@lumenflow/cli 5.4.0 → 5.7.12

package/dist/gates-runners.js

@@ -9,7 +9,7 @@
  * @module gates-runners
  */
 import { spawnSync } from 'node:child_process';
-import { existsSync, mkdirSync, readFileSync, writeFileSync, writeSync } from 'node:fs';
+import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync, writeSync, } from 'node:fs';
 import { access } from 'node:fs/promises';
 import { createRequire } from 'node:module';
 import path from 'node:path';
@@ -19,7 +19,7 @@ import { createGitForPath } from '@lumenflow/core/git-adapter';
 import { resolveGatesCommands, resolveTestRunner, getGatesSection, resolveScopedUnitTestExecutionPlan, formatScopedUnitTestFallbackMessage, } from '@lumenflow/packs-software-delivery/policy/gates-config';
 import { CoChangeRuleConfigSchema, ConditionalCommandConfigSchema, } from '@lumenflow/core/config-schema';
 import { validateBacklogSync } from '@lumenflow/core/validators/backlog-sync';
-import { DELIVERY_REVIEW_ARTIFACT_DIR, DeliveryReviewResultSchema, calculateDeliveryReviewVerdict, createWuPaths, flattenDeliveryReviewAcceptanceCriteria, isCodePathCoveredByChangedFiles, isDeliveryReviewSkippedForType, isPathLikeTestEntry, readWU, resolveDeliveryReviewRuntimeConfig, validateClaimValidation, } from '@lumenflow/core';
+import { DELIVERY_REVIEW_ARTIFACT_DIR, DeliveryReviewResultSchema, calculateDeliveryReviewVerdict, createWuPaths, flattenDeliveryReviewAcceptanceCriteria, isCodePathCoveredByChangedFiles, isDeliveryReviewSkippedForType, isPathLikeTestEntry, readWU, resolveDeliveryReviewRuntimeConfig, validateClaimValidation, DOCS_LAYOUT_PRESETS, } from '@lumenflow/core';
 import { runSupabaseDocsLinter } from '@lumenflow/core/validators/supabase-docs-linter';
 import { isIntegrationMainBranch, resolveIntegrationTargetRef, } from '@lumenflow/core/integration-target';
 import { PACKAGES, PKG_MANAGER, ESLINT_FLAGS, ESLINT_COMMANDS, ESLINT_DEFAULTS, SCRIPTS, CACHE_STRATEGIES, DIRECTORIES, EXIT_CODES, FILE_SYSTEM, } from '@lumenflow/core/wu-constants';
@@ -49,6 +49,8 @@ const DEFAULT_MIGRATION_VERIFY_PATTERNS = [
     'prisma/migrations/**',
     'drizzle/migrations/**',
 ];
+const WU_DB_IMPACTING_FIELD = 'db_impacting';
+const WU_YAML_EXTENSION = '.yaml';
 const DELIVERY_REVIEW_HIGH_RISK_PATH_PATTERN = /(auth|permission|secret|token|credential|billing|payment|migration|schema|policy|sandbox|security|hook)/i;
 const DELIVERY_REVIEW_TEST_PATH_PATTERN = /(^|\/)(__tests__\/|.*\.(test|spec)\.[A-Za-z0-9]+$)/i;
 function asStringArray(value) {
@@ -585,6 +587,181 @@ export async function runIntegrationTests({ agentLog, cwd, }) {
         return { ok: false, duration: Date.now() - start };
     }
 }
+// ── WU-2927: Opt-in local-prep gates (build / integration-test / e2e-smoke) ──
+/**
+ * WU-2927: Resolve `software_delivery.gates.local_prep` from workspace.yaml.
+ *
+ * Returns the typed sub-shape (or undefined when the section is missing or
+ * malformed). The runtime callers fall through to "not applicable" semantics
+ * when this returns undefined or `{ enabled: false }` — backward-compat for
+ * repos that have not opted in.
+ */
+function readLocalPrepConfig(cwd) {
+    try {
+        const section = getGatesSection(cwd);
+        const lp = section?.local_prep;
+        if (lp && typeof lp === 'object' && !Array.isArray(lp)) {
+            return lp;
+        }
+        return undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function readPackageScripts(cwd) {
+    try {
+        const pkgPath = path.join(cwd, 'package.json');
+        if (!existsSync(pkgPath))
+            return undefined;
+        const raw = readFileSync(pkgPath, 'utf8');
+        const parsed = JSON.parse(raw);
+        return parsed.scripts;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * WU-2927: build gate applicability — only when the local-prep profile opts in
+ * (`local_prep.build.enabled = true`). Default false → not-applicable.
+ */
+export function checkBuildApplicability(ctx) {
+    const cwd = ctx.cwd ?? process.cwd();
+    const lp = readLocalPrepConfig(cwd);
+    return Promise.resolve(lp?.build?.enabled === true ? 'applicable' : 'not-applicable');
+}
+/**
+ * WU-2927: build gate preconditions — `build` script must exist in
+ * package.json. With `prereq_strategy: 'fail'` a missing script is treated as
+ * a misconfiguration, not an environmental gap.
+ */
+export function checkBuildPreconditions(ctx) {
+    const cwd = ctx.cwd ?? process.cwd();
+    const scripts = readPackageScripts(cwd);
+    return scripts && Object.prototype.hasOwnProperty.call(scripts, SCRIPTS.BUILD)
+        ? 'satisfied'
+        : 'missing';
+}
+/**
+ * WU-2927: integration-test gate applicability — opt-in via
+ * `local_prep.integration_test.enabled = true`. Replaces the pre-WU-2927
+ * conditional registration (gate-defaults.ts:209 / gates.ts:450/486) so that
+ * the gate is unconditionally registered and applicability is the only knob.
+ */
+export function checkIntegrationTestApplicability(ctx) {
+    const cwd = ctx.cwd ?? process.cwd();
+    const lp = readLocalPrepConfig(cwd);
+    return Promise.resolve(lp?.integration_test?.enabled === true ? 'applicable' : 'not-applicable');
+}
+/**
+ * WU-2927: integration-test gate preconditions — `test:integration` script
+ * must exist. Same fail-on-missing semantics as build (misconfig).
+ */
+export function checkIntegrationTestPreconditions(ctx) {
+    const cwd = ctx.cwd ?? process.cwd();
+    const scripts = readPackageScripts(cwd);
+    return scripts && Object.prototype.hasOwnProperty.call(scripts, SCRIPTS.TEST_INTEGRATION)
+        ? 'satisfied'
+        : 'missing';
+}
+/**
+ * WU-2927: e2e-smoke gate applicability — applicable iff
+ *   (a) `local_prep.e2e_smoke.enabled = true`, AND
+ *   (b) `playwright.config.{ts,js,mjs}` exists at repo root.
+ *
+ * Per stated policy: the absence of a Playwright config is a clean opt-out,
+ * not a missing precondition (no explicit disable required for repos that do
+ * not use Playwright).
+ */
+export function checkE2eSmokeApplicability(ctx) {
+    const cwd = ctx.cwd ?? process.cwd();
+    const lp = readLocalPrepConfig(cwd);
+    if (lp?.e2e_smoke?.enabled !== true)
+        return Promise.resolve('not-applicable');
+    for (const ext of ['ts', 'js', 'mjs']) {
+        if (existsSync(path.join(cwd, `playwright.config.${ext}`))) {
+            return Promise.resolve('applicable');
+        }
+    }
+    return Promise.resolve('not-applicable');
+}
+/**
+ * WU-2927: e2e-smoke gate preconditions — once applicable (Playwright config
+ * present + opted in), the `test:e2e` script must exist. Missing = misconfig
+ * → 'failed' under `prereq_strategy: 'fail'`.
+ */
+export function checkE2eSmokePreconditions(ctx) {
+    const cwd = ctx.cwd ?? process.cwd();
+    const scripts = readPackageScripts(cwd);
+    return scripts && Object.prototype.hasOwnProperty.call(scripts, SCRIPTS.TEST_E2E)
+        ? 'satisfied'
+        : 'missing';
+}
+/**
+ * WU-2927: Read the configured e2e_smoke.tag (default 'smoke').
+ */
+export function getE2eSmokeTag(cwd) {
+    const lp = readLocalPrepConfig(cwd);
+    const tag = lp?.e2e_smoke?.tag;
+    return typeof tag === 'string' && tag.length > 0 ? tag : 'smoke';
+}
+/**
+ * WU-2927: Read the configured latency_budget_warn_ms (default 180_000).
+ */
+export function getLocalPrepLatencyBudgetMs(cwd) {
+    const lp = readLocalPrepConfig(cwd);
+    const budget = lp?.latency_budget_warn_ms;
+    return typeof budget === 'number' && budget >= 0 ? budget : 180_000;
+}
+/**
+ * WU-2927: Run the opt-in build gate (`pnpm build`). Wraps SCRIPTS.BUILD.
+ */
+export async function runBuildGate({ agentLog, cwd, }) {
+    const start = Date.now();
+    const logLine = (line) => {
+        if (!agentLog) {
+            console.log(line);
+            return;
+        }
+        writeSync(agentLog.logFd, `${line}\n`);
+    };
+    try {
+        logLine('\n> Build gate (local_prep)\n');
+        const result = await run(pnpmRun(SCRIPTS.BUILD), { agentLog, cwd });
+        return { ok: result.ok, duration: Date.now() - start };
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        logLine(`⚠️  Build gate failed: ${message}`);
+        return { ok: false, duration: Date.now() - start };
+    }
+}
+/**
+ * WU-2927: Run the opt-in e2e-smoke gate. Executes
+ *   `pnpm test:e2e --tag <local_prep.e2e_smoke.tag>` (default tag 'smoke').
+ */
+export async function runE2eSmokeGate({ agentLog, cwd, }) {
+    const start = Date.now();
+    const logLine = (line) => {
+        if (!agentLog) {
+            console.log(line);
+            return;
+        }
+        writeSync(agentLog.logFd, `${line}\n`);
+    };
+    try {
+        const tag = getE2eSmokeTag(cwd);
+        logLine(`\n> E2E smoke gate (local_prep, tag=${tag})\n`);
+        const result = await run(pnpmRun(SCRIPTS.TEST_E2E, '--tag', tag), { agentLog, cwd });
+        return { ok: result.ok, duration: Date.now() - start };
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        logLine(`⚠️  E2E smoke gate failed: ${message}`);
+        return { ok: false, duration: Date.now() - start };
+    }
+}
 // ── Co-change gate ────────────────────────────────────────────────────
 const CoChangeRulesConfigSchema = CoChangeRuleConfigSchema.array();
 const ConditionalCommandsConfigSchema = ConditionalCommandConfigSchema.array();
@@ -610,6 +787,38 @@ export function getMatchingCoChangeRulesForPaths(options) {
 export function shouldRunMigrationVerifyForChanges(options) {
     return hasPatternMatch(options.changedFiles, [...DEFAULT_MIGRATION_VERIFY_PATTERNS]);
 }
+async function isDbImpactingDisabledForCurrentWU(cwd) {
+    const wuId = (await detectCurrentWUForCwd(cwd)) ?? findSingleWuIdInWuDirectory(cwd);
+    if (!wuId) {
+        return false;
+    }
+    try {
+        const wuPaths = createWuPaths({ projectRoot: cwd });
+        const wuPath = path.join(cwd, wuPaths.WU(wuId));
+        const wu = readWU(wuPath, wuId);
+        return wu[WU_DB_IMPACTING_FIELD] === false;
+    }
+    catch {
+        return false;
+    }
+}
+function findSingleWuIdInWuDirectory(cwd) {
+    try {
+        const wuPaths = createWuPaths({ projectRoot: cwd });
+        const wuDir = path.join(cwd, wuPaths.WU_DIR());
+        if (!existsSync(wuDir)) {
+            return null;
+        }
+        const wuFiles = readdirSync(wuDir).filter((entry) => entry.endsWith(WU_YAML_EXTENSION));
+        if (wuFiles.length !== 1) {
+            return null;
+        }
+        return path.basename(wuFiles[0], WU_YAML_EXTENSION);
+    }
+    catch {
+        return null;
+    }
+}
 function resolveConditionalCommandGuidanceRefs(commands, projectRoot, logWarning) {
     return commands.map((command) => {
         if (!command.guidance_ref) {
@@ -753,6 +962,10 @@ export async function runMigrationVerifyGate({ agentLog, useAgentMode, cwd }) {
         logLine('ℹ️  No changed files detected; skipping migration verification.');
         return { ok: true, duration: Date.now() - start };
     }
+    if (await isDbImpactingDisabledForCurrentWU(effectiveCwd)) {
+        logLine('ℹ️  WU declares db_impacting:false; skipping migration verification.');
+        return { ok: true, duration: Date.now() - start };
+    }
     const conditionalCommands = getResolvedConditionalCommands(effectiveCwd, (msg) => logLine(`⚠️  ${msg}`));
     const matchingConditionalCommands = getMatchingConditionalCommandsForPaths({
         filePaths: changedFiles,
@@ -1099,4 +1312,190 @@ export async function runDocsOnlyFilteredTests({ packages, agentLog, cwd = proce
     const result = await run(filteredCmd, { agentLog });
     return { ok: result.ok, duration: Date.now() - start };
 }
+// ── WU-2926: Per-gate applicability + precondition helpers ─────────────
+/**
+ * WU-2926: Test whether any changed file matches one of the
+ * `applicability_paths` patterns. Returns `true` (applicable) when the override
+ * is undefined or empty so safety-critical-test preserves today's "always
+ * runs" behaviour at gate-defaults.ts:195.
+ */
+export function applicabilityPathsMatch(input) {
+    const { applicabilityPaths } = input;
+    if (!applicabilityPaths || applicabilityPaths.length === 0) {
+        // Default applicable — preserves backward-compat (no override, no narrowing).
+        return true;
+    }
+    return micromatch.isMatch.length >= 0
+        ? input.changedFiles.some((file) => micromatch.isMatch(file, applicabilityPaths))
+        : false;
+}
+/**
+ * WU-2926: Default safety-critical applicability check.
+ *
+ * Backward-compat preservation (load-bearing): with no per-repo
+ * `applicability_paths` override, returns 'applicable' for every change set —
+ * matching the always-runs behaviour at gate-defaults.ts:195 and
+ * gates-runners.ts:743 (runSafetyCriticalTests).
+ *
+ * With an override (e.g. `['app/security/**', 'lib/auth/**']`), returns
+ * 'applicable' only when at least one changed file matches.
+ */
+export async function checkSafetyCriticalApplicability(input) {
+    // Resolve applicability_paths: explicit input wins; else read from
+    // software_delivery.gates.overrides.safety-critical-test.applicability_paths.
+    let paths = input.applicabilityPaths;
+    if (paths === undefined) {
+        paths = readApplicabilityPathsOverride('safety-critical-test', input.cwd ?? process.cwd());
+    }
+    if (!paths || paths.length === 0) {
+        return 'applicable';
+    }
+    let files = input.changedFiles;
+    if (!files) {
+        try {
+            const git = createGitForPath(input.cwd ?? process.cwd());
+            files = await getChangedFilesForIncremental({ git });
+        }
+        catch {
+            files = [];
+        }
+    }
+    return applicabilityPathsMatch({ changedFiles: files, applicabilityPaths: paths })
+        ? 'applicable'
+        : 'not-applicable';
+}
+/**
+ * WU-2926: Read `software_delivery.gates.overrides.<gate_id>.applicability_paths`
+ * from workspace.yaml. Returns undefined when no override is set so callers
+ * can fall through to default-applicable behaviour.
+ */
+function readApplicabilityPathsOverride(gateId, cwd) {
+    try {
+        const required = require;
+        const cfgMod = required('@lumenflow/core/config');
+        if (!cfgMod || typeof cfgMod.getConfig !== 'function')
+            return undefined;
+        const cfg = cfgMod.getConfig();
+        const sd = cfg &&
+            cfg.software_delivery;
+        const gates = sd?.gates;
+        const overrides = gates?.overrides;
+        const entry = overrides?.[gateId];
+        const ap = entry?.applicability_paths;
+        if (Array.isArray(ap) && ap.every((s) => typeof s === 'string')) {
+            return ap;
+        }
+        return undefined;
+    }
+    catch {
+        void cwd;
+        return undefined;
+    }
+}
+/**
+ * WU-2926: migration-verify applicability — only when migrations/.sql or
+ * schema files have changed.
+ */
+export async function checkMigrationVerifyApplicability(ctx) {
+    try {
+        if (await isDbImpactingDisabledForCurrentWU(ctx.cwd ?? process.cwd())) {
+            return 'not-applicable';
+        }
+        const git = createGitForPath(ctx.cwd ?? process.cwd());
+        const changed = await getChangedFilesForIncremental({ git });
+        return shouldRunMigrationVerifyForChanges({ changedFiles: changed })
+            ? 'applicable'
+            : 'not-applicable';
+    }
+    catch {
+        return 'not-applicable';
+    }
+}
+/**
+ * WU-2926: migration-verify preconditions — DATABASE_URL set OR PGlite available.
+ *
+ * PGlite presence is approximated by node_modules/@electric-sql/pglite, the
+ * canonical package the migration toolchain uses for in-process Postgres in
+ * agent worktrees.
+ */
+export function checkMigrationVerifyPreconditions(ctx) {
+    if (process.env.DATABASE_URL && process.env.DATABASE_URL.trim().length > 0) {
+        return Promise.resolve('satisfied');
+    }
+    const cwd = ctx.cwd ?? process.cwd();
+    const pgliteDir = path.join(cwd, 'node_modules', '@electric-sql', 'pglite');
+    return Promise.resolve(existsSync(pgliteDir) ? 'satisfied' : 'missing');
+}
+/**
+ * WU-2926: invariants gate — always applicable; preconditions satisfied when
+ * an invariants config is present (best-effort detection at standard paths).
+ */
+export function checkInvariantsPreconditions(ctx) {
+    const cwd = ctx.cwd ?? process.cwd();
+    const candidates = [
+        'invariants.yaml',
+        'invariants.yml',
+        '.lumenflow/invariants.yaml',
+        `${DOCS_LAYOUT_PRESETS.arc42.operations}/_frameworks/lumenflow/invariants.yaml`,
+    ];
+    for (const rel of candidates) {
+        if (existsSync(path.join(cwd, rel)))
+            return Promise.resolve('satisfied');
+    }
+    // Fallback: invariants runner has internal defaults (the existing gate
+    // already runs without explicit config). Return 'satisfied' to preserve
+    // today's behaviour.
+    return Promise.resolve('satisfied');
+}
+/**
+ * WU-2926: lane-health applicability — only when `.lumenflow/state/lane-state.json`
+ * exists. Preconditions = state path is writable.
+ */
+export function checkLaneHealthApplicability(ctx) {
+    const cwd = ctx.cwd ?? process.cwd();
+    return Promise.resolve(existsSync(path.join(cwd, '.lumenflow', 'state', 'lane-state.json'))
+        ? 'applicable'
+        : 'not-applicable');
+}
+export async function checkLaneHealthPreconditions(ctx) {
+    const cwd = ctx.cwd ?? process.cwd();
+    const stateDir = path.join(cwd, '.lumenflow', 'state');
+    try {
+        await access(stateDir);
+        return 'satisfied';
+    }
+    catch {
+        return 'missing';
+    }
+}
+/**
+ * WU-2926: co-change applicability — only when workspace.yaml has co-change
+ * rules (otherwise the gate has nothing to evaluate).
+ */
+export function checkCoChangeApplicability(ctx) {
+    const cwd = ctx.cwd ?? process.cwd();
+    try {
+        const section = getGatesSection(cwd);
+        const rules = section?.co_change?.rules;
+        return Promise.resolve(Array.isArray(rules) && rules.length > 0 ? 'applicable' : 'not-applicable');
+    }
+    catch {
+        return Promise.resolve('not-applicable');
+    }
+}
+/**
+ * WU-2926: claim-validation applicability — only when a claimed WU YAML
+ * exists for the current worktree. Without a claim, the gate has nothing to
+ * validate.
+ */
+export async function checkClaimValidationApplicability(ctx) {
+    const cwd = ctx.cwd ?? process.cwd();
+    try {
+        const wuId = await detectCurrentWUForCwd(cwd);
+        return wuId ? 'applicable' : 'not-applicable';
+    }
+    catch {
+        return 'not-applicable';
+    }
+}
 //# sourceMappingURL=gates-runners.js.map