@levr-one/cli 0.12.8 → 0.12.10

package/dist/change-scope-DBmyRWZV.js

@@ -0,0 +1,379 @@
+import { detectCiEnvironment } from "./dist-DU3htaZ_.js";
+import * as fs from "node:fs";
+import * as path$1 from "node:path";
+import { spawnSync } from "node:child_process";
+
+//#region src/commands/gates/change-scope.ts
+const runGit = (args, cwd) => {
+	const r = spawnSync("git", [
+		"-c",
+		"core.quotePath=false",
+		...args
+	], {
+		cwd,
+		encoding: "utf8",
+		maxBuffer: 256 * 1024 * 1024
+	});
+	if (r.error) return {
+		code: 127,
+		stdout: "",
+		stderr: r.error.message
+	};
+	return {
+		code: r.status ?? 1,
+		stdout: r.stdout,
+		stderr: r.stderr
+	};
+};
+var NoMergeBaseError = class extends Error {};
+var GitError = class extends Error {};
+function gitOrThrow(git, args, cwd) {
+	const r = git(args, cwd);
+	if (r.code !== 0) throw new GitError(`git ${args.join(" ")} failed (exit ${r.code}): ${r.stderr.trim()}`);
+	return r.stdout;
+}
+function refExists(git, ref, cwd) {
+	return git([
+		"rev-parse",
+		"--verify",
+		"--quiet",
+		`${ref}^{commit}`
+	], cwd).code === 0;
+}
+/**
+* The `--base` value that means "not given" besides an empty one (ENG-7618
+* D3). A gate binding cannot pass an empty argument (the server's check
+* renderer refuses an empty argv element), so an omitted `base` param
+* renders as this word instead.
+*/
+const AUTO_BASE = "auto";
+/** The ref to diff against, and where it came from. Pure apart from `git`. */
+function resolveBaseRef(git, cwd, base, ciTargetBranch) {
+	const flag = base?.trim();
+	if (flag && flag !== AUTO_BASE) return {
+		ref: flag,
+		source: "flag"
+	};
+	const target = ciTargetBranch?.trim();
+	if (target) {
+		const remote = `origin/${target}`;
+		return {
+			ref: refExists(git, remote, cwd) ? remote : target,
+			source: "ci"
+		};
+	}
+	return {
+		ref: "origin/HEAD",
+		source: "origin-head"
+	};
+}
+/** Repo-relative pathspecs for `--scope` (resolved against `cwd`). */
+function scopePathspecs(root, cwd, scope) {
+	const specs = [];
+	for (const raw of scope ?? []) {
+		const trimmed = raw.trim();
+		if (!trimmed) continue;
+		const rel = path$1.relative(root, path$1.resolve(cwd, trimmed));
+		if (rel === ".." || rel.startsWith(`..${path$1.sep}`) || path$1.isAbsolute(rel)) throw new GitError(`--scope "${raw}" resolves outside the repository`);
+		specs.push(rel === "" ? "." : rel.split(path$1.sep).join("/"));
+	}
+	return specs;
+}
+/**
+* `git diff --name-status -z -M` output → path, status and rename source.
+* Entries are NUL-separated: `<status>\0<path>\0` or, for a rename or copy,
+* `R<score>\0<old>\0<new>\0`.
+*/
+function parseNameStatus(out) {
+	const parts = out.split("\0");
+	const entries = [];
+	for (let i = 0; i < parts.length; i++) {
+		const code = parts[i];
+		if (!code) continue;
+		const kind = code[0];
+		if (kind === "R" || kind === "C") {
+			const oldPath = parts[++i] ?? "";
+			const newPath = parts[++i] ?? "";
+			entries.push(kind === "R" ? {
+				path: newPath,
+				status: "renamed",
+				oldPath
+			} : {
+				path: newPath,
+				status: "added"
+			});
+			continue;
+		}
+		const file = parts[++i] ?? "";
+		if (kind === "A") entries.push({
+			path: file,
+			status: "added"
+		});
+		else if (kind === "D") entries.push({
+			path: file,
+			status: "deleted"
+		});
+		else entries.push({
+			path: file,
+			status: "modified"
+		});
+	}
+	return entries;
+}
+/**
+* `git diff --numstat -z -M` output → the paths git counts as binary (`-` for
+* both counts). Unlike the patch's `Binary files … differ` line, numstat marks
+* a binary that is only renamed, only changes mode, or is deleted: observed
+* with git 2.54, an exact (100%) binary rename and a mode-only binary change
+* both print `-\t-`, never `0\t0` (the change-scope test asserts all three
+* against real git, a TAB-named file included). Entries are
+* `<add>\t<del>\t<path>\0`, or `<add>\t<del>\t\0<old>\0<new>\0` for a rename;
+* a deleted file is keyed by its old path, as `ChangedFile.path` is.
+*/
+function parseNumstatBinary(out) {
+	const binary = /* @__PURE__ */ new Set();
+	const parts = out.split("\0");
+	for (let i = 0; i < parts.length; i++) {
+		const entry = parts[i];
+		if (!entry) continue;
+		const fields = /^([^\t]*)\t([^\t]*)\t([\s\S]*)$/.exec(entry);
+		if (!fields) continue;
+		const [, added, deleted, file] = fields;
+		let target = file ?? "";
+		if (target === "") {
+			i += 1;
+			target = parts[++i] ?? "";
+		}
+		if (added === "-" && deleted === "-" && target) binary.add(target);
+	}
+	return binary;
+}
+const C_ESCAPES = {
+	a: 7,
+	b: 8,
+	t: 9,
+	n: 10,
+	v: 11,
+	f: 12,
+	r: 13,
+	"\"": 34,
+	"\\": 92
+};
+/**
+* A path as a patch header prints it → the repository path. git C-quotes a
+* path holding a quote, backslash or control character (`"b/quo\"te.ts"`,
+* octal escapes for non-UTF-8 bytes even with `core.quotePath=false`), and
+* appends a TAB to an unquoted `---`/`+++` path that contains a space. Taken
+* verbatim, either form misses the name-status path and the file's added
+* lines silently become none. Returns null for `/dev/null`.
+*/
+function parseDiffPath(raw, side) {
+	let value = raw;
+	if (value.startsWith("\"") && value.endsWith("\"") && value.length >= 2) {
+		const bytes = [];
+		const body = value.slice(1, -1);
+		for (let i = 0; i < body.length; i++) {
+			const ch = body[i];
+			if (ch !== "\\") {
+				bytes.push(...Buffer.from(ch, "utf8"));
+				continue;
+			}
+			const next = body[i + 1] ?? "";
+			const octal = /^[0-7]{3}/.exec(body.slice(i + 1));
+			if (octal) {
+				bytes.push(parseInt(octal[0], 8));
+				i += 3;
+			} else {
+				bytes.push(C_ESCAPES[next] ?? next.charCodeAt(0));
+				i += 1;
+			}
+		}
+		value = Buffer.from(bytes).toString("utf8");
+	} else value = value.replace(/\t$/, "");
+	if (value === "/dev/null") return null;
+	const prefix = `${side}/`;
+	return value.startsWith(prefix) ? value.slice(prefix.length) : value;
+}
+/**
+* `git diff --unified=0` output → added line numbers per new-side path, and
+* the paths git reports as binary. Hunk headers are `@@ -a[,b] +c[,d] @@`;
+* `d` omitted means 1 and `d == 0` adds nothing.
+*/
+function parseUnifiedDiff(diff) {
+	const added = /* @__PURE__ */ new Map();
+	const binary = /* @__PURE__ */ new Set();
+	let current = null;
+	for (const line of diff.split("\n")) {
+		if (line.startsWith("diff --git ")) {
+			current = null;
+			continue;
+		}
+		if (line.startsWith("+++ ")) {
+			current = parseDiffPath(line.slice(4), "b");
+			if (current !== null && !added.has(current)) added.set(current, []);
+			continue;
+		}
+		if (line.startsWith("Binary files ")) {
+			const m = / and ("(?:[^"\\]|\\.)*"|.+) differ$/.exec(line);
+			const target = m?.[1] ? parseDiffPath(m[1], "b") : null;
+			if (target !== null) binary.add(target);
+			continue;
+		}
+		if (line.startsWith("@@") && current !== null) {
+			const m = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,(\d+))? @@/.exec(line);
+			if (!m) continue;
+			const start = Number(m[1]);
+			const count = m[2] === void 0 ? 1 : Number(m[2]);
+			const lines = added.get(current) ?? [];
+			for (let n = 0; n < count; n++) lines.push(start + n);
+			added.set(current, lines);
+		}
+	}
+	return {
+		added,
+		binary
+	};
+}
+/** True when the first 8000 bytes contain a NUL, git's own binary test. */
+function looksBinary(content) {
+	return content.subarray(0, 8e3).includes(0);
+}
+/** Every line of an untracked file, 1..N (none for an empty or binary file). */
+function allLines(absPath) {
+	let content;
+	try {
+		content = fs.readFileSync(absPath);
+	} catch {
+		return {
+			lines: [],
+			binary: false
+		};
+	}
+	if (looksBinary(content)) return {
+		lines: [],
+		binary: true
+	};
+	const text = content.toString("utf8");
+	if (text.length === 0) return {
+		lines: [],
+		binary: false
+	};
+	const count = text.split("\n").length - (text.endsWith("\n") ? 1 : 0);
+	return {
+		lines: Array.from({ length: count }, (_, i) => i + 1),
+		binary: false
+	};
+}
+/** The change: base, merge base and every changed file inside the scope. */
+function computeChangeScope(options) {
+	const git = options.git ?? runGit;
+	const root = path$1.resolve(gitOrThrow(git, ["rev-parse", "--show-toplevel"], options.cwd).trim());
+	const ciTarget = options.ciTargetBranch !== void 0 ? options.ciTargetBranch : detectCiEnvironment()?.pr_target_branch;
+	const { ref, source } = resolveBaseRef(git, root, options.base, ciTarget);
+	const mb = git([
+		"merge-base",
+		"HEAD",
+		ref
+	], root);
+	const mergeBase = mb.stdout.trim();
+	if (mb.code !== 0 || !mergeBase) throw new NoMergeBaseError(`no merge base between HEAD and ${ref} (from ${source === "flag" ? "--base" : source === "ci" ? "the CI PR target branch" : "origin/HEAD"})` + (mb.stderr.trim() ? `: ${mb.stderr.trim()}` : "") + ". Pass --base <ref>, or fetch the base branch first.");
+	const specs = scopePathspecs(root, options.cwd, options.scope);
+	const pathspec = specs.length > 0 ? ["--", ...specs] : [];
+	const statuses = parseNameStatus(gitOrThrow(git, [
+		"diff",
+		"--name-status",
+		"-z",
+		"-M",
+		"--no-ext-diff",
+		mergeBase,
+		...pathspec
+	], root));
+	const { added, binary } = parseUnifiedDiff(gitOrThrow(git, [
+		"diff",
+		"--unified=0",
+		"--no-color",
+		"--no-ext-diff",
+		"-M",
+		mergeBase,
+		...pathspec
+	], root));
+	for (const file of parseNumstatBinary(gitOrThrow(git, [
+		"diff",
+		"--numstat",
+		"-z",
+		"-M",
+		"--no-ext-diff",
+		mergeBase,
+		...pathspec
+	], root))) binary.add(file);
+	const files = statuses.map((s) => ({
+		...s,
+		addedLines: s.status === "deleted" ? [] : added.get(s.path) ?? [],
+		binary: binary.has(s.path),
+		untracked: false
+	}));
+	const untracked = gitOrThrow(git, [
+		"ls-files",
+		"--others",
+		"--exclude-standard",
+		"-z",
+		...pathspec
+	], root).split("\0").filter((p) => p.length > 0);
+	for (const file of untracked) {
+		const { lines, binary: isBinary } = allLines(path$1.join(root, file));
+		files.push({
+			path: file,
+			status: "added",
+			addedLines: lines,
+			binary: isBinary,
+			untracked: true
+		});
+	}
+	return {
+		root,
+		baseRef: ref,
+		baseSource: source,
+		mergeBase,
+		files
+	};
+}
+/**
+* A file's content at the merge base through `git show`, or null when it did
+* not exist there (an untracked or added file: every entry in it is new).
+*/
+function readAtBase(scope, file, git = runGit) {
+	if (file.untracked || file.status === "added") return null;
+	const atBase = file.oldPath ?? file.path;
+	const r = git(["show", `${scope.mergeBase}:${atBase}`], scope.root);
+	return r.code === 0 ? r.stdout : null;
+}
+/**
+* A minimal glob for exclusion lists, matched against a repo-relative path.
+* `**` crosses directories, `*` and `?` do not. A pattern with no `/` matches
+* the basename (`*.d.ts`, `build.rs`); a leading `**\/` also matches at the
+* root (`**\/src/gen/**` matches `src/gen/x.ts`).
+*/
+function globToRegExp(glob) {
+	const source = glob.includes("/") ? glob : `**/${glob}`;
+	let re = "";
+	for (let i = 0; i < source.length; i++) {
+		const ch = source[i];
+		if (ch === "*") if (source[i + 1] === "*") if (source[i + 2] === "/") {
+			re += "(?:.*/)?";
+			i += 2;
+		} else {
+			re += ".*";
+			i += 1;
+		}
+		else re += "[^/]*";
+		else if (ch === "?") re += "[^/]";
+		else re += ch.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+	}
+	return /* @__PURE__ */ new RegExp(`^${re}$`);
+}
+function matchesAny(file, globs) {
+	return globs.some((g) => globToRegExp(g).test(file));
+}
+
+//#endregion
+export { GitError, NoMergeBaseError, computeChangeScope, matchesAny, readAtBase, runGit };

package/dist/changedCoverageHandler-B8Zh5WIK.js

@@ -0,0 +1,200 @@
+import { COVERAGE_DEFAULT_EXCLUDES } from "./coverage-defaults-Ct3KNnGl.js";
+import "./dist-DU3htaZ_.js";
+import { GitError, NoMergeBaseError, computeChangeScope, matchesAny } from "./change-scope-DBmyRWZV.js";
+import * as fs from "node:fs";
+import * as path$1 from "node:path";
+
+//#region src/commands/gates/changedCoverageHandler.ts
+/**
+* `levr gates changed-coverage` (ENG-7618 D4.2): line coverage over only the
+* lines the change added, read from an lcov file. The `changed_line_coverage`
+* gate runs it.
+*
+* A line counts only when lcov marks it executable (a `DA` record). Every
+* in-scope changed `.ts`, `.tsx` or `.rs` file that is not excluded MUST have
+* an `SF` record: a missing record is missing evidence, so it exits 2 naming
+* the file, never "zero lines" (review R1 C1/C6).
+*
+* Exit 0 when coverage is at or above `--min`; 1 below it, printing every
+* uncovered `file:line`; 2 for a usage error, no merge base, no lcov file, a
+* changed file with no lcov record, or a crash. Zero changed executable lines
+* passes and says so; fewer than SMALL_CHANGE_LINES passes as "not enforced"
+* (the SonarQube small-change rule).
+*/
+/** Source extensions whose changed lines are measured. */
+const COVERAGE_SOURCE_EXTENSIONS = [
+	".ts",
+	".tsx",
+	".rs"
+];
+/** Below this many changed executable lines the threshold is not enforced. */
+const SMALL_CHANGE_LINES = 20;
+/**
+* Parse lcov `SF:` / `DA:<line>,<hits>` / `end_of_record`. Other records
+* (functions, branches, checksums) are ignored. A file listed twice (two
+* test runs merged) keeps the larger hit count per line.
+*/
+function parseLcov(text) {
+	const records = /* @__PURE__ */ new Map();
+	let current = null;
+	for (const raw of text.split(/\r?\n/)) {
+		const line = raw.trim();
+		if (line.startsWith("SF:")) {
+			const file = line.slice(3);
+			current = records.get(file) ?? /* @__PURE__ */ new Map();
+			records.set(file, current);
+		} else if (line.startsWith("DA:") && current) {
+			const [lineNo, hits] = line.slice(3).split(",");
+			const n = Number(lineNo);
+			const h = Number(hits);
+			if (Number.isInteger(n) && Number.isFinite(h)) current.set(n, Math.max(current.get(n) ?? 0, h));
+		} else if (line === "end_of_record") current = null;
+	}
+	return records;
+}
+/**
+* lcov SF paths → repo-root-relative paths (review R2 C6). An absolute path
+* is made relative to the repository root; a relative one is resolved
+* against `lcovRoot` (repo-relative, e.g. `apps/backender` for an app-rooted
+* run). A path outside the repository is returned in `outside`.
+*/
+function normaliseLcovPaths(records, repoRoot, lcovRoot) {
+	const byFile = /* @__PURE__ */ new Map();
+	const outside = [];
+	const base = path$1.resolve(repoRoot, lcovRoot);
+	for (const [sf, lines] of records) {
+		const abs = path$1.isAbsolute(sf) ? path$1.normalize(sf) : path$1.resolve(base, sf);
+		const rel = path$1.relative(repoRoot, abs);
+		if (rel === "" || rel === ".." || rel.startsWith(`..${path$1.sep}`) || path$1.isAbsolute(rel)) {
+			outside.push(sf);
+			continue;
+		}
+		const key = rel.split(path$1.sep).join("/");
+		const merged = byFile.get(key) ?? /* @__PURE__ */ new Map();
+		for (const [n, h] of lines) merged.set(n, Math.max(merged.get(n) ?? 0, h));
+		byFile.set(key, merged);
+	}
+	return {
+		byFile,
+		outside
+	};
+}
+/**
+* Every changed in-scope source file that is not excluded: each must have an
+* lcov record. A file the change only shortened, or renamed untouched, is
+* still changed, so it needs one too even though it adds no lines to count.
+* Only a deleted file is exempt: there is nothing left to measure.
+*/
+function measuredFiles(files, excludes) {
+	return files.filter((f) => f.status !== "deleted" && COVERAGE_SOURCE_EXTENSIONS.some((ext) => f.path.endsWith(ext)) && !matchesAny(f.path, excludes));
+}
+/** Changed executable lines, covered lines and the uncovered `file:line`s. */
+function measureCoverage(files, byFile) {
+	const result = {
+		executable: 0,
+		covered: 0,
+		uncovered: [],
+		missingRecords: []
+	};
+	for (const file of files) {
+		const hits = byFile.get(file.path);
+		if (!hits) {
+			result.missingRecords.push(file.path);
+			continue;
+		}
+		for (const n of file.addedLines) {
+			const h = hits.get(n);
+			if (h === void 0) continue;
+			result.executable++;
+			if (h > 0) result.covered++;
+			else result.uncovered.push(`${file.path}:${n}`);
+		}
+	}
+	return result;
+}
+function fail2(message) {
+	return {
+		exitCode: 2,
+		stdout: "",
+		stderr: `gates changed-coverage: ${message}\n`
+	};
+}
+/** The command body; `execute…` below maps any throw to exit 2. */
+function runChangedCoverage(flags, cwd = process.cwd(), scopeOptions = {}) {
+	const min = Number(flags.min);
+	if (flags.min.trim() === "" || !Number.isFinite(min) || min < 0 || min > 100) return fail2(`--min "${flags.min}" must be a number from 0 to 100`);
+	if (!flags.lcov.trim()) return fail2("--lcov is required");
+	const lcovPath = path$1.resolve(cwd, flags.lcov);
+	if (!fs.existsSync(lcovPath)) return fail2(`no lcov file at ${flags.lcov}; run the tests with lcov coverage first`);
+	try {
+		const scope = computeChangeScope({
+			cwd,
+			base: flags.base,
+			scope: flags.scope,
+			...scopeOptions
+		});
+		const excludes = [...COVERAGE_DEFAULT_EXCLUDES, ...flags.exclude ?? []];
+		const files = measuredFiles(scope.files, excludes);
+		const lcovTime = fs.statSync(lcovPath).mtimeMs;
+		const newer = files.filter((f) => {
+			const abs = path$1.join(scope.root, f.path);
+			return fs.existsSync(abs) && fs.statSync(abs).mtimeMs > lcovTime;
+		}).map((f) => f.path);
+		if (newer.length > 0) return fail2(`${flags.lcov} is older than ${newer.length} changed file(s) it would measure (${newer.join(", ")}); run the tests with coverage again so it describes the current code (a coverage file restored from a cache, or a git checkout, stash or rebase after the test run, does this too)`);
+		const { byFile, outside } = normaliseLcovPaths(parseLcov(fs.readFileSync(lcovPath, "utf8")), scope.root, flags["lcov-root"] || ".");
+		const notes = outside.length > 0 ? `ignored ${outside.length} lcov record(s) outside the repository: ${outside.join(", ")}\n` : "";
+		const result = measureCoverage(files, byFile);
+		if (result.missingRecords.length > 0) return {
+			exitCode: 2,
+			stdout: "",
+			stderr: notes + result.missingRecords.map((f) => `gates changed-coverage: no lcov record for ${f}\n`).join("") + `A changed source file with no lcov record is missing evidence, never zero lines. Run its tests with coverage, check --lcov-root (now "${flags["lcov-root"] || "."}"), or exclude it with --exclude.\n`
+		};
+		const where = `against ${scope.baseRef} (merge base ${scope.mergeBase.slice(0, 12)})`;
+		if (result.executable === 0) return {
+			exitCode: 0,
+			stdout: `${notes}PASS 0 changed executable lines in ${files.length} file(s) ${where}; nothing to measure\n`,
+			stderr: ""
+		};
+		const pct = 100 * result.covered / result.executable;
+		const summary = `${result.covered}/${result.executable} changed executable lines covered (${pct.toFixed(1)}%, min ${min}%) ${where}`;
+		if (result.executable < SMALL_CHANGE_LINES) return {
+			exitCode: 0,
+			stdout: `${notes}PASS ${result.executable} changed lines, not enforced (fewer than ${SMALL_CHANGE_LINES}): ${summary}\n`,
+			stderr: ""
+		};
+		if (pct >= min) return {
+			exitCode: 0,
+			stdout: `${notes}PASS ${summary}\n`,
+			stderr: ""
+		};
+		return {
+			exitCode: 1,
+			stdout: `${notes}FAIL ${summary}\nuncovered changed lines:\n` + result.uncovered.map((l) => `  ${l}\n`).join(""),
+			stderr: ""
+		};
+	} catch (error) {
+		if (error instanceof NoMergeBaseError || error instanceof GitError) return fail2(error.message);
+		return fail2(`crashed: ${error instanceof Error ? error.message : String(error)}`);
+	}
+}
+/**
+* The whole command minus process I/O, so tests can drive it. Any throw —
+* from validation, path resolution or anything below — is exit 2, never an
+* uncaught error: stricli would exit 1 for it, which reads as a verdict.
+*/
+function executeChangedCoverage(flags, cwd, scopeOptions = {}) {
+	try {
+		return runChangedCoverage(flags, cwd ?? process.cwd(), scopeOptions);
+	} catch (error) {
+		return fail2(`crashed: ${error instanceof Error ? error.message : String(error)}`);
+	}
+}
+function gatesChangedCoverageHandler(flags) {
+	const result = executeChangedCoverage(flags);
+	if (result.stdout.length > 0) this.process.stdout.write(result.stdout);
+	if (result.stderr.length > 0) this.process.stderr.write(result.stderr);
+	this.process.exitCode = result.exitCode;
+}
+
+//#endregion
+export { gatesChangedCoverageHandler };