@lumenflow/core 3.1.3 → 3.2.1

package/dist/git-staged-validator.js

@@ -0,0 +1,52 @@
+// Copyright (c) 2026 Hellmai Ltd
+// SPDX-License-Identifier: AGPL-3.0-only
+import { getGitForCwd } from './git-adapter.js';
+import { die } from './error-handler.js';
+/**
+ * Git Staged Files Validator
+ *
+ * Centralized validation for staged files requirement.
+ * Extracted from duplicate implementations in wu-block and wu-unblock (WU-1341).
+ *
+ * Used in --no-auto mode to enforce that required files are staged before commit.
+ *
+ * @module git-staged-validator
+ */
+/**
+ * Ensure all required paths are staged in git index
+ *
+ * Validates that specified files/directories are staged for commit.
+ * Supports exact path matching and directory prefix matching.
+ *
+ * @param {Array<string|null|undefined>} paths - Paths to check (null/undefined values filtered out)
+ * @throws {Error} If UnsafeAny required paths are not staged
+ * @returns {Array<string>} List of all staged files
+ *
+ * @example
+ * // All files staged - success
+ * ensureStaged(['docs/file.md', 'tools/script.js']);
+ *
+ * // Directory prefix - matches all files under directory
+ * ensureStaged(['docs/04-operations/']);
+ *
+ * // Missing files - throws error
+ * ensureStaged(['docs/file1.md', 'docs/file2.md']);
+ * // Error: Stage updates for: docs/file2.md
+ */
+export function ensureStaged(paths) {
+    const git = getGitForCwd();
+    const raw = git.run('git diff --cached --name-only');
+    const staged = raw ? raw.split(/\r?\n/).filter((s) => Boolean(s)) : [];
+    // Filter out null/undefined and check each path
+    const normalizedPaths = paths.filter((p) => typeof p === 'string' && p.length > 0);
+    const missing = normalizedPaths.filter((p) => {
+        // Normalize path: remove trailing slash for directory checks
+        const pathToCheck = p.endsWith('/') ? p.slice(0, -1) : p;
+        return !staged.some((name) => name === pathToCheck || name.startsWith(`${pathToCheck}/`));
+    });
+    if (missing.length) {
+        die(`Stage updates for: ${missing.join(', ')}`);
+    }
+    return staged;
+}
+//# sourceMappingURL=git-staged-validator.js.map

package/dist/git-staged-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-staged-validator.js","sourceRoot":"","sources":["../src/git-staged-validator.ts"],"names":[],"mappings":"AAAA,iCAAiC;AACjC,yCAAyC;AAEzC,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AAEzC;;;;;;;;;GASG;AAEH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,YAAY,CAAC,KAAuC;IAClE,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,+BAA+B,CAAW,CAAC;IAC/D,MAAM,MAAM,GAAa,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAE9F,gDAAgD;IAChD,MAAM,eAAe,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAChG,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAC3C,6DAA6D;QAC7D,MAAM,WAAW,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzD,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,WAAW,GAAG,CAAC,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;IAEH,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,GAAG,CAAC,sBAAsB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/hardcoded-strings.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Hardcoded String Detection Module
+ *
+ * Provides classification of hardcoded path strings to distinguish between:
+ * - Route paths (API endpoints, webhooks, etc.) - should use endpoint constants
+ * - Filesystem paths (absolute paths, config files) - should use path.join()
+ *
+ * This enables Gate 13 to provide accurate, actionable remediation messages.
+ *
+ * @see WU-1788 - Improve hardcoded-string gate messaging for route paths
+ */
+/**
+ * Path type constants
+ * @type {Object}
+ */
+export declare const PATH_TYPES: Readonly<{
+    ROUTE: "route";
+    FILESYSTEM: "filesystem";
+    UNKNOWN: "unknown";
+}>;
+/**
+ * Classify a path string as route, filesystem, or unknown
+ *
+ * @param {string} pathStr - The path string to classify
+ * @returns {string} One of PATH_TYPES values
+ */
+export declare function classifyPath(pathStr: UnsafeAny): "unknown" | "route" | "filesystem";
+/**
+ * Get the appropriate remediation message for a path type
+ *
+ * @param {string} pathType - One of PATH_TYPES values
+ * @returns {string} Remediation message
+ */
+export declare function getRemediation(pathType: UnsafeAny): "Route path - use an endpoint constant or config (e.g., API_ENDPOINT, API_ROUTES.ASSISTANT)" | "File path - use path.join() with constants" | "Path string - use a constant or configuration value";
+/**
+ * Options for hardcoded path violation detection
+ */
+export interface FindHardcodedPathViolationsOptions {
+    /** Whether this is a test file (skip detection) */
+    isTestFile?: boolean;
+    /** Whether this is a config file (skip detection) */
+    isConfigFile?: boolean;
+}
+/**
+ * Find hardcoded path violations in a line of code
+ *
+ * @param {string} line - The line of code to check
+ * @param {FindHardcodedPathViolationsOptions} options - Options for detection
+ * @returns {Array<{line: string, fix: string, pathType: string, path: string}>} Array of violations
+ */
+export declare function findHardcodedPathViolations(line: UnsafeAny, options?: FindHardcodedPathViolationsOptions): {
+    line: any;
+    fix: "Route path - use an endpoint constant or config (e.g., API_ENDPOINT, API_ROUTES.ASSISTANT)" | "File path - use path.join() with constants" | "Path string - use a constant or configuration value";
+    pathType: "unknown" | "route" | "filesystem";
+    path: string;
+}[];
+/**
+ * Legacy function for backwards compatibility with gates-pre-commit.ts
+ * Detects all hardcoded string patterns (not just paths)
+ *
+ * @deprecated Use findHardcodedPathViolations for path-specific detection
+ */
+export declare const HARDCODED_PATTERNS: {
+    pattern: RegExp;
+    message: string;
+}[];
+//# sourceMappingURL=hardcoded-strings.d.ts.map

package/dist/hardcoded-strings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hardcoded-strings.d.ts","sourceRoot":"","sources":["../src/hardcoded-strings.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;GAUG;AAEH;;;GAGG;AACH,eAAO,MAAM,UAAU;;;;EAIrB,CAAC;AAsGH;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,SAAS,sCA0C9C;AAYD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,SAAS,uMAUjD;AA6BD;;GAEG;AACH,MAAM,WAAW,kCAAkC;IACjD,mDAAmD;IACnD,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,qDAAqD;IACrD,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,SAAS,EACf,OAAO,GAAE,kCAAuC;;;;;IAgDjD;AAED;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB;;;GAa9B,CAAC"}

package/dist/hardcoded-strings.js

@@ -0,0 +1,276 @@
+// Copyright (c) 2026 Hellmai Ltd
+// SPDX-License-Identifier: AGPL-3.0-only
+/**
+ * Hardcoded String Detection Module
+ *
+ * Provides classification of hardcoded path strings to distinguish between:
+ * - Route paths (API endpoints, webhooks, etc.) - should use endpoint constants
+ * - Filesystem paths (absolute paths, config files) - should use path.join()
+ *
+ * This enables Gate 13 to provide accurate, actionable remediation messages.
+ *
+ * @see WU-1788 - Improve hardcoded-string gate messaging for route paths
+ */
+/**
+ * Path type constants
+ * @type {Object}
+ */
+export const PATH_TYPES = Object.freeze({
+    ROUTE: 'route',
+    FILESYSTEM: 'filesystem',
+    UNKNOWN: 'unknown',
+});
+/**
+ * Route path prefixes that indicate API/web endpoints
+ * These should use endpoint constants, not path.join()
+ */
+const ROUTE_PREFIXES = [
+    '/api/',
+    '/api?', // API with query params
+    '/auth/',
+    '/v1/',
+    '/v2/',
+    '/v3/',
+    '/graphql',
+    '/webhook/',
+    '/webhooks/',
+    '/trpc/',
+    '/rest/',
+    '/rpc/',
+];
+/**
+ * Filesystem path prefixes that indicate absolute paths
+ * These should use path.join() with constants
+ */
+const FILESYSTEM_PREFIXES = [
+    '/' + 'home/',
+    '/usr/',
+    '/etc/',
+    '/var/',
+    '/tmp/',
+    '/opt/',
+    '/bin/',
+    '/sbin/',
+    '/lib/',
+    '/proc/',
+    '/sys/',
+    '/dev/',
+    '/mnt/',
+    '/media/',
+    '/srv/',
+    '/root/',
+];
+/**
+ * Common file extensions that indicate filesystem paths
+ */
+const FILE_EXTENSIONS = [
+    '.json',
+    '.yaml',
+    '.yml',
+    '.xml',
+    '.conf',
+    '.config',
+    '.cfg',
+    '.ini',
+    '.env',
+    '.log',
+    '.txt',
+    '.md',
+    '.csv',
+    '.tsv',
+    '.sql',
+    '.sh',
+    '.bash',
+    '.zsh',
+    '.py',
+    '.rb',
+    '.pl',
+    '.js',
+    '.ts',
+    '.jsx',
+    '.tsx',
+    '.js',
+    '.cjs',
+    '.png',
+    '.jpg',
+    '.jpeg',
+    '.gif',
+    '.svg',
+    '.ico',
+    '.pdf',
+    '.doc',
+    '.docx',
+    '.xls',
+    '.xlsx',
+    '.pem',
+    '.key',
+    '.crt',
+    '.cer',
+];
+/**
+ * Patterns that indicate filesystem paths
+ */
+const FILESYSTEM_PATTERNS = [
+    /^[A-Z]:[/\\]/, // Windows drive letter (C:\, D:/)
+    /node_modules/, // Node.js modules directory
+    /\.\.\//, // Relative path traversal
+    /~\//, // Home directory shorthand
+];
+/**
+ * Classify a path string as route, filesystem, or unknown
+ *
+ * @param {string} pathStr - The path string to classify
+ * @returns {string} One of PATH_TYPES values
+ */
+export function classifyPath(pathStr) {
+    if (!pathStr || pathStr === '/') {
+        return PATH_TYPES.UNKNOWN;
+    }
+    const normalizedPath = pathStr.toLowerCase();
+    // Check for route path indicators first (more specific)
+    for (const prefix of ROUTE_PREFIXES) {
+        if (normalizedPath.startsWith(prefix) || normalizedPath.includes(prefix)) {
+            return PATH_TYPES.ROUTE;
+        }
+    }
+    // Check for query parameters (indicates a route/URL)
+    if (pathStr.includes('?') && pathStr.startsWith('/')) {
+        return PATH_TYPES.ROUTE;
+    }
+    // Check for filesystem path prefixes
+    for (const prefix of FILESYSTEM_PREFIXES) {
+        if (normalizedPath.startsWith(prefix)) {
+            return PATH_TYPES.FILESYSTEM;
+        }
+    }
+    // Check for file extensions
+    for (const ext of FILE_EXTENSIONS) {
+        if (normalizedPath.endsWith(ext)) {
+            return PATH_TYPES.FILESYSTEM;
+        }
+    }
+    // Check for filesystem patterns
+    for (const pattern of FILESYSTEM_PATTERNS) {
+        if (pattern.test(pathStr)) {
+            return PATH_TYPES.FILESYSTEM;
+        }
+    }
+    // Default to unknown for ambiguous paths
+    return PATH_TYPES.UNKNOWN;
+}
+/**
+ * Remediation messages for each path type
+ */
+const REMEDIATION_MESSAGES = Object.freeze({
+    [PATH_TYPES.ROUTE]: 'Route path - use an endpoint constant or config (e.g., API_ENDPOINT, API_ROUTES.ASSISTANT)',
+    [PATH_TYPES.FILESYSTEM]: 'File path - use path.join() with constants',
+    [PATH_TYPES.UNKNOWN]: 'Path string - use a constant or configuration value',
+});
+/**
+ * Get the appropriate remediation message for a path type
+ *
+ * @param {string} pathType - One of PATH_TYPES values
+ * @returns {string} Remediation message
+ */
+export function getRemediation(pathType) {
+    // Validate pathType to prevent object injection
+    const validTypes = Object.values(PATH_TYPES);
+    if (validTypes.includes(pathType)) {
+        // eslint-disable-next-line security/detect-object-injection -- Safe: pathType validated against known values above
+        return REMEDIATION_MESSAGES[pathType];
+    }
+    return REMEDIATION_MESSAGES[PATH_TYPES.UNKNOWN];
+}
+/**
+ * Pattern to match path-like strings in code
+ * Matches quoted strings that:
+ * - Start with /
+ * - Have at least one path segment after the initial /
+ * - May include alphanumeric characters, underscores, hyphens, dots
+ * - May include query parameters
+ *
+ * Note: Uses non-greedy quantifiers and avoids nested quantifiers to prevent ReDoS
+ */
+// eslint-disable-next-line security/detect-unsafe-regex -- Intentionally simplified pattern, not user-controlled
+const PATH_PATTERN = /['"](\/[\w./-]+(?:\?[^'"]*)?)['"]/gi;
+/**
+ * Check if a line contains a constant definition (SCREAMING_SNAKE_CASE)
+ *
+ * @param {string} line - The line to check
+ * @returns {boolean} True if line defines a constant
+ */
+function isConstantDefinition(line) {
+    if (!line.includes('const '))
+        return false;
+    const afterConst = line.split('const ')[1];
+    if (!afterConst)
+        return false;
+    const identifier = afterConst.trim().split(/[\s=]/)[0];
+    return identifier && identifier === identifier.toUpperCase() && identifier.length > 1;
+}
+/**
+ * Find hardcoded path violations in a line of code
+ *
+ * @param {string} line - The line of code to check
+ * @param {FindHardcodedPathViolationsOptions} options - Options for detection
+ * @returns {Array<{line: string, fix: string, pathType: string, path: string}>} Array of violations
+ */
+export function findHardcodedPathViolations(line, options = {}) {
+    const { isTestFile = false, isConfigFile = false } = options;
+    // Skip test files and config files
+    if (isTestFile || isConfigFile) {
+        return [];
+    }
+    // Skip constant definitions (they ARE the constants we want people to create)
+    if (isConstantDefinition(line)) {
+        return [];
+    }
+    // Skip lines that look like test context
+    if (line.includes('.test.') || line.includes('.spec.')) {
+        return [];
+    }
+    const violations = [];
+    let match;
+    // Reset regex lastIndex for global matching
+    PATH_PATTERN.lastIndex = 0;
+    while ((match = PATH_PATTERN.exec(line)) !== null) {
+        const pathStr = match[1];
+        if (!pathStr) {
+            continue;
+        }
+        // Only flag paths that start with /
+        if (!pathStr.startsWith('/')) {
+            continue;
+        }
+        const pathType = classifyPath(pathStr);
+        const remediation = getRemediation(pathType);
+        violations.push({
+            line: line.substring(0, 80),
+            fix: remediation,
+            pathType,
+            path: pathStr,
+        });
+    }
+    return violations;
+}
+/**
+ * Legacy function for backwards compatibility with gates-pre-commit.ts
+ * Detects all hardcoded string patterns (not just paths)
+ *
+ * @deprecated Use findHardcodedPathViolations for path-specific detection
+ */
+export const HARDCODED_PATTERNS = [
+    {
+        pattern: /['"]https?:\/\/[^'"]+\/api\//i,
+        message: 'API endpoint - use environment variable or config',
+    },
+    {
+        pattern: /throw new Error\s*\(\s*['"][^'"]{50,}['"]\s*\)/i,
+        message: 'Long error message - use error constants',
+    },
+    // WU-1788: Path pattern now uses classifier for accurate messages
+    // The old pattern is replaced by findHardcodedPathViolations
+    { pattern: /['"]#[0-9a-fA-F]{6}['"]/i, message: 'Color value - use theme/design tokens' },
+    { pattern: /if\s*\(\s*['"]feature_/i, message: 'Feature flag - use feature flag service' },
+];
+//# sourceMappingURL=hardcoded-strings.js.map

package/dist/hardcoded-strings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hardcoded-strings.js","sourceRoot":"","sources":["../src/hardcoded-strings.ts"],"names":[],"mappings":"AAAA,iCAAiC;AACjC,yCAAyC;AAEzC;;;;;;;;;;GAUG;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;IACtC,KAAK,EAAE,OAAO;IACd,UAAU,EAAE,YAAY;IACxB,OAAO,EAAE,SAAS;CACnB,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,cAAc,GAAG;IACrB,OAAO;IACP,OAAO,EAAE,wBAAwB;IACjC,QAAQ;IACR,MAAM;IACN,MAAM;IACN,MAAM;IACN,UAAU;IACV,WAAW;IACX,YAAY;IACZ,QAAQ;IACR,QAAQ;IACR,OAAO;CACR,CAAC;AAEF;;;GAGG;AACH,MAAM,mBAAmB,GAAG;IAC1B,GAAG,GAAG,OAAO;IACb,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,OAAO;IACP,OAAO;IACP,OAAO;IACP,SAAS;IACT,OAAO;IACP,QAAQ;CACT,CAAC;AAEF;;GAEG;AACH,MAAM,eAAe,GAAG;IACtB,OAAO;IACP,OAAO;IACP,MAAM;IACN,MAAM;IACN,OAAO;IACP,SAAS;IACT,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,KAAK;IACL,OAAO;IACP,MAAM;IACN,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,KAAK;IACL,MAAM;IACN,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;CACP,CAAC;AAEF;;GAEG;AACH,MAAM,mBAAmB,GAAG;IAC1B,cAAc,EAAE,kCAAkC;IAClD,cAAc,EAAE,4BAA4B;IAC5C,QAAQ,EAAE,0BAA0B;IACpC,KAAK,EAAE,2BAA2B;CACnC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,OAAkB;IAC7C,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;QAChC,OAAO,UAAU,CAAC,OAAO,CAAC;IAC5B,CAAC;IAED,MAAM,cAAc,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAE7C,wDAAwD;IACxD,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;QACpC,IAAI,cAAc,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACzE,OAAO,UAAU,CAAC,KAAK,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,qDAAqD;IACrD,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrD,OAAO,UAAU,CAAC,KAAK,CAAC;IAC1B,CAAC;IAED,qCAAqC;IACrC,KAAK,MAAM,MAAM,IAAI,mBAAmB,EAAE,CAAC;QACzC,IAAI,cAAc,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACtC,OAAO,UAAU,CAAC,UAAU,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,4BAA4B;IAC5B,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QAClC,IAAI,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,OAAO,UAAU,CAAC,UAAU,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,gCAAgC;IAChC,KAAK,MAAM,OAAO,IAAI,mBAAmB,EAAE,CAAC;QAC1C,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1B,OAAO,UAAU,CAAC,UAAU,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,yCAAyC;IACzC,OAAO,UAAU,CAAC,OAAO,CAAC;AAC5B,CAAC;AAED;;GAEG;AACH,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC;IACzC,CAAC,UAAU,CAAC,KAAK,CAAC,EAChB,4FAA4F;IAC9F,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,4CAA4C;IACrE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,qDAAqD;CAC5E,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,QAAmB;IAChD,gDAAgD;IAChD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAE1C,CAAC;IACF,IAAI,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,mHAAmH;QACnH,OAAO,oBAAoB,CAAC,QAA6C,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,oBAAoB,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;;;GASG;AACH,iHAAiH;AACjH,MAAM,YAAY,GAAG,qCAAqC,CAAC;AAE3D;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,IAAe;IAC3C,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9B,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,OAAO,UAAU,IAAI,UAAU,KAAK,UAAU,CAAC,WAAW,EAAE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;AACxF,CAAC;AAYD;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CACzC,IAAe,EACf,UAA8C,EAAE;IAEhD,MAAM,EAAE,UAAU,GAAG,KAAK,EAAE,YAAY,GAAG,KAAK,EAAE,GAAG,OAAO,CAAC;IAE7D,mCAAmC;IACnC,IAAI,UAAU,IAAI,YAAY,EAAE,CAAC;QAC/B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,8EAA8E;IAC9E,IAAI,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,yCAAyC;IACzC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,UAAU,GAAG,EAAE,CAAC;IACtB,IAAI,KAAK,CAAC;IAEV,4CAA4C;IAC5C,YAAY,CAAC,SAAS,GAAG,CAAC,CAAC;IAE3B,OAAO,CAAC,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAClD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,SAAS;QACX,CAAC;QAED,oCAAoC;QACpC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,WAAW,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;QAE7C,UAAU,CAAC,IAAI,CAAC;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC;YAC3B,GAAG,EAAE,WAAW;YAChB,QAAQ;YACR,IAAI,EAAE,OAAO;SACd,CAAC,CAAC;IACL,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC;QACE,OAAO,EAAE,+BAA+B;QACxC,OAAO,EAAE,mDAAmD;KAC7D;IACD;QACE,OAAO,EAAE,iDAAiD;QAC1D,OAAO,EAAE,0CAA0C;KACpD;IACD,kEAAkE;IAClE,6DAA6D;IAC7D,EAAE,OAAO,EAAE,0BAA0B,EAAE,OAAO,EAAE,uCAAuC,EAAE;IACzF,EAAE,OAAO,EAAE,yBAAyB,EAAE,OAAO,EAAE,yCAAyC,EAAE;CAC3F,CAAC"}

package/dist/incremental-lint.d.ts

@@ -0,0 +1,71 @@
+/**
+ * File extensions that should be linted by ESLint
+ * @type {string[]}
+ */
+export declare const LINTABLE_EXTENSIONS: string[];
+/**
+ * Check if a file path should be linted
+ * @param {string} filePath - File path to check
+ * @returns {boolean} True if file should be linted
+ */
+export declare function isLintableFile(filePath: UnsafeAny): boolean;
+/**
+ * Git adapter interface for testing
+ */
+interface GitAdapter {
+    mergeBase: (ref1: string, ref2: string) => Promise<string>;
+    raw: (args: string[]) => Promise<string>;
+}
+/**
+ * Options for getting changed lintable files
+ */
+export interface GetChangedLintableFilesOptions {
+    /** GitAdapter instance (for testing) */
+    git?: GitAdapter;
+    /** Base branch to compare against */
+    baseBranch?: string;
+    /** Optional path prefix to filter files */
+    filterPath?: string;
+}
+/**
+ * Get list of changed files that should be linted
+ * Includes:
+ * - Committed changes since branching from main (git diff merge-base...HEAD)
+ * - Modified but unstaged files (git diff --name-only)
+ * - Untracked files (git ls-files --others --exclude-standard)
+ *
+ * WU-1784: Extended to include untracked and unstaged files to prevent
+ * lint gaps when gates are run before staging/committing changes.
+ *
+ * @param {GetChangedLintableFilesOptions} [options] - Options
+ * @returns {Promise<string[]>} List of file paths to lint
+ *
+ * @example
+ * // Get all changed lintable files
+ * const files = await getChangedLintableFiles();
+ *
+ * @example
+ * // Get only files in apps/web/
+ * const files = await getChangedLintableFiles({ filterPath: 'apps/web/' });
+ */
+export declare function getChangedLintableFiles(options?: GetChangedLintableFilesOptions): Promise<any[]>;
+/**
+ * Convert repo-relative file paths to package-relative paths
+ *
+ * WU-2571: ESLint runs from package directory (e.g., apps/web/) where
+ * repo-relative paths (e.g., apps/web/src/file.ts) don't exist.
+ * This function strips the package prefix to produce paths that
+ * work correctly when ESLint is run from the package directory.
+ *
+ * @param {string[]} repoRelativePaths - Paths relative to repo root (e.g., ['apps/web/src/app.ts'])
+ * @param {string} packagePrefix - Package directory prefix (e.g., 'apps/web/' or 'apps/web')
+ * @returns {string[]} Paths relative to package directory (e.g., ['src/app.ts'])
+ *
+ * @example
+ * const repoRelative = ['apps/web/src/app.ts', 'apps/web/src/lib.tsx'];
+ * const packageRelative = convertToPackageRelativePaths(repoRelative, 'apps/web/');
+ * // Returns: ['src/app.ts', 'src/lib.tsx']
+ */
+export declare function convertToPackageRelativePaths(repoRelativePaths: UnsafeAny, packagePrefix: UnsafeAny): any;
+export {};
+//# sourceMappingURL=incremental-lint.d.ts.map

package/dist/incremental-lint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"incremental-lint.d.ts","sourceRoot":"","sources":["../src/incremental-lint.ts"],"names":[],"mappings":"AAeA;;;GAGG;AACH,eAAO,MAAM,mBAAmB,UAAwC,CAAC;AAkBzE;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,SAAS,WAgBjD;AAcD;;GAEG;AACH,UAAU,UAAU;IAClB,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3D,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC1C;AAED;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC7C,wCAAwC;IACxC,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,qCAAqC;IACrC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2CAA2C;IAC3C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,GAAE,8BAAmC,kBA8BzF;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,6BAA6B,CAC3C,iBAAiB,EAAE,SAAS,EAC5B,aAAa,EAAE,SAAS,OAQzB"}

package/dist/incremental-lint.js

@@ -0,0 +1,132 @@
+// Copyright (c) 2026 Hellmai Ltd
+// SPDX-License-Identifier: AGPL-3.0-only
+/**
+ * @file incremental-lint.ts
+ * @description Incremental linting utilities for gates
+ * WU-1304: Optimise ESLint gates performance
+ *
+ * Provides utilities to determine which files need linting based on
+ * changes since branching from main, enabling faster gate execution.
+ */
+import { getGitForCwd } from './git-adapter.js';
+import { STRING_LITERALS } from './wu-constants.js';
+/**
+ * File extensions that should be linted by ESLint
+ * @type {string[]}
+ */
+export const LINTABLE_EXTENSIONS = ['.ts', '.tsx', '.js', '.jsx', '.js'];
+/**
+ * Directory patterns that should be ignored
+ * Matches ESLint ignores in apps/web/eslint.config.ts
+ * @type {string[]}
+ */
+const IGNORED_DIRECTORIES = [
+    'node_modules/',
+    '.next/',
+    '.expo/',
+    'dist/',
+    'build/',
+    '.turbo/',
+    'coverage/',
+    'worktrees/',
+];
+/**
+ * Check if a file path should be linted
+ * @param {string} filePath - File path to check
+ * @returns {boolean} True if file should be linted
+ */
+export function isLintableFile(filePath) {
+    // Check if in ignored directory
+    for (const ignored of IGNORED_DIRECTORIES) {
+        if (filePath.includes(ignored)) {
+            return false;
+        }
+    }
+    // Check if has lintable extension
+    for (const ext of LINTABLE_EXTENSIONS) {
+        if (filePath.endsWith(ext)) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Parse git output into a list of file paths
+ * @param {string} output - Git command output
+ * @returns {string[]} List of file paths
+ */
+function parseGitFileList(output) {
+    return output
+        .split(STRING_LITERALS.NEWLINE)
+        .map((f) => f.trim())
+        .filter((f) => f.length > 0);
+}
+/**
+ * Get list of changed files that should be linted
+ * Includes:
+ * - Committed changes since branching from main (git diff merge-base...HEAD)
+ * - Modified but unstaged files (git diff --name-only)
+ * - Untracked files (git ls-files --others --exclude-standard)
+ *
+ * WU-1784: Extended to include untracked and unstaged files to prevent
+ * lint gaps when gates are run before staging/committing changes.
+ *
+ * @param {GetChangedLintableFilesOptions} [options] - Options
+ * @returns {Promise<string[]>} List of file paths to lint
+ *
+ * @example
+ * // Get all changed lintable files
+ * const files = await getChangedLintableFiles();
+ *
+ * @example
+ * // Get only files in apps/web/
+ * const files = await getChangedLintableFiles({ filterPath: 'apps/web/' });
+ */
+export async function getChangedLintableFiles(options = {}) {
+    const { git = getGitForCwd(), baseBranch = 'origin/main', filterPath } = options;
+    // Get the merge base (common ancestor) with the base branch
+    const mergeBase = await git.mergeBase('HEAD', baseBranch);
+    // 1. Get committed changes since the merge base
+    const committedOutput = await git.raw(['diff', '--name-only', `${mergeBase}...HEAD`]);
+    const committedFiles = parseGitFileList(committedOutput);
+    // 2. Get modified but unstaged files (WU-1784)
+    const unstagedOutput = await git.raw(['diff', '--name-only']);
+    const unstagedFiles = parseGitFileList(unstagedOutput);
+    // 3. Get untracked files (WU-1784)
+    const untrackedOutput = await git.raw(['ls-files', '--others', '--exclude-standard']);
+    const untrackedFiles = parseGitFileList(untrackedOutput);
+    // Combine all sources and deduplicate using Set
+    const allFiles = [...new Set([...committedFiles, ...unstagedFiles, ...untrackedFiles])];
+    // Filter to lintable files
+    let lintableFiles = allFiles.filter(isLintableFile);
+    // Apply path filter if specified
+    if (filterPath) {
+        lintableFiles = lintableFiles.filter((f) => f.startsWith(filterPath));
+    }
+    return lintableFiles;
+}
+/**
+ * Convert repo-relative file paths to package-relative paths
+ *
+ * WU-2571: ESLint runs from package directory (e.g., apps/web/) where
+ * repo-relative paths (e.g., apps/web/src/file.ts) don't exist.
+ * This function strips the package prefix to produce paths that
+ * work correctly when ESLint is run from the package directory.
+ *
+ * @param {string[]} repoRelativePaths - Paths relative to repo root (e.g., ['apps/web/src/app.ts'])
+ * @param {string} packagePrefix - Package directory prefix (e.g., 'apps/web/' or 'apps/web')
+ * @returns {string[]} Paths relative to package directory (e.g., ['src/app.ts'])
+ *
+ * @example
+ * const repoRelative = ['apps/web/src/app.ts', 'apps/web/src/lib.tsx'];
+ * const packageRelative = convertToPackageRelativePaths(repoRelative, 'apps/web/');
+ * // Returns: ['src/app.ts', 'src/lib.tsx']
+ */
+export function convertToPackageRelativePaths(repoRelativePaths, packagePrefix) {
+    // Normalize the prefix to ensure it ends with a slash
+    const normalizedPrefix = packagePrefix.endsWith('/') ? packagePrefix : `${packagePrefix}/`;
+    return repoRelativePaths
+        .filter((filePath) => filePath.startsWith(normalizedPrefix))
+        .map((filePath) => filePath.slice(normalizedPrefix.length));
+}
+//# sourceMappingURL=incremental-lint.js.map

package/dist/incremental-lint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"incremental-lint.js","sourceRoot":"","sources":["../src/incremental-lint.ts"],"names":[],"mappings":"AAAA,iCAAiC;AACjC,yCAAyC;AAEzC;;;;;;;GAOG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEpD;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AAEzE;;;;GAIG;AACH,MAAM,mBAAmB,GAAG;IAC1B,eAAe;IACf,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,SAAS;IACT,WAAW;IACX,YAAY;CACb,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,QAAmB;IAChD,gCAAgC;IAChC,KAAK,MAAM,OAAO,IAAI,mBAAmB,EAAE,CAAC;QAC1C,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,kCAAkC;IAClC,KAAK,MAAM,GAAG,IAAI,mBAAmB,EAAE,CAAC;QACtC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,MAAiB;IACzC,OAAO,MAAM;SACV,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC;SAC9B,GAAG,CAAC,CAAC,CAAY,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SAC/B,MAAM,CAAC,CAAC,CAAY,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAC5C,CAAC;AAsBD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,UAA0C,EAAE;IACxF,MAAM,EAAE,GAAG,GAAG,YAAY,EAAE,EAAE,UAAU,GAAG,aAAa,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;IAEjF,4DAA4D;IAC5D,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAE1D,gDAAgD;IAChD,MAAM,eAAe,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,SAAS,SAAS,CAAC,CAAC,CAAC;IACtF,MAAM,cAAc,GAAG,gBAAgB,CAAC,eAAe,CAAC,CAAC;IAEzD,+CAA+C;IAC/C,MAAM,cAAc,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;IAC9D,MAAM,aAAa,GAAG,gBAAgB,CAAC,cAAc,CAAC,CAAC;IAEvD,mCAAmC;IACnC,MAAM,eAAe,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACtF,MAAM,cAAc,GAAG,gBAAgB,CAAC,eAAe,CAAC,CAAC;IAEzD,gDAAgD;IAChD,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,cAAc,EAAE,GAAG,aAAa,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;IAExF,2BAA2B;IAC3B,IAAI,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAEpD,iCAAiC;IACjC,IAAI,UAAU,EAAE,CAAC;QACf,aAAa,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;IACxE,CAAC;IAED,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,6BAA6B,CAC3C,iBAA4B,EAC5B,aAAwB;IAExB,sDAAsD;IACtD,MAAM,gBAAgB,GAAG,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,aAAa,GAAG,CAAC;IAE3F,OAAO,iBAAiB;SACrB,MAAM,CAAC,CAAC,QAAmB,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;SACtE,GAAG,CAAC,CAAC,QAAmB,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;AAC3E,CAAC"}

package/dist/incremental-test.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Glob patterns to exclude slow integration/golden tests from changed runs.
+ * @type {string[]}
+ */
+export declare const VITEST_CHANGED_EXCLUDES: readonly string[];
+/**
+ * File extensions considered executable code for test runs.
+ * @type {string[]}
+ */
+export declare const CODE_FILE_EXTENSIONS: readonly string[];
+/**
+ * Check if a path points to a code file that should trigger full tests.
+ *
+ * @param {string} filePath - Path to check
+ * @returns {boolean} True if the path has a code extension
+ */
+export declare function isCodeFilePath(filePath: UnsafeAny): boolean;
+/**
+ * Options for building Vitest changed args
+ */
+interface BuildVitestChangedArgsOptions {
+    /** Base branch for diff */
+    baseBranch?: string;
+}
+/**
+ * Build Vitest CLI args for --changed runs.
+ *
+ * @param {BuildVitestChangedArgsOptions} [options]
+ * @returns {string[]} Vitest args for changed test runs
+ */
+export declare function buildVitestChangedArgs(options?: BuildVitestChangedArgsOptions): string[];
+export {};
+//# sourceMappingURL=incremental-test.d.ts.map

package/dist/incremental-test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"incremental-test.d.ts","sourceRoot":"","sources":["../src/incremental-test.ts"],"names":[],"mappings":"AAaA;;;GAGG;AACH,eAAO,MAAM,uBAAuB,mBAA8D,CAAC;AAEnG;;;GAGG;AACH,eAAO,MAAM,oBAAoB,mBAS/B,CAAC;AAEH;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,SAAS,WAOjD;AAED;;GAEG;AACH,UAAU,6BAA6B;IACrC,2BAA2B;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,GAAE,6BAAkC,YAgBjF"}