@ipation/specbridge 2.2.0 → 2.3.0

package/CHANGELOG.md

@@ -7,6 +7,38 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.3.0] - 2026-02-06
+
+### Added
+
+- Integration test suites for:
+  - MCP server (`tests/integration/mcp-server.test.ts`)
+  - LSP server (`tests/integration/lsp-server.test.ts`)
+  - Dashboard server (`tests/integration/dashboard-server.test.ts`)
+  - Propagation engine (`tests/integration/propagation.test.ts`)
+
+### Changed
+
+- Upgraded major runtime dependencies:
+  - `zod` 3.x → 4.x
+  - `commander` 12.x → 14.x
+  - `ts-morph` 24.x → 27.x
+  - `chokidar` 3.x → 5.x
+  - `express` 4.x → 5.x (with `@types/express` 5.x)
+- Updated CLI unit tests for Commander v14 parse semantics.
+- Raised coverage thresholds to:
+  - lines: `70`
+  - statements: `69`
+  - functions: `73`
+  - branches: `60`
+
+### Fixed
+
+- Express 5 dashboard fallback routing compatibility (`*` → `/{*path}`).
+- Dashboard API now returns `404` for missing decisions instead of `500`.
+- Propagation graph matching now respects the analysis `cwd` for absolute file paths.
+- Removed all remaining production non-null assertions in `src/**/*.ts`.
+
 ## [2.2.0] - 2026-02-06
 
 ### Infrastructure Modernization & Security

package/dist/cli.js

@@ -1261,7 +1261,7 @@ async function loadConfig(basePath = process.cwd()) {
   const parsed = parseYaml(content);
   const result = validateConfig(parsed);
   if (!result.success) {
-    const errors = result.errors.errors.map((e) => `${e.path.join(".")}: ${e.message}`);
+    const errors = result.errors.issues.map((e) => `${e.path.join(".")}: ${e.message}`);
     throw new ConfigError(`Invalid configuration in ${configPath}`, { errors });
   }
   return result.data;
@@ -1385,7 +1385,7 @@ var ConstraintExceptionSchema = z2.object({
 });
 var ConstraintCheckSchema = z2.object({
   verifier: z2.string().min(1),
-  params: z2.record(z2.unknown()).optional()
+  params: z2.record(z2.string(), z2.unknown()).optional()
 });
 var ConstraintSchema = z2.object({
   id: z2.string().min(1).regex(/^[a-z0-9-]+$/, "Constraint ID must be lowercase alphanumeric with hyphens"),
@@ -1427,7 +1427,7 @@ function validateDecision(data) {
   return { success: false, errors: result.error };
 }
 function formatValidationErrors(errors) {
-  return errors.errors.map((err) => {
+  return errors.issues.map((err) => {
     const path5 = err.path.join(".");
     return `${path5}: ${err.message}`;
   });
@@ -2149,7 +2149,10 @@ function buildDependencyGraph(project) {
       const moduleSpec = importDecl.getModuleSpecifierValue();
       const resolved = resolveToSourceFilePath(project, from, moduleSpec);
       if (resolved) {
-        graph.get(from).add(normalizeFsPath(resolved));
+        const dependencies = graph.get(from);
+        if (dependencies) {
+          dependencies.add(normalizeFsPath(resolved));
+        }
       }
     }
   }
@@ -2173,9 +2176,17 @@ function tarjanScc(graph) {
     for (const w of edges) {
       if (!indices.has(w)) {
         strongConnect(w);
-        lowlink.set(v, Math.min(lowlink.get(v), lowlink.get(w)));
+        const currentLowlink = lowlink.get(v);
+        const childLowlink = lowlink.get(w);
+        if (currentLowlink !== void 0 && childLowlink !== void 0) {
+          lowlink.set(v, Math.min(currentLowlink, childLowlink));
+        }
       } else if (onStack.has(w)) {
-        lowlink.set(v, Math.min(lowlink.get(v), indices.get(w)));
+        const currentLowlink = lowlink.get(v);
+        const childIndex = indices.get(w);
+        if (currentLowlink !== void 0 && childIndex !== void 0) {
+          lowlink.set(v, Math.min(currentLowlink, childIndex));
+        }
       }
     }
     if (lowlink.get(v) === indices.get(v)) {
@@ -2197,18 +2208,21 @@ function tarjanScc(graph) {
 }
 function parseMaxImportDepth(rule) {
   const m = rule.match(/maximum\s{1,5}import\s{1,5}depth\s{0,5}[:=]?\s{0,5}(\d+)/i);
-  return m ? Number.parseInt(m[1], 10) : null;
+  const depthText = m?.[1];
+  return depthText ? Number.parseInt(depthText, 10) : null;
 }
 function parseBannedDependency(rule) {
   const m = rule.match(/no\s{1,5}dependencies?\s{1,5}on\s{1,5}(?:package\s{1,5})?(.+?)(?:\.|$)/i);
-  if (!m) return null;
-  const value = m[1].trim();
+  const value = m?.[1]?.trim();
+  if (!value) return null;
   return value.length > 0 ? value : null;
 }
 function parseLayerRule(rule) {
   const m = rule.match(/(\w+)\s{1,5}layer\s{1,5}cannot\s{1,5}depend\s{1,5}on\s{1,5}(\w+)\s{1,5}layer/i);
-  if (!m) return null;
-  return { fromLayer: m[1].toLowerCase(), toLayer: m[2].toLowerCase() };
+  const fromLayer = m?.[1]?.toLowerCase();
+  const toLayer = m?.[2]?.toLowerCase();
+  if (!fromLayer || !toLayer) return null;
+  return { fromLayer, toLayer };
 }
 function fileInLayer(filePath, layer) {
   const fp = normalizeFsPath(filePath).toLowerCase();
@@ -2312,10 +2326,12 @@ var DependencyVerifier = class {
 };
 
 // src/verification/verifiers/complexity.ts
+import { Node as Node4 } from "ts-morph";
 import { SyntaxKind as SyntaxKind2 } from "ts-morph";
 function parseLimit(rule, pattern) {
   const m = rule.match(pattern);
-  return m ? Number.parseInt(m[1], 10) : null;
+  const value = m?.[1];
+  return value ? Number.parseInt(value, 10) : null;
 }
 function getFileLineCount(text) {
   if (text.length === 0) return 0;
@@ -2351,14 +2367,15 @@ function calculateCyclomaticComplexity(fn) {
   return 1 + getDecisionPoints(fn);
 }
 function getFunctionDisplayName(fn) {
-  if ("getName" in fn && typeof fn.getName === "function") {
+  if (Node4.isFunctionDeclaration(fn) || Node4.isMethodDeclaration(fn) || Node4.isFunctionExpression(fn)) {
     const name = fn.getName();
-    if (typeof name === "string" && name.length > 0) return name;
+    if (typeof name === "string" && name.length > 0) {
+      return name;
+    }
   }
   const parent = fn.getParent();
-  if (parent?.getKind() === SyntaxKind2.VariableDeclaration) {
-    const vd = parent;
-    if (typeof vd.getName === "function") return vd.getName();
+  if (parent && Node4.isVariableDeclaration(parent)) {
+    return parent.getName();
   }
   return "<anonymous>";
 }
@@ -2428,9 +2445,8 @@ var ComplexityVerifier = class {
           }));
         }
       }
-      if (maxParams !== null && "getParameters" in fn) {
-        const params = fn.getParameters();
-        const paramCount = Array.isArray(params) ? params.length : 0;
+      if (maxParams !== null) {
+        const paramCount = fn.getParameters().length;
         if (paramCount > maxParams) {
           violations.push(createViolation({
             decisionId,
@@ -2504,8 +2520,7 @@ var SecurityVerifier = class {
         }));
       }
       for (const pa of sourceFile.getDescendantsOfKind(SyntaxKind3.PropertyAssignment)) {
-        const nameNode = pa.getNameNode?.();
-        const propName = nameNode?.getText?.() ?? "";
+        const propName = pa.getNameNode().getText();
         if (!SECRET_NAME_RE.test(propName)) continue;
         const init = pa.getInitializer();
         if (!init || !isStringLiteralLike(init)) continue;
@@ -2541,9 +2556,9 @@ var SecurityVerifier = class {
     if (checkXss) {
       for (const bin of sourceFile.getDescendantsOfKind(SyntaxKind3.BinaryExpression)) {
         const left = bin.getLeft();
-        if (left.getKind() !== SyntaxKind3.PropertyAccessExpression) continue;
-        const pa = left;
-        if (pa.getName?.() === "innerHTML") {
+        const propertyAccess = left.asKind(SyntaxKind3.PropertyAccessExpression);
+        if (!propertyAccess) continue;
+        if (propertyAccess.getName() === "innerHTML") {
           violations.push(createViolation({
             decisionId,
             constraintId: constraint.id,
@@ -2572,8 +2587,9 @@ var SecurityVerifier = class {
     if (checkSql) {
       for (const call of sourceFile.getDescendantsOfKind(SyntaxKind3.CallExpression)) {
         const expr = call.getExpression();
-        if (expr.getKind() !== SyntaxKind3.PropertyAccessExpression) continue;
-        const name = expr.getName?.();
+        const propertyAccess = expr.asKind(SyntaxKind3.PropertyAccessExpression);
+        if (!propertyAccess) continue;
+        const name = propertyAccess.getName();
         if (name !== "query" && name !== "execute") continue;
         const arg = call.getArguments()[0];
         if (!arg) continue;
@@ -2638,12 +2654,14 @@ var ApiVerifier = class {
     if (!enforceKebab) return violations;
     for (const call of sourceFile.getDescendantsOfKind(SyntaxKind4.CallExpression)) {
       const expr = call.getExpression();
-      if (expr.getKind() !== SyntaxKind4.PropertyAccessExpression) continue;
-      const method = expr.getName?.();
+      const propertyAccess = expr.asKind(SyntaxKind4.PropertyAccessExpression);
+      if (!propertyAccess) continue;
+      const method = propertyAccess.getName();
       if (!method || !HTTP_METHODS.has(String(method))) continue;
       const firstArg = call.getArguments()[0];
-      if (!firstArg || firstArg.getKind() !== SyntaxKind4.StringLiteral) continue;
-      const pathValue = firstArg.getLiteralValue?.() ?? firstArg.getText().slice(1, -1);
+      const stringLiteral = firstArg?.asKind(SyntaxKind4.StringLiteral);
+      if (!stringLiteral) continue;
+      const pathValue = stringLiteral.getLiteralValue();
       if (typeof pathValue !== "string") continue;
       if (!isKebabPath(pathValue)) {
         violations.push(createViolation({
@@ -4805,7 +4823,10 @@ async function analyzeTrend(reports) {
       if (!decisionMap.has(decision.decisionId)) {
         decisionMap.set(decision.decisionId, []);
       }
-      decisionMap.get(decision.decisionId).push(decision);
+      const decisionHistory = decisionMap.get(decision.decisionId);
+      if (decisionHistory) {
+        decisionHistory.push(decision);
+      }
     }
   }
   const decisions = Array.from(decisionMap.entries()).map(([decisionId, data]) => {
@@ -5247,7 +5268,11 @@ var SpecBridgeLspServer = class {
       const doc = this.documents.get(params.textDocument.uri);
       if (!doc) return [];
       return violations.filter((v) => v.autofix && v.autofix.edits.length > 0).map((v) => {
-        const edits = v.autofix.edits.map((edit) => ({
+        const autofix = v.autofix;
+        if (!autofix) {
+          return null;
+        }
+        const edits = autofix.edits.map((edit) => ({
           range: {
             start: doc.positionAt(edit.start),
             end: doc.positionAt(edit.end)
@@ -5255,7 +5280,7 @@ var SpecBridgeLspServer = class {
           newText: edit.text
         }));
         return {
-          title: v.autofix.description,
+          title: autofix.description,
           kind: CodeActionKind.QuickFix,
           edit: {
             changes: {
@@ -5263,7 +5288,7 @@ var SpecBridgeLspServer = class {
             }
           }
         };
-      });
+      }).filter((action) => action !== null);
     });
     this.documents.listen(this.connection);
     this.connection.listen();
@@ -6178,7 +6203,8 @@ var DashboardServer = class {
     });
     this.app.get("/api/report/:date", async (req, res) => {
       try {
-        const date = req.params.date;
+        const dateParam = req.params.date;
+        const date = Array.isArray(dateParam) ? dateParam[0] : dateParam;
         if (!date) {
           res.status(400).json({ error: "Date parameter required" });
           return;
@@ -6214,7 +6240,8 @@ var DashboardServer = class {
     });
     this.app.get("/api/decisions/:id", async (req, res) => {
       try {
-        const id = req.params.id;
+        const idParam = req.params.id;
+        const id = Array.isArray(idParam) ? idParam[0] : idParam;
         if (!id) {
           res.status(400).json({ error: "Decision ID required" });
           return;
@@ -6226,6 +6253,10 @@ var DashboardServer = class {
         }
         res.json(decision);
       } catch (error) {
+        if (error instanceof DecisionNotFoundError) {
+          res.status(404).json({ error: "Decision not found" });
+          return;
+        }
         res.status(500).json({
           error: "Failed to load decision",
           message: error instanceof Error ? error.message : "Unknown error"
@@ -6257,7 +6288,8 @@ var DashboardServer = class {
     });
     this.app.get("/api/analytics/decision/:id", async (req, res) => {
       try {
-        const id = req.params.id;
+        const idParam = req.params.id;
+        const id = Array.isArray(idParam) ? idParam[0] : idParam;
         if (!id) {
           res.status(400).json({ error: "Decision ID required" });
           return;
@@ -6346,7 +6378,7 @@ var DashboardServer = class {
       // Cache static assets
       etag: true
     }));
-    this.app.get("*", (_req, res) => {
+    this.app.get("/{*path}", (_req, res) => {
       res.sendFile(join12(publicDir, "index.html"));
     });
   }
@@ -6398,7 +6430,8 @@ import chalk18 from "chalk";
 import ora8 from "ora";
 
 // src/propagation/graph.ts
-async function buildDependencyGraph2(decisions, files) {
+async function buildDependencyGraph2(decisions, files, options = {}) {
+  const { cwd } = options;
   const nodes = /* @__PURE__ */ new Map();
   const decisionToFiles = /* @__PURE__ */ new Map();
   const fileToDecisions = /* @__PURE__ */ new Map();
@@ -6413,7 +6446,7 @@ async function buildDependencyGraph2(decisions, files) {
       const constraintId = `constraint:${decision.metadata.id}/${constraint.id}`;
       const matchingFiles = [];
       for (const file of files) {
-        if (matchesPattern(file, constraint.scope)) {
+        if (matchesPattern(file, constraint.scope, { cwd })) {
           matchingFiles.push(`file:${file}`);
           const fileDecisions = fileToDecisions.get(file) || /* @__PURE__ */ new Set();
           fileDecisions.add(decision.metadata.id);
@@ -6470,7 +6503,7 @@ var PropagationEngine = class {
       absolute: true
     });
     const decisions = this.registry.getActive();
-    this.graph = await buildDependencyGraph2(decisions, files);
+    this.graph = await buildDependencyGraph2(decisions, files, { cwd });
   }
   /**
    * Analyze impact of changing a decision