@mmnto/totem 1.53.3 → 1.53.4

package/dist/parity-detect.js

@@ -0,0 +1,478 @@
+/**
+ * Version-pinned parity drift detector (PR-1, mmnto-ai/totem#2069).
+ *
+ * First detection slice on top of the merged manifest-parser skeleton (#2070).
+ * Senses ONE tractability class — `version-pinned` — and only its DEPS subset
+ * (the four `@mmnto/*` cohort-floor contracts: `mmnto-cli-version`,
+ * `mmnto-totem-version`, `mmnto-mcp-version`,
+ * `mmnto-pack-rust-architecture-version`). The verdict is **pin currency only**
+ * (Tenet 20 claim-class bound): does the consumer's `@mmnto/*` pin resolve to
+ * the current published cohort floor? It NEVER asserts semantic / file-content
+ * drift — that would over-claim the `version-pinned` class.
+ *
+ * Layering: core must NOT import cli's `DiagnosticResult` (wrong dependency
+ * direction). This module returns a core-local `ParityContractVerdict`; the CLI
+ * (`doctor-parity.ts`) maps it to `DiagnosticResult` and owns the
+ * `--strict`/`blocking` fail-promotion. The detector itself returns ONLY
+ * `pass`/`warn`/`skip` — never `fail` — so the gate edge stays a CLI concern.
+ *
+ * Design invariants (mirroring `parity-manifest.ts` + `strategy-resolver.ts`):
+ *   - **Honest-absent (Tenet 14):** absence is never an error. Not-a-consumer,
+ *     floor-unresolvable, or a doctrine pin this slice doesn't handle → `skip`
+ *     (the manifest's `-` "cohort permits absence"). An *applicable* consumer
+ *     missing an expected pin is also `skip` while the manifest is scaffold, but
+ *     kept DISTINCT (expected-but-absent → a `warn` once the consumers lists are
+ *     verified) so the `consumers` field still catches the missing case. Never a
+ *     fabricated verdict.
+ *   - **NEVER networks:** the cohort floor is derived LOCALLY — self-in-tree
+ *     (the totem monorepo at the current git root) or a `../totem` sibling
+ *     checkout. Neither reachable → honest-absent `skip` with a reason.
+ *   - **Side-effect-free / no caching:** every call reads from scratch. Each
+ *     filesystem / git seam is injectable so tests drive synthetic fixtures.
+ *   - **Never throws:** every read failure degrades to a `skip`/`warn` verdict;
+ *     the sensor must never crash the doctor pipeline.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import semver from 'semver';
+import { safeExec } from './sys/exec.js';
+import { resolveGitRoot } from './sys/git.js';
+// ─── Constants ──────────────────────────────────────────
+/**
+ * Fixed scope for every PR-1 deps contract. The id slug (`mmnto-<x>-version`)
+ * is the literal middle of the package name `@mmnto/<x>`; the scope is constant.
+ */
+const MMNTO_SCOPE = '@mmnto/';
+/** The `mmnto-…-version` id convention PR-1 maps to a deps package name. */
+const DEPS_CONTRACT_ID = /^mmnto-(.+)-version$/;
+/** Sibling totem-monorepo dirname probed for a cohort floor (mirrors `resolveStrategyRoot` layer 3). */
+const SIBLING_TOTEM_DIRNAME = 'totem';
+/** Bounded git-command timeout for the origin-remote probe (matches `sys/git.ts`). */
+const GIT_REMOTE_TIMEOUT_MS = 15_000;
+/**
+ * The dep fields, in resolution order, that a consumer can declare an `@mmnto/*`
+ * pin under. `dependencies` first so a normal runtime dep wins display, but the
+ * detector treats a declaration in ANY of these as "the pin is declared here."
+ */
+const DEP_FIELDS = ['dependencies', 'devDependencies', 'optionalDependencies'];
+/**
+ * Derive the current repo's cohort id (e.g. `totem-status`) used to evaluate a
+ * contract's `consumers` applicability. Precedence:
+ *   1. git `origin` remote — `…mmnto-ai/<name>(.git)?` → `<name>`.
+ *   2. `package.json` `name` basename (scope stripped) — `@mmnto/totem-status`
+ *      → `totem-status`.
+ *   3. git-root directory basename.
+ *
+ * Returns `undefined` only when nothing resolves. NEVER throws and NEVER
+ * networks beyond the local `git remote get-url` read (which is swallowed on
+ * failure — git being unavailable is a routine fall-through, not an error).
+ */
+export function deriveCohortRepoId(cwd, options = {}) {
+    // ── 1. git origin remote ──
+    const remoteUrl = readOriginRemote(cwd, options);
+    const fromRemote = repoIdFromRemoteUrl(remoteUrl);
+    if (fromRemote !== undefined)
+        return fromRemote;
+    // Anchor the fallbacks at the git root (not the deep cwd) so the dir-basename
+    // fallback names the repo, not a nested subdir. Lazy: only probed when the
+    // remote miss forces a fallback.
+    const root = resolveRootForFallback(cwd, options.gitRoot);
+    // ── 2. package.json name basename (scope stripped) ──
+    const fromPkg = repoIdFromPackageName(root);
+    if (fromPkg !== undefined)
+        return fromPkg;
+    // ── 3. git-root dir basename ──
+    const base = path.basename(root);
+    return base.length > 0 ? base : undefined;
+}
+/**
+ * Read the git `origin` remote URL, honoring the injected seams. A throwing
+ * reader (or a real git failure) is swallowed — the caller falls through to the
+ * package.json / dir-basename fallbacks.
+ */
+function readOriginRemote(cwd, options) {
+    if (options.readRemote !== undefined) {
+        try {
+            return options.readRemote(cwd);
+            // totem-context: an injected remote-reader that throws is treated as "no remote resolvable" (fall through to the package.json / dir-basename fallbacks); rethrowing would break the never-throws contract for a routine git miss.
+        }
+        catch {
+            return undefined;
+        }
+    }
+    if ('remoteUrl' in options)
+        return options.remoteUrl;
+    try {
+        return safeExec('git', ['remote', 'get-url', 'origin'], {
+            cwd,
+            timeout: GIT_REMOTE_TIMEOUT_MS,
+        });
+        // totem-context: a missing remote / non-git dir / absent git binary is a routine fall-through to the package.json + dir-basename fallbacks, not a sensor failure — the doctor runs against repos without an origin remote by design.
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Extract `<name>` from a `…mmnto-ai/<name>(.git)?` remote URL, else undefined. */
+function repoIdFromRemoteUrl(remoteUrl) {
+    if (typeof remoteUrl !== 'string' || remoteUrl.trim().length === 0)
+        return undefined;
+    // Match the org segment in both ssh (`git@…:mmnto-ai/x.git`) and https
+    // (`https://…/mmnto-ai/x.git`) forms; tolerate a trailing `.git` + slashes.
+    const match = remoteUrl.trim().match(/mmnto-ai\/([^/\s]+?)(?:\.git)?\/?$/);
+    return match?.[1];
+}
+/** Read `package.json` `name`, strip a leading `@scope/`, return the basename. */
+function repoIdFromPackageName(root) {
+    const name = readPackageName(path.join(root, 'package.json'));
+    if (name === undefined)
+        return undefined;
+    // `@mmnto/totem-status` → `totem-status`; `plain-name` → `plain-name`.
+    const slash = name.lastIndexOf('/');
+    const base = slash === -1 ? name : name.slice(slash + 1);
+    return base.length > 0 ? base : undefined;
+}
+/** Resolve the anchor for fallbacks: injected gitRoot, else `resolveGitRoot(cwd)`, else cwd. */
+function resolveRootForFallback(cwd, injected) {
+    if (injected !== undefined)
+        return injected ?? cwd;
+    try {
+        return resolveGitRoot(cwd) ?? cwd;
+        // totem-context: resolveGitRoot throws on permission errors / corrupted index; falling back to cwd keeps the dir-basename fallback working rather than crashing the sensor on a git hiccup.
+    }
+    catch {
+        return cwd;
+    }
+}
+// ─── packageNameForContract ─────────────────────────────
+/**
+ * Resolve the `@mmnto/*` (or vendor) package name a deps/vendor contract pins.
+ * Precedence:
+ *   1. **explicit `package:` field** (mmnto-ai/totem-strategy#517) — the
+ *      machine-parseable name, derive-not-guess. Preferred when present.
+ *   2. **canonical-source path locator** — when `canonicalSource` carries a
+ *      `:path/to/package.json` segment (e.g. `mmnto-cli-version`'s
+ *      `mmnto-ai/totem:packages/cli/package.json#version`), read the `name`
+ *      from that package.json under `floorRoot`. Authoritative — no id guess.
+ *   3. **id convention** — `mmnto-<x>-version` → `@mmnto/<x>` (fallback until all
+ *      contracts carry `package:`).
+ *
+ * Returns `undefined` for contracts with no `package:`, no path locator, and an
+ * id that doesn't match the convention (e.g. `governance-doctrine`, `gate-config`)
+ * so ONLY the contracts this slice handles resolve a name; the CLI keeps the rest
+ * as `skip` stubs.
+ *
+ * @param floorRoot Optional root the canonical-source path locator anchors at
+ *                  (the resolved cohort-floor repo). Omit when only `package:` /
+ *                  the id convention is wanted.
+ */
+export function packageNameForContract(contract, floorRoot) {
+    // ── 1. explicit `package:` field (derive-not-guess; strategy#517) ──
+    if (typeof contract.package === 'string' && contract.package.trim().length > 0) {
+        return contract.package.trim();
+    }
+    // ── 2. canonical-source path locator → read `name` from that package.json ──
+    if (floorRoot !== undefined) {
+        const fromLocator = packageNameFromCanonicalSource(contract.canonicalSource, floorRoot);
+        if (fromLocator !== undefined)
+            return fromLocator;
+    }
+    // ── 3. id convention (mmnto-<x>-version → @mmnto/<x>) ──
+    const match = contract.id.match(DEPS_CONTRACT_ID);
+    if (match?.[1] === undefined)
+        return undefined;
+    // Concatenate (not template-interpolate) so the `@mmnto/` scope's own trailing
+    // `/` reads as the delimiter between scope and package slug.
+    return MMNTO_SCOPE + match[1];
+}
+/**
+ * Read the `name` from the package.json referenced by a `repo:path#fragment`
+ * canonical-source locator, anchored at `floorRoot`. Returns undefined when the
+ * locator has no `:package.json` path segment or the file is unreadable.
+ */
+function packageNameFromCanonicalSource(canonicalSource, floorRoot) {
+    if (typeof canonicalSource !== 'string')
+        return undefined;
+    // Shape: `<repo>:<path>#<fragment>` — we only want the `<path>` between the
+    // first `:` and an optional `#`. A bare `mmnto-ai/totem` (no `:`) has no path.
+    const colon = canonicalSource.indexOf(':');
+    if (colon === -1)
+        return undefined;
+    const afterColon = canonicalSource.slice(colon + 1);
+    const hash = afterColon.indexOf('#');
+    const relPath = (hash === -1 ? afterColon : afterColon.slice(0, hash)).trim();
+    if (!relPath.endsWith('package.json'))
+        return undefined;
+    return readPackageName(path.join(floorRoot, relPath));
+}
+/**
+ * Resolve the "current published version" cohort floor for `packageName`,
+ * derived LOCALLY (NEVER networks), in precedence order:
+ *   (a) **self-in-tree** — the current git root IS the canonical-source repo
+ *       (the totem monorepo): glob `<gitRoot>/packages/*​/package.json`, find
+ *       the one whose `name === packageName`, read its `version`.
+ *   (b) **sibling** — `<gitRoot>/../totem` exists as a directory: glob its
+ *       `packages/*​/package.json` the same way.
+ *   (c) **honest-absent** — neither reachable → `{ resolved: false, reason }`.
+ *
+ * NEVER fabricates a floor and NEVER fetches. Anchors at `gitRoot`, not cwd
+ * (mirroring `strategy-resolver.ts`). Read failures within the glob are
+ * swallowed per-file so one corrupt package.json can't crash the resolver.
+ *
+ * The floor is keyed structurally on `packageName` (the matching
+ * `packages/*​/package.json` `name`), NOT on the consumer's cohort id — a
+ * misderived repoId can't mask a genuine in-tree floor.
+ */
+export function resolveCohortFloor(packageName, gitRoot) {
+    // ── (a) self-in-tree ──
+    // The canonical-source repo for every deps contract is the totem monorepo. If
+    // the current repo IS that monorepo, its own packages/*/package.json is the
+    // floor. We detect "is the monorepo" structurally (a packages/*/package.json
+    // whose name === packageName), not just by id, so a misderived repoId can't
+    // mask a genuine in-tree floor.
+    const selfVersion = readVersionFromPackagesGlob(gitRoot, packageName);
+    if (selfVersion !== undefined) {
+        return { resolved: true, version: selfVersion, source: 'self-in-tree' };
+    }
+    // ── (b) sibling ../totem ──
+    const sibling = path.normalize(path.join(gitRoot, '..', SIBLING_TOTEM_DIRNAME));
+    if (isDirectory(sibling)) {
+        const siblingVersion = readVersionFromPackagesGlob(sibling, packageName);
+        if (siblingVersion !== undefined) {
+            return { resolved: true, version: siblingVersion, source: 'sibling' };
+        }
+    }
+    // ── (c) honest-absent ──
+    return {
+        resolved: false,
+        reason: `cohort floor for ${packageName} not locally determinable; clone mmnto-ai/totem as a sibling (../${SIBLING_TOTEM_DIRNAME}) or run from the totem monorepo`,
+    };
+}
+/**
+ * Glob `<root>/packages/*​/package.json`, return the `version` of the one whose
+ * `name === packageName`. Returns undefined when `<root>/packages` is absent,
+ * no package matches, or every read fails. Per-file read failures are swallowed
+ * so one corrupt manifest doesn't sink the whole probe.
+ */
+function readVersionFromPackagesGlob(root, packageName) {
+    const packagesDir = path.join(root, 'packages');
+    let names;
+    try {
+        names = fs.readdirSync(packagesDir);
+        // totem-context: an absent or unreadable packages/ dir is the "not the monorepo here" signal — return undefined so the resolver falls through to the sibling / honest-absent layer rather than throwing.
+    }
+    catch {
+        return undefined;
+    }
+    for (const name of names) {
+        const entryPath = path.join(packagesDir, name);
+        // Use the statSync-based `isDirectory` (follows symlinks) rather than a
+        // `Dirent.isDirectory()` filter — pnpm / workspace setups symlink package
+        // dirs, which the lstat-like Dirent check reports as non-directories and
+        // would skip (GCA review #2071).
+        if (!isDirectory(entryPath))
+            continue;
+        const parsed = readPackageJson(path.join(entryPath, 'package.json'));
+        if (parsed?.name === packageName && typeof parsed.version === 'string') {
+            return parsed.version;
+        }
+    }
+    return undefined;
+}
+/**
+ * Detect drift for ONE `version-pinned` deps contract. Returns a
+ * `ParityContractVerdict`:
+ *   - **pass** — the consumer's resolved-installed `@mmnto/*` version is ≥ the
+ *     cohort floor (current).
+ *   - **warn** — installed < floor (stale pin). Sensor-not-gate default: the
+ *     detector returns `warn` even for a `blocking` contract; the CLI promotes
+ *     to `fail` only under `--strict`.
+ *   - **skip** — not-a-consumer / pin not declared / floor unresolvable / not a
+ *     deps contract this slice handles / unparseable range (honest-absent).
+ *
+ * NEVER emits `fail` (CLI-edge concern). NEVER throws (read failures degrade to
+ * `skip`). NEVER networks (floor is local-only). NEVER asserts content drift
+ * (claim-class bound to pin currency).
+ */
+export function detectVersionPinnedContract(contract, ctx) {
+    // ── Applicability: consumers list ──
+    if (contract.consumers !== undefined) {
+        if (ctx.repoId === undefined) {
+            // Can't decide applicability without a cohort id — surface it (honest-
+            // absent) rather than silently treating the contract as applicable, which
+            // would make the consumers scope a no-op for this repo (Tenet 4 / Greptile
+            // review #2071).
+            return {
+                status: 'skip',
+                message: `cannot determine applicability — repo id unresolvable; contract is scoped to consumers [${contract.consumers.join(', ')}]`,
+            };
+        }
+        if (!contract.consumers.includes(ctx.repoId)) {
+            return {
+                status: 'skip',
+                message: `cohort permits absence here (${ctx.repoId} not in consumers)`,
+            };
+        }
+    }
+    // ── Resolve the package name (`package:` → locator → id convention) ──
+    // Prefer a name pre-resolved by the CLI (avoids re-reading a locator's
+    // package.json — Greptile review #2071); fall back to resolving here for
+    // standalone callers (tests). gitRoot is the floorRoot for a path locator.
+    const packageName = ctx.packageName ?? packageNameForContract(contract, ctx.gitRoot);
+    if (packageName === undefined) {
+        return {
+            status: 'skip',
+            message: `not a deps version-pinned contract this slice handles (${contract.id})`,
+        };
+    }
+    // ── Read the consumer package.json + its declared range for this pkg ──
+    const readPkg = ctx.readPackageJson ?? readPackageJson;
+    const consumerPkg = readPkg(path.join(ctx.cwd, 'package.json'));
+    const declaredRange = consumerPkg ? findDeclaredRange(consumerPkg, packageName) : undefined;
+    if (declaredRange === undefined) {
+        // Applicable-but-missing: we already passed the `consumers` gate above, so
+        // this repo IS an applicable consumer (in `consumers`, or `consumers` absent
+        // = applies to all) — an expected pin that's absent is drift, NOT
+        // cohort-permitted absence. Held as
+        // a skip-with-note while the manifest is scaffold (consumers lists are
+        // best-effort); flips to `warn` once verified. Kept DISTINCT from the
+        // not-a-consumer skip so the `consumers` field still does its job (strategy
+        // ack 2026-06-03T0156Z, design-call 3).
+        return {
+            status: 'skip',
+            message: `${packageName} expected but not declared — applicable consumer (scaffold: skip; becomes a drift warn once consumers are verified)`,
+            remediation: `Declare ${packageName} in this repo's package.json, or drop this repo from the contract's consumers list if it genuinely does not apply here.`,
+        };
+    }
+    // Guard an unparseable declared range BEFORE resolving anything else — a
+    // garbage range can't yield a currency verdict, so honest-absent skip.
+    if (semver.validRange(declaredRange) === null) {
+        return {
+            status: 'skip',
+            message: `${packageName} declared range "${declaredRange}" is not a valid semver range`,
+        };
+    }
+    // ── Resolve the consumer's installed version (fallback: minVersion(range)) ──
+    const installed = resolveInstalledVersion(ctx.cwd, packageName, declaredRange);
+    if (installed === undefined) {
+        return {
+            status: 'skip',
+            message: `${packageName} pinned (${declaredRange}) but no resolvable installed version`,
+        };
+    }
+    // ── Resolve the cohort floor (local-only; honest-absent on miss) ──
+    const floor = resolveCohortFloor(packageName, ctx.gitRoot);
+    if (!floor.resolved) {
+        return { status: 'skip', message: floor.reason };
+    }
+    // Guard an invalid floor version (corrupt in-tree manifest) → honest-absent.
+    if (semver.valid(floor.version) === null) {
+        return {
+            status: 'skip',
+            message: `cohort floor for ${packageName} ("${floor.version}") is not a valid version`,
+        };
+    }
+    // ── Verdict: pin currency only (semver compare) ──
+    // installed ≥ floor → current; installed < floor → stale. The claim is pin
+    // currency, NOT semantic content — a version-pinned contract may never assert
+    // file/content equality.
+    if (semver.gte(installed, floor.version)) {
+        return {
+            status: 'pass',
+            message: `${packageName} pin current — installed ${installed} ≥ cohort floor ${floor.version} (${floor.source})`,
+        };
+    }
+    return {
+        status: 'warn',
+        message: `${packageName} pin stale — declared ${declaredRange}, installed ${installed} < cohort floor ${floor.version} (${floor.source})`,
+        remediation: `Bump the ${packageName} dependency to >= ${floor.version} and reinstall, then re-run totem doctor --parity.`,
+    };
+}
+/**
+ * Resolve the consumer's installed `@mmnto/*` version. Walks UP the directory
+ * tree from `cwd` reading `<dir>/node_modules/<pkg>/package.json#version` at each
+ * ancestor — monorepo / pnpm / npm-workspace installs hoist deps to a parent or
+ * root `node_modules` rather than the sub-package's, so a cwd-only read would
+ * miss them (GCA review #2071). Mirrors Node's own upward node_modules
+ * resolution. On no hit, falls back to `semver.minVersion(declaredRange)` (the
+ * floor the caret range implies). Returns undefined only when neither resolves
+ * to a valid version.
+ */
+function resolveInstalledVersion(cwd, packageName, declaredRange) {
+    const segments = packageName.split('/');
+    let dir = path.resolve(cwd);
+    for (;;) {
+        const installedPkg = readPackageJson(path.join(dir, 'node_modules', ...segments, 'package.json'));
+        if (installedPkg?.version !== undefined && semver.valid(installedPkg.version) !== null) {
+            return installedPkg.version;
+        }
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            break; // reached the filesystem root
+        dir = parent;
+    }
+    // Fallback: the minimum version the declared range admits. `minVersion`
+    // returns a SemVer or null; coerce to the bare version string.
+    const min = semver.minVersion(declaredRange);
+    return min?.version;
+}
+/** Find the declared range for `packageName` across the three dep fields, in order. */
+function findDeclaredRange(pkg, packageName) {
+    for (const field of DEP_FIELDS) {
+        // `pkg` is loose untrusted JSON; optional-chain the field read so a missing
+        // or non-object dep section yields undefined instead of throwing, then
+        // type-check the value itself. Avoids a null-guard idiom that two compiled
+        // rules disagree on.
+        const range = pkg[field]?.[packageName];
+        if (typeof range === 'string' && range.trim().length > 0)
+            return range;
+    }
+    return undefined;
+}
+// ─── Shared filesystem helpers ──────────────────────────
+/**
+ * Read + JSON-parse a package.json into the loose {@link PackageJsonShape}.
+ * Returns undefined on any read / parse failure or a non-object payload —
+ * mirroring `readEngineRange`'s ENOENT-tolerant JSON read so a missing or
+ * corrupt manifest is honest-absent, never a throw.
+ */
+function readPackageJson(absPath) {
+    let raw;
+    try {
+        raw = fs.readFileSync(absPath, 'utf-8');
+        // totem-context: a missing / unreadable package.json is the honest-absent signal callers degrade to a skip on; rethrowing would force every caller to wrap a routine absence in try/catch.
+    }
+    catch {
+        return undefined;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+        // totem-context: a corrupt package.json degrades to undefined (honest-absent skip), not a crash — the sensor must never sink the doctor pipeline on a malformed consumer manifest.
+    }
+    catch {
+        return undefined;
+    }
+    if (typeof parsed !== 'object' || parsed === null)
+        return undefined;
+    return parsed;
+}
+/** Read just the `name` from a package.json, or undefined on any failure. */
+function readPackageName(absPath) {
+    const parsed = readPackageJson(absPath);
+    return typeof parsed?.name === 'string' ? parsed.name : undefined;
+}
+/**
+ * `fs.statSync` raises on missing paths and on EACCES/ENOTDIR; treat any stat
+ * failure as "not a directory" (mirrors `strategy-resolver.ts`).
+ */
+function isDirectory(p) {
+    try {
+        return fs.statSync(p).isDirectory();
+        // totem-context: stat failures (ENOENT, EACCES, ENOTDIR) are the sibling-miss signal; rethrowing would force the resolver to wrap a routine absence in try/catch.
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=parity-detect.js.map

package/dist/parity-detect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parity-detect.js","sourceRoot":"","sources":["../src/parity-detect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,MAAM,MAAM,QAAQ,CAAC;AAG5B,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE9C,2DAA2D;AAE3D;;;GAGG;AACH,MAAM,WAAW,GAAG,SAAS,CAAC;AAE9B,4EAA4E;AAC5E,MAAM,gBAAgB,GAAG,sBAAsB,CAAC;AAEhD,wGAAwG;AACxG,MAAM,qBAAqB,GAAG,OAAO,CAAC;AAEtC,sFAAsF;AACtF,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAErC;;;;GAIG;AACH,MAAM,UAAU,GAAG,CAAC,cAAc,EAAE,iBAAiB,EAAE,sBAAsB,CAAU,CAAC;AAoCxF;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAChC,GAAW,EACX,UAAqC,EAAE;IAEvC,6BAA6B;IAC7B,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACjD,MAAM,UAAU,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IAClD,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,UAAU,CAAC;IAEhD,8EAA8E;IAC9E,2EAA2E;IAC3E,iCAAiC;IACjC,MAAM,IAAI,GAAG,sBAAsB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAE1D,uDAAuD;IACvD,MAAM,OAAO,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IAE1C,iCAAiC;IACjC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACjC,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5C,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,GAAW,EAAE,OAAkC;IACvE,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,OAAO,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAC/B,kOAAkO;QACpO,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IACD,IAAI,WAAW,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC,SAAS,CAAC;IACrD,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE;YACtD,GAAG;YACH,OAAO,EAAE,qBAAqB;SAC/B,CAAC,CAAC;QACH,qOAAqO;IACvO,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,oFAAoF;AACpF,SAAS,mBAAmB,CAAC,SAA6B;IACxD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACrF,uEAAuE;IACvE,4EAA4E;IAC5E,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAC3E,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AAED,kFAAkF;AAClF,SAAS,qBAAqB,CAAC,IAAY;IACzC,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC;IAC9D,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzC,uEAAuE;IACvE,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACzD,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5C,CAAC;AAED,gGAAgG;AAChG,SAAS,sBAAsB,CAAC,GAAW,EAAE,QAAmC;IAC9E,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,IAAI,GAAG,CAAC;IACnD,IAAI,CAAC;QACH,OAAO,cAAc,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC;QAClC,4LAA4L;IAC9L,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC;AAED,2DAA2D;AAE3D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAAwB,EACxB,SAAkB;IAElB,sEAAsE;IACtE,IAAI,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ,IAAI,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/E,OAAO,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IACjC,CAAC;IAED,8EAA8E;IAC9E,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,WAAW,GAAG,8BAA8B,CAAC,QAAQ,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;QACxF,IAAI,WAAW,KAAK,SAAS;YAAE,OAAO,WAAW,CAAC;IACpD,CAAC;IAED,0DAA0D;IAC1D,MAAM,KAAK,GAAG,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAClD,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC/C,+EAA+E;IAC/E,6DAA6D;IAC7D,OAAO,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,SAAS,8BAA8B,CACrC,eAA8B,EAC9B,SAAiB;IAEjB,IAAI,OAAO,eAAe,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC1D,4EAA4E;IAC5E,+EAA+E;IAC/E,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,KAAK,KAAK,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACnC,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9E,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;QAAE,OAAO,SAAS,CAAC;IACxD,OAAO,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;AACxD,CAAC;AAgBD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,kBAAkB,CAAC,WAAmB,EAAE,OAAe;IACrE,yBAAyB;IACzB,8EAA8E;IAC9E,4EAA4E;IAC5E,6EAA6E;IAC7E,4EAA4E;IAC5E,gCAAgC;IAChC,MAAM,WAAW,GAAG,2BAA2B,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACtE,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAC1E,CAAC;IAED,6BAA6B;IAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,qBAAqB,CAAC,CAAC,CAAC;IAChF,IAAI,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,MAAM,cAAc,GAAG,2BAA2B,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACzE,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACxE,CAAC;IACH,CAAC;IAED,0BAA0B;IAC1B,OAAO;QACL,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,oBAAoB,WAAW,oEAAoE,qBAAqB,kCAAkC;KACnK,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,2BAA2B,CAAC,IAAY,EAAE,WAAmB;IACpE,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAChD,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QACpC,yMAAyM;IAC3M,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QAC/C,wEAAwE;QACxE,0EAA0E;QAC1E,yEAAyE;QACzE,iCAAiC;QACjC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC;YAAE,SAAS;QACtC,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;QACrE,IAAI,MAAM,EAAE,IAAI,KAAK,WAAW,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACvE,OAAO,MAAM,CAAC,OAAO,CAAC;QACxB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAsCD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,2BAA2B,CACzC,QAAwB,EACxB,GAA+B;IAE/B,sCAAsC;IACtC,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACrC,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,uEAAuE;YACvE,0EAA0E;YAC1E,2EAA2E;YAC3E,iBAAiB;YACjB,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,2FAA2F,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;aACrI,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7C,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,gCAAgC,GAAG,CAAC,MAAM,oBAAoB;aACxE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,uEAAuE;IACvE,yEAAyE;IACzE,2EAA2E;IAC3E,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,IAAI,sBAAsB,CAAC,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IACrF,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO;YACL,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,0DAA0D,QAAQ,CAAC,EAAE,GAAG;SAClF,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,MAAM,OAAO,GAAG,GAAG,CAAC,eAAe,IAAI,eAAe,CAAC;IACvD,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC;IAChE,MAAM,aAAa,GAAG,WAAW,CAAC,CAAC,CAAC,iBAAiB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5F,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,2EAA2E;QAC3E,6EAA6E;QAC7E,kEAAkE;QAClE,oCAAoC;QACpC,uEAAuE;QACvE,sEAAsE;QACtE,4EAA4E;QAC5E,wCAAwC;QACxC,OAAO;YACL,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG,WAAW,qHAAqH;YAC5I,WAAW,EAAE,WAAW,WAAW,yHAAyH;SAC7J,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,uEAAuE;IACvE,IAAI,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,KAAK,IAAI,EAAE,CAAC;QAC9C,OAAO;YACL,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG,WAAW,oBAAoB,aAAa,+BAA+B;SACxF,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,MAAM,SAAS,GAAG,uBAAuB,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;IAC/E,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO;YACL,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG,WAAW,YAAY,aAAa,uCAAuC;SACxF,CAAC;IACJ,CAAC;IAED,qEAAqE;IACrE,MAAM,KAAK,GAAG,kBAAkB,CAAC,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACpB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;IACnD,CAAC;IAED,6EAA6E;IAC7E,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;QACzC,OAAO;YACL,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,oBAAoB,WAAW,MAAM,KAAK,CAAC,OAAO,2BAA2B;SACvF,CAAC;IACJ,CAAC;IAED,oDAAoD;IACpD,2EAA2E;IAC3E,8EAA8E;IAC9E,yBAAyB;IACzB,IAAI,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,OAAO;YACL,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG,WAAW,4BAA4B,SAAS,mBAAmB,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,MAAM,GAAG;SACjH,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,GAAG,WAAW,yBAAyB,aAAa,eAAe,SAAS,mBAAmB,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,MAAM,GAAG;QACzI,WAAW,EAAE,YAAY,WAAW,qBAAqB,KAAK,CAAC,OAAO,oDAAoD;KAC3H,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,uBAAuB,CAC9B,GAAW,EACX,WAAmB,EACnB,aAAqB;IAErB,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5B,SAAS,CAAC;QACR,MAAM,YAAY,GAAG,eAAe,CAClC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,GAAG,QAAQ,EAAE,cAAc,CAAC,CAC5D,CAAC;QACF,IAAI,YAAY,EAAE,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;YACvF,OAAO,YAAY,CAAC,OAAO,CAAC;QAC9B,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM,CAAC,8BAA8B;QACzD,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,wEAAwE;IACxE,+DAA+D;IAC/D,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IAC7C,OAAO,GAAG,EAAE,OAAO,CAAC;AACtB,CAAC;AAED,uFAAuF;AACvF,SAAS,iBAAiB,CAAC,GAAqB,EAAE,WAAmB;IACnE,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC/B,4EAA4E;QAC5E,uEAAuE;QACvE,2EAA2E;QAC3E,qBAAqB;QACrB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC;QACxC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;IACzE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,2DAA2D;AAE3D;;;;;GAKG;AACH,SAAS,eAAe,CAAC,OAAe;IACtC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxC,2LAA2L;IAC7L,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzB,mLAAmL;IACrL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACpE,OAAO,MAA0B,CAAC;AACpC,CAAC;AAED,6EAA6E;AAC7E,SAAS,eAAe,CAAC,OAAe;IACtC,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACxC,OAAO,OAAO,MAAM,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACpE,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,CAAS;IAC5B,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACpC,kKAAkK;IACpK,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/parity-detect.test.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Tests for the version-pinned parity drift detector (PR-1,
+ * mmnto-ai/totem#2069 on top of skeleton #2070).
+ *
+ * The detector is pure + side-effect-free: every filesystem / git seam is
+ * injectable so these tests drive it against synthetic fixtures, NOT the live
+ * cohort. Each invariant from the spec's "Invariants to lock via tests" list
+ * gets a case: pass / warn / fail-under-blocking+strict (the fail-promotion is a
+ * CLI-edge concern — the detector itself only ever returns warn here) / skip on
+ * not-declared / skip on not-a-consumer / skip on floor-unresolved /
+ * no-throw-on-read-failure / never-networks / claim-class-bound (pin currency
+ * only, never content equality).
+ *
+ * Mirrors the temp-file + discriminated-union style of `parity-manifest.test.ts`
+ * and the injected-seam style of `strategy-resolver.test.ts`.
+ */
+export {};
+//# sourceMappingURL=parity-detect.test.d.ts.map

package/dist/parity-detect.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parity-detect.test.d.ts","sourceRoot":"","sources":["../src/parity-detect.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG"}