}

@@ -1,7 +1,7 @@
 import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
 import {
   init_esm_shims
-} from "./chunk-3R73A4XB.js";
+} from "./chunk-ECBHH7LU.js";
 
 // src/tools/truncate-utf8.ts
 init_esm_shims();
@@ -24,4 +24,4 @@ export {
   truncateUtf8,
   byteLength
 };
-//# sourceMappingURL=chunk-6XLNIQDB.js.map
+//# sourceMappingURL=chunk-MYI32N4R.js.map