@levr-one/cli 0.12.8 → 0.12.10

package/dist/dependencyAuditHandler-CdpW-IvY.js

@@ -0,0 +1,291 @@
+import "./dist-DU3htaZ_.js";
+import { GitError, NoMergeBaseError, computeChangeScope, readAtBase, runGit } from "./change-scope-DBmyRWZV.js";
+import * as fs from "node:fs";
+import * as path$1 from "node:path";
+import { spawnSync } from "node:child_process";
+
+//#region src/commands/gates/dependencyAuditHandler.ts
+/**
+* `levr gates dependency-audit` (ENG-7618 D4.3): vulnerabilities and
+* disallowed licenses in only the packages the change ADDED or UPGRADED. The
+* `dependency_audit` gate runs it; whole-repo scanning stays in CI.
+*
+* Each lockfile in scope is read at the merge base (`git show`) and in the
+* working tree; the (name, version) pairs new in the working tree are the
+* change's packages. trivy scans the checkout against its LOCAL database
+* only, and its findings are kept when they name one of those packages. A
+* vulnerable dependency the change did not touch stays green.
+*
+* Exit 0 no findings; 1 findings (package@version, CVE or license); 2 for a
+* usage error, no merge base, trivy missing, a trivy failure (an empty or
+* missing database included), or a crash. Never a pass on a failure.
+*/
+const LOCKFILES = [
+	"yarn.lock",
+	"package-lock.json",
+	"pnpm-lock.yaml",
+	"Cargo.lock"
+];
+const SEVERITIES = [
+	"UNKNOWN",
+	"LOW",
+	"MEDIUM",
+	"HIGH",
+	"CRITICAL"
+];
+/** trivy's argv. Reads its existing database and never writes a file. */
+const TRIVY_ARGS = [
+	"fs",
+	"--scanners",
+	"vuln,license",
+	"--skip-db-update",
+	"--offline-scan",
+	"--format",
+	"json",
+	"--quiet",
+	"."
+];
+const runTrivy = (args, cwd) => {
+	const r = spawnSync("trivy", [...args], {
+		cwd,
+		encoding: "utf8",
+		maxBuffer: 512 * 1024 * 1024
+	});
+	const missing = r.error?.code === "ENOENT";
+	return {
+		code: r.status ?? 1,
+		stdout: r.stdout ?? "",
+		stderr: r.stderr ?? (r.error ? r.error.message : ""),
+		missing
+	};
+};
+function add(set, name, version) {
+	if (!name || !version) return;
+	const versions = set.get(name) ?? /* @__PURE__ */ new Set();
+	versions.add(version);
+	set.set(name, versions);
+}
+/** The package name of a yarn descriptor: `@scope/pkg@npm:^1` → `@scope/pkg`. */
+function descriptorName(descriptor) {
+	const d = descriptor.trim().replace(/^"|"$/g, "");
+	const at = d.indexOf("@", 1);
+	return at === -1 ? d : d.slice(0, at);
+}
+/** yarn.lock, classic (`version "1.2.3"`) and berry (`version: 1.2.3`). */
+function parseYarnLock(text) {
+	const set = /* @__PURE__ */ new Map();
+	let name = null;
+	for (const line of text.split(/\r?\n/)) {
+		if (!line || line.startsWith("#")) continue;
+		if (!line.startsWith(" ") && line.endsWith(":")) {
+			const first = line.slice(0, -1).split(",")[0] ?? "";
+			name = first.trim() === "__metadata" ? null : descriptorName(first);
+			continue;
+		}
+		const m = /^\s+version:?\s+"?([^"\s]+)"?\s*$/.exec(line);
+		if (m?.[1] && name) {
+			add(set, name, m[1]);
+			name = null;
+		}
+	}
+	return set;
+}
+/** package-lock.json v2/v3 (`packages`) with a v1 (`dependencies`) fallback. */
+function parsePackageLock(text) {
+	const set = /* @__PURE__ */ new Map();
+	const json = JSON.parse(text);
+	if (json.packages) {
+		for (const [key, entry] of Object.entries(json.packages)) {
+			if (!key || entry.link || !entry.version) continue;
+			const idx = key.lastIndexOf("node_modules/");
+			add(set, idx === -1 ? entry.name ?? key : key.slice(idx + 13), entry.version);
+		}
+		return set;
+	}
+	const walk = (deps) => {
+		for (const [name, entry] of Object.entries(deps ?? {})) {
+			if (entry.version) add(set, name, entry.version);
+			walk(entry.dependencies);
+		}
+	};
+	walk(json.dependencies);
+	return set;
+}
+/** pnpm-lock.yaml `packages:` keys: `/name@1.2.3:`, `name@1.2.3(peer):`, `/name/1.2.3:`. */
+function parsePnpmLock(text) {
+	const set = /* @__PURE__ */ new Map();
+	let inPackages = false;
+	for (const line of text.split(/\r?\n/)) {
+		if (/^\S/.test(line)) {
+			inPackages = line.startsWith("packages:");
+			continue;
+		}
+		if (!inPackages) continue;
+		const m = /^ {2}['"]?\/?([^'"\s]+?)['"]?:\s*$/.exec(line);
+		if (!m?.[1]) continue;
+		const key = m[1].replace(/\(.*$/, "");
+		const at = key.lastIndexOf("@");
+		if (at > 0) add(set, key.slice(0, at), key.slice(at + 1));
+		else {
+			const slash = key.lastIndexOf("/");
+			if (slash > 0) add(set, key.slice(0, slash), key.slice(slash + 1));
+		}
+	}
+	return set;
+}
+/** Cargo.lock `[[package]]` tables. */
+function parseCargoLock(text) {
+	const set = /* @__PURE__ */ new Map();
+	for (const block of text.split("[[package]]").slice(1)) {
+		const name = /^name\s*=\s*"([^"]+)"/m.exec(block)?.[1];
+		const version = /^version\s*=\s*"([^"]+)"/m.exec(block)?.[1];
+		if (name && version) add(set, name, version);
+	}
+	return set;
+}
+function parseLockfile(file, text) {
+	const base = path$1.basename(file);
+	if (base === "yarn.lock") return parseYarnLock(text);
+	if (base === "package-lock.json") return parsePackageLock(text);
+	if (base === "pnpm-lock.yaml") return parsePnpmLock(text);
+	if (base === "Cargo.lock") return parseCargoLock(text);
+	return /* @__PURE__ */ new Map();
+}
+/** (name, version) pairs in `after` that `before` lacks: added or upgraded. */
+function diffPackages(before, after) {
+	const changed = /* @__PURE__ */ new Map();
+	for (const [name, versions] of after) {
+		const old = before.get(name);
+		for (const v of versions) if (!old?.has(v)) add(changed, name, v);
+	}
+	return changed;
+}
+/** Findings that name a changed package, at or above the severity floor. */
+function filterFindings(report, changed, minSeverity, allowedLicenses) {
+	const floor = SEVERITIES.indexOf(minSeverity);
+	const findings = [];
+	const seen = /* @__PURE__ */ new Set();
+	const push = (f) => {
+		const key = `${f.kind}|${f.pkg}|${f.version ?? ""}|${f.id}`;
+		if (seen.has(key)) return;
+		seen.add(key);
+		findings.push(f);
+	};
+	for (const result of report.Results ?? []) {
+		for (const v of result.Vulnerabilities ?? []) {
+			const name = v.PkgName ?? "";
+			const version = v.InstalledVersion ?? "";
+			if (!changed.get(name)?.has(version)) continue;
+			const sev = (v.Severity ?? "UNKNOWN").toUpperCase();
+			const rank = SEVERITIES.indexOf(sev);
+			if ((rank === -1 ? 0 : rank) < floor) continue;
+			push({
+				kind: "vulnerability",
+				pkg: name,
+				version,
+				id: v.VulnerabilityID ?? "?",
+				severity: sev
+			});
+		}
+		if (!allowedLicenses) continue;
+		for (const l of result.Licenses ?? []) {
+			const name = l.PkgName ?? "";
+			const license = l.Name ?? "";
+			if (!changed.has(name) || !license) continue;
+			if (allowedLicenses.has(license.toUpperCase())) continue;
+			push({
+				kind: "license",
+				pkg: name,
+				id: license,
+				severity: l.Severity
+			});
+		}
+	}
+	return findings;
+}
+function fail2(message) {
+	return {
+		exitCode: 2,
+		stdout: "",
+		stderr: `gates dependency-audit: ${message}\n`
+	};
+}
+function formatFinding(f) {
+	return f.kind === "vulnerability" ? `  ${f.pkg}@${f.version} ${f.id} (${f.severity})` : `  ${f.pkg} license ${f.id} is not in --allow-licenses`;
+}
+/** The command body; `execute…` below maps any throw to exit 2. */
+function runDependencyAudit(flags, cwd = process.cwd(), deps = {}) {
+	const severity = flags.severity.trim().toUpperCase();
+	if (!SEVERITIES.includes(severity)) return fail2(`--severity "${flags.severity}" must be one of: ${SEVERITIES.join(", ")}`);
+	const allowed = flags["allow-licenses"]?.trim() ? new Set(flags["allow-licenses"].split(",").map((l) => l.trim().toUpperCase()).filter(Boolean)) : null;
+	const git = deps.git ?? deps.scopeOptions?.git ?? runGit;
+	try {
+		const scope = computeChangeScope({
+			cwd,
+			base: flags.base,
+			scope: flags.scope,
+			git,
+			...deps.scopeOptions
+		});
+		const lockfiles = scope.files.filter((f) => f.status !== "deleted" && LOCKFILES.includes(path$1.basename(f.path)));
+		const changed = /* @__PURE__ */ new Map();
+		for (const file of lockfiles) {
+			const atBase = readAtBase(scope, file, git);
+			const current = fs.readFileSync(path$1.join(scope.root, file.path), "utf8");
+			const delta = diffPackages(atBase === null ? /* @__PURE__ */ new Map() : parseLockfile(file.path, atBase), parseLockfile(file.path, current));
+			for (const [name, versions] of delta) for (const v of versions) add(changed, name, v);
+		}
+		const where = `against ${scope.baseRef} (merge base ${scope.mergeBase.slice(0, 12)})`;
+		const count = [...changed.values()].reduce((n, s) => n + s.size, 0);
+		if (count === 0) return {
+			exitCode: 0,
+			stdout: `PASS no added or upgraded packages in ${lockfiles.length} changed lockfile(s) ${where}\n`,
+			stderr: ""
+		};
+		const trivy = (deps.trivy ?? runTrivy)(TRIVY_ARGS, scope.root);
+		if (trivy.missing) return fail2("trivy is not installed (https://trivy.dev); see `levr gates dependency-audit --help`");
+		if (trivy.code !== 0) return fail2(`trivy exited ${trivy.code}; an empty or missing vulnerability database is an error here, never a pass (warm the cache first, see --help): ` + trivy.stderr.trim().split("\n").slice(-5).join(" | "));
+		let report;
+		try {
+			report = JSON.parse(trivy.stdout);
+		} catch {
+			return fail2("trivy printed no JSON report");
+		}
+		const findings = filterFindings(report, changed, severity, allowed);
+		const summary = `${count} added or upgraded package version(s) ${where}`;
+		if (findings.length === 0) return {
+			exitCode: 0,
+			stdout: `PASS no ${severity}+ findings${allowed ? " or disallowed licenses" : ""} in ${summary}\n`,
+			stderr: ""
+		};
+		return {
+			exitCode: 1,
+			stdout: `FAIL ${findings.length} finding(s) in ${summary}:\n` + findings.map(formatFinding).join("\n") + "\n",
+			stderr: ""
+		};
+	} catch (error) {
+		if (error instanceof NoMergeBaseError || error instanceof GitError) return fail2(error.message);
+		return fail2(`crashed: ${error instanceof Error ? error.message : String(error)}`);
+	}
+}
+/**
+* The whole command minus process I/O, so tests can drive it. Any throw —
+* from validation, path resolution or anything below — is exit 2, never an
+* uncaught error: stricli would exit 1 for it, which reads as a verdict.
+*/
+function executeDependencyAudit(flags, cwd, deps = {}) {
+	try {
+		return runDependencyAudit(flags, cwd ?? process.cwd(), deps);
+	} catch (error) {
+		return fail2(`crashed: ${error instanceof Error ? error.message : String(error)}`);
+	}
+}
+function gatesDependencyAuditHandler(flags) {
+	const result = executeDependencyAudit(flags);
+	if (result.stdout.length > 0) this.process.stdout.write(result.stdout);
+	if (result.stderr.length > 0) this.process.stderr.write(result.stderr);
+	this.process.exitCode = result.exitCode;
+}
+
+//#endregion
+export { gatesDependencyAuditHandler };

package/dist/dist-DU3htaZ_.js

@@ -0,0 +1,325 @@
+import { readFileSync, statSync } from "node:fs";
+import { execSync } from "node:child_process";
+
+//#region ../ci-env/dist/providers/github.js
+const MAX_EVENT_PAYLOAD_BYTES = 5 * 1024 * 1024;
+const PR_EVENT_NAMES = new Set(["pull_request", "pull_request_target"]);
+function readPullRequestEvent(eventPath) {
+	if (!eventPath) return void 0;
+	try {
+		if (statSync(eventPath).size > MAX_EVENT_PAYLOAD_BYTES) return void 0;
+		const raw = readFileSync(eventPath, "utf8");
+		return JSON.parse(raw);
+	} catch {
+		return;
+	}
+}
+const github = {
+	name: "github_actions",
+	detect(env) {
+		return env.GITHUB_ACTIONS === "true";
+	},
+	extract(env) {
+		const isPr = !!env.GITHUB_EVENT_NAME && PR_EVENT_NAMES.has(env.GITHUB_EVENT_NAME);
+		const ref = env.GITHUB_REF ?? "";
+		const prPayload = isPr ? readPullRequestEvent(env.GITHUB_EVENT_PATH) : void 0;
+		const refMatch = isPr ? /^refs\/pull\/(\d+)\/merge$/.exec(ref) : null;
+		const prNumber = prPayload?.pull_request?.number?.toString() ?? refMatch?.[1];
+		const serverUrl = env.GITHUB_SERVER_URL ?? "https://github.com";
+		const repo = env.GITHUB_REPOSITORY ?? "";
+		const commitSha = env.GITHUB_PULL_REQUEST_HEAD_SHA ?? prPayload?.pull_request?.head?.sha ?? env.GITHUB_SHA;
+		return {
+			ci_provider: "github_actions",
+			ci_build_id: env.GITHUB_RUN_ID,
+			ci_build_number: env.GITHUB_RUN_NUMBER,
+			ci_build_url: repo ? `${serverUrl}/${repo}/actions/runs/${env.GITHUB_RUN_ID}` : void 0,
+			ci_job_name: env.GITHUB_JOB,
+			ci_job_url: repo ? `${serverUrl}/${repo}/actions/runs/${env.GITHUB_RUN_ID}` : void 0,
+			commit_sha: commitSha,
+			commit_author: env.GITHUB_ACTOR,
+			branch: isPr ? env.GITHUB_HEAD_REF : ref.startsWith("refs/heads/") ? ref.replace(/^refs\/heads\//, "") : void 0,
+			tag: ref.startsWith("refs/tags/") ? ref.replace(/^refs\/tags\//, "") : void 0,
+			is_pr: isPr,
+			pr_number: prNumber,
+			pr_branch: isPr ? env.GITHUB_HEAD_REF : void 0,
+			pr_target_branch: isPr ? env.GITHUB_BASE_REF : void 0,
+			repository_url: repo ? `${serverUrl}/${repo}` : void 0,
+			repository_slug: repo || void 0,
+			runner_os: env.RUNNER_OS?.toLowerCase(),
+			runner_arch: env.RUNNER_ARCH?.toLowerCase(),
+			runner_name: env.RUNNER_NAME
+		};
+	}
+};
+
+//#endregion
+//#region ../ci-env/dist/providers/gitlab.js
+const gitlab = {
+	name: "gitlab_ci",
+	detect(env) {
+		return env.GITLAB_CI === "true";
+	},
+	extract(env) {
+		const isPr = !!env.CI_MERGE_REQUEST_IID;
+		return {
+			ci_provider: "gitlab_ci",
+			ci_build_id: env.CI_PIPELINE_ID,
+			ci_build_number: env.CI_PIPELINE_IID,
+			ci_build_url: env.CI_PIPELINE_URL,
+			ci_job_name: env.CI_JOB_NAME,
+			ci_job_url: env.CI_JOB_URL,
+			commit_sha: env.CI_COMMIT_SHA,
+			commit_message: env.CI_COMMIT_MESSAGE,
+			commit_author: env.CI_COMMIT_AUTHOR,
+			branch: env.CI_COMMIT_BRANCH ?? env.CI_MERGE_REQUEST_SOURCE_BRANCH_NAME,
+			tag: env.CI_COMMIT_TAG,
+			is_pr: isPr,
+			pr_number: env.CI_MERGE_REQUEST_IID,
+			pr_branch: env.CI_MERGE_REQUEST_SOURCE_BRANCH_NAME,
+			pr_target_branch: env.CI_MERGE_REQUEST_TARGET_BRANCH_NAME,
+			repository_url: env.CI_PROJECT_URL,
+			repository_slug: env.CI_PROJECT_PATH,
+			runner_name: env.CI_RUNNER_DESCRIPTION
+		};
+	}
+};
+
+//#endregion
+//#region ../ci-env/dist/providers/jenkins.js
+const jenkins = {
+	name: "jenkins",
+	detect(env) {
+		return !!env.JENKINS_URL;
+	},
+	extract(env) {
+		const isPr = !!env.CHANGE_ID;
+		return {
+			ci_provider: "jenkins",
+			ci_build_id: env.BUILD_ID,
+			ci_build_number: env.BUILD_NUMBER,
+			ci_build_url: env.BUILD_URL,
+			ci_job_name: env.JOB_NAME,
+			ci_job_url: env.JOB_URL,
+			commit_sha: env.GIT_COMMIT,
+			branch: env.GIT_BRANCH ?? env.BRANCH_NAME,
+			is_pr: isPr,
+			pr_number: env.CHANGE_ID,
+			pr_branch: env.CHANGE_BRANCH,
+			pr_target_branch: env.CHANGE_TARGET,
+			repository_url: env.GIT_URL
+		};
+	}
+};
+
+//#endregion
+//#region ../ci-env/dist/providers/circleci.js
+const circleci = {
+	name: "circleci",
+	detect(env) {
+		return env.CIRCLECI === "true";
+	},
+	extract(env) {
+		const isPr = !!env.CIRCLE_PULL_REQUEST;
+		const prNumber = (env.CIRCLE_PULL_REQUEST ?? "").split("/").pop();
+		return {
+			ci_provider: "circleci",
+			ci_build_id: env.CIRCLE_WORKFLOW_ID,
+			ci_build_number: env.CIRCLE_BUILD_NUM,
+			ci_build_url: env.CIRCLE_BUILD_URL,
+			ci_job_name: env.CIRCLE_JOB,
+			commit_sha: env.CIRCLE_SHA1,
+			branch: env.CIRCLE_BRANCH,
+			tag: env.CIRCLE_TAG,
+			is_pr: isPr,
+			pr_number: isPr ? prNumber : void 0,
+			repository_url: env.CIRCLE_REPOSITORY_URL,
+			repository_slug: env.CIRCLE_PROJECT_USERNAME && env.CIRCLE_PROJECT_REPONAME ? `${env.CIRCLE_PROJECT_USERNAME}/${env.CIRCLE_PROJECT_REPONAME}` : void 0
+		};
+	}
+};
+
+//#endregion
+//#region ../ci-env/dist/providers/azure.js
+const azure = {
+	name: "azure_devops",
+	detect(env) {
+		return env.TF_BUILD === "True";
+	},
+	extract(env) {
+		const isPr = env.BUILD_REASON === "PullRequest" || !!env.SYSTEM_PULLREQUEST_PULLREQUESTID;
+		const orgUrl = env.SYSTEM_TEAMFOUNDATIONCOLLECTIONURI ?? "";
+		const project = env.SYSTEM_TEAMPROJECT ?? "";
+		const buildId = env.BUILD_BUILDID ?? "";
+		return {
+			ci_provider: "azure_devops",
+			ci_build_id: buildId,
+			ci_build_number: env.BUILD_BUILDNUMBER,
+			ci_build_url: orgUrl && project && buildId ? `${orgUrl}${project}/_build/results?buildId=${buildId}` : void 0,
+			ci_job_name: env.AGENT_JOBNAME,
+			commit_sha: env.BUILD_SOURCEVERSION,
+			commit_message: env.BUILD_SOURCEVERSIONMESSAGE,
+			branch: env.BUILD_SOURCEBRANCH?.replace(/^refs\/heads\//, ""),
+			is_pr: isPr,
+			pr_number: env.SYSTEM_PULLREQUEST_PULLREQUESTID,
+			pr_branch: env.SYSTEM_PULLREQUEST_SOURCEBRANCH?.replace(/^refs\/heads\//, ""),
+			pr_target_branch: env.SYSTEM_PULLREQUEST_TARGETBRANCH?.replace(/^refs\/heads\//, ""),
+			repository_url: env.BUILD_REPOSITORY_URI,
+			repository_slug: env.BUILD_REPOSITORY_NAME,
+			runner_os: env.AGENT_OS?.toLowerCase(),
+			runner_name: env.AGENT_NAME
+		};
+	}
+};
+
+//#endregion
+//#region ../ci-env/dist/providers/buildkite.js
+const buildkite = {
+	name: "buildkite",
+	detect(env) {
+		return env.BUILDKITE === "true";
+	},
+	extract(env) {
+		const isPr = env.BUILDKITE_PULL_REQUEST !== "false" && !!env.BUILDKITE_PULL_REQUEST;
+		return {
+			ci_provider: "buildkite",
+			ci_build_id: env.BUILDKITE_BUILD_ID,
+			ci_build_number: env.BUILDKITE_BUILD_NUMBER,
+			ci_build_url: env.BUILDKITE_BUILD_URL,
+			ci_job_name: env.BUILDKITE_LABEL ?? env.BUILDKITE_STEP_KEY,
+			commit_sha: env.BUILDKITE_COMMIT,
+			commit_message: env.BUILDKITE_MESSAGE,
+			commit_author: env.BUILDKITE_BUILD_AUTHOR,
+			branch: env.BUILDKITE_BRANCH,
+			tag: env.BUILDKITE_TAG,
+			is_pr: isPr,
+			pr_number: isPr ? env.BUILDKITE_PULL_REQUEST : void 0,
+			pr_branch: isPr ? env.BUILDKITE_BRANCH : void 0,
+			pr_target_branch: isPr ? env.BUILDKITE_PULL_REQUEST_BASE_BRANCH : void 0,
+			repository_url: env.BUILDKITE_REPO,
+			repository_slug: env.BUILDKITE_PIPELINE_SLUG ? `${env.BUILDKITE_ORGANIZATION_SLUG}/${env.BUILDKITE_PIPELINE_SLUG}` : void 0,
+			runner_name: env.BUILDKITE_AGENT_NAME
+		};
+	}
+};
+
+//#endregion
+//#region ../ci-env/dist/providers/bitbucket.js
+const bitbucket = {
+	name: "bitbucket",
+	detect(env) {
+		return !!env.BITBUCKET_BUILD_NUMBER;
+	},
+	extract(env) {
+		const isPr = !!env.BITBUCKET_PR_ID;
+		const workspace = env.BITBUCKET_WORKSPACE ?? "";
+		const repo = env.BITBUCKET_REPO_SLUG ?? "";
+		return {
+			ci_provider: "bitbucket",
+			ci_build_id: env.BITBUCKET_PIPELINE_UUID,
+			ci_build_number: env.BITBUCKET_BUILD_NUMBER,
+			ci_build_url: workspace && repo && env.BITBUCKET_BUILD_NUMBER ? `https://bitbucket.org/${workspace}/${repo}/pipelines/results/${env.BITBUCKET_BUILD_NUMBER}` : void 0,
+			ci_job_name: env.BITBUCKET_STEP_UUID,
+			commit_sha: env.BITBUCKET_COMMIT,
+			branch: env.BITBUCKET_BRANCH,
+			tag: env.BITBUCKET_TAG,
+			is_pr: isPr,
+			pr_number: env.BITBUCKET_PR_ID,
+			pr_branch: isPr ? env.BITBUCKET_BRANCH : void 0,
+			pr_target_branch: env.BITBUCKET_PR_DESTINATION_BRANCH,
+			repository_url: workspace && repo ? `https://bitbucket.org/${workspace}/${repo}` : void 0,
+			repository_slug: workspace && repo ? `${workspace}/${repo}` : void 0
+		};
+	}
+};
+
+//#endregion
+//#region ../ci-env/dist/providers/generic.js
+/**
+* Generic CI fallback — detects basic CI environment using common env vars.
+* Used when no specific provider is matched.
+*/
+const generic = {
+	name: "generic_ci",
+	detect(env) {
+		return env.CI === "true" || env.CI === "1" || env.CONTINUOUS_INTEGRATION === "true";
+	},
+	extract(env) {
+		return {
+			ci_provider: "generic_ci",
+			ci_build_id: env.BUILD_ID ?? env.BUILD_NUMBER,
+			ci_build_number: env.BUILD_NUMBER,
+			ci_build_url: env.BUILD_URL,
+			commit_sha: env.GIT_COMMIT ?? env.COMMIT_SHA,
+			commit_author: env.GIT_AUTHOR_NAME,
+			branch: env.GIT_BRANCH ?? env.BRANCH_NAME ?? env.BRANCH,
+			tag: env.GIT_TAG ?? env.TAG_NAME,
+			repository_url: env.GIT_URL ?? env.REPOSITORY_URL
+		};
+	}
+};
+
+//#endregion
+//#region ../ci-env/dist/workspace-path.js
+/**
+* Detect the workspace path relative to the git repository root.
+* Useful for monorepos to distinguish which sub-project ran tests.
+*
+* Returns undefined if not in a git repository or git is unavailable.
+*/
+function detectWorkspacePath() {
+	try {
+		return execSync("git rev-parse --show-prefix", {
+			encoding: "utf-8",
+			timeout: 5e3,
+			stdio: [
+				"pipe",
+				"pipe",
+				"pipe"
+			]
+		}).trim().replace(/\/$/, "") || void 0;
+	} catch {
+		return;
+	}
+}
+
+//#endregion
+//#region ../ci-env/dist/detect.js
+/**
+* Ordered list of CI providers to check.
+* More specific providers first, generic fallback last.
+*/
+const PROVIDERS = [
+	github,
+	gitlab,
+	jenkins,
+	circleci,
+	azure,
+	buildkite,
+	bitbucket,
+	generic
+];
+let cachedResult;
+/**
+* Detect the CI environment from environment variables.
+*
+* @param env - Environment variables to inspect. Defaults to `process.env`.
+* @returns Normalized CI environment metadata, or `null` if not running in CI.
+*/
+function detectCiEnvironment(env) {
+	if (env === void 0 && cachedResult !== void 0) return cachedResult;
+	const source = env ?? process.env;
+	for (const provider of PROVIDERS) if (provider.detect(source)) {
+		const result = provider.extract(source);
+		if (!result.workspace_path) result.workspace_path = detectWorkspacePath();
+		if (!result.runner_os) result.runner_os = process.platform;
+		if (!result.runner_arch) result.runner_arch = process.arch;
+		const cleaned = Object.fromEntries(Object.entries(result).filter(([, v]) => v !== void 0));
+		if (env === void 0) cachedResult = cleaned;
+		return cleaned;
+	}
+	if (env === void 0) cachedResult = null;
+	return null;
+}
+
+//#endregion
+export { detectCiEnvironment };

package/dist/{find-workspace-4Us2vEb7.js → find-workspace-IWolSyrf.js}

@@ -1,4 +1,4 @@
-import { getApiUrl } from "./env-DjeRwmZ7.js";
+import { getApiUrl } from "./env-Cv-anxJA.js";
 
 //#region src/mcp/url.ts
 const KNOWN_MCP_URLS = {